feat(server): sync thread read status across clients

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.

[t3dotgg]

Thread read and unread state lived in web local storage, so browsers and devices could disagree about which completed threads had been seen.

This moves lastViewedAt into the event-sourced server projection and adds server-owned mark-viewed and mark-unread commands. Web and mobile now update the shared state, older servers are capability-gated, and view updates do not touch updatedAt or reorder threads. Existing threads remain read by default after migration.

Verified with focused decider, projection, persistence, command, reducer, sidebar, and UI-state tests (177 passing), plus scoped typechecks for contracts, client-runtime, server, web, and mobile.

Built with GPT-5.6-sol via the Codex harness in T3 Code.

---

Note

Medium Risk
Touches orchestration commands, projection, and migration backfill; upgrade backfill can briefly change unread semantics for existing threads until users view them again.

Overview
Thread read/unread state moves from per-browser local storage to the server, so web and mobile share the same lastViewedAt and sidebar badges stay consistent across devices.

The server gains threadViewStatus capability, thread.mark-viewed / thread.mark-unread commands, thread.view-status-updated events, and last_viewed_at on projection_threads (migration 041 backfills existing rows at upgrade time). The decider enforces optimistic concurrency on mark-viewed and never moves view timestamps backward; view updates do not bump updatedAt.

Clients call threadEnvironment.markViewed / markUnread when the capability is present (mobile on screen focus, web on open thread / wake ack / settle-archive paths). uiStateStore drops threadLastVisitedAtById; unread, “Woke”, and mark-unread menus use thread.lastViewedAt and hasUnseenWake. Client-runtime wires markViewed with queued supersededViewedAt for serialized views.

^{Reviewed by Cursor Bugbot for commit 19b837e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Sync thread read/unread status across clients via server-owned view status

• Adds thread.mark-viewed and thread.mark-unread commands to the orchestration layer, with a thread.view-status-updated event and lastViewedAt field persisted on threads in projection_threads.
• Removes client-local read tracking (markThreadVisited, threadLastVisitedAtById) from uiStateStore; unread/woke indicators now derive from server-provided lastViewedAt.
• Exposes a threadViewStatus capability flag from the server; all mark-viewed/mark-unread UI actions (sidebar context menus, wake acknowledgement, archive/settle) are gated on this capability and fall back gracefully when unsupported.
• Adds migration 041_ProjectionThreadsLastViewedAt to add last_viewed_at to projection_threads and backfill existing rows with the current time.
• Risk: Existing persisted threadLastVisitedAtById data in localStorage is silently dropped on next load; read state is reset to server state for all users after upgrade.

^{Macroscope summarized 19b837e.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 62199432-964b-4132-ba27-efffcc0117d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	+16 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−15 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+31 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+19 B (+0.3%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.8 KiB	+12 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: db1507e · PR result: 19b837e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.7 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. This PR introduces a new feature for server-synchronized thread read/unread status, including new commands, events, database migrations, and schema changes. The scope involves significant new runtime behavior. An unresolved Medium severity finding identifies a potential issue where clients can submit far-future timestamps to mark all future completions as read.

^{You can customize Macroscope's approvability policy. Learn more.}

[t3dotgg]

Terrible when compared to #5652

[t3dotgg]

Wrong pr my bad, too many tabs lol

[macroscopeapp]

🟡 Mediumsrc/orchestration.ts:674

ThreadMarkViewedCommand.viewedAt is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied IsoDateTime. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file @packages/contracts/src/orchestration.ts around line 674:
`ThreadMarkViewedCommand.viewedAt` is documented as a server-owned boundary copied from thread completion/wake state, but the schema accepts any client-supplied `IsoDateTime`. Because the decider persists this value directly (only comparing it against the previous one), a client can submit a far-future timestamp and make all subsequent completions and wakes appear already read. The server should derive or validate this boundary against actual thread state rather than trusting the client value.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0125c6f. Configure here.}

[t3dotgg]

Note

🤖 Claude Fable 5.1 responding on behalf of Theo

Closing in favor of #6662, which is the same feature carried further.

Both PRs move thread read state into a server-owned projection column with mark-viewed and mark-unread commands behind a capability flag. #6662 also has, and this branch does not:

• viewedThrough capping and rejection of malformed timestamps in the decider
• Agent awareness relay suppression for viewedAt-only meta updates
• Optimistic pending state on web that reconciles after a rejected or failed command
• A focus-latched acknowledger so an explicit mark-unread survives alt-tab
• Mobile acks gated on route focus, app state, and connection
• A dedicated client scheduler so view writes never block turn or archive commands

This branch is 472 commits behind main with 21 conflicting files, and its migration 041 now collides with 041_AuthSessionClientConnection on main. Rebasing it would cost more than the delta is worth. #6662 has been through two full review passes and only needs a rebase and a migration renumber to 043.