From 8be19ed3f1f22837edb94dfd9324555fae042c24 Mon Sep 17 00:00:00 2001
From: astarktc <148526207+astarktc@users.noreply.github.com>
Date: Tue, 3 Nov 2026 10:27:13 -0600
Subject: [PATCH 001/167] fix(pi): short-lived Pi processes no longer lose
 rotated OAuth tokens (#30187)

---
 .../provider-pi/src/server/adapter.test.ts    |  4 +++
 packages/provider-pi/src/server/adapter.ts    |  1 +
 .../provider-pi/src/server/driver.test.ts     | 11 +++++++
 .../src/server/mcpInjection.test.ts           | 11 +++++++
 .../provider-pi/src/server/mcpInjection.ts    |  4 +++
 packages/provider-pi/src/server/status.ts     |  1 +
 .../src/server/textGeneration.test.ts         | 30 +++++++++++++++++++
 .../provider-pi/src/server/textGeneration.ts  |  1 +
 8 files changed, 63 insertions(+)

diff --git a/packages/provider-pi/src/server/adapter.test.ts b/packages/provider-pi/src/server/adapter.test.ts
index 0afd6960485de..dc994f90cac5a 100644
--- a/packages/provider-pi/src/server/adapter.test.ts
+++ b/packages/provider-pi/src/server/adapter.test.ts
@@ -1591,6 +1591,9 @@ describe("PiAdapterV2", () => {
         arg === "--extension" ? [spawn.args[index + 1]] : [],
       );
       assert.isFalse(spawn.args.includes("--no-extensions"));
+      // A thread's long-lived process keeps Pi's startup model refresh unless the user opts out.
+      assert.notInclude(spawn.args, "--offline");
+      assert.isUndefined(spawn.env.PI_OFFLINE);
       assert.isTrue(extensions.some((path) => path?.endsWith("pi-t3-mcp-extension.ts")));
       assert.equal(spawn.env.T3_MCP_URL, "http://127.0.0.1:43123/mcp");
       assert.equal(spawn.env.T3_MCP_BEARER_TOKEN, "secret-pi-token");
@@ -1891,6 +1894,7 @@ describe("PiAdapterV2", () => {
       assert.equal(args[args.indexOf("--fork") + 1], FAKE_SESSION_FILE);
       assert.include(args, "--no-extensions");
       assert.include(args, "--no-tools");
+      assert.include(args, "--offline");
       assert.notInclude(args, "--no-session");
       assert.deepEqual(
         forkFake
diff --git a/packages/provider-pi/src/server/adapter.ts b/packages/provider-pi/src/server/adapter.ts
index b7045bcd64360..a8e140f02b784 100644
--- a/packages/provider-pi/src/server/adapter.ts
+++ b/packages/provider-pi/src/server/adapter.ts
@@ -3103,6 +3103,7 @@ export const makePiAdapterV2 = Effect.fn("makePiAdapterV2")(function* (
               environment: options.environment,
               mcpSession: undefined,
               extensionPath: undefined,
+              shortLived: true,
               disableExtensions: true,
               disableTools: true,
             });
diff --git a/packages/provider-pi/src/server/driver.test.ts b/packages/provider-pi/src/server/driver.test.ts
index 087a8089aaee8..59586fdaedb39 100644
--- a/packages/provider-pi/src/server/driver.test.ts
+++ b/packages/provider-pi/src/server/driver.test.ts
@@ -169,6 +169,17 @@ it.layer(layerTest)("PiDriver workspace discovery", (it) => {
         ["--approve", "--skill", "extra skill", "--no-session"],
       );
       assert.equal(workspaceLaunch!.options.env?.PI_CODING_AGENT_DIR, "/isolated-pi");
+      // Discovery processes are stopped as soon as they answer, so neither may start Pi's
+      // network refresh at launch.
+      for (const cwd of ["/machine", "/first"]) {
+        const discovery = launches.find(
+          (launch) => launch.options.cwd === cwd && launch.args.includes("--mode"),
+        );
+        assert.deepEqual(
+          discovery?.args.filter((arg) => arg === "--offline"),
+          ["--offline"],
+        );
+      }
     }).pipe(Effect.scoped),
   );
 
diff --git a/packages/provider-pi/src/server/mcpInjection.test.ts b/packages/provider-pi/src/server/mcpInjection.test.ts
index 2ca5f35d026f5..4e776058a66a4 100644
--- a/packages/provider-pi/src/server/mcpInjection.test.ts
+++ b/packages/provider-pi/src/server/mcpInjection.test.ts
@@ -102,6 +102,7 @@ describe("pi T3 MCP injection", () => {
       extensionPath: "/tmp/cache/pi-t3-mcp-extension.ts",
       sessionPath: "/fake/persisted.jsonl",
       ephemeral: true,
+      shortLived: true,
       disableExtensions: true,
       disableTools: true,
     });
@@ -111,9 +112,19 @@ describe("pi T3 MCP injection", () => {
       "--no-session",
       "--provider",
       "anthropic",
+      "--offline",
       "--no-extensions",
       "--no-tools",
     ]);
+    const alreadyOffline = buildPiRpcLaunch({
+      launchArgs: ["--offline"],
+      environment: {},
+      mcpSession: undefined,
+      extensionPath: undefined,
+      ephemeral: true,
+      shortLived: true,
+    });
+    assert.deepEqual(alreadyOffline.args, ["--mode", "rpc", "--no-session", "--offline"]);
     assert.deepInclude(resolvePiLaunchArgs("--mode text"), {
       ok: false,
       message: "Pi launch argument '--mode' is controlled by T3 Code and cannot be overridden.",
diff --git a/packages/provider-pi/src/server/mcpInjection.ts b/packages/provider-pi/src/server/mcpInjection.ts
index 51848c424ca05..ab92ab73dde7a 100644
--- a/packages/provider-pi/src/server/mcpInjection.ts
+++ b/packages/provider-pi/src/server/mcpInjection.ts
@@ -244,6 +244,9 @@ export function buildPiRpcLaunch(input: {
   readonly extensionPath: string | undefined;
   readonly sessionPath?: string | undefined;
   readonly ephemeral?: boolean;
+  // T3 stops these processes as soon as they answer. They run --offline because Pi's startup
+  // catalog refresh renews expired OAuth tokens, and a stop mid-request loses the rotated one.
+  readonly shortLived?: boolean;
   readonly disableExtensions?: boolean;
   readonly disableTools?: boolean;
   readonly runtimeMode?: "approval-required" | "auto-accept-edits" | "auto" | "full-access";
@@ -268,6 +271,7 @@ export function buildPiRpcLaunch(input: {
         ? ["--session", input.sessionPath]
         : []),
     ...launchArgs,
+    ...(input.shortLived === true && !launchArgs.includes("--offline") ? ["--offline"] : []),
     // Restrictions must follow launch args so user flags cannot re-enable unattended tools/extensions.
     ...(input.disableExtensions === true ? ["--no-extensions"] : []),
     ...(input.disableTools === true ? ["--no-tools"] : []),
diff --git a/packages/provider-pi/src/server/status.ts b/packages/provider-pi/src/server/status.ts
index dfafa75ccd579..4775689c8c2b7 100644
--- a/packages/provider-pi/src/server/status.ts
+++ b/packages/provider-pi/src/server/status.ts
@@ -150,6 +150,7 @@ const makePiDiscoveryConnection = Effect.fnUntraced(function* (
     mcpSession: undefined,
     extensionPath: undefined,
     ephemeral: true,
+    shortLived: true,
   });
   const connection = yield* makePiRpcConnection({
     command: piSettings.binaryPath || "pi",
diff --git a/packages/provider-pi/src/server/textGeneration.test.ts b/packages/provider-pi/src/server/textGeneration.test.ts
index ba693da18012b..0e6a8a3c07780 100644
--- a/packages/provider-pi/src/server/textGeneration.test.ts
+++ b/packages/provider-pi/src/server/textGeneration.test.ts
@@ -7,6 +7,7 @@ import * as Queue from "effect/Queue";
 import * as Schema from "effect/Schema";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
+import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import { makePiTextGeneration } from "./textGeneration.ts";
@@ -68,6 +69,35 @@ const makeFakePi = (
     return { spawner, received };
   });
 
+it.effect("runs Pi offline, since the process is stopped as soon as it answers", () =>
+  Effect.gen(function* () {
+    const pi = yield* makeFakePi(JSON.stringify({ subject: "Update README", body: "" }));
+    const launches: Array<ReadonlyArray<string>> = [];
+    const spawner = ChildProcessSpawner.make((command) => {
+      if (ChildProcess.isStandardCommand(command)) launches.push(command.args.map(String));
+      return pi.spawner.spawn(command);
+    });
+    const textGeneration = yield* makePiTextGeneration(
+      { enabled: true, binaryPath: "pi", launchArgs: "", customModels: [] },
+      {},
+    ).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner));
+
+    const result = yield* textGeneration.generateCommitMessage({
+      cwd: process.cwd(),
+      branch: "main",
+      stagedSummary: "M README.md",
+      stagedPatch: "diff --git a/README.md b/README.md",
+      modelSelection: createModelSelection(ProviderInstanceId.make("pi"), "default"),
+    });
+
+    assert.equal(result.subject, "Update README");
+    assert.deepEqual(
+      launches.map((args) => args.filter((arg) => arg === "--offline")),
+      [["--offline"]],
+    );
+  }),
+);
+
 it.effect("names the model and the disabled extensions when Pi cannot load it", () =>
   Effect.gen(function* () {
     const pi = yield* makeFakePi("", "Model not found: demo/demo-model");
diff --git a/packages/provider-pi/src/server/textGeneration.ts b/packages/provider-pi/src/server/textGeneration.ts
index 3fed9963b6cea..40697f2d4280a 100644
--- a/packages/provider-pi/src/server/textGeneration.ts
+++ b/packages/provider-pi/src/server/textGeneration.ts
@@ -47,6 +47,7 @@ export const makePiTextGeneration = Effect.fn("makePiTextGeneration")(function*
         mcpSession: undefined,
         extensionPath: undefined,
         ephemeral: true,
+        shortLived: true,
         disableExtensions: true,
         // Background naming/content helpers must never mutate the workspace.
         disableTools: true,

From e27e12d9b4a408496be359e3e0db1844c6ea87af Mon Sep 17 00:00:00 2001
From: Utkarsh Patil <73941998+UtkarshUsername@users.noreply.github.com>
Date: Tue, 3 Nov 2026 21:57:58 +0530
Subject: [PATCH 002/167] feat(web): add refresh to provider status banners
 (#24861)

---
 apps/web/src/components/ChatView.tsx          |  1 +
 .../src/components/chat/ChatBannerLane.tsx    |  3 +
 .../components/chat/ProviderStatusBanner.tsx  | 69 +++++++++++++++----
 .../src/state/commandPermissions.test.ts      | 34 +++++++++
 .../contracts/src/clientRpcPermissions.ts     |  1 +
 5 files changed, 95 insertions(+), 13 deletions(-)

diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index 6ec89f8c36256..497ccfc877771 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -3367,6 +3367,7 @@ export default function ChatView(props: ChatViewProps) {
             <ThreadFind onClose={focusComposerStable} />
             {isWorkspaceFileDragActive ? <WorkspaceFileDropOverlay /> : null}
             <ChatBannerLane
+              environmentId={activeThread.environmentId}
               providerStatus={visibleProviderStatus}
               providerStatusBannerKey={providerStatusBannerKey}
               setDismissedProviderStatusBannerKey={setDismissedProviderStatusBannerKey}
diff --git a/apps/web/src/components/chat/ChatBannerLane.tsx b/apps/web/src/components/chat/ChatBannerLane.tsx
index 41ee46353f908..8d8a6cb01b839 100644
--- a/apps/web/src/components/chat/ChatBannerLane.tsx
+++ b/apps/web/src/components/chat/ChatBannerLane.tsx
@@ -1,4 +1,5 @@
 import type {
+  EnvironmentId,
   OrchestrationV2ProviderFailureClass,
   ProviderInstanceId,
   ServerProvider,
@@ -13,6 +14,7 @@ import { dismissThreadErrorBannerForSession, ThreadErrorBanner } from "./ThreadE
  * values, so a ChatView render that changes neither banner leaves both cached.
  */
 export function ChatBannerLane(props: {
+  environmentId: EnvironmentId;
   providerStatus: ServerProvider | null;
   providerStatusBannerKey: string | null;
   setDismissedProviderStatusBannerKey: Dispatch<SetStateAction<string | null>>;
@@ -41,6 +43,7 @@ export function ChatBannerLane(props: {
   return (
     <div className="chat-banner-lane pointer-events-none absolute top-0 z-30 flex flex-col">
       <ProviderStatusBanner
+        environmentId={props.environmentId}
         status={providerStatus}
         onDismiss={() => setDismissedProviderStatusBannerKey(providerStatusBannerKey)}
         onOpenProviderSetup={onOpenProviderSetup}
diff --git a/apps/web/src/components/chat/ProviderStatusBanner.tsx b/apps/web/src/components/chat/ProviderStatusBanner.tsx
index 0e258c10906ac..64afa55ed0d78 100644
--- a/apps/web/src/components/chat/ProviderStatusBanner.tsx
+++ b/apps/web/src/components/chat/ProviderStatusBanner.tsx
@@ -1,10 +1,18 @@
-import { type ProviderInstanceId, type ServerProvider } from "@t3tools/contracts";
-import { memo } from "react";
+import {
+  type EnvironmentId,
+  type ProviderInstanceId,
+  type ServerProvider,
+} from "@t3tools/contracts";
+import { useAtomValue } from "@effect/atom-react";
+import { memo, useRef, useState } from "react";
 import { InfoIcon, XIcon } from "lucide-react";
 import { Alert, AlertAction, AlertDescription, AlertTitle } from "../ui/alert";
 import { Button, InlineButton } from "../ui/button";
 import { formatProviderDriverKindLabel } from "../../providerModels";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
+import { serverEnvironment } from "../../state/server";
+import { useAtomCommand } from "../../state/use-atom-command";
+import { RefreshIcon } from "../ui/refresh-icon";
 
 function getIncompatibleVersion(status: ServerProvider) {
   const compatibility = status.compatibilityAdvisory;
@@ -86,14 +94,35 @@ export function getProviderStatusMessage(status: ServerProvider): string {
 }
 
 export const ProviderStatusBanner = memo(function ProviderStatusBanner({
+  environmentId,
   onDismiss,
   onOpenProviderSetup,
   status,
 }: {
+  environmentId: EnvironmentId;
   onDismiss: () => void;
   onOpenProviderSetup?: (instanceId: ProviderInstanceId) => void;
   status: ServerProvider | null;
 }) {
+  const canRefresh = useAtomValue(serverEnvironment.refreshProviders.permissionAtom(environmentId));
+  const refreshProviders = useAtomCommand(serverEnvironment.refreshProviders, {
+    label: "Refresh provider status",
+  });
+  const refreshingRef = useRef(false);
+  const [isRefreshing, setIsRefreshing] = useState(false);
+
+  const refresh = async () => {
+    if (!status || !canRefresh || refreshingRef.current) return;
+    refreshingRef.current = true;
+    setIsRefreshing(true);
+    await refreshProviders({
+      environmentId,
+      input: { instanceId: status.instanceId, refreshModels: true },
+    });
+    refreshingRef.current = false;
+    setIsRefreshing(false);
+  };
+
   if (!status || getProviderStatusBannerKey(status) === null) {
     return null;
   }
@@ -121,17 +150,31 @@ export const ProviderStatusBanner = memo(function ProviderStatusBanner({
         <InfoIcon />
         <AlertTitle>{title}</AlertTitle>
         <AlertDescription>
-          <Tooltip>
-            <TooltipTrigger render={<div className="line-clamp-3" />}>{message}</TooltipTrigger>
-            <TooltipPopup side="top" className="whitespace-pre-wrap">
-              {message}
-            </TooltipPopup>
-          </Tooltip>
-          {onOpenProviderSetup && hasProviderSetup(status) ? (
-            <InlineButton onClick={() => onOpenProviderSetup(status.instanceId)}>
-              Open provider setup
-            </InlineButton>
-          ) : null}
+          <div className="flex flex-col gap-2">
+            <Tooltip>
+              <TooltipTrigger render={<div className="line-clamp-3" />}>{message}</TooltipTrigger>
+              <TooltipPopup side="top" className="whitespace-pre-wrap">
+                {message}
+              </TooltipPopup>
+            </Tooltip>
+            <div className="flex flex-wrap items-center justify-end gap-3">
+              {onOpenProviderSetup && hasProviderSetup(status) ? (
+                <InlineButton onClick={() => onOpenProviderSetup(status.instanceId)}>
+                  Open provider setup
+                </InlineButton>
+              ) : null}
+              <Button
+                aria-label={`Refresh ${providerName} provider status`}
+                disabled={!canRefresh || isRefreshing}
+                onClick={() => void refresh()}
+                size="xs"
+                variant="outline"
+              >
+                <RefreshIcon />
+                {isRefreshing ? "Refreshing..." : "Refresh"}
+              </Button>
+            </div>
+          </div>
         </AlertDescription>
         <AlertAction>
           <Button
diff --git a/packages/client-runtime/src/state/commandPermissions.test.ts b/packages/client-runtime/src/state/commandPermissions.test.ts
index adfad46a41b89..f2ef2c5d02185 100644
--- a/packages/client-runtime/src/state/commandPermissions.test.ts
+++ b/packages/client-runtime/src/state/commandPermissions.test.ts
@@ -67,6 +67,40 @@ const setup = Effect.gen(function* () {
 });
 
 describe("command permissions", () => {
+  it.effect("requires the destination read grant to refresh providers", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const registry = yield* setup;
+        const refresh = createCommandPermissions(runtime, WS_METHODS.serverRefreshProviders);
+        registry.set(sessions(env), AsyncResult.success(grant(true)));
+        expect(registry.get(refresh.permissionAtom(env))).toBe(false);
+        expect((yield* refresh.authorize(registry, env).pipe(Effect.flip))._tag).toBe(
+          "EnvironmentAuthorizationError",
+        );
+        registry.set(
+          sessions(env),
+          AsyncResult.success({
+            ...grant(false),
+            scopes: [AuthOrchestrationReadScope],
+            permissions: [AuthOrchestrationReadScope],
+          }),
+        );
+        expect(registry.get(refresh.permissionAtom(env))).toBe(true);
+        yield* refresh.authorize(registry, env);
+        registry.set(sessions(other), AsyncResult.success(grant(false)));
+        expect(registry.get(refresh.permissionAtom(other))).toBe(false);
+        expect((yield* refresh.authorize(registry, other).pipe(Effect.flip))._tag).toBe(
+          "EnvironmentAuthorizationError",
+        );
+        registry.set(sessions(env), AsyncResult.success(grant(false)));
+        expect(registry.get(refresh.permissionAtom(env))).toBe(false);
+        expect((yield* refresh.authorize(registry, env).pipe(Effect.flip))._tag).toBe(
+          "EnvironmentAuthorizationError",
+        );
+      }),
+    ),
+  );
+
   it.effect("requires the destination preview grant to close a browser tab", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/packages/contracts/src/clientRpcPermissions.ts b/packages/contracts/src/clientRpcPermissions.ts
index c2488226191dc..91db78715551e 100644
--- a/packages/contracts/src/clientRpcPermissions.ts
+++ b/packages/contracts/src/clientRpcPermissions.ts
@@ -20,6 +20,7 @@ export const CLIENT_GUARDED_RPC_SCOPES = {
   [WS_METHODS.previewStopLocalServer]: AuthTerminalOperateScope,
   [WS_METHODS.serverRunStorageCleanup]: AuthSettingsWriteScope,
   [WS_METHODS.serverCheckOtlpEndpoint]: AuthSettingsWriteScope,
+  [WS_METHODS.serverRefreshProviders]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsRunAction]: AuthSourceControlWriteScope,
   [WS_METHODS.pullRequestsUpdate]: AuthSourceControlWriteScope,
   [WS_METHODS.pullRequestsComment]: AuthSourceControlWriteScope,

From 55ea365a8f167495e87c76da247be8bf47c5908a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 16:36:29 +0000
Subject: [PATCH 003/167] fix(server): side chats no longer open with a model
 switch from the parent's turn (#29752)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/orchestration-v2/Orchestrator.ts |  7 ++++++-
 .../ThreadFork.execution.test.ts                 | 16 ++++++++++++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 600764704e57f..59b708f5ba1cf 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -7274,7 +7274,12 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       ...(command.context ? { context: command.context } : {}),
       attachments: command.attachments,
       ...(run.contextHandoffId === null
-        ? modelSwitchSince(projection, modelSelection, sourceRun?.modelSelection)
+        ? modelSwitchSince(
+            projection,
+            modelSelection,
+            // Side chats do not show the parent's runs.
+            sideChatFork ? undefined : sourceRun?.modelSelection,
+          )
         : {}),
     };
     const activeHandoff = portableForkHandoff ?? mergeBackHandoff ?? providerSwitchHandoff;
diff --git a/apps/server/src/orchestration-v2/ThreadFork.execution.test.ts b/apps/server/src/orchestration-v2/ThreadFork.execution.test.ts
index 96c7263173f32..d955755e92122 100644
--- a/apps/server/src/orchestration-v2/ThreadFork.execution.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadFork.execution.test.ts
@@ -852,7 +852,11 @@ const forkSideChat = (commandId: string, sourceThreadId: ThreadId, targetThreadI
     });
   });
 
-const askSideChat = (threadId: ThreadId, commandId: string) =>
+const askSideChat = (
+  threadId: ThreadId,
+  commandId: string,
+  modelSelection?: (typeof forkCases)[number]["modelSelection"],
+) =>
   Effect.gen(function* () {
     const orchestrator = yield* Orchestrator.OrchestratorV2;
     yield* orchestrator.dispatch({
@@ -862,6 +866,7 @@ const askSideChat = (threadId: ThreadId, commandId: string) =>
       messageId: MessageId.make(commandId),
       text: "What is the main thread doing?",
       attachments: [],
+      ...(modelSelection === undefined ? {} : { modelSelection }),
       dispatchMode: { type: "start_immediately" },
       createdBy: "user",
       creationSource: "web",
@@ -954,10 +959,17 @@ it.effect("a side chat of an idle parent still starts with the framing note", ()
           query.includes("FROM orchestration_v2_projection_context_transfers"),
       ),
     );
-    yield* askSideChat(sideChatId, "side-chat-idle-first-message");
+    yield* askSideChat(sideChatId, "side-chat-idle-first-message", {
+      ...forkCases[0]!.modelSelection,
+      model: "side-chat-model",
+    });
 
     const started = yield* orchestrator.getThreadProjection(sideChatId);
     assert.isNotNull(started.providerThreads[0]?.forkedFrom);
+    // The side chat does not show the parent's run, so it is no baseline.
+    assert.isFalse(
+      started.turnItems.some((item) => item.type === "user_message" && item.modelSwitch),
+    );
     assert.lengthOf(started.contextHandoffs, 1);
     const [handoff] = started.contextHandoffs;
     assert.isTrue(

From b7ab02e0f6077a72cadfa5c9a40db4db67bc325f Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 16:40:20 +0000
Subject: [PATCH 004/167] fix(web): copied code blocks keep their blank lines
 in lists, quotes and longer fences (#29755)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/markdown-clipboard.test.ts | 26 ++++++++++++++++++++
 apps/web/src/markdown-clipboard.ts      | 32 ++++++++++++++-----------
 2 files changed, 44 insertions(+), 14 deletions(-)

diff --git a/apps/web/src/markdown-clipboard.test.ts b/apps/web/src/markdown-clipboard.test.ts
index b75291d47f769..ac7afbc8145ac 100644
--- a/apps/web/src/markdown-clipboard.test.ts
+++ b/apps/web/src/markdown-clipboard.test.ts
@@ -206,6 +206,32 @@ describe("serializeRenderedMarkdownFragment", () => {
     expect(serializeRenderedMarkdownFragment(asNode(container))).toBe("-\n\n```\npnpm test\n```");
   });
 
+  it("keeps blank lines inside a code block in a list item, quote, or longer fence", () => {
+    const code = ["import os", "", "", "def main():"];
+    const list = new FakeElement("OL").append(
+      new FakeElement("LI").append(new FakeText("Create it:\n"), renderedCodeBlock(code)),
+    );
+    const quote = new FakeElement("BLOCKQUOTE").append(
+      new FakeElement("P").append(new FakeText("Note:")),
+      renderedCodeBlock(code),
+    );
+    const nestedFence = new FakeElement("DIV").append(
+      new FakeElement("P").append(new FakeText("Example:")),
+      renderedCodeBlock(["```js", "a()", "", "", "b()  ", "```"]),
+    );
+
+    expect(serializeRenderedMarkdownFragment(asNode(nestedFence))).toBe(
+      "Example:\n\n````\n```js\na()\n\n\nb()  \n```\n````",
+    );
+
+    expect(serializeRenderedMarkdownFragment(asNode(new FakeElement("DIV").append(list)))).toBe(
+      "1. Create it:\n   ```\n   import os\n\n\n   def main():\n   ```",
+    );
+    expect(serializeRenderedMarkdownFragment(asNode(new FakeElement("DIV").append(quote)))).toBe(
+      "> Note:\n>\n> ```\n> import os\n>\n>\n> def main():\n> ```",
+    );
+  });
+
   it("omits fences when a selection past the last line drags in the whole code block", () => {
     const container = new FakeElement("DIV").append(
       renderedCodeBlock(["printf '%s' 'TOKEN' | gh secret set CLOUDFLARE_API_TOKEN"]),
diff --git a/apps/web/src/markdown-clipboard.ts b/apps/web/src/markdown-clipboard.ts
index 62bbde6d71667..2364a6c77c4e5 100644
--- a/apps/web/src/markdown-clipboard.ts
+++ b/apps/web/src/markdown-clipboard.ts
@@ -57,6 +57,14 @@ function codeFenceFor(code: string): string {
   return "`".repeat(Math.max(3, longestRun + 1));
 }
 
+function outsideCodeFences(markdown: string, tidy: (prose: string) => string): string {
+  // A fence closes only at its own opening run, so split yields [prose, fence, run] triples.
+  return markdown
+    .split(/((`{3,})[\s\S]*?(?:\2|$))/)
+    .map((part, index) => (index % 3 === 0 ? tidy(part) : index % 3 === 1 ? part : ""))
+    .join("");
+}
+
 function resolveCodeBlockLanguage(pre: Element): string | null {
   const declared =
     pre.closest("[data-language]")?.getAttribute("data-language") ??
@@ -120,11 +128,11 @@ function serializeListItem(
   const task = checkbox ? `[${(checkbox as HTMLInputElement).checked ? "x" : " "}] ` : "";
   const bullet = ordered ? `${index}. ` : "- ";
   const marker = `${bullet}${task}`;
-  let content = serializeChildren(item, inTableCell)
-    .replace(/\n{3,}/g, "\n\n")
-    .trim();
+  let content = outsideCodeFences(serializeChildren(item, inTableCell), (prose) =>
+    prose.replace(/\n{3,}/g, "\n\n"),
+  ).trim();
   if (!item.querySelector(":scope > p")) {
-    content = content.replace(/\n{2,}/g, "\n");
+    content = outsideCodeFences(content, (prose) => prose.replace(/\n{2,}/g, "\n"));
   }
   // Continuations align after the bullet; task boxes belong to the item text.
   const continuationIndent = " ".repeat(bullet.length);
@@ -143,9 +151,9 @@ function serializeList(list: Element, ordered: boolean, inTableCell: boolean): s
 }
 
 function serializeBlockquote(quote: Element, inTableCell: boolean): string {
-  const content = serializeChildren(quote, inTableCell)
-    .replace(/\n{3,}/g, "\n\n")
-    .trim();
+  const content = outsideCodeFences(serializeChildren(quote, inTableCell), (prose) =>
+    prose.replace(/\n{3,}/g, "\n\n"),
+  ).trim();
   if (!content) return "";
   const quoted = content
     .split("\n")
@@ -316,13 +324,9 @@ function soleCodeBlock(container: Node): Element | null {
 }
 
 function tidyMarkdown(markdown: string): string {
-  return markdown
-    .split(/(```[\s\S]*?(?:```|$))/)
-    .map((part, index) =>
-      index % 2 === 1 ? part : part.replace(/[ \t]+(?=\n)/g, "").replace(/\n{3,}/g, "\n\n"),
-    )
-    .join("")
-    .trim();
+  return outsideCodeFences(markdown, (prose) =>
+    prose.replace(/[ \t]+(?=\n)/g, "").replace(/\n{3,}/g, "\n\n"),
+  ).trim();
 }
 
 export function serializeRenderedMarkdownFragment(container: Node): string {

From 42cf5a168c9228c92cd106c247b76632a78d0910 Mon Sep 17 00:00:00 2001
From: Utkarsh Patil <73941998+UtkarshUsername@users.noreply.github.com>
Date: Tue, 3 Nov 2026 22:47:43 +0530
Subject: [PATCH 005/167] fix(web): compact model picker row indicators
 (#26415)

---
 apps/web/src/components/chat/ModelListRow.tsx | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/apps/web/src/components/chat/ModelListRow.tsx b/apps/web/src/components/chat/ModelListRow.tsx
index e70c32b064a3e..69da770f1f84b 100644
--- a/apps/web/src/components/chat/ModelListRow.tsx
+++ b/apps/web/src/components/chat/ModelListRow.tsx
@@ -79,6 +79,7 @@ export const ModelListRow = memo(function ModelListRow(props: {
           {/* The logo is decorative, so name the provider for screen readers. */}
           <span className="sr-only">, {props.providerDisplayName}</span>
         </div>
+        {props.isSelected ? <CheckIcon className="size-3.5 shrink-0" aria-hidden="true" /> : null}
         {props.subProvider ? (
           <span className="min-w-0 shrink truncate text-xs text-muted-foreground/70">
             {props.subProvider}
@@ -100,14 +101,12 @@ export const ModelListRow = memo(function ModelListRow(props: {
       </div>
 
       <div className="flex shrink-0 items-center gap-1.5">
-        {props.jumpLabel ? <Kbd>{props.jumpLabel}</Kbd> : null}
         <Tooltip>
           <TooltipTrigger
             render={
               <Button
                 size="icon-xs"
                 variant="ghost-muted"
-                className="-mr-1 shrink-0"
                 onClick={(event) => {
                   event.stopPropagation();
                   props.onToggleFavorite(props.instanceId, props.slug);
@@ -133,11 +132,7 @@ export const ModelListRow = memo(function ModelListRow(props: {
             {props.isFavorite ? "Remove from favorites" : "Add to favorites"}
           </TooltipPopup>
         </Tooltip>
-        {/* Last, and always reserved, so stars and the check keep fixed columns. */}
-        <CheckIcon
-          className={cn("size-3.5", !props.isSelected && "invisible")}
-          aria-hidden="true"
-        />
+        {props.jumpLabel ? <Kbd>{props.jumpLabel}</Kbd> : null}
       </div>
     </ComboboxItem>
   );

From 911212bf4f60915676ac891345fb325457db957e Mon Sep 17 00:00:00 2001
From: Utkarsh Patil <73941998+UtkarshUsername@users.noreply.github.com>
Date: Tue, 3 Nov 2026 22:49:03 +0530
Subject: [PATCH 006/167] fix(web): open project picker from boring sidebar's
 header (#26495)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/components/Sidebar.browser.test.tsx   | 89 +++++++++++++++++++
 apps/web/src/components/Sidebar.tsx           |  5 +-
 .../src/shortcuts/chatRouteCommands.test.ts   | 65 ++++++++++++++
 apps/web/src/shortcuts/chatRouteCommands.ts   |  5 +-
 docs/user/thread-sidebar.md                   |  7 +-
 5 files changed, 163 insertions(+), 8 deletions(-)
 create mode 100644 apps/web/src/components/Sidebar.browser.test.tsx
 create mode 100644 apps/web/src/shortcuts/chatRouteCommands.test.ts

diff --git a/apps/web/src/components/Sidebar.browser.test.tsx b/apps/web/src/components/Sidebar.browser.test.tsx
new file mode 100644
index 0000000000000..875a2225d70a1
--- /dev/null
+++ b/apps/web/src/components/Sidebar.browser.test.tsx
@@ -0,0 +1,89 @@
+import { DEFAULT_CLIENT_SETTINGS, EnvironmentId, ProjectId } from "@t3tools/contracts";
+import { describe, expect, it, vi } from "vite-plus/test";
+import { userEvent } from "vite-plus/test/browser";
+
+import { render } from "../../test/render";
+import { openCommandPalette } from "../commandPaletteBus";
+import { useHandleNewThread } from "../hooks/useHandleNewThread";
+import { __setClientSettingsForTests, getClientSettings } from "../hooks/useSettings";
+import { useProjects } from "../state/entities";
+import type { Project } from "../types";
+import Sidebar from "./Sidebar";
+import { SidebarProvider } from "./ui/sidebar";
+
+vi.mock("../state/entities", { spy: true });
+vi.mock("../hooks/useHandleNewThread", { spy: true });
+vi.mock("../commandPaletteBus", () => ({
+  openCommandPalette: vi.fn(),
+  isCommandPaletteOpen: () => false,
+}));
+vi.mock("./sidebar/SidebarChrome", () => ({
+  SidebarChromeHeader: () => null,
+  SidebarChromeFooter: () => null,
+}));
+
+function project(id: string): Project {
+  return {
+    id: ProjectId.make(id),
+    environmentId: EnvironmentId.make("local"),
+    title: id,
+    workspaceRoot: `/projects/${id}`,
+    repositoryIdentity: null,
+    defaultModelSelection: null,
+    createdAt: "2026-01-01T00:00:00.000Z",
+    updatedAt: "2026-01-01T00:00:00.000Z",
+    scripts: [],
+  };
+}
+
+describe("sidebar header new thread", () => {
+  it.each([
+    { mode: "normal", count: 2, shift: false, picker: true },
+    { mode: "boring", count: 2, shift: false, picker: true },
+    { mode: "boring", count: 2, shift: true, picker: false },
+    { mode: "boring", count: 1, shift: false, picker: false },
+    { mode: "legacy", count: 2, shift: false, picker: false },
+  ] as const)("$mode sidebar, $count projects, shift=$shift: picker=$picker", async (scenario) => {
+    using stack = new DisposableStack();
+    const previousSettings = getClientSettings();
+    stack.defer(() => __setClientSettingsForTests(previousSettings));
+    __setClientSettingsForTests({
+      ...DEFAULT_CLIENT_SETTINGS,
+      boringSidebarEnabled: scenario.mode === "boring",
+      legacySidebarEnabled: scenario.mode === "legacy",
+    });
+    const projects = [project("active"), project("idle")].slice(0, scenario.count);
+    const currentProjectRef = {
+      environmentId: projects[0]!.environmentId,
+      projectId: projects[0]!.id,
+    };
+    const startThread = vi.fn().mockResolvedValue(null);
+    vi.mocked(useProjects).mockReturnValue(projects);
+    vi.mocked(useHandleNewThread).mockReturnValue({
+      activeDraftThread: null,
+      activeThread: null,
+      defaultProjectRef: currentProjectRef,
+      handleNewThread: startThread,
+      routeDraftId: null,
+      routeThreadRef: null,
+    });
+    vi.mocked(openCommandPalette).mockClear();
+    await using screen = await render(
+      <SidebarProvider>
+        <Sidebar routeReveal={{ observedKey: null, pendingKey: null }} />
+      </SidebarProvider>,
+    );
+
+    await userEvent.click(screen.getByRole("button", { name: "New thread", exact: true }), {
+      modifiers: scenario.shift ? ["Shift"] : [],
+    });
+
+    if (scenario.picker) {
+      expect(openCommandPalette).toHaveBeenCalledExactlyOnceWith({ open: "new-thread-in" });
+      expect(startThread).not.toHaveBeenCalled();
+    } else {
+      expect(openCommandPalette).not.toHaveBeenCalled();
+      expect(startThread).toHaveBeenCalledExactlyOnceWith(currentProjectRef);
+    }
+  });
+});
diff --git a/apps/web/src/components/Sidebar.tsx b/apps/web/src/components/Sidebar.tsx
index cbf0191a7f40f..c21191d88f5b2 100644
--- a/apps/web/src/components/Sidebar.tsx
+++ b/apps/web/src/components/Sidebar.tsx
@@ -1006,6 +1006,7 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
     },
   });
   const boringSidebarEnabled = useBoringSidebarEnabled();
+  const legacySidebarEnabled = useClientSettings((settings) => settings.legacySidebarEnabled);
   const folderRowsMultiline = useClientSettings((settings) => settings.boringSidebarMultilineRows);
   const newThreadContext = useHandleNewThread();
   // Row callbacks capture only the handler; the rest of the context changes with the route.
@@ -2950,7 +2951,7 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
 
   const handleNewThreadClick = (event?: ReactMouseEvent) => {
     if (
-      boringSidebarEnabled ||
+      legacySidebarEnabled ||
       shouldCreateNewThreadInCurrentProject(
         event?.shiftKey ?? false,
         scopeGroups.length,
@@ -3182,7 +3183,7 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
               newThreadShortcutLabel={newThreadShortcutLabel}
               newThreadInProjectShortcutLabel={newThreadInProjectShortcutLabel}
               showNewThreadInProjectHint={
-                !boringSidebarEnabled &&
+                !legacySidebarEnabled &&
                 !shouldCreateNewThreadInCurrentProject(
                   false,
                   scopeGroups.length,
diff --git a/apps/web/src/shortcuts/chatRouteCommands.test.ts b/apps/web/src/shortcuts/chatRouteCommands.test.ts
new file mode 100644
index 0000000000000..6c9ff18690ec4
--- /dev/null
+++ b/apps/web/src/shortcuts/chatRouteCommands.test.ts
@@ -0,0 +1,65 @@
+import { DEFAULT_CLIENT_SETTINGS, EnvironmentId, ProjectId } from "@t3tools/contracts";
+import type { AnyRouter } from "@tanstack/react-router";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import * as commandPalette from "../commandPaletteBus";
+import * as settings from "../hooks/useSettings";
+import * as threadActions from "../lib/chatThreadActions";
+import * as entities from "../state/entities";
+import type { Project } from "../types";
+import { installChatRouteCommands } from "./chatRouteCommands";
+import * as dispatcher from "./dispatcher";
+
+function project(id: string): Project {
+  return {
+    id: ProjectId.make(id),
+    environmentId: EnvironmentId.make("local"),
+    title: id,
+    workspaceRoot: `/projects/${id}`,
+    repositoryIdentity: null,
+    defaultModelSelection: null,
+    createdAt: "2026-01-01T00:00:00.000Z",
+    updatedAt: "2026-01-01T00:00:00.000Z",
+    scripts: [],
+  };
+}
+
+describe("new thread commands", () => {
+  it.each([
+    { mode: "normal", count: 2, command: "chat.new", picker: true },
+    { mode: "boring", count: 2, command: "chat.new", picker: true },
+    { mode: "boring", count: 1, command: "chat.new", picker: false },
+    { mode: "legacy", count: 2, command: "chat.new", picker: false },
+    { mode: "boring", count: 2, command: "chat.newLocal", picker: false },
+  ] as const)("$mode sidebar, $count projects, $command: picker=$picker", (scenario) => {
+    using _settings = vi.spyOn(settings, "getClientSettings").mockReturnValue({
+      ...DEFAULT_CLIENT_SETTINGS,
+      boringSidebarEnabled: scenario.mode === "boring",
+      legacySidebarEnabled: scenario.mode === "legacy",
+    });
+    using _projects = vi
+      .spyOn(entities, "readProjects")
+      .mockReturnValue([project("active"), project("idle")].slice(0, scenario.count));
+    using openPicker = vi.spyOn(commandPalette, "openCommandPalette").mockImplementation(() => {});
+    using startLocal = vi.spyOn(threadActions, "startNewThreadFromContext").mockResolvedValue(true);
+    using register = vi.spyOn(dispatcher, "registerCommands").mockReturnValue(() => {});
+    const router = { state: { matches: [] } } as unknown as AnyRouter;
+    using stack = new DisposableStack();
+    stack.defer(installChatRouteCommands(router));
+    const commands = register.mock.calls[0]![0];
+    const event = {
+      preventDefault: vi.fn(),
+      stopPropagation: vi.fn(),
+    } as unknown as KeyboardEvent;
+
+    commands[scenario.command]!(event);
+
+    if (scenario.picker) {
+      expect(openPicker).toHaveBeenCalledWith({ open: "new-thread-in" });
+      expect(startLocal).not.toHaveBeenCalled();
+    } else {
+      expect(openPicker).not.toHaveBeenCalled();
+      expect(startLocal).toHaveBeenCalledOnce();
+    }
+  });
+});
diff --git a/apps/web/src/shortcuts/chatRouteCommands.ts b/apps/web/src/shortcuts/chatRouteCommands.ts
index 5ddb93f30e8b2..cb9474c9a9237 100644
--- a/apps/web/src/shortcuts/chatRouteCommands.ts
+++ b/apps/web/src/shortcuts/chatRouteCommands.ts
@@ -123,12 +123,9 @@ export function installChatRouteCommands(router: AnyRouter): () => void {
         void scratch.startScratchThread(environmentId);
       },
       "chat.new": (event) => {
-        // The boring sidebar's folders already show the context, so it starts in
-        // the current project like the legacy sidebar did.
-        const { boringSidebarEnabled, legacySidebarEnabled } = getClientSettings();
+        const { legacySidebarEnabled } = getClientSettings();
         const groups = readProjectGroups();
         if (
-          !boringSidebarEnabled &&
           !legacySidebarEnabled &&
           !shouldCreateNewThreadInCurrentProject(
             false,
diff --git a/docs/user/thread-sidebar.md b/docs/user/thread-sidebar.md
index bed4ed73a40c5..37f679725f81b 100644
--- a/docs/user/thread-sidebar.md
+++ b/docs/user/thread-sidebar.md
@@ -5,8 +5,11 @@ need a separate branch and working directory.
 
 ## Start a thread
 
-On web and desktop, a new thread keeps the current project and carries your model
-and mode selections, unless the destination project has its own model default.
+On web and desktop, **New thread** opens the project picker when you have multiple
+projects in the default or project-grouped sidebar. The legacy sidebar always
+starts in the current project. **Shift-click** to start in
+the current project, or use a project's own new-thread action. A new thread carries
+your model and mode selections, unless the destination project has its own model default.
 Its branch and workspace mode come from your configured defaults. To continue in
 an existing worktree, use **New thread in this worktree** from the branch toolbar.
 

From 171f78b87918e065427a9d45f5a3f27a6738ae78 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:19:43 +0000
Subject: [PATCH 007/167] fix(client): project removal counts only listed
 threads, not side chats or subagents (#29917)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ProjectSettingsPanel.logic.test.ts        | 24 +++++++++++++++----
 .../src/state/projectRemoval.ts               |  9 +++++--
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/apps/web/src/components/settings/ProjectSettingsPanel.logic.test.ts b/apps/web/src/components/settings/ProjectSettingsPanel.logic.test.ts
index 6f8ef830daf5c..8d0ad779842cf 100644
--- a/apps/web/src/components/settings/ProjectSettingsPanel.logic.test.ts
+++ b/apps/web/src/components/settings/ProjectSettingsPanel.logic.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vite-plus/test";
-import { EnvironmentId, ProjectId } from "@t3tools/contracts";
+import { EnvironmentId, ProjectId, ThreadId } from "@t3tools/contracts";
 import { planProjectRemoval } from "@t3tools/client-runtime/state/projects";
 
 describe("project removal confirmation", () => {
@@ -16,18 +16,32 @@ describe("project removal confirmation", () => {
     environmentLabel: "Remote",
   };
 
-  it("limits a checkout's thread count to its environment and project", () => {
+  const parentId = ThreadId.make("parent");
+  const listed = { rootThreadId: parentId, parentThreadId: null, relationshipToParent: null };
+  const child = { rootThreadId: parentId, parentThreadId: parentId };
+
+  it("limits a checkout's thread count to its listed threads in that environment and project", () => {
     const plan = planProjectRemoval({
       members: [local],
       groupMemberCount: 2,
       hasOtherMembers: false,
       displayName: "Repo",
       threads: [
-        { environmentId: local.environmentId, projectId: local.id },
-        { environmentId: remote.environmentId, projectId: remote.id },
+        { environmentId: local.environmentId, projectId: local.id, lineage: listed },
+        {
+          environmentId: local.environmentId,
+          projectId: local.id,
+          lineage: { ...child, relationshipToParent: "subagent" },
+        },
+        {
+          environmentId: local.environmentId,
+          projectId: local.id,
+          lineage: { ...child, relationshipToParent: "fork", sideChat: true },
+        },
+        { environmentId: remote.environmentId, projectId: remote.id, lineage: listed },
       ],
     });
-    expect(plan.projectThreads).toHaveLength(1);
+    expect(plan.projectThreads).toHaveLength(3);
     expect(plan.confirmationMessage).toBe(
       'Remove checkout "Repo" and delete its 1 thread?\nPath: /work/repo\nEnvironment: Local\nThose threads and any archived threads are deleted from T3 Code. Provider sessions are kept.\nOther entries in this grouped project are unaffected.\nThis action cannot be undone.',
     );
diff --git a/packages/client-runtime/src/state/projectRemoval.ts b/packages/client-runtime/src/state/projectRemoval.ts
index 09c65a772e689..2225e5758bd2d 100644
--- a/packages/client-runtime/src/state/projectRemoval.ts
+++ b/packages/client-runtime/src/state/projectRemoval.ts
@@ -1,7 +1,9 @@
+import { isListedThreadLineage } from "@t3tools/contracts";
+
 import type { EnvironmentProject, EnvironmentThreadShell } from "./models.ts";
 
 export function planProjectRemoval<
-  Thread extends Pick<EnvironmentThreadShell, "environmentId" | "projectId">,
+  Thread extends Pick<EnvironmentThreadShell, "environmentId" | "projectId" | "lineage">,
 >(options: {
   readonly members: ReadonlyArray<
     Pick<EnvironmentProject, "id" | "environmentId" | "title" | "workspaceRoot"> & {
@@ -20,7 +22,10 @@ export function planProjectRemoval<
   const projectThreads = threads.filter((thread) =>
     memberKeys.has(`${thread.environmentId}:${thread.projectId}`),
   );
-  const threadCount = projectThreads.length + (options.unloadedThreadCount ?? 0);
+  // Side chats and subagents go with their parent but never show in thread lists.
+  const threadCount =
+    projectThreads.filter((thread) => isListedThreadLineage(thread.lineage)).length +
+    (options.unloadedThreadCount ?? 0);
   const isWholeGroup = members.length === groupMemberCount;
   const targetKind = hasOtherMembers || !isWholeGroup ? "checkout" : "project";
   const singleMember = members.length === 1 ? members[0]! : null;

From 68c38b959ae89b96c80c3e67402d6cfe5e0c1437 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:20:20 +0000
Subject: [PATCH 008/167] fix(opencode): text generation errors explain known
 provider failures without raw provider text (#29877)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/server/textGeneration.test.ts         | 61 ++++++++++++++++
 .../src/server/textGeneration.ts              | 72 ++++++++++++-------
 2 files changed, 109 insertions(+), 24 deletions(-)

diff --git a/packages/provider-opencode/src/server/textGeneration.test.ts b/packages/provider-opencode/src/server/textGeneration.test.ts
index 10694ef45ef55..a5a7440257875 100644
--- a/packages/provider-opencode/src/server/textGeneration.test.ts
+++ b/packages/provider-opencode/src/server/textGeneration.test.ts
@@ -456,6 +456,67 @@ it.layer(layerOpenCodeTextGenerationTest)("OpenCodeTextGeneration", (it) => {
     ),
   );
 
+  it.effect(
+    "maps OpenCode prompt errors to fixed details and keeps provider text in the cause",
+    () =>
+      Effect.forEach(
+        [
+          {
+            error: {
+              name: "APIError",
+              data: {
+                message: "Org quota secret-org exceeded",
+                statusCode: 429,
+                isRetryable: true,
+              },
+            },
+            rawText: "secret-org",
+            detail: "The model provider's usage or rate limit was reached. Try again later.",
+          },
+          {
+            error: {
+              name: "APIError",
+              data: {
+                message: "<none>",
+                statusCode: 503,
+                isRetryable: true,
+                responseBody: "<title>Upstream gateway secret-host</title>",
+              },
+            },
+            rawText: "secret-host",
+            detail: "The model provider failed the request (HTTP 503).",
+          },
+          {
+            error: { name: "UnknownError", data: { message: "Provider stack trace secret-token" } },
+            rawText: "secret-token",
+            detail: "OpenCode could not generate the text.",
+          },
+        ],
+        (testCase) =>
+          withOpenCodeTextGeneration(DEFAULT_OPENCODE_SETTINGS, (textGeneration) =>
+            Effect.gen(function* () {
+              runtimeMock.state.promptResult = {
+                data: { info: { error: testCase.error }, parts: [] },
+              };
+
+              const error = yield* textGeneration
+                .generateCommitMessage(DEFAULT_COMMIT_MESSAGE_INPUT)
+                .pipe(Effect.flip);
+
+              expect(error.detail).toBe(testCase.detail);
+              expect(error.message).not.toContain(testCase.rawText);
+              expect(error.cause).toMatchObject({
+                _tag: "OpenCodeTextGenerationPromptResponseError",
+                providerErrorName: testCase.error.name,
+                cause: testCase.error,
+              });
+              expect((error.cause as Error).message).not.toContain(testCase.rawText);
+            }),
+          ),
+        { discard: true },
+      ),
+  );
+
   it.effect("deletes the session when the prompt request rejects", () =>
     withOpenCodeTextGeneration(DEFAULT_OPENCODE_SETTINGS, (textGeneration) =>
       Effect.gen(function* () {
diff --git a/packages/provider-opencode/src/server/textGeneration.ts b/packages/provider-opencode/src/server/textGeneration.ts
index ab8d41f1568b2..570d2ebf6e2f1 100644
--- a/packages/provider-opencode/src/server/textGeneration.ts
+++ b/packages/provider-opencode/src/server/textGeneration.ts
@@ -70,15 +70,40 @@ export class OpenCodeTextGenerationPromptResponseError extends Schema.TaggedErro
   {
     ...openCodePromptErrorContext,
     providerErrorName: Schema.optional(Schema.String),
-    providerMessage: Schema.String,
+    statusCode: Schema.optional(Schema.Int),
+    cause: Schema.Defect(),
   },
 ) {
   override get message(): string {
     const providerError = this.providerErrorName ? ` ${this.providerErrorName}` : "";
-    return `OpenCode prompt${providerError} failed for ${this.operation} in ${this.cwd} using ${this.providerId}/${this.modelId} (session ${this.sessionId}): ${this.providerMessage}`;
+    const status = this.statusCode === undefined ? "" : `, HTTP ${this.statusCode}`;
+    return `OpenCode prompt${providerError} failed for ${this.operation} in ${this.cwd} using ${this.providerId}/${this.modelId} (session ${this.sessionId}${status}).`;
   }
 }
 
+function openCodePromptResponseErrorDetail(error: OpenCodeTextGenerationPromptResponseError) {
+  if (
+    error.providerErrorName === "ProviderAuthError" ||
+    error.statusCode === 401 ||
+    error.statusCode === 403
+  ) {
+    return "The model provider rejected the credentials. Check the provider's sign-in or API key in OpenCode.";
+  }
+  if (error.statusCode === 429) {
+    return "The model provider's usage or rate limit was reached. Try again later.";
+  }
+  if (error.providerErrorName === "ContextOverflowError") {
+    return "The prompt is too long for the selected model's context window.";
+  }
+  if (error.providerErrorName === "MessageAbortedError") {
+    return "OpenCode stopped the generation.";
+  }
+  if (error.statusCode !== undefined) {
+    return `The model provider failed the request (HTTP ${error.statusCode}).`;
+  }
+  return "OpenCode could not generate the text.";
+}
+
 export class OpenCodeTextGenerationEmptyOutputError extends Schema.TaggedError<OpenCodeTextGenerationEmptyOutputError>()(
   "OpenCodeTextGenerationEmptyOutputError",
   {
@@ -94,7 +119,7 @@ export class OpenCodeTextGenerationEmptyOutputError extends Schema.TaggedError<O
 
 interface OpenCodePromptFailure {
   readonly name?: string;
-  readonly message: string;
+  readonly statusCode?: number;
 }
 
 interface OpenCodeTextPart {
@@ -111,26 +136,21 @@ function getOpenCodePromptFailure(error: unknown): OpenCodePromptFailure | null
     "name" in error && typeof error.name === "string" && error.name.trim().length > 0
       ? error.name.trim()
       : undefined;
-  const message =
-    "data" in error &&
-    error.data &&
-    typeof error.data === "object" &&
-    "message" in error.data &&
-    typeof error.data.message === "string"
-      ? error.data.message.trim()
-      : "";
-  if (message.length > 0) {
-    return {
-      ...(name ? { name } : {}),
-      message,
-    };
-  }
-
-  if (name) {
-    return { name, message: name };
+  const data = "data" in error && error.data && typeof error.data === "object" ? error.data : {};
+  const statusCode =
+    "statusCode" in data && typeof data.statusCode === "number" && Number.isInteger(data.statusCode)
+      ? data.statusCode
+      : undefined;
+  const hasMessage =
+    "message" in data && typeof data.message === "string" && data.message.trim().length > 0;
+  if (!name && statusCode === undefined && !hasMessage) {
+    return null;
   }
 
-  return null;
+  return {
+    ...(name ? { name } : {}),
+    ...(statusCode !== undefined ? { statusCode } : {}),
+  };
 }
 
 function isOpenCodeTextPart(part: unknown): part is OpenCodeTextPart {
@@ -263,12 +283,16 @@ export const makeOpenCodeTextGeneration = Effect.fn("makeOpenCodeTextGeneration"
             ),
           ),
         );
-        const promptFailure = getOpenCodePromptFailure(result.data?.info?.error);
+        const promptError = result.data?.info?.error;
+        const promptFailure = getOpenCodePromptFailure(promptError);
         if (promptFailure) {
           return yield* new OpenCodeTextGenerationPromptResponseError({
             ...promptContext,
             ...(promptFailure.name ? { providerErrorName: promptFailure.name } : {}),
-            providerMessage: promptFailure.message,
+            ...(promptFailure.statusCode !== undefined
+              ? { statusCode: promptFailure.statusCode }
+              : {}),
+            cause: promptError,
           });
         }
         const responseParts = result.data?.parts ?? [];
@@ -312,7 +336,7 @@ export const makeOpenCodeTextGeneration = Effect.fn("makeOpenCodeTextGeneration"
           Effect.fail(
             new TextGenerationError({
               operation: cause.operation,
-              detail: cause.providerMessage,
+              detail: openCodePromptResponseErrorDetail(cause),
               cause,
             }),
           ),

From bec3f2d4dd52b01dabb3991e22d5f75fec3d2bc0 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:21:09 +0000
Subject: [PATCH 009/167] fix(mobile): multi-file patches show every changed
 file (#29878)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/mobile/src/lib/threadActivity.test.ts | 19 +++++++++++++++++++
 apps/mobile/src/lib/threadActivity.ts      |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/apps/mobile/src/lib/threadActivity.test.ts b/apps/mobile/src/lib/threadActivity.test.ts
index 583cbe7098e15..69ef04feb4f2f 100644
--- a/apps/mobile/src/lib/threadActivity.test.ts
+++ b/apps/mobile/src/lib/threadActivity.test.ts
@@ -18,6 +18,7 @@ import {
   type OrchestrationV2TurnItem,
 } from "@t3tools/contracts";
 import { deriveThreadCheckpointSummaries } from "@t3tools/client-runtime/state/thread-checkpoints";
+import { summarizeToolGroup } from "@t3tools/client-runtime/work-log/presentation";
 import { getReviewSectionIdForCheckpoint } from "../features/review/reviewModel";
 import * as DateTime from "effect/DateTime";
 import { describe, expect, it } from "vite-plus/test";
@@ -596,6 +597,24 @@ describe("buildThreadFeed", () => {
     expect(items[0]).toMatchObject({ output: rawOutput });
   });
 
+  it("counts every file of a multi-file patch", () => {
+    const item: OrchestrationV2TurnItem = {
+      ...base("multi-file-change", "2026-06-20T00:00:04.000Z", 3),
+      type: "file_change",
+      fileName: "src/a.ts",
+      changes: [
+        { operation: "update", path: "src/a.ts" },
+        { operation: "add", path: "src/b.ts" },
+        { operation: "update", path: "src/renamed.ts", oldPath: "src/original.ts" },
+      ],
+    };
+    const activity = buildThreadFeed([projected(item, 0)]).flatMap((entry) =>
+      entry.type === "activity-group" ? entry.activities : [],
+    )[0]!;
+    expect(workEntryRowLabel(activity.workEntry)).toBe("src/a.ts +2 more");
+    expect(summarizeToolGroup([activity.workEntry]).summary).toBe("Changed 3 files");
+  });
+
   it("anchors feedback before later committed turns", () => {
     const laterUser = {
       ...userMessage("2026-08-29T00:00:05.000Z"),
diff --git a/apps/mobile/src/lib/threadActivity.ts b/apps/mobile/src/lib/threadActivity.ts
index 91681731aab16..8cb5ccb043794 100644
--- a/apps/mobile/src/lib/threadActivity.ts
+++ b/apps/mobile/src/lib/threadActivity.ts
@@ -733,7 +733,7 @@ function toWorkLogEntry(
     case "file_change":
       return {
         ...common,
-        changedFiles: [item.fileName],
+        changedFiles: item.changes?.map((change) => change.path) ?? [item.fileName],
         toolTitle: title ?? "File change",
         toolData: item,
       };

From e5d07108760777a8b366c727d01c582cddf27dbc Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:21:50 +0000
Subject: [PATCH 010/167] fix(server): handoff context names every file of a
 multi-file patch (#29905)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ContextHandoffBudget.test.ts              | 13 ++++++++
 .../ContextHandoffService.test.ts             | 30 +++++++++++++++++++
 .../orchestration-v2/ContextHandoffService.ts |  2 +-
 .../provider-core/src/server/handoffBudget.ts |  2 +-
 4 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ContextHandoffBudget.test.ts b/apps/server/src/orchestration-v2/ContextHandoffBudget.test.ts
index c4068702e3a57..71d9cf3dadaf9 100644
--- a/apps/server/src/orchestration-v2/ContextHandoffBudget.test.ts
+++ b/apps/server/src/orchestration-v2/ContextHandoffBudget.test.ts
@@ -137,6 +137,19 @@ describe("handoff budget", () => {
     assert.equal(command?.kind, "command_execution");
     assert.include(command!.text, "Exit code: 1");
     assert.include(command!.text, "界".repeat(300));
+    assert.equal(
+      historicalMessage({
+        ...base,
+        type: "file_change",
+        fileName: "src/a.ts",
+        changes: [
+          { operation: "update", path: "src/a.ts" },
+          { operation: "add", path: "src/b.ts" },
+          { operation: "update", path: "src/new.ts", oldPath: "src/old.ts" },
+        ],
+      })?.text,
+      "File change: src/a.ts, src/b.ts, src/new.ts",
+    );
     assert.isNull(
       historicalMessage({
         ...base,
diff --git a/apps/server/src/orchestration-v2/ContextHandoffService.test.ts b/apps/server/src/orchestration-v2/ContextHandoffService.test.ts
index 0282819d81b56..78958c2e317d5 100644
--- a/apps/server/src/orchestration-v2/ContextHandoffService.test.ts
+++ b/apps/server/src/orchestration-v2/ContextHandoffService.test.ts
@@ -210,6 +210,36 @@ it.effect("caps the side chat context block without summarizing discarded parent
     });
     assert.isTrue(framingOnly.startsWith("You are in a side chat beside the main thread."));
     assert.notInclude(framingOnly, "Main thread activity");
+
+    const multiFilePatch = ContextHandoffService.makeSideChatContext({
+      parentThreadId,
+      digest: [
+        {
+          id: TurnItemId.make("turn-item:patch"),
+          threadId: parentThreadId,
+          runId: null,
+          nodeId: null,
+          providerThreadId: null,
+          providerTurnId: null,
+          nativeItemRef: null,
+          parentItemId: null,
+          ordinal: 60,
+          status: "completed",
+          title: null,
+          startedAt: null,
+          completedAt: null,
+          updatedAt: DateTime.makeUnsafe(0),
+          type: "file_change",
+          fileName: "src/a.ts",
+          changes: [
+            { operation: "update", path: "src/a.ts" },
+            { operation: "add", path: "src/b.ts" },
+            { operation: "update", path: "src/new.ts", oldPath: "src/old.ts" },
+          ],
+        },
+      ],
+    });
+    assert.include(multiFilePatch, "- File change: src/a.ts, src/b.ts, src/new.ts");
   }).pipe(Effect.provide(layerTest)),
 );
 
diff --git a/apps/server/src/orchestration-v2/ContextHandoffService.ts b/apps/server/src/orchestration-v2/ContextHandoffService.ts
index dcfffa018c8c0..10f2701446268 100644
--- a/apps/server/src/orchestration-v2/ContextHandoffService.ts
+++ b/apps/server/src/orchestration-v2/ContextHandoffService.ts
@@ -213,7 +213,7 @@ function summarizeDeltaItem(item: OrchestrationV2TurnItem): string | null {
     case "command_execution":
       return `- Command: ${compactText(item.input)}`;
     case "file_change":
-      return `- File change: ${item.fileName}`;
+      return `- File change: ${compactText(item.changes?.map((change) => change.path).join(", ") ?? item.fileName)}`;
     case "checkpoint":
       return `- Checkpoint: ${item.files.length} files`;
     case "handoff":
diff --git a/packages/provider-core/src/server/handoffBudget.ts b/packages/provider-core/src/server/handoffBudget.ts
index 4658bc44fc6d3..b1c98806f29d9 100644
--- a/packages/provider-core/src/server/handoffBudget.ts
+++ b/packages/provider-core/src/server/handoffBudget.ts
@@ -147,7 +147,7 @@ export function historicalMessage(
       text = item.message;
       break;
     case "file_change":
-      text = `File change: ${item.fileName}`;
+      text = `File change: ${item.changes?.map((change) => change.path).join(", ") ?? item.fileName}`;
       break;
     case "proposed_plan":
       text = item.markdown;

From e86dc78d6294e99cef47888fe1513b647da48e5d Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:23:26 +0000
Subject: [PATCH 011/167] fix(server): commits and PR text see changes outside
 a subfolder project under diff.relative (#29879)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts |  9 ++++++---
 apps/server/src/vcs/GitVcsDriverCore.ts      | 17 +++++++++++++++--
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 53d031a7413e8..1c3e075d165c8 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -2849,12 +2849,13 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
       }),
     );
 
-    it.effect("reads range patches from source without textconv or color", () =>
+    it.effect("reads range patches from source without textconv, color, or diff.relative", () =>
       Effect.gen(function* () {
         const cwd = yield* makeTmpDir();
         const { initialBranch } = yield* initRepoWithCommit(cwd);
         yield* git(cwd, ["config", "diff.probe.textconv", "touch textconv-ran; echo converted"]);
         yield* git(cwd, ["config", "color.ui", "always"]);
+        yield* git(cwd, ["config", "diff.relative", "true"]);
         yield* git(cwd, ["checkout", "-b", "feature/range"]);
         yield* writeTextFile(cwd, ".gitattributes", "*.doc diff=probe\n");
         yield* writeTextFile(cwd, "notes.doc", "source line\n");
@@ -2864,8 +2865,10 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
         yield* git(cwd, ["commit", "-m", "range files"]);
         const driver = yield* GitVcsDriver.GitVcsDriver;
         const fileSystem = yield* FileSystem.FileSystem;
+        const projectCwd = `${cwd}/app`;
+        yield* fileSystem.makeDirectory(projectCwd);
 
-        const context = yield* driver.readRangeContext(cwd, initialBranch);
+        const context = yield* driver.readRangeContext(projectCwd, initialBranch);
 
         assert.include(context.diffPatch, "+source line");
         assert.notInclude(context.diffPatch, "converted");
@@ -2878,7 +2881,7 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
         assert.isFalse(yield* fileSystem.exists(`${cwd}/textconv-ran`));
 
         yield* writeTextFile(cwd, "notes.doc", "updated source line\n");
-        const staged = yield* driver.prepareCommitContext(cwd, ["notes.doc"]);
+        const staged = yield* driver.prepareCommitContext(projectCwd, ["notes.doc"]);
         assert.include(staged?.stagedPatch ?? "", "+updated source line");
         assert.notInclude(staged?.stagedPatch ?? "", "converted");
         assert.notInclude(staged?.stagedPatch ?? "", "\u001b[");
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 4ace91f8017d2..2736cbc6d4fcb 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -2525,7 +2525,8 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           const stagedSummary = yield* runGitStdoutWithOptions(
             "GitVcsDriver.prepareCommitContext.stagedSummary",
             cwd,
-            ["diff", "--cached", "--name-status"],
+            // cwd can be a subdirectory; diff.relative would hide changes outside it.
+            ["-c", "diff.relative=false", "diff", "--cached", "--name-status"],
             { env, maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
           ).pipe(Effect.map((stdout) => stdout.trim()));
           if (stagedSummary.length === 0) {
@@ -2539,6 +2540,8 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
             "GitVcsDriver.prepareCommitContext.stagedPatch",
             cwd,
             [
+              "-c",
+              "diff.relative=false",
               "diff",
               "--no-color",
               "--no-ext-diff",
@@ -2948,7 +2951,15 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         runGitStdoutWithOptions(
           "GitVcsDriver.readRangeContext.diffStat",
           cwd,
-          ["diff", "--stat", "--no-color", "--end-of-options", diffRange],
+          [
+            "-c",
+            "diff.relative=false",
+            "diff",
+            "--stat",
+            "--no-color",
+            "--end-of-options",
+            diffRange,
+          ],
           {
             maxOutputBytes: RANGE_DIFF_SUMMARY_MAX_OUTPUT_BYTES,
             appendTruncationMarker: true,
@@ -2958,6 +2969,8 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           "GitVcsDriver.readRangeContext.diffPatch",
           cwd,
           [
+            "-c",
+            "diff.relative=false",
             "diff",
             "--no-color",
             "--no-ext-diff",

From 12ec17ce4c6481a8ea1049dedd78d0e56bc48aec Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:24:00 +0000
Subject: [PATCH 012/167] fix(web): opening a project from the command palette
 no longer lands in a subagent or side chat (#29891)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../CommandPalette.browser.test.tsx           | 65 ++++++++++++++++++-
 apps/web/src/components/CommandPalette.tsx    |  4 +-
 2 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/components/CommandPalette.browser.test.tsx b/apps/web/src/components/CommandPalette.browser.test.tsx
index 3883a3e2258e9..9faeab83c6ffc 100644
--- a/apps/web/src/components/CommandPalette.browser.test.tsx
+++ b/apps/web/src/components/CommandPalette.browser.test.tsx
@@ -1,13 +1,28 @@
-import { describe, expect, it } from "vite-plus/test";
+import { EnvironmentId, ProjectId, ThreadId } from "@t3tools/contracts";
+import { describe, expect, it, vi } from "vite-plus/test";
 import { page } from "vite-plus/test/browser";
 
 import { render } from "../../test/render";
 import { openCommandPalette } from "../commandPaletteBus";
 import { useCommandPaletteStore } from "../commandPaletteStore";
+import { makeThreadFixture } from "../test-fixtures";
+import type { Project, Thread } from "../types";
 import { CommandPalette } from "./CommandPalette";
 
-function setup() {
+const entities = vi.hoisted(() => ({
+  projects: [] as ReadonlyArray<Project>,
+  threads: [] as ReadonlyArray<Thread>,
+}));
+vi.mock("../state/entities", async (original) => ({
+  ...(await original<typeof import("../state/entities")>()),
+  useProjects: () => entities.projects,
+  useVisibleThreadShells: () => entities.threads,
+}));
+
+function setup(state: { projects?: ReadonlyArray<Project>; threads?: ReadonlyArray<Thread> } = {}) {
   useCommandPaletteStore.setState(useCommandPaletteStore.getInitialState(), true);
+  entities.projects = state.projects ?? [];
+  entities.threads = state.threads ?? [];
 }
 
 describe("CommandPalette open intents", () => {
@@ -30,4 +45,50 @@ describe("CommandPalette open intents", () => {
     await expect.element(input).toHaveFocus();
     await expect.element(input).toHaveValue("acme");
   });
+
+  it("opens a searched project's latest listed thread, not a newer subagent", async () => {
+    const environmentId = EnvironmentId.make("local");
+    const projectId = ProjectId.make("acme");
+    const parentId = ThreadId.make("parent");
+    setup({
+      projects: [
+        {
+          id: projectId,
+          environmentId,
+          title: "Acme",
+          workspaceRoot: "/work/acme",
+          repositoryIdentity: null,
+          defaultModelSelection: null,
+          createdAt: "2026-03-01T00:00:00.000Z",
+          updatedAt: "2026-03-01T00:00:00.000Z",
+          scripts: [],
+        },
+      ],
+      threads: [
+        makeThreadFixture({
+          id: parentId,
+          environmentId,
+          projectId,
+          latestUserMessageAt: "2026-03-02T00:00:00.000Z",
+        }),
+        makeThreadFixture({
+          id: ThreadId.make("subagent"),
+          environmentId,
+          projectId,
+          updatedAt: "2026-03-03T00:00:00.000Z",
+          lineage: {
+            rootThreadId: parentId,
+            parentThreadId: parentId,
+            relationshipToParent: "subagent",
+          },
+        }),
+      ],
+    });
+    await using screen = await render(<CommandPalette>{null}</CommandPalette>);
+
+    openCommandPalette({ query: "Acme" });
+    await page.getByRole("option", { name: /Acme/ }).first().click();
+
+    await vi.waitFor(() => expect(screen.router?.state.location.pathname).toBe("/local/parent"));
+  });
 });
diff --git a/apps/web/src/components/CommandPalette.tsx b/apps/web/src/components/CommandPalette.tsx
index 068808707b4f5..ddac4fc4d7c17 100644
--- a/apps/web/src/components/CommandPalette.tsx
+++ b/apps/web/src/components/CommandPalette.tsx
@@ -212,6 +212,7 @@ import {
   type SearchOverlayMode,
 } from "./CommandPalette.logic";
 import { resolveEnvironmentOptionLabel } from "./BranchToolbar.logic";
+import { isSidebarHiddenThread } from "./Sidebar.logic";
 import { CommandPaletteContent } from "./CommandPaletteContent";
 import {
   selectCommandPaletteClientSettings,
@@ -493,7 +494,8 @@ function OpenCommandPaletteDialog(props: {
     if (activeThreadReferenceCopyTarget === null) return;
     await copyThreadReference(activeThreadReferenceCopyTarget);
   };
-  const threads = useVisibleThreadShells();
+  // Side chats and subagents open inside their parent, so opening a project never lands on one.
+  const threads = useVisibleThreadShells().filter((thread) => !isSidebarHiddenThread(thread));
   const keybindings = useAtomValue(primaryServerKeybindingsAtom);
   const providersByEnvironment = useEnvironmentProviders();
   const { changeThemeItem, changeAppearanceItem, themeEditorItem } = useCommandPaletteThemeItems();

From 3ee55151e075441a798094202503087fcf1268f0 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 17:45:00 +0000
Subject: [PATCH 013/167] fix(web): device host checks show the error without a
 stack trace (#29912)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../useHostConnectionChecks.browser.test.tsx  | 64 +++++++++++++++++++
 .../settings/useHostConnectionChecks.ts       |  4 +-
 2 files changed, 66 insertions(+), 2 deletions(-)
 create mode 100644 apps/web/src/components/settings/useHostConnectionChecks.browser.test.tsx

diff --git a/apps/web/src/components/settings/useHostConnectionChecks.browser.test.tsx b/apps/web/src/components/settings/useHostConnectionChecks.browser.test.tsx
new file mode 100644
index 0000000000000..93c2776034a4d
--- /dev/null
+++ b/apps/web/src/components/settings/useHostConnectionChecks.browser.test.tsx
@@ -0,0 +1,64 @@
+import { DeviceHostUnavailableError, EnvironmentId } from "@t3tools/contracts";
+import * as Cause from "effect/Cause";
+import { AsyncResult } from "effect/reactivity";
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { act, render } from "../../../test/render";
+
+const state = vi.hoisted(() => ({ test: vi.fn() }));
+function setup() {
+  state.test.mockReset();
+}
+
+vi.mock(import("../../state/use-atom-command"), async (original) => ({
+  ...(await original()),
+  useAtomCommand: (() => state.test) as never,
+}));
+vi.mock(import("../../state/session"), async (original) => ({
+  ...(await original()),
+  readEnvironmentScope: (() => true) as never,
+}));
+
+import { useHostConnectionChecks } from "./useHostConnectionChecks";
+
+const environmentId = EnvironmentId.make("environment-1");
+const targets = [{ environmentId, label: "This Mac", connected: true }];
+
+function Harness({
+  onReady,
+}: {
+  onReady: (run: ReturnType<typeof useHostConnectionChecks>) => void;
+}) {
+  onReady(useHostConnectionChecks(targets));
+  return null;
+}
+
+describe("useHostConnectionChecks", () => {
+  it("reports a failed check by its message, without a stack trace", async () => {
+    setup();
+    state.test.mockResolvedValue(
+      AsyncResult.failure(
+        Cause.fail(
+          new DeviceHostUnavailableError({
+            hostId: "mac",
+            hostLabel: "Mac mini",
+            reason: "SSH connection refused.",
+          }),
+        ),
+      ),
+    );
+    let checks!: ReturnType<typeof useHostConnectionChecks>;
+    await using _screen = await render(<Harness onReady={(next) => (checks = next)} />, {
+      router: false, // the hook reads no route state
+    });
+
+    const results = await act(() =>
+      checks.testConnection({ kind: "ssh", id: "mac", label: "Mac mini", target: "user@mac" }),
+    );
+
+    expect(results?.[environmentId]).toEqual({
+      status: "failed",
+      error: "Mac mini is unavailable: SSH connection refused.",
+    });
+  });
+});
diff --git a/apps/web/src/components/settings/useHostConnectionChecks.ts b/apps/web/src/components/settings/useHostConnectionChecks.ts
index 4b2733cdfcf42..e96b992a149b8 100644
--- a/apps/web/src/components/settings/useHostConnectionChecks.ts
+++ b/apps/web/src/components/settings/useHostConnectionChecks.ts
@@ -1,7 +1,7 @@
 import { AuthSettingsWriteScope } from "@t3tools/contracts";
 import { readEnvironmentScope } from "../../state/session";
 import { useRef, useState } from "react";
-import * as Cause from "effect/Cause";
+import { squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import type { SshDeviceHostConfig } from "@t3tools/contracts";
 import { deviceEnvironment } from "../../state/device";
 import { useAtomCommand } from "../../state/use-atom-command";
@@ -30,7 +30,7 @@ export function useHostConnectionChecks(targets: ReadonlyArray<DeviceHostCheckTa
           throw new Error("This connection cannot test device hosts.");
         }
         const result = await test({ environmentId, input });
-        if (result._tag === "Failure") throw new Error(Cause.pretty(result.cause));
+        if (result._tag === "Failure") throw squashAtomCommandFailure(result);
         return result.value;
       },
       (environmentId, result) => {

From 3d369d55968b09861bf61ba8ebb2eeb6f02973ba Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 11:47:51 -0600
Subject: [PATCH 014/167] feat(web): open full access menu from the new thread
 context strip (#30275)

---
 apps/web/src/components/ChatView.tsx          | 15 ++--
 .../components/ComposerContextPermissions.tsx | 72 +++++++++++++------
 apps/web/src/components/chat/ChatComposer.tsx | 14 ++--
 ...omposerPermissionsSection.browser.test.tsx | 36 ++++++++++
 .../src/components/chat/runtimeModeConfig.ts  | 17 ++++-
 5 files changed, 111 insertions(+), 43 deletions(-)

diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index 497ccfc877771..a1c1c7bc91a5b 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -177,7 +177,6 @@ import { GuestPendingMessages } from "./chat/GuestShareControls";
 import { useDeviceState } from "~/state/device";
 import { BranchToolbar, type BranchToolbarHandle } from "./BranchToolbar";
 import { ComposerContextPermissions } from "./ComposerContextPermissions";
-import { resolveCompatibleRuntimeMode } from "./chat/runtimeModeConfig";
 import { makeWorkspaceFileDropHandlers } from "./chat/workspaceFileDrop";
 import { isEditableFocused } from "../lib/editableFocus";
 import { DEFAULT_RESOLVED_KEYBINDINGS } from "@t3tools/shared/keybindings";
@@ -1838,9 +1837,6 @@ export default function ChatView(props: ChatViewProps) {
     });
   };
   const scheduleComposerFocusStable = useStableCallback(scheduleComposerFocus);
-  const openComposerPermissionsStable = useStableCallback(() =>
-    composerRef.current?.openControl("composer.mode"),
-  );
   const insertArtifactTemplate = (template: CodexArtifactTemplate) => {
     const composer = composerRef.current;
     if (!composer) return;
@@ -3792,13 +3788,12 @@ export default function ChatView(props: ChatViewProps) {
                                   : {
                                       trailing: (
                                         <ComposerContextPermissions
-                                          runtimeMode={
-                                            resolveCompatibleRuntimeMode(
-                                              runtimeMode,
-                                              activeProviderStatus?.supportedRuntimeModes,
-                                            ).mode
+                                          environmentId={environmentId}
+                                          runtimeMode={runtimeMode}
+                                          supportedRuntimeModes={
+                                            activeProviderStatus?.supportedRuntimeModes
                                           }
-                                          onOpen={openComposerPermissionsStable}
+                                          onRuntimeModeChange={handleRuntimeModeChangeStable}
                                         />
                                       ),
                                     })}
diff --git a/apps/web/src/components/ComposerContextPermissions.tsx b/apps/web/src/components/ComposerContextPermissions.tsx
index b4ac2a2eb6983..688968f9bca53 100644
--- a/apps/web/src/components/ComposerContextPermissions.tsx
+++ b/apps/web/src/components/ComposerContextPermissions.tsx
@@ -1,41 +1,67 @@
-import type { RuntimeMode } from "@t3tools/contracts";
+import type { EnvironmentId, RuntimeMode } from "@t3tools/contracts";
 import { useAtomValue } from "@effect/atom-react";
 
 import { shortcutLabelForCommand } from "../keybindings";
+import { useManagedPolicy } from "../state/managedPolicy";
 import { primaryServerKeybindingsAtom } from "../state/server";
 import { ComposerControl } from "./chat/ComposerControl";
-import { runtimeModeConfig } from "./chat/runtimeModeConfig";
+import { ComposerPermissionsSection } from "./chat/ComposerFooterControls";
+import { useComposerMenuProps } from "./chat/composerEventScope";
+import {
+  resolveCompatibleRuntimeMode,
+  resolveRuntimeModeOptions,
+  runtimeModeConfig,
+} from "./chat/runtimeModeConfig";
 import { ComposerContextLabel } from "./ComposerContextLabel";
+import { Menu, MenuPopup, MenuTrigger } from "./ui/menu";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "./ui/tooltip";
 
-/** The new-thread strip names the permissions the first send will use; clicking opens them. */
 export function ComposerContextPermissions(props: {
+  environmentId: EnvironmentId | null;
   runtimeMode: RuntimeMode;
-  onOpen: () => void;
+  supportedRuntimeModes: ReadonlyArray<RuntimeMode> | undefined;
+  onRuntimeModeChange: (mode: RuntimeMode) => void;
 }) {
   const shortcutLabel = shortcutLabelForCommand(
     useAtomValue(primaryServerKeybindingsAtom),
     "composer.mode",
   );
-  const { icon: Icon, label } = runtimeModeConfig[props.runtimeMode];
+  const { mode, modes } = resolveCompatibleRuntimeMode(
+    props.runtimeMode,
+    props.supportedRuntimeModes,
+  );
+  const options = resolveRuntimeModeOptions(modes, useManagedPolicy(props.environmentId));
+  const composerMenuProps = useComposerMenuProps();
+  const { icon: Icon, label } = runtimeModeConfig[mode];
   return (
-    <Tooltip>
-      <TooltipTrigger
-        render={
-          <ComposerControl
-            size="xs"
-            className="ms-auto min-w-0 shrink-0"
-            aria-label={`Permissions: ${label}`}
-            aria-haspopup="menu"
-            data-composer-context-control
-            onClick={props.onOpen}
-          />
-        }
-      >
-        <Icon aria-hidden="true" className="size-3" />
-        <ComposerContextLabel>{label}</ComposerContextLabel>
-      </TooltipTrigger>
-      <TooltipPopup>Permissions{shortcutLabel ? ` · ${shortcutLabel}` : null}</TooltipPopup>
-    </Tooltip>
+    <Menu>
+      <Tooltip>
+        <TooltipTrigger
+          render={
+            <MenuTrigger
+              render={
+                <ComposerControl
+                  size="xs"
+                  className="ms-auto min-w-0 shrink-0"
+                  aria-label={`Permissions: ${label}`}
+                  data-composer-context-control
+                />
+              }
+            />
+          }
+        >
+          <Icon aria-hidden="true" className="size-3" />
+          <ComposerContextLabel>{label}</ComposerContextLabel>
+        </TooltipTrigger>
+        <TooltipPopup>Permissions{shortcutLabel ? ` · ${shortcutLabel}` : null}</TooltipPopup>
+      </Tooltip>
+      <MenuPopup side="top" align="end" {...composerMenuProps}>
+        <ComposerPermissionsSection
+          runtimeMode={mode}
+          runtimeModeOptions={options}
+          onRuntimeModeChange={props.onRuntimeModeChange}
+        />
+      </MenuPopup>
+    </Menu>
   );
 }
diff --git a/apps/web/src/components/chat/ChatComposer.tsx b/apps/web/src/components/chat/ChatComposer.tsx
index 9ad9158cd4da3..25b7f5ce6f87c 100644
--- a/apps/web/src/components/chat/ChatComposer.tsx
+++ b/apps/web/src/components/chat/ChatComposer.tsx
@@ -5,7 +5,7 @@ import { BackgroundThreadContext } from "./backgroundThread";
 import {
   resolveCompatibleRuntimeMode,
   runtimeModeConfig,
-  runtimeModeOptions as runtimeModes,
+  resolveRuntimeModeOptions,
 } from "./runtimeModeConfig";
 import { isLocalEnvironmentDisabled } from "../../localEnvironment";
 import { usePrimaryEnvironmentId } from "../../state/environments";
@@ -285,8 +285,6 @@ function consumePasteAsTextShortcut(deadline: { current: number }): boolean {
   return armed;
 }
 
-const runtimeModeOptions = runtimeModes.map((mode) => ({ mode, ...runtimeModeConfig[mode] }));
-
 export interface ChatComposerHandle {
   focusAtEnd: () => void;
   focusAt: (cursor: number) => void;
@@ -920,12 +918,10 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
     );
   // Modes above an administrator's ceiling stay listed, disabled with the reason.
   const managedPolicy = useManagedPolicy(environmentId);
-  const compatibleRuntimeModeOptions = runtimeModeOptions
-    .filter((option) => compatibleRuntimeModes.includes(option.mode))
-    .map((option) => {
-      const disabledReason = managedRuntimeModeDenial(managedPolicy, option.mode);
-      return disabledReason === undefined ? option : { ...option, disabledReason };
-    });
+  const compatibleRuntimeModeOptions = resolveRuntimeModeOptions(
+    compatibleRuntimeModes,
+    managedPolicy,
+  );
   // A thread or draft already above the ceiling would be refused; offer the broadest mode left.
   const runtimeModeCeilingDenial = managedRuntimeModeDenial(managedPolicy, compatibleRuntimeMode);
   const runtimeModeCeilingFallback =
diff --git a/apps/web/src/components/chat/ComposerPermissionsSection.browser.test.tsx b/apps/web/src/components/chat/ComposerPermissionsSection.browser.test.tsx
index 850256b28904a..0fe4cc14d3869 100644
--- a/apps/web/src/components/chat/ComposerPermissionsSection.browser.test.tsx
+++ b/apps/web/src/components/chat/ComposerPermissionsSection.browser.test.tsx
@@ -5,6 +5,7 @@ import { page, userEvent } from "vite-plus/test/browser";
 
 import { render } from "../../../test/render";
 import { ComposerHandleContext, type ComposerHandleRef } from "../../composerHandleContext";
+import { ComposerContextPermissions } from "../ComposerContextPermissions";
 import { Menu, MenuPopup, MenuRadioGroup, MenuRadioItem, MenuTrigger } from "../ui/menu";
 import {
   focusRequestedPermission,
@@ -149,3 +150,38 @@ it("returns focus to the editor when picking the default hides the chip", async
   await vi.waitFor(() => expect(handle.focusAtEnd).toHaveBeenCalled());
   await expect.element(screen.getByRole("button", { name: "Model" })).not.toHaveFocus();
 });
+
+function ContextPermissions() {
+  const [mode, setMode] = useState<RuntimeMode>("full-access");
+  return (
+    <ComposerContextPermissions
+      environmentId={null}
+      runtimeMode={mode}
+      supportedRuntimeModes={["approval-required", "full-access"]}
+      onRuntimeModeChange={setMode}
+    />
+  );
+}
+
+it("opens permissions directly from the context strip and applies a supported mode", async () => {
+  await using screen = await render(<ContextPermissions />, { router: false }); // no routes involved
+  await userEvent.click(screen.getByRole("button", { name: "Permissions: Full access" }));
+  await expect
+    .element(page.getByRole("menuitemradio", { name: "Full access" }))
+    .toHaveAttribute("aria-checked", "true");
+  await expect
+    .element(page.getByRole("menuitemradio", { name: "Auto", exact: true }))
+    .not.toBeInTheDocument();
+  await userEvent.click(page.getByRole("menuitemradio", { name: "Supervised" }));
+  const trigger = screen.getByRole("button", { name: "Permissions: Supervised" });
+  await expect.element(trigger).toBeVisible();
+  await expect
+    .element(page.getByRole("menuitemradio", { name: "Supervised" }))
+    .not.toBeInTheDocument();
+  await userEvent.click(trigger);
+  await expect
+    .element(page.getByRole("menuitemradio", { name: "Supervised" }))
+    .toHaveAttribute("aria-checked", "true");
+  await userEvent.keyboard("{Escape}");
+  await expect.element(trigger).toHaveFocus();
+});
diff --git a/apps/web/src/components/chat/runtimeModeConfig.ts b/apps/web/src/components/chat/runtimeModeConfig.ts
index 4b6d89dbbec27..7edc187b9ba63 100644
--- a/apps/web/src/components/chat/runtimeModeConfig.ts
+++ b/apps/web/src/components/chat/runtimeModeConfig.ts
@@ -1,4 +1,8 @@
-import type { RuntimeMode } from "@t3tools/contracts";
+import {
+  managedRuntimeModeDenial,
+  type ManagedPolicySummary,
+  type RuntimeMode,
+} from "@t3tools/contracts";
 import { type LucideIcon, LockIcon, PenLineIcon, ShieldOffIcon, SparklesIcon } from "lucide-react";
 
 export const runtimeModeConfig: Record<
@@ -41,3 +45,14 @@ export function resolveCompatibleRuntimeMode(
       : runtimeModeOptions;
   return { modes, mode: modes.includes(runtimeMode) ? runtimeMode : (modes[0] ?? runtimeMode) };
 }
+
+export function resolveRuntimeModeOptions(
+  modes: ReadonlyArray<RuntimeMode>,
+  managedPolicy: ManagedPolicySummary | undefined,
+) {
+  return modes.map((mode) => {
+    const option = { mode, ...runtimeModeConfig[mode] };
+    const disabledReason = managedRuntimeModeDenial(managedPolicy, mode);
+    return disabledReason === undefined ? option : { ...option, disabledReason };
+  });
+}

From e53672d8fc72f0cf2d50420080314b33ff2c6f33 Mon Sep 17 00:00:00 2001
From: Bilal Bakr <62337003+Bil0000@users.noreply.github.com>
Date: Tue, 3 Nov 2026 21:03:32 +0300
Subject: [PATCH 015/167] fix(web): long server lists in thread details now
 page 4 at a time (#28684)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
---
 .../chat/ThreadDetailsCard.browser.test.tsx   | 19 +++++++
 .../src/components/chat/ThreadDetailsCard.tsx |  6 +--
 .../chat/ThreadServersPanel.browser.test.tsx  | 51 +++++++++++++++++++
 .../components/chat/ThreadServersPanel.tsx    | 45 ++++++++++++++--
 4 files changed, 113 insertions(+), 8 deletions(-)
 create mode 100644 apps/web/src/components/chat/ThreadServersPanel.browser.test.tsx

diff --git a/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx b/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
index 673fe94ee1090..e234686d6ff0c 100644
--- a/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
@@ -44,6 +44,7 @@ function Card({
   fixture,
   rows = 1,
   automationRows = 0,
+  serverOverflowRows = 0,
 }: {
   threadRef: ScopedThreadRef;
   inline: boolean;
@@ -52,6 +53,8 @@ function Card({
   rows?: number;
   /** Rows of 100px in an automations list shown at full density. */
   automationRows?: number;
+  /** Rows of 100px that expanded server lists add, which density ignores. */
+  serverOverflowRows?: number;
 }) {
   return (
     // The web root renders in StrictMode, which re-runs ref callbacks on every mount.
@@ -83,6 +86,12 @@ function Card({
               {density === "full" && automationRows > 0 ? (
                 <section data-thread-automations-panel style={{ height: automationRows * 100 }} />
               ) : null}
+              {density === "full" && serverOverflowRows > 0 ? (
+                <div
+                  data-thread-details-server-overflow
+                  style={{ height: serverOverflowRows * 100 }}
+                />
+              ) : null}
             </>
           )}
         </ThreadDetailsCard>
@@ -177,3 +186,13 @@ it("keeps full density when many automations make the content tall", async () =>
     .element(page.getByRole("region", { name: "Thread details" }))
     .toHaveAttribute("data-density", "full");
 });
+
+it("stays full while expanded server rows overflow", async () => {
+  using fixture = setup();
+  await using _screen = await render(
+    <Card threadRef={threadB} inline fixture={fixture} rows={2} serverOverflowRows={4} />,
+  );
+  await expect
+    .element(page.getByRole("region", { name: "Thread details" }))
+    .toHaveAttribute("data-density", "full");
+});
diff --git a/apps/web/src/components/chat/ThreadDetailsCard.tsx b/apps/web/src/components/chat/ThreadDetailsCard.tsx
index 969172c77a972..4e8a47a39791a 100644
--- a/apps/web/src/components/chat/ThreadDetailsCard.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsCard.tsx
@@ -78,10 +78,10 @@ export function ThreadDetailsCard({
     const measure = () => {
       const frame = element.closest<HTMLElement>("[data-thread-details-card]");
       const next = element.offsetHeight + (frame ? frame.offsetHeight - frame.clientHeight : 0);
-      // PR lists, lineage, side chats and automations scroll as they grow. Counting them toward
-      // density would hide the section and workspace controls when the user asks to see more rows.
+      // PR lists, servers, lineage, side chats and automations scroll as they grow. Counting them
+      // toward density would hide the section and workspace controls when the user asks to see more.
       const lists = element.querySelectorAll<HTMLElement>(
-        "[data-thread-relationships-panel], [data-thread-side-chats-panel], [data-thread-details-pr-list], [data-thread-automations-panel]",
+        "[data-thread-relationships-panel], [data-thread-side-chats-panel], [data-thread-details-pr-list], [data-thread-automations-panel], [data-thread-details-server-overflow]",
       );
       const fittingHeight =
         next - Array.from(lists).reduce((sum, list) => sum + list.offsetHeight, 0);
diff --git a/apps/web/src/components/chat/ThreadServersPanel.browser.test.tsx b/apps/web/src/components/chat/ThreadServersPanel.browser.test.tsx
new file mode 100644
index 0000000000000..a2b353554815b
--- /dev/null
+++ b/apps/web/src/components/chat/ThreadServersPanel.browser.test.tsx
@@ -0,0 +1,51 @@
+import { EnvironmentId, ThreadId, type DiscoveredLocalServer } from "@t3tools/contracts";
+import { expect, it, vi } from "vite-plus/test";
+import { page } from "vite-plus/test/browser";
+
+vi.mock(import("../../portDiscoveryState"), async (importOriginal) => ({
+  ...(await importOriginal()),
+  useThreadDiscoveredPorts: () =>
+    Array.from(
+      { length: 10 },
+      (_, index) =>
+        ({
+          pid: index,
+          port: 3000 + index,
+          url: `http://localhost:${3000 + index}`,
+          terminal: null,
+          processName: "node",
+        }) as DiscoveredLocalServer,
+    ),
+}));
+
+import { render } from "../../../test/render";
+import { ThreadServersPanel } from "./ThreadServersPanel";
+
+const panel = (threadId: string) => (
+  <ThreadServersPanel
+    environmentId={EnvironmentId.make("env")}
+    threadId={ThreadId.make(threadId)}
+  />
+);
+
+it("pages servers four at a time, collapses back, and resets on thread switch", async () => {
+  await using screen = await render(panel("a"));
+  const count = (selector: string) => screen.container.querySelectorAll(selector).length;
+  const expectRows = (rows: number) => vi.waitFor(() => expect(count("li")).toBe(rows));
+
+  await expectRows(4);
+  await page.getByRole("button", { name: "Show 4 more" }).click();
+  await expectRows(8);
+  expect(count("[data-thread-details-server-overflow]")).toBe(4);
+  await page.getByRole("button", { name: "Show 2 more" }).click();
+  await expectRows(10);
+  await page.getByRole("button", { name: "Show less" }).click();
+  await expectRows(4);
+
+  await page.getByRole("button", { name: "Show 4 more" }).click();
+  await expectRows(8);
+  await screen.rerender(panel("b"));
+  await expectRows(4);
+  await screen.rerender(panel("a"));
+  await expectRows(4);
+});
diff --git a/apps/web/src/components/chat/ThreadServersPanel.tsx b/apps/web/src/components/chat/ThreadServersPanel.tsx
index f1c8e1a1808f1..52a3119cc054d 100644
--- a/apps/web/src/components/chat/ThreadServersPanel.tsx
+++ b/apps/web/src/components/chat/ThreadServersPanel.tsx
@@ -10,6 +10,7 @@ import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
+import { ChevronDown, ChevronUp } from "lucide";
 import { GlobeIcon, LoaderCircleIcon, SquareIcon } from "lucide-react";
 import { type MouseEvent, useState } from "react";
 
@@ -21,6 +22,7 @@ import { useEnvironment } from "../../state/environments";
 import { previewEnvironment } from "../../state/preview";
 import { useEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
+import { MorphIcon } from "../MorphIcon";
 import { openDiscoveredPort } from "../preview/openDiscoveredPort";
 import { stackedThreadToast, toastManager } from "../ui/toast";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
@@ -28,13 +30,21 @@ import { ThreadDetailsControl } from "./ThreadDetailsControl";
 import { ThreadDetailsSection } from "./ThreadDetailsSection";
 import { THREAD_DETAILS_PANEL_ICON_CLASS } from "./threadDetailsPanelStyles";
 
+const SERVER_PAGE_COUNT = 4;
+
 const serverKey = (server: DiscoveredLocalServer) => `${server.pid}:${server.port}`;
 
-/** Local servers the thread's terminals and agent started. Hidden while none run. */
-export function ThreadServersPanel(props: {
+interface ThreadServersPanelProps {
   readonly environmentId: EnvironmentId;
   readonly threadId: ThreadId;
-}) {
+}
+
+/** Local servers the thread's terminals and agent started. Hidden while none run. */
+export function ThreadServersPanel(props: ThreadServersPanelProps) {
+  return <ThreadServersList key={`${props.environmentId}:${props.threadId}`} {...props} />;
+}
+
+function ThreadServersList(props: ThreadServersPanelProps) {
   const servers = useThreadDiscoveredPorts(props);
   const canOpen = useEnvironmentScope(props.environmentId, AuthPreviewOperateScope);
   const canStop = useAtomValue(
@@ -48,10 +58,12 @@ export function ThreadServersPanel(props: {
     label: "thread server stop",
   });
   const [stoppingKey, setStoppingKey] = useState<string | null>(null);
+  const [visibleCount, setVisibleCount] = useState(SERVER_PAGE_COUNT);
 
   if (servers.length === 0) return null;
   const externalClickLabel = isMacPlatform(navigator.platform) ? "⌘-click" : "Ctrl-click";
   const threadRef = scopeThreadRef(props.environmentId, props.threadId);
+  const hiddenCount = Math.max(0, servers.length - visibleCount);
 
   const reportFailure = (title: string, error: unknown) => {
     toastManager.add(
@@ -96,11 +108,15 @@ export function ThreadServersPanel(props: {
   return (
     <ThreadDetailsSection headingId="thread-details-servers-heading" title="Servers">
       <ul className="m-0 list-none p-0">
-        {servers.map((server) => {
+        {servers.slice(0, visibleCount).map((server, index) => {
           const key = serverKey(server);
           const stoppable = canStop && supportsStop && server.pid !== null;
           return (
-            <li key={key} className="group relative flex items-center rounded-lg">
+            <li
+              key={key}
+              data-thread-details-server-overflow={index >= SERVER_PAGE_COUNT || undefined}
+              className="group relative flex items-center rounded-lg"
+            >
               <Tooltip>
                 <TooltipTrigger
                   delay={200}
@@ -163,6 +179,25 @@ export function ThreadServersPanel(props: {
           );
         })}
       </ul>
+      {servers.length > SERVER_PAGE_COUNT ? (
+        <ThreadDetailsControl
+          variant="ghost"
+          size="sm"
+          onClick={() =>
+            setVisibleCount(hiddenCount > 0 ? visibleCount + SERVER_PAGE_COUNT : SERVER_PAGE_COUNT)
+          }
+          part="row"
+          tone="muted"
+          className="w-full active:scale-100"
+        >
+          <MorphIcon
+            aria-hidden
+            className="size-4 shrink-0"
+            icon={hiddenCount > 0 ? ChevronDown : ChevronUp}
+          />
+          {hiddenCount > 0 ? `Show ${Math.min(hiddenCount, SERVER_PAGE_COUNT)} more` : "Show less"}
+        </ThreadDetailsControl>
+      ) : null}
     </ThreadDetailsSection>
   );
 }

From 115739c1e02e181d6c176a4d8b43716f8f83d1d4 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 12:13:48 -0600
Subject: [PATCH 016/167] fix(web): keep the project filter menu aligned with
 its trigger

---
 apps/web/src/components/Sidebar.tsx                     | 6 ++----
 apps/web/src/components/sidebar/SidebarThreadHeader.tsx | 7 +------
 apps/web/src/components/ui/combobox.tsx                 | 3 +++
 3 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/apps/web/src/components/Sidebar.tsx b/apps/web/src/components/Sidebar.tsx
index c21191d88f5b2..868aa85cec61b 100644
--- a/apps/web/src/components/Sidebar.tsx
+++ b/apps/web/src/components/Sidebar.tsx
@@ -1032,7 +1032,6 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
   const projectScopeFilter = useComboboxFilter();
   const allProjectSnapshotsReady = useAllEnvironmentProjectSnapshotsReady();
   const allProjectConfigsReady = useAtomValue(environmentProjects.projectConfigsReadyAtom);
-  const headerSearchRef = useRef<HTMLDivElement | null>(null);
   // Safari may click after Ctrl+click opens settings; suppress that selection until the picker reopens.
   const suppressNextScopeChangeRef = useRef(false);
   const highlightedProjectScopeKeyRef = useRef<string | null>(null);
@@ -2990,7 +2989,6 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
         fixedHeader={
           <SidebarGroup className="z-[1]">
             <SidebarThreadHeader
-              searchFieldRef={headerSearchRef}
               hasProjects={projectGroups.length > 0}
               projectScope={
                 <Combobox
@@ -3061,8 +3059,8 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
                   {/* Refocusing the trigger after a pointer close shows its focus ring and opens its tooltip. */}
                   <ComboboxPopup
                     align="start"
-                    anchor={headerSearchRef}
-                    className="max-w-[min(18rem,var(--available-width))] overflow-hidden"
+                    collisionAvoidance={{ side: "flip", align: "shift" }}
+                    className="w-[min(18rem,var(--available-width))] overflow-hidden"
                     finalFocus={(closeType) => closeType === "keyboard"}
                   >
                     <ComboboxSearchInput
diff --git a/apps/web/src/components/sidebar/SidebarThreadHeader.tsx b/apps/web/src/components/sidebar/SidebarThreadHeader.tsx
index bccbd38f86a71..e400e03d27586 100644
--- a/apps/web/src/components/sidebar/SidebarThreadHeader.tsx
+++ b/apps/web/src/components/sidebar/SidebarThreadHeader.tsx
@@ -13,7 +13,6 @@ import { SidebarInput, SidebarMenuButton } from "../ui/sidebar";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 
 export interface SidebarThreadHeaderProps {
-  searchFieldRef?: RefObject<HTMLDivElement | null>;
   hasProjects: boolean;
   projectScope: ReactNode;
   onNewProject: () => void;
@@ -33,7 +32,6 @@ export interface SidebarThreadHeaderProps {
 }
 
 export function SidebarThreadHeader({
-  searchFieldRef,
   hasProjects,
   projectScope,
   onNewProject,
@@ -60,10 +58,7 @@ export function SidebarThreadHeader({
 
   return (
     <div className="flex items-center gap-1">
-      <div
-        ref={searchFieldRef}
-        className="flex h-8 min-w-0 flex-1 items-center gap-2 rounded-md px-2 py-1.5 text-sm font-medium text-sidebar-muted-foreground hover:bg-sidebar-row-hover hover:text-sidebar-foreground focus-within:bg-sidebar-row-hover focus-within:text-sidebar-foreground focus-within:ring-1 focus-within:ring-inset focus-within:ring-ring/70"
-      >
+      <div className="flex h-8 min-w-0 flex-1 items-center gap-2 rounded-md px-2 py-1.5 text-sm font-medium text-sidebar-muted-foreground hover:bg-sidebar-row-hover hover:text-sidebar-foreground focus-within:bg-sidebar-row-hover focus-within:text-sidebar-foreground focus-within:ring-1 focus-within:ring-inset focus-within:ring-ring/70">
         <SearchIcon className="size-4 shrink-0 text-(--sidebar-icon-color)" />
         <SidebarInput
           ref={searchInputRef}
diff --git a/apps/web/src/components/ui/combobox.tsx b/apps/web/src/components/ui/combobox.tsx
index a1db1108fa17a..739eb15b9a064 100644
--- a/apps/web/src/components/ui/combobox.tsx
+++ b/apps/web/src/components/ui/combobox.tsx
@@ -139,6 +139,7 @@ function ComboboxPopup({
   sideOffset = 4,
   alignOffset,
   align = "start",
+  collisionAvoidance,
   anchor: anchorProp,
   ...props
 }: ComboboxPrimitive.Popup.Props & {
@@ -147,6 +148,7 @@ function ComboboxPopup({
   alignOffset?: ComboboxPrimitive.Positioner.Props["alignOffset"];
   side?: ComboboxPrimitive.Positioner.Props["side"];
   anchor?: ComboboxPrimitive.Positioner.Props["anchor"];
+  collisionAvoidance?: ComboboxPrimitive.Positioner.Props["collisionAvoidance"];
 }) {
   const { chipsRef, multiple } = React.use(ComboboxContext);
   const anchor = anchorProp ?? (multiple ? chipsRef : undefined);
@@ -157,6 +159,7 @@ function ComboboxPopup({
         align={align}
         alignOffset={alignOffset}
         anchor={anchor}
+        collisionAvoidance={collisionAvoidance}
         className="z-[130] select-none"
         data-slot="combobox-positioner"
         side={side}

From 30724e2e9ae1c2f5da495b590e22e41e425b8db5 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 18:18:22 +0000
Subject: [PATCH 017/167] fix(github): Rebase stack no longer conflicts after a
 lower layer is squash-merged (#29919)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/server/githubStackActions.test.ts     |  2 +-
 .../src/server/githubStackActions.ts          |  2 +
 .../src/server/githubStackRebase.test.ts      | 53 +++++++++++++++++++
 .../src/server/githubStackRebase.ts           | 17 ++++--
 4 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/packages/source-control-github/src/server/githubStackActions.test.ts b/packages/source-control-github/src/server/githubStackActions.test.ts
index 3d95638bc48e9..e6559d05195d4 100644
--- a/packages/source-control-github/src/server/githubStackActions.test.ts
+++ b/packages/source-control-github/src/server/githubStackActions.test.ts
@@ -341,7 +341,7 @@ it.effect("rebases the open layers bottom to top in a scratch clone, each onto t
     expect(api.calls.some(isMutation)).toBe(false);
     const rebases = gitCalls.filter((args) => args[0] === "rebase");
     expect(rebases).toEqual([
-      ["rebase", "--quiet", "--onto", "origin/main", "new-sha"],
+      ["rebase", "--quiet", "--onto", "origin/main", "aaa"],
       ["rebase", "--quiet", "--onto", "new-sha", "bbb"],
     ]);
     expect(gitCalls.filter((args) => args[0] === "push")).toEqual([
diff --git a/packages/source-control-github/src/server/githubStackActions.ts b/packages/source-control-github/src/server/githubStackActions.ts
index f3997a45642a1..fb524ae0518de 100644
--- a/packages/source-control-github/src/server/githubStackActions.ts
+++ b/packages/source-control-github/src/server/githubStackActions.ts
@@ -201,6 +201,7 @@ export const runGitHubStackAction = Effect.fn("runGitHubStackAction")(function*
       })
     )
       return yield* new GitHubStackPermissionError({ ...identity });
+    const mergedHeadSha = stack.layers[stack.layers.indexOf(open[0]!) - 1]?.headSha;
     // GitHub has no stack-rebase API; per-PR updates replay lower layers' old commits.
     yield* cascadeRebaseStack({
       host: input.host,
@@ -211,6 +212,7 @@ export const runGitHubStackAction = Effect.fn("runGitHubStackAction")(function*
         headBranch: layer.headBranch,
         headSha: layer.headSha!,
       })),
+      ...(mergedHeadSha === undefined ? {} : { mergedHeadSha }),
     }).pipe(
       Effect.mapError((cause) =>
         cause._tag === "GitHubStackRebaseConflictError" ||
diff --git a/packages/source-control-github/src/server/githubStackRebase.test.ts b/packages/source-control-github/src/server/githubStackRebase.test.ts
index aa04c61744753..8bf4662a49e8e 100644
--- a/packages/source-control-github/src/server/githubStackRebase.test.ts
+++ b/packages/source-control-github/src/server/githubStackRebase.test.ts
@@ -92,6 +92,59 @@ it.layer(layer)("cascadeRebaseStack", (it) => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect("drops a squash-merged lower layer's commits from the layer above it", () =>
+    Effect.gen(function* () {
+      const repo = yield* setup;
+      const fs = yield* FileSystem.FileSystem;
+      const { process } = yield* SourceControlHost.SourceControlHost;
+      const scratch = yield* fs.makeTempDirectoryScoped({ prefix: "t3-cascade-squash-" });
+      const run = (...args: string[]) =>
+        process
+          .run({
+            operation: "test",
+            command: "git",
+            args,
+            cwd: scratch,
+            env: {
+              GIT_AUTHOR_NAME: "t",
+              GIT_AUTHOR_EMAIL: "t@t",
+              GIT_COMMITTER_NAME: "t",
+              GIT_COMMITTER_EMAIL: "t@t",
+            },
+          })
+          .pipe(Effect.map((out) => out.stdout.trim()));
+      const write = (text: string) => fs.writeFileString(`${scratch}/index.ts`, text);
+      yield* run("clone", "--quiet", repo.remote, ".");
+      yield* run("switch", "--quiet", "-c", "feat/two-steps");
+      yield* write("export const answer = 40;\n");
+      yield* run("commit", "--quiet", "-am", "A1");
+      yield* write("export const answer = 42;\n");
+      yield* run("commit", "--quiet", "-am", "A2");
+      const mergedHeadSha = yield* run("rev-parse", "HEAD");
+      yield* run("switch", "--quiet", "-c", "feat/on-top");
+      yield* write("/** The answer. */\nexport const answer = 42;\n");
+      yield* run("commit", "--quiet", "-am", "B");
+      const headSha = yield* run("rev-parse", "HEAD");
+      yield* run("switch", "--quiet", "main");
+      yield* run("merge", "--quiet", "--squash", "feat/two-steps");
+      yield* run("commit", "--quiet", "-m", "A (#1)");
+      yield* run("push", "--quiet", "origin", "main", "feat/on-top");
+
+      const completed = yield* cascadeRebaseStack({
+        host: "github.com",
+        repository: "acme/web",
+        base: "main",
+        layers: [{ number: 2, headBranch: "feat/on-top", headSha }],
+        mergedHeadSha,
+        remote: repo.remote,
+      });
+      assert.strictEqual(completed, 1);
+      const top = yield* repo.head("feat/on-top");
+      expect(yield* repo.git("rev-parse", `${top}~1`)).toBe(yield* repo.head("main"));
+      expect(yield* repo.git("log", "--format=%s", `main..${top}`)).toBe("B");
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("refuses to overwrite a layer pushed after it was reviewed", () =>
     Effect.gen(function* () {
       const repo = yield* setup;
diff --git a/packages/source-control-github/src/server/githubStackRebase.ts b/packages/source-control-github/src/server/githubStackRebase.ts
index 27595e7e7706d..e75b5e880b040 100644
--- a/packages/source-control-github/src/server/githubStackRebase.ts
+++ b/packages/source-control-github/src/server/githubStackRebase.ts
@@ -40,6 +40,8 @@ export const cascadeRebaseStack = Effect.fn("cascadeRebaseStack")(function* (inp
   readonly repository: string;
   readonly base: string;
   readonly layers: ReadonlyArray<CascadeLayer>;
+  /** Last head of the merged layer directly below the bottom open layer. */
+  readonly mergedHeadSha?: string;
   readonly remote?: string;
 }) {
   const appAccess = yield* GitHubAppAccess.GitHubAppAccess;
@@ -103,13 +105,22 @@ export const cascadeRebaseStack = Effect.fn("cascadeRebaseStack")(function* (inp
 
   let parentOld = `origin/${input.base}`;
   let parentNew = `origin/${input.base}`;
+  // A squash or rebase merge leaves the merged layer's commits outside the base's history.
+  const mergedParent =
+    input.mergedHeadSha !== undefined &&
+    (yield* git(["merge-base", "--is-ancestor", input.mergedHeadSha, first.headSha], true).pipe(
+      Effect.mapError(failed("reading the fork point", first.number, 0)),
+    )).exitCode === 0
+      ? input.mergedHeadSha
+      : undefined;
   for (const [index, layer] of input.layers.entries()) {
-    // Exclude old parents: the base fork point for the bottom, the reviewed lower head above it.
+    // Exclude old parents: the merged layer or fork point for the bottom, the reviewed head above.
     const upstream =
       index === 0
-        ? (yield* git(["merge-base", parentOld, layer.headSha]).pipe(
+        ? (mergedParent ??
+          (yield* git(["merge-base", parentOld, layer.headSha]).pipe(
             Effect.mapError(failed("reading the fork point", layer.number, index)),
-          )).stdout.trim()
+          )).stdout.trim())
         : parentOld;
     yield* git(["checkout", "--quiet", "--detach", layer.headSha]).pipe(
       Effect.mapError(failed("checking out", layer.number, index)),

From abf8998b66040cc869339f307be189dd7e3595c7 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 10:29:26 -0800
Subject: [PATCH 018/167] fix(server): changing a task's wake policy no longer
 reverts a checkpointed parent run (#25662)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../DelegatedCompletionDelivery.test.ts       | 65 +++++++++++++------
 .../src/orchestration-v2/Orchestrator.ts      |  6 +-
 2 files changed, 50 insertions(+), 21 deletions(-)

diff --git a/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts b/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
index cabc322d31331..3f0f9cf0342ee 100644
--- a/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
+++ b/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
@@ -158,7 +158,7 @@ const seedParentWithTerminalTask = (input: {
   readonly runId: RunId;
   readonly rootNodeId: NodeId;
   readonly taskId: NodeId;
-  readonly deliveryState: "delivered" | "claimed" | "acknowledged" | "disposed";
+  readonly deliveryState: "pending" | "delivered" | "claimed" | "acknowledged" | "disposed";
   readonly completionWake?: "always" | "settled_only";
   readonly deliveryTaskIds?: ReadonlyArray<NodeId>;
   readonly parentRunStatus?: "running" | "completed";
@@ -1049,6 +1049,7 @@ it.layer(layerTest)("delegated completion delivery repairs", (it) => {
     { command: "acknowledge", before: "running", after: "failed", capture: false },
     { command: "acknowledge", before: "waiting", after: "completed", capture: true },
     { command: "accept", before: "waiting", after: "completed", capture: true },
+    { command: "wake-policy", before: "running", after: "completed", capture: true },
   ] as const)(
     "keeps a $after run that settled between $command's read and commit",
     ({ command, before, after, capture }) =>
@@ -1062,14 +1063,20 @@ it.layer(layerTest)("delegated completion delivery repairs", (it) => {
         const taskId = NodeId.make(`node:${race}-task`);
         const checkpointId = CheckpointId.make(`checkpoint:${race}`);
         const messageId = MessageId.make(`message:delegated-delivery:${threadId}`);
+        const commandType = {
+          acknowledge: "delegated_task.completion-delivery.acknowledge",
+          accept: "notification.delivery.accept",
+          "wake-policy": "delegated_task.wake-policy",
+        }[command];
         yield* seedParentWithTerminalTask({
           threadId,
           projectId: ProjectId.make(`project:${race}`),
           runId,
           rootNodeId: NodeId.make(`node:${race}-root`),
           taskId,
-          deliveryState: "claimed",
-          deliveryTaskIds: [taskId],
+          ...(command === "wake-policy"
+            ? { deliveryState: "pending" }
+            : { deliveryState: "claimed", deliveryTaskIds: [taskId] }),
           now,
         });
         const parent = (yield* orchestrator.getThreadProjection(threadId)).runs[0]!;
@@ -1110,18 +1117,18 @@ it.layer(layerTest)("delegated completion delivery repairs", (it) => {
         const { delegatedCompletion: _cohort, ...settledRun } = parent;
         const commit = sink.commitCommand;
         let settled = false;
+        let planned: OrchestrationV2Run["delegatedCompletion"];
         yield* Effect.acquireUseRelease(
           Effect.sync(() =>
             vi.spyOn(sink, "commitCommand").mockImplementation((input) =>
               Effect.gen(function* () {
-                if (
-                  !settled &&
-                  input.commandType ===
-                    (command === "accept"
-                      ? "notification.delivery.accept"
-                      : "delegated_task.completion-delivery.acknowledge")
-                ) {
+                if (!settled && input.commandType === commandType) {
                   settled = true;
+                  const plannedRun = input.events.find((event) => event.type === "run.updated");
+                  planned =
+                    plannedRun?.type === "run.updated"
+                      ? plannedRun.payload.delegatedCompletion
+                      : undefined;
                   // The provider turn ends (or its checkpoint lands) after the command read the run.
                   yield* commit({
                     commandId: CommandId.make(`command:${race}`),
@@ -1159,13 +1166,21 @@ it.layer(layerTest)("delegated completion delivery repairs", (it) => {
                     threadId,
                     messageId,
                   }
-                : {
-                    type: "delegated_task.completion-delivery.acknowledge",
-                    commandId: CommandId.make(`command:${race}:task-status`),
-                    parentThreadId: threadId,
-                    taskId,
-                    observedByRunId: runId,
-                  },
+                : command === "wake-policy"
+                  ? {
+                      type: "delegated_task.wake-policy",
+                      commandId: CommandId.make(`command:${race}:wake-policy`),
+                      parentThreadId: threadId,
+                      taskId,
+                      completionWake: "always",
+                    }
+                  : {
+                      type: "delegated_task.completion-delivery.acknowledge",
+                      commandId: CommandId.make(`command:${race}:task-status`),
+                      parentThreadId: threadId,
+                      taskId,
+                      observedByRunId: runId,
+                    },
             ),
           (spy) => Effect.sync(() => spy.mockRestore()),
         );
@@ -1173,12 +1188,22 @@ it.layer(layerTest)("delegated completion delivery repairs", (it) => {
         const finished = yield* orchestrator.getThreadProjection(threadId);
         assert.equal(
           finished.subagents.find((row) => row.id === taskId)?.completionDelivery?.state,
-          command === "accept" ? "delivered" : "acknowledged",
+          { acknowledge: "acknowledged", accept: "delivered", "wake-policy": "claimed" }[command],
         );
         const run = finished.runs.find((candidate) => candidate.id === runId)!;
         assert.deepEqual(
-          { status: run.status, completedAt: run.completedAt, checkpointId: run.checkpointId },
-          { status: after, completedAt: now, checkpointId: capture ? checkpointId : null },
+          {
+            status: run.status,
+            completedAt: run.completedAt,
+            checkpointId: run.checkpointId,
+            delegatedCompletion: run.delegatedCompletion,
+          },
+          {
+            status: after,
+            completedAt: now,
+            checkpointId: capture ? checkpointId : null,
+            delegatedCompletion: planned,
+          },
         );
       }),
   );
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 59b708f5ba1cf..1059c88230788 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -8586,6 +8586,7 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         payload: completionPlan.message,
       });
     }
+    return completionPlan.parentRun?.id;
   });
 
   const dispatchCreatedThreadRecord = Effect.fn("orchestrationV2.dispatch.createdThreadRecord")(
@@ -13413,7 +13414,10 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         yield* dispatchRemoteDelegatedTaskStop(command, events);
         break;
       case "delegated_task.wake-policy":
-        yield* dispatchDelegatedTaskWakePolicy(command, events);
+        updateDelegatedCompletionOnlyRunId = yield* dispatchDelegatedTaskWakePolicy(
+          command,
+          events,
+        );
         break;
       case "delegated_task.completion-delivery.acknowledge":
       case "delegated_task.completion-delivery.dispose":

From a760f374f9ffd8c2f053850f8a120832722ea2e2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 10:32:56 -0800
Subject: [PATCH 019/167] perf(server): settled PR lookups stop re-spawning git
 every sweep (#29721)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/git/GitManager.test.ts | 73 ++++++++++++++++++++++
 apps/server/src/git/GitManager.ts      | 83 +++++++++++++++++++++-----
 2 files changed, 141 insertions(+), 15 deletions(-)

diff --git a/apps/server/src/git/GitManager.test.ts b/apps/server/src/git/GitManager.test.ts
index 3c1f225ca35f7..ff43a8641461e 100644
--- a/apps/server/src/git/GitManager.test.ts
+++ b/apps/server/src/git/GitManager.test.ts
@@ -20,6 +20,7 @@ import * as PlatformError from "effect/PlatformError";
 import * as Result from "effect/Result";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
 import { ChildProcessSpawner } from "effect/process";
 import { expect } from "vite-plus/test";
 import type {
@@ -1077,6 +1078,78 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
     }),
   );
 
+  it.effect("a settled branch PR is rechecked only when the branch moves or every 15 minutes", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      yield* runGit(repoDir, ["push", "-u", "origin", "main"]);
+      yield* runGit(repoDir, ["checkout", "-b", "feature/settled"]);
+      yield* runGit(repoDir, ["push", "-u", "origin", "feature/settled"]);
+      const pullRequest = (number: number, state: "open" | "merged"): FakeChangeRequest => ({
+        number,
+        title: "Settled",
+        url: `https://github.com/pingdotgg/codething-mvp/pull/${number}`,
+        baseRefName: "main",
+        headRefName: "feature/settled",
+        state,
+        updatedAt: `2026-04-0${number}T15:00:00Z`,
+      });
+      const gitCommands: string[] = [];
+      const { manager } = yield* makeManager({
+        gitCommands,
+        providerScenario: {
+          prListSequence: [
+            [pullRequest(1, "merged")],
+            [pullRequest(1, "merged")],
+            [pullRequest(1, "merged")],
+          ],
+          prListOtherwise: [pullRequest(2, "open")],
+        },
+      });
+      const lookup = manager.branchPullRequest({ cwd: repoDir, branch: "feature/settled" });
+      const freshLookups = () => gitCommands.filter((args) => args === "remote").length;
+
+      expect((yield* lookup)?.state).toBe("merged");
+      gitCommands.length = 0;
+      expect((yield* lookup)?.state).toBe("merged");
+      expect((yield* lookup)?.state).toBe("merged");
+      expect(gitCommands.map((args) => args.split(" ", 1)[0]).toSorted()).toEqual([
+        "config",
+        "config",
+        "for-each-ref",
+        "for-each-ref",
+      ]);
+      expect(freshLookups()).toBe(0);
+
+      NodeFS.writeFileSync(NodePath.join(repoDir, "settled.txt"), "new work\n");
+      yield* runGit(repoDir, ["add", "settled.txt"]);
+      yield* runGit(repoDir, ["commit", "-m", "New work"]);
+      gitCommands.length = 0;
+      expect((yield* lookup)?.state).toBe("merged");
+      expect(freshLookups()).toBe(1);
+      gitCommands.length = 0;
+      yield* lookup;
+      expect(freshLookups()).toBe(0);
+
+      // Remembered git state expires after 5 minutes; that rereads git without a recheck.
+      yield* TestClock.adjust("10 minutes");
+      gitCommands.length = 0;
+      expect((yield* lookup)?.state).toBe("merged");
+      expect(freshLookups()).toBe(1);
+
+      yield* TestClock.adjust("5 minutes");
+      gitCommands.length = 0;
+      expect((yield* lookup)?.state).toBe("merged");
+      expect(freshLookups()).toBe(2);
+
+      // A new PR from the reused branch shows on the next host query.
+      yield* TestClock.adjust("5 minutes");
+      expect((yield* lookup)?.number).toBe(2);
+    }),
+  );
+
   it.effect("branch PR lookup uses a saved tracked branch without changing checkout", () =>
     Effect.gen(function* () {
       const repoDir = yield* makeTempDir("t3code-git-manager-");
diff --git a/apps/server/src/git/GitManager.ts b/apps/server/src/git/GitManager.ts
index d1f48bfed3681..993eff3a35f54 100644
--- a/apps/server/src/git/GitManager.ts
+++ b/apps/server/src/git/GitManager.ts
@@ -171,6 +171,7 @@ const PR_LOOKUP_FAILURE_BASE_TTL = Duration.seconds(20);
 const PR_LOOKUP_FAILURE_MAX_TTL = Duration.minutes(15);
 const PR_LOOKUP_CACHE_CAPACITY = 2_048;
 const PR_LOOKUP_GIT_STATE_TTL = Duration.minutes(5);
+const SETTLED_PR_LOOKUP_RECHECK_INTERVAL = Duration.minutes(15);
 const PR_THREAD_CONTEXT_BYTES = 16_000;
 const PR_THREAD_COMMAND_OUTPUT_CHARS = 2_000;
 const isSourceControlProviderError = Schema.is(SourceControlProviderError);
@@ -2425,6 +2426,10 @@ export const make = Effect.gen(function* () {
     prLookupGitStateByKey.set(entryKey, { readAtMs, value });
     return value;
   });
+  const settledPrLookupByBranchKey = new Map<
+    string,
+    { readonly url: string; readonly fingerprint: string; readonly confirmedAtMs: number }
+  >();
   const forgetPrLookupGitState = (cwd: string) =>
     normalizeStatusCacheKey(cwd).pipe(
       Effect.map((cacheCwd) => {
@@ -2470,6 +2475,39 @@ export const make = Effect.gen(function* () {
       };
     },
   );
+  // objectname lets a settled PR result notice new commits on its branch.
+  const readPrLookupBranchRef = (cacheCwd: string, branch: string, fresh: boolean) =>
+    rememberPrLookupGitState(
+      cacheCwd,
+      `branchRef\u0000${branch}`,
+      fresh,
+      gitCore
+        .execute({
+          operation: "GitManager.branchPullRequest.branchRef",
+          cwd: cacheCwd,
+          args: [
+            "for-each-ref",
+            "--format=%(refname)%00%(upstream:short)%00%(upstream:remotename)%00%(upstream:remoteref)%00%(objectname)",
+            `refs/heads/${branch}`,
+          ],
+        })
+        .pipe(Effect.map((result) => result.stdout)),
+    );
+  const readSettledPrLookupFingerprint = (cacheCwd: string, branch: string) =>
+    Effect.all(
+      [
+        readPrLookupBranchRef(cacheCwd, branch, true),
+        gitCore
+          .execute({
+            operation: "GitManager.branchPullRequest.remoteUrls",
+            cwd: cacheCwd,
+            args: ["config", "--get-regexp", "^remote\\..*\\.url$"],
+            allowNonZeroExit: true,
+          })
+          .pipe(Effect.map((result) => result.stdout)),
+      ],
+      { concurrency: "unbounded" },
+    ).pipe(Effect.map((parts) => parts.join("\u0000")));
   const lookupBranchPullRequest = Effect.fn("lookupBranchPullRequest")(function* (
     cacheCwd: string,
     branch: string,
@@ -2493,20 +2531,7 @@ export const make = Effect.gen(function* () {
       .filter((remoteName) => remoteName.length > 0);
     const [firstRemoteName] = remoteNames;
     if (firstRemoteName === undefined) return null;
-    const branchRef = yield* remember(
-      `branchRef\u0000${branch}`,
-      gitCore
-        .execute({
-          operation: "GitManager.branchPullRequest.branchRef",
-          cwd: cacheCwd,
-          args: [
-            "for-each-ref",
-            "--format=%(refname)%00%(upstream:short)%00%(upstream:remotename)%00%(upstream:remoteref)",
-            `refs/heads/${branch}`,
-          ],
-        })
-        .pipe(Effect.map((result) => result.stdout)),
-    );
+    const branchRef = yield* readPrLookupBranchRef(cacheCwd, branch, options.freshGitState);
     const expectedRefName = `refs/heads/${branch}`;
     const exactBranch = (branchRef ?? "")
       .split("\n")
@@ -2657,10 +2682,38 @@ export const make = Effect.gen(function* () {
       freshGitState,
     });
     if (pullRequest === null || pullRequest.state === "open" || freshGitState) return pullRequest;
-    return yield* lookupBranchPullRequest(cacheCwd, branch, {
+    // A confirmed closed or merged result stays final until the branch or remotes change,
+    // with a periodic fresh lookup so a new PR from a reused branch still shows up.
+    const settledKey = `${cacheCwd}\u0000${branch}`;
+    const now = yield* Clock.currentTimeMillis;
+    const settled = settledPrLookupByBranchKey.get(settledKey);
+    // Read before any fresh lookup, so a change made during it forces another one.
+    const fingerprint = yield* readSettledPrLookupFingerprint(cacheCwd, branch);
+    if (
+      settled !== undefined &&
+      settled.url === pullRequest.url &&
+      settled.fingerprint === fingerprint &&
+      now - settled.confirmedAtMs < Duration.toMillis(SETTLED_PR_LOOKUP_RECHECK_INTERVAL)
+    ) {
+      return pullRequest;
+    }
+    const confirmed = yield* lookupBranchPullRequest(cacheCwd, branch, {
       refresh: false,
       freshGitState: true,
     });
+    settledPrLookupByBranchKey.delete(settledKey);
+    if (confirmed !== null && confirmed.state !== "open") {
+      if (settledPrLookupByBranchKey.size >= PR_LOOKUP_CACHE_CAPACITY) {
+        const oldestKey = settledPrLookupByBranchKey.keys().next().value;
+        if (oldestKey !== undefined) settledPrLookupByBranchKey.delete(oldestKey);
+      }
+      settledPrLookupByBranchKey.set(settledKey, {
+        url: confirmed.url,
+        fingerprint,
+        confirmedAtMs: now,
+      });
+    }
+    return confirmed;
   });
   const invalidateLocalStatus: GitManager["Service"]["invalidateLocalStatus"] = Effect.fn(
     "invalidateLocalStatus",

From 4a09502b38e2d30ad23871f85fd629e8c3473e7d Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 18:41:23 +0000
Subject: [PATCH 020/167] fix(server): generated commit and PR text ignores git
 signature output (#29580)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/git/GitManager.test.ts       | 40 ++++++++++++++++++++
 apps/server/src/git/GitManager.ts            |  2 +-
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 23 ++++++++++-
 apps/server/src/vcs/GitVcsDriverCore.ts      | 10 ++++-
 4 files changed, 71 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/git/GitManager.test.ts b/apps/server/src/git/GitManager.test.ts
index ff43a8641461e..fec3b01238334 100644
--- a/apps/server/src/git/GitManager.test.ts
+++ b/apps/server/src/git/GitManager.test.ts
@@ -2638,6 +2638,46 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
     }),
   );
 
+  it.effect("keeps signature output out of recent commit subjects", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const signingKey = NodePath.join(yield* makeTempDir("t3code-git-signing-key-"), "key");
+      NodeChildProcess.execFileSync("ssh-keygen", [
+        "-q",
+        "-t",
+        "ed25519",
+        "-N",
+        "",
+        "-f",
+        signingKey,
+      ]);
+      yield* runGit(repoDir, ["config", "gpg.format", "ssh"]);
+      // A global signer such as 1Password's cannot use the fixture's generated key.
+      yield* runGit(repoDir, ["config", "gpg.ssh.program", "ssh-keygen"]);
+      yield* runGit(repoDir, ["config", "user.signingkey", `${signingKey}.pub`]);
+      yield* runGit(repoDir, ["config", "log.showSignature", "true"]);
+      yield* runGit(repoDir, ["commit", "--amend", "-S", "--no-edit"]);
+      NodeFS.writeFileSync(NodePath.join(repoDir, "README.md"), "hello again\n");
+      let commitInstructions: string | undefined;
+
+      const { manager } = yield* makeManager({
+        textGeneration: {
+          generateCommitMessage: (input) => {
+            commitInstructions = input.policy?.commitInstructions;
+            return Effect.succeed({ subject: "Update readme", body: "" });
+          },
+        },
+      });
+
+      yield* runStackedAction(manager, { cwd: repoDir, action: "commit" });
+
+      expect(commitInstructions).toMatch(
+        /Recent commit subjects from this repository:\nInitial commit$/,
+      );
+    }),
+  );
+
   it.effect("falls back when the dedicated source control writer is unavailable", () =>
     Effect.gen(function* () {
       const repoDir = yield* makeTempDir("t3code-git-manager-");
diff --git a/apps/server/src/git/GitManager.ts b/apps/server/src/git/GitManager.ts
index 993eff3a35f54..feb896b387aeb 100644
--- a/apps/server/src/git/GitManager.ts
+++ b/apps/server/src/git/GitManager.ts
@@ -792,7 +792,7 @@ export const make = Effect.gen(function* () {
       .execute({
         operation: "GitManager.readRecentCommitSubjects",
         cwd,
-        args: ["log", "-n", "20", "--no-merges", "--pretty=format:%s"],
+        args: ["log", "-n", "20", "--no-merges", "--no-show-signature", "--pretty=format:%s"],
       })
       .pipe(
         Effect.map((result) =>
diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 1c3e075d165c8..7c9e764f441b3 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -2849,20 +2849,38 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
       }),
     );
 
-    it.effect("reads range patches from source without textconv, color, or diff.relative", () =>
+    it.effect("reads raw range context regardless of Git display configuration", () =>
       Effect.gen(function* () {
         const cwd = yield* makeTmpDir();
         const { initialBranch } = yield* initRepoWithCommit(cwd);
         yield* git(cwd, ["config", "diff.probe.textconv", "touch textconv-ran; echo converted"]);
         yield* git(cwd, ["config", "color.ui", "always"]);
         yield* git(cwd, ["config", "diff.relative", "true"]);
+        yield* git(cwd, ["config", "log.decorate", "short"]);
         yield* git(cwd, ["checkout", "-b", "feature/range"]);
         yield* writeTextFile(cwd, ".gitattributes", "*.doc diff=probe\n");
         yield* writeTextFile(cwd, "notes.doc", "source line\n");
         yield* writeTextFile(cwd, "plain.txt", "plain line\n");
         yield* writeTextFile(cwd, "binary.dat", "binary\0data");
         yield* git(cwd, ["add", "."]);
-        yield* git(cwd, ["commit", "-m", "range files"]);
+        const signingKey = `${yield* makeTmpDir("git-vcs-driver-signing-key-")}/key`;
+        const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const keygen = ChildProcess.make("ssh-keygen", [
+          "-q",
+          "-t",
+          "ed25519",
+          "-N",
+          "",
+          "-f",
+          signingKey,
+        ]);
+        assert.equal(Number(yield* spawner.exitCode(keygen)), 0);
+        yield* git(cwd, ["config", "gpg.format", "ssh"]);
+        // A global signer such as 1Password's cannot use the fixture's generated key.
+        yield* git(cwd, ["config", "gpg.ssh.program", "ssh-keygen"]);
+        yield* git(cwd, ["config", "user.signingkey", `${signingKey}.pub`]);
+        yield* git(cwd, ["config", "log.showSignature", "true"]);
+        yield* git(cwd, ["commit", "-S", "-m", "range files"]);
         const driver = yield* GitVcsDriver.GitVcsDriver;
         const fileSystem = yield* FileSystem.FileSystem;
         const projectCwd = `${cwd}/app`;
@@ -2870,6 +2888,7 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
 
         const context = yield* driver.readRangeContext(projectCwd, initialBranch);
 
+        assert.match(context.commitSummary.trim(), /^[a-f0-9]+ range files$/);
         assert.include(context.diffPatch, "+source line");
         assert.notInclude(context.diffPatch, "converted");
         assert.include(context.diffPatch, "+plain line");
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 2736cbc6d4fcb..f8b59f389567b 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -2942,7 +2942,15 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         runGitStdoutWithOptions(
           "GitVcsDriver.readRangeContext.log",
           cwd,
-          ["log", "--oneline", "--no-color", "--end-of-options", commitRange],
+          [
+            "log",
+            "--oneline",
+            "--no-color",
+            "--no-decorate",
+            "--no-show-signature",
+            "--end-of-options",
+            commitRange,
+          ],
           {
             maxOutputBytes: RANGE_COMMIT_SUMMARY_MAX_OUTPUT_BYTES,
             appendTruncationMarker: true,

From ea68f2a66759fcef6b1673891ece4577ed97bed9 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 18:43:11 +0000
Subject: [PATCH 021/167] fix(web): picking a branch in a subfolder project
 keeps the thread in the project folder (#29908)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Maria <maria-rcks@users.noreply.github.com>
---
 .../components/BranchToolbar.logic.test.ts    | 51 ++++++++++++++-----
 .../web/src/components/BranchToolbar.logic.ts |  9 +++-
 .../BranchToolbarBranchSelector.tsx           |  8 +++
 3 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/apps/web/src/components/BranchToolbar.logic.test.ts b/apps/web/src/components/BranchToolbar.logic.test.ts
index 08e6f7633dee3..903a20066b39e 100644
--- a/apps/web/src/components/BranchToolbar.logic.test.ts
+++ b/apps/web/src/components/BranchToolbar.logic.test.ts
@@ -160,6 +160,18 @@ describe("dedupeRemoteBranchesWithLocalMatches", () => {
 
 describe("resolveBranchSelectionTarget", () => {
   it("reuses an existing secondary worktree for the selected ref", () => {
+    expect(
+      resolveBranchSelectionTarget({
+        activeProjectCwd: "/repo/nested-checkout/packages/app",
+        activeProjectCheckoutRoot: "/repo/nested-checkout",
+        activeWorktreePath: null,
+        refName: { isDefault: true, worktreePath: "/repo" },
+      }),
+    ).toEqual({
+      checkoutCwd: "/repo",
+      nextWorktreePath: "/repo",
+      reuseExistingWorktree: true,
+    });
     expect(
       resolveBranchSelectionTarget({
         activeProjectCwd: "/repo",
@@ -177,20 +189,31 @@ describe("resolveBranchSelectionTarget", () => {
   });
 
   it("switches back to the main repo when the ref already lives there", () => {
-    expect(
-      resolveBranchSelectionTarget({
-        activeProjectCwd: "/repo",
-        activeWorktreePath: "/repo/.t3/worktrees/feature-a",
-        refName: {
-          isDefault: true,
-          worktreePath: "/repo",
-        },
-      }),
-    ).toEqual({
-      checkoutCwd: "/repo",
-      nextWorktreePath: null,
-      reuseExistingWorktree: true,
-    });
+    // A subdirectory project's own checkout is reported at the repository root.
+    // The checkout root is undefined until the project's status loads.
+    for (const [activeProjectCwd, activeWorktreePath, activeProjectCheckoutRoot] of [
+      ["/repo", "/repo/.t3/worktrees/feature-a", "/repo"],
+      ["/repo/packages/app", "/repo/.t3/worktrees/feature-a", "/repo"],
+      ["/repo/packages/app", null, "/repo"],
+      ["/repo/packages/app", "/repo/.t3/worktrees/feature-a", undefined],
+      ["/repo/packages/app", null, undefined],
+    ] as const) {
+      expect(
+        resolveBranchSelectionTarget({
+          activeProjectCwd,
+          activeProjectCheckoutRoot,
+          activeWorktreePath,
+          refName: {
+            isDefault: true,
+            worktreePath: "/repo",
+          },
+        }),
+      ).toEqual({
+        checkoutCwd: "/repo",
+        nextWorktreePath: null,
+        reuseExistingWorktree: true,
+      });
+    }
   });
 
   it("keeps checkout in the current worktree for non-default refs", () => {
diff --git a/apps/web/src/components/BranchToolbar.logic.ts b/apps/web/src/components/BranchToolbar.logic.ts
index e22dcfaddedeb..a967c3171fbd1 100644
--- a/apps/web/src/components/BranchToolbar.logic.ts
+++ b/apps/web/src/components/BranchToolbar.logic.ts
@@ -7,6 +7,7 @@ import type {
 } from "@t3tools/contracts";
 import * as Schema from "effect/Schema";
 import { sanitizeNewRefName } from "@t3tools/shared/git";
+import { workspaceRelativeFilePath } from "@t3tools/shared/path";
 import { toSortableTimestamp } from "@t3tools/client-runtime/state/thread-sort";
 export { deriveLocalBranchNameFromRemoteRef, sanitizeNewRefName } from "@t3tools/shared/git";
 
@@ -247,6 +248,7 @@ export function resolveLocalCheckoutBranchMismatch(input: {
 
 export function resolveBranchSelectionTarget(input: {
   activeProjectCwd: string;
+  activeProjectCheckoutRoot?: string | undefined;
   activeWorktreePath: string | null;
   refName: Pick<VcsRef, "isDefault" | "worktreePath">;
 }): {
@@ -257,9 +259,14 @@ export function resolveBranchSelectionTarget(input: {
   const { activeProjectCwd, activeWorktreePath, refName } = input;
 
   if (refName.worktreePath) {
+    // Until the project's checkout root loads, a checkout containing the project counts as its own.
+    const isProjectCheckout =
+      input.activeProjectCheckoutRoot === undefined
+        ? workspaceRelativeFilePath(activeProjectCwd, refName.worktreePath) !== null
+        : workspaceRelativeFilePath(input.activeProjectCheckoutRoot, refName.worktreePath) === ".";
     return {
       checkoutCwd: refName.worktreePath,
-      nextWorktreePath: refName.worktreePath === activeProjectCwd ? null : refName.worktreePath,
+      nextWorktreePath: isProjectCheckout ? null : refName.worktreePath,
       reuseExistingWorktree: true,
     };
   }
diff --git a/apps/web/src/components/BranchToolbarBranchSelector.tsx b/apps/web/src/components/BranchToolbarBranchSelector.tsx
index fab250f6adaf8..9782f258afe19 100644
--- a/apps/web/src/components/BranchToolbarBranchSelector.tsx
+++ b/apps/web/src/components/BranchToolbarBranchSelector.tsx
@@ -224,6 +224,12 @@ export function BranchToolbarBranchSelector({
           input: { cwd: branchCwd },
         }),
   );
+  const projectStatusQuery = useEnvironmentQuery(
+    activeProjectCwd === null
+      ? null
+      : vcsEnvironment.status({ environmentId, input: { cwd: activeProjectCwd } }),
+  );
+  const activeProjectCheckoutRoot = projectStatusQuery.data?.workingTree.rootPath;
   const trimmedBranchQuery = branchQuery.trim();
   const branchRefState = usePaginatedBranches({
     environmentId,
@@ -389,6 +395,7 @@ export function BranchToolbarBranchSelector({
 
     const selectionTarget = resolveBranchSelectionTarget({
       activeProjectCwd,
+      activeProjectCheckoutRoot,
       activeWorktreePath,
       refName,
     });
@@ -631,6 +638,7 @@ export function BranchToolbarBranchSelector({
             (!activeProjectCwd ||
               !resolveBranchSelectionTarget({
                 activeProjectCwd,
+                activeProjectCheckoutRoot,
                 activeWorktreePath,
                 refName,
               }).reuseExistingWorktree))

From 499727ddad87468cc22e23e5d8c92b9013f546c0 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 10:57:09 -0800
Subject: [PATCH 022/167] fix(mobile): close and reopen pull requests from the
 actions menu (#29962)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../pull-requests/PullRequestRouteScreen.tsx  | 27 +++++++++++++++++++
 .../pull-requests/PullRequestStatusRows.tsx   |  7 +----
 .../pull-requests/usePullRequestAction.ts     | 12 +++++++--
 3 files changed, 38 insertions(+), 8 deletions(-)

diff --git a/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx b/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
index 4e55ed4ef651b..6129f80d439ec 100644
--- a/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
+++ b/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
@@ -423,6 +423,13 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
     permissions.canEditMaintainerEdits,
   );
   const showsDeleteBranch = pr !== null && canPerformPullRequestAction(pr, "delete-branch");
+  const stateAction = action.available("close")
+    ? "close"
+    : action.available("reopen")
+      ? "reopen"
+      : null;
+  const runStateAction = () =>
+    stateAction === "close" ? action.confirmClose() : void action.perform("reopen");
   const confirmDeleteBranch = () =>
     pr &&
     action.confirm(
@@ -557,6 +564,17 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
                     },
                   ]
                 : []),
+              ...(stateAction
+                ? [
+                    {
+                      accessibilityLabel: pullRequestActionLabel(stateAction, terminology),
+                      icon: PR_ACTION_ICONS[stateAction],
+                      destructive: stateAction === "close",
+                      overflowOnly: true,
+                      onPress: runStateAction,
+                    },
+                  ]
+                : []),
               ...(showsDeleteBranch
                 ? [
                     {
@@ -648,6 +666,15 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
                 <Toolbar.Label>Share…</Toolbar.Label>
               </Toolbar.MenuAction>
             ) : null}
+            {stateAction ? (
+              <Toolbar.MenuAction
+                icon={PR_ACTION_ICONS[stateAction]}
+                destructive={stateAction === "close"}
+                onPress={runStateAction}
+              >
+                <Toolbar.Label>{pullRequestActionLabel(stateAction, terminology)}</Toolbar.Label>
+              </Toolbar.MenuAction>
+            ) : null}
             {showsDeleteBranch ? (
               <Toolbar.MenuAction
                 icon={PR_ACTION_ICONS["delete-branch"]}
diff --git a/apps/mobile/src/features/pull-requests/PullRequestStatusRows.tsx b/apps/mobile/src/features/pull-requests/PullRequestStatusRows.tsx
index 185d555cc776b..52d5505c45604 100644
--- a/apps/mobile/src/features/pull-requests/PullRequestStatusRows.tsx
+++ b/apps/mobile/src/features/pull-requests/PullRequestStatusRows.tsx
@@ -86,12 +86,7 @@ export function PullRequestStatusMenu(props: RowProps) {
       onPressAction={({ nativeEvent }) => {
         const selected = actions.find((id) => id === nativeEvent.event);
         if (!selected) return;
-        if (selected === "close")
-          action.confirm(
-            selected,
-            pullRequestActionLabel("close", terminology),
-            `Close this ${terminology.singular} without merging its changes?`,
-          );
+        if (selected === "close") action.confirmClose();
         else if (selected === "revert")
           action.confirm(
             selected,
diff --git a/apps/mobile/src/features/pull-requests/usePullRequestAction.ts b/apps/mobile/src/features/pull-requests/usePullRequestAction.ts
index f53a8523d6b24..4658330dd6cc3 100644
--- a/apps/mobile/src/features/pull-requests/usePullRequestAction.ts
+++ b/apps/mobile/src/features/pull-requests/usePullRequestAction.ts
@@ -11,7 +11,7 @@ import type {
 import { useRef, useState } from "react";
 import { composerPullRequests } from "../../state/pull-requests";
 import { useAtomCommand } from "../../state/use-atom-command";
-import { canPerformPullRequestAction } from "./pullRequestActions";
+import { canPerformPullRequestAction, pullRequestActionLabel } from "./pullRequestActions";
 import { pullRequestTarget, type PullRequestParams } from "./usePullRequestDiff";
 import { usePullRequestPermissions } from "./usePullRequestPermissions";
 
@@ -55,5 +55,13 @@ export function usePullRequestAction(params: PullRequestParams, pr: PullRequestD
         onPress: () => void perform(action),
       },
     ]);
-  return { available, perform, confirm, busy };
+  const confirmClose = () => {
+    const terminology = sourceControlClients.get(pr?.provider).changeRequest;
+    confirm(
+      "close",
+      pullRequestActionLabel("close", terminology),
+      `Close this ${terminology.singular} without merging its changes?`,
+    );
+  };
+  return { available, perform, confirm, confirmClose, busy };
 }

From ac10bb4aba85156bac5d306b3c288e9d8d7f03ef Mon Sep 17 00:00:00 2001
From: oliver <97427849+flamboh@users.noreply.github.com>
Date: Tue, 3 Nov 2026 11:08:57 -0800
Subject: [PATCH 023/167] fix(web): mouse wheel over the thread minimap glides
 instead of jumping (#29038)

---
 .../chat/timelineMinimapWheel.browser.test.ts | 54 +++++++++++++
 .../components/chat/timelineMinimapWheel.ts   | 80 ++++++++++++++++++-
 2 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/components/chat/timelineMinimapWheel.browser.test.ts

diff --git a/apps/web/src/components/chat/timelineMinimapWheel.browser.test.ts b/apps/web/src/components/chat/timelineMinimapWheel.browser.test.ts
new file mode 100644
index 0000000000000..d107269da7b6f
--- /dev/null
+++ b/apps/web/src/components/chat/timelineMinimapWheel.browser.test.ts
@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { fakeTimers } from "../../../test/render";
+import { forwardWheelToTimeline } from "./timelineMinimapWheel";
+
+function mountTimeline() {
+  const timeline = document.createElement("div");
+  timeline.style.cssText = "height: 200px; overflow-y: auto;";
+  const content = document.createElement("div");
+  content.style.height = "2000px";
+  timeline.append(content);
+  document.body.append(timeline);
+  return Object.assign(timeline, { [Symbol.dispose]: () => timeline.remove() });
+}
+
+function wheel(deltaY: number, wheelDeltaY: number): WheelEvent {
+  const init = { cancelable: true, deltaY, wheelDeltaY };
+  return new WheelEvent("wheel", init);
+}
+
+describe("forwardWheelToTimeline", () => {
+  it.each([
+    ["macOS", -360],
+    ["Linux and Windows", -120],
+  ])("scrolls %s trackpad deltas immediately", (_platform, wheelDeltaY) => {
+    using timeline = mountTimeline();
+    forwardWheelToTimeline(wheel(120, wheelDeltaY), timeline);
+    expect(timeline.scrollTop).toBe(120);
+  });
+
+  it("glides mouse wheel notches and accumulates them", () => {
+    using timeline = mountTimeline();
+    using _timers = fakeTimers();
+    forwardWheelToTimeline(wheel(100, -120), timeline);
+    forwardWheelToTimeline(wheel(100, -120), timeline);
+    expect(timeline.scrollTop).toBe(0);
+    vi.advanceTimersByTime(75);
+    expect(timeline.scrollTop).toBeGreaterThan(0);
+    expect(timeline.scrollTop).toBeLessThan(200);
+    vi.advanceTimersByTime(100);
+    expect(timeline.scrollTop).toBe(200);
+  });
+
+  it("stops gliding when the user clicks or navigates", () => {
+    using timeline = mountTimeline();
+    using _timers = fakeTimers();
+    forwardWheelToTimeline(wheel(100, -120), timeline);
+    vi.advanceTimersByTime(50);
+    timeline.scrollTop = 1000;
+    window.dispatchEvent(new PointerEvent("pointerdown"));
+    vi.advanceTimersByTime(200);
+    expect(timeline.scrollTop).toBe(1000);
+  });
+});
diff --git a/apps/web/src/components/chat/timelineMinimapWheel.ts b/apps/web/src/components/chat/timelineMinimapWheel.ts
index 94cbd8ce008ff..5befc4efb8100 100644
--- a/apps/web/src/components/chat/timelineMinimapWheel.ts
+++ b/apps/web/src/components/chat/timelineMinimapWheel.ts
@@ -1,3 +1,75 @@
+const MOUSE_WHEEL_SCROLL_MS = 150;
+const PRECISE_WHEEL_DELTA_RATIOS = [1, 3];
+
+interface WheelGlide {
+  from: number;
+  to: number;
+  start: number;
+  written: number;
+  frame: number;
+  interruptions: AbortController;
+}
+
+const glides = new WeakMap<HTMLElement, WheelGlide>();
+
+function isPreciseWheel(event: WheelEvent): boolean {
+  if (event.deltaMode !== WheelEvent.DOM_DELTA_PIXEL) return false;
+  const { wheelDeltaY } = event as WheelEvent & { wheelDeltaY?: number };
+  return (
+    wheelDeltaY === undefined ||
+    PRECISE_WHEEL_DELTA_RATIOS.some((ratio) => Math.abs(wheelDeltaY + ratio * event.deltaY) < 1)
+  );
+}
+
+function stopGlide(timeline: HTMLElement): WheelGlide | undefined {
+  const glide = glides.get(timeline);
+  if (!glide) return undefined;
+  cancelAnimationFrame(glide.frame);
+  glide.interruptions.abort();
+  glides.delete(timeline);
+  return glide;
+}
+
+function glideBy(timeline: HTMLElement, distance: number): void {
+  const current = stopGlide(timeline);
+  const scrollTop = timeline.scrollTop;
+  const base = current ? current.to + scrollTop - current.written : scrollTop;
+  const maxScrollTop = timeline.scrollHeight - timeline.clientHeight;
+  const glide: WheelGlide = {
+    from: scrollTop,
+    to: Math.max(0, Math.min(maxScrollTop, base + distance)),
+    start: performance.now(),
+    written: scrollTop,
+    frame: 0,
+    interruptions: new AbortController(),
+  };
+  for (const type of ["pointerdown", "keydown"]) {
+    window.addEventListener(type, () => stopGlide(timeline), {
+      capture: true,
+      signal: glide.interruptions.signal,
+    });
+  }
+  const step = (time: number) => {
+    if (!timeline.isConnected) {
+      stopGlide(timeline);
+      return;
+    }
+    const drift = timeline.scrollTop - glide.written;
+    glide.from += drift;
+    glide.to += drift;
+    const progress = Math.min(1, Math.max(0, (time - glide.start) / MOUSE_WHEEL_SCROLL_MS));
+    timeline.scrollTop = glide.from + (glide.to - glide.from) * (1 - (1 - progress) ** 3);
+    glide.written = timeline.scrollTop;
+    if (progress < 1) {
+      glide.frame = requestAnimationFrame(step);
+    } else {
+      stopGlide(timeline);
+    }
+  };
+  glide.frame = requestAnimationFrame(step);
+  glides.set(timeline, glide);
+}
+
 export function forwardWheelToTimeline(event: WheelEvent, timeline: HTMLElement): void {
   if (event.defaultPrevented || event.ctrlKey || event.deltaY === 0) return;
   event.preventDefault();
@@ -25,5 +97,11 @@ export function forwardWheelToTimeline(event: WheelEvent, timeline: HTMLElement)
       : event.deltaMode === WheelEvent.DOM_DELTA_PAGE
         ? timeline.clientHeight
         : 1;
-  timeline.scrollBy({ top: event.deltaY * pixelsPerUnit });
+  const distance = event.deltaY * pixelsPerUnit;
+  if (isPreciseWheel(event) || window.matchMedia("(prefers-reduced-motion: reduce)").matches) {
+    stopGlide(timeline);
+    timeline.scrollBy({ top: distance });
+    return;
+  }
+  glideBy(timeline, distance);
 }

From 7ab237fc1d05e2373fbaed6a9250b528c5bd72c2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:11:08 -0800
Subject: [PATCH 024/167] fix(server): managed policy covers Kiro (#29915)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/policy/ManagedPolicy.test.ts | 15 +++++++++++++++
 apps/server/src/policy/managedProviders.ts   |  2 ++
 docs/user/managed-policy.md                  |  3 ++-
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/policy/ManagedPolicy.test.ts b/apps/server/src/policy/ManagedPolicy.test.ts
index 9fbe4d2c42791..26e74f05b0372 100644
--- a/apps/server/src/policy/ManagedPolicy.test.ts
+++ b/apps/server/src/policy/ManagedPolicy.test.ts
@@ -11,6 +11,7 @@ import {
 } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 
+import { BUILT_IN_DRIVERS } from "../provider/builtInDrivers.ts";
 import * as ManagedPolicy from "./ManagedPolicy.ts";
 import { disallowedDriverReason, providerHostEnvironment } from "./managedProviders.ts";
 
@@ -349,6 +350,20 @@ it.layer(NodeServices.layer)("ManagedPolicy.load", (it) => {
 
   it.effect("tells clients which drivers run and which instance fields are locked", () =>
     Effect.gen(function* () {
+      // A provider the policy cannot name would also escape its launch-setting rules.
+      const everyDriver = BUILT_IN_DRIVERS.map((driver) => driver.driverKind);
+      const allowingAll = yield* loadFrom(
+        JSON.stringify({
+          schemaVersion: 1,
+          organization: "Example Corp",
+          limits: { providers: { allowedDrivers: everyDriver } },
+        }),
+      );
+      assert.deepEqual<unknown>(
+        allowingAll.summary?.limits?.providers?.allowedDrivers,
+        everyDriver,
+      );
+
       const policy = yield* loadFrom(
         JSON.stringify({
           schemaVersion: 1,
diff --git a/apps/server/src/policy/managedProviders.ts b/apps/server/src/policy/managedProviders.ts
index cbf0f0a1d9b24..5d9ce6aee62d2 100644
--- a/apps/server/src/policy/managedProviders.ts
+++ b/apps/server/src/policy/managedProviders.ts
@@ -19,6 +19,7 @@ import { acpRegistryClient } from "@t3tools/provider-acp-registry/client";
 import { cursorClient } from "@t3tools/provider-cursor/client";
 import { fxClient } from "@t3tools/provider-fx/client";
 import { grokClient } from "@t3tools/provider-grok/client";
+import { kiroClient } from "@t3tools/provider-kiro/client";
 import { museClient } from "@t3tools/provider-muse/client";
 import { openCodeClient } from "@t3tools/provider-opencode/client";
 import { piClient } from "@t3tools/provider-pi/client";
@@ -45,6 +46,7 @@ const PACKAGED_CLIENTS: ReadonlyArray<ProviderClientDefinition> = [
   cursorClient,
   grokClient,
   fxClient,
+  kiroClient,
   museClient,
   openCodeClient,
   piClient,
diff --git a/docs/user/managed-policy.md b/docs/user/managed-policy.md
index e1ba501e6fa3d..6df5375684895 100644
--- a/docs/user/managed-policy.md
+++ b/docs/user/managed-policy.md
@@ -232,7 +232,8 @@ so restart T3 Code after that.
 
 `providers.allowedDrivers` lists the providers that may run, by ID: `codex` (Codex),
 `claudeAgent` (Claude), `cursor` (Cursor), `grok` (Grok), `opencode` (OpenCode), `antigravity`
-(Antigravity), `fx` (fx), `pi` (Pi), `muse` (Muse Code), and `acpRegistry` (ACP Registry).
+(Antigravity), `fx` (fx), `kiro` (Kiro), `pi` (Pi), `muse` (Muse Code), and `acpRegistry` (ACP
+Registry).
 `t3 policy check` rejects an ID this version does not know. Threads on other providers stay,
 marked unavailable, and users can still turn those providers off.
 

From 7681605d7375cfa25e72ca48db56bb76e2025f7e Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:11:14 -0800
Subject: [PATCH 025/167] fix(server): t3 update installs from the policy's
 update mirror (#29911)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/update.test.ts          | 80 +++++++++++++++++++--
 apps/server/src/cli/update.ts               | 78 +++++++++++++++-----
 apps/server/src/cloud/pinnedRuntime.test.ts | 73 ++++++++++++++++++-
 apps/server/src/cloud/pinnedRuntime.ts      | 71 ++++++++++++------
 apps/server/src/cloud/selfUpdate.test.ts    | 29 ++++++--
 apps/server/src/cloud/selfUpdate.ts         | 18 +++--
 apps/server/src/policy/managedUpdates.ts    | 11 +++
 docs/user/managed-policy.md                 | 10 ++-
 packages/shared/src/cliRelease.ts           | 31 ++++++++
 9 files changed, 345 insertions(+), 56 deletions(-)

diff --git a/apps/server/src/cli/update.test.ts b/apps/server/src/cli/update.test.ts
index 848c2c798df41..ecd837e37ac01 100644
--- a/apps/server/src/cli/update.test.ts
+++ b/apps/server/src/cli/update.test.ts
@@ -18,7 +18,13 @@ import * as BootService from "../cloud/bootService.ts";
 import { prunePinnedRuntimes } from "../cloud/pinnedRuntime.ts";
 import * as ManagedPolicy from "../policy/ManagedPolicy.ts";
 import * as ProcessRunner from "../processRunner.ts";
-import { repointLauncher, resolveLauncherPath, resolveNewestVersion, runUpdate } from "./update.ts";
+import {
+  repointLauncher,
+  resolveLauncherPath,
+  resolveMirrorVersion,
+  resolveNewestVersion,
+  runUpdate,
+} from "./update.ts";
 
 // lsof listing one process, so prune sees a process list in which no runtime is running.
 const unrelatedLsof = ProcessRunner.ProcessRunner.of({
@@ -60,10 +66,59 @@ it.effect("authenticates each release page until the requested channel is found"
   }),
 );
 
+it.effect("reads the newest version from the update feed file a mirror publishes", () =>
+  Effect.gen(function* () {
+    const requested: string[] = [];
+    const mirror = {
+      organization: "Example Corp",
+      feedUrl: "https://updates.example.com/t3code/?token=abc",
+    };
+    const resolve = (
+      channel: "stable" | "nightly" | "preview",
+      platform: NodeJS.Platform,
+      arch: string,
+      feed: string,
+    ) =>
+      resolveMirrorVersion(mirror, channel).pipe(
+        Effect.map((version): string => version),
+        Effect.catchTags({ CliUpdateError: (error) => Effect.succeed(`error: ${error.reason}`) }),
+        Effect.provideService(HostProcess.Platform, platform),
+        Effect.provideService(HostProcess.Architecture, arch),
+        Effect.provideService(
+          HttpClient.HttpClient,
+          HttpClient.make((request) => {
+            requested.push(request.url);
+            return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(feed)));
+          }),
+        ),
+      );
+
+    assert.equal(
+      yield* resolve("stable", "darwin", "arm64", "version: 1.4.0\nfiles: []\n"),
+      "1.4.0",
+    );
+    assert.equal(
+      yield* resolve("nightly", "linux", "arm64", "version: '1.5.0-nightly.20261101.2'\n"),
+      "1.5.0-nightly.20261101.2",
+    );
+    assert.deepStrictEqual(requested, [
+      "https://updates.example.com/t3code/latest-mac.yml?token=abc",
+      "https://updates.example.com/t3code/nightly-linux-arm64.yml?token=abc",
+    ]);
+    // A feed for the wrong track is not trusted to mean the requested one.
+    assert.include(
+      yield* resolve("stable", "win32", "x64", "version: 1.5.0-nightly.20261101.2\n"),
+      "Could not read latest.yml from Example Corp's update mirror.",
+    );
+    assert.include(yield* resolve("preview", "win32", "x64", ""), "has no preview builds");
+  }),
+);
+
 it.layer(NodeServices.layer)("t3 update under a managed policy", (it) => {
   const runWithPolicy = (
     updates: ManagedUpdatesPolicy,
     input: { readonly channel?: "stable" | "nightly"; readonly requestedVersion?: string } = {},
+    httpClient = HttpClient.make(() => Effect.die("unexpected release lookup")),
   ) =>
     runUpdate({
       baseDir: "/unused",
@@ -85,10 +140,7 @@ it.layer(NodeServices.layer)("t3 update under a managed policy", (it) => {
           // Refusals happen before the update touches the network, the service, or a process.
           Layer.mock(BootService.BootService, {}),
           Layer.mock(ProcessRunner.ProcessRunner, {}),
-          Layer.succeed(
-            HttpClient.HttpClient,
-            HttpClient.make(() => Effect.die("unexpected release lookup")),
-          ),
+          Layer.succeed(HttpClient.HttpClient, httpClient),
         ),
       ),
     );
@@ -118,6 +170,24 @@ it.layer(NodeServices.layer)("t3 update under a managed policy", (it) => {
       }
     }),
   );
+
+  it.effect("looks for updates on the policy's mirror, never the public releases", () =>
+    Effect.gen(function* () {
+      const requested: string[] = [];
+      const error = yield* runWithPolicy(
+        { mode: "auto", feedUrl: "https://updates.example.com/t3code" },
+        { channel: "stable" },
+        HttpClient.make((request) => {
+          requested.push(new URL(request.url).origin);
+          return Effect.succeed(
+            HttpClientResponse.fromWeb(request, new Response("", { status: 404 })),
+          );
+        }),
+      );
+      assert.include(error.message, "from Example Corp's update mirror");
+      assert.deepStrictEqual(requested, ["https://updates.example.com"]);
+    }),
+  );
 });
 
 it.layer(NodeServices.layer)("t3 update launcher", (it) => {
diff --git a/apps/server/src/cli/update.ts b/apps/server/src/cli/update.ts
index dc2e29345864c..be36b1184d88d 100644
--- a/apps/server/src/cli/update.ts
+++ b/apps/server/src/cli/update.ts
@@ -5,6 +5,8 @@ import {
   cliReleaseIndexPageUrl,
   cliReleaseChannelOf,
   newestCliReleaseVersion,
+  releaseAssetUrl,
+  updateFeedFileName,
   type CliReleaseChannel,
 } from "@t3tools/shared/cliRelease";
 import * as Console from "effect/Console";
@@ -24,6 +26,7 @@ import {
   ensurePinnedRuntimeInstalled,
   launcherOwnsVersionsDir,
   pinnedRuntimeCommand,
+  isUnpublishedRelease,
   PinnedRuntimeInstallError,
   pinnedRuntimePaths,
   pinnedRuntimeVersionsDir,
@@ -33,7 +36,7 @@ import {
 } from "../cloud/pinnedRuntime.ts";
 import { compareExactServiceVersions, isExactServiceVersion } from "../cloud/serviceProtocol.ts";
 import * as ManagedPolicy from "../policy/ManagedPolicy.ts";
-import { managedUpdateRefusal } from "../policy/managedUpdates.ts";
+import { managedUpdateMirror, managedUpdateRefusal } from "../policy/managedUpdates.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import { isProcessAlive, readPersistedServerRuntimeState } from "../serverRuntimeState.ts";
 import { projectLocationFlags, resolveCliAuthConfig } from "./config.ts";
@@ -94,6 +97,47 @@ export const resolveNewestVersion = Effect.fn("cli.update.resolve_newest")(funct
   return yield* new CliUpdateError({ reason: `No published ${channel} release was found.` });
 });
 
+/** The version an update mirror's feed file for this platform offers on `channel`. */
+export const resolveMirrorVersion = Effect.fn("cli.update.resolve_mirror")(function* (
+  mirror: { readonly organization: string; readonly feedUrl: string },
+  channel: CliReleaseChannel,
+) {
+  if (channel === "preview") {
+    return yield* new CliUpdateError({
+      reason: `${mirror.organization}'s update mirror has no preview builds.`,
+    });
+  }
+  const httpClient = yield* HttpClient.HttpClient;
+  const fileName = updateFeedFileName(
+    channel === "nightly" ? "nightly" : "latest",
+    yield* HostProcess.Platform,
+    yield* HostProcess.Architecture,
+  );
+  const url = releaseAssetUrl(mirror.feedUrl, fileName);
+  // Not the URL, whose query can hold the mirror's access token.
+  const unreadable = new CliUpdateError({
+    reason: `Could not read ${fileName} from ${mirror.organization}'s update mirror.`,
+  });
+  const body = yield* httpClient.get(url).pipe(
+    Effect.flatMap(HttpClientResponse.filterStatusOk),
+    Effect.flatMap((response) => response.text),
+    Effect.mapError(() => unreadable),
+    Effect.timeoutOrElse({
+      duration: RELEASE_INDEX_TIMEOUT,
+      orElse: () => Effect.fail(unreadable),
+    }),
+  );
+  const version = /^version:\s*["']?([^"'\s]+)/m.exec(body)?.[1];
+  if (
+    version === undefined ||
+    !isExactServiceVersion(version) ||
+    cliReleaseChannelOf(version) !== channel
+  ) {
+    return yield* unreadable;
+  }
+  return version;
+});
+
 /**
  * Only a launcher that already points into this home's `runtime/versions` tree is touched; a
  * plain copy of the executable, or a launcher for some other install, is left alone. It is
@@ -320,6 +364,7 @@ export const runUpdate = Effect.fn("cli.update.run")(function* (input: {
   const httpClient = yield* HttpClient.HttpClient;
   const service = yield* BootService.BootService;
   const policy = yield* ManagedPolicy.ManagedPolicy;
+  const mirror = managedUpdateMirror(policy.document);
 
   const currentVersion = packageJson.version;
   const channel = input.channel ?? cliReleaseChannelOf(currentVersion);
@@ -338,9 +383,11 @@ export const runUpdate = Effect.fn("cli.update.run")(function* (input: {
   const progress = createUpdateProgress();
   progress.status("Checking for updates...");
   const targetVersion = yield* (
-    input.requestedVersion === undefined
-      ? resolveNewestVersion(channel)
-      : Effect.succeed(input.requestedVersion)
+    input.requestedVersion !== undefined
+      ? Effect.succeed(input.requestedVersion)
+      : mirror === undefined
+        ? resolveNewestVersion(channel)
+        : resolveMirrorVersion(mirror, channel)
   ).pipe(Effect.ensuring(Effect.sync(progress.finish)));
   const targetChannel = cliReleaseChannelOf(targetVersion);
 
@@ -455,7 +502,8 @@ export const runUpdate = Effect.fn("cli.update.run")(function* (input: {
     httpClient,
     platform,
     arch,
-    releaseBaseUrl: environment[CLI_RELEASE_BASE_URL_ENV]?.trim() || undefined,
+    releaseBaseUrl: mirror?.feedUrl ?? (environment[CLI_RELEASE_BASE_URL_ENV]?.trim() || undefined),
+    requirePublishedRelease: mirror !== undefined,
     validate: (paths) =>
       runner
         .run({
@@ -481,17 +529,15 @@ export const runUpdate = Effect.fn("cli.update.run")(function* (input: {
         ),
   }).pipe(
     Effect.ensuring(Effect.sync(progress.finish)),
-    Effect.catchIf(
-      (error): error is PinnedRuntimeInstallError =>
-        error._tag === "PinnedRuntimeInstallError" &&
-        error.step.startsWith("downloading the t3 release checksums") &&
-        String(error.cause).includes("404"),
-      () =>
-        Effect.fail(
-          new CliUpdateError({
-            reason: `No release archive was published for t3@${targetVersion}.`,
-          }),
-        ),
+    Effect.catchIf(isUnpublishedRelease, () =>
+      Effect.fail(
+        new CliUpdateError({
+          reason:
+            mirror === undefined
+              ? `No release archive was published for t3@${targetVersion}.`
+              : `${mirror.organization}'s update mirror has no t3@${targetVersion} for this machine.`,
+        }),
+      ),
     ),
   );
 
diff --git a/apps/server/src/cloud/pinnedRuntime.test.ts b/apps/server/src/cloud/pinnedRuntime.test.ts
index 7babf123b9d42..38e56b30388f9 100644
--- a/apps/server/src/cloud/pinnedRuntime.test.ts
+++ b/apps/server/src/cloud/pinnedRuntime.test.ts
@@ -16,6 +16,7 @@ import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as ProcessRunner from "../processRunner.ts";
 import {
   ensurePinnedRuntimeInstalled,
+  isUnpublishedRelease,
   pinnedRuntimeCommand,
   pinnedRuntimePaths,
   PinnedRuntimeInstallError,
@@ -39,7 +40,7 @@ const validChecksums = archiveHex(archiveBytes).pipe(
 const releaseHttpClient = (checksums: string, requests: string[] = []) =>
   HttpClient.make((request) => {
     requests.push(request.url);
-    const body = request.url.endsWith("/SHA256SUMS") ? checksums : archiveBytes;
+    const body = new URL(request.url).pathname.endsWith("/SHA256SUMS") ? checksums : archiveBytes;
     return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(body)));
   });
 const extractingRunner = (fs: FileSystem.FileSystem, path: Path.Path, commands: string[] = []) =>
@@ -155,6 +156,40 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
     }),
   );
 
+  it.effect("reports a release that lists an archive it does not serve as unpublished", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-archive-missing-" });
+      const checksums = yield* validChecksums;
+      const failsWith = (status: number) =>
+        ensurePinnedRuntimeInstalled({
+          baseDir,
+          version,
+          fs,
+          path,
+          platform: "linux",
+          arch: "x64",
+          httpClient: HttpClient.make((request) =>
+            Effect.succeed(
+              HttpClientResponse.fromWeb(
+                request,
+                request.url.endsWith("/SHA256SUMS")
+                  ? new Response(checksums)
+                  : new Response("", { status }),
+              ),
+            ),
+          ),
+          // "404" in the mirror's path must not read a server error as a missing release.
+          releaseBaseUrl: "https://updates.example.com/404/t3code",
+          runner: extractingRunner(fs, path),
+          validate: () => Effect.die("must not validate a missing archive"),
+        }).pipe(Effect.flip);
+      assert.isTrue(isUnpublishedRelease(yield* failsWith(404)));
+      assert.isFalse(isUnpublishedRelease(yield* failsWith(500)));
+    }),
+  );
+
   it.effect("refuses an archive whose checksum does not match the release", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
@@ -267,6 +302,42 @@ it.layer(NodeServices.layer)("ensurePinnedRuntimeInstalled", (it) => {
     }),
   );
 
+  it.effect("reuses a cached runtime under a mirror only while the mirror lists it", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-pinned-runtime-mirror-" });
+      const cached = pinnedRuntimePaths(path, baseDir, version, "linux");
+      yield* fs.makeDirectory(path.dirname(cached.entryPath), { recursive: true });
+      yield* fs.writeFileString(cached.entryPath, "#!/bin/sh\n");
+      yield* fs.writeFileString(cached.sentinelPath, `${version}\n`);
+      const install = (checksums: string, requests: string[]) =>
+        ensurePinnedRuntimeInstalled({
+          baseDir,
+          version,
+          fs,
+          path,
+          platform: "linux",
+          arch: "x64",
+          httpClient: releaseHttpClient(checksums, requests),
+          // A signed mirror URL keeps its query on every file it serves.
+          releaseBaseUrl: "https://updates.example.com/t3code/?token=abc",
+          requirePublishedRelease: true,
+          runner: extractingRunner(fs, path),
+          validate: () => Effect.void,
+        });
+
+      const withdrawn = yield* install("", []).pipe(Effect.flip);
+      assert.include(withdrawn.message, `finding ${archiveName} in the t3 release checksums`);
+      const requests: string[] = [];
+      assert.equal((yield* install(yield* validChecksums, requests)).entryPath, cached.entryPath);
+      // Listed, so the cached runtime is used without downloading it again.
+      assert.deepEqual(requests, [
+        `https://updates.example.com/t3code/v${version}/SHA256SUMS?token=abc`,
+      ]);
+    }),
+  );
+
   it.effect("preserves a completed runtime when validation fails", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/cloud/pinnedRuntime.ts b/apps/server/src/cloud/pinnedRuntime.ts
index 96745fe85bf41..4e8df29f3026d 100644
--- a/apps/server/src/cloud/pinnedRuntime.ts
+++ b/apps/server/src/cloud/pinnedRuntime.ts
@@ -9,14 +9,15 @@ import * as Schema from "effect/Schema";
 import * as Option from "effect/Option";
 import * as Stream from "effect/Stream";
 import * as Semaphore from "effect/Semaphore";
-import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
+import { HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse } from "effect/http";
 
 import {
   CLI_RELEASE_CHECKSUMS_FILE,
   cliArchiveFileName,
   cliArchivePlatformKey,
   cliArchiveTarCommand,
-  cliReleaseDownloadBaseUrl,
+  cliReleaseAssetUrl,
+  type CliArchivePlatformKey,
   parseChecksums,
 } from "@t3tools/shared/cliRelease";
 
@@ -111,6 +112,8 @@ interface PinnedRuntimeInstallInput {
   readonly arch: string;
   readonly httpClient: HttpClient.HttpClient;
   readonly releaseBaseUrl?: string | undefined;
+  /** Reuse a cached runtime only while the release source still lists it, as a policy mirror does. */
+  readonly requirePublishedRelease?: boolean;
   readonly onProgress?: (progress: PinnedRuntimeProgress) => void;
 }
 
@@ -178,28 +181,11 @@ const installFromArchive = Effect.fn("cloud.pinned_runtime.install_archive")(fun
     });
   }
   const httpClient = input.httpClient;
-  const baseUrl = cliReleaseDownloadBaseUrl(input.version, input.releaseBaseUrl);
-  const fileName = cliArchiveFileName(input.version, platformKey);
-
   input.onProgress?.({ stage: "download", received: 0, total: undefined });
-  const checksums = parseChecksums(
-    new TextDecoder().decode(
-      yield* fetchReleaseAsset(
-        httpClient,
-        `${baseUrl}/${CLI_RELEASE_CHECKSUMS_FILE}`,
-        "downloading the t3 release checksums",
-      ),
-    ),
-  );
-  const expected = checksums.get(fileName);
-  if (expected === undefined) {
-    return yield* new PinnedRuntimeInstallError({
-      step: `finding ${fileName} in the t3 release checksums`,
-    });
-  }
+  const { fileName, expected } = yield* publishedArchive(input, platformKey);
   const archive = yield* fetchReleaseAsset(
     httpClient,
-    `${baseUrl}/${fileName}`,
+    cliReleaseAssetUrl(input.version, fileName, input.releaseBaseUrl),
     "downloading the t3 release archive",
     input.onProgress,
   );
@@ -248,6 +234,40 @@ const installFromArchive = Effect.fn("cloud.pinned_runtime.install_archive")(fun
   yield* fs.remove(archivePath, { force: true }).pipe(Effect.ignore);
 });
 
+/** The release's archive for this machine and its checksum; fails when the release lists none. */
+const publishedArchive = Effect.fn("cloud.pinned_runtime.published_archive")(function* (
+  input: PinnedRuntimeInstallInput,
+  platformKey: CliArchivePlatformKey,
+) {
+  const fileName = cliArchiveFileName(input.version, platformKey);
+  const checksums = parseChecksums(
+    new TextDecoder().decode(
+      yield* fetchReleaseAsset(
+        input.httpClient,
+        cliReleaseAssetUrl(input.version, CLI_RELEASE_CHECKSUMS_FILE, input.releaseBaseUrl),
+        "downloading the t3 release checksums",
+      ),
+    ),
+  );
+  const expected = checksums.get(fileName);
+  if (expected === undefined) {
+    return yield* new PinnedRuntimeInstallError({
+      step: `finding ${fileName} in the t3 release checksums`,
+    });
+  }
+  return { fileName, expected };
+});
+
+const isPinnedRuntimeInstallError = Schema.is(PinnedRuntimeInstallError);
+
+/** Whether an install failed because the release source does not publish the version for this machine. */
+export const isUnpublishedRelease = (error: unknown): error is PinnedRuntimeInstallError =>
+  isPinnedRuntimeInstallError(error) &&
+  (error.step.startsWith("finding ") ||
+    (error.step.startsWith("downloading the t3 release") &&
+      HttpClientError.isHttpClientError(error.cause) &&
+      error.cause.response?.status === 404));
+
 const installPinnedRuntime = Effect.fn("cloud.pinned_runtime.ensure_installed")(function* (
   input: PinnedRuntimeInstallInput,
 ) {
@@ -265,6 +285,15 @@ const installPinnedRuntime = Effect.fn("cloud.pinned_runtime.ensure_installed")(
   const alreadyPinned =
     entryExists && Option.isSome(sentinel) && sentinel.value.trim() === input.version;
   if (alreadyPinned) {
+    if (input.requirePublishedRelease === true) {
+      const platformKey = cliArchivePlatformKey(input.platform, input.arch);
+      if (platformKey === undefined) {
+        return yield* new PinnedRuntimeInstallError({
+          step: `selecting a t3 release archive for ${input.platform}-${input.arch}`,
+        });
+      }
+      yield* publishedArchive(input, platformKey);
+    }
     input.onProgress?.({ stage: "cached" });
     yield* input.validate(paths);
     return paths;
diff --git a/apps/server/src/cloud/selfUpdate.test.ts b/apps/server/src/cloud/selfUpdate.test.ts
index 9e1aee9c095aa..a938d6778820f 100644
--- a/apps/server/src/cloud/selfUpdate.test.ts
+++ b/apps/server/src/cloud/selfUpdate.test.ts
@@ -36,9 +36,10 @@ interface HarnessOptions {
 }
 
 const archiveBytes = new TextEncoder().encode("not really a tarball");
-const releaseHttpClient = (order: string[], beforeDownload?: Effect.Effect<void>) =>
+const releaseHttpClient = (order: string[], urls: string[], beforeDownload?: Effect.Effect<void>) =>
   HttpClient.make((request) =>
     Effect.gen(function* () {
+      urls.push(request.url);
       if (request.url.endsWith("/SHA256SUMS")) {
         const digest = yield* Effect.promise(() => crypto.subtle.digest("SHA-256", archiveBytes));
         const hex = Array.from(new Uint8Array(digest), (byte) =>
@@ -62,6 +63,7 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
   const path = yield* Path.Path;
   const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-self-update-test-" });
   const order: string[] = [];
+  const urls: string[] = [];
   const runner = ProcessRunner.ProcessRunner.of({
     run: (input) =>
       Effect.gen(function* () {
@@ -141,7 +143,10 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
         run: () => Effect.die("unexpected desktop app update run"),
       },
     ),
-    Effect.provideService(HttpClient.HttpClient, releaseHttpClient(order, options.beforeDownload)),
+    Effect.provideService(
+      HttpClient.HttpClient,
+      releaseHttpClient(order, urls, options.beforeDownload),
+    ),
     Effect.provideService(HostProcess.Platform, "linux"),
     Effect.provideService(HostProcess.Architecture, "x64"),
     Effect.provide(
@@ -151,7 +156,7 @@ const makeHarness = Effect.fn("test.make_self_update_harness")(function* (
       ),
     ),
   );
-  return { selfUpdate, order };
+  return { selfUpdate, order, urls };
 });
 
 it.layer(NodeServices.layer)("server self update", (it) => {
@@ -198,11 +203,17 @@ it.layer(NodeServices.layer)("server self update", (it) => {
 
   it.effect("lets a user start an update, but only to stable without nightly", () =>
     Effect.gen(function* () {
-      const { selfUpdate, order } = yield* makeHarness({
+      const { selfUpdate, order, urls } = yield* makeHarness({
         policy: {
           schemaVersion: 1,
           organization: "Example Corp",
-          limits: { updates: { mode: "auto", allowNightly: false } },
+          limits: {
+            updates: {
+              mode: "auto",
+              allowNightly: false,
+              feedUrl: "https://updates.example.com/t3code/",
+            },
+          },
         },
       });
       expect(
@@ -210,7 +221,15 @@ it.layer(NodeServices.layer)("server self update", (it) => {
           .reason,
       ).toBe("Example Corp manages T3 Code updates. Only stable releases can be installed.");
       expect(order).toEqual([]);
+      // The mirror lists only 1.1.0's archive.
+      expect((yield* selfUpdate.update({ targetVersion: "1.2.0" }).pipe(Effect.flip)).reason).toBe(
+        "Example Corp's update mirror has no t3@1.2.0 for this machine.",
+      );
       expect((yield* selfUpdate.update({ targetVersion: "1.1.0" })).updateId).toBe("launcher-id");
+      // The release comes from the policy's mirror, not GitHub.
+      expect(urls.length).toBeGreaterThan(0);
+      for (const url of urls)
+        expect(url).toMatch(/^https:\/\/updates\.example\.com\/t3code\/v1\.[12]\.0\//);
     }),
   );
 
diff --git a/apps/server/src/cloud/selfUpdate.ts b/apps/server/src/cloud/selfUpdate.ts
index 1f285b9b6522e..58baa160adf71 100644
--- a/apps/server/src/cloud/selfUpdate.ts
+++ b/apps/server/src/cloud/selfUpdate.ts
@@ -31,10 +31,11 @@ import * as ServerConfig from "../config.ts";
 import * as DesktopAppUpdate from "../desktopUpdate/DesktopAppUpdate.ts";
 import { databaseMigrationHead } from "../persistence/databaseMigrationHead.ts";
 import * as ManagedPolicy from "../policy/ManagedPolicy.ts";
-import { managedUpdateRefusal } from "../policy/managedUpdates.ts";
+import { managedUpdateMirror, managedUpdateRefusal } from "../policy/managedUpdates.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import {
   ensurePinnedRuntimeInstalled,
+  isUnpublishedRelease,
   pinnedRuntimeCommand,
   PinnedRuntimeInstallError,
   pinnedRuntimePaths,
@@ -132,9 +133,10 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
   const platform = yield* HostProcess.Platform;
   const arch = yield* HostProcess.Architecture;
   const httpClient = yield* HttpClient.HttpClient;
-  const releaseBaseUrl = Option.getOrUndefined(
-    yield* Config.String(CLI_RELEASE_BASE_URL_ENV).pipe(Config.option),
-  );
+  const mirror = managedUpdateMirror(policy.document);
+  const releaseBaseUrl =
+    mirror?.feedUrl ??
+    Option.getOrUndefined(yield* Config.String(CLI_RELEASE_BASE_URL_ENV).pipe(Config.option));
   const inFlight = yield* Ref.make(false);
 
   yield* pruneRuntimesOnStart({ baseDir: serverConfig.baseDir, managed: launcher.managed }).pipe(
@@ -209,6 +211,7 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
         platform,
         arch,
         releaseBaseUrl,
+        requirePublishedRelease: mirror !== undefined,
         validate: (runtime) =>
           runner
             .run({
@@ -282,7 +285,12 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
         Effect.mapError((error) =>
           error._tag === "PinnedRuntimePreflightBlockedError"
             ? failWith(error.reason, error)
-            : failWith(`Could not prepare t3@${targetVersion}.`, error),
+            : mirror !== undefined && isUnpublishedRelease(error)
+              ? failWith(
+                  `${mirror.organization}'s update mirror has no t3@${targetVersion} for this machine.`,
+                  error,
+                )
+              : failWith(`Could not prepare t3@${targetVersion}.`, error),
         ),
       );
 
diff --git a/apps/server/src/policy/managedUpdates.ts b/apps/server/src/policy/managedUpdates.ts
index 32adc6e4f3812..d805cfa028e2f 100644
--- a/apps/server/src/policy/managedUpdates.ts
+++ b/apps/server/src/policy/managedUpdates.ts
@@ -5,6 +5,17 @@ import {
 } from "@t3tools/contracts";
 import type { CliReleaseChannel } from "@t3tools/shared/cliRelease";
 
+/**
+ * The update mirror the policy sends updates to, or `undefined` for the public releases. It wins
+ * over the environment, which a user can set.
+ */
+export function managedUpdateMirror(document: ManagedPolicyDocument | undefined) {
+  const feedUrl = document?.limits?.updates?.feedUrl;
+  return feedUrl === undefined || document === undefined
+    ? undefined
+    : { organization: document.organization, feedUrl };
+}
+
 /**
  * Why the managed policy refuses an update a user or maintainer asked for, or `undefined` when it
  * allows it. The server never updates on its own, so `auto` allows every explicit request.
diff --git a/docs/user/managed-policy.md b/docs/user/managed-policy.md
index 6df5375684895..f9d170624bd8c 100644
--- a/docs/user/managed-policy.md
+++ b/docs/user/managed-policy.md
@@ -250,9 +250,13 @@ starts the binary you set.
 
 - `mode`: `auto` keeps the normal update flow. `off` stops T3 Code from checking for updates, for
   machines that get T3 Code through device management.
-- `feedUrl`: the desktop app updates from your own mirror of the release feed instead of GitHub.
-  Publish only the versions you have approved. The `t3` command-line server updates through npm,
-  so pin it with your package tooling.
+- `feedUrl`: T3 Code updates from your own mirror instead of GitHub: the desktop app, `t3 update`,
+  and updates started from another device. Publish only the versions you have approved, laid out
+  as on a GitHub release. The release's update files (`latest.yml`, `latest-mac.yml`,
+  `latest-linux.yml`, `latest-linux-arm64.yml`, and their `nightly` versions if you allow nightly)
+  and the desktop installers they list go at the URL's root. The release's `t3-*` archives and
+  `SHA256SUMS` go under `v<version>/`. A `t3` run through `npx` comes from npm, so pin it with your
+  package tooling.
 - `allowNightly: false`: the nightly channel is unavailable.
 
 ## What a policy does not cover
diff --git a/packages/shared/src/cliRelease.ts b/packages/shared/src/cliRelease.ts
index 66777cc044478..80eeec4397545 100644
--- a/packages/shared/src/cliRelease.ts
+++ b/packages/shared/src/cliRelease.ts
@@ -50,6 +50,22 @@ export function cliReleaseDownloadBaseUrl(
   return `${(baseUrl?.trim() || CLI_RELEASE_DEFAULT_BASE_URL).replace(/\/+$/, "")}/v${version}`;
 }
 
+/** `segments` added to `baseUrl`'s path, keeping its query, such as a signed mirror URL's token. */
+export function releaseAssetUrl(baseUrl: string, ...segments: ReadonlyArray<string>): string {
+  const url = new URL(baseUrl);
+  url.pathname = [url.pathname.replace(/\/+$/, ""), ...segments.map(encodeURIComponent)].join("/");
+  return url.toString();
+}
+
+/** A file of release `version`, from `baseUrl` laid out as GitHub's release downloads. */
+export function cliReleaseAssetUrl(
+  version: string,
+  fileName: string,
+  baseUrl: string | undefined = CLI_RELEASE_DEFAULT_BASE_URL,
+): string {
+  return releaseAssetUrl(baseUrl?.trim() || CLI_RELEASE_DEFAULT_BASE_URL, `v${version}`, fileName);
+}
+
 export function parseChecksums(text: string): ReadonlyMap<string, string> {
   const checksums = new Map<string, string>();
   for (const line of text.split(/\r?\n/)) {
@@ -86,6 +102,21 @@ export function desktopUpdateChannelOf(version: string): "latest" | "nightly" {
   return cliReleaseChannelOf(version) === "nightly" ? "nightly" : "latest";
 }
 
+/**
+ * The update feed file a desktop app on this platform reads, which an update mirror publishes at
+ * its root beside the release's CLI archives.
+ */
+export function updateFeedFileName(
+  channel: "latest" | "nightly",
+  platform: NodeJS.Platform,
+  arch: string,
+): string {
+  if (platform === "darwin") return `${channel}-mac.yml`;
+  if (platform === "linux")
+    return arch === "arm64" ? `${channel}-linux-arm64.yml` : `${channel}-linux.yml`;
+  return `${channel}.yml`;
+}
+
 /** Whether a track switch may install `found` after its database check cleared `checked`: any build
  * on the switch's track at least as new, since later releases only add migrations. */
 export function acceptsTrackSwitchRelease(

From a50fe102fb6d7253b03c296636c753a01fd33dda Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 19:16:29 +0000
Subject: [PATCH 026/167] fix(desktop): Ctrl+R on macOS reaches the preview
 page instead of reloading it (#29893)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/desktop/src/preview/Manager.test.ts | 27 ++++++++++++++++++++++++
 apps/desktop/src/preview/Manager.ts      |  6 +++---
 2 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/apps/desktop/src/preview/Manager.test.ts b/apps/desktop/src/preview/Manager.test.ts
index d917af72d389b..32b9ad23f9c93 100644
--- a/apps/desktop/src/preview/Manager.test.ts
+++ b/apps/desktop/src/preview/Manager.test.ts
@@ -615,6 +615,33 @@ describe("PreviewManager", () => {
       ),
   );
 
+  effectIt.effect.each([
+    ["darwin", true, false, true],
+    ["darwin", false, true, false],
+    ["linux", false, true, true],
+    ["win32", true, false, false],
+  ] as const)(
+    "reloads the preview only on the platform refresh chord: %s meta=%s ctrl=%s",
+    ([platform, meta, control, expected]) =>
+      withManager(
+        (manager) =>
+          Effect.gen(function* () {
+            const preview = makeFaviconWebContents();
+            fromId.mockReturnValue(preview.webContents);
+            yield* manager.createTab("tab_refresh");
+            yield* manager.registerWebview("tab_refresh", 42);
+            const preventDefault = vi.fn();
+            preview.listeners.get("before-input-event")!(
+              { preventDefault } as never,
+              { type: "keyDown", key: "r", meta, control, shift: false, alt: false } as never,
+            );
+            expect(preventDefault).toHaveBeenCalledTimes(expected ? 1 : 0);
+            expect(preview.reload).toHaveBeenCalledTimes(expected ? 1 : 0);
+          }),
+        platform,
+      ),
+  );
+
   effectIt.effect("keeps editing and forwarded shortcuts in whichever tab holds focus", () =>
     withManager((manager) =>
       Effect.gen(function* () {
diff --git a/apps/desktop/src/preview/Manager.ts b/apps/desktop/src/preview/Manager.ts
index c83eae8d8358c..18eb4b2b75968 100644
--- a/apps/desktop/src/preview/Manager.ts
+++ b/apps/desktop/src/preview/Manager.ts
@@ -464,10 +464,10 @@ export const previewWindowOpenAction = (details: {
     : "navigate";
 };
 
-const isPreviewRefreshShortcut = (input: Electron.Input): boolean =>
+const isPreviewRefreshShortcut = (input: Electron.Input, platform: NodeJS.Platform): boolean =>
   input.type === "keyDown" &&
   input.key.toLowerCase() === "r" &&
-  (input.meta || input.control) &&
+  (platform === "darwin" ? input.meta && !input.control : input.control && !input.meta) &&
   !input.shift &&
   !input.alt;
 
@@ -1488,7 +1488,7 @@ const makeNativeOperations = Effect.fn("PreviewManager.makeOperations")(function
         }
         return;
       }
-      if (isPreviewRefreshShortcut(input)) {
+      if (isPreviewRefreshShortcut(input, hostPlatform)) {
         event.preventDefault();
         runFork(
           attempt({ operation: "shortcut.refresh", tabId, webContentsId: wc.id }, () =>

From 3f48896580eb404ae72b5f02e0af61bf16b69adf Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 19:18:09 +0000
Subject: [PATCH 027/167] fix(server): native forks after an undo no longer
 copy later turns (#29902)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/ClaudeAdapterV2.test.ts          | 14 +++++
 .../Adapters/ClaudeAdapterV2.ts               |  3 +-
 .../ProviderTurnStartService.test.ts          | 55 +++++++++++++++++--
 .../ProviderTurnStartService.ts               | 16 +++++-
 4 files changed, 81 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index 45d21b5944e24..c75b99832e4cc 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -6350,9 +6350,15 @@ describe("ClaudeAdapterV2 background wake turns", () => {
 
   it.effect("never records a subagent uuid for a turn with no main-thread assistant message", () =>
     Effect.gen(function* () {
+      const forkCalls: Array<ClaudeAdapterV2.ClaudeAgentSdkSessionForkInput> = [];
       const harness = yield* makeWakeHarnessWithOptions({
         close: (sdkMessages) => Queue.shutdown(sdkMessages),
         freshQueueOnReopen: true,
+        forkSession: (input) =>
+          Effect.sync(() => {
+            forkCalls.push(input);
+            return { sessionId: "forked-after-compact-rollback" };
+          }),
       });
       const now = yield* DateTime.now;
       const subagentUuid = "00000000-0000-4000-8000-000000000644";
@@ -6433,6 +6439,14 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         pastSilentTurn.providerThread.nativeConversationHeadRef?.nativeId,
         earlierCursor,
       );
+      // Forks omit rolled-back turns, which Claude's transcript still holds past the pinned head.
+      yield* harness.runtime.forkThread({
+        sourceProviderThread: pastSilentTurn.providerThread,
+        sourceProviderTurns: turnsAcrossSilent.slice(0, 2),
+        providerTurnId: providerTurn.id,
+        targetThreadId: ThreadId.make("thread-claude-fork-after-compact-rollback"),
+      });
+      assert.equal(forkCalls[0]?.options.upToMessageId, earlierCursor);
       const interruptedBeforeCompact = yield* rollbackTo(
         [
           {
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index 674f55c524d75..b306bcf52d888 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -2070,7 +2070,8 @@ const resolveClaudeForkUpToMessageId = Effect.fn("ClaudeAdapterV2.resolveForkUpT
       .slice(boundaryIndex + 1)
       .filter(isTerminalProviderTurn);
     if (terminalTurnsAfterBoundary.length === 0) {
-      return undefined;
+      // Rollback pins the head but leaves the rolled-back turns in Claude's transcript.
+      return yield* getNativeConversationHeadId(input.sourceProviderThread);
     }
 
     return yield* new ProviderAdapter.ProviderAdapterForkThreadError({
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
index a696fec352025..f7f9dc25ddc92 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
@@ -488,6 +488,35 @@ function makeLocalCommandHarness(input: {
       strength: "strong" as const,
     },
   };
+  const parentProviderTurn = (ordinal: number, attemptRunId: RunId) => ({
+    attempt: {
+      ...projection.attempts[0]!,
+      id: RunAttemptId.make(`side-chat-parent-attempt-${ordinal}`),
+      runId: attemptRunId,
+      providerThreadId: parentProviderThread.id,
+      status: "completed" as const,
+    },
+    turn: {
+      id: ProviderTurnId.make(`side-chat-parent-turn-${ordinal}`),
+      providerThreadId: parentProviderThread.id,
+      nodeId: rootNodeId,
+      runAttemptId: RunAttemptId.make(`side-chat-parent-attempt-${ordinal}`),
+      nativeTurnRef: {
+        driver: providerThread.driver,
+        nativeId: `side-chat-parent-native-turn-${ordinal}`,
+        strength: "strong" as const,
+      },
+      ordinal,
+      status: "completed" as const,
+      startedAt: now,
+      completedAt: now,
+    },
+  });
+  const parentRolledBackRunId = RunId.make("side-chat-parent-rolled-back-run");
+  const parentTurns = [
+    parentProviderTurn(1, parentRunId),
+    parentProviderTurn(2, parentRolledBackRunId),
+  ];
   const parentRecords = {
     ...projection,
     thread: { ...projection.thread, id: parentThreadId },
@@ -498,17 +527,27 @@ function makeLocalCommandHarness(input: {
         threadId: parentThreadId,
         ordinal: 1,
         providerThreadId: parentProviderThread.id,
-        activeAttemptId: null,
+        activeAttemptId: parentTurns[0]!.attempt.id,
         status: "completed" as const,
         completedAt: now,
       },
+      {
+        ...run,
+        id: parentRolledBackRunId,
+        threadId: parentThreadId,
+        ordinal: 2,
+        providerThreadId: parentProviderThread.id,
+        activeAttemptId: parentTurns[1]!.attempt.id,
+        status: "rolled_back" as const,
+        completedAt: now,
+      },
       ...(input.sideChat?.nativeForkFrom === "busy"
         ? [
             {
               ...run,
               id: RunId.make("side-chat-parent-busy-run"),
               threadId: parentThreadId,
-              ordinal: 2,
+              ordinal: 3,
               providerThreadId: parentProviderThread.id,
               status: "running" as const,
             },
@@ -516,8 +555,8 @@ function makeLocalCommandHarness(input: {
         : []),
     ],
     providerThreads: [parentProviderThread],
-    attempts: [],
-    providerTurns: [],
+    attempts: parentTurns.map(({ attempt }) => attempt),
+    providerTurns: parentTurns.map(({ turn }) => turn),
     turnItems: [],
   };
   if (input.sideChat !== undefined) {
@@ -749,7 +788,9 @@ function makeLocalCommandHarness(input: {
       strength: "strong" as const,
     },
   };
-  const forkThread = vi.fn(() => Effect.succeed(sideChatThread));
+  const forkThread = vi.fn((_fork: ProviderAdapter.ProviderAdapterV2ForkThreadInput) =>
+    Effect.succeed(sideChatThread),
+  );
   const sideChatSession = {
     driver: providerThread.driver,
     providerSession,
@@ -1273,6 +1314,10 @@ effectIt.effect.each([
       yield* harness.start;
 
       expect(harness.forkThread).toHaveBeenCalledTimes(forks ? 1 : 0);
+      // The parent's rolled-back turn is gone from its native conversation.
+      expect(
+        harness.forkThread.mock.calls[0]?.[0].sourceProviderTurns?.map((turn) => turn.id),
+      ).toEqual(forks ? ["side-chat-parent-turn-1"] : undefined);
       expect(harness.projection().contextTransfers).toMatchObject([
         { id: "side-chat-fork", status: transferStatus },
       ]);
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
index 62a9e8b88e96d..cd121c7115a2a 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
@@ -1150,10 +1150,24 @@ export const layer: Layer.Layer<
             (candidate) => candidate.ordinal > sourceRun.ordinal && isActiveRun(candidate),
           );
           if (!sourceBusy) {
+            // Rolled-back turns are no longer in the source conversation, so they cannot bound a fork.
+            const rolledBackAttemptIds = new Set(
+              sourceProjection.attempts
+                .filter((attempt) =>
+                  sourceProjection.runs.some(
+                    (candidate) =>
+                      candidate.id === attempt.runId && candidate.status === "rolled_back",
+                  ),
+                )
+                .map((attempt) => attempt.id),
+            );
             return yield* loadFromProvider(
               session.forkThread({
                 sourceProviderThread,
-                sourceProviderTurns: sourceProjection.providerTurns,
+                sourceProviderTurns: sourceProjection.providerTurns.filter(
+                  (turn) =>
+                    turn.runAttemptId === null || !rolledBackAttemptIds.has(turn.runAttemptId),
+                ),
                 targetThreadId: projection.thread.id,
                 modelSelection: run.modelSelection,
                 runtimePolicy: resolvedRuntimePolicy,

From 7f17f515389505a26fe2963e61905cc5d7417963 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 19:20:39 +0000
Subject: [PATCH 028/167] fix(server): idle compaction still runs after a
 queued message is removed or steered (#29904)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/IdleCompaction.test.ts   | 26 ++++++++++++++++++-
 .../src/orchestration-v2/IdleCompaction.ts    | 11 +++++---
 .../orchestration-v2/IdleCompactionService.ts | 10 ++++---
 .../orchestration-v2/ProjectionStore.test.ts  |  7 +++--
 .../src/orchestration-v2/ProjectionStore.ts   |  1 +
 5 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/apps/server/src/orchestration-v2/IdleCompaction.test.ts b/apps/server/src/orchestration-v2/IdleCompaction.test.ts
index 3c13452e98e7f..a11a534b32614 100644
--- a/apps/server/src/orchestration-v2/IdleCompaction.test.ts
+++ b/apps/server/src/orchestration-v2/IdleCompaction.test.ts
@@ -163,6 +163,22 @@ describe("idleCompactionWindow", () => {
     const compacted = records(cache);
     compacted.messages = [{ ...compacted.messages[0]!, text: "/compact" }];
     expect(idleCompactionWindow(compacted, NOW_MS)).toBeNull();
+    const steered = records(cache);
+    steered.runs = [
+      ...steered.runs,
+      {
+        ...steered.runs[0]!,
+        id: RunId.make("run-2"),
+        ordinal: 2,
+        userMessageId: MessageId.make("message-2"),
+        status: "cancelled",
+        startedAt: null,
+      },
+    ];
+    expect(idleCompactionWindow(steered, NOW_MS)?.runId).toBe(runId);
+    // A turn Claude itself reported as cancelled did run, so it stays the latest.
+    steered.runs = steered.runs.map((run) => ({ ...run, startedAt: at(-MINUTE_MS) }));
+    expect(idleCompactionWindow(steered, NOW_MS)).toBeNull();
     const archived = records(cache);
     archived.thread = { ...archived.thread, archivedAt: at() };
     expect(idleCompactionWindow(archived, NOW_MS)).toBeNull();
@@ -323,9 +339,17 @@ describe("IdleCompactionService", () => {
           ordinal: 2,
           userMessageId: laterMessageId,
         };
+        const cancelledRun = {
+          ...earlierRun,
+          id: RunId.make("run-3"),
+          ordinal: 3,
+          userMessageId: MessageId.make("message-3"),
+          status: "cancelled" as const,
+          startedAt: null,
+        };
         const data: OrchestrationV2ThreadProjection = {
           ...base,
-          runs: [earlierRun, laterRun],
+          runs: [earlierRun, laterRun, cancelledRun],
           messages: [
             ...base.messages,
             { ...base.messages[0]!, id: laterMessageId, runId: laterRunId, text: "Keep going" },
diff --git a/apps/server/src/orchestration-v2/IdleCompaction.ts b/apps/server/src/orchestration-v2/IdleCompaction.ts
index a89894045c298..c4d586817551f 100644
--- a/apps/server/src/orchestration-v2/IdleCompaction.ts
+++ b/apps/server/src/orchestration-v2/IdleCompaction.ts
@@ -51,10 +51,13 @@ export function idleCompactionWindow(
   if (thread.snoozedUntil != null && DateTime.toEpochMillis(thread.snoozedUntil) > nowMs)
     return null;
   if (!isListedThreadLineage(thread.lineage)) return null;
-  const latestRun = runs.reduce<(typeof runs)[number] | null>(
-    (latest, run) => (latest === null || run.ordinal > latest.ordinal ? run : latest),
-    null,
-  );
+  // A removed or steered queued message leaves a cancelled run that never started.
+  const latestRun = runs
+    .filter((run) => run.status !== "cancelled" || run.startedAt !== null)
+    .reduce<(typeof runs)[number] | null>(
+      (latest, run) => (latest === null || run.ordinal > latest.ordinal ? run : latest),
+      null,
+    );
   if (latestRun?.status !== "completed" || latestRun.completedAt === null) return null;
   const message = messages.find((candidate) => candidate.id === latestRun.userMessageId);
   // Never compact a compaction, so one idle spell compacts at most once.
diff --git a/apps/server/src/orchestration-v2/IdleCompactionService.ts b/apps/server/src/orchestration-v2/IdleCompactionService.ts
index 3b3b788b183a5..c7035de4ec584 100644
--- a/apps/server/src/orchestration-v2/IdleCompactionService.ts
+++ b/apps/server/src/orchestration-v2/IdleCompactionService.ts
@@ -88,10 +88,12 @@ export const make = Effect.gen(function* () {
           )
         )
           return;
-        const latestRun = records.runs.reduce<(typeof records.runs)[number] | undefined>(
-          (latest, run) => (latest === undefined || run.ordinal > latest.ordinal ? run : latest),
-          undefined,
-        );
+        const latestRun = records.runs
+          .filter((run) => run.status !== "cancelled" || run.startedAt !== null)
+          .reduce<(typeof records.runs)[number] | undefined>(
+            (latest, run) => (latest === undefined || run.ordinal > latest.ordinal ? run : latest),
+            undefined,
+          );
         // A late update for an earlier run replaced the latest run's timer, so take it over.
         if (latestRun?.status === "completed" && latestRun.id !== runId) {
           runId = latestRun.id;
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index 5b24a65a99567..a79b2f37a1ddf 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -322,6 +322,8 @@ it.effect("idle compaction filters keep the latest run, live work and the newest
       [2, "completed"],
       [3, "completed"],
       [4, "failed"],
+      // A removed or steered queued message.
+      [5, "cancelled"],
     ] as const) {
       const runId = RunId.make(`run:idle-compaction:${ordinal}`);
       yield* store.apply({
@@ -345,7 +347,7 @@ it.effect("idle compaction filters keep the latest run, live work and the newest
           activeAttemptId: null,
           status,
           requestedAt: now,
-          startedAt: now,
+          startedAt: status === "cancelled" ? null : now,
           completedAt: now,
           checkpointId: null,
           contextHandoffId: null,
@@ -446,7 +448,8 @@ it.effect("idle compaction filters keep the latest run, live work and the newest
         contextTransferStatuses: ["pending"],
       },
     );
-    // The failed latest run stays, so a completed earlier run is not mistaken for the latest.
+    // The failed latest run stays, so a completed earlier run is not mistaken for the latest,
+    // and a cancelled queued run never counts as the latest.
     assert.deepEqual(
       records.runs.map((run) => run.id),
       ["run:idle-compaction:rolled-back", "run:idle-compaction:4"],
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 3cffce15b70d6..d67da31d073da 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -3278,6 +3278,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                     OR (${filter.includeLatestRun === true ? 1 : 0} = 1 AND run_id = (
                       SELECT run_id FROM orchestration_v2_projection_runs
                       WHERE thread_id = ${threadId}
+                        AND (status <> 'cancelled' OR json_extract(payload_json, '$.startedAt') IS NOT NULL)
                       ORDER BY ordinal DESC
                       LIMIT 1
                     )))`

From a9468dab74df255ce7f1a601ca1a73ef743d51e9 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 19:23:30 +0000
Subject: [PATCH 029/167] fix(server): guests of a forked thread can open files
 on the messages it inherited (#29794)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/guest/GuestShareService.test.ts       | 76 +++++++++++++++++++
 apps/server/src/guest/GuestShareService.ts    | 13 +++-
 .../src/orchestration-v2/ProjectionStore.ts   | 18 +++++
 3 files changed, 106 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/guest/GuestShareService.test.ts b/apps/server/src/guest/GuestShareService.test.ts
index a22e6182c7738..cfd8ca1363fa4 100644
--- a/apps/server/src/guest/GuestShareService.test.ts
+++ b/apps/server/src/guest/GuestShareService.test.ts
@@ -965,6 +965,82 @@ it.effect("serves the shared thread's files to its guest, never another thread's
   }).pipe(Effect.scoped, Effect.provide(layerTest)),
 );
 
+it.effect("gives a fork's guest the files on messages the fork shows from its source", () =>
+  Effect.gen(function* () {
+    const { orchestrator } = yield* shareThread;
+    const guestShares = yield* GuestShareService.GuestShareService;
+    const { attachmentsDir } = yield* ServerConfig.ServerConfig;
+    const fileSystem = yield* FileSystem.FileSystem;
+    const ownerImage = Effect.fn(function* (name: string) {
+      const image = {
+        type: "image" as const,
+        id: ChatAttachmentId.make(createAttachmentId(threadId)!),
+        name,
+        mimeType: "image/png",
+        sizeBytes: PNG.length,
+      };
+      yield* fileSystem.writeFile(
+        resolveAttachmentPath({ attachmentsDir, attachment: image })!,
+        PNG,
+      );
+      yield* orchestrator.dispatch({
+        type: "message.dispatch",
+        commandId: CommandId.make(`owner:${name}`),
+        threadId,
+        messageId: MessageId.make(`message:${name}`),
+        text: name,
+        attachments: [image],
+        dispatchMode: { type: "defer_start" },
+        createdBy: "user",
+        creationSource: "web",
+      });
+      return image;
+    });
+    const inherited = yield* ownerImage("before.png");
+    const run = (yield* orchestrator.getThreadRecords(threadId, ["runs"])).runs[0]!;
+    const now = yield* DateTime.now;
+    yield* (yield* EventSink.EventSinkV2).write({
+      events: [
+        {
+          id: EventId.make("event:run-done"),
+          type: "run.updated",
+          threadId,
+          runId: run.id,
+          providerInstanceId: instanceId,
+          occurredAt: now,
+          payload: { ...run, status: "completed", completedAt: now },
+        },
+      ],
+    });
+    const forkId = ThreadId.make("thread:guest-share-fork");
+    yield* orchestrator.dispatch({
+      type: "thread.fork",
+      commandId: CommandId.make("fork"),
+      sourceThreadId: threadId,
+      targetThreadId: forkId,
+      sourcePoint: { type: "run", runId: run.id },
+      createdBy: "user",
+      creationSource: "web",
+    });
+    const later = yield* ownerImage("after.png");
+    const { url } = yield* guestShares.create({ threadId: forkId });
+    const { token: session } = yield* guestShares.redeem({
+      credential: url.slice(url.indexOf("#") + 1),
+      name: "Sam",
+    });
+
+    assert.equal(
+      (yield* guestShares.attachment(session, inherited.id)).attachment.id,
+      inherited.id,
+    );
+    // The source's messages after the fork point are not part of the fork.
+    assert.equal(
+      (yield* Effect.flip(guestShares.attachment(session, later.id))).reason,
+      "unavailable",
+    );
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.effect("serves an image on the host only when an agent reply the guest sees shows it", () =>
   Effect.gen(function* () {
     const { orchestrator, guestShares } = yield* shareThread;
diff --git a/apps/server/src/guest/GuestShareService.ts b/apps/server/src/guest/GuestShareService.ts
index 8298e10e4df5a..fd9a0efc3b66b 100644
--- a/apps/server/src/guest/GuestShareService.ts
+++ b/apps/server/src/guest/GuestShareService.ts
@@ -715,7 +715,18 @@ const make = Effect.gen(function* () {
             .find((candidate) => candidate.id === attachmentId),
         ),
         Effect.mapError(() => unavailable),
-      ));
+      )) ??
+      // A fork shows its source's earlier messages, which stay in the source thread.
+      (thread.forkedFrom === null
+        ? undefined
+        : yield* orchestrator.getTimelinePage(thread.id, { attachmentId, limit: 1 }).pipe(
+            Effect.map(({ items }) =>
+              items
+                .flatMap(({ item }) => (item.type === "user_message" ? item.attachments : []))
+                .find((candidate) => candidate.id === attachmentId),
+            ),
+            Effect.mapError(() => unavailable),
+          ));
     const path =
       found === undefined ? null : resolveAttachmentPath({ attachmentsDir, attachment: found });
     if (found === undefined || path === null) return yield* unavailable;
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index d67da31d073da..6186db8c6e39d 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -394,6 +394,7 @@ export type ProjectionRecords<K extends ProjectionRecordField> = Pick<
 export interface ProjectionTimelinePageOptions {
   readonly afterPosition?: number;
   readonly itemId?: TurnItemId;
+  readonly attachmentId?: string;
   readonly view?: "messages" | "activity";
   readonly limit: number;
 }
@@ -5835,6 +5836,20 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         .withTransaction(
           Effect.gen(function* () {
             const index = yield* readTimelineIndex(threadId, new Set());
+            const attachmentOwners =
+              options.attachmentId === undefined
+                ? undefined
+                : new Set(
+                    (yield* sql<{ thread_id: string; turn_item_id: string }>`
+          SELECT item.thread_id, item.turn_item_id
+          FROM orchestration_v2_projection_turn_items AS item,
+            json_each(item.payload_json, '$.attachments') AS attachment
+          WHERE item.thread_id IN ${sql.in([...new Set(index.visible.map((row) => row.sourceThreadId))])}
+            AND item.type = 'user_message'
+            AND json_extract(attachment.value, '$.id') = ${options.attachmentId}`).map(
+                      (row) => `${row.thread_id}:${row.turn_item_id}`,
+                    ),
+                  );
             const matching = index.visible
               .map((row, position) => ({ ...row, position }))
               .filter((row) =>
@@ -5845,6 +5860,9 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                         row.item.type,
                       ))
                   : row.sourceItemId === options.itemId,
+              )
+              .filter(
+                (row) => attachmentOwners?.has(`${row.sourceThreadId}:${row.sourceItemId}`) ?? true,
               );
             const page = matching.slice(0, options.limit);
             const sources = yield* encodeTimelineSources(

From 1a3f76e80afd33785d06c2acaf0e80eb1785c1e6 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 13:28:06 -0600
Subject: [PATCH 030/167] fix(evals): resume browser verification after
 unavailable status (#30298)

---
 .agents/skills/test-t3-app/SKILL.md           | 17 ++++--
 evals/mcp-tool-use/README.md                  |  1 +
 .../mcp-tool-use/cases/visual-preview.ndjson  |  2 +
 evals/mcp-tool-use/run.test.ts                | 22 +++++++
 evals/mcp-tool-use/run.ts                     | 57 ++++++++++++++-----
 5 files changed, 80 insertions(+), 19 deletions(-)

diff --git a/.agents/skills/test-t3-app/SKILL.md b/.agents/skills/test-t3-app/SKILL.md
index 6fde6fff30984..7ac0eb1106b32 100644
--- a/.agents/skills/test-t3-app/SKILL.md
+++ b/.agents/skills/test-t3-app/SKILL.md
@@ -5,10 +5,10 @@ description: Test T3 Code's web and desktop UI through its built-in Browser pane
 
 # Test T3 web and desktop
 
-Use T3's built-in Browser panel for verification. If its tools are absent or
-the panel reports unavailable, explain the blocker and stop verification.
-Do not install or switch to another automation system. For native mobile
-testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md).
+Use T3's built-in Browser panel for verification. Follow the recovery steps
+below before declaring it unavailable. Do not install or switch to another
+automation system. For native mobile testing, use
+[test-t3-mobile](../test-t3-mobile/SKILL.md).
 
 ## Start the app
 
@@ -36,8 +36,13 @@ model, such as Haiku for Claude or Luna for Codex.
 
 ## Use the Browser panel
 
-Call `preview_status`, then `preview_open` if the Browser panel is
-closed. Navigate to the complete startup pairing URL once with
+Call `preview_status`. If no tab can be automated, call `preview_open`, including
+when status reports `available: false` or `tabId: null`. Status can report
+unavailable simply because no tab exists yet; opening a tab needs no user action.
+Stop verification and explain the blocker only if the tools are absent or
+`preview_open` reports unavailable or fails.
+
+Navigate to the complete startup pairing URL once with
 `preview_navigate`, then use `preview_snapshot` and T3's interaction tools.
 If the token was consumed or expired, run `node apps/server/src/bin.ts pair`
 for a fresh one. Keep using the same tab.
diff --git a/evals/mcp-tool-use/README.md b/evals/mcp-tool-use/README.md
index 3b817f574455f..fadea6438da46 100644
--- a/evals/mcp-tool-use/README.md
+++ b/evals/mcp-tool-use/README.md
@@ -26,6 +26,7 @@ Cases are JSON lines in `cases/`, one file per area. The case schema in `run.ts`
 - `kind`: `bad` reproduces a mistake, `guard` protects correct behavior, `control` is ordinary work.
 - `experience`: the real mistake, in a sentence. `source`: where it happened.
 - `setup`: the fake thread, its `world` (repo, branch, files, PRs, pages), `priorTurns`, and `mocks` for tool results.
+- `setup.priorTurns[].toolCalls[].resultFile`: load a repository-relative file as the tool result instead of copying its contents into the case. An empty `prompt` resumes a top-level thread after its last prior tool result without adding a user message. Side-chat and subagent setups require a nonempty prompt.
 - `expect`: the checks, such as `calls`, `callsMustNot`, `maxCalls`, `order`, `textMust`, and `linked`. Device cases also use `device` to check every child brief, forbid raw UI commands, bound failed device actions per user turn, and require artifact paths in completed final answers.
 
 Check that the case builds with `--dry-run --case <id>`. Then run it on the text before your fix, where it must fail, and on the text after, where it must pass.
diff --git a/evals/mcp-tool-use/cases/visual-preview.ndjson b/evals/mcp-tool-use/cases/visual-preview.ndjson
index 1940692d9fe17..1b9d713307e91 100644
--- a/evals/mcp-tool-use/cases/visual-preview.ndjson
+++ b/evals/mcp-tool-use/cases/visual-preview.ndjson
@@ -28,3 +28,5 @@
 {"id": "proactive-visual-ci-time-breakdown", "area": "visual-preview", "kind": "bad", "privacy": "commit-safe", "pattern": "data that reads better as a chart answered in prose only", "rule": "When a chart, diagram, or mockup says more than prose: html_preview, then html_render", "source": {"report": "agents used inline HTML visuals less often after #24850 made the rule ask-only"}, "experience": "The user shared CI job times over several runs and asked what eats the time. The agent answered in prose; a stacked chart would have shown it.", "setup": {"role": "top"}, "prompt": "CI got slow. Here are job times in minutes for the last 8 runs on main. What's eating the time?\n\nRun | install | typecheck | lint | test-server | test-web | build | e2e\n1 | 2.1 | 3.0 | 1.2 | 6.8 | 4.1 | 3.3 | 7.9\n2 | 2.0 | 3.1 | 1.1 | 6.9 | 4.0 | 3.4 | 8.2\n3 | 2.2 | 3.0 | 1.2 | 7.4 | 4.2 | 3.3 | 8.0\n4 | 2.1 | 3.2 | 1.3 | 9.8 | 4.1 | 3.5 | 8.1\n5 | 2.3 | 3.1 | 1.2 | 12.6 | 4.3 | 3.4 | 8.4\n6 | 2.2 | 3.3 | 1.2 | 13.1 | 4.2 | 3.6 | 12.9\n7 | 2.1 | 3.2 | 1.3 | 13.4 | 4.4 | 3.5 | 13.2\n8 | 2.2 | 3.2 | 1.2 | 13.0 | 4.3 | 3.4 | 13.5", "expect": {"calls": [{"tool": "html_render"}], "order": ["html_preview", "html_render"], "notCalls": ["preview_open", "preview_navigate"]}}
 {"id": "requested-after-video-for-edit", "area": "visual-preview", "kind": "bad", "privacy": "commit-safe", "pattern": "agent refuses requested browser recording of its own edit", "experience": "A user asked for an after video of a UI fix. The agent declined because the injected instructions prohibited preview for its own edits.", "rule": "Use preview when the user asks for browser work, including recording an edit.", "setup": {"role": "top", "context": "The UI fix is complete and a development server is already running at http://localhost:3000. Browser verification and recording are authorized.", "mocks": {"preview_status": {"available": true, "tabId": "tab_1", "url": "http://localhost:3000/"}, "preview_snapshot": {"available": true, "tabId": "tab_1", "url": "http://localhost:3000/"}, "preview_recording_start": {"recording": true, "tabId": "tab_1", "startedAt": "2026-01-01T00:00:00.000Z"}, "preview_recording_stop": {"id": "recording_1", "tabId": "tab_1", "path": "/tmp/after.webm", "mimeType": "video/webm", "sizeBytes": 1024, "createdAt": "2026-01-01T00:00:01.000Z"}}}, "prompt": "Use the T3 browser to verify the UI fix you just made and record an after video.", "expect": {"calls": [{"tool": "preview_recording_start"}, {"tool": "preview_recording_stop"}], "order": ["preview_recording_start", "preview_recording_stop"]}, "source": {"report": "A user requested an after video of a UI fix; the agent declined because preview was prohibited for its own edits."}}
 {"id": "dev-server-opened-blank-then-navigated", "area": "visual-preview", "kind": "bad", "pattern": "preview_open on a blank tab, then preview_navigate to the dev-server port", "experience": "Asked to open a dev server in the T3 preview, agents opened a blank tab and navigated it to the port in a second call. 121 of these pairs in a month of maintainer threads.", "rule": "preview_open takes a url but not a dev-server target", "privacy": "commit-safe", "setup": {"role": "top", "context": "CLAUDE.md says: for t3code browser work, use the server-side preview_* mcp tools, with `target: {kind: \"environment-port\", port: ...}` for dev servers in the current environment. The dev server for this repo is running; `vp run dev` printed `Local: http://localhost:5173/`.", "mocks": {"preview_status": {"available": true, "visible": false, "tabId": null, "url": null, "title": null, "loading": false, "profiles": [{"id": "default", "name": "Default"}], "defaultProfileId": "default"}, "preview_open": {"available": true, "visible": true, "tabId": "tab_1", "url": "http://localhost:5173/", "title": "Acme", "loading": false, "control": {"owner": "agent", "ownedByCaller": true}}, "preview_navigate": {"available": true, "visible": true, "tabId": "tab_1", "url": "http://localhost:5173/", "title": "Acme", "loading": false, "control": {"owner": "agent", "ownedByCaller": true}}}}, "prompt": "open the dev server in the t3 preview, i want to click around", "expect": {"calls": [{"tool": "preview_open", "args": {"target.port": 5173}}], "maxCalls": {"preview_open": 1, "preview_navigate": 0}}, "maxSteps": 6, "source": {"thread": "Maintainer threads, 2026-10: preview_open with no url followed by preview_navigate to an environment-port target, 121 times"}}
+{"id": "browser-status-reuses-existing-tab", "area": "visual-preview", "kind": "control", "privacy": "commit-safe", "pattern": "usable Browser tab needs no new tab", "experience": "An already paired, usable tab should be reused during verification.", "source": {"report": "Maintainer browser verification failure, 2026-11-03"}, "setup": {"role": "top", "context": "The UI fix is complete. The test server is healthy at http://localhost:5173 and its browser profile is already paired. The current tab can be automated.", "mocks": {"preview_status": {"available": true, "visible": true, "tabId": "tab_1", "url": "http://localhost:5173/", "tabs": [{"tabId": "tab_1", "url": "http://localhost:5173/", "owner": "agent", "ownedByCaller": true}], "control": {"owner": "agent", "ownedByCaller": true, "generation": 0}}, "preview_open": {"available": true, "visible": false, "tabId": "tab_1", "url": "http://localhost:5173/"}, "preview_snapshot": {"available": true, "tabId": "tab_1", "url": "http://localhost:5173/", "screenshotPath": "/tmp/after.png"}}, "priorTurns": [{"role": "user", "text": "Use the Browser panel to verify the UI fix and capture an after screenshot."}, {"role": "assistant", "toolCalls": [{"tool": "Bash", "input": {"command": "cat .agents/skills/test-t3-app/SKILL.md"}, "result": "", "resultFile": ".agents/skills/test-t3-app/SKILL.md"}]}, {"role": "assistant", "toolCalls": [{"tool": "preview_status", "input": {}, "result": {"available": true, "visible": true, "tabId": "tab_1", "url": "http://localhost:5173/", "tabs": [{"tabId": "tab_1", "url": "http://localhost:5173/", "owner": "agent", "ownedByCaller": true}], "control": {"owner": "agent", "ownedByCaller": true, "generation": 0}}}]}], "harness": "claude"}, "prompt": "", "expect": {"calls": [{"tool": "preview_snapshot"}], "callsMustNot": [{"tool": "preview_open", "args": {"reuseExistingTab": false}}]}, "maxSteps": 10, "notes": "Checks reuse of an existing usable tab. Screenshot saving is outside this control. Prior tool-result replay is validated on the Claude harness; Codex output wrapping needs separate validation."}
+{"id": "browser-resume-after-unavailable-status", "area": "visual-preview", "kind": "bad", "privacy": "commit-safe", "pattern": "closed Browser panel treated as unavailable automation", "experience": "The agent read test-t3-app, saw available false with no tab, and asked the user to open the panel instead of calling preview_open. Opening a tab succeeded on the next turn.", "source": {"report": "Maintainer browser verification failure, 2026-11-03; fresh skill read followed by unavailable status. Opus replay reproduces the stop on the old skill."}, "setup": {"role": "top", "context": "Repository instructions: Before web or desktop UI verification, read .agents/skills/test-t3-app/SKILL.md and follow it. If a skill causes you to stop or leave requested work unfinished, link the SKILL.md, quote the relevant instruction, and explain how it applies.", "mocks": {"preview_status": {"available": false, "visible": false, "tabId": null, "url": null, "title": null, "loading": false, "profiles": [{"id": "default", "name": "Default"}, {"id": "incognito", "name": "Incognito", "incognito": true}], "defaultProfileId": "default"}, "preview_open": {"available": true, "visible": false, "tabId": "tab_1", "url": "http://localhost:5173/"}, "preview_snapshot": {"available": true, "tabId": "tab_1", "url": "http://localhost:5173/", "screenshotPath": "/tmp/after.png"}}, "world": {"repo": "acme/app", "branch": "fix/permissions-popup", "status": "", "files": {"apps/web/src/components/ComposerContextPermissions.tsx": "export function ComposerContextPermissions() { return <PermissionsMenu side=\"top\" align=\"end\" />; }\n"}, "description": "The requested fix is already committed as a1b2c3d on fix/permissions-popup, ahead of main. It changes ComposerContextPermissions.tsx to open the permissions popup above its trigger. Dependencies are installed. No development server is running and no .t3 directory exists.", "commits": [{"sha": "a1b2c3d", "subject": "fix(web): open composer permissions above its button"}]}, "priorTurns": [{"role": "user", "text": "When I click Full access in the composer, open its permissions menu directly above that button."}, {"role": "assistant", "toolCalls": [{"tool": "Bash", "input": {"command": "git commit -am \"fix(web): open composer permissions above its button\""}, "result": "[fix/permissions-popup a1b2c3d] fix(web): open composer permissions above its button\n 1 file changed, 3 insertions(+), 1 deletion(-)"}]}, {"role": "assistant", "text": "Implemented. Clicking Full access opens the permissions menu above the button. Focused checks pass. Full-client visual verification remains undone."}, {"role": "user", "text": "before/after screenshot"}, {"role": "assistant", "toolCalls": [{"tool": "Bash", "input": {"command": "cat .agents/skills/test-t3-app/SKILL.md"}, "result": "", "resultFile": ".agents/skills/test-t3-app/SKILL.md"}]}, {"role": "assistant", "text": "I'll use the test-t3-app skill to capture the before and after states in the app."}, {"role": "assistant", "toolCalls": [{"tool": "preview_status", "input": {}, "result": {"available": false, "visible": false, "tabId": null, "url": null, "title": null, "loading": false, "profiles": [{"id": "default", "name": "Default"}, {"id": "incognito", "name": "Incognito", "incognito": true}], "defaultProfileId": "default"}}]}], "shellMocks": [{"match": "git status|ls .*\\.t3", "output": "ls: .t3: No such file or directory"}], "harness": "claude"}, "prompt": "", "expect": {"calls": [{"tool": "preview_open"}]}, "maxSteps": 8, "notes": "Resume at the failed decision after reading the skill and receiving available=false. Opus reproduces the premature stop; Sonnet did not reliably reproduce it. This checks recovery through preview_open, not completion of screenshots. Prior tool-result replay is validated on the Claude harness; Codex output wrapping needs separate validation."}
diff --git a/evals/mcp-tool-use/run.test.ts b/evals/mcp-tool-use/run.test.ts
index 217e505f5fcf5..6c24f18ac5063 100644
--- a/evals/mcp-tool-use/run.test.ts
+++ b/evals/mcp-tool-use/run.test.ts
@@ -394,6 +394,28 @@ it("replays earlier capability results with the model under test as the caller",
     .flatMap((message) => message.content)
     .find((block) => block.type === "tool_result" && String(block.content).includes("inherited"));
   assert.include(String(replayed?.content), '"inheritedModel":"claude-opus-5-5"');
+  const resumed = buildMessages(makeSample({ ...testCase, prompt: "" }, base));
+  assert.equal(resumed.at(-1)?.role, "user");
+  assert.equal(resumed.at(-1)?.content.at(-1)?.type, "tool_result");
+  for (const setup of [
+    {
+      ...testCase.setup,
+      sideChat: { parentThreadId: "thread-parent", digest: ["The permissions fix is committed."] },
+    },
+    { ...testCase.setup, role: "native-subagent" as const },
+    { ...testCase.setup, role: "delegated-child" as const },
+  ]) {
+    assert.throws(
+      () =>
+        buildMessages(
+          makeSample(
+            { ...testCase, prompt: "", setup },
+            { ...base, subagentContext: "Hook context" },
+          ),
+        ),
+      /Empty-prompt replay/,
+    );
+  }
 });
 
 it("gives each launched thread its own id, and reading it back shows that thread's brief", () => {
diff --git a/evals/mcp-tool-use/run.ts b/evals/mcp-tool-use/run.ts
index 3e6bb84f697be..02c5d8ce58e46 100644
--- a/evals/mcp-tool-use/run.ts
+++ b/evals/mcp-tool-use/run.ts
@@ -140,6 +140,8 @@ const PriorToolCall = Schema.Struct({
   input: Schema.Unknown,
   /** For a device tool, `"default"` runs the call on the world's devices for T3's result. */
   result: Schema.Unknown,
+  /** Repository-relative file whose current contents supply this tool result. */
+  resultFile: Schema.optional(Schema.String),
 });
 
 /**
@@ -275,6 +277,7 @@ export const McpToolUseCase = Schema.Struct({
       Schema.Struct({ parentThreadId: Schema.String, digest: Schema.Array(Schema.String) }),
     ),
   }),
+  /** Empty to resume a top-level thread without side-chat context after its last tool result. */
   prompt: Schema.String,
   /** Records for the context chips `prompt` links, projected as T3 sends them. */
   promptContext: Schema.optional(Schema.Struct({ records: Schema.Array(ComposerContextRecord) })),
@@ -880,6 +883,19 @@ export const buildMessages = (sample: Sample) => {
     else messages[messages.length - 1] = { role, content: [...last.content, ...blocks] };
   };
   const { role, context, delegateRole, priorTurns = [] } = testCase.setup;
+  const sideChat = testCase.setup.sideChat;
+  if (testCase.prompt === "" && (role !== "top" || sideChat !== undefined)) {
+    throw new Error(
+      `${testCase.id}: Empty-prompt replay requires a top-level thread without side-chat context.`,
+    );
+  }
+  const sideChatContext =
+    sideChat === undefined
+      ? undefined
+      : makeSideChatContext({
+          parentThreadId: ThreadId.make(sideChat.parentThreadId),
+          digest: sideChat.digest,
+        });
   const native = role === "native-subagent";
   const notes = [
     native
@@ -926,19 +942,11 @@ export const buildMessages = (sample: Sample) => {
     testCase.promptContext === undefined
       ? testCase.prompt
       : projectComposerContextForProvider({ text: testCase.prompt, ...testCase.promptContext });
-  const sideChat = testCase.setup.sideChat;
   const prompt =
-    sideChat === undefined
-      ? userText
-      : withInlineContext(
-          makeSideChatContext({
-            parentThreadId: ThreadId.make(sideChat.parentThreadId),
-            digest: sideChat.digest,
-          }),
-          userText,
-        );
+    sideChatContext === undefined ? userText : withInlineContext(sideChatContext, userText);
   const childPrompt = () => taskPrompt({ task: prompt, role: delegateRole });
-  push("user", text(role === "delegated-child" ? childPrompt() : prompt));
+  if (testCase.prompt !== "")
+    push("user", text(role === "delegated-child" ? childPrompt() : prompt));
   // Claude Code gives a subagent its SubagentStart hooks' context as a reminder after the task.
   if (native && base.subagentContext) {
     push("user", reminder(`SubagentStart hook additional context: ${base.subagentContext}`));
@@ -2125,12 +2133,35 @@ const main = Effect.gen(function* () {
   const wanted = flags.case?.flatMap((ids) => ids.split(","));
   const codex = isCodex(flags.model);
   const harness = codex ? "codex" : "claude";
-  const selected = cases.filter(
+  const selectedCases = cases.filter(
     ({ id, setup }) =>
       (wanted === undefined || wanted.includes(id)) &&
       (setup.harness === undefined || setup.harness === harness),
   );
-  if (selected.length === 0) return yield* Effect.die(new Error("No case matches --case."));
+  if (selectedCases.length === 0) return yield* Effect.die(new Error("No case matches --case."));
+  const selected = yield* Effect.forEach(selectedCases, (testCase) =>
+    Effect.gen(function* () {
+      const priorTurns = yield* Effect.forEach(testCase.setup.priorTurns ?? [], (turn) =>
+        Effect.gen(function* () {
+          const toolCalls = yield* Effect.forEach(turn.toolCalls ?? [], (call) =>
+            call.resultFile === undefined
+              ? Effect.succeed(call)
+              : fs
+                  .readFileString(path.resolve(import.meta.dirname, "../..", call.resultFile))
+                  .pipe(Effect.map((result) => ({ ...call, result }))),
+          );
+          return { ...turn, toolCalls };
+        }),
+      );
+      return {
+        ...testCase,
+        setup: {
+          ...testCase.setup,
+          priorTurns,
+        },
+      };
+    }),
+  );
   // Trimmed captures without user data ship beside the cases. `--template` also takes a raw
   // CLIProxyAPI capture.
   const templatePath =

From bff68fb6b6f86346f780024db62ba75873f70854 Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Tue, 3 Nov 2026 14:31:29 -0500
Subject: [PATCH 031/167] fix(shared): saving one source control token no
 longer drops the other hosts' tokens (#29554)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../SourceControlAppSignInSettings.tsx        |  2 +-
 packages/contracts/src/settings.ts            |  2 +-
 packages/shared/src/serverSettings.test.ts    | 18 ++++++++++
 packages/shared/src/serverSettings.ts         | 34 ++++++++++++++++---
 4 files changed, 50 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/components/settings/SourceControlAppSignInSettings.tsx b/apps/web/src/components/settings/SourceControlAppSignInSettings.tsx
index df73fa3b24b45..54b0018a249c7 100644
--- a/apps/web/src/components/settings/SourceControlAppSignInSettings.tsx
+++ b/apps/web/src/components/settings/SourceControlAppSignInSettings.tsx
@@ -171,7 +171,7 @@ export function SourceControlAppSignInSettings({
           />
         </span>
       ) : tokenOverrides ? (
-        "Signed in, but the token saved below is used until you remove it."
+        "Signed in, but the token saved below is used while it can be read."
       ) : (
         "Signed in"
       );
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index 4bb3119561b08..cf8e6effe0570 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -1696,7 +1696,7 @@ export const ServerSettingsPatch = Schema.Struct({
       otlpLogsUrl: Schema.optionalKey(TrimmedString),
     }),
   ),
-  /** Merges per host, replacing patched fields whole; redaction markers retain secrets, empty or omitted secrets remove them. */
+  /** Merges per host, replacing patched fields whole; redaction markers retain secrets, empty secrets remove them. A non-empty token map keeps the saved tokens of hosts it omits; an empty map clears them all. */
   sourceControlHosts: Schema.optionalKey(Schema.Record(Schema.String, SourceControlHostSettings)),
   // Replace whole maps to avoid half-merged driver configs.
   providerInstances: Schema.optionalKey(Schema.Record(ProviderInstanceId, ProviderInstanceConfig)),
diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index a897f3d427a34..cfbc9339e4eef 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -127,6 +127,24 @@ describe("serverSettings helpers", () => {
     });
   });
 
+  it("keeps a source control host's saved tokens when a patch sets another host's token", () => {
+    const reference = { provider: "vault", reference: "github/token" };
+    const saved = applyServerSettingsPatch(DEFAULT_SERVER_SETTINGS, {
+      sourceControlHosts: { github: { tokens: { "github.com": reference } } },
+    });
+    const patched = applyServerSettingsPatch(saved, {
+      sourceControlHosts: { github: { tokens: { "ghe.example": "x" } } },
+    });
+    expect(patched.sourceControlHosts.github?.tokens).toEqual({
+      "github.com": reference,
+      "ghe.example": "x",
+    });
+    const recased = applyServerSettingsPatch(saved, {
+      sourceControlHosts: { github: { tokens: { " GitHub.com ": "ghp_new" } } },
+    });
+    expect(recased.sourceControlHosts.github?.tokens).toEqual({ "github.com": "ghp_new" });
+  });
+
   it("inherits actions, preserves existing actions, and supports empty overrides and reset", () => {
     const project = { id: ProjectId.make("project-actions"), scripts: [] };
     const action = {
diff --git a/packages/shared/src/serverSettings.ts b/packages/shared/src/serverSettings.ts
index e936c9f83acba..0db213a90f7b6 100644
--- a/packages/shared/src/serverSettings.ts
+++ b/packages/shared/src/serverSettings.ts
@@ -23,6 +23,7 @@ import {
   withIdleCompaction,
 } from "@t3tools/contracts";
 import * as Option from "effect/Option";
+import * as Predicate from "effect/Predicate";
 import * as Schema from "effect/Schema";
 import { deepMerge } from "./Struct.ts";
 import { fromLenientJson } from "./schemaJson.ts";
@@ -226,6 +227,15 @@ function mergeSettingsEntries<Value>(
   return Object.fromEntries(next);
 }
 
+// Secret persistence keys tokens by trimmed, lowercased host, so merge on the same key.
+const byHost = (tokens: unknown) =>
+  Object.fromEntries(
+    Object.entries(Predicate.isObject(tokens) ? tokens : {}).map(([host, token]) => [
+      host.trim().toLowerCase(),
+      token,
+    ]),
+  );
+
 const knownProjectOverrideKeys = new Set(Object.keys(ProjectSettingsOverrides.fields));
 
 function pickOverrideKeys(entry: ProjectSettingsOverrides | undefined, known: boolean) {
@@ -530,10 +540,26 @@ export function applyServerSettingsPatch(
           sourceControlHosts: {
             ...current.sourceControlHosts,
             ...Object.fromEntries(
-              Object.entries(sourceControlHostsPatch).map(([kind, fields]) => [
-                kind,
-                { ...current.sourceControlHosts[kind], ...fields },
-              ]),
+              Object.entries(sourceControlHostsPatch).map(([kind, fields]) => {
+                const saved = current.sourceControlHosts[kind];
+                return [
+                  kind,
+                  {
+                    ...saved,
+                    ...fields,
+                    // Older clients send the whole token map; a host missing from it keeps its saved
+                    // token. An empty map still clears them all.
+                    ...(Predicate.isObject(fields.tokens) && Object.keys(fields.tokens).length > 0
+                      ? {
+                          tokens: {
+                            ...byHost(saved?.tokens),
+                            ...byHost(fields.tokens),
+                          },
+                        }
+                      : {}),
+                  },
+                ];
+              }),
             ),
           },
         }

From dd24b375f0c94cdeb76d1774ab5022aff2e1406e Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:46:40 -0800
Subject: [PATCH 032/167] fix(desktop): a policy that stops startup no longer
 points at another release (#30319)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/app/DesktopStartupRecovery.test.ts    |  14 +++
 .../desktop/src/app/DesktopStartupRecovery.ts |  24 ++++-
 .../src/backend/DesktopBackendManager.test.ts | 100 ++++++++++--------
 .../src/backend/DesktopBackendManager.ts      |  18 +++-
 packages/contracts/src/desktopBootstrap.ts    |   2 +
 packages/shared/src/managedPolicyFile.ts      |   5 +-
 6 files changed, 107 insertions(+), 56 deletions(-)

diff --git a/apps/desktop/src/app/DesktopStartupRecovery.test.ts b/apps/desktop/src/app/DesktopStartupRecovery.test.ts
index 12d5289af67c7..029bcaac2b487 100644
--- a/apps/desktop/src/app/DesktopStartupRecovery.test.ts
+++ b/apps/desktop/src/app/DesktopStartupRecovery.test.ts
@@ -74,6 +74,19 @@ describe("resolveStartupRecoveryOffer", () => {
     ).toEqual({ _tag: "Reinstall", version: "0.1.2" });
   });
 
+  it("blames the managed policy unless a newer version can read it", () => {
+    expect(
+      resolveStartupRecoveryOffer(
+        updateState({ status: "available", availableVersion: "0.1.4" }),
+        "0.1.2",
+        true,
+      ),
+    ).toEqual({ _tag: "Update", version: "0.1.4" });
+    expect(
+      resolveStartupRecoveryOffer(updateState({ status: "up-to-date" }), "0.1.2", true),
+    ).toEqual({ _tag: "ManagedPolicy" });
+  });
+
   it("falls back to the releases page when this version never started", () => {
     expect(resolveStartupRecoveryOffer(updateState({ status: "disabled" }), "0.1.3")).toEqual({
       _tag: "Releases",
@@ -168,6 +181,7 @@ it.effect.each([
       yield* SubscriptionRef.set(state.primaryBackendStartup, {
         _tag: "Failing",
         reason: "Server failed before readiness",
+        managedPolicy: false,
         output: "Failure details",
       });
       yield* Deferred.await(checked);
diff --git a/apps/desktop/src/app/DesktopStartupRecovery.ts b/apps/desktop/src/app/DesktopStartupRecovery.ts
index ae94fd5b4c135..c8228183aad91 100644
--- a/apps/desktop/src/app/DesktopStartupRecovery.ts
+++ b/apps/desktop/src/app/DesktopStartupRecovery.ts
@@ -32,7 +32,8 @@ export type StartupRecoveryOffer =
   | { readonly _tag: "Update"; readonly version: string }
   | { readonly _tag: "Downloading"; readonly version: string; readonly percent: number | null }
   | { readonly _tag: "Reinstall"; readonly version: string }
-  | { readonly _tag: "Releases" };
+  | { readonly _tag: "Releases" }
+  | { readonly _tag: "ManagedPolicy" };
 
 const STARTUP_RECOVERY_ACTIONS = ["update", "reinstall", "releases", "copy", "quit"] as const;
 type StartupRecoveryAction = (typeof STARTUP_RECOVERY_ACTIONS)[number];
@@ -41,6 +42,7 @@ type StartupRecoveryAction = (typeof STARTUP_RECOVERY_ACTIONS)[number];
 export function resolveStartupRecoveryOffer(
   update: DesktopUpdateState,
   lastStartedVersion: string | null,
+  managedPolicy = false,
 ): StartupRecoveryOffer {
   if (update.status === "downloading" && update.availableVersion !== null) {
     return {
@@ -55,6 +57,8 @@ export function resolveStartupRecoveryOffer(
   if (updateVersion !== null && updateVersion !== update.notAppliedVersion) {
     return { _tag: "Update", version: updateVersion };
   }
+  // A newer release can know a key this one refuses; an older one or the releases page cannot help.
+  if (managedPolicy) return { _tag: "ManagedPolicy" };
   if (update.enabled && (update.status === "idle" || update.status === "checking")) {
     return { _tag: "Checking" };
   }
@@ -98,6 +102,11 @@ function describeOffer(offer: StartupRecoveryOffer): { text: string; action: str
         text: "Get a different version from the releases page.",
         action: actionLink("releases", "Open releases", true),
       };
+    case "ManagedPolicy":
+      return {
+        text: "Your organization's managed policy stopped T3 Code from starting. Send the details below to your IT administrator.",
+        action: "",
+      };
   }
 }
 
@@ -171,8 +180,14 @@ export const listen: Effect.Effect<
   const { latest, changes: updateChanges } = yield* updates.subscribe;
   const updateStateRef = yield* Ref.make(latest);
 
-  const offer = Ref.get(updateStateRef).pipe(
-    Effect.map((state) => resolveStartupRecoveryOffer(state, lastStartedVersion)),
+  const offer = Effect.all([Ref.get(updateStateRef), Ref.get(failureRef)]).pipe(
+    Effect.map(([state, failure]) =>
+      resolveStartupRecoveryOffer(
+        state,
+        lastStartedVersion,
+        Option.exists(failure, ({ managedPolicy }) => managedPolicy),
+      ),
+    ),
   );
 
   const render = Effect.gen(function* () {
@@ -332,7 +347,8 @@ export const listen: Effect.Effect<
         }
         if (startup._tag !== "Failing") return;
         if (Option.isSome(yield* Ref.get(failureRef))) return;
-        yield* Ref.set(failureRef, Option.some({ reason: startup.reason, output: startup.output }));
+        const { _tag, ...failure } = startup;
+        yield* Ref.set(failureRef, Option.some(failure));
         // The backend manager already logs each failure's reason.
         yield* logWarning("primary backend failing to start");
         yield* show();
diff --git a/apps/desktop/src/backend/DesktopBackendManager.test.ts b/apps/desktop/src/backend/DesktopBackendManager.test.ts
index a5c12043d9aaa..e4714673777d9 100644
--- a/apps/desktop/src/backend/DesktopBackendManager.test.ts
+++ b/apps/desktop/src/backend/DesktopBackendManager.test.ts
@@ -1,4 +1,5 @@
 import {
+  SERVER_EXIT_CODE_MANAGED_POLICY,
   SERVER_EXIT_CODE_STATE_DIR_OWNED,
   DesktopBackendBootstrap,
   type DesktopBackendBootstrap as DesktopBackendBootstrapValue,
@@ -623,56 +624,63 @@ describe("DesktopBackendManager", () => {
     ),
   );
 
-  it.effect("reports a crash loop with the server output on the third restart", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        const message = "Error: Cannot find module 'zod/v4' in /Users/René";
-        let exitCount = 0;
-        const firstExit = yield* Deferred.make<void>();
-        const reports = yield* Queue.unbounded<{
-          readonly exitCount: number;
-          readonly failure: DesktopBackendManager.BackendStartupFailure;
-        }>();
-        const instance = yield* makeTestInstance({
-          spawnerLayer: Layer.succeed(
-            ChildProcessSpawner.ChildProcessSpawner,
-            ChildProcessSpawner.make(() =>
-              Effect.succeed(
-                makeProcess({
-                  // "é" split across chunks must not decode as U+FFFD, and the 4,000-char cut
-                  // lands inside the emoji's surrogate pair.
-                  stderr: Stream.make(
-                    new TextEncoder().encode(
-                      `😀${"x".repeat(3_999 - message.length)}${message.slice(0, -1)}`,
+  // A policy refusal is reported on the first exit, since retrying cannot fix it.
+  it.effect.each([
+    { code: 1, exits: 3, managedPolicy: false },
+    { code: SERVER_EXIT_CODE_MANAGED_POLICY, exits: 1, managedPolicy: true },
+  ])(
+    "reports exit $code with the server output after $exits exits",
+    ({ code, exits, managedPolicy }) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const message = "Error: Cannot find module 'zod/v4' in /Users/René";
+          let exitCount = 0;
+          const firstExit = yield* Deferred.make<void>();
+          const reports = yield* Queue.unbounded<{
+            readonly exitCount: number;
+            readonly failure: DesktopBackendManager.BackendStartupFailure;
+          }>();
+          const instance = yield* makeTestInstance({
+            spawnerLayer: Layer.succeed(
+              ChildProcessSpawner.ChildProcessSpawner,
+              ChildProcessSpawner.make(() =>
+                Effect.succeed(
+                  makeProcess({
+                    // "é" split across chunks must not decode as U+FFFD, and the 4,000-char cut
+                    // lands inside the emoji's surrogate pair.
+                    stderr: Stream.make(
+                      new TextEncoder().encode(
+                        `😀${"x".repeat(3_999 - message.length)}${message.slice(0, -1)}`,
+                      ),
+                      new Uint8Array([0xc3]),
+                      new Uint8Array([0xa9]),
                     ),
-                    new Uint8Array([0xc3]),
-                    new Uint8Array([0xa9]),
-                  ),
-                  exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(1)),
-                }),
+                    exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(code)),
+                  }),
+                ),
               ),
             ),
-          ),
-          httpClientLayer: layerHttpClient(() => Effect.never),
-          backendOutputLog: {
-            persistFailure: () => {
-              exitCount += 1;
-              return Deferred.succeed(firstExit, undefined).pipe(Effect.asVoid);
+            httpClientLayer: layerHttpClient(() => Effect.never),
+            backendOutputLog: {
+              persistFailure: () => {
+                exitCount += 1;
+                return Deferred.succeed(firstExit, undefined).pipe(Effect.asVoid);
+              },
             },
-          },
-          onStartupFailure: (failure) =>
-            Queue.offer(reports, { exitCount, failure }).pipe(Effect.asVoid),
-        });
-        yield* instance.start;
-        yield* Deferred.await(firstExit);
-        yield* TestClock.adjust(Duration.minutes(1));
-        const { exitCount: exitsWhenReported, failure } = yield* Queue.take(reports);
-        assert.equal(exitsWhenReported, 3);
-        assert.equal(failure.reason, "The server could not start (code=1).");
-        assert.isTrue(failure.output.endsWith(message));
-        assert.isTrue(failure.output.isWellFormed());
-      }).pipe(Effect.provide(TestClock.layer())),
-    ),
+            onStartupFailure: (failure) =>
+              Queue.offer(reports, { exitCount, failure }).pipe(Effect.asVoid),
+          });
+          yield* instance.start;
+          yield* Deferred.await(firstExit);
+          yield* TestClock.adjust(Duration.minutes(1));
+          const { exitCount: exitsWhenReported, failure } = yield* Queue.take(reports);
+          assert.equal(exitsWhenReported, exits);
+          assert.equal(failure.reason, `The server could not start (code=${code}).`);
+          assert.equal(failure.managedPolicy, managedPolicy);
+          assert.isTrue(failure.output.endsWith(message));
+          assert.isTrue(failure.output.isWellFormed());
+        }).pipe(Effect.provide(TestClock.layer())),
+      ),
   );
 
   it.effect("waits out a slow startup and reports one that never becomes ready", () =>
diff --git a/apps/desktop/src/backend/DesktopBackendManager.ts b/apps/desktop/src/backend/DesktopBackendManager.ts
index aa3b4d59ef1bf..2f5b57c4e3c95 100644
--- a/apps/desktop/src/backend/DesktopBackendManager.ts
+++ b/apps/desktop/src/backend/DesktopBackendManager.ts
@@ -17,6 +17,7 @@ import { HttpClient } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
 import {
+  SERVER_EXIT_CODE_MANAGED_POLICY,
   SERVER_EXIT_CODE_STATE_DIR_OWNED,
   DesktopBackendBootstrap,
   type DesktopBackendBootstrap as DesktopBackendBootstrapValue,
@@ -223,6 +224,8 @@ export const PRIMARY_INSTANCE_ID: BackendInstanceId = BackendInstanceId(
 
 export interface BackendStartupFailure {
   readonly reason: string;
+  /** The server refused to start under this machine's managed policy. */
+  readonly managedPolicy: boolean;
   /** Tail of the last run's stdout and stderr. */
   readonly output: string;
 }
@@ -635,9 +638,11 @@ export const makeBackendInstance = Effect.fn("makeBackendInstance")(function* (
   // One streaming decoder per stream keeps UTF-8 characters split across chunks intact.
   const makeOutputDecoders = () => ({ stdout: new TextDecoder(), stderr: new TextDecoder() });
   let outputDecoders = makeOutputDecoders();
-  const reportStartupFailure = (reason: string) =>
+  const reportStartupFailure = (reason: string, managedPolicy = false) =>
     Ref.get(outputTail).pipe(
-      Effect.flatMap((output) => spec.onStartupFailure?.({ reason, output }) ?? Effect.void),
+      Effect.flatMap(
+        (output) => spec.onStartupFailure?.({ reason, managedPolicy, output }) ?? Effect.void,
+      ),
     );
 
   const { logWarning: logInstanceWarning, logError: logInstanceError } =
@@ -880,7 +885,7 @@ export const makeBackendInstance = Effect.fn("makeBackendInstance")(function* (
                   yield* (spec.onStateDirOwned?.() ?? Effect.void).pipe(Effect.ignore);
                   return;
                 }
-                yield* scheduleRestart(reason);
+                yield* scheduleRestart(reason, exitCode);
               }
             }),
           );
@@ -980,6 +985,7 @@ export const makeBackendInstance = Effect.fn("makeBackendInstance")(function* (
 
   const scheduleRestart = Effect.fn("desktop.backendInstance.scheduleRestart")(function* (
     reason: string,
+    exitCode?: number,
   ) {
     const scheduled = yield* SubscriptionRef.modify(state, (latest) => {
       if (!latest.desiredRunning || Option.isSome(latest.restartFiber)) {
@@ -1003,8 +1009,10 @@ export const makeBackendInstance = Effect.fn("makeBackendInstance")(function* (
           reason,
           delayMs: Duration.toMillis(delay),
         });
-        if (attempt >= STARTUP_FAILURE_RESTART_ATTEMPTS) {
-          yield* reportStartupFailure(`The server could not start (${reason}).`);
+        // Retrying cannot fix a policy refusal, so say so at once; retries still pick up a fix.
+        const managedPolicy = exitCode === SERVER_EXIT_CODE_MANAGED_POLICY;
+        if (managedPolicy || attempt >= STARTUP_FAILURE_RESTART_ATTEMPTS) {
+          yield* reportStartupFailure(`The server could not start (${reason}).`, managedPolicy);
         }
         const restartFiber = yield* Effect.forkIn(
           Effect.sleep(delay).pipe(
diff --git a/packages/contracts/src/desktopBootstrap.ts b/packages/contracts/src/desktopBootstrap.ts
index a77e14b555420..6bec048a56b4e 100644
--- a/packages/contracts/src/desktopBootstrap.ts
+++ b/packages/contracts/src/desktopBootstrap.ts
@@ -4,6 +4,8 @@ import { PortSchema, PositiveInt, TrimmedNonEmptyString } from "./baseSchemas.ts
 
 // A supervisor must not restart a server refused by the state-directory owner.
 export const SERVER_EXIT_CODE_STATE_DIR_OWNED = 78;
+// A server the managed policy refused, so the desktop app blames the policy rather than the release.
+export const SERVER_EXIT_CODE_MANAGED_POLICY = 77;
 
 export const DesktopBackendBootstrap = Schema.Struct({
   mode: Schema.Literal("desktop"),
diff --git a/packages/shared/src/managedPolicyFile.ts b/packages/shared/src/managedPolicyFile.ts
index e7e44608d838c..12fb5a666a04a 100644
--- a/packages/shared/src/managedPolicyFile.ts
+++ b/packages/shared/src/managedPolicyFile.ts
@@ -1,4 +1,4 @@
-import { ManagedPolicyDocument } from "@t3tools/contracts";
+import { ManagedPolicyDocument, SERVER_EXIT_CODE_MANAGED_POLICY } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
@@ -6,6 +6,7 @@ import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Runtime from "effect/Runtime";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
@@ -20,6 +21,8 @@ export class ManagedPolicyFileError extends Schema.TaggedError<ManagedPolicyFile
     cause: Schema.optional(Schema.Defect()),
   },
 ) {
+  override readonly [Runtime.errorExitCode] = SERVER_EXIT_CODE_MANAGED_POLICY;
+
   override get message(): string {
     return `T3 Code cannot use the managed policy at ${this.path}: ${this.reason}. It will not start until an administrator fixes this.`;
   }

From 15707a84b03e27bb257d60e027812ebf94bbda25 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:46:59 -0800
Subject: [PATCH 033/167] docs: pin an absolute binary path under a permission
 cap (#29916)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/user/managed-policy.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/docs/user/managed-policy.md b/docs/user/managed-policy.md
index f9d170624bd8c..16febe7aaaf3c 100644
--- a/docs/user/managed-policy.md
+++ b/docs/user/managed-policy.md
@@ -178,8 +178,13 @@ config home, and the environment variables set on each provider. They come from
 [`providers.instances`](#providers) or T3 Code's defaults, and users cannot change them, because a
 wrapper script, a launch flag, or a variable such as `NODE_OPTIONS` could otherwise turn off the
 provider's approvals. Pin the variables your users need, such as a gateway URL, in
-`providers.instances`. Variables in the environment that starts T3 Code itself still reach
-providers.
+`providers.instances`.
+
+Variables in the environment that starts T3 Code itself still reach providers, and a default
+binary path such as `claude` is looked up on that environment's `PATH`. The desktop app builds that
+environment from settings the user controls, such as their shell profile, so a user could put their
+own `claude` earlier on their `PATH`. Pin an absolute `binaryPath` in `providers.instances` for each
+provider you allow.
 
 ACP agents' own mode menus have no effect under `maxRuntimeMode`, except Antigravity's, whose modes
 T3 Code can place under the limit. Users still choose which ACP Registry agent runs; leave

From c756ebaabc0c67dee347a205ab7907a3d1f29622 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:59:20 -0800
Subject: [PATCH 034/167] fix(mobile): Android follow-up menu shows in full
 with the keyboard open (#29263)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/mobile/src/components/ui/AndroidAnchoredMenu.tsx | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/apps/mobile/src/components/ui/AndroidAnchoredMenu.tsx b/apps/mobile/src/components/ui/AndroidAnchoredMenu.tsx
index a1f6a02cc32eb..369fcf19ef55a 100644
--- a/apps/mobile/src/components/ui/AndroidAnchoredMenu.tsx
+++ b/apps/mobile/src/components/ui/AndroidAnchoredMenu.tsx
@@ -4,7 +4,6 @@ import { use, useRef, useState } from "react";
 import type { StyleProp, ViewInstance, ViewStyle } from "react-native";
 import { Pressable, ScrollView, View } from "react-native";
 import { useKeyboardState } from "react-native-keyboard-controller";
-import Animated, { FadeIn } from "react-native-reanimated";
 
 import { useHardwareBack } from "../../lib/backHandler";
 import { deriveMenuHorizontalPlacement } from "../../lib/menu-placement";
@@ -181,8 +180,8 @@ export function AndroidAnchoredMenu(props: AndroidAnchoredMenuProps) {
                 onClose={close}
               />
             ) : (
-              <Animated.View
-                entering={FadeIn.duration(120)}
+              <View
+                // No entering animation: it freezes this frame before the Compose host reports its size.
                 className="absolute overflow-hidden bg-card-alt shadow-md"
                 style={{
                   left,
@@ -215,7 +214,7 @@ export function AndroidAnchoredMenu(props: AndroidAnchoredMenuProps) {
                     onClose={close}
                   />
                 </ScrollView>
-              </Animated.View>
+              </View>
             )}
           </View>
         </OverlayPortal>

From 7239986680d1f0af0e711a68293e3a4a17c8064b Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 11:59:28 -0800
Subject: [PATCH 035/167] fix(web): deleting the open thread no longer opens a
 snoozed or settled thread (#29643)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/Sidebar.logic.test.ts | 35 +++++++++++++++++++
 apps/web/src/components/Sidebar.logic.ts      | 11 ++++--
 apps/web/src/hooks/useThreadActions.ts        |  1 +
 3 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/components/Sidebar.logic.test.ts b/apps/web/src/components/Sidebar.logic.test.ts
index 669c805492bcc..3e2e8be2ce18d 100644
--- a/apps/web/src/components/Sidebar.logic.test.ts
+++ b/apps/web/src/components/Sidebar.logic.test.ts
@@ -624,10 +624,45 @@ describe("getFallbackThreadIdAfterDelete", () => {
       deletedThreadId: ThreadId.make("thread-active"),
       deletedThreadIds: new Set([ThreadId.make("thread-active"), ThreadId.make("thread-newest")]),
       sortOrder: "created_at",
+      now: "2026-03-09T10:10:00.000Z",
     });
 
     expect(fallbackThreadId).toBe(ThreadId.make("thread-next"));
   });
+
+  it.each([
+    [
+      "snoozed",
+      { snoozedUntil: "2099-01-01T00:00:00.000Z", snoozedAt: "2026-03-09T10:06:00.000Z" },
+    ],
+    ["settled", { settledOverride: "settled", settledAt: "2026-03-09T10:06:00.000Z" }],
+  ] as const)("skips a %s thread parked on its shelf", (_state, parked) => {
+    const fallbackThreadId = getFallbackThreadIdAfterDelete({
+      threads: [
+        makeThread({
+          id: ThreadId.make("thread-visible"),
+          createdAt: "2026-03-09T10:01:00.000Z",
+          updatedAt: "2026-03-09T10:01:00.000Z",
+        }),
+        makeThread({
+          id: ThreadId.make("thread-parked"),
+          createdAt: "2026-03-09T10:02:00.000Z",
+          updatedAt: "2026-03-09T10:06:00.000Z",
+          ...parked,
+        }),
+        makeThread({
+          id: ThreadId.make("thread-active"),
+          createdAt: "2026-03-09T10:03:00.000Z",
+          updatedAt: "2026-03-09T10:03:00.000Z",
+        }),
+      ],
+      deletedThreadId: ThreadId.make("thread-active"),
+      sortOrder: "created_at",
+      now: "2026-03-09T10:10:00.000Z",
+    });
+
+    expect(fallbackThreadId).toBe(ThreadId.make("thread-visible"));
+  });
 });
 
 describe("sortScopedProjectsForSidebar", () => {
diff --git a/apps/web/src/components/Sidebar.logic.ts b/apps/web/src/components/Sidebar.logic.ts
index 55cf694c2b79e..c20789e2a9160 100644
--- a/apps/web/src/components/Sidebar.logic.ts
+++ b/apps/web/src/components/Sidebar.logic.ts
@@ -1211,14 +1211,17 @@ export function resolveThreadStatusPill(input: {
 }
 
 export function getFallbackThreadIdAfterDelete<
-  T extends Pick<Thread, "id" | "projectId" | "createdAt" | "updatedAt"> & ThreadSortInput,
+  T extends Pick<Thread, "id" | "projectId" | "createdAt" | "updatedAt" | "settledOverride"> &
+    ThreadSortInput &
+    ThreadSnoozeShell,
 >(input: {
   threads: readonly T[];
   deletedThreadId: T["id"];
   sortOrder: SidebarThreadSortOrder;
+  now: string;
   deletedThreadIds?: ReadonlySet<T["id"]>;
 }): T["id"] | null {
-  const { deletedThreadId, deletedThreadIds, sortOrder, threads } = input;
+  const { deletedThreadId, deletedThreadIds, sortOrder, now, threads } = input;
   const deletedThread = threads.find((thread) => thread.id === deletedThreadId);
   if (!deletedThread) {
     return null;
@@ -1230,7 +1233,9 @@ export function getFallbackThreadIdAfterDelete<
         (thread) =>
           thread.projectId === deletedThread.projectId &&
           thread.id !== deletedThreadId &&
-          !deletedThreadIds?.has(thread.id),
+          !deletedThreadIds?.has(thread.id) &&
+          thread.settledOverride !== "settled" &&
+          !effectiveSnoozed(thread, { now }),
       ),
       sortOrder,
     )[0]?.id ?? null
diff --git a/apps/web/src/hooks/useThreadActions.ts b/apps/web/src/hooks/useThreadActions.ts
index e5eedffc16698..904b94ebfc5c5 100644
--- a/apps/web/src/hooks/useThreadActions.ts
+++ b/apps/web/src/hooks/useThreadActions.ts
@@ -554,6 +554,7 @@ export function useThreadActions() {
       deletedThreadId: threadRef.threadId,
       deletedThreadIds,
       sortOrder: sidebarThreadSortOrder,
+      now: new Date().toISOString(),
     });
     const deleteResult = await deleteThreadMutation({
       environmentId: threadRef.environmentId,

From 31eb1d00765672969b0dc1b27caef78a0c4b2e36 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:00:15 -0800
Subject: [PATCH 036/167] fix(web): closing Settings or Usage no longer jumps
 back to a quote's source (#29013)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../sidebar/mainAppLocation.browser.test.tsx  | 77 +++++++++++++++++++
 .../src/components/sidebar/mainAppLocation.ts |  4 +-
 .../src/lib/assistantCitationNavigation.ts    |  7 ++
 3 files changed, 87 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/components/sidebar/mainAppLocation.browser.test.tsx

diff --git a/apps/web/src/components/sidebar/mainAppLocation.browser.test.tsx b/apps/web/src/components/sidebar/mainAppLocation.browser.test.tsx
new file mode 100644
index 0000000000000..dbcae07fca81c
--- /dev/null
+++ b/apps/web/src/components/sidebar/mainAppLocation.browser.test.tsx
@@ -0,0 +1,77 @@
+import { EnvironmentId, MessageId, ThreadId, type AssistantCitation } from "@t3tools/contracts";
+import type { AnyRouter } from "@tanstack/react-router";
+import { describe, expect, it, vi } from "vite-plus/test";
+import { userEvent } from "vite-plus/test/browser";
+
+import { render } from "../../../test/render";
+import {
+  assistantCitationFromLocation,
+  assistantCitationNavigation,
+} from "../../lib/assistantCitationNavigation";
+import {
+  startMainAppLocationTracking,
+  useCloseAppModal,
+  useNavigateToMainApp,
+} from "./mainAppLocation";
+
+const THREAD_PATH = "/environment-one/thread-one";
+
+const citation: AssistantCitation = {
+  version: 1,
+  environmentId: EnvironmentId.make("environment-one"),
+  threadId: ThreadId.make("thread-one"),
+  messageId: MessageId.make("assistant-one"),
+  text: "quoted reply",
+  start: 0,
+  end: 12,
+  prefix: "",
+  suffix: "",
+};
+
+function ReturnControls() {
+  const closeAppModal = useCloseAppModal();
+  const navigateToMainApp = useNavigateToMainApp();
+  return (
+    <>
+      <button type="button" onClick={() => void closeAppModal()}>
+        Close modal
+      </button>
+      <button type="button" onClick={() => void navigateToMainApp()}>
+        Back to app
+      </button>
+    </>
+  );
+}
+
+// The tracker records on onResolved, which the router emits only once React commits the page.
+async function settled(router: AnyRouter, navigation: Promise<void>) {
+  await navigation;
+  await vi.waitFor(() =>
+    expect(router.state.resolvedLocation?.href).toBe(router.state.location.href),
+  );
+}
+
+describe("main app return location", () => {
+  it("returns to the thread without re-opening the quote source it was opened at", async () => {
+    await using screen = await render(<ReturnControls />, { router: THREAD_PATH });
+    const router = screen.router!;
+    using _tracking = { [Symbol.dispose]: startMainAppLocationTracking(router) };
+
+    const returnLocation = async (from: string, control: string) => {
+      await settled(router, router.navigate(assistantCitationNavigation(citation)));
+      expect(assistantCitationFromLocation(router.state.location.href)).toEqual(citation);
+      await settled(router, router.navigate({ href: from }));
+      await userEvent.click(screen.getByRole("button", { name: control }));
+      await vi.waitFor(() => expect(router.state.location.pathname).toBe(THREAD_PATH));
+      return router.state.location.href;
+    };
+
+    const closingUsage = await returnLocation("/usage", "Close modal");
+    const sidebarBack = await returnLocation("/pull-requests", "Back to app");
+
+    expect({ closingUsage, sidebarBack }).toEqual({
+      closingUsage: THREAD_PATH,
+      sidebarBack: THREAD_PATH,
+    });
+  });
+});
diff --git a/apps/web/src/components/sidebar/mainAppLocation.ts b/apps/web/src/components/sidebar/mainAppLocation.ts
index a732d9f435bfc..8e4267af73890 100644
--- a/apps/web/src/components/sidebar/mainAppLocation.ts
+++ b/apps/web/src/components/sidebar/mainAppLocation.ts
@@ -1,6 +1,7 @@
 import { useNavigate, type AnyRouter } from "@tanstack/react-router";
 
 import { GUEST_PAGE_PATH } from "../../guestPage";
+import { withoutAssistantCitationHash } from "../../lib/assistantCitationNavigation";
 
 /** Settings and Usage open as modals over the last main-app view. */
 export function isAppModalPage(pathname: string) {
@@ -22,8 +23,9 @@ let appModalReturnHref: string | null = null;
 /** Remembers where Settings, Usage, and the utility pages lead back to. */
 export function startMainAppLocationTracking(router: AnyRouter): () => void {
   const record = () => {
-    const { pathname, href } = router.state.location;
+    const { pathname } = router.state.location;
     if (isAppModalPage(pathname) || SHELL_LESS_PATHS.has(pathname)) return;
+    const href = withoutAssistantCitationHash(router.state.location.href);
     appModalReturnHref = href;
     if (!isSidebarUtilityPage(pathname)) mainAppHref = href;
   };
diff --git a/apps/web/src/lib/assistantCitationNavigation.ts b/apps/web/src/lib/assistantCitationNavigation.ts
index 1320b73aa33c5..3300d086d08c1 100644
--- a/apps/web/src/lib/assistantCitationNavigation.ts
+++ b/apps/web/src/lib/assistantCitationNavigation.ts
@@ -39,6 +39,13 @@ export function assistantCitationFromLocation(href: string) {
   }
 }
 
+/** Return paths drop the quote hash so going back does not reveal its source again. */
+export function withoutAssistantCitationHash(href: string) {
+  const hashIndex = href.indexOf("#");
+  if (hashIndex === -1 || !href.startsWith(CITATION_HASH_PREFIX, hashIndex + 1)) return href;
+  return href.slice(0, hashIndex);
+}
+
 /** A fresh activation lets the same link reveal its source again after dismissal. */
 export function assistantCitationNavigation(citation: AssistantCitation) {
   return {

From 3040f91bb5cd320298712b337fa1415079259967 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:00:39 -0800
Subject: [PATCH 037/167] fix(server): squash-merged branches no longer offer
 push & create PR (#28494)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/git/GitManager.test.ts | 238 +++++++++++++++++++++++++
 apps/server/src/git/GitManager.ts      |  54 ++++--
 2 files changed, 279 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/git/GitManager.test.ts b/apps/server/src/git/GitManager.test.ts
index fec3b01238334..b8c253bbd0c1d 100644
--- a/apps/server/src/git/GitManager.test.ts
+++ b/apps/server/src/git/GitManager.test.ts
@@ -1848,6 +1848,244 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
     }),
   );
 
+  function squashMergeIntoRemoteMain(repoDir: string, branch: string) {
+    return Effect.gen(function* () {
+      yield* runGit(repoDir, ["push", "-u", "origin", "main"]);
+      yield* runGit(repoDir, ["checkout", "-b", branch]);
+      NodeFS.writeFileSync(NodePath.join(repoDir, "squash.txt"), "one\ntwo\n");
+      yield* runGit(repoDir, ["add", "squash.txt"]);
+      yield* runGit(repoDir, ["commit", "-m", "Feature work"]);
+      yield* runGit(repoDir, ["push", "-u", "origin", branch]);
+      // The host squash-merges: a new commit on main with the branch's tree, not the branch's commit.
+      const squash = yield* runGit(repoDir, [
+        "commit-tree",
+        "HEAD^{tree}",
+        "-p",
+        "origin/main",
+        "-m",
+        "Feature work (#217)",
+      ]);
+      yield* runGit(repoDir, ["push", "origin", `${squash.stdout.trim()}:refs/heads/main`]);
+      return (yield* runGit(repoDir, ["rev-parse", "HEAD"])).stdout.trim();
+    });
+  }
+
+  const squashMergedPr = (branch: string, headSha: string): FakeChangeRequest => ({
+    number: 217,
+    title: "Feature work",
+    url: "https://github.com/pingdotgg/t3code/pull/217",
+    baseRefName: "main",
+    headRefName: branch,
+    headSha,
+    state: "merged",
+    mergedAt: "2026-04-02T15:00:00Z",
+    updatedAt: "2026-04-02T15:00:00Z",
+  });
+
+  it.effect("status reports nothing to ship after a squash merge deleted the remote branch", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/squash-deleted";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      yield* runGit(repoDir, ["push", "origin", "--delete", branch]);
+      yield* runGit(repoDir, ["fetch", "--prune", "origin"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: { prListSequence: [[squashMergedPr(branch, headSha)]] },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect(status.hasUpstream).toBe(false);
+      expect({
+        aheadCount: status.aheadCount,
+        aheadOfDefaultCount: status.aheadOfDefaultCount,
+      }).toEqual({ aheadCount: 0, aheadOfDefaultCount: 0 });
+    }),
+  );
+
+  it.effect("status reports nothing to ship after a squash merge kept the remote branch", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/squash-kept";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      yield* runGit(repoDir, ["fetch", "--prune", "origin"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: { prListSequence: [[squashMergedPr(branch, headSha)]] },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect(status.hasUpstream).toBe(true);
+      expect({
+        aheadCount: status.aheadCount,
+        aheadOfDefaultCount: status.aheadOfDefaultCount,
+      }).toEqual({ aheadCount: 0, aheadOfDefaultCount: 0 });
+    }),
+  );
+
+  it.effect("status still reports work to ship for a commit added after a squash merge", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/squash-follow-up";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      NodeFS.writeFileSync(NodePath.join(repoDir, "follow-up.txt"), "after merge\n");
+      yield* runGit(repoDir, ["add", "follow-up.txt"]);
+      yield* runGit(repoDir, ["commit", "-m", "Follow-up work"]);
+      yield* runGit(repoDir, ["fetch", "--prune", "origin"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: { prListSequence: [[squashMergedPr(branch, headSha)]] },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect(status.aheadCount).toBe(1);
+      expect(status.aheadOfDefaultCount).toBe(2);
+    }),
+  );
+
+  it.effect("status still reports work against main after a merge into another base", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const initialSha = (yield* runGit(repoDir, ["rev-parse", "HEAD"])).stdout.trim();
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/release-only";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      // Move the merge to release and leave main without it.
+      const squashSha = (yield* runGit(repoDir, ["rev-parse", "origin/main"])).stdout.trim();
+      yield* runGit(repoDir, ["push", "origin", `${squashSha}:refs/heads/release`]);
+      yield* runGit(repoDir, ["push", "--force", "origin", `${initialSha}:refs/heads/main`]);
+      yield* runGit(repoDir, ["fetch", "origin"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: {
+          prListSequence: [[{ ...squashMergedPr(branch, headSha), baseRefName: "release" }]],
+        },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect(status.aheadOfDefaultCount).toBe(1);
+    }),
+  );
+
+  it.effect("status keeps a squash-merged branch shipped when a later PR lookup fails", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/squash-lookup-fails";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      yield* runGit(repoDir, ["push", "origin", "--delete", branch]);
+      yield* runGit(repoDir, ["fetch", "--prune", "origin"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: {
+          prListSequence: [[squashMergedPr(branch, headSha)]],
+          failWith: "Rate limited",
+          failAfterCalls: 1,
+        },
+      });
+
+      const first = yield* manager.status({ cwd: repoDir });
+      yield* manager.invalidateStatus(repoDir);
+      const second = yield* manager.status({ cwd: repoDir });
+
+      expect(first.aheadOfDefaultCount).toBe(0);
+      expect(second.pr?.state).toBe("merged");
+      expect({
+        aheadCount: second.aheadCount,
+        aheadOfDefaultCount: second.aheadOfDefaultCount,
+      }).toEqual({ aheadCount: 0, aheadOfDefaultCount: 0 });
+    }),
+  );
+
+  it.effect("status keeps real divergence for a squash-merged branch that tracks its base", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
+      const branch = "feature/squash-tracks-main";
+      const headSha = yield* squashMergeIntoRemoteMain(repoDir, branch);
+      yield* runGit(repoDir, ["fetch", "origin"]);
+      yield* runGit(repoDir, ["branch", "--set-upstream-to", "origin/main"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: { prListSequence: [[squashMergedPr(branch, headSha)]] },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect({ aheadCount: status.aheadCount, behindCount: status.behindCount }).toEqual({
+        aheadCount: 1,
+        behindCount: 1,
+      });
+    }),
+  );
+
+  it.effect("status reports nothing to ship after a squash merge into a non-origin default", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      yield* runGit(repoDir, ["branch", "-m", "develop"]);
+      const remoteDir = yield* createBareRemote();
+      yield* runGit(repoDir, ["remote", "add", "upstream", remoteDir]);
+      yield* runGit(repoDir, ["push", "-u", "upstream", "develop"]);
+      yield* runGit(repoDir, ["remote", "set-head", "upstream", "develop"]);
+      const branch = "feature/squash-develop";
+      yield* runGit(repoDir, ["checkout", "-b", branch]);
+      NodeFS.writeFileSync(NodePath.join(repoDir, "squash.txt"), "one\ntwo\n");
+      yield* runGit(repoDir, ["add", "squash.txt"]);
+      yield* runGit(repoDir, ["commit", "-m", "Feature work"]);
+      yield* runGit(repoDir, ["push", "-u", "upstream", branch]);
+      const headSha = (yield* runGit(repoDir, ["rev-parse", "HEAD"])).stdout.trim();
+      const squash = yield* runGit(repoDir, [
+        "commit-tree",
+        "HEAD^{tree}",
+        "-p",
+        "upstream/develop",
+        "-m",
+        "Feature work (#217)",
+      ]);
+      yield* runGit(repoDir, ["push", "upstream", `${squash.stdout.trim()}:refs/heads/develop`]);
+      yield* runGit(repoDir, ["fetch", "upstream"]);
+
+      const { manager } = yield* makeManager({
+        providerScenario: {
+          prListSequence: [[{ ...squashMergedPr(branch, headSha), baseRefName: "develop" }]],
+        },
+      });
+
+      const status = yield* manager.status({ cwd: repoDir });
+
+      expect(status.pr?.state).toBe("merged");
+      expect({
+        aheadCount: status.aheadCount,
+        aheadOfDefaultCount: status.aheadOfDefaultCount,
+      }).toEqual({ aheadCount: 0, aheadOfDefaultCount: 0 });
+    }),
+  );
+
   it.each([
     [
       "https://github.example.com/team/repository/pull/42?tab=files",
diff --git a/apps/server/src/git/GitManager.ts b/apps/server/src/git/GitManager.ts
index feb896b387aeb..7ec4b4effbdaa 100644
--- a/apps/server/src/git/GitManager.ts
+++ b/apps/server/src/git/GitManager.ts
@@ -1259,6 +1259,7 @@ export const make = Effect.gen(function* () {
   const getPrLookup = (key: string) => detachStackFrame(Cache.get(prLookupCache, key));
   interface LastKnownPr {
     readonly pr: ReturnType<typeof toStatusPr> | null;
+    readonly headSha: string | null;
     readonly upstreamRef: string | null;
     readonly headBranch: string;
     readonly remoteName: string | null;
@@ -1280,7 +1281,7 @@ export const make = Effect.gen(function* () {
   const resolveLastKnownPr = (
     branchKey: string,
     current: Pick<LastKnownPr, "upstreamRef" | "headBranch" | "remoteName" | "headRemoteUrlKey">,
-  ): ReturnType<typeof toStatusPr> | null => {
+  ): LastKnownPr | null => {
     const lastKnown = lastKnownPrByBranchKey.get(branchKey);
     if (!lastKnown) return null;
     if (lastKnown.headBranch !== current.headBranch) {
@@ -1289,7 +1290,7 @@ export const make = Effect.gen(function* () {
 
     // Config read failures become null; require both remote URLs before treating a mismatch as real.
     if (lastKnown.headRemoteUrlKey !== null && current.headRemoteUrlKey !== null) {
-      return lastKnown.headRemoteUrlKey === current.headRemoteUrlKey ? lastKnown.pr : null;
+      return lastKnown.headRemoteUrlKey === current.headRemoteUrlKey ? lastKnown : null;
     }
 
     if (
@@ -1298,9 +1299,9 @@ export const make = Effect.gen(function* () {
       lastKnown.remoteName !== null &&
       current.remoteName !== null
     ) {
-      return lastKnown.remoteName === current.remoteName ? lastKnown.pr : null;
+      return lastKnown.remoteName === current.remoteName ? lastKnown : null;
     }
-    return lastKnown.pr;
+    return lastKnown;
   };
   const lookupStatusPr = Effect.fn("lookupStatusPr")(function* (
     cwd: string,
@@ -1325,17 +1326,18 @@ export const make = Effect.gen(function* () {
     }
     return yield* getPrLookup(cacheKey).pipe(
       Effect.map(({ latest, headContext }) => {
-        if (!latest) return { pr: null, headContext };
+        if (!latest) return { pr: null, headSha: null, headContext };
         // Merged/closed matches are usually reverse-merge history, not the thread's PR context.
         if (details.isDefaultBranch && latest.state !== "open") {
-          return { pr: null, headContext };
+          return { pr: null, headSha: null, headContext };
         }
-        return { pr: toStatusPr(latest), headContext };
+        return { pr: toStatusPr(latest), headSha: latest.headSha ?? null, headContext };
       }),
-      Effect.tap(({ pr, headContext }) =>
+      Effect.tap(({ pr, headSha, headContext }) =>
         Effect.sync(() =>
           rememberLastKnownPr(branchKey, {
             pr,
+            headSha,
             upstreamRef: details.upstreamRef,
             headBranch: headContext.headBranch,
             remoteName: headContext.remoteName,
@@ -1343,7 +1345,7 @@ export const make = Effect.gen(function* () {
           }),
         ),
       ),
-      Effect.map(({ pr }) => pr),
+      Effect.map(({ pr, headSha }) => ({ pr, headSha })),
       Effect.catch((error) => {
         const fallback = lastKnownPrByBranchKey.get(branchKey)?.pr
           ? resolveLookupHeadContext(cwd, details).pipe(
@@ -1375,6 +1377,10 @@ export const make = Effect.gen(function* () {
               : {}),
           }),
           Effect.andThen(fallback),
+          Effect.map((lastKnown) => ({
+            pr: lastKnown?.pr ?? null,
+            headSha: lastKnown?.headSha ?? null,
+          })),
         );
       }),
     );
@@ -1390,7 +1396,7 @@ export const make = Effect.gen(function* () {
       return null;
     }
 
-    const pr =
+    const { pr, headSha } =
       details.branch !== null
         ? yield* lookupStatusPr(
             cwd,
@@ -1402,13 +1408,35 @@ export const make = Effect.gen(function* () {
             },
             options?.refreshMissingPullRequest,
           )
-        : null;
+        : { pr: null, headSha: null };
+    // Squash and rebase merges land new commits, so HEAD never becomes reachable from the base.
+    const shippedByMergedPr =
+      pr?.state === "merged" &&
+      headSha !== null &&
+      (yield* Effect.gen(function* () {
+        const defaultBranch =
+          details.defaultBranch ??
+          (yield* gitCore.resolvePrimaryRemoteName(cwd).pipe(
+            Effect.flatMap((remoteName) => gitCore.resolveDefaultBranchName(cwd, remoteName)),
+            Effect.orElseSucceed(() => null),
+          ));
+        const mergedIntoDefault =
+          defaultBranch === null
+            ? pr.baseRef === "main" || pr.baseRef === "master"
+            : pr.baseRef === defaultBranch;
+        if (!mergedIntoDefault) return false;
+        return yield* gitCore.resolveCommit({ cwd, revision: "HEAD" }).pipe(
+          Effect.map(({ commitSha }) => commitSha === headSha),
+          Effect.orElseSucceed(() => false),
+        );
+      }));
 
     return {
       hasUpstream: details.hasUpstream,
-      aheadCount: details.aheadCount,
+      // A real upstream delta stays; only the no-upstream fallback counts against the base.
+      aheadCount: shippedByMergedPr && !details.hasUpstream ? 0 : details.aheadCount,
       behindCount: details.behindCount,
-      aheadOfDefaultCount: details.aheadOfDefaultCount,
+      aheadOfDefaultCount: shippedByMergedPr ? 0 : details.aheadOfDefaultCount,
       pr,
     } satisfies VcsStatusRemoteResult;
   });

From cf90825f876ceb26058d6433d9d9008d773c5510 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:01:08 -0800
Subject: [PATCH 038/167] fix(mobile): settings providers show the ACP registry
 icon (#28135)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../settings/SettingsEnvironmentDetailRouteScreen.tsx       | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
index 21edb7f9edc6c..13c9619768f4e 100644
--- a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
@@ -333,7 +333,11 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
                       <View key={provider.instanceId}>
                         <View className="gap-1 p-4">
                           <View className="flex-row items-center gap-2">
-                            <ProviderIcon provider={provider.driver} size={18} />
+                            <ProviderIcon
+                              provider={provider.driver}
+                              iconUrl={provider.iconUrl}
+                              size={18}
+                            />
                             <Text className="min-w-0 flex-1 text-base font-t3-medium text-foreground">
                               {provider.displayName ?? provider.driver}
                             </Text>

From 7b666f3780f6ed28a02d29e0176a90a9a6dbe3b8 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:01:21 -0800
Subject: [PATCH 039/167] fix(server): Grok usage limits tell Legacy-mode xAI
 accounts to switch to Privacy Mode (#28097)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/provider/GrokProvider.test.ts | 30 +++++++++++++++++++
 .../provider-grok/src/server/usageLimits.ts   | 12 ++++++++
 2 files changed, 42 insertions(+)

diff --git a/apps/server/src/provider/GrokProvider.test.ts b/apps/server/src/provider/GrokProvider.test.ts
index 9cc1a9a7e3238..9be799112cc23 100644
--- a/apps/server/src/provider/GrokProvider.test.ts
+++ b/apps/server/src/provider/GrokProvider.test.ts
@@ -722,6 +722,36 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("readGrokAccount"
       }
     }),
   );
+
+  it.effect("tells accounts in Legacy (no storage) to switch to Privacy Mode", () =>
+    Effect.gen(function* () {
+      const { usageLimits: limits } = yield* readGrokAccount({
+        HOME: "/definitely/not/a/grok-home",
+        GROK_AUTH: '{"https://accounts.x.ai/sign-in":{"key":"private-token"}}',
+      }).pipe(
+        Effect.provideService(
+          HttpClient.HttpClient,
+          HttpClient.make((request) =>
+            Effect.succeed(
+              HttpClientResponse.fromWeb(
+                request,
+                Response.json(
+                  {
+                    error:
+                      "Grok Build is not supported in Legacy (no storage). Switch to Privacy Mode to use Grok Build. [WKE=privacy-mode:legacy]",
+                  },
+                  { status: 403 },
+                ),
+              ),
+            ),
+          ),
+        ),
+      );
+      expect(limits.unavailable?.reason).toBe("probeFailed");
+      expect(limits.unavailable?.message).toMatch(/Privacy Mode/);
+      expect(limits.unavailable?.message).not.toMatch(/WKE=|Grok Build is not supported/);
+    }),
+  );
 });
 
 it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("readGrokAccount email", (it) => {
diff --git a/packages/provider-grok/src/server/usageLimits.ts b/packages/provider-grok/src/server/usageLimits.ts
index 8036df0dd3e99..c6ba583c139ce 100644
--- a/packages/provider-grok/src/server/usageLimits.ts
+++ b/packages/provider-grok/src/server/usageLimits.ts
@@ -38,6 +38,7 @@ const GrokUsageResponse = Schema.Struct({
     }),
   ),
 });
+const GrokErrorResponse = Schema.Struct({ error: Schema.String });
 
 function parsePeriodBoundary(value: string | undefined) {
   if (
@@ -182,6 +183,17 @@ export const readGrokAccount = Effect.fn("readGrokAccount")(function* (
         HttpClientRequest.bearerToken(token),
       ),
     );
+    if (response.status === 403) {
+      const { error } = yield* HttpClientResponse.schemaBodyJson(GrokErrorResponse)(response);
+      // xAI refuses Grok Build while the account's privacy setting is a legacy mode.
+      if (error.includes("WKE=privacy-mode:")) {
+        return makeUnavailableUsageLimits({
+          checkedAt,
+          reason: "probeFailed",
+          message: "Switch your xAI account to Privacy Mode to show Grok usage limits.",
+        });
+      }
+    }
     const body = yield* HttpClientResponse.schemaBodyJson(GrokUsageResponse)(
       yield* HttpClientResponse.filterStatusOk(response),
     );

From 58cf69c835bc8346974e67ca53eb80f3dd49ecad Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:01:59 -0800
Subject: [PATCH 040/167] fix(usage): label a proxied Claude account by its
 e-mail, and drop .json from hub rows (#28065)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/shared/src/usageLimits.test.ts | 73 +++++++++++++++++++++++++
 packages/shared/src/usageLimits.ts      | 18 +++++-
 2 files changed, 88 insertions(+), 3 deletions(-)

diff --git a/packages/shared/src/usageLimits.test.ts b/packages/shared/src/usageLimits.test.ts
index 23447ae7930b0..72a17323386c8 100644
--- a/packages/shared/src/usageLimits.test.ts
+++ b/packages/shared/src/usageLimits.test.ts
@@ -672,6 +672,57 @@ describe("pools", () => {
     expect(accounts[0]?.displayName).toBe("claude-team-seat");
   });
 
+  it("labels a default-named instance merged with a hub account by e-mail, keeping a chosen name", () => {
+    const native = provider({
+      driver: claude,
+      instanceId: ProviderInstanceId.make("claudeAgent"),
+      displayName: "Claude",
+      auth: { status: "authenticated", email: "a@example.com" },
+      usageLimits: { checkedAt, windows: [window] },
+    });
+    const named = provider({
+      driver: claude,
+      instanceId: ProviderInstanceId.make("claude-work"),
+      displayName: "Work",
+      auth: { status: "authenticated", email: "b@example.com" },
+      usageLimits: { checkedAt, windows: [window] },
+    });
+    const hubAccount = (email: string) => ({
+      id: `claude-${email}.json`,
+      driver: claude,
+      email,
+      usageLimits: { checkedAt, windows: [window] },
+    });
+    const input = new Map([
+      [
+        EnvironmentId.make("env-a"),
+        {
+          ...laptop,
+          serverConfig: {
+            providers: [native, named],
+            usageLimitSources: [
+              {
+                ...source,
+                accounts: [
+                  hubAccount("a@example.com"),
+                  hubAccount("b@example.com"),
+                  hubAccount("c@example.com"),
+                ],
+              },
+            ],
+          },
+        },
+      ],
+    ]);
+    expect(
+      collectLimitAccounts(input).map(({ displayName, email }) => ({ displayName, email })),
+    ).toEqual([
+      { displayName: null, email: "a@example.com" },
+      { displayName: "Work", email: "b@example.com" },
+      { displayName: null, email: "c@example.com" },
+    ]);
+  });
+
   it("pools Codex windows by kind, whichever slot reported them", () => {
     const codexAccount = (id: string, slots: readonly string[]) => ({
       id,
@@ -1138,6 +1189,28 @@ describe("/usage-limits", () => {
     expect(report?.accounts[0]?.limits.resetCredits?.availableCount).toBe(3);
   });
 
+  it("labels hub rows by account id without .json", () => {
+    const hub = [
+      {
+        ...sources[0]!,
+        label: "CLIProxyAPI",
+        accounts: [
+          {
+            id: "claude-b@example.com.json",
+            driver: selected.driver,
+            email: "b@example.com",
+            usageLimits: limits,
+          },
+          { id: "team-seat.json", driver: selected.driver, usageLimits: limits },
+        ],
+      },
+    ];
+    const report = collectProviderUsageLimits(selected.instanceId, [selected], hub, now);
+    expect(
+      report?.accounts.filter((account) => account.sourceLabel).map((account) => account.label),
+    ).toEqual(["CLIProxyAPI · claude-b@example.com", "CLIProxyAPI · team-seat"]);
+  });
+
   it("keeps unidentified custom instances separate, filtering by driver", () => {
     const report = collectProviderUsageLimits(
       selected.instanceId,
diff --git a/packages/shared/src/usageLimits.ts b/packages/shared/src/usageLimits.ts
index bf7dfea4e04bf..869f676acae69 100644
--- a/packages/shared/src/usageLimits.ts
+++ b/packages/shared/src/usageLimits.ts
@@ -9,6 +9,7 @@ import {
   type ProviderConsumeResetCreditInput,
   type ServerProviderSlashCommand,
   isProviderAvailable,
+  PROVIDER_DISPLAY_NAMES,
   type ServerProvider,
   type ServerProviderUsageLimits,
   type ServerProviderUsageWindow,
@@ -232,6 +233,8 @@ function accountKeyResolver(reports: Iterable<AccountReport>) {
   };
 }
 
+const hubAccountName = (account: { readonly id: string }) => account.id.replace(/\.json$/i, "");
+
 export interface LimitAccount {
   readonly key: string;
   readonly driver: ServerProvider["driver"];
@@ -297,9 +300,18 @@ export function collectLimitAccounts(presentations: LimitPresentations): readonl
     ];
     const winner = fresher ? next : previous;
     const creditSource = creditSources.get(key);
+    // A hub e-mail names the account better than the driver's default instance name.
+    const hubEmail = [previous, next].some(
+      (account) => account.environments.length === 0 && account.email,
+    );
+    const displayName = previous.displayName ?? next.displayName;
     accounts.set(key, {
       ...previous,
-      displayName: previous.displayName ?? next.displayName,
+      displayName:
+        hubEmail &&
+        displayName?.toLowerCase() === PROVIDER_DISPLAY_NAMES[previous.driver]?.toLowerCase()
+          ? null
+          : displayName,
       plan: planSources.get(key)?.plan ?? previous.plan ?? next.plan,
       accentColor: previous.accentColor ?? next.accentColor,
       environments,
@@ -353,7 +365,7 @@ export function collectLimitAccounts(presentations: LimitPresentations): readonl
         merge(resolveKey(account) ?? key, {
           key,
           driver: account.driver,
-          displayName: account.email ? null : account.id.replace(/\.json$/i, ""),
+          displayName: account.email ? null : hubAccountName(account),
           email: account.email,
           plan: account.plan,
           accentColor: undefined,
@@ -843,7 +855,7 @@ export function collectProviderUsageLimits(
       accounts.push({
         id: `${source.id}:${account.id}`,
         driver: account.driver,
-        label: `${source.label} · ${account.id}`,
+        label: `${source.label} · ${hubAccountName(account)}`,
         sourceLabel: "CLI Proxy",
         ...(account.usageLimits.resetCredits?.nextCreditId
           ? {

From 9def583f8e315f644708501ebcf1f3d4bb320444 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:02:28 -0800
Subject: [PATCH 041/167] fix(gitlab): a signed-out default glab host no longer
 hides other signed-in hosts (#27840)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/server/discovery.ts                   | 51 +++++++----
 .../src/server/GitLabSourceControlProvider.ts |  4 +
 .../src/server/gitLabDiscovery.test.ts        | 88 ++++++++++++++++++-
 3 files changed, 125 insertions(+), 18 deletions(-)

diff --git a/packages/source-control-core/src/server/discovery.ts b/packages/source-control-core/src/server/discovery.ts
index 9a89011717515..d5e58c2282b1c 100644
--- a/packages/source-control-core/src/server/discovery.ts
+++ b/packages/source-control-core/src/server/discovery.ts
@@ -41,6 +41,8 @@ export type SourceControlCliDiscoverySpec = SourceControlDiscoverySpecBase & {
   readonly executable: string;
   readonly versionArgs: ReadonlyArray<string>;
   readonly authArgs: ReadonlyArray<string>;
+  /** Asked once when `authArgs` reports signed out; its answer counts only when it finds a sign-in. */
+  readonly authRetryArgs?: ReadonlyArray<string>;
   readonly remoteRefinementArgs?: (
     context: SourceControlProvider.SourceControlProviderContext,
   ) => ReadonlyArray<string>;
@@ -269,6 +271,37 @@ export function probeSourceControlProvider(input: {
   }
 
   const spec = input.spec;
+  const runAuth = (args: ReadonlyArray<string>) =>
+    input.process
+      .run({
+        operation: "source-control.discovery.auth",
+        command: spec.executable,
+        args,
+        cwd: input.cwd,
+        allowNonZeroExit: true,
+        timeoutMs: probeTimeoutMs(spec),
+        maxOutputBytes: 8_000,
+        appendTruncationMarker: true,
+      })
+      .pipe(
+        Effect.map(spec.parseAuth),
+        Effect.catch((cause) =>
+          Effect.succeed(unknownAuth(Option.getOrUndefined(detailFromCause(cause)))),
+        ),
+      );
+  const retryArgs = spec.authRetryArgs;
+  const auth =
+    retryArgs === undefined
+      ? runAuth(spec.authArgs)
+      : runAuth(spec.authArgs).pipe(
+          Effect.filterOrElse(
+            (result) => result.status !== "unauthenticated",
+            (signedOut) =>
+              runAuth(retryArgs).pipe(
+                Effect.map((retry) => (retry.status === "authenticated" ? retry : signedOut)),
+              ),
+          ),
+        );
 
   // The auth check does not depend on the version output, so both spawn at once.
   return Effect.all(
@@ -278,23 +311,7 @@ export function probeSourceControlProvider(input: {
         process: input.process,
         cwd: input.cwd,
       }),
-      input.process
-        .run({
-          operation: "source-control.discovery.auth",
-          command: spec.executable,
-          args: spec.authArgs,
-          cwd: input.cwd,
-          allowNonZeroExit: true,
-          timeoutMs: probeTimeoutMs(spec),
-          maxOutputBytes: 8_000,
-          appendTruncationMarker: true,
-        })
-        .pipe(
-          Effect.map(spec.parseAuth),
-          Effect.catch((cause) =>
-            Effect.succeed(unknownAuth(Option.getOrUndefined(detailFromCause(cause)))),
-          ),
-        ),
+      auth,
     ],
     { concurrency: "unbounded" },
   ).pipe(
diff --git a/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts b/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
index beeb6b38af1d0..21c499cae9ed1 100644
--- a/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
+++ b/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
@@ -146,7 +146,11 @@ export const discovery = {
   label: "GitLab",
   executable: "glab",
   versionArgs: ["--version"],
+  // Without --all, glab 1.79+ checks only the current host unless that is gitlab.com; older
+  // glab lists every host and rejects --all. --all waits on every host, so ask it only after
+  // the current host reports signed out.
   authArgs: ["auth", "status"],
+  authRetryArgs: ["auth", "status", "--all"],
   // glab host matching requires the remote's exact spelling.
   remoteRefinementArgs: ({ provider, remoteUrl }) => {
     const authority = /^[a-z][a-z0-9+.-]*:\/\/([^/]+)/iu.exec(remoteUrl.trim())?.[1];
diff --git a/packages/source-control-gitlab/src/server/gitLabDiscovery.test.ts b/packages/source-control-gitlab/src/server/gitLabDiscovery.test.ts
index a30f676c9c954..f0fdcba5aa065 100644
--- a/packages/source-control-gitlab/src/server/gitLabDiscovery.test.ts
+++ b/packages/source-control-gitlab/src/server/gitLabDiscovery.test.ts
@@ -2,7 +2,10 @@ import {
   parseGitRemoteHost,
   unknownRemoteProvider,
 } from "@t3tools/source-control-core/shared/definition";
-import { refineUnknownRemoteProvider } from "@t3tools/source-control-core/server/discovery";
+import {
+  probeSourceControlProvider,
+  refineUnknownRemoteProvider,
+} from "@t3tools/source-control-core/server/discovery";
 import { processOutput } from "@t3tools/source-control-testing/TestSourceControlHost";
 import { assert, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
@@ -21,6 +24,89 @@ Logged in to gitlab.com as gitlab-user
   assert.deepStrictEqual(auth.account, Option.some("gitlab-user"));
 });
 
+// Without `--all`, glab 1.79+ checks only the current host unless that is gitlab.com.
+it.effect("reports a signed-in host when glab's default host is signed out", () =>
+  Effect.gen(function* () {
+    const defaultHostOnly = `gitlab.gnome.org
+  x gitlab.gnome.org: API call failed: GET https://gitlab.gnome.org/api/v4/user: 401 {message: 401 Unauthorized}
+`;
+    const allHosts = `gitlab.com
+  ✓ Logged in to gitlab.com as gitlab-user (/home/user/.config/glab-cli/config.yml)
+${defaultHostOnly}`;
+    const item = yield* probeSourceControlProvider({
+      spec: GitLabSourceControlProvider.discovery,
+      cwd: "/repo",
+      process: {
+        run: ({ args }) =>
+          Effect.succeed(
+            args[0] === "--version"
+              ? processOutput("glab 1.124.0\n")
+              : processOutput(args.includes("--all") ? allHosts : defaultHostOnly, {
+                  exitCode: ChildProcessSpawner.ExitCode(1),
+                }),
+          ),
+      },
+    });
+    assert.strictEqual(item.auth.status, "authenticated");
+    assert.deepStrictEqual(item.auth.account, Option.some("gitlab-user"));
+    assert.deepStrictEqual(item.auth.host, Option.some("gitlab.com"));
+  }),
+);
+
+it.effect("skips --all when the current glab host is signed in", () =>
+  Effect.gen(function* () {
+    const asked: Array<ReadonlyArray<string>> = [];
+    const item = yield* probeSourceControlProvider({
+      spec: GitLabSourceControlProvider.discovery,
+      cwd: "/repo",
+      process: {
+        run: ({ args }) => {
+          asked.push(args);
+          return Effect.succeed(
+            args[0] === "--version"
+              ? processOutput("glab 1.124.0\n")
+              : processOutput(`gitlab.example.test
+  ✓ Logged in to gitlab.example.test as gitlab-user
+`),
+          );
+        },
+      },
+    });
+    assert.strictEqual(item.auth.status, "authenticated");
+    assert.isFalse(asked.some((args) => args.includes("--all")));
+  }),
+);
+
+it.effect("keeps glab's own sign-out detail when glab predates --all", () =>
+  Effect.gen(function* () {
+    const item = yield* probeSourceControlProvider({
+      spec: GitLabSourceControlProvider.discovery,
+      cwd: "/repo",
+      process: {
+        run: ({ args }) =>
+          Effect.succeed(
+            args[0] === "--version"
+              ? processOutput("glab 1.53.0\n")
+              : args.includes("--all")
+                ? processOutput("", {
+                    stderr: "unknown flag: --all\n",
+                    exitCode: ChildProcessSpawner.ExitCode(1),
+                  })
+                : processOutput("", {
+                    stderr: "No GitLab instances have been authenticated with glab.\n",
+                    exitCode: ChildProcessSpawner.ExitCode(1),
+                  }),
+          ),
+      },
+    });
+    assert.strictEqual(item.auth.status, "unauthenticated");
+    assert.deepStrictEqual(
+      item.auth.detail,
+      Option.some("No GitLab instances have been authenticated with glab."),
+    );
+  }),
+);
+
 it.effect.each([
   {
     name: "without relying on host naming",

From 550c5fa34b6b4f287496f3d725a300347274fbcf Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:13:13 -0800
Subject: [PATCH 042/167] perf(server): prune events the projections already
 cover (#29806)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../FoundationPersistence.test.ts             | 144 +----
 .../ProjectionMaintenance.test.ts             | 385 ++++++++++++
 .../orchestration-v2/ProjectionMaintenance.ts | 572 ++++++++----------
 .../TurnItemCompaction.test.ts                | 488 ---------------
 .../LegacyV1Cutover.integration.test.ts       |   8 +-
 .../legacy/LegacyV1ThreadImporter.test.ts     |  10 +-
 .../src/orchestration-v2/runtimeLayer.test.ts | 116 +---
 .../testkit/ProjectionReplay.ts               | 182 ++++++
 .../ProviderSwitch.integration.test.ts        |   6 +-
 .../persistence/DatabaseMaintenance.test.ts   |  16 +-
 .../src/persistence/DatabaseMaintenance.ts    |  29 +-
 .../src/persistence/DatabaseStorage.test.ts   |   9 +-
 .../server/src/persistence/DatabaseStorage.ts |   3 +-
 ...CanonicalizeThreadPullRequestLinks.test.ts |   6 +-
 ...6_RepairClientSettlementTimestamps.test.ts |   6 +-
 .../persistence/OrchestrationEventStore.ts    |  19 +-
 .../project/ProjectService.deletion.test.ts   |   6 +-
 apps/server/src/server.ts                     |   8 +-
 apps/server/src/ws.test.ts                    | 237 +++++---
 apps/server/src/ws.ts                         |  74 ++-
 docs/internals/overview.md                    |  20 +-
 docs/user/background-service.md               |   4 +-
 22 files changed, 1144 insertions(+), 1204 deletions(-)
 create mode 100644 apps/server/src/orchestration-v2/ProjectionMaintenance.test.ts
 delete mode 100644 apps/server/src/orchestration-v2/TurnItemCompaction.test.ts
 create mode 100644 apps/server/src/orchestration-v2/testkit/ProjectionReplay.ts

diff --git a/apps/server/src/orchestration-v2/FoundationPersistence.test.ts b/apps/server/src/orchestration-v2/FoundationPersistence.test.ts
index c5c51646584aa..475e0a0e4ae7b 100644
--- a/apps/server/src/orchestration-v2/FoundationPersistence.test.ts
+++ b/apps/server/src/orchestration-v2/FoundationPersistence.test.ts
@@ -62,6 +62,7 @@ import * as EventSink from "./EventSink.ts";
 import * as EventStore from "./EventStore.ts";
 import * as IdAllocator from "@t3tools/provider-core/server/IdAllocator";
 import * as ProjectionMaintenance from "./ProjectionMaintenance.ts";
+import * as ProjectionReplay from "./testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 import * as ProjectStore from "./ProjectStore.ts";
 import * as ProviderRuntimeRecovery from "./ProviderRuntimeRecoveryService.ts";
@@ -85,6 +86,9 @@ const layerCommandReceiptStoreProvided = CommandReceiptStore.layer.pipe(
 );
 const layerIsolatedOutbox = Layer.fresh(EffectOutbox.layer.pipe(Layer.provideMerge(layerDatabase)));
 const layerProjectionMaintenanceProvided = ProjectionMaintenance.layer.pipe(
+  Layer.provide(layerDatabase),
+);
+const layerProjectionReplayProvided = ProjectionReplay.layer.pipe(
   Layer.provide(layerStoresProvided),
 );
 const layerTest = Layer.mergeAll(
@@ -94,6 +98,7 @@ const layerTest = Layer.mergeAll(
   layerCommandReceiptStoreProvided,
   IdAllocator.layer,
   layerProjectionMaintenanceProvided,
+  layerProjectionReplayProvided,
 );
 
 const providerInstanceId = ProviderInstanceId.make("codex");
@@ -148,85 +153,6 @@ function threadCreatedEvent(input: {
   };
 }
 
-it.effect("rebuilds event history one bounded page at a time", () =>
-  Effect.gen(function* () {
-    const eventStore = yield* EventStore.EventStoreV2;
-    const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
-    const now = yield* DateTime.now;
-    const threadId = ThreadId.make("thread:foundation-paged-rebuild");
-    const thread = makeThread(threadId, now);
-    const eventCount = 1_005;
-    yield* eventStore.append({
-      events: [
-        threadCreatedEvent({ id: "event:paged-rebuild:0", thread, now }),
-        ...Array.from({ length: eventCount - 1 }, (_, index) => ({
-          id: EventId.make(`event:paged-rebuild:${index + 1}`),
-          type: "thread.metadata-updated" as const,
-          threadId,
-          occurredAt: now,
-          payload: { ...thread, title: `Rebuilt update ${index + 1}` },
-        })),
-      ],
-    });
-    let applied = 0;
-    let failAfterFirstPage = false;
-    const appliedAtRead: Array<number> = [];
-    const layerObservedStores = Layer.mergeAll(
-      Layer.succeed(EventStore.EventStoreV2, {
-        ...eventStore,
-        read: (input) =>
-          Stream.suspend(() => {
-            appliedAtRead.push(applied);
-            if (failAfterFirstPage && applied >= 500) {
-              return Stream.fail(
-                new EventStore.EventStoreReadEventsError({ afterSequence: input?.afterSequence }),
-              );
-            }
-            return eventStore.read(input);
-          }),
-      }),
-      Layer.succeed(ProjectionStore.ProjectionStoreV2, {
-        ...projectionStore,
-        apply: (event) =>
-          projectionStore.apply(event).pipe(
-            Effect.tap(() =>
-              Effect.sync(() => {
-                applied += 1;
-              }),
-            ),
-          ),
-      }),
-    );
-    const rebuild = Effect.gen(function* () {
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-      return yield* maintenance.rebuild;
-    }).pipe(
-      Effect.provide(
-        Layer.fresh(ProjectionMaintenance.layer.pipe(Layer.provide(layerObservedStores))),
-      ),
-    );
-    const rebuilt = yield* rebuild;
-    assert.isTrue(rebuilt.valid);
-    assert.equal(applied, eventCount);
-    assert.deepEqual(appliedAtRead, [0, 500, 1_000]);
-    assert.equal(
-      (yield* projectionStore.getThreadProjection(threadId)).thread.title,
-      "Rebuilt update 1004",
-    );
-    applied = 0;
-    failAfterFirstPage = true;
-    const failed = yield* Effect.exit(rebuild);
-    assert.equal(failed._tag, "Failure");
-    assert.equal(applied, 500);
-    assert.equal(
-      (yield* projectionStore.getThreadProjection(threadId)).thread.title,
-      "Rebuilt update 1004",
-    );
-    const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-    assert.isTrue((yield* maintenance.verify).valid);
-  }).pipe(Effect.provide(layerTest)),
-);
-
 const seedCompaction = Effect.fnUntraced(function* () {
   const sql = yield* SqlClient.SqlClient;
   yield* sql`INSERT INTO orchestration_v2_legacy_imports (
@@ -240,6 +166,13 @@ const seedCompaction = Effect.fnUntraced(function* () {
   ) SELECT 'event-' || n, 'thread', 'thread', n,
     CASE WHEN n IN (1, 51, 101) THEN 'message.updated' ELSE 'thread.visited' END,
     '2026-10-17', 'server', '{"id":"message"}', '{}', 2 FROM history`;
+  // A pass a day ago marked the whole log; projections cover it.
+  yield* sql`INSERT INTO orchestration_v2_projection_metadata (
+    projection_name, schema_version, last_sequence, updated_at
+  ) VALUES
+    ('event-log-prune-mark', 2, 151, '1969-12-30T00:00:00.000Z'),
+    ('thread-projections', 2, 151, '1969-12-30T00:00:00.000Z')
+  ON CONFLICT(projection_name) DO UPDATE SET last_sequence = excluded.last_sequence`;
   yield* sql`WITH RECURSIVE history(n) AS (
     SELECT 1 UNION ALL SELECT n + 1 FROM history WHERE n < 100
   ) INSERT INTO orchestration_command_receipts (
@@ -284,11 +217,12 @@ it.effect("discovers on the reader worker and deletes on the writer", () =>
           }),
       );
       const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-      const result = yield* maintenance.compactEventStore();
-      assert.equal(result.deletedEventCount, 148);
+      const result = yield* maintenance.pruneEventStore();
+      assert.equal(result.deletedEventCount, 150);
       assert.equal(result.deletedReceiptCount, 100);
+      // Only the in-transaction check for rows appended during the pass reads on the writer.
       assert.deepEqual(
-        reads.filter((query) => /\bSELECT\b/.test(query)),
+        reads.filter((query) => /\bSELECT\b/.test(query) && !query.includes("AS prompt_sequence")),
         [],
       );
       assert(writes.some((query) => query.includes("DELETE FROM orchestration_events")));
@@ -296,7 +230,6 @@ it.effect("discovers on the reader worker and deletes on the writer", () =>
     }).pipe(
       Effect.provide(
         ProjectionMaintenance.layer.pipe(
-          Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
           Layer.provideMerge(SqlitePersistence.layerFromPath(filename)),
         ),
       ),
@@ -318,7 +251,7 @@ it.effect("paces scheduled compaction while preserving retention state and fixed
     const tracer = Tracer.make({
       span(options) {
         const span = new Tracer.NativeSpan(options);
-        if (span.name === "ProjectionMaintenance.compactEventStore") compactionSpans.push(span);
+        if (span.name === "ProjectionMaintenance.pruneEventStore") compactionSpans.push(span);
         const end = span.end.bind(span);
         span.end = (time, exit) => {
           end(time, exit);
@@ -377,15 +310,13 @@ it.effect("paces scheduled compaction while preserving retention state and fixed
         },
       }),
     );
-    assert.deepEqual(pauses, Array(5).fill(270));
+    assert.deepEqual(pauses, Array(8).fill(270));
     assert.deepEqual(
       compactionSpans.map((span) => span.status._tag),
       ["Ended"],
     );
+    // 151 stopped being the stream head when 152 committed mid-pass; 152 is past the bound.
     assert.deepEqual(yield* sql`SELECT sequence FROM orchestration_events ORDER BY sequence`, [
-      { sequence: 1 },
-      { sequence: 101 },
-      { sequence: 151 },
       { sequence: 152 },
     ]);
     assert.deepEqual(yield* sql`SELECT command_id FROM orchestration_command_receipts`, [
@@ -768,7 +699,7 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
     Effect.gen(function* () {
       const eventSink = yield* EventSink.EventSinkV2;
       const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const now = yield* DateTime.now;
       const firstThreadId = ThreadId.make("thread:foundation-shared-session:first");
       const secondThreadId = ThreadId.make("thread:foundation-shared-session:second");
@@ -829,7 +760,7 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
     }),
   );
 
-  it.effect("compacts superseded state events, imported v1 events, and legacy receipts", () =>
+  it.effect("prunes covered history, imported v1 events, and legacy receipts", () =>
     Effect.gen(function* () {
       const eventSink = yield* EventSink.EventSinkV2;
       const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
@@ -983,9 +914,12 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
         ON CONFLICT(command_id) DO NOTHING
       `;
 
-      const summary = yield* maintenance.compactEventStore();
+      // The first pass only marks the head and drops imported legacy rows.
+      const marked = yield* maintenance.pruneEventStore();
+      yield* TestClock.adjust("1 day");
+      const summary = yield* maintenance.pruneEventStore();
       assert.isAtLeast(summary.deletedEventCount, 504);
-      assert.isAtLeast(summary.deletedReceiptCount, 1);
+      assert.equal(marked.deletedReceiptCount + summary.deletedReceiptCount, 1);
 
       const remaining = yield* sql<{ readonly event_id: string }>`
         SELECT event_id
@@ -996,18 +930,7 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
       `;
       assert.deepEqual(
         remaining.map((row) => row.event_id),
-        [
-          "event:foundation-compact:create",
-          "event:foundation-compact:meta",
-          "event:foundation-compact:message-1",
-          "event:foundation-compact:node-1",
-          "event:foundation-compact:item-1",
-          "event:foundation-compact:visit-2",
-          "event:foundation-compact:message-2",
-          "event:foundation-compact:node-2",
-          "event:foundation-compact:item-2",
-          "event:foundation-compact:tags-2",
-        ],
+        ["event:foundation-compact:create", "event:foundation-compact:tags-2"],
       );
 
       const remainingV1 = yield* sql<{ readonly stream_id: string }>`
@@ -1031,8 +954,6 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
         ["command:foundation-compact:pending"],
       );
 
-      assert.isTrue((yield* maintenance.verify).valid);
-      assert.isTrue((yield* maintenance.rebuild).valid);
       assert.deepEqual(yield* projections.getThreadProjection(threadId), beforeCompaction);
     }),
   );
@@ -1041,7 +962,7 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
     Effect.gen(function* () {
       const eventSink = yield* EventSink.EventSinkV2;
       const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const sql = yield* SqlClient.SqlClient;
       const now = yield* DateTime.now;
       const parentThreadId = ThreadId.make("thread:foundation-cross-thread:parent");
@@ -3152,7 +3073,7 @@ it.layer(layerTest)("orchestration V2 foundation persistence", (it) => {
     Effect.gen(function* () {
       const eventSink = yield* EventSink.EventSinkV2;
       const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const sql = yield* SqlClient.SqlClient;
       const now = yield* DateTime.now;
       const threadId = ThreadId.make("thread:foundation-many-items");
@@ -3384,10 +3305,7 @@ it.effect.each(["events", "receipts"] as const)(
       const path = yield* Path.Path;
       const directory = yield* fs.makeTempDirectoryScoped({ prefix: "compaction-reader-" });
       const database = SqlitePersistence.layerFromPath(path.join(directory, "statev2.sqlite"));
-      const maintenanceLayer = ProjectionMaintenance.layer.pipe(
-        Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
-        Layer.provideMerge(database),
-      );
+      const maintenanceLayer = ProjectionMaintenance.layer.pipe(Layer.provideMerge(database));
       yield* Effect.gen(function* () {
         const sql = yield* SqlClient.SqlClient;
         const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
@@ -3434,7 +3352,7 @@ it.effect.each(["events", "receipts"] as const)(
             : Effect.succeed(statement);
         };
         const compacted = yield* Deferred.make<void>();
-        const compaction = yield* maintenance.compactEventStore().pipe(
+        const compaction = yield* maintenance.pruneEventStore().pipe(
           Effect.provideService(Statement.CurrentTransformer, observeDiscovery),
           Effect.provideService(Statement.SpanPropagationEnabled, true),
           Effect.tap(() => Deferred.succeed(compacted, undefined)),
diff --git a/apps/server/src/orchestration-v2/ProjectionMaintenance.test.ts b/apps/server/src/orchestration-v2/ProjectionMaintenance.test.ts
new file mode 100644
index 0000000000000..1f42953cc4ec3
--- /dev/null
+++ b/apps/server/src/orchestration-v2/ProjectionMaintenance.test.ts
@@ -0,0 +1,385 @@
+import { assert, it } from "@effect/vitest";
+import {
+  EventId,
+  NodeId,
+  PlanId,
+  type OrchestrationV2AppThread,
+  type OrchestrationV2DomainEvent,
+  type OrchestrationV2TurnItem,
+  ProjectId,
+  ProviderDriverKind,
+  ProviderInstanceId,
+  ThreadId,
+  TurnItemId,
+} from "@t3tools/contracts";
+import * as DateTime from "effect/DateTime";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as Layer from "effect/Layer";
+import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
+import * as SqlClient from "effect/sql/SqlClient";
+import * as Statement from "effect/sql/Statement";
+
+import * as SqlitePersistence from "../persistence/Sqlite.ts";
+import * as EventSink from "./EventSink.ts";
+import * as EventStore from "./EventStore.ts";
+import * as ProjectionMaintenance from "./ProjectionMaintenance.ts";
+import * as ProjectionStore from "./ProjectionStore.ts";
+import * as OrchestrationEventStore from "../persistence/OrchestrationEventStore.ts";
+
+const database = SqlitePersistence.layerMemory;
+const eventStoreProvided = EventStore.layer.pipe(Layer.provideMerge(database));
+const projectionStoreProvided = ProjectionStore.layer.pipe(Layer.provideMerge(database));
+const stores = Layer.mergeAll(database, eventStoreProvided, projectionStoreProvided);
+const layerTest = Layer.mergeAll(
+  stores,
+  OrchestrationEventStore.layer.pipe(Layer.provide(database)),
+  EventSink.layer.pipe(Layer.provide(stores)),
+  ProjectionMaintenance.layer.pipe(Layer.provide(stores)),
+);
+
+const providerInstanceId = ProviderInstanceId.make("codex");
+const providerDriver = ProviderDriverKind.make("codex");
+const modelSelection = { instanceId: providerInstanceId, model: "gpt-5.4" };
+
+function makeThread(threadId: ThreadId, now: DateTime.Utc): OrchestrationV2AppThread {
+  return {
+    id: threadId,
+    projectId: ProjectId.make(`project:${threadId}`),
+    title: "Turn item compaction",
+    providerInstanceId,
+    modelSelection,
+    runtimeMode: "full-access",
+    interactionMode: "default",
+    branch: null,
+    worktreePath: null,
+    activeProviderThreadId: null,
+    lineage: { rootThreadId: threadId, parentThreadId: null, relationshipToParent: null },
+    forkedFrom: null,
+    createdBy: "user",
+    creationSource: "web",
+    createdAt: now,
+    updatedAt: now,
+    archivedAt: null,
+    settledOverride: null,
+    settledAt: null,
+    lastVisitedAt: null,
+    deletedAt: null,
+  };
+}
+
+function threadCreated(thread: OrchestrationV2AppThread, now: DateTime.Utc) {
+  return {
+    id: EventId.make("event:turn-item-compaction:thread"),
+    type: "thread.created",
+    threadId: thread.id,
+    providerInstanceId,
+    occurredAt: now,
+    payload: thread,
+  } satisfies OrchestrationV2DomainEvent;
+}
+
+const itemSpecs = [
+  { key: "command", type: "command_execution", ordinal: 10 },
+  { key: "reasoning", type: "reasoning", ordinal: 20 },
+  { key: "todo", type: "todo_list", ordinal: 30 },
+  { key: "commanded", type: "command_execution", ordinal: 40 },
+] as const;
+
+function itemEvent(
+  threadId: ThreadId,
+  now: DateTime.Utc,
+  spec: (typeof itemSpecs)[number],
+  revision: number,
+  eventId = `event:turn-item-compaction:${spec.key}:${revision}`,
+): OrchestrationV2DomainEvent {
+  const id = TurnItemId.make(`turn-item:compaction:${spec.key}`);
+  const growing = `${spec.key}:${revision}:` + "x".repeat((revision + 1) * 192);
+  const completed = revision === 69;
+  const base = {
+    id,
+    threadId,
+    runId: null,
+    nodeId: null,
+    providerThreadId: null,
+    providerTurnId: null,
+    nativeItemRef: null,
+    parentItemId: null,
+    ordinal: spec.ordinal,
+    status: completed ? ("completed" as const) : ("running" as const),
+    title: spec.key,
+    startedAt: now,
+    completedAt: completed ? now : null,
+    updatedAt: now,
+  };
+  let payload: OrchestrationV2TurnItem;
+  switch (spec.type) {
+    case "command_execution":
+      payload = {
+        ...base,
+        type: "command_execution",
+        input: `run ${spec.key}`,
+        output: growing,
+      };
+      break;
+    case "reasoning":
+      payload = { ...base, type: "reasoning", text: growing, streaming: !completed };
+      break;
+    case "todo_list":
+      payload = {
+        ...base,
+        type: "todo_list",
+        planId: PlanId.make("plan:turn-item-compaction"),
+        steps: [{ id: "step", text: growing, status: completed ? "completed" : "running" }],
+        explanation: growing,
+      };
+      break;
+  }
+  return {
+    id: EventId.make(eventId),
+    type: "turn-item.updated",
+    threadId,
+    occurredAt: now,
+    payload,
+  };
+}
+
+function subagentEvents(
+  threadId: ThreadId,
+  now: DateTime.Utc,
+  revision: number,
+  eventSuffix = String(revision),
+): ReadonlyArray<OrchestrationV2DomainEvent> {
+  const id = NodeId.make("subagent:turn-item-compaction");
+  const prompt = revision === 0 ? "Review prompt A. ".repeat(40) : "Review prompt B. ".repeat(40);
+  const progress = `Review progress ${revision}`;
+  return [
+    {
+      id: EventId.make(`event:turn-item-compaction:subagent:${eventSuffix}`),
+      type: "subagent.updated",
+      threadId,
+      occurredAt: now,
+      payload: {
+        id,
+        threadId,
+        runId: null,
+        parentNodeId: NodeId.make("node:turn-item-compaction-parent"),
+        origin: "provider_native",
+        createdBy: "agent",
+        driver: providerDriver,
+        providerInstanceId,
+        providerThreadId: null,
+        childThreadId: null,
+        nativeTaskRef: {
+          driver: providerDriver,
+          nativeId: "compaction-review",
+          strength: "strong",
+        },
+        prompt,
+        progress,
+        title: "Review",
+        model: null,
+        status: "running",
+        result: null,
+        startedAt: now,
+        completedAt: null,
+        updatedAt: now,
+      },
+    },
+    {
+      id: EventId.make(`event:turn-item-compaction:subagent-item:${eventSuffix}`),
+      type: "turn-item.updated",
+      threadId,
+      occurredAt: now,
+      payload: {
+        id: TurnItemId.make("turn-item:compaction:subagent"),
+        threadId,
+        runId: null,
+        nodeId: null,
+        providerThreadId: null,
+        providerTurnId: null,
+        nativeItemRef: null,
+        parentItemId: null,
+        ordinal: 50,
+        status: "running",
+        title: "Review",
+        startedAt: now,
+        completedAt: null,
+        updatedAt: now,
+        type: "subagent",
+        subagentId: id,
+        origin: "provider_native",
+        driver: providerDriver,
+        providerInstanceId,
+        childThreadId: null,
+        prompt,
+        progress,
+        result: null,
+      },
+    },
+  ] satisfies ReadonlyArray<OrchestrationV2DomainEvent>;
+}
+
+const insertRunningRunUpdate = (threadId: ThreadId) =>
+  Effect.flatMap(
+    SqlClient.SqlClient,
+    (sql) => sql<{ readonly sequence: number }>`
+      INSERT INTO orchestration_events (
+        event_id, aggregate_kind, stream_id, stream_version, event_type,
+        occurred_at, actor_kind, payload_json, metadata_json, application_event_version
+      ) VALUES (
+        'event:prune:run-running', 'thread', ${threadId},
+        (SELECT MAX(stream_version) + 1 FROM orchestration_events WHERE stream_id = ${threadId}),
+        'run.updated', '2026-11-01T00:00:00.000Z', 'server', '{"status":"running"}', '{}', 2
+      ) RETURNING sequence
+    `,
+  );
+
+const remainingEventIds = (threadId: ThreadId) =>
+  Effect.flatMap(
+    SqlClient.SqlClient,
+    (sql) => sql<{ readonly event_id: string }>`
+      SELECT event_id FROM orchestration_events WHERE stream_id = ${threadId} ORDER BY sequence
+    `,
+  ).pipe(Effect.map((rows) => rows.map((row) => row.event_id)));
+
+it.effect("prunes events the projections cover once the retained day has passed", () =>
+  Effect.gen(function* () {
+    const sink = yield* EventSink.EventSinkV2;
+    const eventStore = yield* EventStore.EventStoreV2;
+    const events = yield* OrchestrationEventStore.OrchestrationEventStore;
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+    const now = yield* DateTime.now;
+    const threadId = ThreadId.make("thread:prune");
+    yield* sink.write({ events: [threadCreated(makeThread(threadId, now), now)] });
+    for (const revision of [0, 1, 2]) {
+      yield* sink.write({ events: [itemEvent(threadId, now, itemSpecs[0], revision)] });
+    }
+    yield* sink.write({ events: subagentEvents(threadId, now, 0) });
+    yield* insertRunningRunUpdate(threadId);
+    yield* sink.write({ events: [itemEvent(threadId, now, itemSpecs[1], 0)] });
+
+    // The first pass only marks the head; nothing is a day old yet.
+    assert.equal((yield* maintenance.pruneEventStore()).deletedEventCount, 0);
+    const markedThrough = yield* eventStore.latestSequence();
+
+    // Repeating prompt A borrows it from the anchors written before the mark.
+    yield* sink.write({ events: subagentEvents(threadId, now, 0, "repeat") });
+    yield* sink.write({ events: [itemEvent(threadId, now, itemSpecs[0], 3)] });
+    const highWater = yield* eventStore.latestSequence();
+    const projection = yield* projections.getThreadProjection(threadId);
+
+    yield* TestClock.adjust("23 hours");
+    assert.equal((yield* maintenance.pruneEventStore()).deletedEventCount, 0);
+    yield* TestClock.adjust("1 hour");
+    assert.equal((yield* maintenance.pruneEventStore()).deletedEventCount, 4);
+
+    assert.deepEqual(yield* remainingEventIds(threadId), [
+      "event:turn-item-compaction:thread",
+      "event:turn-item-compaction:subagent:0",
+      "event:turn-item-compaction:subagent-item:0",
+      "event:prune:run-running",
+      "event:turn-item-compaction:subagent:repeat",
+      "event:turn-item-compaction:subagent-item:repeat",
+      "event:turn-item-compaction:command:3",
+    ]);
+    assert.equal(yield* events.prunedThroughSequence, markedThrough);
+    assert.equal(yield* eventStore.latestSequence(), highWater);
+    assert.equal(yield* eventStore.latestSequence({ threadId }), highWater);
+    assert.deepEqual(yield* projections.getThreadProjection(threadId), projection);
+    const repeated = yield* eventStore
+      .read({ threadId, eventType: "subagent.updated", afterSequence: markedThrough })
+      .pipe(Stream.runCollect);
+    assert.deepEqual(
+      Array.from(repeated, (stored) =>
+        stored.event.type === "subagent.updated" ? stored.event.payload.prompt : null,
+      ),
+      ["Review prompt A. ".repeat(40)],
+    );
+  }).pipe(Effect.provide(layerTest)),
+);
+
+it.effect("keeps the anchor a retained stream head borrows from", () =>
+  Effect.gen(function* () {
+    const sink = yield* EventSink.EventSinkV2;
+    const eventStore = yield* EventStore.EventStoreV2;
+    const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+    const now = yield* DateTime.now;
+    const threadId = ThreadId.make("thread:prune-head");
+    yield* sink.write({ events: [threadCreated(makeThread(threadId, now), now)] });
+    yield* sink.write({ events: subagentEvents(threadId, now, 0) });
+    // The stream's newest row borrows prompt A, so it is kept below the boundary.
+    yield* sink.write({ events: subagentEvents(threadId, now, 0, "repeat") });
+    yield* maintenance.pruneEventStore();
+    yield* TestClock.adjust("1 day");
+    assert.isAbove((yield* maintenance.pruneEventStore()).deletedEventCount, 0);
+
+    assert.include(
+      yield* remainingEventIds(threadId),
+      "event:turn-item-compaction:subagent-item:0",
+    );
+    const stored = yield* eventStore.read({ threadId }).pipe(Stream.runCollect);
+    const head = Array.from(stored).at(-1)?.event;
+    assert.deepEqual(
+      head?.type === "turn-item.updated" && head.payload.type === "subagent"
+        ? head.payload.prompt
+        : null,
+      "Review prompt A. ".repeat(40),
+    );
+  }).pipe(Effect.provide(layerTest)),
+);
+
+it.effect("keeps an anchor that a row appended during the pass borrows from", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const sink = yield* EventSink.EventSinkV2;
+      const eventStore = yield* EventStore.EventStoreV2;
+      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const now = yield* DateTime.now;
+      const threadId = ThreadId.make("thread:prune-race");
+      yield* sink.write({ events: [threadCreated(makeThread(threadId, now), now)] });
+      yield* sink.write({ events: subagentEvents(threadId, now, 0) });
+      yield* maintenance.pruneEventStore();
+      yield* sink.write({ events: [itemEvent(threadId, now, itemSpecs[0], 0)] });
+      yield* TestClock.adjust("1 day");
+
+      const scanStarted = yield* Deferred.make<void>();
+      const releaseScan = yield* Deferred.make<void>();
+      let blocked = false;
+      const blockFirstScanPage: Statement.Transformer = (statement) => {
+        const [query] = statement.compile();
+        if (!blocked && query.includes("END AS prunable")) {
+          blocked = true;
+          return Deferred.succeed(scanStarted, undefined).pipe(
+            Effect.andThen(Deferred.await(releaseScan)),
+            Effect.as(statement),
+          );
+        }
+        return Effect.succeed(statement);
+      };
+      const pass = yield* maintenance
+        .pruneEventStore()
+        .pipe(
+          Effect.provideService(Statement.CurrentTransformer, blockFirstScanPage),
+          Effect.forkScoped,
+        );
+      yield* Deferred.await(scanStarted);
+      yield* sink.write({ events: subagentEvents(threadId, now, 0, "late") });
+      yield* Deferred.succeed(releaseScan, undefined);
+      assert.equal((yield* Fiber.join(pass)).deletedEventCount, 0);
+
+      const late = yield* eventStore
+        .read({ threadId, eventType: "subagent.updated" })
+        .pipe(Stream.runCollect);
+      assert.deepEqual(
+        Array.from(late, (stored) =>
+          stored.event.type === "subagent.updated" ? stored.event.payload.prompt : null,
+        ),
+        ["Review prompt A. ".repeat(40), "Review prompt A. ".repeat(40)],
+      );
+    }),
+  ).pipe(Effect.provide(layerTest)),
+);
diff --git a/apps/server/src/orchestration-v2/ProjectionMaintenance.ts b/apps/server/src/orchestration-v2/ProjectionMaintenance.ts
index 211fb2ad8e7a3..210322aed686f 100644
--- a/apps/server/src/orchestration-v2/ProjectionMaintenance.ts
+++ b/apps/server/src/orchestration-v2/ProjectionMaintenance.ts
@@ -1,26 +1,18 @@
-import { ThreadId } from "@t3tools/contracts";
 import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
-import * as Stream from "effect/Stream";
 import * as SqlClient from "effect/sql/SqlClient";
 
-import * as EventStore from "./EventStore.ts";
+import {
+  EVENT_LOG_PRUNE_MARK,
+  EVENT_LOG_PRUNED_THROUGH,
+} from "../persistence/OrchestrationEventStore.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 
-export interface ProjectionVerificationV2 {
-  readonly valid: boolean;
-  readonly schemaVersion: number;
-  readonly expectedSequence: number;
-  readonly projectionSequence: number;
-  readonly unreadableThreadIds: ReadonlyArray<ThreadId>;
-  readonly missingThreadIds: ReadonlyArray<ThreadId>;
-  readonly unexpectedThreadIds: ReadonlyArray<ThreadId>;
-}
-
 export class ProjectionMaintenanceError extends Schema.TaggedError<ProjectionMaintenanceError>()(
   "ProjectionMaintenanceError",
   {
@@ -30,9 +22,8 @@ export class ProjectionMaintenanceError extends Schema.TaggedError<ProjectionMai
 ) {}
 
 export interface ProjectionMaintenanceV2Shape {
-  readonly verify: Effect.Effect<ProjectionVerificationV2, ProjectionMaintenanceError>;
-  readonly rebuild: Effect.Effect<ProjectionVerificationV2, ProjectionMaintenanceError>;
-  readonly compactEventStore: (betweenPages?: Effect.Effect<void>) => Effect.Effect<
+  /** Deletes events the projections already cover once they are older than the retained history. */
+  readonly pruneEventStore: (betweenPages?: Effect.Effect<void>) => Effect.Effect<
     {
       readonly deletedEventCount: number;
       readonly deletedReceiptCount: number;
@@ -47,369 +38,282 @@ export class ProjectionMaintenanceV2 extends Context.Service<
   ProjectionMaintenanceV2Shape
 >()("t3/orchestration-v2/ProjectionMaintenance/ProjectionMaintenanceV2") {}
 
-type ProjectionMetadataRow = {
-  readonly schema_version: number;
+// Reconnect replay and command-id retries read this tail; older cursors resync from a snapshot.
+const RETAINED_EVENT_HISTORY = Duration.days(1);
+// Small pages bound work on the reader worker and synchronous fallback.
+const PAGE_SIZE = 50;
+const REFERENCE_SCAN_WINDOW = 1000;
+
+type MetadataRow = {
+  readonly projection_name: string;
   readonly last_sequence: number;
+  readonly updated_at: string;
 };
 
-const encodeEntityKey = Schema.encodeSync(
-  Schema.fromJsonString(Schema.Tuple([Schema.String, Schema.String, Schema.NullOr(Schema.String)])),
-);
-
-export const layer: Layer.Layer<
-  ProjectionMaintenanceV2,
-  never,
-  EventStore.EventStoreV2 | ProjectionStore.ProjectionStoreV2 | SqlClient.SqlClient
-> = Layer.effect(
+export const layer: Layer.Layer<ProjectionMaintenanceV2, never, SqlClient.SqlClient> = Layer.effect(
   ProjectionMaintenanceV2,
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    const eventStore = yield* EventStore.EventStoreV2;
-    const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
-
-    const verify = Effect.gen(function* () {
-      const expectedThreadRows = yield* sql<{ readonly thread_id: string }>`
-        SELECT DISTINCT stream_id AS thread_id
-        FROM orchestration_events INDEXED BY orchestration_events_v2_created_threads_idx
-        WHERE application_event_version = 2
-          AND aggregate_kind = 'thread'
-          AND event_type = 'thread.created'
-        ORDER BY stream_id ASC
-      `;
-      const projectionRows = yield* sql<{ readonly thread_id: string }>`
-        SELECT thread_id
-        FROM orchestration_v2_projection_threads
-        ORDER BY thread_id ASC
-      `;
-      const actualIds = projectionRows.map((row) => ThreadId.make(row.thread_id));
-      const expectedIds = expectedThreadRows.map((row) => ThreadId.make(row.thread_id));
-      const actualSet = new Set(actualIds);
-      const expectedSet = new Set(expectedIds);
-      const missingThreadIds = expectedIds.filter((threadId) => !actualSet.has(threadId));
-      const unexpectedThreadIds = actualIds.filter((threadId) => !expectedSet.has(threadId));
-      const unreadableThreadIds = yield* projectionStore.getUnreadableThreadIds();
-      const metadata = yield* sql<ProjectionMetadataRow>`
-        SELECT schema_version, last_sequence
-        FROM orchestration_v2_projection_metadata
-        WHERE projection_name = 'thread-projections'
-        LIMIT 1
-      `;
-      const expectedSequence = yield* eventStore.latestSequence();
-      const schemaVersion = metadata[0]?.schema_version ?? 0;
-      const projectionSequence = metadata[0]?.last_sequence ?? 0;
-      return {
-        valid:
-          schemaVersion === ProjectionStore.ORCHESTRATION_V2_PROJECTION_SCHEMA_VERSION &&
-          projectionSequence === expectedSequence &&
-          missingThreadIds.length === 0 &&
-          unexpectedThreadIds.length === 0 &&
-          unreadableThreadIds.length === 0,
-        schemaVersion,
-        expectedSequence,
-        projectionSequence,
-        unreadableThreadIds,
-        missingThreadIds,
-        unexpectedThreadIds,
-      } satisfies ProjectionVerificationV2;
-    }).pipe(sql.withTransaction);
 
-    const rebuild = Effect.gen(function* () {
-      yield* sql.withTransaction(
-        Effect.gen(function* () {
-          const throughSequence = yield* eventStore.latestSequence();
-          yield* sql`DELETE FROM orchestration_v2_projection_context_transfers`;
-          yield* sql`DELETE FROM orchestration_v2_projection_context_handoffs`;
-          yield* sql`DELETE FROM orchestration_v2_projection_checkpoints`;
-          yield* sql`DELETE FROM orchestration_v2_projection_checkpoint_scopes`;
-          yield* sql`DELETE FROM orchestration_v2_projection_turn_items`;
-          yield* sql`DELETE FROM orchestration_v2_projection_plans`;
-          yield* sql`DELETE FROM orchestration_v2_projection_messages`;
-          yield* sql`DELETE FROM orchestration_v2_projection_runtime_requests`;
-          yield* sql`DELETE FROM orchestration_v2_projection_provider_turns`;
-          yield* sql`DELETE FROM orchestration_v2_projection_provider_threads`;
-          yield* sql`DELETE FROM orchestration_v2_projection_provider_session_bindings`;
-          yield* sql`DELETE FROM orchestration_v2_projection_provider_sessions`;
-          yield* sql`DELETE FROM orchestration_v2_projection_subagents`;
-          yield* sql`DELETE FROM orchestration_v2_projection_nodes`;
-          yield* sql`DELETE FROM orchestration_v2_projection_run_attempts`;
-          yield* sql`DELETE FROM orchestration_v2_projection_runs`;
-          yield* sql`DELETE FROM orchestration_v2_projection_threads`;
-          yield* sql`DELETE FROM orchestration_v2_turn_item_positions`;
+    const writeMetadata = (name: string, sequence: number, at: DateTime.Utc) => sql`
+      INSERT INTO orchestration_v2_projection_metadata (
+        projection_name, schema_version, last_sequence, updated_at
+      )
+      VALUES (
+        ${name},
+        ${ProjectionStore.ORCHESTRATION_V2_PROJECTION_SCHEMA_VERSION},
+        ${sequence},
+        ${DateTime.formatIso(at)}
+      )
+      ON CONFLICT(projection_name) DO UPDATE SET
+        last_sequence = excluded.last_sequence,
+        updated_at = excluded.updated_at
+    `;
 
-          const pageSize = 500;
-          let lastSequence = 0;
-          while (true) {
-            const page = yield* eventStore
-              .read({ afterSequence: lastSequence, throughSequence, limit: pageSize })
-              .pipe(Stream.runCollect);
-            for (const stored of page) {
-              yield* projectionStore.apply(stored.event);
-              if (stored.event.type === "turn-item.updated") {
-                yield* sql`
-                INSERT INTO orchestration_v2_turn_item_positions (
-                  thread_id,
-                  turn_item_id,
-                  ordinal
-                )
-                VALUES (
-                  ${stored.event.threadId},
-                  ${stored.event.payload.id},
-                  ${stored.event.payload.ordinal}
-                )
-                ON CONFLICT(thread_id, turn_item_id) DO UPDATE SET
-                  ordinal = excluded.ordinal
-                `;
-              }
-              lastSequence = stored.sequence;
-            }
-            if (page.length < pageSize) break;
-            yield* Effect.yieldNow;
-          }
-          const now = DateTime.formatIso(yield* DateTime.now);
-          yield* sql`
-            INSERT INTO orchestration_v2_projection_metadata (
-              projection_name,
-              schema_version,
-              last_sequence,
-              updated_at
-            )
-            VALUES (
-              'thread-projections',
-              ${ProjectionStore.ORCHESTRATION_V2_PROJECTION_SCHEMA_VERSION},
-              ${lastSequence},
-              ${now}
-            )
-            ON CONFLICT(projection_name) DO UPDATE SET
-              schema_version = excluded.schema_version,
-              last_sequence = excluded.last_sequence,
-              updated_at = excluded.updated_at
-          `;
-        }),
-      );
-      return yield* verify;
+    // Collects anchors whose prompt later rows borrow through promptSequence.
+    const readPromptReferences = Effect.fnUntraced(function* (
+      afterSequence: number,
+      throughSequence: number,
+      betweenPages: Effect.Effect<void>,
+    ) {
+      const referenced = new Set<number>();
+      for (let cursor = afterSequence; cursor < throughSequence;) {
+        const windowEnd = Math.min(cursor + REFERENCE_SCAN_WINDOW, throughSequence);
+        const rows = yield* sql<{ readonly prompt_sequence: number }>`
+          SELECT json_extract(payload_json, '$.promptSequence') AS prompt_sequence
+          FROM orchestration_events
+          WHERE sequence > ${cursor}
+            AND sequence <= ${windowEnd}
+            AND event_type IN ('subagent.updated', 'turn-item.updated')
+            AND json_type(payload_json, '$.promptSequence') = 'integer'
+        `.pipe(NodeSqliteClient.readOnly);
+        for (const row of rows) referenced.add(row.prompt_sequence);
+        cursor = windowEnd;
+        yield* betweenPages;
+      }
+      return referenced;
     });
 
-    const mapError =
-      (operation: string) =>
-      <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-        effect.pipe(
-          Effect.mapError((cause) => new ProjectionMaintenanceError({ operation, cause })),
-        );
-
-    // Keep thread.created as the verification and replay anchor; clients recognize deletion by thread.deleted event type.
-    const SUPERSEDABLE_THREAD_EVENT_TYPES = [
-      "thread.archived",
-      "thread.unarchived",
-      "thread.settled",
-      "thread.unsettled",
-      "thread.snoozed",
-      "thread.unsnoozed",
-      "thread.pinned",
-      "thread.auto-settle-set",
-      "thread.unpinned",
-      "thread.pin-reordered",
-      "thread.active-reordered",
-      "thread.metadata-updated",
-      "thread.pull-request-synced",
-      "thread.runtime-mode-updated",
-      "thread.interaction-mode-updated",
-      "thread.model-selection-updated",
-      "thread.provider-switched",
-      "thread.guest-share-updated",
-    ];
-    // Read-state events preserve updatedAt and supersede only each other. Activity events supersede both groups.
-    const READ_STATE_THREAD_EVENT_TYPES = ["thread.visited", "thread.marked-unread"];
-    // Older clients skip tag events, so these supersede only each other.
-    const TAG_THREAD_EVENT_TYPE = "thread.tags-updated";
-
-    const supersedableThreadEventTypes = new Set(SUPERSEDABLE_THREAD_EVENT_TYPES);
-    const readStateThreadEventTypes = new Set(READ_STATE_THREAD_EVENT_TYPES);
-    // Subagent snapshots stay intact because later rows can reference an earlier prompt.
-    // Commanded turn items stay for command-result replay.
-    // Small pages bound work on the reader worker and synchronous fallback.
-    const COMPACTION_PAGE_SIZE = 50;
-
-    // Keep first/latest keyed events for replay order; page every event to bound sparse scans.
-    const compactEventStore = Effect.fn("ProjectionMaintenance.compactEventStore")(function* (
-      betweenPages: Effect.Effect<void> = Effect.void,
+    const pruneEvents = Effect.fnUntraced(function* (
+      throughSequence: number,
+      head: number,
+      betweenPages: Effect.Effect<void>,
     ) {
-      const bounds = yield* sql<{
-        readonly event_sequence: number;
-        readonly receipt_row_id: number;
-      }>`
-        SELECT
-          COALESCE((SELECT MAX(sequence) FROM orchestration_events), 0) AS event_sequence,
-          COALESCE((SELECT MAX(rowid) FROM orchestration_command_receipts), 0) AS receipt_row_id
+      const referenced = yield* readPromptReferences(throughSequence, head, betweenPages);
+      // Stream heads at or below the boundary are kept, so the anchors they borrow must stay too.
+      const keptHeadReferences = yield* sql<{ readonly prompt_sequence: number }>`
+        SELECT json_extract(event.payload_json, '$.promptSequence') AS prompt_sequence
+        FROM (
+          SELECT MAX(sequence) AS sequence FROM orchestration_events
+          GROUP BY aggregate_kind, stream_id
+        ) AS heads
+        JOIN orchestration_events AS event ON event.sequence = heads.sequence
+        WHERE heads.sequence <= ${throughSequence}
+          AND event.event_type IN ('subagent.updated', 'turn-item.updated')
+          AND json_type(event.payload_json, '$.promptSequence') = 'integer'
       `.pipe(NodeSqliteClient.readOnly);
-      let throughSequence = bounds[0]?.event_sequence ?? 0;
-      let throughReceiptRowId = bounds[0]?.receipt_row_id ?? 0;
-      const retainedThreadIds = new Set<string>();
-      const retainedReadStateThreadIds = new Set<string>();
-      const retainedTagThreadIds = new Set<string>();
-      // Retain each key's oldest candidate, deleting it only when an older event appears.
-      const oldestCandidateByEntityKey = new Map<string, number | null>();
-      let deletedEventCount = 0;
-      let deletedReceiptCount = 0;
-
-      while (throughSequence > 0) {
-        const rows = yield* sql<{
-          readonly sequence: number;
-          readonly application_event_version: number;
-          readonly aggregate_kind: string;
-          readonly stream_id: string;
-          readonly event_type: string;
-          readonly entity_id: string | null;
-          readonly imported_legacy_thread: number;
-        }>`
+      for (const row of keptHeadReferences) referenced.add(row.prompt_sequence);
+      yield* betweenPages;
+      let referencesThrough = head;
+      let deleted = 0;
+      let cursor = 0;
+      while (cursor < throughSequence) {
+        const rows = yield* sql<{ readonly sequence: number; readonly prunable: number }>`
           SELECT
             event.sequence,
-            event.application_event_version,
-            event.aggregate_kind,
-            event.stream_id,
-            event.event_type,
-            CASE
-              WHEN event.application_event_version = 2
-                AND event.event_type IN ('message.updated', 'node.updated')
-              THEN json_extract(event.payload_json, '$.id')
-              WHEN event.application_event_version = 2
-                AND event.event_type = 'turn-item.updated'
-                AND event.command_id IS NULL
-                AND json_extract(event.payload_json, '$.type') <> 'subagent'
-              THEN json_extract(event.payload_json, '$.id')
-              WHEN event.application_event_version = 2
-                AND event.event_type = 'thread.pull-request-link-updated'
-              THEN json_array(json_extract(event.payload_json, '$.host'),
-                json_extract(event.payload_json, '$.repository'),
-                json_extract(event.payload_json, '$.number'))
-              ELSE NULL
-            END AS entity_id,
             CASE
-              WHEN event.application_event_version = 1 AND event.aggregate_kind = 'thread'
-              THEN EXISTS (
-                SELECT 1 FROM orchestration_v2_legacy_imports AS legacy_import
-                WHERE legacy_import.thread_id = event.stream_id
-                  AND legacy_import.transcript_imported_at IS NOT NULL
-              )
-              ELSE 0
-            END AS imported_legacy_thread
+              WHEN event.application_event_version = 1 THEN 0
+              -- The legacy importer treats a thread without thread.created as not yet imported.
+              WHEN event.event_type = 'thread.created' THEN 0
+              -- Codex usage history reads the selection a run attempt started with.
+              WHEN event.event_type = 'run.updated'
+                AND json_extract(event.payload_json, '$.status') = 'running' THEN 0
+              -- The newest row keeps each stream's high water, stream_version, and snapshot sequence.
+              WHEN event.sequence = (
+                SELECT MAX(newer.sequence) FROM orchestration_events AS newer
+                WHERE newer.aggregate_kind = event.aggregate_kind
+                  AND newer.stream_id = event.stream_id
+              ) THEN 0
+              ELSE 1
+            END AS prunable
           FROM orchestration_events AS event
-          WHERE event.sequence <= ${throughSequence}
-          ORDER BY event.sequence DESC
-          LIMIT ${COMPACTION_PAGE_SIZE + 1}
+          WHERE event.sequence > ${cursor}
+            AND event.sequence <= ${throughSequence}
+          ORDER BY event.sequence ASC
+          LIMIT ${PAGE_SIZE}
         `.pipe(NodeSqliteClient.readOnly);
-        const page = rows.slice(0, COMPACTION_PAGE_SIZE);
-        const obsolete: number[] = [];
-        for (const row of page) {
-          if (row.imported_legacy_thread === 1) {
-            obsolete.push(row.sequence);
-          } else if (row.application_event_version === 2) {
-            if (
-              row.aggregate_kind === "thread" &&
-              supersedableThreadEventTypes.has(row.event_type)
-            ) {
-              if (retainedThreadIds.has(row.stream_id)) obsolete.push(row.sequence);
-              else retainedThreadIds.add(row.stream_id);
-            } else if (
-              row.aggregate_kind === "thread" &&
-              readStateThreadEventTypes.has(row.event_type)
-            ) {
-              if (
-                retainedThreadIds.has(row.stream_id) ||
-                retainedReadStateThreadIds.has(row.stream_id)
-              ) {
-                obsolete.push(row.sequence);
-              } else retainedReadStateThreadIds.add(row.stream_id);
-            } else if (
-              row.aggregate_kind === "thread" &&
-              row.event_type === TAG_THREAD_EVENT_TYPE
-            ) {
-              if (retainedThreadIds.has(row.stream_id) || retainedTagThreadIds.has(row.stream_id)) {
-                obsolete.push(row.sequence);
-              } else retainedTagThreadIds.add(row.stream_id);
-            } else if (
-              row.event_type === "thread.pull-request-link-updated" &&
-              retainedThreadIds.has(row.stream_id)
-            ) {
-              // A newer whole-thread payload already carries this link's state.
-              obsolete.push(row.sequence);
-            } else if (
-              row.event_type === "thread.pull-request-link-updated" ||
-              row.event_type === "message.updated" ||
-              row.event_type === "node.updated" ||
-              (row.event_type === "turn-item.updated" && row.entity_id !== null)
-            ) {
-              const key = encodeEntityKey([row.event_type, row.stream_id, row.entity_id]);
-              const candidate = oldestCandidateByEntityKey.get(key);
-              if (candidate === undefined) oldestCandidateByEntityKey.set(key, null);
-              else {
-                if (candidate !== null) obsolete.push(candidate);
-                oldestCandidateByEntityKey.set(key, row.sequence);
+        const candidates = rows.filter((row) => row.prunable === 1).map((row) => row.sequence);
+        // Never hold a transaction or the reader lock across a yield or a rest.
+        yield* Effect.yieldNow;
+        if (candidates.length > 0) {
+          deleted += yield* sql.withTransaction(
+            Effect.gen(function* () {
+              // Rows appended since the reference scan may borrow a prompt from a candidate.
+              const appended = yield* sql<{
+                readonly sequence: number;
+                readonly prompt_sequence: number | null;
+              }>`
+                SELECT
+                  sequence,
+                  CASE
+                    WHEN event_type IN ('subagent.updated', 'turn-item.updated')
+                      AND json_type(payload_json, '$.promptSequence') = 'integer'
+                    THEN json_extract(payload_json, '$.promptSequence')
+                  END AS prompt_sequence
+                FROM orchestration_events
+                WHERE sequence > ${referencesThrough}
+              `;
+              for (const row of appended) {
+                if (row.prompt_sequence !== null) referenced.add(row.prompt_sequence);
+                referencesThrough = Math.max(referencesThrough, row.sequence);
               }
-            }
-          }
+              const obsolete = candidates.filter((sequence) => !referenced.has(sequence));
+              if (obsolete.length === 0) return 0;
+              yield* sql`DELETE FROM orchestration_events WHERE sequence IN ${sql.in(obsolete)}`;
+              return obsolete.length;
+            }),
+          );
+          yield* Effect.yieldNow;
         }
-        // Never hold a transaction or the reader lock across a yield or a rest.
+        // Rest after every page, including the last, so the next loop starts a fresh slice.
+        yield* betweenPages;
+        if (rows.length < PAGE_SIZE) break;
+        cursor = rows.at(-1)?.sequence ?? throughSequence;
+      }
+      return deleted;
+    });
+
+    // Imported legacy threads are served from v2 rows; their v1 events and receipts have no reader.
+    const pruneImportedLegacyHistory = Effect.fnUntraced(function* (
+      throughSequence: number,
+      throughReceiptRowId: number,
+      betweenPages: Effect.Effect<void>,
+    ) {
+      let deletedEventCount = 0;
+      let deletedReceiptCount = 0;
+      for (let cursor = 0; ;) {
+        const rows = yield* sql<{ readonly sequence: number; readonly imported: number }>`
+          SELECT
+            event.sequence,
+            event.aggregate_kind = 'thread' AND EXISTS (
+              SELECT 1 FROM orchestration_v2_legacy_imports AS legacy_import
+              WHERE legacy_import.thread_id = event.stream_id
+                AND legacy_import.transcript_imported_at IS NOT NULL
+            ) AS imported
+          FROM orchestration_events AS event
+            INDEXED BY idx_orchestration_events_application_sequence
+          WHERE event.application_event_version = 1
+            AND event.sequence > ${cursor}
+            AND event.sequence <= ${throughSequence}
+          ORDER BY event.sequence ASC
+          LIMIT ${PAGE_SIZE}
+        `.pipe(NodeSqliteClient.readOnly);
+        const obsolete = rows.filter((row) => row.imported === 1).map((row) => row.sequence);
         yield* Effect.yieldNow;
         if (obsolete.length > 0) {
           yield* sql`DELETE FROM orchestration_events WHERE sequence IN ${sql.in(obsolete)}`;
           deletedEventCount += obsolete.length;
           yield* Effect.yieldNow;
         }
-        throughSequence =
-          rows.length <= COMPACTION_PAGE_SIZE ? 0 : (page.at(-1)?.sequence ?? 1) - 1;
-        if (throughSequence > 0 || throughReceiptRowId > 0) yield* betweenPages;
+        yield* betweenPages;
+        if (rows.length < PAGE_SIZE) break;
+        cursor = rows.at(-1)?.sequence ?? cursor;
       }
-
-      while (throughReceiptRowId > 0) {
+      for (let cursor = 0; ;) {
         const rows = yield* sql<{
           readonly row_id: number;
           readonly command_id: string;
-          readonly imported_legacy_thread: number;
+          readonly imported: number;
         }>`
           SELECT
             receipt.rowid AS row_id,
             receipt.command_id,
-            CASE
-              WHEN receipt.command_type = 'legacy' AND receipt.aggregate_kind = 'thread'
-              THEN EXISTS (
-                SELECT 1 FROM orchestration_v2_legacy_imports AS legacy_import
-                WHERE legacy_import.thread_id = receipt.aggregate_id
-                  AND legacy_import.transcript_imported_at IS NOT NULL
-              )
-              ELSE 0
-            END AS imported_legacy_thread
+            receipt.command_type = 'legacy' AND receipt.aggregate_kind = 'thread' AND EXISTS (
+              SELECT 1 FROM orchestration_v2_legacy_imports AS legacy_import
+              WHERE legacy_import.thread_id = receipt.aggregate_id
+                AND legacy_import.transcript_imported_at IS NOT NULL
+            ) AS imported
           FROM orchestration_command_receipts AS receipt
-          WHERE receipt.rowid <= ${throughReceiptRowId}
-          ORDER BY receipt.rowid DESC
-          LIMIT ${COMPACTION_PAGE_SIZE + 1}
+          WHERE receipt.rowid > ${cursor} AND receipt.rowid <= ${throughReceiptRowId}
+          ORDER BY receipt.rowid ASC
+          LIMIT ${PAGE_SIZE}
         `.pipe(NodeSqliteClient.readOnly);
-        const page = rows.slice(0, COMPACTION_PAGE_SIZE);
-        const obsolete = page
-          .filter((row) => row.imported_legacy_thread === 1)
-          .map((row) => row.command_id);
+        const obsolete = rows.filter((row) => row.imported === 1).map((row) => row.command_id);
         yield* Effect.yieldNow;
         if (obsolete.length > 0) {
           yield* sql`DELETE FROM orchestration_command_receipts WHERE command_id IN ${sql.in(obsolete)}`;
           deletedReceiptCount += obsolete.length;
           yield* Effect.yieldNow;
         }
-        throughReceiptRowId = (page.at(-1)?.row_id ?? 1) - 1;
-        if (rows.length <= COMPACTION_PAGE_SIZE) break;
         yield* betweenPages;
+        if (rows.length < PAGE_SIZE) break;
+        cursor = rows.at(-1)?.row_id ?? cursor;
       }
+      return { deletedEventCount, deletedReceiptCount };
+    });
 
-      const freelistRows = yield* sql<{ readonly freelist_count: number }>`PRAGMA freelist_count`;
-      const pageSizeRows = yield* sql<{ readonly page_size: number }>`PRAGMA page_size`;
-      const reclaimableBytes =
-        (freelistRows[0]?.freelist_count ?? 0) * (pageSizeRows[0]?.page_size ?? 0);
+    // A pass prunes through the mark the previous pass left once that mark is a day old, so
+    // at least RETAINED_EVENT_HISTORY of events always remains. Receipts stay for idempotency.
+    const pruneEventStore = Effect.fn("ProjectionMaintenance.pruneEventStore")(
+      function* (betweenPages: Effect.Effect<void> = Effect.void) {
+        const now = yield* DateTime.now;
+        const metadata = yield* sql<MetadataRow>`
+          SELECT projection_name, last_sequence, updated_at
+          FROM orchestration_v2_projection_metadata
+          WHERE projection_name IN (
+            'thread-projections', ${EVENT_LOG_PRUNE_MARK}, ${EVENT_LOG_PRUNED_THROUGH}
+          )
+        `.pipe(NodeSqliteClient.readOnly);
+        const read = (name: string) => metadata.find((row) => row.projection_name === name);
+        const projected = read("thread-projections")?.last_sequence ?? 0;
+        const mark = read(EVENT_LOG_PRUNE_MARK);
+        const prunedThrough = read(EVENT_LOG_PRUNED_THROUGH)?.last_sequence ?? 0;
+        // Fixed bounds: foreground commits during the pass wait for the next one.
+        const bounds = yield* sql<{ readonly sequence: number; readonly receipt_row_id: number }>`
+          SELECT
+            COALESCE((SELECT MAX(sequence) FROM orchestration_events), 0) AS sequence,
+            COALESCE((SELECT MAX(rowid) FROM orchestration_command_receipts), 0) AS receipt_row_id
+        `.pipe(NodeSqliteClient.readOnly);
+        const head = bounds[0]?.sequence ?? 0;
 
-      return { deletedEventCount, deletedReceiptCount, reclaimableBytes };
-    }, mapError("compact event store"));
+        let deletedEventCount = 0;
+        const markIsDue =
+          mark !== undefined &&
+          DateTime.toEpochMillis(now) - Date.parse(mark.updated_at) >=
+            Duration.toMillis(RETAINED_EVENT_HISTORY);
+        if (mark !== undefined && markIsDue) {
+          const throughSequence = Math.max(Math.min(mark.last_sequence, projected), prunedThrough);
+          if (throughSequence > prunedThrough) {
+            // Publish the boundary first so resuming clients take a snapshot, never a partial replay.
+            yield* writeMetadata(EVENT_LOG_PRUNED_THROUGH, throughSequence, now);
+          }
+          deletedEventCount += yield* pruneEvents(throughSequence, head, betweenPages);
+        }
+        if (mark === undefined || markIsDue) yield* writeMetadata(EVENT_LOG_PRUNE_MARK, head, now);
 
-    return ProjectionMaintenanceV2.of({
-      verify: mapError("verify")(verify),
-      rebuild: mapError("rebuild")(rebuild),
-      compactEventStore,
-    });
+        const legacy = yield* pruneImportedLegacyHistory(
+          head,
+          bounds[0]?.receipt_row_id ?? 0,
+          betweenPages,
+        );
+        deletedEventCount += legacy.deletedEventCount;
+
+        const freelistRows = yield* sql<{ readonly freelist_count: number }>`PRAGMA freelist_count`;
+        const pageSizeRows = yield* sql<{ readonly page_size: number }>`PRAGMA page_size`;
+        const reclaimableBytes =
+          (freelistRows[0]?.freelist_count ?? 0) * (pageSizeRows[0]?.page_size ?? 0);
+
+        return {
+          deletedEventCount,
+          deletedReceiptCount: legacy.deletedReceiptCount,
+          reclaimableBytes,
+        };
+      },
+      Effect.mapError(
+        (cause) => new ProjectionMaintenanceError({ operation: "prune event store", cause }),
+      ),
+    );
+
+    return ProjectionMaintenanceV2.of({ pruneEventStore });
   }),
 );
diff --git a/apps/server/src/orchestration-v2/TurnItemCompaction.test.ts b/apps/server/src/orchestration-v2/TurnItemCompaction.test.ts
deleted file mode 100644
index 5799c5fbdcd31..0000000000000
--- a/apps/server/src/orchestration-v2/TurnItemCompaction.test.ts
+++ /dev/null
@@ -1,488 +0,0 @@
-import { applyOrchestrationV2ProjectionEvent } from "../../../../packages/client-runtime/src/state/orchestrationV2Projection.ts";
-import { assert, it } from "@effect/vitest";
-import {
-  CommandId,
-  EventId,
-  NodeId,
-  PlanId,
-  type OrchestrationV2AppThread,
-  type OrchestrationV2DomainEvent,
-  type OrchestrationV2TurnItem,
-  ProjectId,
-  ProviderDriverKind,
-  ProviderInstanceId,
-  ThreadId,
-  TurnItemId,
-} from "@t3tools/contracts";
-import * as DateTime from "effect/DateTime";
-import * as Deferred from "effect/Deferred";
-import * as Effect from "effect/Effect";
-import * as Fiber from "effect/Fiber";
-import * as Layer from "effect/Layer";
-import * as Stream from "effect/Stream";
-import * as Tracer from "effect/Tracer";
-import * as SqlClient from "effect/sql/SqlClient";
-import * as Statement from "effect/sql/Statement";
-
-import * as SqlitePersistence from "../persistence/Sqlite.ts";
-import * as EventSink from "./EventSink.ts";
-import * as EventStore from "./EventStore.ts";
-import * as ProjectionMaintenance from "./ProjectionMaintenance.ts";
-import * as ProjectionStore from "./ProjectionStore.ts";
-
-const database = SqlitePersistence.layerMemory;
-const eventStoreProvided = EventStore.layer.pipe(Layer.provideMerge(database));
-const projectionStoreProvided = ProjectionStore.layer.pipe(Layer.provideMerge(database));
-const stores = Layer.mergeAll(database, eventStoreProvided, projectionStoreProvided);
-const layerTest = Layer.mergeAll(
-  stores,
-  EventSink.layer.pipe(Layer.provide(stores)),
-  ProjectionMaintenance.layer.pipe(Layer.provide(stores)),
-);
-
-const providerInstanceId = ProviderInstanceId.make("codex");
-const providerDriver = ProviderDriverKind.make("codex");
-const modelSelection = { instanceId: providerInstanceId, model: "gpt-5.4" };
-
-function makeThread(threadId: ThreadId, now: DateTime.Utc): OrchestrationV2AppThread {
-  return {
-    id: threadId,
-    projectId: ProjectId.make(`project:${threadId}`),
-    title: "Turn item compaction",
-    providerInstanceId,
-    modelSelection,
-    runtimeMode: "full-access",
-    interactionMode: "default",
-    branch: null,
-    worktreePath: null,
-    activeProviderThreadId: null,
-    lineage: { rootThreadId: threadId, parentThreadId: null, relationshipToParent: null },
-    forkedFrom: null,
-    createdBy: "user",
-    creationSource: "web",
-    createdAt: now,
-    updatedAt: now,
-    archivedAt: null,
-    settledOverride: null,
-    settledAt: null,
-    lastVisitedAt: null,
-    deletedAt: null,
-  };
-}
-
-function threadCreated(thread: OrchestrationV2AppThread, now: DateTime.Utc) {
-  return {
-    id: EventId.make("event:turn-item-compaction:thread"),
-    type: "thread.created",
-    threadId: thread.id,
-    providerInstanceId,
-    occurredAt: now,
-    payload: thread,
-  } satisfies OrchestrationV2DomainEvent;
-}
-
-const itemSpecs = [
-  { key: "command", type: "command_execution", ordinal: 10 },
-  { key: "reasoning", type: "reasoning", ordinal: 20 },
-  { key: "todo", type: "todo_list", ordinal: 30 },
-  { key: "commanded", type: "command_execution", ordinal: 40 },
-] as const;
-
-function itemEvent(
-  threadId: ThreadId,
-  now: DateTime.Utc,
-  spec: (typeof itemSpecs)[number],
-  revision: number,
-  eventId = `event:turn-item-compaction:${spec.key}:${revision}`,
-): OrchestrationV2DomainEvent {
-  const id = TurnItemId.make(`turn-item:compaction:${spec.key}`);
-  const growing = `${spec.key}:${revision}:` + "x".repeat((revision + 1) * 192);
-  const completed = revision === 69;
-  const base = {
-    id,
-    threadId,
-    runId: null,
-    nodeId: null,
-    providerThreadId: null,
-    providerTurnId: null,
-    nativeItemRef: null,
-    parentItemId: null,
-    ordinal: spec.ordinal,
-    status: completed ? ("completed" as const) : ("running" as const),
-    title: spec.key,
-    startedAt: now,
-    completedAt: completed ? now : null,
-    updatedAt: now,
-  };
-  let payload: OrchestrationV2TurnItem;
-  switch (spec.type) {
-    case "command_execution":
-      payload = {
-        ...base,
-        type: "command_execution",
-        input: `run ${spec.key}`,
-        output: growing,
-      };
-      break;
-    case "reasoning":
-      payload = { ...base, type: "reasoning", text: growing, streaming: !completed };
-      break;
-    case "todo_list":
-      payload = {
-        ...base,
-        type: "todo_list",
-        planId: PlanId.make("plan:turn-item-compaction"),
-        steps: [{ id: "step", text: growing, status: completed ? "completed" : "running" }],
-        explanation: growing,
-      };
-      break;
-  }
-  return {
-    id: EventId.make(eventId),
-    type: "turn-item.updated",
-    threadId,
-    occurredAt: now,
-    payload,
-  };
-}
-
-function subagentEvents(
-  threadId: ThreadId,
-  now: DateTime.Utc,
-  revision: number,
-): ReadonlyArray<OrchestrationV2DomainEvent> {
-  const id = NodeId.make("subagent:turn-item-compaction");
-  const prompt = revision === 0 ? "Review prompt A. ".repeat(40) : "Review prompt B. ".repeat(40);
-  const progress = `Review progress ${revision}`;
-  return [
-    {
-      id: EventId.make(`event:turn-item-compaction:subagent:${revision}`),
-      type: "subagent.updated",
-      threadId,
-      occurredAt: now,
-      payload: {
-        id,
-        threadId,
-        runId: null,
-        parentNodeId: NodeId.make("node:turn-item-compaction-parent"),
-        origin: "provider_native",
-        createdBy: "agent",
-        driver: providerDriver,
-        providerInstanceId,
-        providerThreadId: null,
-        childThreadId: null,
-        nativeTaskRef: {
-          driver: providerDriver,
-          nativeId: "compaction-review",
-          strength: "strong",
-        },
-        prompt,
-        progress,
-        title: "Review",
-        model: null,
-        status: "running",
-        result: null,
-        startedAt: now,
-        completedAt: null,
-        updatedAt: now,
-      },
-    },
-    {
-      id: EventId.make(`event:turn-item-compaction:subagent-item:${revision}`),
-      type: "turn-item.updated",
-      threadId,
-      occurredAt: now,
-      payload: {
-        id: TurnItemId.make("turn-item:compaction:subagent"),
-        threadId,
-        runId: null,
-        nodeId: null,
-        providerThreadId: null,
-        providerTurnId: null,
-        nativeItemRef: null,
-        parentItemId: null,
-        ordinal: 50,
-        status: "running",
-        title: "Review",
-        startedAt: now,
-        completedAt: null,
-        updatedAt: now,
-        type: "subagent",
-        subagentId: id,
-        origin: "provider_native",
-        driver: providerDriver,
-        providerInstanceId,
-        childThreadId: null,
-        prompt,
-        progress,
-        result: null,
-      },
-    },
-  ] satisfies ReadonlyArray<OrchestrationV2DomainEvent>;
-}
-
-it.effect(
-  "compacts ordinary snapshots while preserving replay, prompts, command lookup, and positions",
-  () =>
-    Effect.gen(function* () {
-      const sink = yield* EventSink.EventSinkV2;
-      const eventStore = yield* EventStore.EventStoreV2;
-      const projections = yield* ProjectionStore.ProjectionStoreV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-      const sql = yield* SqlClient.SqlClient;
-      const now = yield* DateTime.now;
-      const threadId = ThreadId.make("thread:turn-item-compaction");
-      const thread = makeThread(threadId, now);
-      const writes = [...(yield* sink.write({ events: [threadCreated(thread, now)] }))];
-      const commandId = CommandId.make("command:turn-item-compaction:middle");
-      const snapshotsPerItem = 70;
-      for (let revision = 0; revision < snapshotsPerItem; revision += 1) {
-        const order =
-          revision === 0
-            ? [itemSpecs[0], itemSpecs[1], itemSpecs[2], itemSpecs[3]]
-            : [itemSpecs[1], itemSpecs[0], itemSpecs[2], itemSpecs[3]];
-        const events = order
-          .filter((spec) => spec.key !== "commanded" || revision !== 35)
-          .map((spec) => itemEvent(threadId, now, spec, revision));
-        if (revision < 3) events.push(...subagentEvents(threadId, now, revision));
-        const stored = yield* sink.write({ events });
-        writes.push(...stored);
-        if (revision === 35) {
-          const middle = itemEvent(
-            threadId,
-            now,
-            itemSpecs[3],
-            revision,
-            "event:turn-item-compaction:commanded:middle",
-          );
-          writes.push(...(yield* sink.write({ commandId, events: [middle] })));
-        }
-      }
-      const beforeProjection = yield* projections.getThreadProjection(threadId);
-      const highWater = yield* eventStore.latestSequence();
-      const bytes = yield* sql<{ readonly rows: number; readonly payload_bytes: number }>`
-      SELECT COUNT(*) AS rows, COALESCE(SUM(octet_length(payload_json)), 0) AS payload_bytes
-      FROM orchestration_events WHERE stream_id = ${threadId}
-    `;
-      const summary = yield* maintenance.compactEventStore();
-      const replay = yield* eventStore.read({ threadId }).pipe(Stream.runCollect);
-      const expectedIds = new Set([
-        "event:turn-item-compaction:thread",
-        ...itemSpecs.flatMap((spec) => [
-          `event:turn-item-compaction:${spec.key}:0`,
-          `event:turn-item-compaction:${spec.key}:${snapshotsPerItem - 1}`,
-        ]),
-        "event:turn-item-compaction:commanded:middle",
-        ...Array.from({ length: 3 }, (_, revision) => [
-          `event:turn-item-compaction:subagent:${revision}`,
-          `event:turn-item-compaction:subagent-item:${revision}`,
-        ]).flat(),
-      ]);
-      assert.deepEqual(
-        replay,
-        writes.filter((stored) => expectedIds.has(stored.event.id)),
-      );
-      assert.lengthOf(replay, 16);
-      assert.equal(summary.deletedEventCount, bytes[0]!.rows - replay.length);
-      assert.isBelow(
-        (yield* sql<{ readonly payload_bytes: number }>`
-        SELECT COALESCE(SUM(octet_length(payload_json)), 0) AS payload_bytes
-        FROM orchestration_events WHERE stream_id = ${threadId}
-      `)[0]!.payload_bytes,
-        bytes[0]!.payload_bytes,
-      );
-      assert.equal(yield* eventStore.latestSequence(), highWater);
-
-      const commanded = yield* sink.readByCommandId({ commandId }).pipe(Stream.runCollect);
-      assert.deepEqual(
-        commanded.map((stored) => stored.event.id),
-        [EventId.make("event:turn-item-compaction:commanded:middle")],
-      );
-      const storedPrompts = yield* sql<{
-        readonly event_id: string;
-        readonly sequence: number;
-        readonly prompt: string;
-        readonly prompt_sequence: number | null;
-      }>`
-      SELECT event_id, sequence,
-        json_extract(payload_json, '$.prompt') AS prompt,
-        json_extract(payload_json, '$.promptSequence') AS prompt_sequence
-      FROM orchestration_events
-      WHERE stream_id = ${threadId} AND event_type = 'subagent.updated'
-      ORDER BY sequence ASC
-    `;
-      assert.lengthOf(storedPrompts, 3);
-      assert.equal(storedPrompts[0]!.prompt_sequence, null);
-      assert.equal(storedPrompts[1]!.prompt_sequence, null);
-      assert.equal(storedPrompts[2]!.prompt, "");
-      assert.equal(storedPrompts[2]!.prompt_sequence, storedPrompts[1]!.sequence);
-
-      const deletedCursor = writes.find(
-        (stored) => stored.event.id === "event:turn-item-compaction:command:35",
-      )!.sequence;
-      assert.isFalse(replay.some((stored) => stored.sequence === deletedCursor));
-      const cursors = [0, deletedCursor, highWater];
-      for (const cursor of cursors) {
-        const cursorReplay = yield* eventStore
-          .read({ threadId, afterSequence: cursor, throughSequence: highWater })
-          .pipe(Stream.runCollect);
-        const expected = replay.filter((stored) => stored.sequence > cursor);
-        assert.deepEqual(
-          cursorReplay.map((stored) => stored.sequence),
-          expected.map((stored) => stored.sequence),
-        );
-
-        let clientProjection: typeof beforeProjection | null = {
-          ...beforeProjection,
-          subagents: [],
-          turnItems: [],
-          visibleTurnItems: [],
-        };
-        let latestLocalTurnOrdinal: number | null = null;
-        for (const stored of [
-          ...writes.filter((entry) => entry.sequence <= cursor),
-          ...cursorReplay,
-        ]) {
-          clientProjection = applyOrchestrationV2ProjectionEvent(clientProjection, stored.event, {
-            partialTimeline: true,
-            latestLocalTurnOrdinal,
-          });
-          if (stored.event.type === "turn-item.updated") {
-            latestLocalTurnOrdinal = Math.max(
-              latestLocalTurnOrdinal ?? 0,
-              stored.event.payload.ordinal,
-            );
-          }
-        }
-        assert.deepEqual(clientProjection?.turnItems, beforeProjection.turnItems);
-        assert.deepEqual(clientProjection?.visibleTurnItems, beforeProjection.visibleTurnItems);
-      }
-      assert.isTrue((yield* maintenance.verify).valid);
-      assert.isTrue((yield* maintenance.rebuild).valid);
-      assert.deepEqual(yield* projections.getThreadProjection(threadId), beforeProjection);
-      const positions = yield* sql<{
-        readonly turn_item_id: string;
-        readonly ordinal: number;
-      }>`
-      SELECT turn_item_id, ordinal
-      FROM orchestration_v2_turn_item_positions
-      WHERE thread_id = ${threadId}
-      ORDER BY ordinal ASC
-    `;
-      assert.deepEqual(
-        positions.map((row) => [row.turn_item_id, row.ordinal]),
-        [
-          ...itemSpecs.map((spec, index) => [`turn-item:compaction:${spec.key}`, index + 1]),
-          ["turn-item:compaction:subagent", 5],
-        ],
-      );
-    }).pipe(Effect.provide(layerTest)),
-);
-
-it.effect("keeps post-bound appends visible during compaction", () =>
-  Effect.scoped(
-    Effect.gen(function* () {
-      const sink = yield* EventSink.EventSinkV2;
-      const eventStore = yield* EventStore.EventStoreV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-      const now = yield* DateTime.now;
-      const threadId = ThreadId.make("thread:turn-item-compaction-race");
-      const thread = makeThread(threadId, now);
-      const initial = yield* sink.write({
-        events: [
-          threadCreated(thread, now),
-          ...[0, 1, 2].map((revision) => itemEvent(threadId, now, itemSpecs[0], revision)),
-        ],
-      });
-      const beforeSequence = initial.at(-1)!.sequence;
-
-      const streamReady = yield* Deferred.make<void>();
-      const streamTracer = Tracer.make({
-        span(options) {
-          const span = new Tracer.NativeSpan(options);
-          const end = span.end.bind(span);
-          span.end = (endTime, exit) => {
-            end(endTime, exit);
-            const query = span.attributes.get("db.query.text");
-            if (typeof query === "string" && query.includes("MAX(sequence)")) {
-              Deferred.doneUnsafe(streamReady, Effect.void);
-            }
-          };
-          return span;
-        },
-      });
-      const liveEvents = yield* sink
-        .stream({ threadId, afterSequence: beforeSequence })
-        .pipe(
-          Stream.take(3),
-          Stream.runCollect,
-          Effect.withTracer(streamTracer),
-          Effect.forkScoped,
-        );
-      yield* Deferred.await(streamReady);
-
-      const scanStarted = yield* Deferred.make<void>();
-      const releaseScan = yield* Deferred.make<void>();
-      let blocked = false;
-      const blockFirstScanPage: Statement.Transformer = (statement) => {
-        const [query] = statement.compile();
-        if (
-          !blocked &&
-          query.includes("FROM orchestration_events AS event") &&
-          query.includes("ORDER BY event.sequence DESC")
-        ) {
-          blocked = true;
-          return Deferred.succeed(scanStarted, undefined).pipe(
-            Effect.andThen(Deferred.await(releaseScan)),
-            Effect.as(statement),
-          );
-        }
-        return Effect.succeed(statement);
-      };
-      const compaction = yield* maintenance
-        .compactEventStore()
-        .pipe(
-          Effect.provideService(Statement.CurrentTransformer, blockFirstScanPage),
-          Effect.forkScoped,
-        );
-      yield* Deferred.await(scanStarted);
-      const snapshots = [3, 4, 5].map((revision) =>
-        itemEvent(
-          threadId,
-          now,
-          itemSpecs[0],
-          revision,
-          `event:turn-item-compaction-race:${revision}`,
-        ),
-      );
-      const appended = yield* sink.write({ events: snapshots });
-      yield* Deferred.succeed(releaseScan, undefined);
-      assert.equal((yield* Fiber.join(compaction)).deletedEventCount, 1);
-      const streamed = yield* Fiber.join(liveEvents);
-      assert.deepEqual(
-        streamed.map((stored) => stored.sequence),
-        appended.map((stored) => stored.sequence),
-      );
-      assert.deepEqual(
-        streamed.map((stored) => stored.event.id),
-        snapshots.map((event) => event.id),
-      );
-      assert.equal(yield* eventStore.latestSequence(), appended.at(-1)!.sequence);
-      const firstPassRows = yield* eventStore
-        .read({ threadId, eventType: "turn-item.updated" })
-        .pipe(Stream.runCollect);
-      assert.deepEqual(
-        firstPassRows.map((stored) => stored.sequence),
-        [initial[1]!.sequence, beforeSequence, ...appended.map((stored) => stored.sequence)],
-      );
-      yield* maintenance.compactEventStore();
-      const secondPassRows = yield* eventStore
-        .read({ threadId, eventType: "turn-item.updated" })
-        .pipe(Stream.runCollect);
-      assert.deepEqual(
-        secondPassRows.map((stored) => stored.sequence),
-        [initial[1]!.sequence, appended.at(-1)!.sequence],
-      );
-    }),
-  ).pipe(Effect.provide(layerTest)),
-);
diff --git a/apps/server/src/orchestration-v2/legacy/LegacyV1Cutover.integration.test.ts b/apps/server/src/orchestration-v2/legacy/LegacyV1Cutover.integration.test.ts
index 5d2343f6a1ea6..83c34c7edab17 100644
--- a/apps/server/src/orchestration-v2/legacy/LegacyV1Cutover.integration.test.ts
+++ b/apps/server/src/orchestration-v2/legacy/LegacyV1Cutover.integration.test.ts
@@ -42,7 +42,7 @@ import * as EventSink from "../EventSink.ts";
 import * as EventStore from "../EventStore.ts";
 import * as LegacyV1ThreadImporter from "./LegacyV1ThreadImporter.ts";
 import * as Orchestrator from "../Orchestrator.ts";
-import * as ProjectionMaintenance from "../ProjectionMaintenance.ts";
+import * as ProjectionReplay from "../testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "../ProjectionStore.ts";
 import * as ProviderAdapterRegistry from "../ProviderAdapterRegistry.ts";
 import * as ProviderReplayHarness from "../testkit/ProviderReplayHarness.ts";
@@ -600,9 +600,7 @@ const layerBoot = (input: {
   const layerImporterProvided = LegacyV1ThreadImporter.layer.pipe(
     Layer.provide(Layer.mergeAll(layerStoresProvided, layerEventSinkProvided)),
   );
-  const layerMaintenanceProvided = ProjectionMaintenance.layer.pipe(
-    Layer.provide(layerStoresProvided),
-  );
+  const layerMaintenanceProvided = ProjectionReplay.layer.pipe(Layer.provide(layerStoresProvided));
   const layerOrchestratorProvided = ProviderReplayHarness.layerWithRegistry(
     {
       name: input.name,
@@ -676,7 +674,7 @@ describe("orchestration v2 legacy v1 cutover", () => {
             Effect.gen(function* () {
               const sql = yield* SqlClient.SqlClient;
               const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-              const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+              const maintenance = yield* ProjectionReplay.ProjectionReplay;
               const projections = yield* ProjectionStore.ProjectionStoreV2;
               const orchestrator = yield* Orchestrator.OrchestratorV2;
 
diff --git a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
index 87059b7c1d0ae..50671194d46d2 100644
--- a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
+++ b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
@@ -19,7 +19,7 @@ import { listLinkedPullRequestThreads } from "../../pullRequest/linkedThreads.ts
 import * as EventSink from "../EventSink.ts";
 import * as EventStore from "../EventStore.ts";
 import * as LegacyV1ThreadImporter from "./LegacyV1ThreadImporter.ts";
-import * as ProjectionMaintenance from "../ProjectionMaintenance.ts";
+import * as ProjectionReplay from "../testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "../ProjectionStore.ts";
 
 const layerDatabase = SqlitePersistence.layerMemory;
@@ -34,14 +34,14 @@ const layerEventSinkProvided = EventSink.layer.pipe(Layer.provide(layerStoresPro
 const layerImporterProvided = LegacyV1ThreadImporter.layer.pipe(
   Layer.provide(Layer.mergeAll(layerStoresProvided, layerEventSinkProvided)),
 );
-const layerProjectionMaintenanceProvided = ProjectionMaintenance.layer.pipe(
+const layerProjectionReplayProvided = ProjectionReplay.layer.pipe(
   Layer.provide(layerStoresProvided),
 );
 const layerTest = Layer.mergeAll(
   layerStoresProvided,
   layerEventSinkProvided,
   layerImporterProvided,
-  layerProjectionMaintenanceProvided,
+  layerProjectionReplayProvided,
 );
 
 const seedPendingTranscripts = Effect.gen(function* () {
@@ -220,7 +220,7 @@ it.layer(layerTest)("LegacyV1ThreadImporter", (it) => {
     Effect.gen(function* () {
       const sql = yield* SqlClient.SqlClient;
       const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const projections = yield* ProjectionStore.ProjectionStoreV2;
       const eventSink = yield* EventSink.EventSinkV2;
       const threadId = ThreadId.make("thread:legacy-import");
@@ -605,7 +605,7 @@ it.layer(layerTest)("LegacyV1ThreadImporter", (it) => {
     Effect.gen(function* () {
       const sql = yield* SqlClient.SqlClient;
       const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const projections = yield* ProjectionStore.ProjectionStoreV2;
       const eventSink = yield* EventSink.EventSinkV2;
       const threadId = ThreadId.make("thread:legacy-metadata-upgrade");
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index b38fb737c91db..34d252457e63a 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -68,7 +68,8 @@ import * as EffectWorker from "./EffectWorker.ts";
 import * as EffectOutbox from "./EffectOutbox.ts";
 import * as EventSink from "./EventSink.ts";
 import * as ProviderRuntimeRecoveryService from "./ProviderRuntimeRecoveryService.ts";
-import * as ProjectionMaintenance from "./ProjectionMaintenance.ts";
+import * as EventStore from "./EventStore.ts";
+import * as ProjectionReplay from "./testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 import * as PullRequestWatchReactor from "./PullRequestWatchReactor.ts";
 import { PULL_REQUEST_WATCH_WAKE_LIMIT } from "./pullRequestWatch.ts";
@@ -277,8 +278,21 @@ const moveProject = (projectId: ProjectId, workspaceRoot: string, updatedAt: str
     }),
   );
 
+// Read-only oracle: projections still equal a replay of these unpruned test logs.
+const layerProjectionReplayTest = ProjectionReplay.layer.pipe(
+  Layer.provide(
+    Layer.merge(
+      EventStore.layerFromOrchestrationEventStore.pipe(
+        Layer.provide(RuntimeLayer.layerEventInfrastructure),
+      ),
+      ProjectionStore.layer,
+    ),
+  ),
+);
+
 const layerTest = Layer.mergeAll(
   RuntimeLayer.layer,
+  layerProjectionReplayTest,
   RuntimeLayer.layerEventSink,
   ProjectStore.layer,
   ProjectionStore.layer,
@@ -297,7 +311,7 @@ const layerTest = Layer.mergeAll(
   Layer.provide(layerPlatformTest),
 );
 
-const layerLegacyImportTest = RuntimeLayer.layer.pipe(
+const layerLegacyImportTest = Layer.merge(RuntimeLayer.layer, layerProjectionReplayTest).pipe(
   Layer.provide(McpSessionRegistryTestkit.layer),
   Layer.provide(McpProviderSessions.layer),
   Layer.provideMerge(SqlitePersistence.layerMemory),
@@ -817,6 +831,7 @@ it.layer(layerProjectDeletionTest)("project deletion during thread commands", (i
 });
 
 const layerSharedApplicationDataPlaneTest = Layer.mergeAll(
+  layerProjectionReplayTest,
   RuntimeLayer.layer.pipe(Layer.provide(RuntimeLayer.layerProjectService)),
   RuntimeLayer.layerProjectService,
   RuntimeLayer.layerEventSink,
@@ -2210,7 +2225,7 @@ it.layer(layerLegacyImportTest)("OrchestrationV2 legacy import", (it) => {
     Effect.gen(function* () {
       const sql = yield* SqlClient.SqlClient;
       const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const orchestrator = yield* Orchestrator.OrchestratorV2;
       const threadManagement = yield* ThreadManagementService.ThreadManagementService;
       const metadataThreadId = ThreadId.make("runtime-layer-legacy-metadata-thread");
@@ -2725,7 +2740,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
   it.effect("keeps the branch pull request when linking another pull request", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const threadId = ThreadId.make("branch-pr-link");
       const projectId = ProjectId.make("branch-pr-project");
       yield* seedProject({
@@ -2834,7 +2849,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
   it.effect("retains multiple pull requests and dismissed stack members through rebuilds", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const threadId = ThreadId.make("runtime-multiple-pull-requests");
       yield* orchestrator.dispatch({
         type: "thread.create",
@@ -2925,7 +2940,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
   it.effect("starts, records, and stops a pull request watch", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const threadId = ThreadId.make("runtime-pull-request-watch");
       yield* orchestrator.dispatch({
         type: "thread.create",
@@ -3017,7 +3032,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
   it.effect.each(["manual", "automatic"])("settling ends every pull request watch: %s", (mode) =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const threadId = ThreadId.make(`pr-watch-settle-${mode}`);
       yield* orchestrator.dispatch({
         type: "thread.create",
@@ -4753,7 +4768,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
   it.effect("cancels preparing work on archive and keeps it cancelled through replay", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const threadId = ThreadId.make("runtime-layer-archive-preparing-thread");
       yield* orchestrator.dispatch({
         type: "thread.create",
@@ -6321,7 +6336,7 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
         assert.equal(queued.length, 2);
         yield* recovery.reconcile(trigger);
         yield* recovery.reconcile("startup");
-        const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+        const maintenance = yield* ProjectionReplay.ProjectionReplay;
         assert.isTrue((yield* maintenance.rebuild).valid);
         assert.equal(yield* orchestrator.resumeQueuedRuns, 0);
         const held = yield* orchestrator.getThreadProjection(threadId);
@@ -7547,11 +7562,11 @@ it.layer(Layer.fresh(layerSharedApplicationDataPlaneTest))("thread opens", (it)
   );
 });
 
-it.layer(Layer.fresh(layerSharedApplicationDataPlaneTest))("compact PR events", (it) => {
+it.layer(Layer.fresh(layerSharedApplicationDataPlaneTest))("PR link events", (it) => {
   it.effect("persists only the changed PR link and replays it without losing other links", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       const sql = yield* SqlClient.SqlClient;
       const threadId = ThreadId.make("compact-pr-sync");
       yield* orchestrator.dispatch({
@@ -7650,85 +7665,6 @@ it.layer(Layer.fresh(layerSharedApplicationDataPlaneTest))("compact PR events",
         (yield* orchestrator.getThreadShell(threadId))?.pullRequests,
         after?.pullRequests,
       );
-      for (const [commandId, title] of [
-        ["compact-pr-sync-again", "Still open PR"],
-        ["compact-pr-sync-merged", "Merged PR"],
-      ] as const) {
-        yield* orchestrator.dispatch({
-          type: "thread.pull-request-link.sync",
-          commandId: CommandId.make(commandId),
-          threadId,
-          ...key,
-          number: 2,
-          snapshot: {
-            state: title === "Merged PR" ? "merged" : "open",
-            title,
-            headBranch: "feature/pr",
-            baseBranch: "main",
-            isDraft: false,
-            updatedAt: null,
-            syncedAt: "2026-10-13T13:00:00.000Z",
-          },
-          stack: null,
-        });
-      }
-      const latest = yield* orchestrator.getThreadShell(threadId);
-      yield* maintenance.compactEventStore();
-      const linkEvents = yield* sql<{ command_id: string }>`
-        SELECT command_id FROM orchestration_events
-        WHERE stream_id = ${threadId} AND event_type = 'thread.pull-request-link-updated'
-        ORDER BY sequence
-      `;
-      assert.deepEqual(
-        linkEvents.map((row) => row.command_id),
-        ["compact-pr-sync", "compact-pr-sync-merged"],
-      );
-      assert.isTrue((yield* maintenance.rebuild).valid);
-      assert.deepEqual(
-        (yield* orchestrator.getThreadShell(threadId))?.pullRequests,
-        latest?.pullRequests,
-      );
-
-      // Visits preserve updatedAt, so compaction must retain earlier renames; later renames supersede visits.
-      const threadEvents = () => sql<{ event_type: string }>`
-        SELECT event_type FROM orchestration_events
-        WHERE stream_id = ${threadId}
-          AND event_type IN ('thread.metadata-updated', 'thread.visited')
-        ORDER BY sequence
-      `;
-      yield* orchestrator.dispatch({
-        type: "thread.metadata.update",
-        commandId: CommandId.make("compact-pr-rename"),
-        threadId,
-        title: "Renamed before visit",
-      });
-      for (const [commandId, visitedAt] of [
-        ["compact-pr-visit", "2026-10-13T14:00:00.000Z"],
-        ["compact-pr-visit-again", "2026-10-13T15:00:00.000Z"],
-      ] as const) {
-        yield* orchestrator.dispatch({
-          type: "thread.visit",
-          commandId: CommandId.make(commandId),
-          threadId,
-          visitedAt,
-        });
-      }
-      yield* maintenance.compactEventStore();
-      assert.deepEqual(
-        (yield* threadEvents()).map((row) => row.event_type),
-        ["thread.metadata-updated", "thread.visited"],
-      );
-      yield* orchestrator.dispatch({
-        type: "thread.metadata.update",
-        commandId: CommandId.make("compact-pr-rename-again"),
-        threadId,
-        title: "Renamed after visit",
-      });
-      yield* maintenance.compactEventStore();
-      assert.deepEqual(
-        (yield* threadEvents()).map((row) => row.event_type),
-        ["thread.metadata-updated"],
-      );
     }),
   );
 });
diff --git a/apps/server/src/orchestration-v2/testkit/ProjectionReplay.ts b/apps/server/src/orchestration-v2/testkit/ProjectionReplay.ts
new file mode 100644
index 0000000000000..437db15c375f8
--- /dev/null
+++ b/apps/server/src/orchestration-v2/testkit/ProjectionReplay.ts
@@ -0,0 +1,182 @@
+import { ThreadId } from "@t3tools/contracts";
+import * as Context from "effect/Context";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
+import * as SqlClient from "effect/sql/SqlClient";
+
+import * as EventStore from "../EventStore.ts";
+import * as ProjectionStore from "../ProjectionStore.ts";
+
+export interface ProjectionReplayVerification {
+  readonly valid: boolean;
+  readonly schemaVersion: number;
+  readonly expectedSequence: number;
+  readonly projectionSequence: number;
+  readonly unreadableThreadIds: ReadonlyArray<ThreadId>;
+  readonly missingThreadIds: ReadonlyArray<ThreadId>;
+  readonly unexpectedThreadIds: ReadonlyArray<ThreadId>;
+}
+
+export class ProjectionReplayError extends Schema.TaggedError<ProjectionReplayError>()(
+  "ProjectionReplayError",
+  { cause: Schema.Defect() },
+) {}
+
+/**
+ * Test oracle: projections must equal a replay of an unpruned event log. Production prunes
+ * events the projections cover, so it never replays (see ProjectionMaintenance).
+ */
+export class ProjectionReplay extends Context.Service<
+  ProjectionReplay,
+  {
+    readonly verify: Effect.Effect<ProjectionReplayVerification, ProjectionReplayError>;
+    readonly rebuild: Effect.Effect<ProjectionReplayVerification, ProjectionReplayError>;
+  }
+>()("t3/orchestration-v2/testkit/ProjectionReplay") {}
+
+type ProjectionMetadataRow = {
+  readonly schema_version: number;
+  readonly last_sequence: number;
+};
+
+export const layer: Layer.Layer<
+  ProjectionReplay,
+  never,
+  EventStore.EventStoreV2 | ProjectionStore.ProjectionStoreV2 | SqlClient.SqlClient
+> = Layer.effect(
+  ProjectionReplay,
+  Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    const eventStore = yield* EventStore.EventStoreV2;
+    const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
+
+    const verify = Effect.gen(function* () {
+      const expectedThreadRows = yield* sql<{ readonly thread_id: string }>`
+        SELECT DISTINCT stream_id AS thread_id
+        FROM orchestration_events INDEXED BY orchestration_events_v2_created_threads_idx
+        WHERE application_event_version = 2
+          AND aggregate_kind = 'thread'
+          AND event_type = 'thread.created'
+        ORDER BY stream_id ASC
+      `;
+      const projectionRows = yield* sql<{ readonly thread_id: string }>`
+        SELECT thread_id
+        FROM orchestration_v2_projection_threads
+        ORDER BY thread_id ASC
+      `;
+      const actualIds = projectionRows.map((row) => ThreadId.make(row.thread_id));
+      const expectedIds = expectedThreadRows.map((row) => ThreadId.make(row.thread_id));
+      const actualSet = new Set(actualIds);
+      const expectedSet = new Set(expectedIds);
+      const missingThreadIds = expectedIds.filter((threadId) => !actualSet.has(threadId));
+      const unexpectedThreadIds = actualIds.filter((threadId) => !expectedSet.has(threadId));
+      const unreadableThreadIds = yield* projectionStore.getUnreadableThreadIds();
+      const metadata = yield* sql<ProjectionMetadataRow>`
+        SELECT schema_version, last_sequence
+        FROM orchestration_v2_projection_metadata
+        WHERE projection_name = 'thread-projections'
+        LIMIT 1
+      `;
+      const expectedSequence = yield* eventStore.latestSequence();
+      const schemaVersion = metadata[0]?.schema_version ?? 0;
+      const projectionSequence = metadata[0]?.last_sequence ?? 0;
+      return {
+        valid:
+          schemaVersion === ProjectionStore.ORCHESTRATION_V2_PROJECTION_SCHEMA_VERSION &&
+          projectionSequence === expectedSequence &&
+          missingThreadIds.length === 0 &&
+          unexpectedThreadIds.length === 0 &&
+          unreadableThreadIds.length === 0,
+        schemaVersion,
+        expectedSequence,
+        projectionSequence,
+        unreadableThreadIds,
+        missingThreadIds,
+        unexpectedThreadIds,
+      } satisfies ProjectionReplayVerification;
+    }).pipe(sql.withTransaction);
+
+    const rebuild = Effect.gen(function* () {
+      yield* sql.withTransaction(
+        Effect.gen(function* () {
+          const throughSequence = yield* eventStore.latestSequence();
+          yield* sql`DELETE FROM orchestration_v2_projection_context_transfers`;
+          yield* sql`DELETE FROM orchestration_v2_projection_context_handoffs`;
+          yield* sql`DELETE FROM orchestration_v2_projection_checkpoints`;
+          yield* sql`DELETE FROM orchestration_v2_projection_checkpoint_scopes`;
+          yield* sql`DELETE FROM orchestration_v2_projection_turn_items`;
+          yield* sql`DELETE FROM orchestration_v2_projection_plans`;
+          yield* sql`DELETE FROM orchestration_v2_projection_messages`;
+          yield* sql`DELETE FROM orchestration_v2_projection_runtime_requests`;
+          yield* sql`DELETE FROM orchestration_v2_projection_provider_turns`;
+          yield* sql`DELETE FROM orchestration_v2_projection_provider_threads`;
+          yield* sql`DELETE FROM orchestration_v2_projection_provider_session_bindings`;
+          yield* sql`DELETE FROM orchestration_v2_projection_provider_sessions`;
+          yield* sql`DELETE FROM orchestration_v2_projection_subagents`;
+          yield* sql`DELETE FROM orchestration_v2_projection_nodes`;
+          yield* sql`DELETE FROM orchestration_v2_projection_run_attempts`;
+          yield* sql`DELETE FROM orchestration_v2_projection_runs`;
+          yield* sql`DELETE FROM orchestration_v2_projection_threads`;
+          yield* sql`DELETE FROM orchestration_v2_turn_item_positions`;
+
+          const pageSize = 500;
+          let lastSequence = 0;
+          while (true) {
+            const page = yield* eventStore
+              .read({ afterSequence: lastSequence, throughSequence, limit: pageSize })
+              .pipe(Stream.runCollect);
+            for (const stored of page) {
+              yield* projectionStore.apply(stored.event);
+              if (stored.event.type === "turn-item.updated") {
+                yield* sql`
+                INSERT INTO orchestration_v2_turn_item_positions (
+                  thread_id,
+                  turn_item_id,
+                  ordinal
+                )
+                VALUES (
+                  ${stored.event.threadId},
+                  ${stored.event.payload.id},
+                  ${stored.event.payload.ordinal}
+                )
+                ON CONFLICT(thread_id, turn_item_id) DO UPDATE SET
+                  ordinal = excluded.ordinal
+                `;
+              }
+              lastSequence = stored.sequence;
+            }
+            if (page.length < pageSize) break;
+            yield* Effect.yieldNow;
+          }
+          const now = DateTime.formatIso(yield* DateTime.now);
+          yield* sql`
+            INSERT INTO orchestration_v2_projection_metadata (
+              projection_name,
+              schema_version,
+              last_sequence,
+              updated_at
+            )
+            VALUES (
+              'thread-projections',
+              ${ProjectionStore.ORCHESTRATION_V2_PROJECTION_SCHEMA_VERSION},
+              ${lastSequence},
+              ${now}
+            )
+            ON CONFLICT(projection_name) DO UPDATE SET
+              schema_version = excluded.schema_version,
+              last_sequence = excluded.last_sequence,
+              updated_at = excluded.updated_at
+          `;
+        }),
+      );
+      return yield* verify;
+    });
+
+    const mapError = <A, E>(effect: Effect.Effect<A, E>) =>
+      effect.pipe(Effect.mapError((cause) => new ProjectionReplayError({ cause })));
+    return ProjectionReplay.of({ verify: mapError(verify), rebuild: mapError(rebuild) });
+  }),
+);
diff --git a/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts b/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
index f36e463079f99..2570c28e36b77 100644
--- a/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
+++ b/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
@@ -52,7 +52,7 @@ import * as LegacyV1ThreadImporter from "../legacy/LegacyV1ThreadImporter.ts";
 import * as Orchestrator from "../Orchestrator.ts";
 import * as EffectWorker from "../EffectWorker.ts";
 import * as EffectOutbox from "../EffectOutbox.ts";
-import * as ProjectionMaintenance from "../ProjectionMaintenance.ts";
+import * as ProjectionReplay from "./ProjectionReplay.ts";
 import * as ProjectionStore from "../ProjectionStore.ts";
 import * as ProviderAdapterRegistry from "../ProviderAdapterRegistry.ts";
 import { makeProviderFailure } from "@t3tools/provider-core/server/failure";
@@ -3148,7 +3148,7 @@ describe("orchestration v2 provider switching", () => {
         const layerImporterProvided = LegacyV1ThreadImporter.layer.pipe(
           Layer.provide(Layer.mergeAll(layerStoresProvided, layerEventSinkProvided)),
         );
-        const layerMaintenanceProvided = ProjectionMaintenance.layer.pipe(
+        const layerMaintenanceProvided = ProjectionReplay.layer.pipe(
           Layer.provide(layerStoresProvided),
         );
         const layerOrchestratorProvided = ProviderReplayHarness.layerWithRegistry(
@@ -3177,7 +3177,7 @@ describe("orchestration v2 provider switching", () => {
         const projection = yield* Effect.gen(function* () {
           const sql = yield* SqlClient.SqlClient;
           const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-          const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+          const maintenance = yield* ProjectionReplay.ProjectionReplay;
           const orchestrator = yield* Orchestrator.OrchestratorV2;
           const worker = yield* EffectWorker.OrchestrationEffectWorkerV2;
 
diff --git a/apps/server/src/persistence/DatabaseMaintenance.test.ts b/apps/server/src/persistence/DatabaseMaintenance.test.ts
index 381b143923adf..c767cebd0f886 100644
--- a/apps/server/src/persistence/DatabaseMaintenance.test.ts
+++ b/apps/server/src/persistence/DatabaseMaintenance.test.ts
@@ -12,9 +12,6 @@ import * as SqlClient from "effect/sql/SqlClient";
 
 import * as DatabaseMaintenance from "./DatabaseMaintenance.ts";
 import * as Sqlite from "./Sqlite.ts";
-import * as EventStore from "../orchestration-v2/EventStore.ts";
-import * as ProjectionMaintenance from "../orchestration-v2/ProjectionMaintenance.ts";
-import * as ProjectionStore from "../orchestration-v2/ProjectionStore.ts";
 
 it.layer(DatabaseMaintenance.layer.pipe(Layer.provideMerge(NodeServices.layer)))(
   "DatabaseMaintenance",
@@ -111,17 +108,8 @@ it.layer(DatabaseMaintenance.layer.pipe(Layer.provideMerge(NodeServices.layer)))
         const maintenance = yield* DatabaseMaintenance.DatabaseMaintenance;
         const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-compact-" });
         const dbPath = path.join(baseDir, "userdata", "statev2.sqlite");
-        yield* Effect.flatMap(
-          ProjectionMaintenance.ProjectionMaintenanceV2,
-          (projections) => projections.rebuild,
-        ).pipe(
-          Effect.provide(
-            ProjectionMaintenance.layer.pipe(
-              Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
-              Layer.provideMerge(Sqlite.layerFromPath(dbPath)),
-            ),
-          ),
-        );
+        // Opening the database migrates it.
+        yield* Effect.void.pipe(Effect.provide(Sqlite.layerFromPath(dbPath)));
         yield* Effect.gen(function* () {
           const sql = yield* SqlClient.SqlClient;
           yield* sql`PRAGMA auto_vacuum = NONE`;
diff --git a/apps/server/src/persistence/DatabaseMaintenance.ts b/apps/server/src/persistence/DatabaseMaintenance.ts
index 4a97e6dcace98..d7876785c898d 100644
--- a/apps/server/src/persistence/DatabaseMaintenance.ts
+++ b/apps/server/src/persistence/DatabaseMaintenance.ts
@@ -9,9 +9,7 @@ import * as Schema from "effect/Schema";
 import * as SqlClient from "effect/sql/SqlClient";
 import { isSqlError } from "effect/sql/SqlError";
 
-import * as EventStore from "../orchestration-v2/EventStore.ts";
 import * as ProjectionMaintenance from "../orchestration-v2/ProjectionMaintenance.ts";
-import * as ProjectionStore from "../orchestration-v2/ProjectionStore.ts";
 import { rebuildMessageSearch } from "../orchestration-v2/messageSearchIndex.ts";
 
 export class DatabaseMissingError extends Schema.TaggedError<DatabaseMissingError>()(
@@ -32,15 +30,6 @@ export class DatabaseInUseError extends Schema.TaggedError<DatabaseInUseError>()
   }
 }
 
-export class DatabaseProjectionsInvalidError extends Schema.TaggedError<DatabaseProjectionsInvalidError>()(
-  "DatabaseProjectionsInvalidError",
-  { path: Schema.String },
-) {
-  override get message() {
-    return "Database projections need repair before compaction. Start T3 Code once so it rebuilds them, then run doctor again. If this CLI is older than the one that wrote the database, update T3 Code first.";
-  }
-}
-
 export class DatabaseInspectError extends Schema.TaggedError<DatabaseInspectError>()(
   "DatabaseInspectError",
   { path: Schema.String, cause: Schema.Defect() },
@@ -89,10 +78,7 @@ export class DatabaseMaintenance extends Context.Service<
         readonly deletedEventCount: number;
         readonly deletedReceiptCount: number;
       },
-      | DatabaseMissingError
-      | DatabaseInUseError
-      | DatabaseProjectionsInvalidError
-      | DatabaseCompactError
+      DatabaseMissingError | DatabaseInUseError | DatabaseCompactError
     >;
     /** Deletes only the pre-0.1.0 database; earlier versions still use it. */
     readonly removeLegacyDatabase: (
@@ -101,9 +87,7 @@ export class DatabaseMaintenance extends Context.Service<
   }
 >()("t3/persistence/DatabaseMaintenance") {}
 
-const isDomainError = Schema.is(
-  Schema.Union([DatabaseMissingError, DatabaseInUseError, DatabaseProjectionsInvalidError]),
-);
+const isDomainError = Schema.is(Schema.Union([DatabaseMissingError, DatabaseInUseError]));
 
 const readStorage = Effect.gen(function* () {
   const sql = yield* SqlClient.SqlClient;
@@ -180,13 +164,7 @@ const make = Effect.gen(function* () {
         const sql = yield* SqlClient.SqlClient;
         yield* lockExclusively(databasePath);
         const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
-        if (!(yield* maintenance.verify).valid) {
-          return yield* new DatabaseProjectionsInvalidError({ path: databasePath });
-        }
-        const summary = yield* maintenance.compactEventStore();
-        if (!(yield* maintenance.verify).valid) {
-          return yield* new DatabaseProjectionsInvalidError({ path: databasePath });
-        }
+        const summary = yield* maintenance.pruneEventStore();
         // VACUUM is required to enable incremental auto_vacuum on existing databases.
         yield* sql`PRAGMA auto_vacuum = INCREMENTAL`;
         yield* sql`VACUUM`;
@@ -196,7 +174,6 @@ const make = Effect.gen(function* () {
       }).pipe(
         Effect.provide(
           ProjectionMaintenance.layer.pipe(
-            Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
             Layer.provideMerge(NodeSqliteClient.layer({ filename: databasePath })),
           ),
         ),
diff --git a/apps/server/src/persistence/DatabaseStorage.test.ts b/apps/server/src/persistence/DatabaseStorage.test.ts
index 878f596600888..73a0d4cac7cd8 100644
--- a/apps/server/src/persistence/DatabaseStorage.test.ts
+++ b/apps/server/src/persistence/DatabaseStorage.test.ts
@@ -9,9 +9,7 @@ import * as TestClock from "effect/testing/TestClock";
 import * as SqlClient from "effect/sql/SqlClient";
 
 import * as ServerConfig from "../config.ts";
-import * as EventStore from "../orchestration-v2/EventStore.ts";
 import * as ProjectionMaintenance from "../orchestration-v2/ProjectionMaintenance.ts";
-import * as ProjectionStore from "../orchestration-v2/ProjectionStore.ts";
 import * as DatabaseStorage from "./DatabaseStorage.ts";
 import * as Sqlite from "./Sqlite.ts";
 
@@ -28,7 +26,6 @@ const storageLayer = <E>(
 ) =>
   DatabaseStorage.layer.pipe(
     Layer.provide(ProjectionMaintenance.layer),
-    Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
     Layer.provideMerge(Sqlite.layerMemory),
     Layer.provideMerge(config),
     Layer.provide(NodeServices.layer),
@@ -54,14 +51,12 @@ it.effect("a new database returns freed pages online without losing data", () =>
 );
 
 const compactionLayer = (
-  compactEventStore: ProjectionMaintenance.ProjectionMaintenanceV2["Service"]["compactEventStore"],
+  pruneEventStore: ProjectionMaintenance.ProjectionMaintenanceV2["Service"]["pruneEventStore"],
 ) =>
   DatabaseStorage.layer.pipe(
     Layer.provide(
       Layer.succeed(ProjectionMaintenance.ProjectionMaintenanceV2, {
-        compactEventStore,
-        verify: Effect.die("unexpected verification"),
-        rebuild: Effect.die("unexpected rebuild"),
+        pruneEventStore,
       }),
     ),
     Layer.provide(Sqlite.layerMemory),
diff --git a/apps/server/src/persistence/DatabaseStorage.ts b/apps/server/src/persistence/DatabaseStorage.ts
index bbb4dd1399efd..a0dd307237d46 100644
--- a/apps/server/src/persistence/DatabaseStorage.ts
+++ b/apps/server/src/persistence/DatabaseStorage.ts
@@ -31,7 +31,6 @@ export class DatabaseStorage extends Context.Service<
   }
 >()("t3/persistence/DatabaseStorage") {}
 
-// Deleted events have newer retained replacements; old cursors replay to the same state.
 const make = Effect.gen(function* () {
   const sql = yield* SqlClient.SqlClient;
   const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
@@ -108,7 +107,7 @@ const make = Effect.gen(function* () {
       yield* Effect.sleep((Number(elapsed) / 1_000_000) * 9);
       sliceStarted = yield* Clock.monotonicTimeNanos;
     });
-    const result = yield* maintenance.compactEventStore(betweenPages);
+    const result = yield* maintenance.pruneEventStore(betweenPages);
     const completedAt = yield* Clock.currentTimeMillis;
     yield* fs.writeFileString(compactedAtPath, String(completedAt)).pipe(Effect.ignore);
     if (result.deletedEventCount > 0 || result.deletedReceiptCount > 0) {
diff --git a/apps/server/src/persistence/Migrations/064_CanonicalizeThreadPullRequestLinks.test.ts b/apps/server/src/persistence/Migrations/064_CanonicalizeThreadPullRequestLinks.test.ts
index 69eb8eff57027..b53309c187ed3 100644
--- a/apps/server/src/persistence/Migrations/064_CanonicalizeThreadPullRequestLinks.test.ts
+++ b/apps/server/src/persistence/Migrations/064_CanonicalizeThreadPullRequestLinks.test.ts
@@ -9,7 +9,7 @@ import * as SqlClient from "effect/sql/SqlClient";
 
 import * as EventStore from "../../orchestration-v2/EventStore.ts";
 import * as ProjectionStore from "../../orchestration-v2/ProjectionStore.ts";
-import * as ProjectionMaintenance from "../../orchestration-v2/ProjectionMaintenance.ts";
+import * as ProjectionReplay from "../../orchestration-v2/testkit/ProjectionReplay.ts";
 import { listLinkedPullRequestThreads } from "../../pullRequest/linkedThreads.ts";
 import { runMigrations } from "../Migrations.ts";
 
@@ -53,7 +53,7 @@ const thread = (id: string) => ({
 });
 
 const layer = it.layer(
-  ProjectionMaintenance.layer.pipe(
+  ProjectionReplay.layer.pipe(
     Layer.provideMerge(
       Layer.mergeAll(EventStore.layer, ProjectionStore.layer).pipe(
         Layer.provideMerge(NodeSqliteClient.layer({ filename: ":memory:" })),
@@ -156,7 +156,7 @@ layer("064_CanonicalizeThreadPullRequestLinks", (it) => {
       `;
       assert.equal(v1?.payload_json, v1Payload);
 
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       assert.isTrue((yield* maintenance.rebuild).valid);
       for (const [host, repository, id] of [
         ["github.com", "acme/web", "github"],
diff --git a/apps/server/src/persistence/Migrations/066_RepairClientSettlementTimestamps.test.ts b/apps/server/src/persistence/Migrations/066_RepairClientSettlementTimestamps.test.ts
index f30289cb92de9..d62654b37ece6 100644
--- a/apps/server/src/persistence/Migrations/066_RepairClientSettlementTimestamps.test.ts
+++ b/apps/server/src/persistence/Migrations/066_RepairClientSettlementTimestamps.test.ts
@@ -6,13 +6,13 @@ import * as Layer from "effect/Layer";
 import * as SqlClient from "effect/sql/SqlClient";
 
 import * as EventStore from "../../orchestration-v2/EventStore.ts";
-import * as ProjectionMaintenance from "../../orchestration-v2/ProjectionMaintenance.ts";
+import * as ProjectionReplay from "../../orchestration-v2/testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "../../orchestration-v2/ProjectionStore.ts";
 import { runMigrations } from "../Migrations.ts";
 import Migration0066 from "./066_RepairClientSettlementTimestamps.ts";
 
 const layer = it.layer(
-  ProjectionMaintenance.layer.pipe(
+  ProjectionReplay.layer.pipe(
     Layer.provideMerge(
       Layer.mergeAll(EventStore.layer, ProjectionStore.layer).pipe(
         Layer.provideMerge(NodeSqliteClient.layer({ filename: ":memory:" })),
@@ -363,7 +363,7 @@ layer("066_RepairClientSettlementTimestamps", (it) => {
       yield* Migration0066;
       assert.deepEqual(yield* snapshot, repaired);
 
-      const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+      const maintenance = yield* ProjectionReplay.ProjectionReplay;
       assert.isTrue((yield* maintenance.rebuild).valid);
       assert.deepEqual(yield* imported, expectedImported);
     }),
diff --git a/apps/server/src/persistence/OrchestrationEventStore.ts b/apps/server/src/persistence/OrchestrationEventStore.ts
index dbea09d666988..e55d82713871b 100644
--- a/apps/server/src/persistence/OrchestrationEventStore.ts
+++ b/apps/server/src/persistence/OrchestrationEventStore.ts
@@ -33,6 +33,10 @@ import {
   type OrchestrationEventStoreError,
 } from "./Errors.ts";
 
+/** Projection metadata rows: events at or below the pruned-through sequence may be gone. */
+export const EVENT_LOG_PRUNED_THROUGH = "event-log-pruned-through";
+export const EVENT_LOG_PRUNE_MARK = "event-log-prune-mark";
+
 export type UnsequencedProjectEvent = ApplicationProjectEvent extends infer Event
   ? Event extends ApplicationProjectEvent
     ? Omit<Event, "sequence">
@@ -93,6 +97,9 @@ export class OrchestrationEventStore extends Context.Service<
 
     readonly latestApplicationSequence: Effect.Effect<number, OrchestrationEventStoreError>;
 
+    /** Replay from a cursor below this misses pruned events; resync from a snapshot instead. */
+    readonly prunedThroughSequence: Effect.Effect<number, OrchestrationEventStoreError>;
+
     /** Unknown event types fail unless skipUnknownEventTypes logs and drops them; only client replay may opt in. */
     readonly readApplicationEvents: (input: {
       readonly afterSequence: number;
@@ -450,7 +457,7 @@ const makeEventStore = Effect.gen(function* () {
           const promptKey = subagent === undefined ? undefined : `${event.type}:${subagent.id}`;
           const hint = promptKey === undefined ? undefined : promptHints.get(promptKey);
           const payloadJson = yield* encodeJson(encoded.payload);
-          // Deduplicate repeated progress prompts via anchor rows that ProjectionMaintenance never deletes.
+          // Deduplicate repeated progress prompts via anchor rows; pruning keeps anchors that retained rows reference.
           const storedPayload =
             hint !== undefined && subagent !== undefined
               ? sql`CASE WHEN EXISTS (
@@ -672,6 +679,15 @@ const makeEventStore = Effect.gen(function* () {
     ),
   );
 
+  const prunedThroughSequence = sql<{ readonly last_sequence: number }>`
+    SELECT last_sequence FROM orchestration_v2_projection_metadata
+    WHERE projection_name = ${EVENT_LOG_PRUNED_THROUGH}
+  `.pipe(
+    NodeSqliteClient.readOnly,
+    Effect.map((rows) => rows[0]?.last_sequence ?? 0),
+    Effect.mapError(toPersistenceSqlError("OrchestrationEventStore.prunedThroughSequence:query")),
+  );
+
   // Advance over raw rows so even a full page of unknown types cannot end replay early.
   const catchUpApplicationEvents = (input: {
     readonly afterSequence: number;
@@ -748,6 +764,7 @@ const makeEventStore = Effect.gen(function* () {
     getReplayStats,
     latestAgentSequence,
     latestApplicationSequence,
+    prunedThroughSequence,
     readApplicationEvents: catchUpApplicationEvents,
     publishCommitted: (events) => PubSub.publishAll(committedEvents, events).pipe(Effect.asVoid),
     streamApplicationEvents,
diff --git a/apps/server/src/project/ProjectService.deletion.test.ts b/apps/server/src/project/ProjectService.deletion.test.ts
index 41804842d5205..28b1c40541ddf 100644
--- a/apps/server/src/project/ProjectService.deletion.test.ts
+++ b/apps/server/src/project/ProjectService.deletion.test.ts
@@ -22,7 +22,7 @@ import * as EventSink from "../orchestration-v2/EventSink.ts";
 import * as EventStore from "../orchestration-v2/EventStore.ts";
 import * as IdAllocator from "@t3tools/provider-core/server/IdAllocator";
 import * as LegacyV1ThreadImporter from "../orchestration-v2/legacy/LegacyV1ThreadImporter.ts";
-import * as ProjectionMaintenance from "../orchestration-v2/ProjectionMaintenance.ts";
+import * as ProjectionReplay from "../orchestration-v2/testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "../orchestration-v2/ProjectionStore.ts";
 import * as ProjectStore from "../orchestration-v2/ProjectStore.ts";
 import * as ThreadCommandExecutor from "../orchestration-v2/ThreadCommandExecutor.ts";
@@ -40,7 +40,7 @@ const layerEventPersistence = EventSink.layer.pipe(
 );
 const layerServices = Layer.mergeAll(
   LegacyV1ThreadImporter.layer.pipe(Layer.provideMerge(layerEventPersistence)),
-  ProjectionMaintenance.layer.pipe(Layer.provide(layerEventPersistence)),
+  ProjectionReplay.layer.pipe(Layer.provide(layerEventPersistence)),
   ProjectStore.layer,
   IdAllocator.layer,
   ThreadCommandExecutor.layer,
@@ -310,7 +310,7 @@ it.effect(
 
       yield* Effect.gen(function* () {
         const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
-        const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
+        const maintenance = yield* ProjectionReplay.ProjectionReplay;
         const projections = yield* ProjectionStore.ProjectionStoreV2;
         const service = yield* ProjectService.make;
         assert.deepEqual(yield* importer.reconcileShells, {
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index a4433b59e8b77..395afcf56631a 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -198,7 +198,6 @@ import * as ThreadSettlementService from "./orchestration-v2/ThreadSettlementSer
 import * as IdleCompactionService from "./orchestration-v2/IdleCompactionService.ts";
 import * as ThreadPullRequestService from "./orchestration-v2/ThreadPullRequestService.ts";
 import * as RunFinalizationService from "./orchestration-v2/RunFinalizationService.ts";
-import * as EventStoreV2 from "./orchestration-v2/EventStore.ts";
 import * as ProjectionMaintenance from "./orchestration-v2/ProjectionMaintenance.ts";
 import * as ProjectionStoreV2 from "./orchestration-v2/ProjectionStore.ts";
 import { makePersistedServerRuntimeState } from "./serverRuntimeState.ts";
@@ -629,12 +628,7 @@ const layerRuntimeCoreDependenciesBase = Layer.mergeAll(
   layerThreadSettlementWorker,
   layerIdleCompactionWorker,
   StorageCleanup.layer.pipe(Layer.provide(ProjectionStoreV2.layer)),
-  DatabaseStorage.layer.pipe(
-    Layer.provide(ProjectionMaintenance.layer),
-    Layer.provide(
-      Layer.merge(EventStoreV2.layerFromOrchestrationEventStore, ProjectionStoreV2.layer),
-    ),
-  ),
+  DatabaseStorage.layer.pipe(Layer.provide(ProjectionMaintenance.layer)),
   layerThreadPullRequestWorker,
   DelegatedTaskAnalytics.layer,
   Layer.effectDiscard(
diff --git a/apps/server/src/ws.test.ts b/apps/server/src/ws.test.ts
index 36d58fea2a328..4583d3f153054 100644
--- a/apps/server/src/ws.test.ts
+++ b/apps/server/src/ws.test.ts
@@ -22,6 +22,8 @@ import {
 import * as Deferred from "effect/Deferred";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Cause from "effect/Cause";
 import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as PubSub from "effect/PubSub";
@@ -31,6 +33,7 @@ import * as TestClock from "effect/testing/TestClock";
 import { Headers } from "effect/http";
 import { RpcGroup, RpcMessage, RpcServer } from "effect/rpc";
 import * as SqlClient from "effect/sql/SqlClient";
+import * as Statement from "effect/sql/Statement";
 
 import * as PreviewAutomationBroker from "./mcp/PreviewAutomationBroker.ts";
 import * as ServerBrowser from "./preview/ServerBrowser.ts";
@@ -115,9 +118,6 @@ import * as Keybindings from "./keybindings.ts";
 import * as ServerSettings from "./serverSettings.ts";
 import * as ManagedPolicy from "./policy/ManagedPolicy.ts";
 
-import * as EventStore from "./orchestration-v2/EventStore.ts";
-import * as ProjectionMaintenance from "./orchestration-v2/ProjectionMaintenance.ts";
-import * as ProjectionStore from "./orchestration-v2/ProjectionStore.ts";
 import * as ThreadManagement from "./orchestration-v2/ThreadManagementService.ts";
 import * as ProjectStore from "./orchestration-v2/ProjectStore.ts";
 import * as OrchestrationEventStore from "./persistence/OrchestrationEventStore.ts";
@@ -1161,93 +1161,176 @@ it.effect("on-demand clients get provider config without workspace snapshots", (
   ),
 );
 
-// Compaction keeps the oldest and newest event per message, so a cursor older
-// than the deleted rows still replays each message where the client would
-// first have seen it (reducers append on first sight) and reaches the same
-// final state. No snapshot fallback is needed.
-it.effect("thread resume across compacted history keeps message order and final state", () =>
+// Pruned history cannot be replayed: a cursor below the boundary must resync from a snapshot.
+it.effect.each(["thread", "shell"] as const)(
+  "%s resume from a cursor below the pruned boundary loads a snapshot",
+  (scope) =>
+    Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+      const now = "2026-10-13T00:00:00.000Z";
+      const threadId = ThreadId.make("thread:pruned");
+      const insert = (version: number) => sql<{ sequence: number }>`
+        INSERT INTO orchestration_events (
+          event_id, aggregate_kind, stream_id, stream_version, event_type,
+          occurred_at, actor_kind, payload_json, metadata_json, application_event_version
+        ) VALUES (
+          ${`pruned:${version}`}, 'thread', ${threadId}, ${version}, 'provider-session.detached',
+          ${now}, 'server', ${JSON.stringify({ providerSessionId: "session:pruned", detachedAt: now })},
+          '{}', 2
+        ) RETURNING sequence
+      `;
+      const [first] = yield* insert(0);
+      const [second] = yield* insert(1);
+      yield* insert(2);
+      yield* sql`
+        INSERT INTO orchestration_v2_projection_metadata (
+          projection_name, schema_version, last_sequence, updated_at
+        ) VALUES (${OrchestrationEventStore.EVENT_LOG_PRUNED_THROUGH}, 2, ${second!.sequence}, ${now})
+      `;
+      const subscription = Effect.gen(function* () {
+        const stream =
+          scope === "thread"
+            ? yield* subscribeOrchestrationV2Thread({ threadId, afterSequence: first!.sequence })
+            : yield* subscribeOrchestrationV2Shell({ afterSequence: first!.sequence });
+        return stream;
+      });
+      const exit = yield* subscription.pipe(
+        Effect.provideService(ThreadManagement.ThreadManagementService, {
+          ensureLegacyTranscript: () => Effect.void,
+          getThreadSnapshot: () => Effect.die("snapshot"),
+          listActiveShellIndex: () => Effect.die("snapshot"),
+          readShellSnapshot: () => Effect.die("snapshot"),
+          listActiveSubagentThreadIds: () => Effect.die("replay"),
+        } as unknown as ThreadManagement.ThreadManagementService["Service"]),
+        Effect.provideService(ProjectStore.ProjectStoreV2, {
+          listShells: () => Effect.succeed([]),
+        } as unknown as ProjectStore.ProjectStoreV2["Service"]),
+        Effect.provideService(
+          ProjectService.ProjectService,
+          {} as ProjectService.ProjectService["Service"],
+        ),
+        Effect.provideService(ProjectEnrichment.ProjectEnrichmentService, {
+          subscribeChanges: PubSub.subscribe(yield* PubSub.unbounded()),
+        } as ProjectEnrichment.ProjectEnrichmentService["Service"]),
+        Effect.exit,
+      );
+      assert.deepEqual(Exit.isFailure(exit) ? Cause.squash(exit.cause) : exit, "snapshot");
+    }).pipe(Effect.scoped, Effect.provide(ReplayTestLayer)),
+);
+
+// A prune pass can delete replayed rows after the boundary check; the read must not be trusted.
+it.effect.each(["thread", "shell"] as const)(
+  "%s resume loads a snapshot when pruning advances during the replay read",
+  (scope) =>
+    Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+      const now = "2026-10-13T00:00:00.000Z";
+      const threadId = ThreadId.make("thread:prune-race");
+      const insert = (version: number) => sql<{ sequence: number }>`
+        INSERT INTO orchestration_events (
+          event_id, aggregate_kind, stream_id, stream_version, event_type,
+          occurred_at, actor_kind, payload_json, metadata_json, application_event_version
+        ) VALUES (
+          ${`prune-race:${version}`}, 'thread', ${threadId}, ${version}, 'provider-session.detached',
+          ${now}, 'server', ${JSON.stringify({ providerSessionId: "session:race", detachedAt: now })},
+          '{}', 2
+        ) RETURNING sequence
+      `;
+      const [first] = yield* insert(0);
+      const [second] = yield* insert(1);
+      yield* insert(2);
+
+      const readStarted = yield* Deferred.make<void>();
+      const releaseRead = yield* Deferred.make<void>();
+      let gated = false;
+      const gateReplayRead: Statement.Transformer = (statement) => {
+        const [query] = statement.compile();
+        // The paged replay read (readApplicationRows), not the stats or high-water queries.
+        if (!gated && /^\s*SELECT\s+sequence,\s+event_id,/.test(query)) {
+          gated = true;
+          return Deferred.succeed(readStarted, undefined).pipe(
+            Effect.andThen(Deferred.await(releaseRead)),
+            Effect.as(statement),
+          );
+        }
+        return Effect.succeed(statement);
+      };
+      const subscription = Effect.gen(function* () {
+        const stream =
+          scope === "thread"
+            ? yield* subscribeOrchestrationV2Thread({ threadId, afterSequence: first!.sequence })
+            : yield* subscribeOrchestrationV2Shell({ afterSequence: first!.sequence });
+        return stream;
+      }).pipe(
+        Effect.provideService(Statement.CurrentTransformer, gateReplayRead),
+        Effect.provideService(ThreadManagement.ThreadManagementService, {
+          ensureLegacyTranscript: () => Effect.void,
+          getThreadSnapshot: () => Effect.die("snapshot"),
+          listActiveShellIndex: () => Effect.die("snapshot"),
+          readShellSnapshot: () => Effect.die("snapshot"),
+          listActiveSubagentThreadIds: () => Effect.succeed([]),
+        } as unknown as ThreadManagement.ThreadManagementService["Service"]),
+        Effect.provideService(ProjectStore.ProjectStoreV2, {
+          listShells: () => Effect.succeed([]),
+        } as unknown as ProjectStore.ProjectStoreV2["Service"]),
+        Effect.provideService(
+          ProjectService.ProjectService,
+          {} as ProjectService.ProjectService["Service"],
+        ),
+        Effect.provideService(ProjectEnrichment.ProjectEnrichmentService, {
+          subscribeChanges: PubSub.subscribe(yield* PubSub.unbounded()),
+        } as ProjectEnrichment.ProjectEnrichmentService["Service"]),
+        Effect.exit,
+        Effect.forkChild,
+      );
+      const fiber = yield* subscription;
+      yield* Deferred.await(readStarted);
+      // A pass publishes its boundary, then deletes the rows it covers.
+      yield* sql`
+        INSERT INTO orchestration_v2_projection_metadata (
+          projection_name, schema_version, last_sequence, updated_at
+        ) VALUES (${OrchestrationEventStore.EVENT_LOG_PRUNED_THROUGH}, 2, ${second!.sequence}, ${now})
+      `;
+      yield* sql`DELETE FROM orchestration_events WHERE sequence = ${second!.sequence}`;
+      yield* Deferred.succeed(releaseRead, undefined);
+      const exit = yield* Fiber.join(fiber);
+      assert.deepEqual(Exit.isFailure(exit) ? Cause.squash(exit.cause) : exit, "snapshot");
+    }).pipe(Effect.scoped, Effect.provide(ReplayTestLayer)),
+);
+
+// A thread idle since before the boundary missed nothing; resuming must not resend its body.
+it.effect("thread resume at its own high-water below the pruned boundary skips the snapshot", () =>
   Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    const maintenance = yield* ProjectionMaintenance.ProjectionMaintenanceV2;
     const now = "2026-10-13T00:00:00.000Z";
-    const threadId = ThreadId.make("thread:compacted");
-    const insertMessage = (version: number, id: string, text: string) => sql<{
-      sequence: number;
-    }>`
+    const threadId = ThreadId.make("thread:idle");
+    const [last] = yield* sql<{ sequence: number }>`
       INSERT INTO orchestration_events (
         event_id, aggregate_kind, stream_id, stream_version, event_type,
         occurred_at, actor_kind, payload_json, metadata_json, application_event_version
       ) VALUES (
-        ${`compacted:${version}`}, 'thread', ${threadId}, ${version}, 'message.updated',
-        ${now}, 'server', ${JSON.stringify({
-          createdBy: "user",
-          creationSource: "web",
-          id,
-          threadId,
-          runId: null,
-          nodeId: null,
-          role: "user",
-          text,
-          attachments: [],
-          streaming: false,
-          createdAt: now,
-          updatedAt: now,
-        })}, '{}', 2
+        'idle:0', 'thread', ${threadId}, 0, 'provider-session.detached',
+        ${now}, 'server', ${JSON.stringify({ providerSessionId: "session:idle", detachedAt: now })},
+        '{}', 2
       ) RETURNING sequence
     `;
-    const [first] = yield* insertMessage(0, "message:a", "a created");
-    const [second] = yield* insertMessage(1, "message:b", "b created");
-    yield* insertMessage(2, "message:a", "a superseded");
-    const [head] = yield* insertMessage(3, "message:a", "a final");
-    // thread.deleted is never superseded: clients switch on the event type.
-    for (const version of [0, 1]) {
-      yield* sql`
-        INSERT INTO orchestration_events (
-          event_id, aggregate_kind, stream_id, stream_version, event_type,
-          occurred_at, actor_kind, payload_json, metadata_json, application_event_version
-        ) VALUES (
-          ${`deleted:${version}`}, 'thread', 'thread:deleted-twice', ${version}, 'thread.deleted',
-          ${now}, 'server', '{}', '{}', 2
-        )
-      `;
-    }
-    assert.equal((yield* maintenance.compactEventStore()).deletedEventCount, 1);
-
-    const items = yield* subscribeOrchestrationV2Thread({
+    yield* sql`
+      INSERT INTO orchestration_v2_projection_metadata (
+        projection_name, schema_version, last_sequence, updated_at
+      ) VALUES (${OrchestrationEventStore.EVENT_LOG_PRUNED_THROUGH}, 2, ${last!.sequence + 10}, ${now})
+    `;
+    const exit = yield* subscribeOrchestrationV2Thread({
       threadId,
-      afterSequence: first!.sequence - 1,
-      requestCompletionMarker: true,
+      afterSequence: last!.sequence,
     }).pipe(
-      Effect.flatMap((stream) =>
-        stream.pipe(
-          Stream.takeUntil((item) => item.kind === "synchronized"),
-          Stream.runCollect,
-        ),
-      ),
       Effect.provideService(ThreadManagement.ThreadManagementService, {
         ensureLegacyTranscript: () => Effect.void,
-        streamStoredEventsFrom: () => Stream.never,
+        getThreadSnapshot: () => Effect.die("snapshot"),
+        streamStoredEventsFrom: () => Stream.empty,
       } as unknown as ThreadManagement.ThreadManagementService["Service"]),
+      Effect.exit,
     );
-    assert.deepEqual(
-      Array.from(items, (item) =>
-        item.kind === "event"
-          ? [item.sequence, item.event.type === "message.updated" ? item.event.payload.text : null]
-          : [item.kind],
-      ),
-      [
-        [first!.sequence, "a created"],
-        [second!.sequence, "b created"],
-        [head!.sequence, "a final"],
-        ["synchronized"],
-      ],
-    );
-  }).pipe(
-    Effect.provide(
-      ProjectionMaintenance.layer.pipe(
-        Layer.provide(Layer.merge(EventStore.layer, ProjectionStore.layer)),
-        Layer.provideMerge(ReplayTestLayer),
-      ),
-    ),
-  ),
+    // A snapshot load dies with "snapshot", so success means the resume replayed nothing.
+    assert.isTrue(Exit.isSuccess(exit));
+  }).pipe(Effect.scoped, Effect.provide(ReplayTestLayer)),
 );
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 492764c6ae5c8..06682ff4ae4c5 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -780,6 +780,7 @@ const canReplayPersistedRange = Effect.fnUntraced(function* (
   if (replayGap < 0 || replayGap > maxGap) {
     return false;
   }
+  if (afterSequence < (yield* applicationEvents.prunedThroughSequence)) return false;
   const stats = yield* applicationEvents.getReplayStats({
     afterSequence,
     throughSequence: headSequence,
@@ -968,7 +969,21 @@ export const subscribeOrchestrationV2Thread = Effect.fn("ws.orchestrationV2.subs
             }),
         ),
       );
-      if (input.afterSequence > highWater) {
+      const prunedThrough = yield* applicationEvents.prunedThroughSequence.pipe(
+        Effect.mapError(
+          (cause) =>
+            new OrchestrationV2GetThreadProjectionError({
+              threadId: input.threadId,
+              message: `Failed to prepare orchestration V2 thread ${input.threadId} replay`,
+              cause,
+            }),
+        ),
+      );
+      // An idle thread's cursor sits at its own high-water: nothing was missed, so replay nothing.
+      if (
+        input.afterSequence > highWater ||
+        (input.afterSequence < highWater && input.afterSequence < prunedThrough)
+      ) {
         return yield* snapshotThenLive();
       }
       const stats = yield* applicationEvents
@@ -1009,9 +1024,25 @@ export const subscribeOrchestrationV2Thread = Effect.fn("ws.orchestrationV2.subs
         // Retained creation events may describe deleted threads; replace replay only if a snapshot exists.
         if (shell !== null) return yield* snapshotThenLive();
       }
-      const replay = coalesceLiveUpdatedEvents(
-        yield* loadReplayThrough(input.afterSequence, highWater),
-      );
+      const replayed = yield* loadReplayThrough(input.afterSequence, highWater);
+      // Pruning publishes its boundary before deleting, so a pass during the read shows up here.
+      if (
+        input.afterSequence < highWater &&
+        input.afterSequence <
+          (yield* applicationEvents.prunedThroughSequence.pipe(
+            Effect.mapError(
+              (cause) =>
+                new OrchestrationV2GetThreadProjectionError({
+                  threadId: input.threadId,
+                  message: `Failed to prepare orchestration V2 thread ${input.threadId} replay`,
+                  cause,
+                }),
+            ),
+          ))
+      ) {
+        return yield* snapshotThenLive();
+      }
+      const replay = coalesceLiveUpdatedEvents(replayed);
       const plan = decideThreadResume({
         afterSequence: input.afterSequence,
         highWater,
@@ -1245,31 +1276,38 @@ export const subscribeOrchestrationV2Shell = Effect.fn("ws.orchestrationV2.subsc
         });
       }
 
-      const highWater = yield* applicationEvents.latestApplicationSequence;
-      if (!(yield* canReplayPersistedRange(input.afterSequence, highWater, SHELL_RESUME_MAX_GAP))) {
+      const fromSnapshot = Effect.gen(function* () {
         const loaded = yield* loadSnapshot();
         return composeShellStreamWithEnrichment({
           initial: initialSnapshotItems(loaded),
           tail: completionThenLive(loaded.snapshot.snapshotSequence),
           enrichment: enrichmentRefreshes,
         });
+      });
+      const highWater = yield* applicationEvents.latestApplicationSequence;
+      if (!(yield* canReplayPersistedRange(input.afterSequence, highWater, SHELL_RESUME_MAX_GAP))) {
+        return yield* fromSnapshot;
       }
 
       subagentThreadIds = new Set(yield* threadManagement.listActiveSubagentThreadIds());
 
       const loaded = yield* loadProjectMetadataSnapshot(highWater);
-      const replay = toShellStream(
-        applicationEvents
-          .readApplicationEvents({
-            afterSequence: input.afterSequence,
-            throughSequence: highWater,
-            // A row a newer build wrote (e.g. after a downgrade) must not fail
-            // every shell resubscribe. The live tail below resumes from
-            // highWater, so a dropped row never hides later events.
-            skipUnknownEventTypes: true,
-          })
-          .pipe(Stream.filter(filterSubagentTranscript)),
-      );
+      // Read before replying: the range is budgeted above, and a prune pass during the read
+      // publishes its boundary first, so the recheck below catches deleted rows.
+      const replayed = yield* applicationEvents
+        .readApplicationEvents({
+          afterSequence: input.afterSequence,
+          throughSequence: highWater,
+          // A row a newer build wrote (e.g. after a downgrade) must not fail
+          // every shell resubscribe. The live tail below resumes from
+          // highWater, so a dropped row never hides later events.
+          skipUnknownEventTypes: true,
+        })
+        .pipe(Stream.filter(filterSubagentTranscript), Stream.runCollect);
+      if (input.afterSequence < (yield* applicationEvents.prunedThroughSequence)) {
+        return yield* fromSnapshot;
+      }
+      const replay = toShellStream(Stream.fromIterable(replayed));
       return composeShellStreamWithEnrichment({
         initial: initialEnrichmentItems(loaded),
         tail: Stream.concat(Stream.concat(replay, completionMarker), liveFrom(highWater)),
diff --git a/docs/internals/overview.md b/docs/internals/overview.md
index 9e5cf6c9d8a6c..f24e3625d92f8 100644
--- a/docs/internals/overview.md
+++ b/docs/internals/overview.md
@@ -44,8 +44,8 @@ select known environment-local checkouts; the group itself does not store inheri
 
 ## Durable intent and side effects
 
-The event log is the source of truth for orchestration state. The
-[v2 orchestrator](../../apps/server/src/orchestration-v2/Orchestrator.ts) serializes commands and
+Orchestration state is decided as events, and projections are the source of truth once they apply
+them. The [v2 orchestrator](../../apps/server/src/orchestration-v2/Orchestrator.ts) serializes commands and
 decides events without performing provider or filesystem work.
 [EventSink](../../apps/server/src/orchestration-v2/EventSink.ts) commits events, persisted projections,
 the accepted command receipt, and outbox effects in one database transaction. Subscribers receive
@@ -58,7 +58,21 @@ therefore means the intent committed, not that the provider, checkpoint, or othe
 finished. Keep external I/O out of command decisions and the database transaction. Effects tied to
 a lost provider process cannot simply replay; recovery retires them before admitting new work.
 
-Persisted events must remain decodable on replay. Changing a schema affects old environments at
+The event log only keeps what live readers need: about a day of history for reconnect replay and
+command-id retries.
+[ProjectionMaintenance](../../apps/server/src/orchestration-v2/ProjectionMaintenance.ts) deletes
+older events the projections cover, so projections cannot be rebuilt from the log. It keeps each
+stream's newest event (high-water marks, stream versions, snapshot sequences), `thread.created`
+(the legacy importer's marker), every `running` run update (Codex usage history reads the first
+of each attempt), and prompt anchors that retained subagent rows reference. A client whose cursor
+is below both its thread's newest event and the recorded pruned-through sequence missed pruned
+events, so it resumes from a snapshot; an idle thread's cursor resumes without one. Resumes
+recheck that sequence after reading the replay, since a pass can prune during the read. V2 command
+receipts stay for idempotency: a retry older than the retained history is still deduplicated,
+but its replay comes back without the pruned events. Receipts of imported legacy commands are
+removed once their threads are imported.
+
+Retained events must remain decodable on replay. Changing a schema affects old environments at
 startup as well as live RPC traffic. Compatibility work must account for stored history, not just
 what the newest client sends.
 
diff --git a/docs/user/background-service.md b/docs/user/background-service.md
index c36527b2c425c..83974146c2cdf 100644
--- a/docs/user/background-service.md
+++ b/docs/user/background-service.md
@@ -161,8 +161,8 @@ For failures after signing in to T3 Connect, see
 
 ## Reclaim database space
 
-T3 Code removes superseded internal history on its own while it runs; your
-conversations are kept. Databases created before this shrank automatically
+T3 Code removes internal history older than a day on its own while it runs;
+your conversations are kept. Databases created before this shrank automatically
 still hold the freed space on disk until a one-time offline repair returns it
 and turns on automatic shrinking. Settings > Maintenance (web and desktop) or
 Settings > Maintenance (mobile) suggests the repair when at least 1 GiB can be

From 260297b55fc97c5b10ff55511967f6d20c622e54 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Tue, 3 Nov 2026 20:31:00 +0000
Subject: [PATCH 043/167] fix(server): GPT-6.1 Sol no longer compacts after
 every tool call on managed Codex (#30004)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/provider/CodexInstallation.test.ts    | 27 +++++++++
 apps/server/src/provider/CodexInstallation.ts | 56 ++++++++++---------
 2 files changed, 56 insertions(+), 27 deletions(-)

diff --git a/apps/server/src/provider/CodexInstallation.test.ts b/apps/server/src/provider/CodexInstallation.test.ts
index ab266b7a8c01d..daf1dac2654de 100644
--- a/apps/server/src/provider/CodexInstallation.test.ts
+++ b/apps/server/src/provider/CodexInstallation.test.ts
@@ -359,6 +359,33 @@ it.effect("requires an update before running an older activated managed installa
   }).pipe(Effect.scoped, Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))),
 );
 
+it.effect("updates an older supported managed installation to the pinned release on startup", () =>
+  Effect.gen(function* () {
+    const first = yield* makeHarness();
+    yield* first.installation.start;
+    yield* terminalState(first.installation);
+    const executable = yield* first.installation.resolve();
+    const oldDirectory = `${first.installation.managedDirectory}/0.156.0`;
+    yield* first.fs.rename(executable.managedVersionDirectory!, oldDirectory);
+    for (const name of ["codex-package.json", ".install-complete.json"]) {
+      const file = `${oldDirectory}/${name}`;
+      yield* first.fs.writeFileString(
+        file,
+        (yield* first.fs.readFileString(file)).replaceAll("0.156.1", "0.156.0"),
+      );
+    }
+    yield* first.fs.writeFileString(
+      `${first.installation.managedDirectory}/active.json`,
+      '{"version":"0.156.0"}',
+    );
+    const restarted = yield* makeHarness({ baseDir: first.baseDir });
+    expect((yield* restarted.installation.state).operationId).not.toBeNull();
+    expect((yield* terminalState(restarted.installation)).phase).toBe("succeeded");
+    expect((yield* restarted.installation.resolve()).version).toBe("0.156.1");
+    expect(restarted.downloads()).toBe(1);
+  }).pipe(Effect.scoped, Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))),
+);
+
 it.effect("rejects corrupted downloads without publishing a runtime", () =>
   Effect.gen(function* () {
     const { installation, fs } = yield* makeHarness({
diff --git a/apps/server/src/provider/CodexInstallation.ts b/apps/server/src/provider/CodexInstallation.ts
index 83e9e4e15864d..8fdcfbebb328e 100644
--- a/apps/server/src/provider/CodexInstallation.ts
+++ b/apps/server/src/provider/CodexInstallation.ts
@@ -5,6 +5,7 @@ import {
   type ServerProviderCompatibilityAdvisory,
 } from "@t3tools/contracts";
 import { cliArchiveTarCommand } from "@t3tools/shared/cliRelease";
+import { compareSemverVersions } from "@t3tools/shared/semver";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import { resolveCommandPath, resolveSpawnCommand } from "@t3tools/shared/shell";
 import * as Clock from "effect/Clock";
@@ -58,46 +59,46 @@ export interface CodexReleaseAsset {
 }
 const RELEASES: Readonly<Record<string, CodexReleaseAsset>> = {
   "darwin-arm64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "aarch64-apple-darwin",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-aarch64-apple-darwin.tar.gz",
-    sha256: "fea42f9625091f011e38f059da974d52e57ba31831648bb1c7f0b1a385fde547",
-    archiveBytes: 127394863,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-aarch64-apple-darwin.tar.gz",
+    sha256: "55a440cb579f970abe7c79ab181e54b0ea4c419be99f333bbd868eebac9c21f0",
+    archiveBytes: 165951869,
   },
   "darwin-x64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "x86_64-apple-darwin",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-x86_64-apple-darwin.tar.gz",
-    sha256: "618dbcd55419fa041871f777a14b107ceb3fe2d339ef81e21e6ab5374420dc71",
-    archiveBytes: 138670455,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-x86_64-apple-darwin.tar.gz",
+    sha256: "1cb65690230be5982c654ba2655e3a3b594dce9c55b780e78bfdfeff829d7ad9",
+    archiveBytes: 180076524,
   },
   "linux-arm64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "aarch64-unknown-linux-musl",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-aarch64-unknown-linux-musl.tar.gz",
-    sha256: "fdd47ed6aade0360796fd3f6f95a45096f327c15e19e8c7339f9dc5633041786",
-    archiveBytes: 136933361,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-aarch64-unknown-linux-musl.tar.gz",
+    sha256: "7821b77dda2e6283fb1f63f3165177a271da8833e857cf673c6ca1c9db3bfcc6",
+    archiveBytes: 187370368,
   },
   "linux-x64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "x86_64-unknown-linux-musl",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-x86_64-unknown-linux-musl.tar.gz",
-    sha256: "8b711520beddf385467b8da4d2c93736637c6ba1e46811cf0d8606b7c490b6f6",
-    archiveBytes: 145976992,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-x86_64-unknown-linux-musl.tar.gz",
+    sha256: "1d44b28bc4ac9937d7d3532264baa68a507ce364956a0d4ebb856f331cdee254",
+    archiveBytes: 199694962,
   },
   "win32-arm64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "aarch64-pc-windows-msvc",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-aarch64-pc-windows-msvc.tar.gz",
-    sha256: "85994caecdc7609c49fd585c1cdb5677fa9d0acbf789650cff23a13afc9505db",
-    archiveBytes: 142037952,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-aarch64-pc-windows-msvc.tar.gz",
+    sha256: "9383152a72f97bb5dd148493c8214e4fed38d805aa2c3297cb3739f7f130becf",
+    archiveBytes: 187024318,
   },
   "win32-x64": {
-    version: "0.156.1",
+    version: "0.166.0",
     target: "x86_64-pc-windows-msvc",
-    url: "https://github.com/openai/codex/releases/download/rust-v0.156.1/codex-package-x86_64-pc-windows-msvc.tar.gz",
-    sha256: "a2e017db9807e6a2269a26fea0e1d9546469cef4d472a33016bc9f3ad7d3b733",
-    archiveBytes: 153839991,
+    url: "https://github.com/openai/codex/releases/download/rust-v0.166.0/codex-package-x86_64-pc-windows-msvc.tar.gz",
+    sha256: "d559bb88e74d471265857b93b7f19bc250dae527673b9191b33534478093f6bc",
+    archiveBytes: 202589789,
   },
 };
 const resolveCodexReleaseAsset = (platform: NodeJS.Platform, arch: string) =>
@@ -655,14 +656,12 @@ export const makeCodexInstallation = Effect.fn("makeCodexInstallation")(function
         }
         const operationId = yield* random.uuidV4();
         const next: ProviderInstallState = {
-          driver: DRIVER,
+          ...current,
           operationId,
           phase: "downloading",
           downloadedBytes: 0,
           totalBytes: asset.archiveBytes,
           version: asset.version,
-          installedVersion: current.installedVersion,
-          canRemove: current.canRemove,
           message: "Downloading Codex.",
         };
         yield* SubscriptionRef.set(state, next);
@@ -807,6 +806,9 @@ export const makeCodexInstallation = Effect.fn("makeCodexInstallation")(function
           source: "managed",
         }) satisfies ProviderInstallState,
     );
+    // A supported older runtime still resolves, so a raised pin needs its own update.
+    if (asset && compareSemverVersions(installed.version, asset.version) < 0)
+      yield* start.pipe(Effect.ignore);
   }).pipe(
     Effect.catch(() =>
       SubscriptionRef.update(

From bd48d8c8f622dfb4ac3a092061f205b85045d244 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 12:41:07 -0800
Subject: [PATCH 044/167] feat(policy): admins set managed policy from a Group
 Policy template (#29862)

Co-authored-by: Matthew Feroz <136640686+MatthewFeroz@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/policy.ts                 |  63 ++-
 apps/server/src/policy/ManagedPolicy.ts       |   5 +-
 apps/server/src/policy/managedProviders.ts    |   4 +
 .../server/src/policy/policyTemplates.test.ts |  37 ++
 apps/server/src/policy/policyTemplates.ts     | 386 ++++++++++++++++
 docs/user/managed-policy.md                   |  39 +-
 packages/shared/src/managedPolicyFile.test.ts | 224 ++++++++--
 packages/shared/src/managedPolicyFile.ts      | 411 +++++++++++++++---
 8 files changed, 1053 insertions(+), 116 deletions(-)
 create mode 100644 apps/server/src/policy/policyTemplates.test.ts
 create mode 100644 apps/server/src/policy/policyTemplates.ts

diff --git a/apps/server/src/cli/policy.ts b/apps/server/src/cli/policy.ts
index 99275968fd609..b56c5a0ef60cd 100644
--- a/apps/server/src/cli/policy.ts
+++ b/apps/server/src/cli/policy.ts
@@ -1,13 +1,17 @@
 import * as Console from "effect/Console";
+import type { ManagedPolicyDocument } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import * as Path from "effect/Path";
 import * as References from "effect/References";
-import { Argument, Command, GlobalFlag } from "effect/cli";
+import { Argument, Command, Flag, GlobalFlag } from "effect/cli";
 import * as CliError from "effect/cli/CliError";
+import * as SecureRandom from "effect/crypto/SecureRandom";
 
 import * as ManagedPolicy from "../policy/ManagedPolicy.ts";
+import { macosProfile, windowsAdml, windowsAdmx } from "../policy/policyTemplates.ts";
 import { isProcessAlive, readPersistedServerRuntimeState } from "../serverRuntimeState.ts";
 import { projectLocationFlags, resolveCliAuthConfig } from "./config.ts";
 
@@ -103,7 +107,62 @@ const checkCommand = Command.make("check", {
   ),
 );
 
+const SAMPLE_POLICY: ManagedPolicyDocument = {
+  schemaVersion: 1,
+  organization: "Example Corp",
+  limits: { maxRuntimeMode: "auto-accept-edits", clients: ["desktop"], telemetry: false },
+};
+
+const templatesCommand = Command.make("templates", {
+  directory: Argument.String("directory").pipe(
+    Argument.withDescription("Directory to write the templates to."),
+  ),
+  policy: Flag.String("policy").pipe(
+    Flag.withDescription("Policy file to put in the macOS profile. Default: a small sample."),
+    Flag.optional,
+  ),
+}).pipe(
+  Command.withDescription(
+    "Write the Windows Group Policy template and a macOS configuration profile.",
+  ),
+  Command.withHandler(
+    Effect.fn("cli.policy.templates")(function* ({ directory, policy }) {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      let document = SAMPLE_POLICY;
+      if (Option.isSome(policy)) {
+        if (!(yield* fs.exists(policy.value))) {
+          return yield* new CliError.UserError({
+            cause: policy.value,
+            userMessage: `No policy file at ${policy.value}.`,
+          });
+        }
+        const loaded = (yield* ManagedPolicy.load(policy.value)).document;
+        if (loaded !== undefined) document = loaded;
+      }
+      const random = yield* SecureRandom.SecureRandom;
+      const profile = macosProfile(document, {
+        profile: yield* random.uuidV4().pipe(Effect.orDie),
+        payload: yield* random.uuidV4().pipe(Effect.orDie),
+      });
+      if (profile._tag === "Invalid") {
+        return yield* new CliError.UserError({ cause: document, userMessage: profile.reason });
+      }
+      const files = [
+        [path.join(directory, "windows", "t3code.admx"), windowsAdmx()],
+        [path.join(directory, "windows", "en-US", "t3code.adml"), windowsAdml()],
+        [path.join(directory, "macos", "t3code.mobileconfig"), profile.profile],
+      ] as const;
+      for (const [file, contents] of files) {
+        yield* fs.makeDirectory(path.dirname(file), { recursive: true });
+        yield* fs.writeFileString(file, contents);
+        yield* Console.log(file);
+      }
+    }),
+  ),
+);
+
 export const policyCommand = Command.make("policy").pipe(
   Command.withDescription("Inspect the administrator's managed policy."),
-  Command.withSubcommands([showCommand, checkCommand]),
+  Command.withSubcommands([showCommand, checkCommand, templatesCommand]),
 );
diff --git a/apps/server/src/policy/ManagedPolicy.ts b/apps/server/src/policy/ManagedPolicy.ts
index 15167dedd38c2..01651051893c0 100644
--- a/apps/server/src/policy/ManagedPolicy.ts
+++ b/apps/server/src/policy/ManagedPolicy.ts
@@ -185,7 +185,10 @@ const make = Effect.gen(function* () {
   const policy = yield* Option.match(devPath, {
     onSome: load,
     onNone: () =>
-      readManagedPolicy(platform).pipe(
+      readManagedPolicy(
+        platform,
+        ManagedProviders.knownDriverLabels().map(({ driver }) => driver),
+      ).pipe(
         Effect.flatMap((found) =>
           fromDocument(found?.source ?? managedPolicyPath(platform), found?.document),
         ),
diff --git a/apps/server/src/policy/managedProviders.ts b/apps/server/src/policy/managedProviders.ts
index 5d9ce6aee62d2..ac390097e150d 100644
--- a/apps/server/src/policy/managedProviders.ts
+++ b/apps/server/src/policy/managedProviders.ts
@@ -77,6 +77,10 @@ const KNOWN_DRIVERS: ReadonlyMap<ProviderDriverKind, KnownDriver> = new Map([
   ),
 ]);
 
+/** Each driver a policy may name, with the label users see. */
+export const knownDriverLabels = () =>
+  Array.from(KNOWN_DRIVERS, ([driver, { label }]) => ({ driver, label }));
+
 const PINNED_CONFIG_FIELDS = ["binaryPath", "launchArgs"] as const;
 type PinnedConfigField = (typeof PINNED_CONFIG_FIELDS)[number];
 
diff --git a/apps/server/src/policy/policyTemplates.test.ts b/apps/server/src/policy/policyTemplates.test.ts
new file mode 100644
index 0000000000000..9d97f0f311994
--- /dev/null
+++ b/apps/server/src/policy/policyTemplates.test.ts
@@ -0,0 +1,37 @@
+import { assert, it } from "@effect/vitest";
+import {
+  WINDOWS_POLICY_GROUPS,
+  WINDOWS_POLICY_LISTS,
+  WINDOWS_POLICY_VALUES,
+} from "@t3tools/shared/managedPolicyFile";
+
+import { macosProfile, windowsAdmx } from "./policyTemplates.ts";
+
+it("gives every registry value the Windows reader accepts a Group Policy control", () => {
+  const admx = windowsAdmx();
+  for (const name of Object.keys(WINDOWS_POLICY_VALUES)) {
+    assert.include(admx, `valueName="${name}"`);
+  }
+  for (const key of Object.keys(WINDOWS_POLICY_LISTS)) {
+    assert.include(admx, `key="SOFTWARE\\Policies\\T3Tools\\T3Code\\${key}"`);
+  }
+  for (const name of Object.keys(WINDOWS_POLICY_GROUPS)) {
+    assert.include(admx, `valueName="${name}"`);
+  }
+});
+
+it("refuses a profile for a policy with a null value, which a plist cannot hold", () => {
+  const profile = macosProfile(
+    {
+      schemaVersion: 1,
+      organization: "Example Corp",
+      settings: { defaultModelSelection: { value: null, locked: true } },
+    },
+    { profile: "profile-uuid", payload: "payload-uuid" },
+  );
+  assert.deepStrictEqual(profile, {
+    _tag: "Invalid",
+    reason:
+      "settings.defaultModelSelection is null, which a configuration profile cannot hold; deploy this policy as a file.",
+  });
+});
diff --git a/apps/server/src/policy/policyTemplates.ts b/apps/server/src/policy/policyTemplates.ts
new file mode 100644
index 0000000000000..55c15fb94f56c
--- /dev/null
+++ b/apps/server/src/policy/policyTemplates.ts
@@ -0,0 +1,386 @@
+import type { ManagedPolicyDocument } from "@t3tools/contracts";
+import {
+  WINDOWS_POLICY_KEY,
+  WINDOWS_POLICY_GROUPS,
+  WINDOWS_POLICY_LISTS,
+  WINDOWS_POLICY_VALUES,
+} from "@t3tools/shared/managedPolicyFile";
+
+import { knownDriverLabels } from "./managedProviders.ts";
+
+type ValueName = keyof typeof WINDOWS_POLICY_VALUES;
+type ListKey = keyof typeof WINDOWS_POLICY_LISTS;
+
+type Element =
+  | {
+      readonly kind: "text";
+      readonly name: ValueName;
+      readonly label: string;
+      readonly json?: true;
+    }
+  | {
+      readonly kind: "enum";
+      readonly name: ValueName;
+      readonly label: string;
+      readonly items: ReadonlyArray<{ readonly value: string; readonly label: string }>;
+      readonly defaultItem: number;
+    }
+  | {
+      readonly kind: "checkbox";
+      readonly list?: ListKey;
+      readonly name: string;
+      readonly label: string;
+      readonly defaultChecked: boolean;
+    };
+
+interface Policy {
+  readonly id: string;
+  readonly title: string;
+  readonly help: string;
+  /** A policy whose Enabled and Disabled states are themselves the value. */
+  readonly toggle?: ValueName;
+  readonly elements?: ReadonlyArray<Element>;
+}
+
+const RUNTIME_MODES = [
+  { value: "approval-required", label: "Supervised" },
+  { value: "auto-accept-edits", label: "Auto-accept edits" },
+  { value: "auto", label: "Auto" },
+  { value: "full-access", label: "Full access" },
+];
+
+const policies = (): ReadonlyArray<Policy> => [
+  {
+    id: "Organization",
+    title: "Organization",
+    help: 'Required whenever any other T3 Code policy is set: T3 Code will not start with policies that do not name an organization.\n\nUsers see the name as "Managed by <organization>" beside every control the policy locks. The support URL is optional.',
+    elements: [
+      { kind: "text", name: "Organization", label: "Organization name" },
+      { kind: "text", name: "SupportUrl", label: "Support URL (optional)" },
+    ],
+  },
+  {
+    id: "MaxRuntimeMode",
+    title: "Broadest permission mode",
+    help: "The broadest permission mode any thread may use, including threads agents and scheduled tasks start.\n\nA thread already above it cannot run another turn until someone lowers its mode. Under this limit, each provider's launch settings (binary path, launch arguments, environment variables) come only from the policy.\n\nDisabled or Not Configured: no restriction.",
+    elements: [
+      {
+        kind: "enum",
+        name: "MaxRuntimeMode",
+        label: "Broadest permission mode",
+        items: RUNTIME_MODES,
+        defaultItem: 1,
+      },
+    ],
+  },
+  {
+    id: "Clients",
+    title: "Allowed clients",
+    help: "What may connect to T3 Code on this machine.\n\nWithout Remote, T3 Code only listens on this machine, does not create pairing links, signs out devices that paired earlier, and turns T3 Connect off. Check at least one client.\n\nDisabled or Not Configured: no restriction.",
+    elements: [
+      {
+        kind: "checkbox",
+        list: "Clients",
+        name: "desktop",
+        label: "Desktop app on this machine",
+        defaultChecked: true,
+      },
+      {
+        kind: "checkbox",
+        list: "Clients",
+        name: "local-browser",
+        label: "A browser on this machine",
+        defaultChecked: true,
+      },
+      {
+        kind: "checkbox",
+        list: "Clients",
+        name: "remote",
+        label: "Remote: phones, other computers, app.t3.codes",
+        defaultChecked: false,
+      },
+    ],
+  },
+  {
+    id: "Connect",
+    title: "Allow T3 Connect",
+    help: "Disabled turns T3 Connect off and unlinks this machine. Other remote access still follows Allowed clients.\n\nEnabled or Not Configured leaves T3 Connect available.",
+    toggle: "Connect",
+  },
+  {
+    id: "WebhookTasks",
+    title: "Allow webhook tasks",
+    help: "Disabled stops scheduled tasks from using webhook triggers. Existing webhook tasks are kept but do not run.",
+    toggle: "WebhookTasks",
+  },
+  {
+    id: "BrowserCookieImport",
+    title: "Allow importing browser cookies",
+    help: "Disabled stops users from importing cookies from another browser into T3 Code's browser.",
+    toggle: "BrowserCookieImport",
+  },
+  {
+    id: "Telemetry",
+    title: "Allow usage data",
+    help: "Disabled stops T3 Code from sending product usage data and relay connection traces. Enabled cannot turn them on for a user who turned them off.",
+    toggle: "Telemetry",
+  },
+  {
+    id: "AllowedDrivers",
+    title: "Allowed providers",
+    help: "Only the checked providers may run. Threads on other providers stay, marked unavailable.\n\nDisabled or Not Configured: no restriction.",
+    elements: knownDriverLabels().map(({ driver, label }) => ({
+      kind: "checkbox" as const,
+      list: "AllowedDrivers" as const,
+      name: driver,
+      label,
+      defaultChecked: driver === "codex" || driver === "claudeAgent",
+    })),
+  },
+  {
+    id: "Updates",
+    title: "Updates",
+    help: "Off stops T3 Code from checking for updates, for machines that receive T3 Code through device management.\n\nA feed URL makes the desktop app update from your own mirror of the release feed instead of GitHub; it must be https. Unchecking nightly makes the nightly channel unavailable.\n\nDisabled or Not Configured: no restriction.",
+    elements: [
+      {
+        kind: "enum",
+        name: "UpdatesMode",
+        label: "Updates",
+        items: [
+          { value: "auto", label: "Automatic" },
+          { value: "off", label: "Off" },
+        ],
+        defaultItem: 0,
+      },
+      { kind: "text", name: "UpdatesFeedUrl", label: "Feed URL (optional)" },
+      {
+        kind: "checkbox",
+        name: "AllowNightly",
+        label: "Allow the nightly channel",
+        defaultChecked: true,
+      },
+    ],
+  },
+  {
+    id: "Settings",
+    title: "Managed settings (JSON)",
+    help: 'Defaults and locks for server settings, as the "settings" object of a T3 Code policy. Each key is a setting path; each value is {"value": ..., "locked": true|false}.\n\nExample: {"enableAgentBrowserAccess": {"value": false, "locked": true}}\n\nRun "t3 policy check" on a policy file with the same object to validate it first.',
+    elements: [{ kind: "text", name: "Settings", label: "Settings JSON", json: true }],
+  },
+  {
+    id: "ProviderInstances",
+    title: "Provider settings (JSON)",
+    help: 'Fields set on every instance of a provider, as the "limits.providers.instances" object of a T3 Code policy: environment variables, binaryPath, launchArgs.\n\nExample: {"claudeAgent": {"locked": true, "environment": [{"name": "CLAUDE_CODE_USE_BEDROCK", "value": "1"}]}}\n\nEvery user on the machine can read this value, so do not put credentials in it.',
+    elements: [
+      { kind: "text", name: "ProviderInstances", label: "Provider settings JSON", json: true },
+    ],
+  },
+];
+
+const escapeXml = (text: string) =>
+  text
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;");
+
+// ADMX keys are relative to the hive the policy class picks.
+const ADMX_KEY = WINDOWS_POLICY_KEY.replace(/^HKLM\\/, "");
+const elementId = (element: Element) =>
+  element.kind === "checkbox" && element.list !== undefined
+    ? `${element.list}_${element.name}`
+    : element.name;
+
+const admxElement = (element: Element) => {
+  const id = elementId(element);
+  switch (element.kind) {
+    case "text":
+      return `<text id="${id}" valueName="${element.name}"${
+        element.name === "Organization" ? ' required="true"' : ""
+      }${element.json ? ' maxLength="32767"' : ""} />`;
+    case "enum":
+      return [
+        `<enum id="${id}" valueName="${element.name}" required="true">`,
+        ...element.items.map(
+          (item) =>
+            `  <item displayName="$(string.${id}_${item.value})"><value><string>${item.value}</string></value></item>`,
+        ),
+        "</enum>",
+      ].join("\n          ");
+    case "checkbox":
+      return `<boolean id="${id}"${
+        element.list === undefined ? "" : ` key="${ADMX_KEY}\\${element.list}"`
+      } valueName="${escapeXml(element.name)}"><trueValue><decimal value="1" /></trueValue><falseValue><decimal value="0" /></falseValue></boolean>`;
+  }
+};
+
+/** The language-neutral Group Policy template. */
+export function windowsAdmx(): string {
+  const body = policies().map((policy) => {
+    const head = `<policy name="${policy.id}" class="Machine" displayName="$(string.${policy.id})" explainText="$(string.${policy.id}_Help)" key="${ADMX_KEY}"`;
+    const common = `<parentCategory ref="T3Code" />\n      <supportedOn ref="SUPPORTED_T3Code" />`;
+    if (policy.toggle !== undefined) {
+      return `    ${head} valueName="${policy.toggle}">
+      ${common}
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>`;
+    }
+    const grouped = Object.hasOwn(WINDOWS_POLICY_GROUPS, policy.id);
+    return `    ${head}${grouped ? ` valueName="${policy.id}"` : ""} presentation="$(presentation.${policy.id})">
+      ${common}${grouped ? '\n      <enabledValue><decimal value="1" /></enabledValue>\n      <disabledValue><decimal value="0" /></disabledValue>' : ""}
+      <elements>
+        ${(policy.elements ?? []).map(admxElement).join("\n        ")}
+      </elements>
+    </policy>`;
+  });
+  return `<?xml version="1.0" encoding="utf-8"?>
+<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
+  <policyNamespaces>
+    <target prefix="t3code" namespace="T3Tools.Policies.T3Code" />
+  </policyNamespaces>
+  <resources minRequiredRevision="1.0" />
+  <supportedOn>
+    <definitions>
+      <definition name="SUPPORTED_T3Code" displayName="$(string.SUPPORTED_T3Code)" />
+    </definitions>
+  </supportedOn>
+  <categories>
+    <category name="T3Code" displayName="$(string.T3Code)" />
+  </categories>
+  <policies>
+${body.join("\n")}
+  </policies>
+</policyDefinitions>
+`;
+}
+
+const presentationElement = (element: Element) => {
+  const id = elementId(element);
+  switch (element.kind) {
+    case "text":
+      return `<textBox refId="${id}"><label>${escapeXml(element.label)}</label></textBox>`;
+    case "enum":
+      return `<dropdownList refId="${id}" noSort="true" defaultItem="${element.defaultItem}">${escapeXml(element.label)}</dropdownList>`;
+    case "checkbox":
+      return `<checkBox refId="${id}" defaultChecked="${element.defaultChecked}">${escapeXml(element.label)}</checkBox>`;
+  }
+};
+
+/** The en-US strings and dialog layouts for `windowsAdmx`. */
+export function windowsAdml(): string {
+  const strings: Array<readonly [string, string]> = [
+    ["T3Code", "T3 Code"],
+    ["SUPPORTED_T3Code", "T3 Code with managed policy support"],
+  ];
+  const presentations: Array<string> = [];
+  for (const policy of policies()) {
+    strings.push([policy.id, policy.title], [`${policy.id}_Help`, policy.help]);
+    for (const element of policy.elements ?? []) {
+      if (element.kind === "enum") {
+        for (const item of element.items) {
+          strings.push([`${elementId(element)}_${item.value}`, item.label]);
+        }
+      }
+    }
+    if (policy.elements !== undefined) {
+      presentations.push(
+        `      <presentation id="${policy.id}">\n        ${policy.elements.map(presentationElement).join("\n        ")}\n      </presentation>`,
+      );
+    }
+  }
+  return `<?xml version="1.0" encoding="utf-8"?>
+<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
+  <displayName>T3 Code</displayName>
+  <description>Policies for T3 Code</description>
+  <resources>
+    <stringTable>
+${strings.map(([id, text]) => `      <string id="${id}">${escapeXml(text)}</string>`).join("\n")}
+    </stringTable>
+    <presentationTable>
+${presentations.join("\n")}
+    </presentationTable>
+  </resources>
+</policyDefinitionResources>
+`;
+}
+
+const plistValue = (value: unknown, indent: string): string => {
+  const inner = `${indent}  `;
+  if (typeof value === "string") return `${indent}<string>${escapeXml(value)}</string>`;
+  if (typeof value === "boolean") return `${indent}<${value} />`;
+  if (typeof value === "number") {
+    return Number.isInteger(value)
+      ? `${indent}<integer>${value}</integer>`
+      : `${indent}<real>${value}</real>`;
+  }
+  if (Array.isArray(value)) {
+    return `${indent}<array>\n${value.map((item) => plistValue(item, inner)).join("\n")}\n${indent}</array>`;
+  }
+  const entries = Object.entries(value as Record<string, unknown>);
+  return `${indent}<dict>\n${entries
+    .map(([key, item]) => `${inner}<key>${escapeXml(key)}</key>\n${plistValue(item, inner)}`)
+    .join("\n")}\n${indent}</dict>`;
+};
+
+/** Where `value` holds a `null`, as path segments, or undefined when it holds none. */
+const nullPath = (
+  value: unknown,
+  path: ReadonlyArray<string>,
+): ReadonlyArray<string> | undefined => {
+  if (value === null) return path;
+  if (typeof value !== "object") return undefined;
+  for (const [key, item] of Object.entries(value)) {
+    const found = nullPath(item, [...path, key]);
+    if (found !== undefined) return found;
+  }
+  return undefined;
+};
+
+/** A device configuration profile that installs `document` for `com.t3tools.t3code`. */
+export function macosProfile(
+  document: ManagedPolicyDocument,
+  uuids: { readonly profile: string; readonly payload: string },
+):
+  | { readonly _tag: "Valid"; readonly profile: string }
+  | { readonly _tag: "Invalid"; readonly reason: string } {
+  // A plist has no null, and a setting may be locked empty.
+  const empty = nullPath(document, []);
+  if (empty !== undefined) {
+    const setting =
+      empty[0] === "settings" && empty.at(-1) === "value" ? empty.slice(0, -1) : empty;
+    return {
+      _tag: "Invalid",
+      reason: `${setting.join(".")} is null, which a configuration profile cannot hold; deploy this policy as a file.`,
+    };
+  }
+  const profile = {
+    PayloadContent: [
+      {
+        PayloadDisplayName: "T3 Code policy",
+        PayloadIdentifier: `com.t3tools.t3code.policy.${uuids.payload}`,
+        PayloadType: "com.t3tools.t3code",
+        PayloadUUID: uuids.payload,
+        PayloadVersion: 1,
+        ...document,
+      },
+    ],
+    PayloadDescription: "Configures T3 Code for every user on this Mac.",
+    PayloadDisplayName: `T3 Code policy for ${document.organization}`,
+    PayloadIdentifier: `com.t3tools.t3code.policy`,
+    PayloadOrganization: document.organization,
+    PayloadScope: "System",
+    PayloadType: "Configuration",
+    PayloadUUID: uuids.profile,
+    PayloadVersion: 1,
+  };
+  return {
+    _tag: "Valid",
+    profile: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+${plistValue(profile, "")}
+</plist>
+`,
+  };
+}
diff --git a/docs/user/managed-policy.md b/docs/user/managed-policy.md
index 16febe7aaaf3c..6017444e52a9f 100644
--- a/docs/user/managed-policy.md
+++ b/docs/user/managed-policy.md
@@ -46,11 +46,11 @@ Every user on the machine can read the policy, so do not put credentials in it.
 
 Use one of these per machine:
 
-| OS      | Native policy                                                       | Policy file                                       |
-| ------- | ------------------------------------------------------------------- | ------------------------------------------------- |
-| macOS   | Configuration profile for `com.t3tools.t3code`                      | `/Library/Application Support/T3Code/policy.json` |
-| Windows | `Policy` string value under `HKLM\SOFTWARE\Policies\T3Tools\T3Code` | `C:\Program Files\T3Code\policy.json`             |
-| Linux   |                                                                     | `/etc/t3code/policy.json`                         |
+| OS      | Native policy                                                                                        | Policy file                                       |
+| ------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
+| macOS   | Configuration profile for `com.t3tools.t3code`                                                       | `/Library/Application Support/T3Code/policy.json` |
+| Windows | Group Policy template, or a `Policy` JSON value (both under `HKLM\SOFTWARE\Policies\T3Tools\T3Code`) | `C:\Program Files\T3Code\policy.json`             |
+| Linux   |                                                                                                      | `/etc/t3code/policy.json`                         |
 
 T3 Code does not merge sources. If a machine has both a native policy and a policy file, T3 Code
 refuses to start until you remove one.
@@ -62,14 +62,28 @@ administrators.
 `com.t3tools.t3code`. The payload's keys are the policy's top-level keys (`schemaVersion`,
 `organization`, `supportUrl`, `settings`, `limits`); JSON objects become dictionaries and lists
 become arrays. To make the payload from a policy file you checked, run
-`plutil -convert xml1 -o com.t3tools.t3code.plist policy.json` and upload the result. Install it as
+`plutil -convert xml1 -o com.t3tools.t3code.plist policy.json` and upload the result, or run
+`t3 policy templates <directory> --policy policy.json` to write a complete
+`macos/t3code.mobileconfig`. Install it as
 a device profile, since T3 Code ignores user profiles, and deploy only one profile for this domain.
 A profile cannot hold `null`, so use a policy file if a setting's value must be `null`.
 
-**Windows registry.** Set the `Policy` value (`REG_SZ`) to the whole policy as one line of JSON,
+**Windows Group Policy.** Run `t3 policy templates <directory>` and copy
+`windows/t3code.admx` and `windows/en-US/t3code.adml` into your `PolicyDefinitions` folder or
+central store, or import them into Intune. The policies appear under Computer Configuration >
+Administrative Templates > T3 Code. Set **Organization** whenever you set any other T3 Code policy.
+Locks and provider fields go in the two JSON policies, as the same objects a policy file would hold.
+Machines pick up a change at the next Group Policy refresh; run `gpupdate /target:computer /force`
+to apply it now, then restart T3 Code.
+Setting **Allow T3 Connect**, **Allow webhook tasks**, **Allow importing browser cookies**, or
+**Allow usage data** to **Disabled** turns that feature off. Setting any other T3 Code policy to
+**Disabled** restricts nothing, the same as **Not Configured**.
+
+**Windows registry value.** Instead of the template, set the `Policy` value (`REG_SZ`) to the whole policy as one line of JSON,
 from Group Policy Preferences or an Intune script. T3 Code reads it through the Windows registry
-API, so it works where registry tools such as `reg.exe` are blocked for users. In PowerShell, as an
-administrator:
+API, so it works where registry tools such as `reg.exe` are blocked for users. Use one or the other:
+T3 Code refuses to start when the key holds both a `Policy` value and the template's settings. In
+PowerShell, as an administrator:
 
 ```powershell
 $json = (Get-Content -Raw -Encoding UTF8 policy.json) -replace '\r?\n\s*', ''
@@ -92,7 +106,8 @@ reopen the desktop app, or run `t3 service restart` for the
 [background service](./background-service.md). Reconnecting a phone or browser does not reload the
 policy.
 
-To remove a policy, delete the file, remove the profile, or delete the registry value, then restart
+To remove a policy, delete the file, remove the profile, set the Group Policy settings to
+**Not Configured**, or delete the registry value, then restart
 the server. Users get back the settings they had chosen, since T3 Code never writes policy values
 into them.
 
@@ -104,7 +119,9 @@ version does not support, or a machine with both a native policy and a file. The
 the policy came from and what is wrong.
 
 `t3 policy check` catches the same problems in a JSON file. For a profile or registry value, check
-the JSON before you convert it. A policy written for a newer version can use keys an older one
+the JSON before you convert it. For the Group Policy template, check a complete policy file that
+holds the same settings, then paste its `settings` and `limits.providers.instances` objects into the
+two JSON policies. A policy written for a newer version can use keys an older one
 cannot enforce, so upgrade T3 Code before you deploy a policy that uses them.
 
 ## Settings
diff --git a/packages/shared/src/managedPolicyFile.test.ts b/packages/shared/src/managedPolicyFile.test.ts
index f6cf7ef8c2cb6..2ab3ea710e3ec 100644
--- a/packages/shared/src/managedPolicyFile.test.ts
+++ b/packages/shared/src/managedPolicyFile.test.ts
@@ -2,6 +2,7 @@ import { assert, describe, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import { ChildProcessSpawner } from "effect/process";
@@ -12,6 +13,7 @@ import {
   MACOS_MANAGED_PREFERENCES_PATH,
   managedPolicyPath,
   readManagedPolicy,
+  type RegistryKey,
   WINDOWS_POLICY_KEY,
   layerWindowsRegistry,
   WindowsRegistry,
@@ -23,8 +25,10 @@ const policy = JSON.stringify({ schemaVersion: 1, organization: "Example Corp" }
 /** What a command prints and exits with. */
 type Result = { readonly stdout: string; readonly exitCode: number };
 
-/** The registry's `Policy` value: its text, absent, or the Win32 error reading it fails with. */
-type RegistryAnswer = string | undefined | { readonly code?: number };
+/** Keys below the policy key ("" for the key itself), or the error every read fails with. */
+type RegistryAnswer = Readonly<Record<string, RegistryKey>> | WindowsRegistryError;
+const isRegistryError = Schema.is(WindowsRegistryError);
+const POLICY_SUBKEY = WINDOWS_POLICY_KEY.slice("HKLM\\".length);
 
 /** Files that exist, what a command prints and exits with by command name, and the registry. */
 const machine = (
@@ -36,10 +40,10 @@ const machine = (
     Layer.succeed(
       WindowsRegistry,
       WindowsRegistry.of({
-        readMachineString: () =>
-          typeof registry === "object"
-            ? Effect.fail(new WindowsRegistryError(registry))
-            : Effect.succeed(registry),
+        readMachineKey: (subkey) =>
+          isRegistryError(registry)
+            ? Effect.fail(registry)
+            : Effect.succeed(registry[subkey.slice(POLICY_SUBKEY.length + 1)]),
       }),
     ),
     FileSystem.layerNoop({
@@ -70,11 +74,34 @@ const machine = (
     ),
   );
 
+/** A policy key holding `values`, with checkbox subkeys of `name=0|1` entries. */
+const policyKey = (
+  values: RegistryKey["values"],
+  subkeys: Readonly<Record<string, Readonly<Record<string, number>>>> = {},
+): Readonly<Record<string, RegistryKey>> => ({
+  "": { values, subkeys: Object.keys(subkeys) },
+  ...Object.fromEntries(
+    Object.entries(subkeys).map(([name, boxes]) => [
+      name,
+      {
+        values: Object.entries(boxes).map(([box, data]) => ({
+          name: box,
+          type: "REG_DWORD" as const,
+          data,
+        })),
+        subkeys: [],
+      },
+    ]),
+  ),
+});
+const text = (name: string, data: string) => ({ name, type: "REG_SZ" as const, data });
+const dword = (name: string, data: number) => ({ name, type: "REG_DWORD" as const, data });
+
 const read = (
   platform: NodeJS.Platform,
   files: Readonly<Record<string, string>>,
   commands: Parameters<typeof machine>[1] = {},
-  registry: RegistryAnswer = undefined,
+  registry: RegistryAnswer = {},
 ) =>
   readManagedPolicy(platform).pipe(
     Effect.map((found) => found?.source),
@@ -139,52 +166,189 @@ describe("readManagedPolicy", () => {
   );
 
   it.effect(
-    "reads the Windows Policies registry value, and treats only an absent one as none",
+    "reads a Policy value of JSON from the registry, and treats only an absent key as none",
     () =>
       Effect.gen(function* () {
         const file = { [managedPolicyPath("win32")]: policy };
         const win32 = (files: Readonly<Record<string, string>>, registry: RegistryAnswer) =>
           read("win32", files, {}, registry);
+        const json = policyKey([text("Policy", policy)]);
 
-        assert.equal(yield* win32({}, policy), WINDOWS_POLICY_KEY);
-        assert.isUndefined(yield* win32({}, undefined));
-        assert.equal(yield* win32(file, undefined), managedPolicyPath("win32"));
-        assert.include(yield* win32(file, policy), "deploy the policy one way");
+        assert.equal(yield* win32({}, json), WINDOWS_POLICY_KEY);
+        assert.isUndefined(yield* win32({}, {}));
+        assert.equal(yield* win32(file, {}), managedPolicyPath("win32"));
+        assert.include(yield* win32(file, json), "deploy the policy one way");
         // A read that fails, here access denied, is not read as no policy, file or not.
         for (const files of [{}, file]) {
           assert.include(
-            yield* win32(files, { code: 5 }),
+            yield* win32(files, new WindowsRegistryError({ code: 5 })),
             "the registry cannot be read (Windows error 5)",
           );
         }
-        assert.include(yield* win32({}, {}), "cannot load its registry reader; reinstall T3 Code");
         assert.include(
-          yield* win32({}, { code: 1630 }),
+          yield* win32({}, new WindowsRegistryError({})),
+          "cannot load its registry reader; reinstall T3 Code",
+        );
+        assert.include(
+          yield* win32({}, policyKey([{ name: "Policy", type: "other" }])),
           "its Policy value is not a string (REG_SZ)",
         );
-        assert.include(yield* win32({}, "{ not json"), "does not match the policy schema");
+        assert.include(
+          yield* win32({}, policyKey([text("Policy", "{ not json")])),
+          "does not match the policy schema",
+        );
+        for (const both of [
+          policyKey([text("Policy", policy), text("Organization", "Example")]),
+          policyKey([text("Policy", policy)], { Clients: { desktop: 1 } }),
+        ]) {
+          assert.include(yield* win32({}, both), "both a Policy value and Group Policy settings");
+        }
+        // Not Configured clears a list policy's values but can leave its empty subkey behind.
+        assert.equal(
+          yield* win32({}, policyKey([text("Policy", policy)], { Clients: {} })),
+          WINDOWS_POLICY_KEY,
+        );
       }),
   );
 
+  it.effect("builds the policy from the values the Group Policy template writes", () =>
+    Effect.gen(function* () {
+      const organization = text("Organization", "Société 日本 ✓");
+      const document = (registry: RegistryAnswer) =>
+        readManagedPolicy("win32", ["codex", "claudeAgent"]).pipe(
+          Effect.map((found): unknown => found?.document),
+          Effect.catchTags({
+            ManagedPolicyFileError: (error) => Effect.succeed(`error: ${error.reason}`),
+          }),
+          Effect.provide(machine({}, {}, registry)),
+        );
+
+      assert.deepStrictEqual(
+        yield* document(
+          policyKey(
+            [
+              organization,
+              text("SupportUrl", ""),
+              // Registry names ignore case.
+              text("maxRuntimeMode", "auto-accept-edits"),
+              dword("Telemetry", 0),
+              text("Settings", '{"enableAgentBrowserAccess": {"value": false, "locked": true}}'),
+              text("UpdatesMode", "off"),
+              dword("AllowNightly", 1),
+              dword("Updates", 1),
+              dword("Clients", 1),
+              dword("AllowedDrivers", 1),
+            ],
+            // Registry names ignore case, so a subkey written in other case still counts.
+            {
+              clients: { Desktop: 1, "LOCAL-BROWSER": 1, REMOTE: 1 },
+              AllowedDrivers: { Codex: 1, CLAUDEAGENT: 1, UnknownDriver: 1 },
+            },
+          ),
+        ),
+        {
+          schemaVersion: 1,
+          organization: "Société 日本 ✓",
+          settings: { enableAgentBrowserAccess: { value: false, locked: true } },
+          limits: {
+            maxRuntimeMode: "auto-accept-edits",
+            telemetry: false,
+            updates: { mode: "off", allowNightly: true },
+            clients: ["desktop", "local-browser", "remote"],
+            providers: { allowedDrivers: ["codex", "claudeAgent", "UnknownDriver"] },
+          },
+        },
+      );
+
+      // Disabling a policy leaves each checkbox's falseValue behind; it restricts nothing.
+      const disabledGroups = {
+        Clients: { desktop: 0, "local-browser": 0, remote: 0 },
+        AllowedDrivers: { codex: 0, claudeAgent: 0 },
+      };
+      assert.deepStrictEqual(
+        yield* document(
+          policyKey(
+            [
+              organization,
+              dword("Clients", 0),
+              dword("AllowedDrivers", 0),
+              dword("Updates", 0),
+              dword("AllowNightly", 0),
+              dword("Telemetry", 0),
+            ],
+            disabledGroups,
+          ),
+        ),
+        { schemaVersion: 1, organization: "Société 日本 ✓", limits: { telemetry: false } },
+      );
+      // With nothing else configured, that is no policy rather than one missing Organization.
+      assert.isUndefined(
+        yield* document(
+          policyKey([dword("AllowedDrivers", 0)], {
+            AllowedDrivers: disabledGroups.AllowedDrivers,
+          }),
+        ),
+      );
+      assert.isUndefined(yield* document(policyKey([])));
+
+      // Anything the template does not write fails closed rather than being ignored.
+      for (const [registry, reason] of [
+        [policyKey([organization, dword("Telemetry", 2)]), "DWORD of 0 or 1"],
+        [policyKey([organization, text("MaxMode", "auto")]), "not a T3 Code policy value"],
+        [policyKey([organization], { Other: { x: 1 } }), "Other is not a T3 Code policy key"],
+        [
+          {
+            ...policyKey([organization, dword("Clients", 1)], { Clients: { desktop: 1 } }),
+            Clients: { values: [dword("desktop", 1)], subkeys: ["Nested"] },
+          },
+          "Clients\\Nested is not a T3 Code policy key",
+        ],
+        [policyKey([organization, text("Settings", "{")]), "not valid JSON"],
+        [policyKey([organization, dword("Clients", 2)]), "DWORD of 0 or 1"],
+        [
+          policyKey([organization, dword("Clients", 1)], { Clients: { UnknownClient: 1 } }),
+          "does not match the policy schema",
+        ],
+        [
+          policyKey([organization, dword("Clients", 1)], { Clients: { desktop: 0 } }),
+          "does not match the policy schema",
+        ],
+        [policyKey([dword("Organization", 1)]), "Organization must be a string"],
+        // REG_EXPAND_SZ would fill in the reading user's variables.
+        [policyKey([{ name: "Organization", type: "other" }]), "Organization must be a string"],
+        [
+          policyKey([text("MaxRuntimeMode", "auto-accept-edits")]),
+          "set the Organization policy whenever another T3 Code policy is set",
+        ],
+      ] as const) {
+        assert.include(yield* document(registry), reason);
+      }
+    }),
+  );
+
   it.effect.runIf(HostProcess.Platform.defaultValue() === "win32")(
-    "reads REG_SZ values through the Win32 API, and refuses other types",
+    "lists registry values and subkeys through the Win32 API",
     () =>
       Effect.gen(function* () {
         const registry = yield* WindowsRegistry;
-        const version = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
-        assert.match((yield* registry.readMachineString(version, "ProductName")) ?? "", /Windows/);
-        assert.isUndefined(yield* registry.readMachineString(version, "T3CodeNoSuchValue"));
-        assert.isUndefined(
-          yield* registry.readMachineString("SOFTWARE\\T3CodeNoSuchKey", "Policy"),
+        const version = yield* registry.readMachineKey(
+          "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
         );
-        // REG_DWORD, and REG_EXPAND_SZ, which would otherwise expand the user's variables.
-        for (const [key, value] of [
-          [version, "CurrentMajorVersionNumber"],
-          ["SOFTWARE\\Microsoft\\Windows\\CurrentVersion", "ProgramFilesPath"],
-        ] as const) {
-          const error = yield* registry.readMachineString(key, value).pipe(Effect.flip);
-          assert.equal(error.code, 1630);
-        }
+        const value = (name: string) => version?.values.find((entry) => entry.name === name);
+        const product = value("ProductName");
+        assert.match(product?.type === "REG_SZ" ? product.data : "", /Windows/);
+        assert.equal(value("CurrentMajorVersionNumber")?.type, "REG_DWORD");
+        assert.isUndefined(yield* registry.readMachineKey("SOFTWARE\\T3CodeNoSuchKey"));
+        const windows = yield* registry.readMachineKey(
+          "SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
+        );
+        // REG_EXPAND_SZ, which would otherwise expand the user's variables.
+        assert.equal(
+          windows?.values.find((entry) => entry.name === "ProgramFilesPath")?.type,
+          "other",
+        );
+        const parent = yield* registry.readMachineKey("SOFTWARE\\Microsoft\\Windows NT");
+        assert.isTrue(parent?.subkeys.includes("CurrentVersion"));
       }).pipe(Effect.provide(layerWindowsRegistry(() => import("ffi-rs")))),
   );
 });
diff --git a/packages/shared/src/managedPolicyFile.ts b/packages/shared/src/managedPolicyFile.ts
index 12fb5a666a04a..e6faf3b711239 100644
--- a/packages/shared/src/managedPolicyFile.ts
+++ b/packages/shared/src/managedPolicyFile.ts
@@ -1,4 +1,8 @@
-import { ManagedPolicyDocument, SERVER_EXIT_CODE_MANAGED_POLICY } from "@t3tools/contracts";
+import {
+  ManagedPolicyClient,
+  ManagedPolicyDocument,
+  SERVER_EXIT_CODE_MANAGED_POLICY,
+} from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
@@ -94,8 +98,41 @@ export const readManagedPolicyFile = Effect.fn("readManagedPolicyFile")(function
 export const MACOS_MANAGED_PREFERENCES_PATH =
   "/Library/Managed Preferences/com.t3tools.t3code.plist";
 const WINDOWS_POLICY_SUBKEY = "SOFTWARE\\Policies\\T3Tools\\T3Code";
-/** The registry key Group Policy and Intune write to on Windows; `Policy` holds the JSON. */
+/**
+ * The registry key Group Policy and Intune write to on Windows. It holds either the Group Policy
+ * template's values, one per control, or a `Policy` string with the whole policy as JSON.
+ */
 export const WINDOWS_POLICY_KEY = `HKLM\\${WINDOWS_POLICY_SUBKEY}`;
+
+/** Each value a Group Policy control writes, and where it lands in the document. */
+export const WINDOWS_POLICY_VALUES = {
+  Organization: { type: "string", path: ["organization"] },
+  SupportUrl: { type: "string", path: ["supportUrl"] },
+  Settings: { type: "json", path: ["settings"] },
+  MaxRuntimeMode: { type: "string", path: ["limits", "maxRuntimeMode"] },
+  Connect: { type: "boolean", path: ["limits", "connect"] },
+  WebhookTasks: { type: "boolean", path: ["limits", "webhookTasks"] },
+  Telemetry: { type: "boolean", path: ["limits", "telemetry"] },
+  BrowserCookieImport: { type: "boolean", path: ["limits", "browserCookieImport"] },
+  ProviderInstances: { type: "json", path: ["limits", "providers", "instances"] },
+  UpdatesMode: { type: "string", path: ["limits", "updates", "mode"] },
+  UpdatesFeedUrl: { type: "string", path: ["limits", "updates", "feedUrl"] },
+  AllowNightly: { type: "boolean", path: ["limits", "updates", "allowNightly"] },
+} as const satisfies Record<
+  string,
+  { readonly type: "string" | "json" | "boolean"; readonly path: ReadonlyArray<string> }
+>;
+
+/** Subkeys of checkboxes: every value set to 1 is one entry of the list at `path`. */
+export const WINDOWS_POLICY_LISTS = {
+  Clients: ["limits", "clients"],
+  AllowedDrivers: ["limits", "providers", "allowedDrivers"],
+} as const satisfies Record<string, ReadonlyArray<string>>;
+// A disabled policy still writes its checkboxes' falseValue; its own DWORD disambiguates it.
+export const WINDOWS_POLICY_GROUPS = {
+  ...WINDOWS_POLICY_LISTS,
+  Updates: ["limits", "updates"],
+} as const satisfies Record<string, ReadonlyArray<string>>;
 // An absolute path: an earlier PATH entry could otherwise answer that there is no policy.
 const PLUTIL = "/usr/bin/plutil";
 
@@ -112,30 +149,50 @@ export class WindowsRegistryError extends Schema.TaggedError<WindowsRegistryErro
   }
 }
 
+/** A registry value; REG_EXPAND_SZ and every other type read as `other`. */
+export type RegistryValue =
+  | { readonly name: string; readonly type: "REG_SZ"; readonly data: string }
+  | { readonly name: string; readonly type: "REG_DWORD"; readonly data: number }
+  | { readonly name: string; readonly type: "other" };
+
+export interface RegistryKey {
+  readonly values: ReadonlyArray<RegistryValue>;
+  readonly subkeys: ReadonlyArray<string>;
+}
+
 /**
- * Reads the registry through the Win32 API in this process. A missing value and a failed read
- * come back apart, and blocked registry tools such as reg.exe do not matter.
+ * Reads the registry through the Win32 API in this process. A missing key and a failed read come
+ * back apart, and blocked registry tools such as reg.exe do not matter.
  */
 export class WindowsRegistry extends Context.Service<
   WindowsRegistry,
   {
-    /** The REG_SZ `value` of HKLM\\`subkey` in the 64-bit view; undefined when either is absent. */
-    readonly readMachineString: (
+    /** The values and subkey names of HKLM\\`subkey` in the 64-bit view; undefined when absent. */
+    readonly readMachineKey: (
       subkey: string,
-      value: string,
-    ) => Effect.Effect<string | undefined, WindowsRegistryError>;
+    ) => Effect.Effect<RegistryKey | undefined, WindowsRegistryError>;
   }
 >()("@t3tools/shared/managedPolicyFile/WindowsRegistry") {}
 
 // (HKEY)(LONG)0x80000002, sign-extended to 64 bits.
 const HKEY_LOCAL_MACHINE = -0x7ffffffen;
-const RRF_RT_REG_SZ = 0x2;
-const RRF_SUBKEY_WOW6464KEY = 0x10000;
-// Without it a REG_EXPAND_SZ value passes as REG_SZ, with the user's variables filled in.
-const RRF_NOEXPAND = 0x10000000;
+const KEY_READ = 0x20019;
+const KEY_WOW64_64KEY = 0x100;
+const REG_SZ = 1;
+const REG_DWORD = 4;
 const ERROR_FILE_NOT_FOUND = 2;
 const ERROR_MORE_DATA = 234;
-const ERROR_UNSUPPORTED_TYPE = 1630;
+const ERROR_NO_MORE_ITEMS = 259;
+// Value and key names are at most 16,383 characters.
+const MAX_NAME_CHARS = 16_384;
+
+class Win32Failure extends Error {
+  readonly code: number;
+  constructor(code: number) {
+    super(`Windows error ${code}`);
+    this.code = code;
+  }
+}
 
 /**
  * Each app passes how it loads ffi-rs: a server single-executable resolves packages on disk only
@@ -146,67 +203,129 @@ export const layerWindowsRegistry = (loadFfi: () => Promise<typeof import("ffi-r
     WindowsRegistry,
     Effect.gen(function* () {
       const architecture = yield* HostProcess.Architecture;
-      const loadGetValue = yield* Effect.cached(
+      const loadApi = yield* Effect.cached(
         Effect.tryPromise({
           try: async () => {
-            // HKEY_LOCAL_MACHINE and the pointer arguments below are 64-bit.
+            // HKEY_LOCAL_MACHINE, key handles, and the null pointers below are 64-bit.
             if (architecture !== "x64" && architecture !== "arm64") {
               throw new Error(`no registry access on ${architecture}`);
             }
             const { DataType, load, open } = await loadFfi();
             open({ library: "t3-advapi32", path: "advapi32.dll" });
-            return (subkey: string, value: string, data: Buffer, size: Buffer): number =>
+            const call = (
+              funcName: string,
+              paramsType: Array<(typeof DataType)[keyof typeof DataType]>,
+              paramsValue: Array<unknown>,
+            ): number =>
               load({
                 library: "t3-advapi32",
-                funcName: "RegGetValueW",
+                funcName,
                 retType: DataType.I32,
-                paramsType: [
-                  DataType.BigInt,
-                  DataType.WString,
-                  DataType.WString,
-                  DataType.U32,
-                  DataType.BigInt,
-                  DataType.U8Array,
-                  DataType.U8Array,
-                ],
-                paramsValue: [
-                  HKEY_LOCAL_MACHINE,
-                  subkey,
-                  value,
-                  RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY | RRF_NOEXPAND,
-                  0n,
-                  data,
-                  size,
-                ],
-              });
+                paramsType,
+                paramsValue,
+              } as Parameters<typeof load>[0]) as number;
+            const { BigInt: Handle, U32, U8Array: Out, WString } = DataType;
+            return {
+              open: (subkey: string, handle: Buffer) =>
+                call(
+                  "RegOpenKeyExW",
+                  [Handle, WString, U32, U32, Out],
+                  [HKEY_LOCAL_MACHINE, subkey, 0, KEY_READ | KEY_WOW64_64KEY, handle],
+                ),
+              enumValue: (
+                key: bigint,
+                index: number,
+                name: Buffer,
+                nameChars: Buffer,
+                type: Buffer,
+                data: Buffer,
+                dataBytes: Buffer,
+              ) =>
+                call(
+                  "RegEnumValueW",
+                  [Handle, U32, Out, Out, Handle, Out, Out, Out],
+                  [key, index, name, nameChars, 0n, type, data, dataBytes],
+                ),
+              enumKey: (key: bigint, index: number, name: Buffer, nameChars: Buffer) =>
+                call(
+                  "RegEnumKeyExW",
+                  [Handle, U32, Out, Out, Handle, Handle, Handle, Handle],
+                  [key, index, name, nameChars, 0n, 0n, 0n, 0n],
+                ),
+              close: (key: bigint) => call("RegCloseKey", [Handle], [key]),
+            };
           },
           catch: (cause) => new WindowsRegistryError({ cause }),
         }),
       );
+
+      const readKey = (api: Effect.Success<typeof loadApi>, subkey: string) => {
+        const handle = Buffer.alloc(8);
+        const opened = api.open(subkey, handle);
+        if (opened === ERROR_FILE_NOT_FOUND) return undefined;
+        if (opened !== 0) throw new Win32Failure(opened);
+        const key = handle.readBigInt64LE();
+        try {
+          const name = Buffer.alloc(MAX_NAME_CHARS * 2);
+          const chars = Buffer.alloc(4);
+          const values: Array<RegistryValue> = [];
+          for (let index = 0; ; index++) {
+            let data = Buffer.alloc(64 * 1024);
+            const type = Buffer.alloc(4);
+            const bytes = Buffer.alloc(4);
+            const attempt = () => {
+              chars.writeUInt32LE(MAX_NAME_CHARS);
+              bytes.writeUInt32LE(data.length);
+              return api.enumValue(key, index, name, chars, type, data, bytes);
+            };
+            let code = attempt();
+            // The value is larger than the buffer; the API reported the size it needs.
+            if (code === ERROR_MORE_DATA) {
+              data = Buffer.alloc(bytes.readUInt32LE());
+              code = attempt();
+            }
+            if (code === ERROR_NO_MORE_ITEMS) break;
+            if (code !== 0) throw new Win32Failure(code);
+            const valueName = name.subarray(0, chars.readUInt32LE() * 2).toString("utf16le");
+            const stored = data.subarray(0, bytes.readUInt32LE());
+            const valueType = type.readUInt32LE();
+            values.push(
+              valueType === REG_SZ
+                ? {
+                    name: valueName,
+                    type: "REG_SZ",
+                    data: stored.toString("utf16le").replace(/\0+$/, ""),
+                  }
+                : valueType === REG_DWORD && stored.length === 4
+                  ? { name: valueName, type: "REG_DWORD", data: stored.readUInt32LE() }
+                  : { name: valueName, type: "other" },
+            );
+          }
+          const subkeys: Array<string> = [];
+          for (let index = 0; ; index++) {
+            chars.writeUInt32LE(MAX_NAME_CHARS);
+            const code = api.enumKey(key, index, name, chars);
+            if (code === ERROR_NO_MORE_ITEMS) break;
+            if (code !== 0) throw new Win32Failure(code);
+            subkeys.push(name.subarray(0, chars.readUInt32LE() * 2).toString("utf16le"));
+          }
+          return { values, subkeys };
+        } finally {
+          api.close(key);
+        }
+      };
+
       return WindowsRegistry.of({
-        readMachineString: Effect.fn("WindowsRegistry.readMachineString")(
-          function* (subkey, value) {
-            const getValue = yield* loadGetValue;
-            const attempt = (bytes: number) =>
-              Effect.try({
-                try: () => {
-                  const data = Buffer.alloc(bytes);
-                  const size = Buffer.alloc(4);
-                  size.writeUInt32LE(bytes);
-                  const code = getValue(subkey, value, data, size);
-                  return { code, data, bytes: size.readUInt32LE() };
-                },
-                catch: (cause) => new WindowsRegistryError({ cause }),
-              });
-            let result = yield* attempt(64 * 1024);
-            // The value grew past the buffer; the API reported the size it needs.
-            if (result.code === ERROR_MORE_DATA) result = yield* attempt(result.bytes);
-            if (result.code === ERROR_FILE_NOT_FOUND) return undefined;
-            if (result.code !== 0) return yield* new WindowsRegistryError({ code: result.code });
-            // The size counts the terminating null RegGetValueW adds.
-            return result.data.subarray(0, result.bytes).toString("utf16le").replace(/\0+$/, "");
-          },
-        ),
+        readMachineKey: Effect.fn("WindowsRegistry.readMachineKey")(function* (subkey) {
+          const api = yield* loadApi;
+          return yield* Effect.try({
+            try: () => readKey(api, subkey),
+            catch: (cause) =>
+              new WindowsRegistryError(
+                cause instanceof Win32Failure ? { code: cause.code, cause } : { cause },
+              ),
+          });
+        }),
       });
     }),
   );
@@ -229,6 +348,115 @@ const run = Effect.fnUntraced(
 );
 
 const decodeJsonExit = Schema.decodeUnknownExit(Schema.fromJsonString(Schema.Unknown));
+type PolicyRegistryValue = RegistryValue & {
+  /** The list subkey the value sits in, or "" for the policy key itself. */
+  readonly key: string;
+};
+
+const setPath = (target: Record<string, unknown>, path: ReadonlyArray<string>, value: unknown) => {
+  let node = target;
+  for (const segment of path.slice(0, -1)) {
+    node = (node[segment] ??= {}) as Record<string, unknown>;
+  }
+  node[path.at(-1)!] = value;
+};
+
+const dwordBoolean = (value: RegistryValue) =>
+  value.type !== "REG_DWORD"
+    ? undefined
+    : value.data === 0
+      ? false
+      : value.data === 1
+        ? true
+        : undefined;
+
+/**
+ * The document the Group Policy template's values describe, undefined when they describe none, or
+ * why they do not describe one.
+ */
+function windowsPolicyDocument(
+  values: ReadonlyArray<PolicyRegistryValue>,
+  knownDrivers: ReadonlyArray<string>,
+): { readonly document: unknown } | { readonly error: string } {
+  // Registry names ignore case; a hand-written `organization` is still Organization.
+  const canonical = new Map(
+    [...Object.keys(WINDOWS_POLICY_VALUES), ...Object.keys(WINDOWS_POLICY_GROUPS)].map((name) => [
+      name.toLowerCase(),
+      name,
+    ]),
+  );
+  values = values.map((value) =>
+    value.key === ""
+      ? { ...value, name: canonical.get(value.name.toLowerCase()) ?? value.name }
+      : value,
+  );
+  const document: Record<string, unknown> = { schemaVersion: 1 };
+  const lists = new Map<string, Array<string>>();
+  const disabled: Array<ReadonlyArray<string>> = [];
+  for (const value of values) {
+    if (value.key !== "" || !Object.hasOwn(WINDOWS_POLICY_GROUPS, value.name)) continue;
+    const enabled = dwordBoolean(value);
+    if (enabled === undefined) return { error: `${value.name} must be a DWORD of 0 or 1` };
+    if (!enabled) {
+      disabled.push(WINDOWS_POLICY_GROUPS[value.name as keyof typeof WINDOWS_POLICY_GROUPS]);
+    } else if (Object.hasOwn(WINDOWS_POLICY_LISTS, value.name)) {
+      lists.set(value.name, []);
+    }
+  }
+  const put = (path: ReadonlyArray<string>, value: unknown) => {
+    if (!disabled.some((prefix) => prefix.every((segment, index) => path[index] === segment))) {
+      setPath(document, path, value);
+    }
+  };
+  for (const value of values) {
+    const where = value.key === "" ? value.name : `${value.key}\\${value.name}`;
+    if (value.key !== "") {
+      const checked = dwordBoolean(value);
+      if (checked === undefined) return { error: `${where} must be a DWORD of 0 or 1` };
+      const list = lists.get(value.key) ?? [];
+      lists.set(value.key, list);
+      if (checked) {
+        const names = value.key === "Clients" ? ManagedPolicyClient.literals : knownDrivers;
+        list.push(
+          names.find((name) => name.toLowerCase() === value.name.toLowerCase()) ?? value.name,
+        );
+      }
+      continue;
+    }
+    if (Object.hasOwn(WINDOWS_POLICY_GROUPS, value.name)) continue;
+    if (!Object.hasOwn(WINDOWS_POLICY_VALUES, value.name)) {
+      return { error: `${value.name} is not a T3 Code policy value` };
+    }
+    const field = WINDOWS_POLICY_VALUES[value.name as keyof typeof WINDOWS_POLICY_VALUES];
+    if (field.type === "boolean") {
+      const flag = dwordBoolean(value);
+      if (flag === undefined) return { error: `${where} must be a DWORD of 0 or 1` };
+      put(field.path, flag);
+      continue;
+    }
+    if (value.type !== "REG_SZ") return { error: `${where} must be a string (REG_SZ)` };
+    // Group Policy writes an empty string for a box left blank.
+    if (value.data === "") continue;
+    if (field.type === "string") {
+      put(field.path, value.data);
+      continue;
+    }
+    const parsed = decodeJsonExit(value.data);
+    if (Exit.isFailure(parsed)) return { error: `${where} is not valid JSON` };
+    put(field.path, parsed.value);
+  }
+  for (const [key, list] of lists) {
+    put(WINDOWS_POLICY_LISTS[key as keyof typeof WINDOWS_POLICY_LISTS], list);
+  }
+  // Policies set to Disabled leave values behind that restrict nothing.
+  if (Object.keys(document).length === 1) return { document: undefined };
+  // The schema would name `["organization"]`, which an admin cannot map to a Group Policy setting.
+  if (document.organization === undefined) {
+    return { error: "set the Organization policy whenever another T3 Code policy is set" };
+  }
+  return { document };
+}
+
 // Strict: keys beside the wrapper, or more than one entry, decode as a plain document and fail.
 const decodeForcedExit = Schema.decodeUnknownExit(
   Schema.Struct({
@@ -261,7 +489,10 @@ function unwrapForced(json: string): unknown {
 }
 
 /** Read the policy a configuration profile or Group Policy set; absent means no such policy. */
-const readPlatformPolicy = Effect.fnUntraced(function* (platform: NodeJS.Platform) {
+const readPlatformPolicy = Effect.fnUntraced(function* (
+  platform: NodeJS.Platform,
+  knownDrivers: ReadonlyArray<string>,
+) {
   if (platform === "darwin") {
     const path = MACOS_MANAGED_PREFERENCES_PATH;
     const exists = yield* (yield* FileSystem.FileSystem)
@@ -286,26 +517,61 @@ const readPlatformPolicy = Effect.fnUntraced(function* (platform: NodeJS.Platfor
   }
   if (platform === "win32") {
     const path = WINDOWS_POLICY_KEY;
-    const raw = yield* (yield* WindowsRegistry)
-      .readMachineString(WINDOWS_POLICY_SUBKEY, "Policy")
-      .pipe(
+    const registry = yield* WindowsRegistry;
+    const readKey = (subkey: string) =>
+      registry.readMachineKey(subkey).pipe(
         Effect.mapError(
           (cause) =>
             new ManagedPolicyFileError({
               path,
               reason:
-                cause.code === ERROR_UNSUPPORTED_TYPE
-                  ? "its Policy value is not a string (REG_SZ)"
-                  : cause.code === undefined
-                    ? "this T3 Code install cannot load its registry reader; reinstall T3 Code"
-                    : `the registry cannot be read (${cause.message})`,
+                cause.code === undefined
+                  ? "this T3 Code install cannot load its registry reader; reinstall T3 Code"
+                  : `the registry cannot be read (${cause.message})`,
               cause,
             }),
         ),
       );
-    return raw === undefined
-      ? undefined
-      : { source: path, document: yield* decodeDocument(path, raw) };
+    const refuse = (reason: string) => new ManagedPolicyFileError({ path, reason });
+    const root = yield* readKey(WINDOWS_POLICY_SUBKEY);
+    if (root === undefined) return undefined;
+    const json = root.values.find((value) => value.name.toLowerCase() === "policy");
+    if (json !== undefined) {
+      // Not Configured clears a list policy's values but can leave its empty subkey behind.
+      let templateSettings = root.values.length > 1;
+      for (const subkey of root.subkeys) {
+        if (templateSettings) break;
+        const child = yield* readKey(`${WINDOWS_POLICY_SUBKEY}\\${subkey}`);
+        templateSettings =
+          child !== undefined && (child.values.length > 0 || child.subkeys.length > 0);
+      }
+      if (templateSettings) {
+        return yield* refuse(
+          "it holds both a Policy value and Group Policy settings; deploy the policy one way",
+        );
+      }
+      if (json.type !== "REG_SZ") return yield* refuse("its Policy value is not a string (REG_SZ)");
+      return { source: path, document: yield* decodeDocument(path, json.data) };
+    }
+    const values: Array<PolicyRegistryValue> = root.values.map((value) => ({ ...value, key: "" }));
+    for (const subkey of root.subkeys) {
+      // Registry names ignore case.
+      const list = Object.keys(WINDOWS_POLICY_LISTS).find(
+        (name) => name.toLowerCase() === subkey.toLowerCase(),
+      );
+      if (list === undefined) return yield* refuse(`${subkey} is not a T3 Code policy key`);
+      const checkboxes = yield* readKey(`${WINDOWS_POLICY_SUBKEY}\\${subkey}`);
+      if (checkboxes === undefined) continue;
+      if (checkboxes.subkeys.length > 0) {
+        return yield* refuse(`${subkey}\\${checkboxes.subkeys[0]} is not a T3 Code policy key`);
+      }
+      values.push(...checkboxes.values.map((value) => ({ ...value, key: list })));
+    }
+    const built = windowsPolicyDocument(values, knownDrivers);
+    if ("error" in built) return yield* refuse(built.error);
+    // An empty key, or one holding only policies set to Disabled, sets nothing.
+    if (built.document === undefined) return undefined;
+    return { source: path, document: yield* decodeDocument(path, built.document) };
   }
   return undefined;
 });
@@ -317,10 +583,11 @@ const readPlatformPolicy = Effect.fnUntraced(function* (platform: NodeJS.Platfor
  */
 export const readManagedPolicy = Effect.fn("readManagedPolicy")(function* (
   platform: NodeJS.Platform,
+  knownDrivers: ReadonlyArray<string> = [],
 ) {
   const filePath = managedPolicyPath(platform);
   const [platformPolicy, file] = yield* Effect.all([
-    readPlatformPolicy(platform),
+    readPlatformPolicy(platform, knownDrivers),
     readManagedPolicyFile(filePath),
   ]);
   if (platformPolicy !== undefined && file !== undefined) {

From 2c9991432f8a25740116c4d2aa8d9e52e6c27cec Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 14:41:40 -0600
Subject: [PATCH 045/167] perf(server): bound streaming recovery reads by
 active runs (#30357)

---
 .../ProjectionRecovery.test.ts                | 100 ++++++++++++++++++
 .../src/orchestration-v2/ProjectionStore.ts   |  14 +--
 2 files changed, 107 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts b/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
index f1169f1e910b4..733238e62d2f3 100644
--- a/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
@@ -658,6 +658,106 @@ it.effect("includes shared sessions and provider-owned background rosters in rec
   }).pipe(Effect.provide(layerTest)),
 );
 
+it.effect("bounds streaming recovery reads by candidate runs and preserves message ordering", () =>
+  Effect.gen(function* () {
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const sql = yield* SqlClient.SqlClient;
+    const now = yield* DateTime.now;
+    const threadId = yield* createThread("streaming");
+    const other = yield* createThread("streaming-other");
+    const empty = yield* createThread("streaming-empty");
+    const statements: Array<ReturnType<Statement.Statement<unknown>["compile"]>> = [];
+    const observe: Statement.Transformer = (statement) => {
+      const compiled = statement.compile();
+      if (compiled[0].includes("SELECT message.payload_json")) statements.push(compiled);
+      return Effect.succeed(statement);
+    };
+    const expected: MessageId[] = [];
+    const statuses = [
+      "queued",
+      "preparing",
+      "starting",
+      "running",
+      "waiting",
+      "completed",
+      "interrupted",
+      "rolled_back",
+      "failed",
+      "cancelled",
+    ] as const;
+    for (const [index, status] of statuses.entries()) {
+      const runId = yield* createRun(threadId, status, { ordinal: index + 1 });
+      for (const suffix of ["b", "a", "settled", "wrong-thread"]) {
+        const id = MessageId.make(`message:streaming:${index}:${suffix}`);
+        const streaming = suffix !== "settled";
+        const messageThread = suffix === "wrong-thread" ? other : threadId;
+        const createdAt = DateTime.add(now, { seconds: -index });
+        yield* projections.apply({
+          id: EventId.make(`event:${id}`),
+          type: "message.updated",
+          threadId: messageThread,
+          runId,
+          occurredAt: now,
+          payload: {
+            id,
+            threadId: messageThread,
+            runId,
+            nodeId: null,
+            role: "assistant",
+            text: id,
+            attachments: [],
+            streaming,
+            createdAt,
+            updatedAt: now,
+            createdBy: "agent",
+            creationSource: "provider",
+          },
+        });
+      }
+      if (index < 5)
+        expected.unshift(
+          MessageId.make(`message:streaming:${index}:a`),
+          MessageId.make(`message:streaming:${index}:b`),
+        );
+    }
+    const foreignRun = yield* createRun(other, "running");
+    yield* sql`
+      INSERT INTO orchestration_v2_projection_messages
+        (message_id, thread_id, run_id, role, streaming, created_at, updated_at, payload_json)
+      VALUES ('foreign-run', ${threadId}, ${foreignRun}, 'assistant', 1, '', '', '{}')
+    `;
+    yield* sql`
+      INSERT INTO orchestration_v2_projection_messages
+        (message_id, thread_id, run_id, role, streaming, created_at, updated_at, payload_json)
+      VALUES ('old-history', ${empty}, NULL, 'assistant', 1, '', '', '{}')
+    `;
+    const projection = yield* projections
+      .getRuntimeRecoveryProjection(threadId)
+      .pipe(Effect.provideService(Statement.CurrentTransformer, observe));
+    assert.deepEqual(
+      projection.messages.map((message) => message.id),
+      expected,
+    );
+    const emptyProjection = yield* projections
+      .getRuntimeRecoveryProjection(empty)
+      .pipe(Effect.provideService(Statement.CurrentTransformer, observe));
+    assert.deepEqual(emptyProjection.messages, []);
+    assert.equal(statements.length, 2);
+    for (const [query, params] of statements) {
+      const plan = yield* sql.unsafe<{ detail: string }>(`EXPLAIN QUERY PLAN ${query}`, params);
+      assert.isTrue(plan[0]?.detail.includes("SEARCH run "), JSON.stringify(plan));
+      assert.isTrue(
+        plan.some((row) => row.detail.includes("messages_run_idx")),
+        JSON.stringify(plan),
+      );
+      assert.isFalse(
+        plan.some((row) => row.detail.includes("messages_thread_created_idx")),
+        JSON.stringify(plan),
+      );
+    }
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.effect("bounds runtime provider-thread reads by ownership and preserves recovery liveness", () =>
   Effect.gen(function* () {
     const projections = yield* ProjectionStore.ProjectionStoreV2;
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 6186db8c6e39d..d7a5fc4a18d5a 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -4730,14 +4730,14 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
               WHERE thread_id = ${threadId} AND status = 'pending'
               ORDER BY created_at ASC, runtime_request_id ASC
             `,
+            // CROSS JOIN keeps empty run cohorts out of message history; the run index bounds each lookup.
             sql<PayloadRow>`
-              SELECT message.payload_json FROM orchestration_v2_projection_messages AS message
-              WHERE message.thread_id = ${threadId} AND message.streaming = 1
-                AND message.run_id IN (
-                  SELECT run_id FROM orchestration_v2_projection_runs
-                  WHERE thread_id = ${threadId}
-                    AND status IN ('queued', 'preparing', 'starting', 'running', 'waiting')
-                )
+              SELECT message.payload_json FROM orchestration_v2_projection_runs AS run
+              CROSS JOIN orchestration_v2_projection_messages AS message
+                INDEXED BY orchestration_v2_projection_messages_run_idx ON message.run_id = run.run_id
+              WHERE run.thread_id = ${threadId}
+                AND run.status IN ('queued', 'preparing', 'starting', 'running', 'waiting')
+                AND message.thread_id = ${threadId} AND message.streaming = 1
               ORDER BY message.created_at ASC, message.message_id ASC
             `,
             sql<PayloadRow>`

From 0b5600b1c3df49f705ba245df5aa50c59dc91490 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 14:41:49 -0600
Subject: [PATCH 046/167] perf(server): read pull request metadata from a
 lightweight snapshot

PR discovery used the full shell snapshot, which derived activity and counted historical items across active threads. Read only PR metadata and its event sequence in one transaction, then decode after releasing the reader. Preserve settled backfill, targeted refreshes, legacy PR normalization, and guarded updates.

Validation: check:changed passed with 80 tests after merging main; CI passed on 988187f. Native Electron measurements and a concurrent-write control confirmed metadata parity and coherent sequences. Synthetic measurements cover PR reads and service initialization, not full desktop startup.

Model: GPT 6.1 Sol. Harness: Codex in T3 Code.
---
 .../src/orchestration-v2/Orchestrator.ts      | 11 +++
 .../orchestration-v2/ProjectionStore.test.ts  | 83 ++++++++++++++++++-
 .../src/orchestration-v2/ProjectionStore.ts   | 77 +++++++++++++++++
 .../ProviderTurnControlService.test.ts        |  1 +
 .../ThreadPullRequestService.test.ts          | 82 ++++++++++++------
 .../ThreadPullRequestService.ts               | 17 +---
 6 files changed, 231 insertions(+), 40 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 1059c88230788..16256585dc526 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -438,6 +438,12 @@ export interface OrchestratorV2Shape {
     },
     OrchestratorV2Error
   >;
+  readonly getPullRequestSnapshot: (
+    options: Parameters<ProjectionStoreV2["Service"]["getPullRequestSnapshot"]>[0],
+  ) => Effect.Effect<
+    Effect.Success<ReturnType<ProjectionStoreV2["Service"]["getPullRequestSnapshot"]>>,
+    OrchestratorV2Error
+  >;
   readonly getShellSnapshot: (
     options?: ShellSnapshotOptions,
   ) => Effect.Effect<OrchestrationV2ThreadShellSnapshot, OrchestratorV2Error>;
@@ -14143,6 +14149,11 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
           .pipe(Effect.mapError((cause) => new OrchestratorProjectionError({ threadId, cause })));
       },
     ),
+    getPullRequestSnapshot: Effect.fn("OrchestratorV2.getPullRequestSnapshot")(function (options) {
+      return projectionStore
+        .getPullRequestSnapshot(options)
+        .pipe(Effect.mapError(shellProjectionError));
+    }),
     getShellSnapshot: Effect.fn("OrchestratorV2.getShellSnapshot")(function (options) {
       return projectionStore.getShellSnapshot(options).pipe(Effect.mapError(shellProjectionError));
     }),
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index a79b2f37a1ddf..f453dec956722 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -32,6 +32,7 @@ import {
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Tracer from "effect/Tracer";
 import * as SqlClient from "effect/sql/SqlClient";
@@ -64,6 +65,7 @@ const encodeUnknownJsonString = Schema.encodeSync(Schema.fromJsonString(Schema.U
 
 const traceSqlStatements = () => {
   const statements: Array<string> = [];
+  const queryTransactions: Array<string | null> = [];
   const tracer = Tracer.make({
     span(options) {
       const span = new Tracer.NativeSpan(options);
@@ -71,12 +73,19 @@ const traceSqlStatements = () => {
       span.end = (endTime, exit) => {
         end(endTime, exit);
         const query = span.attributes.get("db.query.text");
-        if (typeof query === "string") statements.push(query);
+        if (typeof query === "string") {
+          statements.push(query);
+          let parent = Option.getOrUndefined(span.parent);
+          while (parent?._tag === "Span" && parent.name !== "sql.transaction") {
+            parent = Option.getOrUndefined(parent.parent);
+          }
+          queryTransactions.push(parent?._tag === "Span" ? parent.spanId : null);
+        }
       };
       return span;
     },
   });
-  return { statements, tracer };
+  return { statements, tracer, queryTransactions };
 };
 
 /** The shell index flags every live shell and matches its shells on the fields subscriber trims read. */
@@ -3793,6 +3802,76 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
           .filter((id) => id === readThreadId || id === laterThreadId);
 
       yield* createThread(readThreadId);
+      yield* sql`UPDATE orchestration_v2_projection_threads
+        SET payload_json = json_set(payload_json, '$.linkedPullRequest', json(${JSON.stringify({
+          projectId: "project:shell-read",
+          repository: "acme/project",
+          number: 42,
+          url: "https://github.com/acme/project/pull/42",
+        })})) WHERE thread_id = ${readThreadId}`;
+      const trace = traceSqlStatements();
+      const discovery = yield* projectionStore
+        .getPullRequestSnapshot({})
+        .pipe(Effect.withTracer(trace.tracer));
+      assert.deepEqual(
+        discovery.threads
+          .map((thread) => thread.id)
+          .filter((id) => id === readThreadId || id === laterThreadId),
+        [readThreadId],
+      );
+      assert.strictEqual(discovery.snapshotSequence, 0);
+      assert.strictEqual(trace.queryTransactions.length, 2);
+      assert.isNotNull(trace.queryTransactions[0]);
+      assert.strictEqual(new Set(trace.queryTransactions).size, 1);
+      assert.isFalse(
+        trace.statements.some((query) =>
+          /orchestration_v2_projection_(runs|messages|turn_items|provider_threads)/.test(query),
+        ),
+      );
+      const fullShell = (yield* projectionStore.getShellSnapshot()).threads.find(
+        (thread) => thread.id === readThreadId,
+      )!;
+      const metadata = discovery.threads.find((thread) => thread.id === readThreadId)!;
+      for (const key of Object.keys(metadata) as Array<keyof typeof metadata>) {
+        assert.deepEqual(metadata[key], fullShell[key]);
+      }
+      const narrow = yield* projectionStore.getPullRequestSnapshot({ threadId: readThreadId });
+      assert.deepEqual(
+        narrow.threads,
+        discovery.threads.filter((thread) => thread.id === readThreadId),
+      );
+      const settledPayload = (settledAt: string | null, archivedAt: string | null) => sql`
+        UPDATE orchestration_v2_projection_threads
+        SET payload_json = json_set(payload_json, '$.settledAt', ${settledAt}, '$.archivedAt', ${archivedAt})
+        WHERE thread_id = ${readThreadId}
+      `;
+      yield* settledPayload(DateTime.formatIso(now), null);
+      assert.isFalse(
+        (yield* projectionStore.getPullRequestSnapshot({ unsettledOnly: true })).threads.some(
+          (thread) => thread.id === readThreadId,
+        ),
+      );
+      assert.strictEqual(
+        (yield* projectionStore.getPullRequestSnapshot({ threadId: readThreadId })).threads.length,
+        1,
+      );
+      yield* settledPayload(null, DateTime.formatIso(now));
+      assert.isFalse(
+        (yield* projectionStore.getPullRequestSnapshot({})).threads.some(
+          (thread) => thread.id === readThreadId,
+        ),
+      );
+      assert.strictEqual(
+        (yield* projectionStore.getPullRequestSnapshot({ threadId: readThreadId })).threads.length,
+        1,
+      );
+      yield* sql`UPDATE orchestration_v2_projection_threads SET deleted_at = '2026-11-03T00:00:00.000Z' WHERE thread_id = ${readThreadId}`;
+      assert.deepEqual(
+        (yield* projectionStore.getPullRequestSnapshot({ threadId: readThreadId })).threads,
+        [],
+      );
+      yield* sql`UPDATE orchestration_v2_projection_threads SET deleted_at = NULL WHERE thread_id = ${readThreadId}`;
+      yield* settledPayload(null, null);
       const decode = yield* sql.withTransaction(projectionStore.readShellSnapshot());
       yield* createThread(laterThreadId);
 
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index d7a5fc4a18d5a..8726799153cee 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -481,6 +481,16 @@ export interface ProjectionStoreV2Shape {
   readonly apply: (
     event: OrchestrationV2DomainEvent,
   ) => Effect.Effect<void, ProjectionStoreV2Error>;
+  readonly getPullRequestSnapshot: (options: {
+    readonly threadId?: ThreadId;
+    readonly unsettledOnly?: boolean;
+  }) => Effect.Effect<
+    {
+      readonly snapshotSequence: number;
+      readonly threads: ReadonlyArray<typeof PullRequestThread.Type>;
+    },
+    ProjectionStoreV2Error
+  >;
   readonly getShellSnapshot: (
     options?: ShellSnapshotOptions,
   ) => Effect.Effect<OrchestrationV2ThreadShellSnapshot, ProjectionStoreV2Error>;
@@ -1097,6 +1107,37 @@ const encodeContextTransferPayload = Schema.encodeEffect(
   Schema.fromJsonString(OrchestrationV2ContextTransferJsonSchema),
 );
 
+const PullRequestThread = OrchestrationV2AppThreadJsonSchema.mapFields(
+  ({
+    id,
+    projectId,
+    lineage,
+    branch,
+    worktreePath,
+    archivedAt,
+    settledOverride,
+    settledAt,
+    linkedPullRequest,
+    branchPullRequest,
+    pullRequests,
+  }) => ({
+    id,
+    projectId,
+    lineage,
+    branch,
+    worktreePath,
+    archivedAt,
+    settledOverride,
+    settledAt,
+    linkedPullRequest,
+    branchPullRequest,
+    pullRequests,
+  }),
+);
+const decodePullRequestThread = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(PullRequestThread),
+);
+
 const decodeThreadPayload = Schema.decodeUnknownEffect(
   Schema.fromJsonString(OrchestrationV2AppThreadJsonSchema),
 );
@@ -6895,6 +6936,41 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         Effect.map(decodeShellSnapshot),
       );
 
+    const getPullRequestSnapshot: ProjectionStoreV2Shape["getPullRequestSnapshot"] = Effect.fn(
+      "ProjectionStore.getPullRequestSnapshot",
+    )(function* ({ threadId, unsettledOnly = false }) {
+      const { rows, sequenceRows } = yield* sql.withTransaction(
+        Effect.gen(function* () {
+          const rows = yield* sql<PayloadRow>`
+          SELECT t.payload_json FROM orchestration_v2_projection_threads t
+          WHERE t.deleted_at IS NULL${
+            threadId === undefined
+              ? sql` AND json_extract(t.payload_json, '$.archivedAt') IS NULL`
+              : sql` AND t.thread_id = ${threadId}`
+          }${
+            unsettledOnly
+              ? sql` AND json_extract(t.payload_json, '$.settledAt') IS NULL
+                AND json_extract(t.payload_json, '$.settledOverride') IS NOT 'settled'`
+              : sql``
+          }
+          ORDER BY t.updated_at ASC, t.thread_id ASC
+        `;
+          const sequenceRows = yield* sql<{ readonly snapshot_sequence: number | null }>`
+          SELECT MAX(sequence) AS snapshot_sequence FROM orchestration_events
+          WHERE application_event_version = 2 AND aggregate_kind = 'thread'
+        `;
+          return { rows, sequenceRows };
+        }),
+      );
+      // Decode after releasing the reader, keeping rows and sequence from the same transaction.
+      const threads = yield* Effect.forEach(rows, (row) =>
+        decodePullRequestThread(row.payload_json).pipe(
+          Effect.map((thread) => ({ ...thread, pullRequests: threadPullRequestsOf(thread) })),
+        ),
+      );
+      return { snapshotSequence: sequenceRows[0]?.snapshot_sequence ?? 0, threads };
+    }, Effect.mapError(shellSnapshotReadError));
+
     const getShellSnapshot: ProjectionStoreV2Shape["getShellSnapshot"] = (options) =>
       sql
         .withTransaction(readShellSnapshotRows(options))
@@ -7163,6 +7239,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
     return {
       apply,
       getShellSnapshot: readOnReader(getShellSnapshot),
+      getPullRequestSnapshot: readOnReader(getPullRequestSnapshot),
       listActiveSubagentThreadIds: readOnReader(listActiveSubagentThreadIds),
       countThreads: readOnReader(countThreads),
       listActiveShellIndex: readOnReader(listActiveShellIndex),
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
index 77caf03712571..bc5656094445f 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
@@ -271,6 +271,7 @@ it.effect(
           getUnreadableThreadIds: () => Effect.die("unused getUnreadableThreadIds"),
           getThreadSnapshot: () => Effect.die("unused getThreadSnapshot"),
           getThreadSnapshotWindow: () => Effect.die("unused getThreadSnapshotWindow"),
+          getPullRequestSnapshot: () => Effect.die("unused getPullRequestSnapshot"),
         }),
       );
       const layerSessionManager = Layer.succeed(
diff --git a/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts b/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
index 9c2ff9ef18f7a..423d1cddd943c 100644
--- a/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
@@ -28,6 +28,10 @@ import * as ProjectStore from "./ProjectStore.ts";
 import * as RepositoryIdentityResolver from "../project/RepositoryIdentityResolver.ts";
 import * as PullRequestService from "../pullRequest/PullRequestService.ts";
 import * as ServerActivation from "../serverActivation.ts";
+import * as ProjectionStore from "./ProjectionStore.ts";
+import * as SqlClient from "effect/sql/SqlClient";
+import * as SqlitePersistence from "../persistence/Sqlite.ts";
+import { EventId } from "@t3tools/contracts";
 import * as Orchestrator from "./Orchestrator.ts";
 import * as ThreadPullRequestService from "./ThreadPullRequestService.ts";
 
@@ -105,15 +109,13 @@ describe("ThreadPullRequestServiceV2 reads", () => {
         const dependencies = Layer.mergeAll(
           Layer.mock(Orchestrator.OrchestratorV2)({
             streamDomainEvents: Stream.fromQueue(domainEvents),
-            getShellSnapshot: () =>
+            getPullRequestSnapshot: () =>
               Effect.succeed({
                 schemaVersion: 2,
                 snapshotSequence: 1,
                 threads: [thread],
                 archivedThreads: [],
               }),
-            getThreadEventSequence: () => Effect.succeed(1),
-            getThreadShell: () => Effect.succeed(thread),
           }),
           Layer.mock(ProjectStore.ProjectStoreV2)({
             listShells: () => Effect.succeed([project]),
@@ -212,6 +214,8 @@ describe("ThreadPullRequestServiceV2 reads", () => {
         Effect.gen(function* () {
           const thread = {
             ...threadShell("worktree-thread"),
+            settledOverride: "settled" as const,
+            settledAt: NOW,
             branch: "feature/worktree",
             worktreePath: "/workspace/worktree",
           };
@@ -230,7 +234,7 @@ describe("ThreadPullRequestServiceV2 reads", () => {
           const dependencies = Layer.mergeAll(
             Layer.mock(Orchestrator.OrchestratorV2)({
               streamDomainEvents: Stream.never,
-              getShellSnapshot: () =>
+              getPullRequestSnapshot: () =>
                 Deferred.succeed(sweepStarted, undefined).pipe(
                   Effect.as({
                     schemaVersion: 2,
@@ -335,18 +339,17 @@ describe("ThreadPullRequestServiceV2 reads", () => {
         const dependencies = Layer.mergeAll(
           Layer.mock(Orchestrator.OrchestratorV2)({
             streamDomainEvents: Stream.fromQueue(domainEvents),
-            getShellSnapshot: () =>
-              Queue.offer(sweeps, undefined).pipe(
-                Effect.as({
-                  schemaVersion: 2,
-                  snapshotSequence: 1,
-                  threads: [parent, child],
-                  archivedThreads: [],
-                }),
-              ),
-            getThreadEventSequence: () => Effect.succeed(1),
-            getThreadShell: (threadId) =>
-              Effect.succeed([parent, child].find((thread) => thread.id === threadId) ?? null),
+            getPullRequestSnapshot: ({ threadId }) =>
+              threadId !== undefined
+                ? Effect.succeed({ snapshotSequence: 1, threads: [child] })
+                : Queue.offer(sweeps, undefined).pipe(
+                    Effect.as({
+                      schemaVersion: 2,
+                      snapshotSequence: 1,
+                      threads: [parent, child],
+                      archivedThreads: [],
+                    }),
+                  ),
           }),
           Layer.mock(ProjectStore.ProjectStoreV2)({
             listShells: () => Effect.succeed([project]),
@@ -457,14 +460,37 @@ describe("ThreadPullRequestServiceV2 reads", () => {
           const dependencies = Layer.mergeAll(
             Layer.mock(Orchestrator.OrchestratorV2)({
               streamDomainEvents: Stream.never,
-              getShellSnapshot: () =>
-                Deferred.succeed(sweepStarted, undefined).pipe(
-                  Effect.as({
-                    schemaVersion: 2,
-                    snapshotSequence: 1,
-                    threads: [thread],
-                    archivedThreads: [],
-                  }),
+              getPullRequestSnapshot: (options) =>
+                Effect.gen(function* () {
+                  const store = yield* ProjectionStore.ProjectionStoreV2;
+                  yield* store.apply({
+                    id: EventId.make(`event:${thread.id}:created`),
+                    type: "thread.created",
+                    threadId: thread.id,
+                    occurredAt: NOW,
+                    payload: { ...thread, lastVisitedAt: thread.lastVisitedAt ?? null },
+                  });
+                  const sql = yield* SqlClient.SqlClient;
+                  yield* sql`INSERT INTO orchestration_events (
+                    sequence, event_id, aggregate_kind, stream_id, stream_version, event_type,
+                    occurred_at, actor_kind, payload_json, metadata_json, application_event_version
+                  ) VALUES (7, 'pr-discovery', 'thread', ${thread.id}, 1, 'thread.created',
+                    '2026-09-20T00:00:00.000Z', 'system', '{}', '{}', 2)`;
+                  for (const table of [
+                    "orchestration_v2_projection_turn_items",
+                    "orchestration_v2_projection_messages",
+                    "orchestration_v2_projection_provider_threads",
+                    "orchestration_v2_projection_runs",
+                  ])
+                    yield* sql.unsafe(`DROP TABLE ${table}`);
+                  const snapshot = yield* store.getPullRequestSnapshot(options);
+                  yield* Deferred.succeed(sweepStarted, undefined);
+                  return snapshot;
+                }).pipe(
+                  Effect.provide(
+                    ProjectionStore.layer.pipe(Layer.provideMerge(SqlitePersistence.layerMemory)),
+                  ),
+                  Effect.orDie,
                 ),
               dispatch: (command) =>
                 Effect.sync(() => {
@@ -529,6 +555,14 @@ describe("ThreadPullRequestServiceV2 reads", () => {
             expect(commands[0]).toMatchObject({
               type: "thread.pull-request.sync",
               threadId: thread.id,
+              snapshotSequence: 7,
+              expected: {
+                workspaceRoot: project.workspaceRoot,
+                branch: thread.branch,
+                worktreePath: thread.worktreePath,
+                linkedPullRequest: savedReference,
+                branchPullRequest: savedReference,
+              },
               branchPullRequest: null,
             });
             expect(commands[0]).not.toHaveProperty("linkedPullRequest");
diff --git a/apps/server/src/orchestration-v2/ThreadPullRequestService.ts b/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
index e221388a5b8c0..1cb01acd4ed9c 100644
--- a/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
+++ b/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
@@ -7,7 +7,6 @@ import {
   type ThreadLinkedPullRequest,
 } from "@t3tools/contracts";
 import { makeDrainableWorker } from "@t3tools/shared/DrainableWorker";
-import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as SecureRandom from "effect/crypto/SecureRandom";
@@ -120,19 +119,9 @@ export const make = Effect.gen(function* () {
   };
 
   const readThreadSnapshot = ({ threadId, backfill }: RefreshRequest) =>
-    threadId === null
-      ? orchestrator
-          .getShellSnapshot({
-            location: "active",
-            unsettledOnly: !(backfill || pendingBackfill.size > 0),
-          })
-          .pipe(NodeSqliteClient.readOnly)
-      : Effect.gen(function* () {
-          // Read sequence first so guarded sync rejects intervening changes.
-          const snapshotSequence = yield* orchestrator.getThreadEventSequence(threadId);
-          const thread = yield* orchestrator.getThreadShell(threadId);
-          return { snapshotSequence, threads: thread === null ? [] : [thread] };
-        });
+    orchestrator.getPullRequestSnapshot(
+      threadId === null ? { unsettledOnly: !(backfill || pendingBackfill.size > 0) } : { threadId },
+    );
 
   const synchronize = Effect.fn("ThreadPullRequestServiceV2.synchronize")(function* (
     request: RefreshRequest,

From c3c15f7d3623979e0d93fc1cf0963cc6b9487dcf Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 20:46:13 +0000
Subject: [PATCH 047/167] fix(server): cancelling worktree setup no longer
 leaves its new branch behind (#29781)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ThreadLaunchService.test.ts               | 58 ++++++++++++++++++-
 .../orchestration-v2/ThreadLaunchService.ts   | 37 ++++++++++--
 2 files changed, 88 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts b/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
index ec0e37056543b..ea2534241aed7 100644
--- a/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
@@ -164,6 +164,10 @@ function makeHarness(options: HarnessOptions = {}) {
     (_input: Parameters<GitWorkflow.GitWorkflowService["Service"]["removeWorktree"]>[0]) =>
       Effect.void,
   );
+  const deleteLocalBranch = vi.fn(
+    (_input: Parameters<GitWorkflow.GitWorkflowService["Service"]["deleteLocalBranch"]>[0]) =>
+      Effect.void,
+  );
   const runSetup = vi.fn(
     options.runSetup ?? (() => Effect.succeed({ status: "no-script" as const })),
   );
@@ -208,6 +212,7 @@ function makeHarness(options: HarnessOptions = {}) {
       remoteExists: options.remoteExists ?? (() => Effect.succeed(true)),
       remoteBranchExists: () => Effect.succeed(true),
       removeWorktree,
+      deleteLocalBranch,
       ...options.git,
     }),
     Layer.succeed(ProjectSetupScriptRunner.ProjectSetupScriptRunner, {
@@ -276,6 +281,7 @@ function makeHarness(options: HarnessOptions = {}) {
     ),
     createWorktree,
     removeWorktree,
+    deleteLocalBranch,
     renameBranch,
     generateBranchName,
     generateThreadTitle,
@@ -2188,8 +2194,15 @@ it.effect("shared intake preserves durable attachment bytes after a lost launch
 it.effect("cancels tracked setup before provider work is released", () =>
   Effect.gen(function* () {
     const entered = yield* Deferred.make<void>();
+    const renamed = yield* Deferred.make<void>();
     const harness = makeHarness({
-      runSetup: () => Deferred.succeed(entered, undefined).pipe(Effect.andThen(Effect.never)),
+      renameBranch: (input) =>
+        Deferred.succeed(renamed, undefined).pipe(Effect.as({ branch: input.newBranch })),
+      runSetup: () =>
+        Deferred.await(renamed).pipe(
+          Effect.andThen(Deferred.succeed(entered, undefined)),
+          Effect.andThen(Effect.never),
+        ),
     });
     yield* Effect.gen(function* () {
       const launches = yield* ThreadLaunch.ThreadLaunchService;
@@ -2210,11 +2223,50 @@ it.effect("cancels tracked setup before provider work is released", () =>
       const projection = yield* threads.getThreadProjection(launched.threadId);
       assert.equal(projection.runs[0]?.status, "failed");
       assert.isNull(projection.thread.worktreePath);
+      assert.deepEqual(harness.deleteLocalBranch.mock.calls[0]?.[0], {
+        cwd: "/repo",
+        refName: "generated-branch",
+        force: true,
+      });
       assert.isEmpty(yield* outbox.listByCommandId(CommandId.make(`${input.commandId}:release`)));
     }).pipe(Effect.provide(harness.layer));
   }),
 );
 
+it.effect(
+  "deletes a claimed worktree's branch when setup is cancelled before checkout returns",
+  () =>
+    Effect.gen(function* () {
+      const claimed = yield* Deferred.make<void>();
+      const harness = makeHarness({
+        createWorktree: (_input, options) =>
+          (options?.progress?.onWorktreeClaimed?.("/repo-worktrees/feature") ?? Effect.void).pipe(
+            Effect.andThen(Deferred.succeed(claimed, undefined)),
+            Effect.andThen(Effect.never),
+          ),
+      });
+      yield* Effect.gen(function* () {
+        const launches = yield* ThreadLaunch.ThreadLaunchService;
+        const tracker = yield* WorktreeSetupTracker.WorktreeSetupTracker;
+        const launched = yield* launches.launch(
+          launchInput({
+            command: "launch:cancel-claimed",
+            thread: "thread:cancel-claimed",
+            message: "Start",
+            workspace: { type: "worktree", baseRef: "main" },
+          }),
+        );
+        yield* Deferred.await(claimed);
+        assert.isTrue(yield* tracker.cancel(launched.threadId));
+        assert.equal(harness.removeWorktree.mock.calls[0]?.[0].path, "/repo-worktrees/feature");
+        assert.equal(
+          harness.deleteLocalBranch.mock.calls[0]?.[0].refName,
+          harness.createWorktree.mock.calls[0]?.[0].newRefName,
+        );
+      }).pipe(Effect.provide(harness.layer));
+    }),
+);
+
 it.effect("stops an in-flight branch rename when tracked setup is cancelled", () =>
   Effect.gen(function* () {
     const setupEntered = yield* Deferred.make<void>();
@@ -2259,6 +2311,10 @@ it.effect("stops an in-flight branch rename when tracked setup is cancelled", ()
       );
       assert.equal(harness.renameBranch.mock.calls.length, 0);
       assert.isNull((yield* threads.getThreadProjection(launched.threadId)).thread.worktreePath);
+      assert.equal(
+        harness.deleteLocalBranch.mock.calls[0]?.[0].refName,
+        harness.createWorktree.mock.calls[0]?.[0].newRefName,
+      );
     }).pipe(Effect.provide(harness.layer));
   }),
 );
diff --git a/apps/server/src/orchestration-v2/ThreadLaunchService.ts b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
index 4ab38c4b305e3..7e7829ba947cf 100644
--- a/apps/server/src/orchestration-v2/ThreadLaunchService.ts
+++ b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
@@ -310,6 +310,7 @@ const make = Effect.gen(function* () {
     const reused = input.reusedWorktree;
     const tracked = input.workspaceStrategy.type === "worktree" || reused !== undefined;
     let createdWorktreePath: string | null = null;
+    let createdBranch: string | null = null;
     let setupTerminalId: string | null = null;
     let workspaceRecorded = false;
     let runReleased = false;
@@ -448,6 +449,7 @@ const make = Effect.gen(function* () {
                 onWorktreeClaimed: (path) =>
                   Effect.sync(() => {
                     createdWorktreePath = path;
+                    createdBranch = branch;
                   }),
                 onCheckoutProgress: (progress) =>
                   setupTracker.stage(threadId, "checkout", { percent: progress.percent }),
@@ -458,6 +460,7 @@ const make = Effect.gen(function* () {
         worktreePath = worktree.worktree.path;
         branch = worktree.worktree.refName;
         createdWorktreePath = worktreePath;
+        createdBranch = branch;
         yield* setupTracker.update(threadId, (snapshot) => ({ ...snapshot, worktreePath, branch }));
         yield* setupTracker.stageStatus(threadId, "checkout", "done");
       }
@@ -487,12 +490,22 @@ const make = Effect.gen(function* () {
         const worktreeCwd = worktreePath;
         branchRename = yield* generateBranchNameFor(worktreeCwd, initialMessage).pipe(
           Effect.flatMap(({ branch: newBranch, exactName }) =>
-            git.renameBranch({
-              cwd: worktreeCwd,
-              oldBranch,
-              newBranch,
-              ...(exactName ? { exactName: true } : {}),
-            }),
+            git
+              .renameBranch({
+                cwd: worktreeCwd,
+                oldBranch,
+                newBranch,
+                ...(exactName ? { exactName: true } : {}),
+              })
+              .pipe(
+                // A cancel must see the renamed branch, or its cleanup deletes the old name.
+                Effect.tap((renamed) =>
+                  Effect.sync(() => {
+                    createdBranch = renamed.branch;
+                  }),
+                ),
+                Effect.uninterruptible,
+              ),
           ),
           Effect.flatMap((renamed) =>
             Effect.gen(function* () {
@@ -680,10 +693,22 @@ const make = Effect.gen(function* () {
           ) {
             if (branchRename !== null) yield* Fiber.interrupt(branchRename);
             const removedPath = createdWorktreePath;
+            const removedBranch = createdBranch;
             // Forget worktrees only after removal succeeds; failed removals must not reuse partially written checkouts.
             yield* git
               .removeWorktree({ cwd: project.workspaceRoot, path: removedPath, force: true })
               .pipe(
+                Effect.andThen(
+                  removedBranch === null
+                    ? Effect.void
+                    : git
+                        .deleteLocalBranch({
+                          cwd: project.workspaceRoot,
+                          refName: removedBranch,
+                          force: true,
+                        })
+                        .pipe(Effect.ignoreCause({ log: true })),
+                ),
                 Effect.andThen(
                   threads
                     .dispatch({

From d1ec71e6ff8b46bacfbe103af72034eba3654e63 Mon Sep 17 00:00:00 2001
From: Alex <me@pixp.cc>
Date: Tue, 3 Nov 2026 12:48:56 -0800
Subject: [PATCH 048/167] feat(mobile): add on-device Android dictation
 (#26734)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Alex Jankowiak <alexjankowiak@nebius.com>
---
 apps/mobile/app.config.ts                     |  11 +-
 .../android/build.gradle                      |  31 ++
 .../android/src/main/AndroidManifest.xml      |   5 +
 .../GoogleVoiceTranscriber.kt                 | 162 ++++++++
 .../modules/t3voicetranscription/PcmOutput.kt |  85 ++++
 .../modules/t3voicetranscription/PcmPipe.kt   | 105 +++++
 .../t3voicetranscription/RecordedPcm.kt       | 172 ++++++++
 .../RecordingPcmConverter.kt                  |  68 ++++
 .../T3VoiceTranscriptionModule.kt             | 112 ++++++
 .../VoiceTranscriptionFailure.kt              |  24 ++
 .../GoogleVoiceTranscriberTest.kt             | 211 ++++++++++
 .../t3voicetranscription/PcmReplayTest.kt     | 126 ++++++
 .../RecordingPcmConverterTest.kt              |  51 +++
 .../expo-module.config.json                   |   6 +
 .../SettingsMicrophoneRouteScreen.tsx         |  41 +-
 .../features/settings/SettingsRouteScreen.tsx |   8 +-
 .../components/ScheduledTaskPromptField.tsx   |   8 +-
 .../src/features/threads/ThreadComposer.tsx   |   8 +-
 .../voice-input/ComposerDictationControl.tsx  |  91 ++---
 .../voice-input/VoiceInputProvider.tsx        |  62 +--
 .../voice-input/lazyVoiceRecorder.test.ts     |  56 ++-
 .../features/voice-input/lazyVoiceRecorder.ts |  43 +-
 .../voiceRecordingPermission.test.ts          |  52 +++
 .../voice-input/voiceRecordingPermission.ts   |  36 ++
 .../mobile/src/lib/microphonePriority.test.ts |  10 +
 apps/mobile/src/lib/microphonePriority.ts     |  12 +-
 .../src/lib/permissionStatusAtom.test.ts      |  19 +
 apps/mobile/src/lib/permissionStatusAtom.ts   |  13 +-
 .../native/voiceTranscription.android.test.ts |  84 ++++
 .../src/native/voiceTranscription.android.ts  |  88 +++++
 .../src/native/voiceTranscription.ios.test.ts |   2 +-
 .../src/native/voiceTranscription.ios.ts      |   2 +-
 apps/mobile/src/native/voiceTranscription.ts  |   2 +-
 docs/user/composer.md                         |  44 ++-
 .../src/voice-input/controller.test.ts        |  21 +-
 .../src/voice-input/controller.ts             |  30 +-
 patches/expo-audio@58.0.9.patch               | 367 +++++++++++++++++-
 pnpm-lock.yaml                                |   6 +-
 38 files changed, 2119 insertions(+), 155 deletions(-)
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/build.gradle
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/AndroidManifest.xml
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriber.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmOutput.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmPipe.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordedPcm.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordingPcmConverter.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/T3VoiceTranscriptionModule.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/VoiceTranscriptionFailure.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriberTest.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/PcmReplayTest.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/RecordingPcmConverterTest.kt
 create mode 100644 apps/mobile/modules/t3-voice-transcription/expo-module.config.json
 create mode 100644 apps/mobile/src/features/voice-input/voiceRecordingPermission.test.ts
 create mode 100644 apps/mobile/src/features/voice-input/voiceRecordingPermission.ts
 create mode 100644 apps/mobile/src/native/voiceTranscription.android.test.ts
 create mode 100644 apps/mobile/src/native/voiceTranscription.android.ts

diff --git a/apps/mobile/app.config.ts b/apps/mobile/app.config.ts
index e6d388b9a9856..b94367a64ebf4 100644
--- a/apps/mobile/app.config.ts
+++ b/apps/mobile/app.config.ts
@@ -367,7 +367,7 @@ const config: ExpoConfig = {
       "expo-audio",
       {
         microphonePermission: "Allow T3 Code to use your microphone for voice input.",
-        recordAudioAndroid: false,
+        recordAudioAndroid: true,
         enableBackgroundPlayback: false,
         enableBackgroundRecording: false,
       },
@@ -381,7 +381,14 @@ const config: ExpoConfig = {
         recordAudioAndroid: false,
       },
     ],
-    ["expo-image-picker", { photosPermission: false, microphonePermission: false }],
+    [
+      "expo-image-picker",
+      {
+        photosPermission: false,
+        // `false` makes this plugin add RECORD_AUDIO to blockedPermissions, breaking Android dictation.
+        microphonePermission: "Allow T3 Code to use your microphone for voice input.",
+      },
+    ],
     [
       "expo-splash-screen",
       {
diff --git a/apps/mobile/modules/t3-voice-transcription/android/build.gradle b/apps/mobile/modules/t3-voice-transcription/android/build.gradle
new file mode 100644
index 0000000000000..05995a7cc4cce
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/build.gradle
@@ -0,0 +1,31 @@
+apply plugin: 'com.android.library'
+apply plugin: 'org.jetbrains.kotlin.android'
+
+group = 'com.t3tools.voicetranscription'
+version = '0.0.0'
+
+android {
+  namespace 'expo.modules.t3voicetranscription'
+  compileSdk rootProject.ext.compileSdkVersion
+
+  defaultConfig {
+    minSdkVersion rootProject.ext.minSdkVersion
+    targetSdkVersion rootProject.ext.targetSdkVersion
+  }
+}
+
+dependencies {
+  implementation project(':expo-modules-core')
+  implementation 'androidx.media3:media3-common:1.9.1'
+  implementation 'com.google.mlkit:genai-speech-recognition:1.0.0-alpha2'
+  testImplementation 'junit:junit:4.13.2'
+  testImplementation 'org.robolectric:robolectric:4.16.1'
+  testImplementation 'org.jetbrains.kotlinx:kotlinx-coroutines-test:1.10.2'
+}
+
+tasks.withType(Test).configureEach {
+  systemProperty 'robolectric.dependency.repo.url', 'https://repo.maven.apache.org/maven2'
+  javaLauncher = javaToolchains.launcherFor {
+    languageVersion = JavaLanguageVersion.of(21)
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/AndroidManifest.xml b/apps/mobile/modules/t3-voice-transcription/android/src/main/AndroidManifest.xml
new file mode 100644
index 0000000000000..05bc93c9a7d5c
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/AndroidManifest.xml
@@ -0,0 +1,5 @@
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+  <!-- Recognition is gated to API 31; older devices retain the rest of the app. -->
+  <uses-sdk tools:overrideLibrary="com.google.mlkit.genai.speechrecognition,com.google.mlkit.genai.common" />
+</manifest>
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriber.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriber.kt
new file mode 100644
index 0000000000000..95423844c1d2c
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriber.kt
@@ -0,0 +1,162 @@
+package expo.modules.t3voicetranscription
+
+import android.content.Context
+import com.google.mlkit.genai.common.DownloadStatus
+import com.google.mlkit.genai.common.FeatureStatus
+import com.google.mlkit.genai.common.GenAiException
+import com.google.mlkit.genai.speechrecognition.SpeechRecognition
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerOptions
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerResponse
+import com.google.mlkit.genai.speechrecognition.speechRecognizerOptions
+import com.google.mlkit.genai.speechrecognition.speechRecognizerRequest
+import java.io.Closeable
+import java.util.Locale
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.withContext
+
+internal class VoiceTranscriptionException(
+  val code: String,
+  message: String,
+  cause: Throwable? = null
+) : Exception(message, cause)
+
+private val recognitionModes = listOf(
+  SpeechRecognizerOptions.Mode.MODE_ADVANCED,
+  SpeechRecognizerOptions.Mode.MODE_BASIC
+)
+
+internal suspend fun isGoogleVoiceTranscriptionSupported(
+  createClient: (Int) -> GoogleSpeechClient
+): Boolean {
+  for (mode in recognitionModes) {
+    createClient(mode).use { client ->
+      when (checkModelSupport(client)) {
+        FeatureStatus.AVAILABLE,
+        FeatureStatus.DOWNLOADABLE,
+        FeatureStatus.DOWNLOADING -> return true
+      }
+    }
+  }
+  return false
+}
+
+internal suspend fun prepareGoogleVoiceTranscription(
+  createClient: (Int) -> GoogleSpeechClient
+): Int {
+  for (mode in recognitionModes) {
+    createClient(mode).use { client ->
+      if (prepareModel(client)) return mode
+    }
+  }
+  throw VoiceTranscriptionException(
+    "unavailable",
+    "On-device voice transcription is not available for this device language."
+  )
+}
+
+private suspend fun prepareModel(client: GoogleSpeechClient): Boolean = try {
+  val status = client.checkStatus()
+  if (status == FeatureStatus.UNAVAILABLE) {
+    false
+  } else {
+    if (status == FeatureStatus.DOWNLOADABLE ||
+      status == FeatureStatus.DOWNLOADING
+    ) {
+      client.download()
+    }
+    when (client.checkStatus()) {
+      FeatureStatus.UNAVAILABLE -> false
+      FeatureStatus.AVAILABLE -> true
+      else -> throw VoiceTranscriptionException(
+        "preparation-failed",
+        "Voice transcription could not prepare this language."
+      )
+    }
+  }
+} catch (error: GenAiException) {
+  if (!isModelUnavailable(error)) throw error
+  false
+}
+
+// Any probe failure for one mode means "try the next mode"; prepare surfaces the real error.
+private suspend fun checkModelSupport(client: GoogleSpeechClient): Int = try {
+  client.checkStatus()
+} catch (_: GenAiException) {
+  FeatureStatus.UNAVAILABLE
+}
+
+private fun isModelUnavailable(error: GenAiException): Boolean = when (error.errorCode) {
+  GenAiException.ErrorCode.NOT_AVAILABLE,
+  GenAiException.ErrorCode.NOT_SUPPORTED,
+  GenAiException.ErrorCode.AICORE_INCOMPATIBLE,
+  GenAiException.ErrorCode.NEEDS_SYSTEM_UPDATE -> true
+  else -> false
+}
+
+internal suspend fun collectGoogleVoiceTranscript(
+  responses: Flow<SpeechRecognizerResponse>
+): String {
+  val text = StringBuilder()
+  var partial = ""
+  var completed = false
+  responses.collect { response ->
+    when (response) {
+      // Separators between final utterances are supplied by the SDK.
+      is SpeechRecognizerResponse.FinalTextResponse -> {
+        text.append(response.text)
+        partial = ""
+      }
+      is SpeechRecognizerResponse.PartialTextResponse -> partial = response.text
+      is SpeechRecognizerResponse.ErrorResponse -> throw response.e
+      is SpeechRecognizerResponse.CompletedResponse -> completed = true
+      else -> Unit
+    }
+  }
+  requireCompleteAudio(completed) { "Speech recognition did not complete the recording." }
+  // Some sessions complete with a trailing partial instead of another final event.
+  return text.append(partial).toString().trim()
+}
+
+internal interface GoogleSpeechClient : Closeable {
+  suspend fun checkStatus(): Int
+  suspend fun download()
+}
+
+internal class MlKitSpeechClient(context: Context, locale: Locale, mode: Int) : GoogleSpeechClient {
+  private val context = context.applicationContext
+  private val recognizer = SpeechRecognition.getClient(
+    speechRecognizerOptions {
+      this.locale = locale
+      preferredMode = mode
+    }
+  )
+
+  override suspend fun checkStatus() = recognizer.checkStatus()
+
+  override suspend fun download() {
+    val result = recognizer.download().first {
+      it is DownloadStatus.DownloadCompleted || it is DownloadStatus.DownloadFailed
+    }
+    if (result is DownloadStatus.DownloadFailed) throw result.e
+  }
+
+  suspend fun transcribe(uri: String): String = withRecordedPcm(context, uri) { pcm ->
+    PcmPipe.open().use { pipe ->
+      val request = speechRecognizerRequest { audioSource = pipe.source }
+      try {
+        collectGoogleVoiceTranscript(
+          pacedRecordedResponses(pcm, pipe) {
+            recognizer.startRecognition(request)
+          }
+        )
+      } finally {
+        // Stop inference before closing the SDK-owned descriptor, including cancellation.
+        withContext(NonCancellable) { runCatching { recognizer.stopRecognition() } }
+      }
+    }
+  }
+
+  override fun close() = recognizer.close()
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmOutput.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmOutput.kt
new file mode 100644
index 0000000000000..8673ce0d790e8
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmOutput.kt
@@ -0,0 +1,85 @@
+package expo.modules.t3voicetranscription
+
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerResponse
+import kotlinx.coroutines.NonCancellable
+import kotlinx.coroutines.TimeoutCancellationException
+import kotlinx.coroutines.async
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.flow
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeout
+import java.io.File
+import java.util.concurrent.atomic.AtomicBoolean
+
+internal interface PcmOutput : AutoCloseable {
+  suspend fun write(buffer: ByteArray, count: Int)
+  fun finish()
+  fun verifyConsumed()
+}
+
+private suspend fun replayPcm(file: File, output: PcmOutput) {
+  val expected = file.length()
+  var sent = 0L
+  file.inputStream().use { input ->
+    val buffer = ByteArray(3200)
+    while (true) {
+      val count = input.read(buffer)
+      if (count == -1) break
+      requireCompleteAudio(count > 0 && count % 2 == 0) {
+        "Recorded PCM contains an incomplete audio frame."
+      }
+      // STREAMING requires real-time delivery, including the final short buffer.
+      delay((count * 1000L + 31999) / 32000)
+      output.write(buffer, count)
+      sent += count
+    }
+  }
+  requireCompleteAudio(sent == expected && file.length() == expected) {
+    "The recording changed while speech recognition was reading it. No transcript was added."
+  }
+}
+
+internal fun pacedRecordedResponses(
+  file: File,
+  output: PcmOutput,
+  responses: () -> Flow<SpeechRecognizerResponse>
+): Flow<SpeechRecognizerResponse> = flow {
+  coroutineScope {
+    val exhausted = AtomicBoolean()
+    val sender = async {
+      replayPcm(file, output)
+      exhausted.set(true)
+      output.finish()
+    }
+    try {
+      withTimeout(file.length() / 32 + 30000) {
+        responses().collect { emit(it) }
+        requireCompleteAudio(exhausted.get()) {
+          "Speech recognition ended before receiving the complete recording. " +
+            "No transcript was added. Retry dictation."
+        }
+        sender.await()
+        output.verifyConsumed()
+      }
+    } catch (e: TimeoutCancellationException) {
+      throw VoiceTranscriptionException(
+        "incomplete-audio",
+        "Speech recognition did not finish the complete recording. No transcript was added. Retry dictation.",
+        e
+      )
+    } finally {
+      sender.cancel()
+      try {
+        output.finish()
+      } finally {
+        withContext(NonCancellable) { sender.join() }
+      }
+    }
+  }
+}
+
+internal inline fun requireCompleteAudio(condition: Boolean, message: () -> String) {
+  if (!condition) throw VoiceTranscriptionException("incomplete-audio", message())
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmPipe.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmPipe.kt
new file mode 100644
index 0000000000000..b654ce01a8116
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/PcmPipe.kt
@@ -0,0 +1,105 @@
+package expo.modules.t3voicetranscription
+
+import android.os.ParcelFileDescriptor
+import android.system.ErrnoException
+import android.system.Os
+import android.system.OsConstants
+import com.google.mlkit.genai.common.audio.AudioSource
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.ensureActive
+import kotlinx.coroutines.withTimeout
+import kotlinx.coroutines.TimeoutCancellationException
+import java.util.concurrent.atomic.AtomicBoolean
+
+internal class PcmPipe private constructor(
+  val source: AudioSource,
+  private val writer: ParcelFileDescriptor,
+  verificationReader: ParcelFileDescriptor
+) : PcmOutput {
+  private val closed = AtomicBoolean()
+  private val reader = ParcelFileDescriptor.AutoCloseInputStream(verificationReader)
+  override suspend fun write(buffer: ByteArray, count: Int) {
+    try {
+      withTimeout(5000) {
+        var offset = 0
+        while (offset < count) {
+          currentCoroutineContext().ensureActive()
+          try {
+            val written = Os.write(writer.fileDescriptor, buffer, offset, count - offset)
+            requireCompleteAudio(written > 0) { "On-device speech stopped reading the recording." }
+            offset += written
+          } catch (e: ErrnoException) {
+            if (e.errno != OsConstants.EAGAIN) {
+              throw VoiceTranscriptionException(
+                "incomplete-audio",
+                "On-device speech stopped reading the complete recording. No transcript was added. Retry dictation.",
+                e
+              )
+            }
+            delay(10)
+          }
+        }
+      }
+    } catch (e: TimeoutCancellationException) {
+      throw VoiceTranscriptionException(
+        "incomplete-audio",
+        "On-device speech could not read the complete recording. No transcript was added. Retry dictation.",
+        e
+      )
+    }
+  }
+  override fun finish() = writer.close()
+  override fun verifyConsumed() {
+    requireCompleteAudio(reader.available() == 0) {
+      "Speech recognition ended with unread recorded audio. No transcript was added. Retry dictation."
+    }
+  }
+  override fun close() {
+    if (!closed.compareAndSet(false, true)) return
+    try {
+      writer.close()
+    } finally {
+      try {
+        reader.close()
+      } finally {
+        source.close()
+      }
+    }
+  }
+  companion object {
+    fun open(): PcmPipe {
+      val ends = ParcelFileDescriptor.createPipe()
+      var sdkReader: ParcelFileDescriptor? = null
+      var retained = false
+      try {
+        Os.fcntlInt(ends[1].fileDescriptor, OsConstants.F_SETFL, OsConstants.O_NONBLOCK)
+        // The SDK closes its descriptor; verification must retain a separate read end.
+        sdkReader = ends[0].dup()
+        val pipe = PcmPipe(
+          AudioSource.fromPfd(sdkReader, AudioSource.Mode.STREAMING),
+          ends[1],
+          ends[0]
+        )
+        retained = true
+        return pipe
+      } finally {
+        if (!retained) closeFailedPipe(sdkReader, ends)
+      }
+    }
+    private fun closeFailedPipe(
+      sdkReader: ParcelFileDescriptor?,
+      ends: Array<ParcelFileDescriptor>
+    ) {
+      try {
+        sdkReader?.close()
+      } finally {
+        try {
+          ends[0].close()
+        } finally {
+          ends[1].close()
+        }
+      }
+    }
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordedPcm.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordedPcm.kt
new file mode 100644
index 0000000000000..b719981df19bd
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordedPcm.kt
@@ -0,0 +1,172 @@
+package expo.modules.t3voicetranscription
+
+import android.content.Context
+import android.media.AudioFormat
+import android.media.MediaCodec
+import android.media.MediaExtractor
+import android.media.MediaFormat
+import android.net.Uri
+import java.io.Closeable
+import java.io.File
+import java.io.OutputStream
+import java.nio.ByteOrder
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
+import kotlinx.coroutines.TimeoutCancellationException
+import kotlinx.coroutines.withTimeout
+
+internal suspend fun <T> withRecordedPcm(
+  context: Context,
+  uri: String,
+  transcribe: suspend (File) -> T
+): T {
+  val pcm = File.createTempFile("dictation-", ".pcm", context.cacheDir)
+  try {
+    try {
+      withTimeout(30000) { decodeRecording(context, Uri.parse(uri), pcm) }
+    } catch (_: TimeoutCancellationException) {
+      throw VoiceTranscriptionException(
+        "incomplete-audio",
+        "Audio decoding did not finish the recording. Retry dictation."
+      )
+    }
+    requireCompleteAudio(pcm.length() > 0 && pcm.length() % 2 == 0L) {
+      "The recording did not contain complete audio samples."
+    }
+    return transcribe(pcm)
+  } finally {
+    pcm.delete()
+  }
+}
+
+private suspend fun decodeRecording(context: Context, uri: Uri, output: File) {
+  val extractor = MediaExtractor()
+  Closeable { extractor.release() }.use {
+    extractor.setDataSource(context, uri, null)
+    val track = (0 until extractor.trackCount).firstOrNull {
+      extractor.getTrackFormat(it).getString(MediaFormat.KEY_MIME)?.startsWith("audio/") == true
+    } ?: throw VoiceTranscriptionException("incomplete-audio", "The recording has no audio track.")
+    extractor.selectTrack(track)
+    decodeTrack(extractor, extractor.getTrackFormat(track), output)
+  }
+}
+
+private suspend fun decodeTrack(extractor: MediaExtractor, format: MediaFormat, output: File) {
+  format.setInteger(MediaFormat.KEY_PCM_ENCODING, AudioFormat.ENCODING_PCM_16BIT)
+  val decoder = MediaCodec.createDecoderByType(
+    requireNotNull(format.getString(MediaFormat.KEY_MIME))
+  )
+  Closeable { decoder.release() }.use {
+    decoder.configure(format, null, null, 0)
+    decoder.start()
+    Closeable { decoder.stop() }.use {
+      output.outputStream().buffered().use { stream -> decodeBuffers(decoder, extractor, stream) }
+    }
+  }
+}
+
+private suspend fun decodeBuffers(
+  decoder: MediaCodec,
+  extractor: MediaExtractor,
+  stream: OutputStream
+) {
+  var converter: RecordingPcmConverter? = null
+  var decodedFormat: Triple<Int, Int, Int>? = null
+  try {
+    var inputEnded = false
+    var outputEnded = false
+    val info = MediaCodec.BufferInfo()
+    while (!outputEnded) {
+      currentCoroutineContext().ensureActive()
+      if (!inputEnded) inputEnded = queueDecoderInput(decoder, extractor)
+      val index = decoder.dequeueOutputBuffer(info, 10000)
+      when {
+        index == MediaCodec.INFO_OUTPUT_FORMAT_CHANGED -> {
+          val next = pcmFormat(decoder.outputFormat, decodedFormat)
+          decodedFormat = next
+          converter = converter ?: createConverter(next, stream)
+        }
+        index >= 0 -> {
+          consumeDecodedBuffer(decoder, index, info, requireNotNull(converter))
+          outputEnded = info.flags and MediaCodec.BUFFER_FLAG_END_OF_STREAM != 0
+        }
+      }
+    }
+    requireCompleteAudio(inputEnded) {
+      "Audio decoding ended before reading the complete recording."
+    }
+    converter?.finish()
+  } finally {
+    converter?.close()
+  }
+}
+
+private fun pcmFormat(
+  format: MediaFormat,
+  previous: Triple<Int, Int, Int>?
+): Triple<Int, Int, Int> {
+  val encoding = if (format.containsKey(MediaFormat.KEY_PCM_ENCODING)) {
+    format.getInteger(MediaFormat.KEY_PCM_ENCODING)
+  } else {
+    AudioFormat.ENCODING_PCM_16BIT
+  }
+  requireCompleteAudio(encoding == AudioFormat.ENCODING_PCM_16BIT) {
+    "The decoder did not provide 16-bit audio."
+  }
+  val next = Triple(
+    format.getInteger(MediaFormat.KEY_SAMPLE_RATE),
+    format.getInteger(MediaFormat.KEY_CHANNEL_COUNT),
+    encoding
+  )
+  requireCompleteAudio(previous == null || previous == next) {
+    "The recording changed audio format while decoding."
+  }
+  return next
+}
+
+private fun createConverter(
+  format: Triple<Int, Int, Int>,
+  stream: OutputStream
+): RecordingPcmConverter {
+  val bytes = ByteArray(8192)
+  return RecordingPcmConverter(format.first, format.second) { buffer ->
+    while (buffer.hasRemaining()) {
+      val count = minOf(buffer.remaining(), bytes.size)
+      buffer.get(bytes, 0, count)
+      stream.write(bytes, 0, count)
+    }
+  }
+}
+
+private fun queueDecoderInput(decoder: MediaCodec, extractor: MediaExtractor): Boolean {
+  val index = decoder.dequeueInputBuffer(10000)
+  if (index < 0) return false
+  val buffer = requireNotNull(decoder.getInputBuffer(index))
+  val count = extractor.readSampleData(buffer, 0)
+  return if (count < 0) {
+    decoder.queueInputBuffer(index, 0, 0, 0, MediaCodec.BUFFER_FLAG_END_OF_STREAM)
+    true
+  } else {
+    decoder.queueInputBuffer(index, 0, count, extractor.sampleTime, 0)
+    extractor.advance()
+    false
+  }
+}
+
+private fun consumeDecodedBuffer(
+  decoder: MediaCodec,
+  index: Int,
+  info: MediaCodec.BufferInfo,
+  converter: RecordingPcmConverter
+) {
+  try {
+    if (info.size <= 0 || info.flags and MediaCodec.BUFFER_FLAG_CODEC_CONFIG != 0) return
+    val buffer = requireNotNull(decoder.getOutputBuffer(index))
+    buffer.position(info.offset)
+    buffer.limit(info.offset + info.size)
+    buffer.order(ByteOrder.nativeOrder())
+    converter.write(buffer)
+  } finally {
+    decoder.releaseOutputBuffer(index, false)
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordingPcmConverter.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordingPcmConverter.kt
new file mode 100644
index 0000000000000..3272b2bd7d5f5
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/RecordingPcmConverter.kt
@@ -0,0 +1,68 @@
+package expo.modules.t3voicetranscription
+
+import androidx.annotation.OptIn
+import androidx.media3.common.C
+import androidx.media3.common.audio.AudioProcessingPipeline
+import androidx.media3.common.audio.AudioProcessor
+import androidx.media3.common.audio.ChannelMixingAudioProcessor
+import androidx.media3.common.audio.ChannelMixingMatrix
+import androidx.media3.common.audio.SonicAudioProcessor
+import androidx.media3.common.util.UnstableApi
+import com.google.common.collect.ImmutableList
+import java.nio.ByteBuffer
+
+@OptIn(UnstableApi::class)
+internal class RecordingPcmConverter(
+  sampleRate: Int,
+  channels: Int,
+  private val consume: (ByteBuffer) -> Unit
+) : AutoCloseable {
+  private val frameSize = channels * 2
+  private val pipeline = AudioProcessingPipeline(
+    ImmutableList.of(
+      ChannelMixingAudioProcessor().apply {
+        putChannelMixingMatrix(ChannelMixingMatrix.createForConstantGain(channels, 1))
+      },
+      SonicAudioProcessor().apply { setOutputSampleRateHz(16000) }
+    )
+  )
+
+  init {
+    pipeline.configure(AudioProcessor.AudioFormat(sampleRate, channels, C.ENCODING_PCM_16BIT))
+    pipeline.flush()
+  }
+
+  fun write(input: ByteBuffer) {
+    requireCompleteAudio(input.remaining() % frameSize == 0) {
+      "Decoded audio contains an incomplete sample."
+    }
+    if (!pipeline.isOperational) {
+      consume(input)
+      return
+    }
+    while (input.hasRemaining()) {
+      val before = input.remaining()
+      pipeline.queueInput(input)
+      val output = pipeline.output
+      val produced = output.remaining()
+      consume(output)
+      requireCompleteAudio(input.remaining() < before || produced > 0) {
+        "Audio conversion stopped before the recording ended."
+      }
+    }
+  }
+
+  fun finish() {
+    if (!pipeline.isOperational) return
+    pipeline.queueEndOfStream()
+    while (!pipeline.isEnded) {
+      val output = pipeline.output
+      requireCompleteAudio(output.hasRemaining() || pipeline.isEnded) {
+        "Audio conversion did not finish the recording."
+      }
+      consume(output)
+    }
+  }
+
+  override fun close() = pipeline.reset()
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/T3VoiceTranscriptionModule.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/T3VoiceTranscriptionModule.kt
new file mode 100644
index 0000000000000..b49791bea2b9b
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/T3VoiceTranscriptionModule.kt
@@ -0,0 +1,112 @@
+package expo.modules.t3voicetranscription
+
+import android.content.res.Resources
+import android.os.Build
+import expo.modules.kotlin.Promise
+import expo.modules.kotlin.functions.Coroutine
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+import java.util.Locale
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+class T3VoiceTranscriptionModule : Module() {
+  private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+  private val lock = Any()
+  private var operation: Pair<Int, Job>? = null
+
+  override fun definition() = ModuleDefinition {
+    Name("T3VoiceTranscription")
+
+    AsyncFunction("checkAvailability").Coroutine<Boolean> {
+      if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) {
+        false
+      } else {
+        withContext(Dispatchers.IO) {
+          val context = requireNotNull(appContext.reactContext)
+          val locale = Resources.getSystem().configuration.locales[0]
+          isGoogleVoiceTranscriptionSupported { MlKitSpeechClient(context, locale, it) }
+        }
+      }
+    }
+
+    AsyncFunction("prepare") { id: Int, promise: Promise ->
+      runOperation(id, promise, "preparation-failed") {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.S) {
+          throw VoiceTranscriptionException(
+            "unavailable",
+            "Voice transcription requires Android 12 or later."
+          )
+        }
+        val context = requireNotNull(appContext.reactContext)
+        val locale = Resources.getSystem().configuration.locales[0]
+        val mode = prepareGoogleVoiceTranscription { MlKitSpeechClient(context, locale, it) }
+        mapOf("locale" to locale.toLanguageTag(), "mode" to mode)
+      }
+    }
+
+    AsyncFunction("transcribe") {
+        id: Int,
+        uri: String,
+        language: String,
+        mode: Int,
+        promise: Promise
+      ->
+      runOperation(id, promise, "transcription-failed") {
+        val context = requireNotNull(appContext.reactContext)
+        MlKitSpeechClient(context, Locale.forLanguageTag(language), mode).use { it.transcribe(uri) }
+      }
+    }
+
+    AsyncFunction("cancel") { id: Int, promise: Promise ->
+      scope.launch {
+        val job = synchronized(lock) { operation?.takeIf { it.first == id }?.second }
+        job?.cancelAndJoin()
+        promise.resolve(null)
+      }
+    }
+
+    OnDestroy { scope.cancel() }
+  }
+
+  private fun runOperation(
+    id: Int,
+    promise: Promise,
+    errorCode: String,
+    block: suspend () -> Any?
+  ) {
+    var result: Result<Any?>? = null
+    val job = scope.launch(start = CoroutineStart.LAZY) {
+      result = runCatching { block() }
+    }
+    synchronized(lock) {
+      if (operation != null) {
+        job.cancel()
+        promise.reject("busy", "Another voice transcription is already active.", null)
+        return
+      }
+      operation = id to job
+    }
+    job.invokeOnCompletion { cause ->
+      synchronized(lock) { if (operation?.first == id) operation = null }
+      val outcome = cause?.let { Result.failure<Any?>(it) } ?: result
+        ?: Result.failure(CancellationException("Voice transcription was cancelled."))
+      outcome.fold(
+        onSuccess = { promise.resolve(it) },
+        onFailure = { error ->
+          val code = voiceTranscriptionErrorCode(error, errorCode)
+          promise.reject(code, error.message, error)
+        }
+      )
+    }
+    job.start()
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/VoiceTranscriptionFailure.kt b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/VoiceTranscriptionFailure.kt
new file mode 100644
index 0000000000000..bc3dca6f4efbf
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/main/java/expo/modules/t3voicetranscription/VoiceTranscriptionFailure.kt
@@ -0,0 +1,24 @@
+package expo.modules.t3voicetranscription
+
+import com.google.mlkit.genai.common.GenAiException
+import kotlinx.coroutines.CancellationException
+
+internal fun voiceTranscriptionErrorCode(
+  error: Throwable,
+  fallback: String
+): String = when (error) {
+  is CancellationException -> "cancelled"
+  is VoiceTranscriptionException -> error.code
+  is GenAiException -> when {
+    error.message.orEmpty().contains("NO_SPEECH_DETECTED") -> "no-speech"
+    error.errorCode == GenAiException.ErrorCode.NOT_ENOUGH_DISK_SPACE -> "storage"
+    error.errorCode == GenAiException.ErrorCode.PER_APP_BATTERY_USE_QUOTA_EXCEEDED -> "quota"
+    error.errorCode == GenAiException.ErrorCode.BUSY -> "busy"
+    error.errorCode == GenAiException.ErrorCode.AUDIO_BUFFER_OVERFLOW -> "audio-overflow"
+    error.errorCode == GenAiException.ErrorCode.NEEDS_SYSTEM_UPDATE ||
+      error.errorCode == GenAiException.ErrorCode.AICORE_INCOMPATIBLE -> "needs-update"
+    error.message.orEmpty().contains("DOWNLOAD_ERROR") -> "download-failed"
+    else -> fallback
+  }
+  else -> fallback
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriberTest.kt b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriberTest.kt
new file mode 100644
index 0000000000000..aaa76dfbf07e2
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/GoogleVoiceTranscriberTest.kt
@@ -0,0 +1,211 @@
+package expo.modules.t3voicetranscription
+
+import com.google.mlkit.genai.common.FeatureStatus
+import com.google.mlkit.genai.common.GenAiException
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerOptions
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerResponse
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.flow.flow
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class GoogleVoiceTranscriberTest {
+  @Test
+  fun preservesUtterancesAndTheirSpacingWithoutDuplicatingHypotheses() = runBlocking {
+    for ((finals, trailing, expected) in listOf(
+      Triple(
+        listOf("The beginning.", " The middle.", " Repeat this.", " Repeat this."),
+        emptyList(),
+        "The beginning. The middle. Repeat this. Repeat this."
+      ),
+      Triple(listOf("最初の文。", "次の文。"), emptyList(), "最初の文。次の文。"),
+      Triple(
+        listOf("The beginning."),
+        listOf(" An unfinished ending", " The final sentence."),
+        "The beginning. The final sentence."
+      )
+    )) {
+      val responses = flow {
+        for (text in finals) {
+          emit(SpeechRecognizerResponse.PartialTextResponse("Unfinished hypothesis"))
+          emit(SpeechRecognizerResponse.FinalTextResponse(text, emptyList()))
+        }
+        for (text in trailing) emit(SpeechRecognizerResponse.PartialTextResponse(text))
+        emit(SpeechRecognizerResponse.CompletedResponse)
+      }
+      assertEquals(expected, collectGoogleVoiceTranscript(responses))
+    }
+    val incomplete = runCatching {
+      collectGoogleVoiceTranscript(
+        flow {
+          emit(SpeechRecognizerResponse.FinalTextResponse("Incomplete recording.", emptyList()))
+        }
+      )
+    }
+    assertEquals(
+      "incomplete-audio",
+      (incomplete.exceptionOrNull() as VoiceTranscriptionException).code
+    )
+  }
+
+  private class Client(
+    var status: Int,
+    val onStatus: () -> Unit = {},
+    val downloadedStatus: Int = FeatureStatus.AVAILABLE,
+    val onDownload: suspend () -> Unit = {}
+  ) : GoogleSpeechClient {
+    var closed = false
+    var downloads = 0
+
+    override suspend fun checkStatus(): Int {
+      onStatus()
+      return status
+    }
+
+    override suspend fun download() {
+      downloads += 1
+      onDownload()
+      status = downloadedStatus
+    }
+
+    override fun close() {
+      closed = true
+    }
+  }
+
+  @Test
+  fun checksSupportWithoutDownloadingAndClosesProbedClients() = runBlocking {
+    for ((advancedStatus, basicStatus, supported) in listOf(
+      Triple(FeatureStatus.AVAILABLE, FeatureStatus.UNAVAILABLE, true),
+      Triple(FeatureStatus.DOWNLOADABLE, FeatureStatus.UNAVAILABLE, true),
+      Triple(FeatureStatus.DOWNLOADING, FeatureStatus.UNAVAILABLE, true),
+      Triple(FeatureStatus.UNAVAILABLE, FeatureStatus.AVAILABLE, true),
+      Triple(FeatureStatus.UNAVAILABLE, FeatureStatus.DOWNLOADABLE, true),
+      Triple(FeatureStatus.UNAVAILABLE, FeatureStatus.DOWNLOADING, true),
+      Triple(FeatureStatus.UNAVAILABLE, FeatureStatus.UNAVAILABLE, false)
+    )) {
+      val clients = mutableListOf<Client>()
+      assertEquals(
+        supported,
+        isGoogleVoiceTranscriptionSupported { mode ->
+          Client(
+            if (mode == SpeechRecognizerOptions.Mode.MODE_ADVANCED) advancedStatus else basicStatus
+          ).also { clients.add(it) }
+        }
+      )
+      assertTrue(clients.all { it.closed && it.downloads == 0 })
+      assertEquals(if (advancedStatus == FeatureStatus.UNAVAILABLE) 2 else 1, clients.size)
+    }
+  }
+
+  @Test
+  fun preparesAdvancedBeforeConsideringBasic() = runBlocking {
+    for (status in listOf(
+      FeatureStatus.AVAILABLE,
+      FeatureStatus.DOWNLOADABLE,
+      FeatureStatus.DOWNLOADING
+    )) {
+      val client = Client(status)
+      val mode = prepareGoogleVoiceTranscription {
+        assertEquals(SpeechRecognizerOptions.Mode.MODE_ADVANCED, it)
+        client
+      }
+      assertEquals(SpeechRecognizerOptions.Mode.MODE_ADVANCED, mode)
+      assertEquals(if (status == FeatureStatus.AVAILABLE) 0 else 1, client.downloads)
+      assertTrue(client.closed)
+    }
+  }
+
+  @Test
+  fun fallsBackToBasicOnlyForUnavailableAdvancedModels() = runBlocking {
+    for ((duringDownload, errorCode) in listOf(
+      false to null,
+      false to GenAiException.ErrorCode.NOT_AVAILABLE,
+      false to GenAiException.ErrorCode.NOT_SUPPORTED,
+      true to GenAiException.ErrorCode.NOT_AVAILABLE,
+      true to GenAiException.ErrorCode.NOT_SUPPORTED,
+      true to null
+    )) {
+      val advanced = Client(
+        if (duringDownload) FeatureStatus.DOWNLOADABLE else FeatureStatus.UNAVAILABLE,
+        downloadedStatus = if (duringDownload &&
+          errorCode == null
+        ) {
+          FeatureStatus.UNAVAILABLE
+        } else {
+          FeatureStatus.AVAILABLE
+        },
+        onStatus = {
+          if (!duringDownload && errorCode != null) {
+            throw GenAiException(Exception("Unavailable"), errorCode)
+          }
+        },
+        onDownload = {
+          if (duringDownload && errorCode != null) {
+            throw GenAiException(Exception("Unavailable"), errorCode)
+          }
+        }
+      )
+      val basic = Client(FeatureStatus.DOWNLOADABLE)
+      val mode = prepareGoogleVoiceTranscription {
+        if (it == SpeechRecognizerOptions.Mode.MODE_ADVANCED) advanced else basic
+      }
+      assertEquals(SpeechRecognizerOptions.Mode.MODE_BASIC, mode)
+      assertTrue(advanced.closed && basic.closed)
+      assertEquals(1, basic.downloads)
+    }
+    val clients = mutableListOf<Client>()
+    val result = runCatching {
+      prepareGoogleVoiceTranscription { Client(FeatureStatus.UNAVAILABLE).also { clients.add(it) } }
+    }
+    assertEquals("unavailable", (result.exceptionOrNull() as VoiceTranscriptionException).code)
+    assertTrue(clients.all { it.closed })
+  }
+
+  @Test
+  fun preservesDownloadAndQuotaFailuresInsteadOfSilentlyFallingBack() = runBlocking {
+    for (errorCode in listOf(
+      GenAiException.ErrorCode.NOT_ENOUGH_DISK_SPACE,
+      GenAiException.ErrorCode.PER_APP_BATTERY_USE_QUOTA_EXCEEDED
+    )) {
+      val error = GenAiException(Exception("Preparation failed"), errorCode)
+      val client = Client(FeatureStatus.DOWNLOADABLE, onDownload = { throw error })
+      val result = runCatching {
+        prepareGoogleVoiceTranscription {
+          assertEquals(SpeechRecognizerOptions.Mode.MODE_ADVANCED, it)
+          client
+        }
+      }
+      assertEquals(error, result.exceptionOrNull())
+      assertEquals(
+        if (errorCode == GenAiException.ErrorCode.NOT_ENOUGH_DISK_SPACE) "storage" else "quota",
+        voiceTranscriptionErrorCode(error, "preparation-failed")
+      )
+      assertTrue(client.closed)
+    }
+  }
+
+  @Test
+  fun cancellationClosesTheDownloadingClientWithoutStartingBasic() = runBlocking {
+    val enteredDownload = CompletableDeferred<Unit>()
+    val download = CompletableDeferred<Unit>()
+    val client = Client(FeatureStatus.DOWNLOADABLE, onDownload = {
+      enteredDownload.complete(Unit)
+      download.await()
+    })
+    val job = launch {
+      prepareGoogleVoiceTranscription {
+        assertEquals(SpeechRecognizerOptions.Mode.MODE_ADVANCED, it)
+        client
+      }
+    }
+    enteredDownload.await()
+    job.cancelAndJoin()
+    assertTrue(client.closed)
+    assertEquals(FeatureStatus.DOWNLOADABLE, client.status)
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/PcmReplayTest.kt b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/PcmReplayTest.kt
new file mode 100644
index 0000000000000..f226cbebca7cb
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/PcmReplayTest.kt
@@ -0,0 +1,126 @@
+package expo.modules.t3voicetranscription
+
+import com.google.mlkit.genai.speechrecognition.SpeechRecognizerResponse
+import java.io.ByteArrayOutputStream
+import java.io.File
+import kotlinx.coroutines.CompletableDeferred
+import kotlinx.coroutines.cancelAndJoin
+import kotlinx.coroutines.flow.flow
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.test.currentTime
+import kotlinx.coroutines.test.runTest
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+@OptIn(kotlinx.coroutines.ExperimentalCoroutinesApi::class)
+class PcmReplayTest {
+  private class Output : PcmOutput {
+    val bytes = ByteArrayOutputStream()
+    val ended = CompletableDeferred<Unit>()
+    var unread = false
+    var closed = false
+
+    override suspend fun write(buffer: ByteArray, count: Int) {
+      bytes.write(buffer, 0, count)
+    }
+    override fun finish() {
+      ended.complete(Unit)
+    }
+    override fun verifyConsumed() {
+      requireCompleteAudio(!unread) { "Unread audio." }
+    }
+    override fun close() {
+      closed = true
+    }
+  }
+
+  @Test fun replaysTheEntireLongFileIncludingTheLastShortBuffer() = runTest {
+    val pcm = ByteArray(1994140) { (it % 251).toByte() }
+    val file = File.createTempFile("dictation-replay-", ".pcm").apply { writeBytes(pcm) }
+    try {
+      Output().use { output ->
+        val responses = pacedRecordedResponses(file, output) {
+          flow {
+            output.ended.await()
+            emit(SpeechRecognizerResponse.FinalTextResponse("Opening. ", emptyList()))
+            emit(SpeechRecognizerResponse.FinalTextResponse("Repeat. Repeat. 中間。", emptyList()))
+            emit(SpeechRecognizerResponse.PartialTextResponse(" A longer unfinished ending"))
+            emit(SpeechRecognizerResponse.PartialTextResponse(" End."))
+            emit(SpeechRecognizerResponse.CompletedResponse)
+          }
+        }
+        assertEquals("Opening. Repeat. Repeat. 中間。 End.", collectGoogleVoiceTranscript(responses))
+        assertArrayEquals(pcm, output.bytes.toByteArray())
+        assertEquals(62317L, currentTime)
+      }
+    } finally {
+      file.delete()
+    }
+  }
+
+  @Test fun refusesSuccessfulSdkCompletionBeforeAllAudioIsConsumed() = runTest {
+    val file = File.createTempFile("dictation-replay-", ".pcm").apply {
+      writeBytes(ByteArray(6400))
+    }
+    try {
+      for (early in listOf(true, false)) {
+        Output().use { output ->
+          output.unread = !early
+          val result = runCatching {
+            collectGoogleVoiceTranscript(
+              pacedRecordedResponses(file, output) {
+                flow {
+                  if (!early) output.ended.await()
+                  emit(
+                    SpeechRecognizerResponse.FinalTextResponse(
+                      "Plausible but incomplete.",
+                      emptyList()
+                    )
+                  )
+                  emit(SpeechRecognizerResponse.CompletedResponse)
+                }
+              }
+            )
+          }
+          assertEquals(
+            "incomplete-audio",
+            (result.exceptionOrNull() as VoiceTranscriptionException).code
+          )
+          assertTrue(output.ended.isCompleted)
+        }
+      }
+    } finally {
+      file.delete()
+    }
+  }
+
+  @Test fun cancellationSettlesTheSenderBeforeReleasingItsOutput() = runTest {
+    val file = File.createTempFile("dictation-replay-", ".pcm").apply {
+      writeBytes(ByteArray(6400))
+    }
+    val entered = CompletableDeferred<Unit>()
+    val output = Output()
+    try {
+      val job = launch {
+        output.use {
+          collectGoogleVoiceTranscript(
+            pacedRecordedResponses(file, it) {
+              flow {
+                entered.complete(Unit)
+                CompletableDeferred<Unit>().await()
+              }
+            }
+          )
+        }
+      }
+      entered.await()
+      job.cancelAndJoin()
+      assertTrue(output.ended.isCompleted)
+      assertTrue(output.closed)
+    } finally {
+      file.delete()
+    }
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/RecordingPcmConverterTest.kt b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/RecordingPcmConverterTest.kt
new file mode 100644
index 0000000000000..694523610e880
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/android/src/test/java/expo/modules/t3voicetranscription/RecordingPcmConverterTest.kt
@@ -0,0 +1,51 @@
+package expo.modules.t3voicetranscription
+
+import java.io.ByteArrayOutputStream
+import java.nio.ByteBuffer
+import java.nio.ByteOrder
+import kotlin.math.abs
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.annotation.Config
+
+@RunWith(RobolectricTestRunner::class)
+@Config(manifest = Config.NONE, sdk = [31])
+class RecordingPcmConverterTest {
+  @Test fun preservesAlreadyCompatiblePcmAndResamplesStereoThroughItsTail() {
+    for ((rate, channels) in listOf(16000 to 1, 44100 to 2, 48000 to 2)) {
+      val frames = rate * 2 + 37
+      val input = ByteBuffer.allocateDirect(frames * channels * 2).order(ByteOrder.nativeOrder())
+      repeat(frames) { frame ->
+        val level = if (frame < rate) 6000 else 18000
+        repeat(channels) { input.putShort(level.toShort()) }
+      }
+      input.flip()
+      val original = ByteArray(input.remaining()).also { input.duplicate().get(it) }
+      val result = ByteArrayOutputStream()
+      RecordingPcmConverter(rate, channels) { buffer ->
+        val bytes = ByteArray(buffer.remaining())
+        buffer.get(bytes)
+        result.write(bytes)
+      }.use { converter ->
+        while (input.hasRemaining()) {
+          val end = minOf(input.limit(), input.position() + channels * 2 * 317)
+          val block = input.slice().order(ByteOrder.nativeOrder())
+          block.limit(end - input.position())
+          converter.write(block)
+          input.position(end)
+        }
+        converter.finish()
+      }
+      val bytes = result.toByteArray()
+      if (rate == 16000) assertArrayEquals(original, bytes)
+      val samples = ByteBuffer.wrap(bytes).order(ByteOrder.nativeOrder()).asShortBuffer()
+      assertTrue(abs(samples.remaining() * rate.toLong() - frames * 16000L) <= rate)
+      assertEquals(6000, samples[8000].toInt())
+      assertEquals(18000, samples[samples.limit() - 10].toInt())
+    }
+  }
+}
diff --git a/apps/mobile/modules/t3-voice-transcription/expo-module.config.json b/apps/mobile/modules/t3-voice-transcription/expo-module.config.json
new file mode 100644
index 0000000000000..5867f41ffe75e
--- /dev/null
+++ b/apps/mobile/modules/t3-voice-transcription/expo-module.config.json
@@ -0,0 +1,6 @@
+{
+  "platforms": ["android"],
+  "android": {
+    "modules": ["expo.modules.t3voicetranscription.T3VoiceTranscriptionModule"]
+  }
+}
diff --git a/apps/mobile/src/features/settings/SettingsMicrophoneRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsMicrophoneRouteScreen.tsx
index 480ae40232e39..be236d80ccefc 100644
--- a/apps/mobile/src/features/settings/SettingsMicrophoneRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsMicrophoneRouteScreen.tsx
@@ -3,7 +3,7 @@ import { useAtomSet, useAtomValue } from "@effect/atom-react";
 import { AsyncResult } from "effect/reactivity";
 import { getRecordingPermissionsAsync, requestRecordingPermissionsAsync } from "expo-audio";
 import { useState } from "react";
-import { Linking, useWindowDimensions, View } from "react-native";
+import { Linking, Platform, useWindowDimensions, View } from "react-native";
 import Reanimated, { ReduceMotion, useAnimatedStyle, withTiming } from "react-native-reanimated";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
 
@@ -16,15 +16,17 @@ import {
   type MicrophoneEntry,
   type MicrophoneKind,
   microphoneEntryKey,
-  microphoneOrder,
 } from "../../lib/microphonePriority";
-import { getLocalVoiceTranscriber } from "../../native/voiceTranscription";
 import { mobilePreferencesAtom, updateMobilePreferencesAtom } from "../../state/preferences";
 import { ListRowLayout } from "../../components/ui/ListRowLayout";
 import { ThreadSwipeable } from "../home/thread-swipe-actions";
 import { ListActionRow as SettingsActionRow } from "../../components/ui/ListActionRow";
 import { SettingsDragHandle } from "./components/SettingsDragHandle";
 import { SettingsSection } from "./components/SettingsSection";
+import {
+  deviceMicrophoneOrder,
+  localVoiceTranscriberAtom,
+} from "../voice-input/VoiceInputProvider";
 
 type MicrophonePermission = "checking" | "granted" | "ask" | "denied";
 
@@ -72,7 +74,10 @@ const KINDS: Record<
   bluetooth: {
     label: "Bluetooth",
     row: "Other Bluetooth",
-    rowDescription: "AirPods, headsets, and cars not listed",
+    rowDescription:
+      Platform.OS === "android"
+        ? "Earbuds, headsets, and cars, including Android Auto, not listed"
+        : "AirPods, headsets, and cars not listed",
     icon: "headphones",
   },
   builtIn: {
@@ -89,8 +94,16 @@ const KINDS: Record<
   },
 };
 
+const UNAVAILABLE_EXPLANATION =
+  Platform.OS === "android"
+    ? "T3 Code's voice input uses Google's on-device speech recognition, which needs Android 12 or later with compatible Google speech services for the device language. Without it, the composer has no microphone button, and allowing microphone access won't add one. Keyboard voice typing is separate and isn't affected."
+    : "T3 Code's voice input uses Apple's on-device speech transcription, which needs iOS 26 or later on a device that supports it. Without it, the composer has no microphone button, and allowing microphone access won't add one. Apple keyboard dictation is separate and isn't affected.";
+
 export function SettingsMicrophoneRouteScreen() {
-  return getLocalVoiceTranscriber() === null ? <VoiceInputUnavailable /> : <MicrophoneSettings />;
+  const transcriber = useAtomValue(localVoiceTranscriberAtom);
+  // Android's probe is asynchronous; an empty sheet avoids flashing "unavailable" first.
+  if (transcriber === "checking") return <View collapsable={false} className="flex-1 bg-sheet" />;
+  return transcriber === null ? <VoiceInputUnavailable /> : <MicrophoneSettings />;
 }
 
 function VoiceInputUnavailable() {
@@ -107,12 +120,7 @@ function VoiceInputUnavailable() {
         <SettingsSection title="Voice input">
           <ListRowLayout icon="mic" label="Not available on this device" />
         </SettingsSection>
-        <Text className="px-2 text-sm text-foreground-muted">
-          T3 Code's voice input uses Apple's on-device speech transcription, which needs iOS 26 or
-          later on a device that supports it. Without it, the composer has no microphone button, and
-          allowing microphone access won't add one. Apple keyboard dictation is separate and isn't
-          affected.
-        </Text>
+        <Text className="px-2 text-sm text-foreground-muted">{UNAVAILABLE_EXPLANATION}</Text>
       </ScrollView>
     </View>
   );
@@ -123,7 +131,7 @@ function MicrophoneSettings() {
   const preferencesResult = useAtomValue(mobilePreferencesAtom);
   const savePreferences = useAtomSet(updateMobilePreferencesAtom);
   const ready = AsyncResult.isSuccess(preferencesResult) && !preferencesResult.waiting;
-  const entries = microphoneOrder(
+  const entries = deviceMicrophoneOrder(
     AsyncResult.isSuccess(preferencesResult) ? preferencesResult.value.microphones : undefined,
   );
   const { permission, request: requestPermission } = useMicrophonePermission();
@@ -138,7 +146,7 @@ function MicrophoneSettings() {
   const move = (key: string, steps: number) =>
     savePreferences({
       transform: (current) => {
-        const next = [...microphoneOrder(current.microphones)];
+        const next = [...deviceMicrophoneOrder(current.microphones)];
         const from = next.findIndex((entry) => microphoneEntryKey(entry) === key);
         const to = Math.min(next.length - 1, Math.max(0, from + steps));
         if (from === -1 || from === to) return {};
@@ -150,7 +158,7 @@ function MicrophoneSettings() {
   const forget = (key: string) =>
     savePreferences({
       transform: (current) => ({
-        microphones: microphoneOrder(current.microphones).filter(
+        microphones: deviceMicrophoneOrder(current.microphones).filter(
           (entry) => microphoneEntryKey(entry) !== key,
         ),
       }),
@@ -227,9 +235,12 @@ function MicrophoneSettings() {
           })}
         </SettingsSection>
         <Text className="px-2 text-sm text-foreground-muted">
-          Voice input records from the first connected microphone in this list. Wired and Bluetooth
+          Voice input prefers the first connected microphone in this list. Wired and Bluetooth
           devices are added by name after you use voice input with them connected; until then, the
           Other row ranks them. Swipe a device left to forget it.
+          {Platform.OS === "android"
+            ? " Android may use another input when the preferred microphone cannot be routed."
+            : null}
         </Text>
       </ScrollView>
     </View>
diff --git a/apps/mobile/src/features/settings/SettingsRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsRouteScreen.tsx
index 34de55fd44082..59e75efa60c53 100644
--- a/apps/mobile/src/features/settings/SettingsRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsRouteScreen.tsx
@@ -244,12 +244,8 @@ function useSettingsIndexSections(): SettingsListSection[] {
         ...(navigationCustomizationAvailable()
           ? [page("SettingsNavigation", "line.3.horizontal", "Navigation tabs")]
           : []),
-        ...(Platform.OS === "ios"
-          ? [
-              page("SettingsKeyboard", "keyboard", "Keyboard"),
-              page("SettingsMicrophone", "mic", "Microphone"),
-            ]
-          : []),
+        ...(Platform.OS === "ios" ? [page("SettingsKeyboard", "keyboard", "Keyboard")] : []),
+        page("SettingsMicrophone", "mic", "Microphone"),
       ],
     },
     {
diff --git a/apps/mobile/src/features/settings/components/ScheduledTaskPromptField.tsx b/apps/mobile/src/features/settings/components/ScheduledTaskPromptField.tsx
index b0b65ff53778b..62cfea826b5ad 100644
--- a/apps/mobile/src/features/settings/components/ScheduledTaskPromptField.tsx
+++ b/apps/mobile/src/features/settings/components/ScheduledTaskPromptField.tsx
@@ -4,6 +4,7 @@ import { AppText as Text } from "../../../components/ui/AppText";
 import type { ComposerEditorSelection } from "../../../components/ComposerEditor";
 import {
   ComposerDictationCancelAction,
+  ComposerDictationError,
   ComposerDictationPrimaryAction,
   ComposerDictationStartAction,
   ComposerDictationStatus,
@@ -22,7 +23,7 @@ export function ScheduledTaskPromptField(props: {
 }) {
   const voice = props.voiceInput;
   const presentation = resolveVoiceComposerPresentation(voice.state, voice.elapsedSeconds);
-  const showsDictation = presentation.statusLabel !== null;
+  const showsDictation = presentation.statusKind === "active";
   const showsIdleTrigger = voice.isAvailable && !showsDictation;
 
   return (
@@ -55,6 +56,10 @@ export function ScheduledTaskPromptField(props: {
           </View>
         ) : null}
       </View>
+      <ComposerDictationError
+        error={voice.state.phase === "error" ? voice.state.error : null}
+        onDismiss={voice.cancel}
+      />
       {showsDictation ? (
         <ComposerDictationToolbar showsDictation>
           <View className="h-11 flex-row items-center">
@@ -64,7 +69,6 @@ export function ScheduledTaskPromptField(props: {
               elapsedSeconds={voice.elapsedSeconds}
               phase={voice.state.phase}
               presentation={presentation}
-              onDismissError={voice.cancel}
             />
             <ComposerDictationPrimaryAction
               state={voice.state}
diff --git a/apps/mobile/src/features/threads/ThreadComposer.tsx b/apps/mobile/src/features/threads/ThreadComposer.tsx
index ea2928f531374..f68f9787f49d4 100644
--- a/apps/mobile/src/features/threads/ThreadComposer.tsx
+++ b/apps/mobile/src/features/threads/ThreadComposer.tsx
@@ -107,6 +107,7 @@ import { offersLinkedEnvironments } from "@t3tools/client-runtime/link-request";
 import {
   ComposerDictationCancelAction,
   ComposerDictationDraftContent,
+  ComposerDictationError,
   ComposerDictationPrimaryAction,
   ComposerDictationStartAction,
   ComposerDictationStatus,
@@ -576,7 +577,7 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
     voiceInput.state,
     voiceInput.elapsedSeconds,
   );
-  const isVoiceInputPresented = voicePresentation.statusLabel !== null;
+  const isVoiceInputPresented = voicePresentation.statusKind === "active";
   const isExpanded = isFocused || settingsSheetPresentation.keepsComposerExpanded;
   const { layout, setComposerEditing } = useAdaptiveWorkspaceLayout();
   const floatingSidebarComposer = useAndroidFloatingTabs() && layout.usesSplitView;
@@ -881,6 +882,10 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
             paddingVertical: surfacePaddingVertical,
           }}
         >
+          <ComposerDictationError
+            error={voiceInput.state.phase === "error" ? voiceInput.state.error : null}
+            onDismiss={voiceInput.cancel}
+          />
           {isExpanded ? editingAttachments : null}
           <View
             onLayout={(event) => {
@@ -1145,7 +1150,6 @@ export const ThreadComposer = function ThreadComposer(props: ThreadComposerProps
                   elapsedSeconds={voiceInput.elapsedSeconds}
                   phase={voiceInput.state.phase}
                   presentation={voicePresentation}
-                  onDismissError={voiceInput.cancel}
                 />
                 <View className="shrink-0 flex-row items-center">
                   <ComposerDictationPrimaryAction
diff --git a/apps/mobile/src/features/voice-input/ComposerDictationControl.tsx b/apps/mobile/src/features/voice-input/ComposerDictationControl.tsx
index f38c4f05825a5..615914589e80e 100644
--- a/apps/mobile/src/features/voice-input/ComposerDictationControl.tsx
+++ b/apps/mobile/src/features/voice-input/ComposerDictationControl.tsx
@@ -319,12 +319,39 @@ function VoiceActionButton(props: {
   );
 }
 
+export function ComposerDictationError(props: {
+  readonly error: string | null;
+  readonly onDismiss: () => void;
+}) {
+  if (!props.error) return null;
+  return (
+    <View className="min-w-0 flex-row items-center gap-2 px-4 py-3">
+      <Text accessibilityRole="alert" className="min-w-0 flex-1 text-sm text-danger-foreground">
+        {props.error}
+      </Text>
+      <Pressable
+        accessibilityLabel="Dismiss voice input error"
+        accessibilityRole="button"
+        className="size-7 items-center justify-center active:opacity-70"
+        hitSlop={8}
+        onPress={props.onDismiss}
+      >
+        <SymbolView
+          name="xmark"
+          size={12}
+          tintColorClassName="accent-icon-muted"
+          type="monochrome"
+        />
+      </Pressable>
+    </View>
+  );
+}
+
 export function ComposerDictationStatus(props: {
   readonly audioLevels: SharedValue<ReadonlyArray<number>>;
   readonly elapsedSeconds: number;
   readonly phase: VoiceInputPhase;
   readonly presentation: VoiceComposerPresentation;
-  readonly onDismissError: () => void;
 }) {
   const recording = props.phase === "recording";
   const waveformStyle = useAnimatedStyle(() => ({
@@ -334,54 +361,28 @@ export function ComposerDictationStatus(props: {
     opacity: withTiming(recording ? 0 : 1, DICTATION_TIMING),
   }));
 
-  if (!props.presentation.statusLabel) return null;
-  const isError = props.presentation.statusKind === "error";
+  if (!props.presentation.statusLabel || props.presentation.statusKind === "error") return null;
   return (
     <View className="relative h-11 min-w-0 flex-1 justify-center">
-      {isError ? (
-        <View className="min-w-0 flex-row items-center gap-1.5 px-2">
-          <Text className="min-w-0 flex-1 text-sm text-danger-foreground" numberOfLines={2}>
+      <View
+        accessible
+        accessibilityLabel={props.presentation.statusLabel}
+        accessibilityLiveRegion={props.phase === "recording" ? "none" : "polite"}
+        className="h-11"
+      >
+        <Animated.View
+          className="absolute inset-0 min-w-0 flex-row items-center gap-2 px-1"
+          style={waveformStyle}
+        >
+          <VoiceWaveform audioLevels={props.audioLevels} />
+          <DictationElapsedTime className="text-foreground-muted" seconds={props.elapsedSeconds} />
+        </Animated.View>
+        <Animated.View className="absolute inset-0 justify-center px-2" style={labelStyle}>
+          <Text className="text-center text-sm text-foreground-muted" numberOfLines={1}>
             {props.presentation.statusLabel}
           </Text>
-          <Pressable
-            accessibilityLabel="Dismiss voice input error"
-            accessibilityRole="button"
-            className="size-7 items-center justify-center active:opacity-70"
-            hitSlop={8}
-            onPress={props.onDismissError}
-          >
-            <SymbolView
-              name="xmark"
-              size={12}
-              tintColorClassName="accent-icon-muted"
-              type="monochrome"
-            />
-          </Pressable>
-        </View>
-      ) : (
-        <View
-          accessible
-          accessibilityLabel={props.presentation.statusLabel}
-          accessibilityLiveRegion={props.phase === "recording" ? "none" : "polite"}
-          className="h-11"
-        >
-          <Animated.View
-            className="absolute inset-0 min-w-0 flex-row items-center gap-2 px-1"
-            style={waveformStyle}
-          >
-            <VoiceWaveform audioLevels={props.audioLevels} />
-            <DictationElapsedTime
-              className="text-foreground-muted"
-              seconds={props.elapsedSeconds}
-            />
-          </Animated.View>
-          <Animated.View className="absolute inset-0 justify-center px-2" style={labelStyle}>
-            <Text className="text-center text-sm text-foreground-muted" numberOfLines={1}>
-              {props.presentation.statusLabel}
-            </Text>
-          </Animated.View>
-        </View>
-      )}
+        </Animated.View>
+      </View>
     </View>
   );
 }
diff --git a/apps/mobile/src/features/voice-input/VoiceInputProvider.tsx b/apps/mobile/src/features/voice-input/VoiceInputProvider.tsx
index 809ee3a9d21b5..eab40efd4905b 100644
--- a/apps/mobile/src/features/voice-input/VoiceInputProvider.tsx
+++ b/apps/mobile/src/features/voice-input/VoiceInputProvider.tsx
@@ -1,18 +1,14 @@
 import { useAtomValue } from "@effect/atom-react";
-import {
-  AudioModule,
-  RecordingPresets,
-  requestRecordingPermissionsAsync,
-  type RecordingStatus,
-} from "expo-audio";
+import { AudioModule, RecordingPresets, type RecordingStatus } from "expo-audio";
 import { File } from "expo-file-system";
 import { activateKeepAwakeAsync, deactivateKeepAwake } from "expo-keep-awake";
 import { useSyncExternalStore } from "react";
-import { AppState, Platform } from "react-native";
+import { Platform } from "react-native";
 import { Atom, AsyncResult } from "effect/reactivity";
 import { makeMutable } from "react-native-reanimated";
 
 import {
+  type MicrophoneEntry,
   microphoneOrder,
   preferredMicrophoneInput,
   rememberMicrophones,
@@ -20,10 +16,15 @@ import {
 import { getLocalVoiceTranscriber } from "../../native/voiceTranscription";
 import { mobilePreferencesAtom, updateMobilePreferencesAtom } from "../../state/preferences";
 import { getNativeShowcaseScene } from "../showcase/nativeShowcaseScene";
-import { voiceInputBlocksSubmission } from "@t3tools/client-runtime/voice-input";
+import {
+  voiceInputBlocksSubmission,
+  type VoiceTranscriber,
+} from "@t3tools/client-runtime/voice-input";
 import { createLazyVoiceRecorder } from "./lazyVoiceRecorder";
 import { VOICE_WAVEFORM_SAMPLE_COUNT } from "./voiceInputMetering";
 import { VoiceInputSession } from "./voiceInputSession";
+import { createVoiceRecordingPermission } from "./voiceRecordingPermission";
+import { makePermissionStatusAtom } from "../../lib/permissionStatusAtom";
 import {
   acquireAudioSession,
   activateAudioSession,
@@ -49,6 +50,24 @@ function keepScreenAwake(tag: string): () => void {
   return () => void activation.then(() => deactivateKeepAwake(tag)).catch(() => {});
 }
 
+export const deviceMicrophoneOrder = (saved?: ReadonlyArray<MicrophoneEntry>) =>
+  microphoneOrder(saved, Platform.OS === "android" ? "android" : "ios");
+
+/** "checking" until the first availability probe settles; re-probed on foreground. */
+export const localVoiceTranscriberAtom = makePermissionStatusAtom<
+  VoiceTranscriber | null | "checking"
+>({
+  label: "mobile:voice-input:transcriber",
+  initial: "checking",
+  read: () => getLocalVoiceTranscriber().catch(() => null),
+}).pipe(Atom.keepAlive);
+
+// Each foreground re-probe yields a new transcriber; composers re-render only when availability flips.
+const localVoiceInputAvailableAtom = Atom.make((get) => {
+  const transcriber = get(localVoiceTranscriberAtom);
+  return transcriber !== null && transcriber !== "checking";
+});
+
 /**
  * The app has one microphone and one dictation at a time, so the session
  * lives for the registry's lifetime rather than any screen's.
@@ -58,11 +77,15 @@ const voiceInputAtom = Atom.make((get) => {
   // Mounted so the recorder can read and remember microphones synchronously.
   get.mount(mobilePreferencesAtom);
   get.mount(updateMobilePreferencesAtom);
+  get.mount(localVoiceTranscriberAtom);
   const audioLevels = makeMutable<ReadonlyArray<number>>(
     Array<number>(VOICE_WAVEFORM_SAMPLE_COUNT).fill(0),
   );
   let keepAwakeSequence = 0;
   let audioToken: ReturnType<typeof acquireAudioSession> | null = null;
+  const permission = createVoiceRecordingPermission(() => {
+    void session.controller.appMovedToBackground();
+  });
   const recorder = createLazyVoiceRecorder({
     create: () => new AudioModule.AudioRecorder(VOICE_RECORDING_OPTIONS),
     onStatus: (status: RecordingStatus) => {
@@ -77,12 +100,12 @@ const voiceInputAtom = Atom.make((get) => {
     selectInput: (inputs) => {
       const preferences = registry.get(mobilePreferencesAtom);
       if (!AsyncResult.isSuccess(preferences)) return null;
-      const known = microphoneOrder(preferences.value.microphones);
+      const known = deviceMicrophoneOrder(preferences.value.microphones);
       const order = rememberMicrophones(known, inputs);
       if (order !== known) {
         registry.set(updateMobilePreferencesAtom, {
           transform: (current) => ({
-            microphones: rememberMicrophones(microphoneOrder(current.microphones), inputs),
+            microphones: rememberMicrophones(deviceMicrophoneOrder(current.microphones), inputs),
           }),
         });
       }
@@ -91,11 +114,11 @@ const voiceInputAtom = Atom.make((get) => {
   });
   const session: VoiceInputSession = new VoiceInputSession({
     recorder,
-    getTranscriber: getLocalVoiceTranscriber,
-    requestPermission: async () => {
-      const permission = await requestRecordingPermissionsAsync();
-      return { granted: permission.granted, canAskAgain: permission.canAskAgain };
+    getTranscriber: () => {
+      const transcriber = registry.get(localVoiceTranscriberAtom);
+      return transcriber === "checking" ? null : transcriber;
     },
+    requestPermission: permission.requestPermission,
     configureRecording: async () => {
       const token = acquireAudioSession("recording");
       audioToken = token;
@@ -120,14 +143,8 @@ const voiceInputAtom = Atom.make((get) => {
     publishAudioLevels: (levels) => audioLevels.set(levels),
     keepAwake: () => keepScreenAwake(`voice-input:${++keepAwakeSequence}`),
   });
-  // iOS reports `inactive` while its permission dialog is open. Only the real
-  // background state cancels preparation; recorder status handles calls and
-  // route interruptions during capture.
-  const appStateSubscription = AppState.addEventListener("change", (nextState) => {
-    if (nextState === "background") void session.controller.appMovedToBackground();
-  });
   get.addFinalizer(() => {
-    appStateSubscription.remove();
+    permission.dispose();
     session.dispose();
     recorder.release();
   });
@@ -136,10 +153,11 @@ const voiceInputAtom = Atom.make((get) => {
 
 export function useGlobalVoiceInput() {
   const { session, audioLevels } = useAtomValue(voiceInputAtom);
+  const isTranscriberAvailable = useAtomValue(localVoiceInputAvailableAtom);
   const snapshot = useSyncExternalStore(session.subscribe, session.getSnapshot);
   return {
     ...snapshot,
-    isAvailable: getLocalVoiceTranscriber() !== null || getNativeShowcaseScene() !== null,
+    isAvailable: isTranscriberAvailable || getNativeShowcaseScene() !== null,
     audioLevels,
     isBusy: voiceInputBlocksSubmission(snapshot.state),
     session,
diff --git a/apps/mobile/src/features/voice-input/lazyVoiceRecorder.test.ts b/apps/mobile/src/features/voice-input/lazyVoiceRecorder.test.ts
index d3236bc7c992b..fbb6059099a8a 100644
--- a/apps/mobile/src/features/voice-input/lazyVoiceRecorder.test.ts
+++ b/apps/mobile/src/features/voice-input/lazyVoiceRecorder.test.ts
@@ -9,14 +9,20 @@ type State = { readonly isRecording: boolean };
 
 function createNativeRecorder(uri: string) {
   const listeners = new Set<(status: Status) => void>();
+  // Like expo-audio on Android, preparing again requires a stop in between.
+  let isPrepared = false;
   return {
     uri: null as string | null,
     prepared: uri,
     prepareToRecordAsync: vi.fn(async function (this: { uri: string | null; prepared: string }) {
+      if (isPrepared) throw new Error("Recorder is already prepared");
+      isPrepared = true;
       this.uri = this.prepared;
     }),
     record: vi.fn(),
-    stop: vi.fn(async (): Promise<void> => undefined),
+    stop: vi.fn(async (): Promise<void> => {
+      isPrepared = false;
+    }),
     getStatus: vi.fn((): State => ({ isRecording: true })),
     addListener: vi.fn((_event: "recordingStatusUpdate", listener: (status: Status) => void) => {
       listeners.add(listener);
@@ -26,7 +32,8 @@ function createNativeRecorder(uri: string) {
       { uid: "car", name: "CarPlay", type: "CarAudio" },
       { uid: "built-in", name: "iPhone Microphone", type: "MicrophoneBuiltIn" },
     ]),
-    setInput: vi.fn((_uid: string) => undefined),
+    setInput: vi.fn((_uid: string): void | Promise<void> => undefined),
+    cancelInputSelection: vi.fn((): void => undefined),
     release: vi.fn(),
     emit: (status: Status) => listeners.forEach((listener) => listener(status)),
   };
@@ -34,12 +41,14 @@ function createNativeRecorder(uri: string) {
 
 function createHarness(
   selectInput?: (inputs: ReadonlyArray<VoiceRecordingInput>) => VoiceRecordingInput | null,
+  configure?: (native: ReturnType<typeof createNativeRecorder>) => void,
 ) {
   const created: Array<ReturnType<typeof createNativeRecorder>> = [];
   const statuses: Status[] = [];
   const recorder = createLazyVoiceRecorder({
     create: () => {
       const native = createNativeRecorder(`file:///voice-${created.length}.m4a`);
+      configure?.(native);
       created.push(native);
       return native;
     },
@@ -57,10 +66,21 @@ describe("createLazyVoiceRecorder", () => {
 
     const disconnected = createHarness((inputs) => inputs[1] ?? null);
     await disconnected.recorder.prepareToRecordAsync();
+    await disconnected.recorder.stop();
     disconnected.created[0]!.setInput.mockImplementationOnce(() => {
       throw new Error("Preferred input not found");
     });
     await expect(disconnected.recorder.prepareToRecordAsync()).resolves.toBeUndefined();
+
+    const timedOut = createHarness(
+      (inputs) => inputs[1] ?? null,
+      (native) => {
+        native.setInput.mockImplementationOnce(() =>
+          Promise.reject(new Error("Routing timed out")),
+        );
+      },
+    );
+    await expect(timedOut.recorder.prepareToRecordAsync()).resolves.toBeUndefined();
   });
 
   it("forwards status events until the recorder is released", async () => {
@@ -76,8 +96,12 @@ describe("createLazyVoiceRecorder", () => {
   });
 
   describe("with the voice input controller", () => {
-    function createController(granted: boolean) {
-      const harness = createHarness();
+    function createController(
+      granted: boolean,
+      selectInput?: (inputs: ReadonlyArray<VoiceRecordingInput>) => VoiceRecordingInput | null,
+      configure?: (native: ReturnType<typeof createNativeRecorder>) => void,
+    ) {
+      const harness = createHarness(selectInput, configure);
       const deleted: string[] = [];
       const controller = new VoiceInputController({
         recorder: harness.recorder,
@@ -108,5 +132,29 @@ describe("createLazyVoiceRecorder", () => {
       expect(controller.currentState.phase).toBe("error");
       expect(created).toHaveLength(0);
     });
+
+    it("abandons a pending input route when dictation is canceled", async () => {
+      const routing = Promise.withResolvers<void>();
+      const { controller, created } = createController(
+        true,
+        (inputs) => inputs[1] ?? null,
+        (native) => {
+          // Expo drops the promise of a canceled coroutine function, so it never settles.
+          native.setInput.mockImplementationOnce(() => {
+            routing.resolve();
+            return new Promise(() => undefined);
+          });
+        },
+      );
+      const starting = controller.start();
+      await routing.promise;
+      controller.cancel();
+      await starting;
+      expect(created[0]!.cancelInputSelection).toHaveBeenCalled();
+      expect(controller.currentState.phase).toBe("idle");
+
+      await controller.start();
+      expect(controller.currentState.phase).toBe("recording");
+    });
   });
 });
diff --git a/apps/mobile/src/features/voice-input/lazyVoiceRecorder.ts b/apps/mobile/src/features/voice-input/lazyVoiceRecorder.ts
index eceb06bab8c64..6100a869fa441 100644
--- a/apps/mobile/src/features/voice-input/lazyVoiceRecorder.ts
+++ b/apps/mobile/src/features/voice-input/lazyVoiceRecorder.ts
@@ -1,4 +1,7 @@
-import type { VoiceRecorder } from "@t3tools/client-runtime/voice-input";
+import {
+  throwIfVoiceTranscriptionAborted,
+  type VoiceRecorder,
+} from "@t3tools/client-runtime/voice-input";
 
 type Subscription = { remove(): void };
 
@@ -19,7 +22,8 @@ export interface NativeVoiceRecorder<TStatus, TRecorderState> {
     listener: (status: TStatus) => void,
   ): Subscription;
   getAvailableInputs(): ReadonlyArray<VoiceRecordingInput>;
-  setInput(uid: string): void;
+  setInput(uid: string): void | Promise<void>;
+  cancelInputSelection?(): void;
   release(): void;
 }
 
@@ -39,6 +43,7 @@ export function createLazyVoiceRecorder<TStatus, TRecorderState>(input: {
   let retired: NativeVoiceRecorder<TStatus, TRecorderState> | null = null;
   let retiredUri: string | null = null;
   let pending: Promise<unknown> = Promise.resolve();
+  let abandonInputSelection: (() => void) | null = null;
 
   const track = <T>(promise: Promise<T>): Promise<T> => {
     pending = Promise.allSettled([pending, promise]).then(() => undefined);
@@ -50,19 +55,42 @@ export function createLazyVoiceRecorder<TStatus, TRecorderState>(input: {
       if (recorder) return recorder.uri;
       return retired ? retired.uri : retiredUri;
     },
-    prepareToRecordAsync() {
+    prepareToRecordAsync(signal) {
       if (!recorder) {
         recorder = input.create();
         subscription = recorder.addListener("recordingStatusUpdate", input.onStatus);
       }
       const prepared = recorder;
       return track(
-        prepared.prepareToRecordAsync().then(() => {
+        prepared.prepareToRecordAsync().then(async () => {
+          if (signal) throwIfVoiceTranscriptionAborted(signal);
           if (!input.selectInput) return;
+          let selected: VoiceRecordingInput | null;
           try {
-            const selected = input.selectInput(prepared.getAvailableInputs());
-            if (selected) prepared.setInput(selected.uid);
-          } catch {}
+            selected = input.selectInput(prepared.getAvailableInputs());
+          } catch {
+            return;
+          }
+          if (!selected) return;
+          const uid = selected.uid;
+          // Expo never settles a canceled coroutine function's promise, so stop waiting on abort.
+          const abandoned = Promise.withResolvers<void>();
+          const abandon = () => {
+            prepared.cancelInputSelection?.();
+            abandoned.resolve();
+          };
+          signal?.addEventListener("abort", abandon, { once: true });
+          abandonInputSelection = abandon;
+          try {
+            await Promise.race([
+              new Promise<void>((resolve) => resolve(prepared.setInput(uid))).catch(() => {}),
+              abandoned.promise,
+            ]);
+            if (signal) throwIfVoiceTranscriptionAborted(signal);
+          } finally {
+            signal?.removeEventListener("abort", abandon);
+            if (abandonInputSelection === abandon) abandonInputSelection = null;
+          }
         }),
       );
     },
@@ -79,6 +107,7 @@ export function createLazyVoiceRecorder<TStatus, TRecorderState>(input: {
     release() {
       const released = recorder;
       if (!released) return;
+      abandonInputSelection?.();
       recorder = null;
       subscription?.remove();
       subscription = null;
diff --git a/apps/mobile/src/features/voice-input/voiceRecordingPermission.test.ts b/apps/mobile/src/features/voice-input/voiceRecordingPermission.test.ts
new file mode 100644
index 0000000000000..ccb108811f78a
--- /dev/null
+++ b/apps/mobile/src/features/voice-input/voiceRecordingPermission.test.ts
@@ -0,0 +1,52 @@
+import { expect, it, vi } from "vite-plus/test";
+
+const mocks = vi.hoisted(() => ({
+  state: "active",
+  listeners: new Set<(state: string) => void>(),
+  request: vi.fn<() => Promise<{ granted: boolean; canAskAgain: boolean }>>(),
+}));
+
+vi.mock("expo-audio", () => ({ requestRecordingPermissionsAsync: mocks.request }));
+vi.mock("react-native", () => ({
+  Platform: { OS: "android" },
+  AppState: {
+    get currentState() {
+      return mocks.state;
+    },
+    addEventListener: (_event: string, listener: (state: string) => void) => {
+      mocks.listeners.add(listener);
+      return { remove: () => mocks.listeners.delete(listener) };
+    },
+  },
+}));
+
+import { createVoiceRecordingPermission } from "./voiceRecordingPermission";
+
+function changeAppState(state: string) {
+  mocks.state = state;
+  mocks.listeners.forEach((listener) => listener(state));
+}
+
+it("keeps dictation alive while Android's permission activity backgrounds the app", async () => {
+  const permission = Promise.withResolvers<{ granted: boolean; canAskAgain: boolean }>();
+  mocks.request.mockReturnValue(permission.promise);
+  const interrupted = vi.fn();
+  const recording = createVoiceRecordingPermission(interrupted);
+  let settled = false;
+  const result = recording.requestPermission().then((value) => {
+    settled = true;
+    return value;
+  });
+
+  changeAppState("background");
+  permission.resolve({ granted: true, canAskAgain: true });
+  await Promise.resolve();
+  expect(settled).toBe(false);
+  changeAppState("active");
+  expect(await result).toMatchObject({ granted: true });
+  expect(interrupted).not.toHaveBeenCalled();
+
+  changeAppState("background");
+  expect(interrupted).toHaveBeenCalledOnce();
+  recording.dispose();
+});
diff --git a/apps/mobile/src/features/voice-input/voiceRecordingPermission.ts b/apps/mobile/src/features/voice-input/voiceRecordingPermission.ts
new file mode 100644
index 0000000000000..21ff1df02dd7e
--- /dev/null
+++ b/apps/mobile/src/features/voice-input/voiceRecordingPermission.ts
@@ -0,0 +1,36 @@
+import { requestRecordingPermissionsAsync } from "expo-audio";
+import { AppState, Platform } from "react-native";
+
+export function createVoiceRecordingPermission(onBackground: () => void) {
+  let requesting = false;
+  let disposed = false;
+  let resume: (() => void) | null = null;
+  const subscription = AppState.addEventListener("change", (state) => {
+    if (state === "active") resume?.();
+    if (state === "background" && !requesting) onBackground();
+  });
+  return {
+    requestPermission: async () => {
+      if (Platform.OS !== "android") return requestRecordingPermissionsAsync();
+      // Android's permission activity backgrounds the app; resume before preparing Google's model.
+      requesting = true;
+      try {
+        const permission = await requestRecordingPermissionsAsync();
+        if (!disposed && AppState.currentState !== "active") {
+          await new Promise<void>((resolve) => {
+            resume = resolve;
+          });
+        }
+        return permission;
+      } finally {
+        requesting = false;
+        resume = null;
+      }
+    },
+    dispose: () => {
+      disposed = true;
+      subscription.remove();
+      resume?.();
+    },
+  };
+}
diff --git a/apps/mobile/src/lib/microphonePriority.test.ts b/apps/mobile/src/lib/microphonePriority.test.ts
index fff3659057f69..d25ec96e7ba17 100644
--- a/apps/mobile/src/lib/microphonePriority.test.ts
+++ b/apps/mobile/src/lib/microphonePriority.test.ts
@@ -31,6 +31,12 @@ describe("microphoneOrder", () => {
       "kind:bluetooth",
       "kind:carPlay",
     ]);
+    expect(keys(microphoneOrder([{ kind: "carPlay" }, ...saved], "android"))).toEqual([
+      "kind:wired",
+      "kind:builtIn",
+      "airpods",
+      "kind:bluetooth",
+    ]);
   });
 });
 
@@ -75,5 +81,9 @@ describe("preferredMicrophoneInput", () => {
     expect(preferredMicrophoneInput([airPods, usb], order)).toBe(usb);
     expect(preferredMicrophoneInput([airPods, carPlay], order)).toBe(airPods);
     expect(preferredMicrophoneInput([airPods, iPhone], order)).toBe(iPhone);
+    const headset = { uid: "android:7:headset", name: "Headset", type: "BluetoothSCO" };
+    expect(preferredMicrophoneInput([headset, iPhone], microphoneOrder([], "android"))).toBe(
+      headset,
+    );
   });
 });
diff --git a/apps/mobile/src/lib/microphonePriority.ts b/apps/mobile/src/lib/microphonePriority.ts
index e505837fef313..fbe928f081ab2 100644
--- a/apps/mobile/src/lib/microphonePriority.ts
+++ b/apps/mobile/src/lib/microphonePriority.ts
@@ -1,11 +1,9 @@
-/** iOS lists connected inputs only after recording-session setup. */
 const MICROPHONE_KINDS = ["wired", "bluetooth", "builtIn", "carPlay"] as const;
 
 export type MicrophoneKind = (typeof MICROPHONE_KINDS)[number];
 
 export interface MicrophoneDevice {
   readonly kind: MicrophoneKind;
-  /** iOS's port identifier, stable across reconnects of the same device. */
   readonly uid: string;
   readonly name: string;
 }
@@ -18,12 +16,13 @@ interface MicrophoneInput {
   readonly type: string;
 }
 
-// A car without CarPlay connects as a Bluetooth headset, so it is a Bluetooth device.
+// A car without CarPlay, and Android Auto, routes its microphone over Bluetooth, so it is a Bluetooth device.
 const KIND_BY_PORT_TYPE: Readonly<Record<string, MicrophoneKind>> = {
   MicrophoneWired: "wired",
   USBAudio: "wired",
   LineIn: "wired",
   BluetoothHFP: "bluetooth",
+  BluetoothSCO: "bluetooth",
   BluetoothLE: "bluetooth",
   MicrophoneBuiltIn: "builtIn",
   CarAudio: "carPlay",
@@ -47,10 +46,13 @@ export function microphoneEntryKey(entry: MicrophoneEntry): string {
 
 export function microphoneOrder(
   saved: ReadonlyArray<MicrophoneEntry> = [],
+  platform: "ios" | "android" = "ios",
 ): ReadonlyArray<MicrophoneEntry> {
+  const kinds = MICROPHONE_KINDS.filter((kind) => platform === "ios" || kind !== "carPlay");
   const order: MicrophoneEntry[] = [];
   const keys = new Set<string>();
   for (const entry of saved) {
+    if (!kinds.includes(entry.kind)) continue;
     const row =
       isMicrophoneDevice(entry) && DEVICE_KINDS.has(entry.kind) ? entry : { kind: entry.kind };
     const key = microphoneEntryKey(row);
@@ -58,7 +60,7 @@ export function microphoneOrder(
     keys.add(key);
     order.push(row);
   }
-  for (const kind of MICROPHONE_KINDS) {
+  for (const kind of kinds) {
     if (keys.has(`kind:${kind}`)) continue;
     const lastDevice = order.map((entry) => entry.kind).lastIndexOf(kind);
     const below = order.findIndex(
@@ -95,7 +97,7 @@ export function rememberMicrophones(
   return next ?? order;
 }
 
-/** The connected input of the first entry that has one, or null to leave the route to iOS. */
+/** The connected input of the first entry that has one, or null for the system default. */
 export function preferredMicrophoneInput<Input extends MicrophoneInput>(
   inputs: ReadonlyArray<Input>,
   order: ReadonlyArray<MicrophoneEntry>,
diff --git a/apps/mobile/src/lib/permissionStatusAtom.test.ts b/apps/mobile/src/lib/permissionStatusAtom.test.ts
index 052b2a37cb0f9..ec3330c8f54aa 100644
--- a/apps/mobile/src/lib/permissionStatusAtom.test.ts
+++ b/apps/mobile/src/lib/permissionStatusAtom.test.ts
@@ -26,6 +26,10 @@ function deferredReads() {
       pending.shift()?.(status);
       await Promise.resolve();
     },
+    resolveLast: async (status: string) => {
+      pending.pop()?.(status);
+      await Promise.resolve();
+    },
     get count() {
       return pending.length;
     },
@@ -68,6 +72,21 @@ describe("makePermissionStatusAtom", () => {
     expect(native.listeners.size).toBe(0);
   });
 
+  it("keeps the newest read when an older one settles last", async () => {
+    const reads = deferredReads();
+    const atom = makePermissionStatusAtom({ label: "test", initial: "checking", read: reads.read });
+    const { registry, flush } = makeRegistry();
+    const unmount = registry.mount(atom);
+
+    for (const listener of native.listeners) listener("active");
+    await reads.resolveLast("available");
+    await reads.resolveNext("unavailable");
+    expect(registry.get(atom)).toBe("available");
+
+    unmount();
+    flush();
+  });
+
   it("stores a request's outcome", () => {
     const reads = deferredReads();
     const atom = makePermissionStatusAtom({ label: "test", initial: "checking", read: reads.read });
diff --git a/apps/mobile/src/lib/permissionStatusAtom.ts b/apps/mobile/src/lib/permissionStatusAtom.ts
index ee8ff5dcdfecc..0aaded10957f7 100644
--- a/apps/mobile/src/lib/permissionStatusAtom.ts
+++ b/apps/mobile/src/lib/permissionStatusAtom.ts
@@ -3,9 +3,9 @@ import { Atom } from "effect/reactivity";
 import { subscribeAppActive } from "./appState";
 
 /**
- * A system permission as the app last saw it. Reads it when first mounted and
- * again each time the app returns to the foreground, where the user may have
- * changed it in system Settings. Writing stores the outcome of a request.
+ * A system permission or device capability as the app last saw it. Reads it
+ * when first mounted and again each time the app returns to the foreground,
+ * where the user may have changed it in system Settings. Writing stores the outcome of a request.
  */
 export function makePermissionStatusAtom<S>(options: {
   readonly label: string;
@@ -15,8 +15,13 @@ export function makePermissionStatusAtom<S>(options: {
   return Atom.writable(
     (get) => {
       // A read that settles after unmount is dropped: setSelf on a disposed lifetime is a no-op.
+      // Only the latest read lands, so a slow earlier read cannot overwrite a newer status.
+      let latest = 0;
       const refresh = () => {
-        void options.read().then((status) => get.setSelf(status));
+        const read = ++latest;
+        void options.read().then((status) => {
+          if (read === latest) get.setSelf(status);
+        });
       };
       refresh();
       get.addFinalizer(subscribeAppActive(refresh));
diff --git a/apps/mobile/src/native/voiceTranscription.android.test.ts b/apps/mobile/src/native/voiceTranscription.android.test.ts
new file mode 100644
index 0000000000000..7a2e39e4304e8
--- /dev/null
+++ b/apps/mobile/src/native/voiceTranscription.android.test.ts
@@ -0,0 +1,84 @@
+import { expect, it, vi } from "vite-plus/test";
+
+const mocks = vi.hoisted(() => ({
+  checkAvailability: vi.fn<() => Promise<boolean>>(),
+  prepare: vi.fn<(id: number) => Promise<{ locale: string; mode: number }>>(),
+  transcribe: vi.fn<(id: number, uri: string, locale: string, mode: number) => Promise<string>>(),
+  cancel: vi.fn<(id: number) => Promise<void>>(),
+}));
+
+vi.mock("expo", () => ({
+  requireOptionalNativeModule: () => ({ isAvailable: () => true, ...mocks }),
+}));
+
+import {
+  VoiceInputController,
+  resetVoiceInputGlobalsForTests,
+} from "../../../../packages/client-runtime/src/voice-input/controller";
+
+import { getLocalVoiceTranscriber } from "./voiceTranscription.android";
+
+it.each([false, true])(
+  "waits for device support before offering a transcriber (%s)",
+  async (supported) => {
+    vi.resetAllMocks();
+    const probe = Promise.withResolvers<boolean>();
+    mocks.checkAvailability.mockReturnValue(probe.promise);
+    let settled = false;
+    const result = Promise.resolve(getLocalVoiceTranscriber()).then((transcriber) => {
+      settled = true;
+      return transcriber;
+    });
+    await Promise.resolve();
+    expect(settled).toBe(false);
+    probe.resolve(supported);
+    expect((await result) !== null).toBe(supported);
+  },
+);
+
+it.each([
+  ["preparation", "storage", /disk|storage|space/i],
+  ["preparation", "quota", /quota|limit/i],
+  ["transcription", "storage", /disk|storage|space/i],
+  ["transcription", "quota", /quota|limit/i],
+] as const)("preserves an actionable %s error: %s", async (phase, code, expected) => {
+  vi.resetAllMocks();
+  resetVoiceInputGlobalsForTests();
+  mocks.checkAvailability.mockResolvedValue(true);
+  mocks.prepare.mockResolvedValue({ locale: "en-US", mode: 0 });
+  mocks.transcribe.mockResolvedValue("Complete transcript.");
+  mocks.cancel.mockResolvedValue(undefined);
+  const rejection = Object.assign(new Error("Native SDK failure"), { code });
+  (phase === "preparation" ? mocks.prepare : mocks.transcribe).mockRejectedValue(rejection);
+  const transcriber = await getLocalVoiceTranscriber();
+  const commit = vi.fn();
+  const draft = {
+    ownerKey: "acceptance:dictation",
+    text: "Preserved draft.",
+    selection: { start: 16, end: 16 },
+    revision: 1,
+  };
+  const controller = new VoiceInputController({
+    recorder: {
+      uri: "file:///acceptance.m4a",
+      prepareToRecordAsync: async () => {},
+      record: () => {},
+      stop: async () => {},
+    },
+    getTranscriber: () => transcriber,
+    requestPermission: async () => ({ granted: true, canAskAgain: true }),
+    configureRecording: async () => {},
+    releaseRecording: async () => {},
+    deleteRecording: () => {},
+    readDraft: () => draft,
+    commitDraft: commit,
+    onStateChange: () => {},
+  });
+  await controller.start();
+  if (phase === "transcription") await controller.stop();
+
+  expect(controller.currentState).toMatchObject({ phase: "error", errorAction: "retry" });
+  expect(commit).not.toHaveBeenCalled();
+  expect(draft.text).toBe("Preserved draft.");
+  expect(controller.currentState.error).toMatch(expected);
+});
diff --git a/apps/mobile/src/native/voiceTranscription.android.ts b/apps/mobile/src/native/voiceTranscription.android.ts
new file mode 100644
index 0000000000000..13e233d0cccfa
--- /dev/null
+++ b/apps/mobile/src/native/voiceTranscription.android.ts
@@ -0,0 +1,88 @@
+import { requireOptionalNativeModule } from "expo";
+
+import {
+  VoiceTranscriptionError,
+  throwIfVoiceTranscriptionAborted,
+  type VoiceTranscriber,
+} from "@t3tools/client-runtime/voice-input";
+
+type PreparedGoogleTranscription = { readonly locale: string; readonly mode: number };
+
+type GoogleTranscriptionModule = {
+  checkAvailability(): Promise<boolean>;
+  prepare(id: number): Promise<PreparedGoogleTranscription>;
+  transcribe(id: number, uri: string, locale: string, mode: number): Promise<string>;
+  cancel(id: number): Promise<void>;
+};
+
+const native = requireOptionalNativeModule<GoogleTranscriptionModule>("T3VoiceTranscription");
+
+const nativeErrorMessages: Readonly<Record<string, string>> = {
+  unavailable: "On-device voice transcription is not available for this device language.",
+  storage: "Not enough storage for on-device dictation. Free device storage and retry.",
+  quota: "On-device speech quota reached. Let the device rest or charge it, then retry.",
+  "no-speech": "No speech was detected. Speak again and retry dictation.",
+  busy: "On-device speech is busy. Wait for it to finish, then retry dictation.",
+  "needs-update": "Update Android and its on-device speech services, then retry dictation.",
+  "download-failed": "Speech model download failed. Check your network connection and retry.",
+  "audio-overflow":
+    "The speech engine could not process the complete recording. No text was added. Retry dictation.",
+  "incomplete-audio":
+    "Speech recognition could not process the complete recording. No text was added. Retry dictation.",
+};
+
+let nextOperationId = 0;
+
+export async function getLocalVoiceTranscriber(): Promise<VoiceTranscriber | null> {
+  if (!native || !(await native.checkAvailability())) return null;
+  const module = native;
+  return {
+    prepare: async ({ signal }) => {
+      const prepared = await runOperation(module, signal, "preparation-failed", (id) =>
+        module.prepare(id),
+      );
+      return {
+        locale: prepared.locale,
+        transcribe: (uri, { signal }) =>
+          runOperation(module, signal, "transcription-failed", (id) =>
+            module.transcribe(id, uri, prepared.locale, prepared.mode),
+          ),
+      };
+    },
+  };
+}
+
+async function runOperation<T>(
+  module: GoogleTranscriptionModule,
+  signal: AbortSignal,
+  fallbackCode: "preparation-failed" | "transcription-failed",
+  operation: (id: number) => Promise<T>,
+): Promise<T> {
+  throwIfVoiceTranscriptionAborted(signal);
+  const id = ++nextOperationId;
+  let cancellation: Promise<void> | undefined;
+  const abort = () => {
+    cancellation = module.cancel(id).catch(() => {});
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  try {
+    const result = await operation(id);
+    throwIfVoiceTranscriptionAborted(signal);
+    return result;
+  } catch (error) {
+    throwIfVoiceTranscriptionAborted(signal);
+    const code =
+      typeof error === "object" && error !== null && "code" in error ? error.code : undefined;
+    throw new VoiceTranscriptionError(
+      code === "unavailable" || code === "unsupported-locale" ? code : fallbackCode,
+      (typeof code === "string" ? nativeErrorMessages[code] : undefined) ??
+        (fallbackCode === "preparation-failed"
+          ? "Voice transcription could not prepare this language. Check Google speech services and try again."
+          : "Voice transcription failed."),
+      { cause: error },
+    );
+  } finally {
+    signal.removeEventListener("abort", abort);
+    await cancellation;
+  }
+}
diff --git a/apps/mobile/src/native/voiceTranscription.ios.test.ts b/apps/mobile/src/native/voiceTranscription.ios.test.ts
index d3ee19c262de6..d83c371bc2a90 100644
--- a/apps/mobile/src/native/voiceTranscription.ios.test.ts
+++ b/apps/mobile/src/native/voiceTranscription.ios.test.ts
@@ -65,7 +65,7 @@ describe("getLocalVoiceTranscriber", () => {
     });
     const controller = new AbortController();
     const options = { signal: controller.signal };
-    const prepared = await getLocalVoiceTranscriber()!.prepare(options);
+    const prepared = await (await getLocalVoiceTranscriber())!.prepare(options);
     const result = prepared
       .transcribe("file:///voice.m4a", options)
       .catch((error: unknown) => error);
diff --git a/apps/mobile/src/native/voiceTranscription.ios.ts b/apps/mobile/src/native/voiceTranscription.ios.ts
index 216b9e958dd66..9f9556645101d 100644
--- a/apps/mobile/src/native/voiceTranscription.ios.ts
+++ b/apps/mobile/src/native/voiceTranscription.ios.ts
@@ -33,7 +33,7 @@ function getNativeErrorCode(error: unknown): string | undefined {
   return typeof error.code === "string" ? error.code : undefined;
 }
 
-export function getLocalVoiceTranscriber(): VoiceTranscriber | null {
+export async function getLocalVoiceTranscriber(): Promise<VoiceTranscriber | null> {
   const locale = getDeviceLocale();
   if (!AppleTranscription.isAvailable(locale)) return null;
   return { prepare: (options) => prepareVoiceTranscription(locale, options) };
diff --git a/apps/mobile/src/native/voiceTranscription.ts b/apps/mobile/src/native/voiceTranscription.ts
index e003064ae3f84..496a862836a19 100644
--- a/apps/mobile/src/native/voiceTranscription.ts
+++ b/apps/mobile/src/native/voiceTranscription.ts
@@ -1,5 +1,5 @@
 import type { VoiceTranscriber } from "@t3tools/client-runtime/voice-input";
 
-export function getLocalVoiceTranscriber(): VoiceTranscriber | null {
+export async function getLocalVoiceTranscriber(): Promise<VoiceTranscriber | null> {
   return null;
 }
diff --git a/docs/user/composer.md b/docs/user/composer.md
index a3e06c9aed6f7..0008e15fce27a 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -177,28 +177,36 @@ Stashes containing uploaded files must be restored in their original environment
 Those files are retained for 24 hours. After an upload expires, restore the prompt
 and use **Attach again** or remove the missing file before sending.
 
-## Voice input on iPhone
-
-On supported iPhones with iOS 26 or later, use the composer's microphone to record,
-then confirm to transcribe. Text is inserted where your selection was when
-recording started, ready for you to review and edit before sending.
-
-Voice input depends on Apple's on-device speech transcription. On a device without
-it, the composer has no microphone button and **Settings → Microphone** says voice
-input isn't available.
-
-The first use may download Apple's speech model and needs a network connection.
-Later transcription works offline for that language. Recordings can be up to five
-minutes long. Canceling, leaving the screen, or an audio interruption discards the
-recording and preserves your existing draft. While recording, the screen stays
+## Voice input on mobile
+
+On supported iPhones with iOS 26 or later and Android devices with Android 12 or
+later, use the composer's microphone to record, then confirm to transcribe. Text is
+inserted where your selection was when recording started, ready for you to review
+and edit before sending.
+
+Voice input uses on-device speech transcription: Apple's on iOS, and compatible
+Google speech services on Android. When it is unavailable for the device or its
+language, the composer has no microphone button and **Settings → Microphone** says
+voice input isn't available. On Android, keep T3 Code open while recording and
+transcribing.
+
+The first use may download a speech model and needs a network connection.
+Later transcription works offline for that language. On Android, transcription
+processes the full recording at roughly its original duration. Recordings can be up to five
+minutes long. Canceling or an audio interruption discards the recording and
+preserves your existing draft. Navigating to another screen keeps dictation active;
+use the floating controls to finish or cancel. While recording, the screen stays
 awake; it can sleep normally once recording stops.
 
-Voice input records from the first connected microphone in **Settings → Microphone**.
-The list mixes kinds (built-in, other wired, other Bluetooth, CarPlay) with wired and
-Bluetooth devices you have dictated with, listed by name. Drag to rank them together:
+Choose a preferred order in **Settings → Microphone**. Voice input requests the first
+connected microphone in the list. The list mixes kinds (built-in, other wired, other
+Bluetooth, and CarPlay on iOS) with wired and Bluetooth devices you have dictated
+with, listed by name. Drag to rank them together:
 for example, put **Other Bluetooth** above your AirPods so a new headset is preferred
 while the AirPods microphone stays low. By default, CarPlay comes after the built-in
-microphone. Swipe a device left to forget it.
+microphone on iOS. Swipe a device left to forget it. Android may use another input
+when the preferred microphone cannot be routed. Devices with the same name may share
+a saved preference, but simultaneous same-name inputs remain separately selectable.
 
 Transcription runs on your device. T3 Code deletes the temporary audio after
 transcription or cancellation; only the message text is sent when you submit.
diff --git a/packages/client-runtime/src/voice-input/controller.test.ts b/packages/client-runtime/src/voice-input/controller.test.ts
index d433748e5bdbb..4b7f9a9c3d40d 100644
--- a/packages/client-runtime/src/voice-input/controller.test.ts
+++ b/packages/client-runtime/src/voice-input/controller.test.ts
@@ -9,7 +9,11 @@ import {
   type VoiceInputControllerDependencies,
   type VoiceRecorder,
 } from "./controller.ts";
-import type { PreparedVoiceTranscription, VoiceTranscriber } from "./transcription.ts";
+import {
+  VoiceTranscriptionError,
+  type PreparedVoiceTranscription,
+  type VoiceTranscriber,
+} from "./transcription.ts";
 
 function deferred<T>() {
   let resolve!: (value: T) => void;
@@ -116,6 +120,21 @@ describe("VoiceInputController", () => {
     expect(unsupported.controller.currentState.error).toContain("not available");
     expect(unsupported.recorder.record).not.toHaveBeenCalled();
 
+    const reason = new VoiceTranscriptionError(
+      "unavailable",
+      "This device requires iOS 26 or later.",
+    );
+    const unavailable = createHarness({
+      getTranscriber: () => ({
+        prepare: async () => {
+          throw reason;
+        },
+      }),
+    });
+    await unavailable.controller.start();
+    expect(unavailable.controller.currentState.error).toBe(reason.message);
+    expect(unavailable.recorder.record).not.toHaveBeenCalled();
+
     const denied = createHarness({
       requestPermission: async () => ({ granted: false, canAskAgain: false }),
     });
diff --git a/packages/client-runtime/src/voice-input/controller.ts b/packages/client-runtime/src/voice-input/controller.ts
index b9d0f54f67672..41576db90cf8e 100644
--- a/packages/client-runtime/src/voice-input/controller.ts
+++ b/packages/client-runtime/src/voice-input/controller.ts
@@ -1,6 +1,10 @@
 import { replaceTextRange } from "@t3tools/shared/composerTrigger";
 
-import type { PreparedVoiceTranscription, VoiceTranscriber } from "./transcription.ts";
+import {
+  VoiceTranscriptionError,
+  type PreparedVoiceTranscription,
+  type VoiceTranscriber,
+} from "./transcription.ts";
 
 export const VOICE_RECORDING_LIMIT_SECONDS = 5 * 60;
 
@@ -34,7 +38,7 @@ export type VoiceRecorderStatus = {
 
 export interface VoiceRecorder {
   readonly uri: string | null;
-  prepareToRecordAsync(): Promise<void>;
+  prepareToRecordAsync(signal?: AbortSignal): Promise<void>;
   record(options: { readonly forDuration: number }): void;
   stop(): Promise<void>;
 }
@@ -167,14 +171,18 @@ function preparationErrorMessage(error: unknown): string {
   if (errorCode(error) === "unsupported-locale") {
     return "Voice transcription is not available for this language.";
   }
-  return "Could not prepare voice transcription.";
+  return error instanceof VoiceTranscriptionError
+    ? error.message
+    : "Could not prepare voice transcription.";
 }
 
 function transcriptionErrorMessage(error: unknown): string {
   if (error instanceof Error && error.message === "voice-operation-busy") {
     return "Voice transcription is still finishing. Try again shortly.";
   }
-  return "Could not transcribe this recording.";
+  return error instanceof VoiceTranscriptionError
+    ? error.message
+    : "Could not transcribe this recording.";
 }
 
 const IDLE_STATE: VoiceInputState = { phase: "idle", error: null, errorAction: null };
@@ -258,7 +266,7 @@ export class VoiceInputController {
       await this.dependencies.configureRecording();
       this.recordingConfigured = true;
       if (!this.isCurrent(operationToken)) return;
-      await this.dependencies.recorder.prepareToRecordAsync();
+      await this.dependencies.recorder.prepareToRecordAsync(abortController.signal);
       if (!this.isCurrent(operationToken)) return;
       this.recordingUri = this.dependencies.recorder.uri;
       this.rememberRecordingUri(this.recordingUri);
@@ -441,12 +449,7 @@ export class VoiceInputController {
         ? { phase: "error", error, errorAction: "retry" }
         : { phase: "idle", error: null, errorAction: null },
     );
-    try {
-      await this.dependencies.recorder.stop();
-    } catch {
-    } finally {
-      await this.releaseResources();
-    }
+    await this.releaseResources();
   }
 
   private async releaseResources(): Promise<void> {
@@ -454,6 +457,11 @@ export class VoiceInputController {
     try {
       this.rememberRecordingUri(this.dependencies.recorder.uri);
     } catch {}
+    if (this.recordingConfigured) {
+      try {
+        await this.dependencies.recorder.stop();
+      } catch {}
+    }
     this.recordingUri = null;
     for (const uri of this.ownedRecordingUris) {
       try {
diff --git a/patches/expo-audio@58.0.9.patch b/patches/expo-audio@58.0.9.patch
index 8a644111bce49..8249a399b3bad 100644
--- a/patches/expo-audio@58.0.9.patch
+++ b/patches/expo-audio@58.0.9.patch
@@ -72,9 +72,10 @@ diff --git a/ios/AudioModule.swift b/ios/AudioModule.swift
          !self.isSessionInUse else {
          return
 diff --git a/src/AudioModule.types.ts b/src/AudioModule.types.ts
+index 3194a8ebd1b91793d03a1692c563b5d2e83c2738..e7e713199f776b60093b75da782197427cf2000d 100644
 --- a/src/AudioModule.types.ts
 +++ b/src/AudioModule.types.ts
-@@ -27,6 +27,8 @@
+@@ -24,6 +24,8 @@ import type { AudioStream } from './AudioStream.types';
   */
  export declare class NativeAudioModule extends NativeModule {
    setIsAudioActiveAsync(active: boolean): Promise<void>;
@@ -83,7 +84,7 @@ diff --git a/src/AudioModule.types.ts b/src/AudioModule.types.ts
    setAudioModeAsync(category: Partial<AudioMode>): Promise<void>;
    requestRecordingPermissionsAsync(): Promise<PermissionResponse>;
    requestNotificationPermissionsAsync(): Promise<PermissionResponse>;
-@@ -175,8 +175,9 @@
+@@ -175,8 +177,9 @@ export declare class AudioPlayer extends SharedObject<AudioEvents> {
 
    /**
     * Pauses the player.
@@ -95,9 +96,10 @@ diff --git a/src/AudioModule.types.ts b/src/AudioModule.types.ts
    /**
     * Replaces the current audio source with a new one.
 diff --git a/build/AudioModule.types.d.ts b/build/AudioModule.types.d.ts
+index 0d63c9b949cfae7a101902fc3bb70fcf46094f68..b590f9654bbf74b5052b71e31b7ed6d3d0050aa4 100644
 --- a/build/AudioModule.types.d.ts
 +++ b/build/AudioModule.types.d.ts
-@@ -6,6 +6,8 @@
+@@ -8,6 +8,8 @@ import type { AudioStream } from './AudioStream.types';
   */
  export declare class NativeAudioModule extends NativeModule {
      setIsAudioActiveAsync(active: boolean): Promise<void>;
@@ -106,7 +108,7 @@ diff --git a/build/AudioModule.types.d.ts b/build/AudioModule.types.d.ts
      setAudioModeAsync(category: Partial<AudioMode>): Promise<void>;
      requestRecordingPermissionsAsync(): Promise<PermissionResponse>;
      requestNotificationPermissionsAsync(): Promise<PermissionResponse>;
-@@ -135,8 +135,9 @@
+@@ -135,8 +137,9 @@ export declare class AudioPlayer extends SharedObject<AudioEvents> {
      play(): void;
      /**
       * Pauses the player.
@@ -118,12 +120,367 @@ diff --git a/build/AudioModule.types.d.ts b/build/AudioModule.types.d.ts
       * Replaces the current audio source with a new one.
       */
 diff --git a/android/src/main/java/expo/modules/audio/AudioModule.kt b/android/src/main/java/expo/modules/audio/AudioModule.kt
+index 6c81fce3dd518d3b82e3280940a001c7be84dd0a..16125c679c870e2eae48f8db953dedd3fc842c3d 100644
 --- a/android/src/main/java/expo/modules/audio/AudioModule.kt
 +++ b/android/src/main/java/expo/modules/audio/AudioModule.kt
-@@ -678,5 +678,5 @@
+@@ -677,7 +677,7 @@ class AudioModule : Module() {
+         }
        }
 
 -      Function("pause") { player: AudioPlayer ->
 +      Function("pause") { player: AudioPlayer, /* deactivateSession - iOS only */ _: Boolean? ->
          runOnMain {
            player.isPaused = false
+           player.ref.pause()
+@@ -824,10 +824,14 @@ class AudioModule : Module() {
+         return@Function recorder.getAvailableInputs(audioManager)
+       }
+
+-      Function("setInput") { recorder: AudioRecorder, input: String ->
++      AsyncFunction("setInput") Coroutine { recorder: AudioRecorder, input: String ->
+         recorder.setInput(input, audioManager)
+       }
+
++      Function("cancelInputSelection") { recorder: AudioRecorder ->
++        recorder.cancelInputSelection()
++      }
++
+       Function("startRecordingAtTime") { recorder: AudioRecorder, seconds: Double ->
+         checkRecordingPermission()
+         if (recorder.isPrepared) {
+diff --git a/android/src/main/java/expo/modules/audio/AudioRecorder.kt b/android/src/main/java/expo/modules/audio/AudioRecorder.kt
+index 2ff4a474fdea3efa652436a8a3960c3669ad298b..1ced279991294d3d81cb20fa339ca73e5d6d6c01 100644
+--- a/android/src/main/java/expo/modules/audio/AudioRecorder.kt
++++ b/android/src/main/java/expo/modules/audio/AudioRecorder.kt
+@@ -19,6 +19,9 @@ import expo.modules.kotlin.exception.CodedException
+ import expo.modules.kotlin.exception.Exceptions
+ import expo.modules.kotlin.sharedobjects.SharedObject
+ import kotlinx.coroutines.Job
++import kotlinx.coroutines.CancellationException
++import kotlinx.coroutines.currentCoroutineContext
++import kotlinx.coroutines.job
+ import kotlinx.coroutines.delay
+ import kotlinx.coroutines.launch
+ import java.io.File
+@@ -42,12 +45,19 @@ class AudioRecorder(
+   var isPrepared = false
+ 
+   private var recorder: MediaRecorder? = null
++  private val inputRoute = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
++    RecordingInputRoute(context.getSystemService(Context.AUDIO_SERVICE) as AudioManager)
++  } else {
++    null
++  }
+   val id = UUID.randomUUID().toString()
+   var startTime = 0L
+   var isRecording = false
+   var isPaused = false
+   private var isPausedBySystem = false
+   private var recordingTimerJob: Job? = null
++  private var inputSelectionJob: Job? = null
++  private var inputSelectionCanceled = false
+   private var durationLimitMillis: Long? = null
+   var useForegroundService = false
+ 
+@@ -90,6 +100,7 @@ class AudioRecorder(
+       throw AudioRecorderAlreadyPreparedException()
+     }
+ 
++    synchronized(this) { inputSelectionCanceled = false }
+     val recordingOptions = options ?: this.options
+     val mediaRecorder = createRecorder(recordingOptions)
+     recorder = mediaRecorder
+@@ -245,10 +256,15 @@ class AudioRecorder(
+   }
+ 
+   private fun reset() {
++    cancelInputSelection()
+     recordingTimerJob?.cancel()
+     recordingTimerJob = null
+ 
+-    recorder?.release()
++    try {
++      recorder?.release()
++    } finally {
++      inputRoute?.close()
++    }
+     recorder = null
+     isRecording = false
+     isPaused = false
+@@ -468,55 +484,68 @@ class AudioRecorder(
+       throw DeviceInfoNotFoundException()
+     }
+ 
+-    return getMapFromDeviceInfo(deviceInfo)
++    return getMapFromDeviceInfo(deviceInfo, recordingInputs(audioManager))
+   }
+ 
+   private fun hasRecordingPermissions() =
+     ContextCompat.checkSelfPermission(context, Manifest.permission.RECORD_AUDIO) == PackageManager.PERMISSION_GRANTED
+ 
+-  fun getAvailableInputs(audioManager: AudioManager) =
+-    audioManager.getDevices(AudioManager.GET_DEVICES_INPUTS).mapNotNull { deviceInfo ->
+-      val type = deviceInfo.type
+-      if (type == AudioDeviceInfo.TYPE_BUILTIN_MIC || type == AudioDeviceInfo.TYPE_BLUETOOTH_SCO || type == AudioDeviceInfo.TYPE_WIRED_HEADSET) {
+-        getMapFromDeviceInfo(deviceInfo)
+-      } else {
+-        null
+-      }
++  fun getAvailableInputs(audioManager: AudioManager): List<Bundle> {
++    val inputs = recordingInputs(audioManager)
++    return inputs.map { getMapFromDeviceInfo(it, inputs) }
++  }
++
++  suspend fun setInput(uid: String, audioManager: AudioManager) {
++    val job = currentCoroutineContext().job
++    synchronized(this) {
++      if (inputSelectionCanceled) throw CancellationException("Input selection canceled")
++      inputSelectionJob = job
++    }
++    try {
++      setInputDevice(uid, audioManager)
++    } finally {
++      synchronized(this) { if (inputSelectionJob === job) inputSelectionJob = null }
+     }
++  }
++
++  fun cancelInputSelection() {
++    val job = synchronized(this) {
++      inputSelectionCanceled = true
++      inputSelectionJob
++    }
++    job?.cancel()
++  }
+ 
+   @Suppress("DEPRECATION")
+-  fun setInput(uid: String, audioManager: AudioManager) {
+-    val deviceInfo: AudioDeviceInfo? = getDeviceInfoFromUid(uid, audioManager)
++  private suspend fun setInputDevice(uid: String, audioManager: AudioManager) {
++    val deviceInfo = getDeviceInfoFromUid(uid, audioManager) ?: throw PreferredInputNotFoundException()
+ 
+     if (Build.VERSION.SDK_INT <= Build.VERSION_CODES.P) {
+       throw SetAudioInputNotSupportedException()
+     }
+ 
+-    if (deviceInfo != null && deviceInfo.type == AudioDeviceInfo.TYPE_BLUETOOTH_SCO) {
+-      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+-        audioManager.setCommunicationDevice(deviceInfo)
+-      } else {
++    try {
++      if (inputRoute != null) {
++        inputRoute.select(deviceInfo)
++      } else if (deviceInfo.type == AudioDeviceInfo.TYPE_BLUETOOTH_SCO) {
+         audioManager.startBluetoothSco()
+-      }
+-    } else {
+-      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+-        audioManager.clearCommunicationDevice()
+       } else {
+         audioManager.stopBluetoothSco()
+       }
+-    }
+-
+-    val success = recorder?.setPreferredDevice(deviceInfo)
+-    if (success == false) {
+-      throw PreferredInputNotFoundException()
++      val source = getDeviceInfoFromUid(uid, audioManager)?.takeIf { it.isSource }
++      if (recorder?.setPreferredDevice(source) != true) {
++        throw PreferredInputNotFoundException()
++      }
++    } catch (error: Exception) {
++      inputRoute?.close()
++      throw error
+     }
+   }
+ 
+   private fun getDeviceInfoFromUid(uid: String, audioManager: AudioManager): AudioDeviceInfo? {
+-    val id = uid.toInt()
+-    val audioDevices: Array<AudioDeviceInfo> = audioManager.getDevices(AudioManager.GET_DEVICES_INPUTS)
++    val audioDevices = recordingInputs(audioManager)
+     for (device in audioDevices) {
+-      if (device.id == id) {
++      if (recordingInputUid(device, audioDevices) == uid) {
+         return device
+       }
+     }
+diff --git a/android/src/main/java/expo/modules/audio/AudioUtils.kt b/android/src/main/java/expo/modules/audio/AudioUtils.kt
+index 81819c1d771bdeec093bb35a65a5e1e1af0cf9d7..cd0c7624b4cd8a4ebf7ed3b3390cfc76802e8530 100644
+--- a/android/src/main/java/expo/modules/audio/AudioUtils.kt
++++ b/android/src/main/java/expo/modules/audio/AudioUtils.kt
+@@ -2,6 +2,8 @@ package expo.modules.audio
+ 
+ import android.content.Context
+ import android.media.AudioDeviceInfo
++import android.media.AudioManager
++import android.os.Build
+ import android.os.Bundle
+ import androidx.annotation.OptIn
+ import androidx.media3.common.Player
+@@ -17,22 +19,57 @@ fun ensureDirExists(dir: File): File {
+   return dir
+ }
+ 
+-fun getMapFromDeviceInfo(deviceInfo: AudioDeviceInfo): Bundle {
++fun getMapFromDeviceInfo(deviceInfo: AudioDeviceInfo, inputs: List<AudioDeviceInfo>): Bundle {
+   val map = Bundle()
+-  val type = when (deviceInfo.type) {
+-    AudioDeviceInfo.TYPE_BUILTIN_MIC -> "MicrophoneBuiltIn"
+-    AudioDeviceInfo.TYPE_BLUETOOTH_SCO -> "BluetoothSCO"
+-    AudioDeviceInfo.TYPE_BLUETOOTH_A2DP -> "BluetoothA2DP"
+-    AudioDeviceInfo.TYPE_TELEPHONY -> "Telephony"
+-    AudioDeviceInfo.TYPE_WIRED_HEADSET -> "MicrophoneWired"
+-    else -> "Unknown device type"
+-  }
++  val type = recordingInputType(deviceInfo.type) ?: "Unknown device type"
+   map.putString("name", deviceInfo.productName.toString())
+   map.putString("type", type)
+-  map.putString("uid", deviceInfo.id.toString())
++  map.putString("uid", recordingInputUid(deviceInfo, inputs))
+   return map
+ }
+ 
++internal fun recordingInputs(manager: AudioManager): List<AudioDeviceInfo> {
++  val inputs = manager.getDevices(AudioManager.GET_DEVICES_INPUTS).filter {
++    recordingInputType(it.type) != null
++  }
++  val bluetooth = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
++    manager.availableCommunicationDevices.filter { isBluetoothInput(it.type) }
++  } else {
++    emptyList()
++  }
++  // Some Bluetooth microphone ports appear only after the communication route is activated.
++  return (inputs + bluetooth).distinctBy {
++    if (isBluetoothInput(it.type)) recordingInputUid(it) else "port:${it.id}"
++  }
++}
++
++internal fun isBluetoothInput(type: Int) = type == AudioDeviceInfo.TYPE_BLUETOOTH_SCO ||
++  type == AudioDeviceInfo.TYPE_BLE_HEADSET
++
++internal fun recordingInputType(type: Int): String? = when (type) {
++  AudioDeviceInfo.TYPE_BUILTIN_MIC -> "MicrophoneBuiltIn"
++  AudioDeviceInfo.TYPE_BLUETOOTH_SCO -> "BluetoothSCO"
++  AudioDeviceInfo.TYPE_BLE_HEADSET -> "BluetoothLE"
++  AudioDeviceInfo.TYPE_WIRED_HEADSET -> "MicrophoneWired"
++  AudioDeviceInfo.TYPE_USB_DEVICE, AudioDeviceInfo.TYPE_USB_HEADSET -> "USBAudio"
++  AudioDeviceInfo.TYPE_LINE_ANALOG, AudioDeviceInfo.TYPE_LINE_DIGITAL -> "LineIn"
++  else -> null
++}
++
++internal fun recordingInputUid(device: AudioDeviceInfo, inputs: List<AudioDeviceInfo> = emptyList()): String {
++  val base = recordingInputBaseUid(device)
++  val ambiguous = !isBluetoothInput(device.type) && inputs.any {
++    it.id != device.id && recordingInputBaseUid(it) == base
++  }
++  return if (ambiguous) "$base:port:${device.id}" else base
++}
++
++private fun recordingInputBaseUid(device: AudioDeviceInfo): String {
++  // Port IDs and USB addresses (ALSA card numbers) change on reconnect; Bluetooth addresses don't.
++  val stable = Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && isBluetoothInput(device.type)
++  return "android:${device.type}:${if (stable) device.address.ifBlank { device.productName } else device.productName}"
++}
++
+ @OptIn(UnstableApi::class)
+ fun buildBasicMediaSession(context: Context, player: Player, onPlay: () -> Unit): MediaSession {
+   return MediaSession.Builder(context, PlayRequestingPlayer(player, onPlay))
+diff --git a/android/src/main/java/expo/modules/audio/RecordingInputRoute.kt b/android/src/main/java/expo/modules/audio/RecordingInputRoute.kt
+new file mode 100644
+index 0000000000000000000000000000000000000000..cdba9724318cf06afd21b4df6b895b381afa8e6f
+--- /dev/null
++++ b/android/src/main/java/expo/modules/audio/RecordingInputRoute.kt
+@@ -0,0 +1,53 @@
++package expo.modules.audio
++
++import android.media.AudioDeviceInfo
++import android.media.AudioManager
++import androidx.annotation.RequiresApi
++import java.io.Closeable
++import java.util.concurrent.Executor
++import kotlinx.coroutines.CompletableDeferred
++import kotlinx.coroutines.withTimeout
++
++@RequiresApi(31)
++internal class RecordingInputRoute(private val manager: AudioManager) : Closeable {
++  private var previousMode: Int? = null
++
++  suspend fun select(input: AudioDeviceInfo) {
++    if (!isBluetoothInput(input.type)) {
++      close()
++      return
++    }
++    // Communication routing takes the headset's output; Android pairs its microphone.
++    val output = manager.availableCommunicationDevices.firstOrNull {
++      it.isSink && it.type == input.type &&
++        if (input.address.isNotBlank()) it.address == input.address else it.productName == input.productName
++    } ?: throw PreferredInputNotFoundException()
++    val ready = CompletableDeferred<Unit>()
++    val listener = AudioManager.OnCommunicationDeviceChangedListener {
++      if (it?.id == output.id) ready.complete(Unit)
++    }
++    manager.addOnCommunicationDeviceChangedListener(Executor { it.run() }, listener)
++    try {
++      if (previousMode == null) previousMode = manager.mode
++      manager.mode = AudioManager.MODE_IN_COMMUNICATION
++      if (!manager.setCommunicationDevice(output)) throw PreferredInputNotFoundException()
++      if (manager.communicationDevice?.id == output.id) ready.complete(Unit)
++      withTimeout(5_000) { ready.await() }
++    } catch (error: Exception) {
++      close()
++      throw error
++    } finally {
++      manager.removeOnCommunicationDeviceChangedListener(listener)
++    }
++  }
++
++  override fun close() {
++    val mode = previousMode ?: return
++    previousMode = null
++    try {
++      manager.clearCommunicationDevice()
++    } finally {
++      if (manager.mode == AudioManager.MODE_IN_COMMUNICATION) manager.mode = mode
++    }
++  }
++}
+diff --git a/android/src/test/java/expo/modules/audio/RecordingInputIdentityTest.kt b/android/src/test/java/expo/modules/audio/RecordingInputIdentityTest.kt
+new file mode 100644
+index 0000000000000000000000000000000000000000..4dd0567e2170770e9b0f6a17dc4581bc769d5c6a
+--- /dev/null
++++ b/android/src/test/java/expo/modules/audio/RecordingInputIdentityTest.kt
+@@ -0,0 +1,35 @@
++package expo.modules.audio
++
++import android.media.AudioDeviceInfo
++import android.media.AudioManager
++import io.mockk.every
++import io.mockk.mockk
++import org.junit.Assert.*
++import org.junit.Test
++
++class RecordingInputIdentityTest {
++  private fun device(id: Int) = mockk<AudioDeviceInfo> {
++    every { this@mockk.id } returns id
++    every { type } returns AudioDeviceInfo.TYPE_USB_DEVICE
++    every { productName } returns "USB Microphone"
++    every { address } returns "card=$id;device=0;"
++  }
++
++  @Test
++  fun identicalUsbMicrophonesRemainSelectable() {
++    val first = device(1)
++    val second = device(2)
++    val manager = mockk<AudioManager> {
++      every { getDevices(AudioManager.GET_DEVICES_INPUTS) } returns arrayOf(first, second)
++    }
++    val inputs = recordingInputs(manager)
++    assertEquals(2, inputs.size)
++    val firstUid = recordingInputUid(first, inputs)
++    val secondUid = recordingInputUid(second, inputs)
++    assertNotEquals(firstUid, secondUid)
++    assertSame(first, inputs.single { recordingInputUid(it, inputs) == firstUid })
++    assertSame(second, inputs.single { recordingInputUid(it, inputs) == secondUid })
++    val reconnected = device(99)
++    assertEquals(recordingInputUid(first, listOf(first)), recordingInputUid(reconnected, listOf(reconnected)))
++  }
++}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 755f2f95c2ed1..84d25ab15249a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -378,7 +378,7 @@ patchedDependencies:
   '@react-navigation/native-stack@7.21.0': 990d575444c4af2ce8218b3b7a8280fe244c03abbdb32b822a2e862f791dbf42
   app-builder-lib@26.16.1: 0fbe9ae51783f5768ebe197d12d1fdb7d477a08c92e5db2f6356bcce62613c53
   dbus-next@0.10.2: cfff57561b0ee59b5addb3b2e6c6f20906e967507a530ab67e8db8108e520ba4
-  expo-audio@58.0.9: 530af071088a809fe1a97ce2b2269c78335fbb5dcd3893d6937ff5c304c85a0a
+  expo-audio@58.0.9: b391b150cf67acdf23a9d924b791a63f8c4c84ec7a7b18cc82f815f7933fe4ba
   expo-modules-core@58.0.22: f0b0fd100550ed76e5c25b4d13eb7c9ff62825f8f197c53edf7bf447c50c9fb7
   expo-network@58.0.3: cd09b6d1744dde4efa081b5619ebcff38877d98f7502a51cab121629dece8237
   expo-sharing@58.0.19: 321a86e1471e34c53f1f2937fbb4304ea3f7b7a78ad9e4d35febc2b9e73e9688
@@ -627,7 +627,7 @@ importers:
         version: 58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1)
       expo-audio:
         specifier: 58.0.9
-        version: 58.0.9(patch_hash=530af071088a809fe1a97ce2b2269c78335fbb5dcd3893d6937ff5c304c85a0a)(expo-asset@58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1))(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)
+        version: 58.0.9(patch_hash=b391b150cf67acdf23a9d924b791a63f8c4c84ec7a7b18cc82f815f7933fe4ba)(expo-asset@58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1))(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)
       expo-auth-session:
         specifier: ~58.0.13
         version: 58.0.13(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1)
@@ -18508,7 +18508,7 @@ snapshots:
       - supports-color
       - typescript
 
-  expo-audio@58.0.9(patch_hash=530af071088a809fe1a97ce2b2269c78335fbb5dcd3893d6937ff5c304c85a0a)(expo-asset@58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1))(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0):
+  expo-audio@58.0.9(patch_hash=b391b150cf67acdf23a9d924b791a63f8c4c84ec7a7b18cc82f815f7933fe4ba)(expo-asset@58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1))(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0):
     dependencies:
       expo: 58.0.14(277a83826bb26ba15256633fefeb0bc2)
       expo-asset: 58.0.16(@tsc-rs/typescript@0.8.0)(expo@58.0.14)(react-native@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(@react-native/metro-config@0.88.0(@babel/core@7.29.7(supports-color@8.1.1))(bufferutil@4.1.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(@types/react@19.3.0)(bufferutil@4.1.0)(react@19.3.0)(supports-color@8.1.1)(utf-8-validate@6.0.6))(react@19.3.0)(supports-color@8.1.1)

From a10490937dbd8a9e441b0518a77a60117f3ecf5a Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Tue, 3 Nov 2026 16:01:07 -0500
Subject: [PATCH 049/167] feat(server): read usage limit source keys from a
 secret provider (#27760)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/serverSettings.test.ts        | 105 ++++++++++++++++--
 apps/server/src/serverSettings.ts             |  37 +++++-
 apps/server/src/settingsSecrets.ts            | 102 ++++++++++++-----
 .../sourceControlHostSecrets.test.ts          |  23 +++-
 .../sourceControl/sourceControlHostSecrets.ts |  14 ++-
 .../src/usage/UsageLimitSources.test.ts       |  72 +++++++++++-
 apps/server/src/usage/UsageLimitSources.ts    |  44 ++++++--
 apps/server/src/usage/cliproxyApi.ts          |  46 ++++----
 apps/server/src/ws.test.ts                    |  12 +-
 apps/server/src/ws.ts                         |  29 ++++-
 .../settings/AddUsageLimitSourceDialog.tsx    |  25 +++--
 .../SecretSourceInput.browser.test.tsx        |  23 ++++
 .../components/settings/SecretSourceInput.tsx |   9 ++
 .../src/connection/compatibility.test.ts      |   1 +
 .../src/connection/compatibility.ts           |   3 +
 .../src/connection/resolver.test.ts           |   2 +-
 packages/contracts/src/environment.ts         |   5 +
 packages/contracts/src/settings.ts            |   6 +-
 18 files changed, 462 insertions(+), 96 deletions(-)

diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index 8d50f0b597b57..726756655740f 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -27,6 +27,7 @@ import * as Path from "effect/Path";
 import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
+import * as SchemaAST from "effect/SchemaAST";
 import * as SqlClient from "effect/sql/SqlClient";
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
 import { sourceControlHostSecretName } from "./sourceControl/sourceControlHostSecrets.ts";
@@ -34,6 +35,7 @@ import * as ServerConfig from "./config.ts";
 import * as SqlitePersistence from "./persistence/Sqlite.ts";
 import { writeFileStringAtomically } from "@t3tools/shared/atomicWrite";
 import * as ServerSettingsModule from "./serverSettings.ts";
+import { SECRET_REDACTED } from "./settingsSecrets.ts";
 import * as ManagedPolicy from "./policy/ManagedPolicy.ts";
 import { resolveProviderInstanceTerminalEnvironment } from "./terminal/Manager.ts";
 
@@ -102,6 +104,36 @@ const recordProviderUsage = (provider: string, instanceId: string | null = provi
     `;
   });
 
+/** Paths of fields typed `SettingsSecretValue` that clients decode with the settings schema itself. */
+function strictSecretReferencePaths(
+  ast: SchemaAST.AST,
+  path = "",
+  seen = new Set<SchemaAST.AST>(),
+): ReadonlyArray<string> {
+  if (seen.has(ast)) return [];
+  seen.add(ast);
+  const walk = (type: SchemaAST.AST, at: string): ReadonlyArray<string> =>
+    type.context?.annotations?.settingsSecretReference === true
+      ? [at]
+      : strictSecretReferencePaths(type, `${at}.`, seen);
+  if (SchemaAST.isObjects(ast)) {
+    return [
+      ...ast.propertySignatures.flatMap((property) =>
+        walk(property.type, `${path}${String(property.name)}`),
+      ),
+      ...ast.indexSignatures.flatMap((signature) => walk(signature.type, `${path}*`)),
+    ];
+  }
+  if (SchemaAST.isArrays(ast)) {
+    return [...ast.elements, ...ast.rest].flatMap((element) => walk(element, `${path}[]`));
+  }
+  if (SchemaAST.isUnion(ast)) {
+    return ast.types.flatMap((member) => strictSecretReferencePaths(member, path, seen));
+  }
+  if (SchemaAST.isSuspend(ast)) return strictSecretReferencePaths(ast.thunk(), path, seen);
+  return [];
+}
+
 it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings", (it) => {
   it.effect("serializes concurrent model preference edits without cancelling duplicate adds", () =>
     Effect.gen(function* () {
@@ -278,7 +310,8 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         },
       });
       assert.deepStrictEqual<unknown>(
-        ServerSettingsModule.redactServerSettingsForClient(settings).secretProviders,
+        ServerSettingsModule.redactServerSettingsForClient(settings, { secretReferences: true })
+          .secretProviders,
         {
           personal: { kind: "one_password", label: "Personal", config: { account: "my" } },
           vault: { kind: "openbao", label: "Vault" },
@@ -1331,7 +1364,9 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
           "quota-secret",
           "expo-secret",
         ];
-        const client = ServerSettingsModule.redactServerSettingsForClient(saved);
+        const client = ServerSettingsModule.redactServerSettingsForClient(saved, {
+          secretReferences: true,
+        });
         const disk = yield* fs.readFileString(config.settingsPath);
         for (const value of values) {
           assert.include(JSON.stringify(saved), value);
@@ -1365,7 +1400,9 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
             instance: { ...client.providerInstances[instanceId]!, config: { apiKey } },
           });
           assert.propertyVal(changed.providerInstances[instanceId]?.config, "apiKey", apiKey);
-          const redacted = ServerSettingsModule.redactServerSettingsForClient(changed);
+          const redacted = ServerSettingsModule.redactServerSettingsForClient(changed, {
+            secretReferences: true,
+          });
           assert.propertyVal(
             redacted.providerInstances[instanceId]?.config,
             "apiKey",
@@ -1414,9 +1451,8 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         });
         assert.isTrue(Option.isNone(yield* store.get(secretNames[1]!)));
         assert.deepEqual(
-          ServerSettingsModule.redactServerSettingsForClient(referenced).providerInstances[
-            instanceId
-          ]?.environment,
+          ServerSettingsModule.redactServerSettingsForClient(referenced, { secretReferences: true })
+            .providerInstances[instanceId]?.environment,
           [{ name: "API_TOKEN", value: secret, sensitive: true }],
         );
         yield* service.updateSettings({
@@ -1463,7 +1499,9 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         "serverPassword",
         "legacy-password",
       );
-      const client = ServerSettingsModule.redactServerSettingsForClient(saved);
+      const client = ServerSettingsModule.redactServerSettingsForClient(saved, {
+        secretReferences: true,
+      });
       for (const value of ["legacy-api-key", "legacy-password"]) {
         assert.notInclude(yield* fs.readFileString(config.settingsPath), value);
         assert.notInclude(JSON.stringify(client), value);
@@ -1507,8 +1545,9 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         for (const secret of ["bb-access", "ghp_dotcom", "ghp_ghe"]) assert.notInclude(raw, secret);
         assert.include(raw, "me@example.com");
 
-        const forClient =
-          ServerSettingsModule.redactServerSettingsForClient(saved).sourceControlHosts;
+        const forClient = ServerSettingsModule.redactServerSettingsForClient(saved, {
+          secretReferences: true,
+        }).sourceControlHosts;
         assert.equal(forClient.bitbucket?.email, "me@example.com");
         assert.notInclude(String(forClient.bitbucket?.accessToken), "bb-access");
         assert.isAbove(String(forClient.bitbucket?.accessToken).length, 0);
@@ -1570,15 +1609,59 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         assert.isTrue(Option.isNone(yield* stored("bitbucket", "accessToken", null)));
         assert.isTrue(Option.isNone(yield* stored("github", "tokens", "github.com")));
         assert.isTrue(Option.isSome(yield* stored("github", "tokens", "ghe.acme.test")));
-        const redacted =
-          ServerSettingsModule.redactServerSettingsForClient(referenced).sourceControlHosts;
+        const redacted = ServerSettingsModule.redactServerSettingsForClient(referenced, {
+          secretReferences: true,
+        }).sourceControlHosts;
         assert.deepEqual(redacted.bitbucket?.accessToken, reference);
         const tokens = redacted.github?.tokens as Record<string, unknown>;
         assert.deepEqual(tokens["github.com"], gitHubReference);
         assert.notEqual(tokens["ghe.acme.test"], "ghp_ghe");
+
+        // A client that cannot decode references sees saved secrets and can send them back.
+        const usageReference = {
+          provider: SecretProviderId.make("personal"),
+          reference: "op://Private/Hub/key",
+        };
+        const hub = UsageLimitSourceId.make("hub");
+        const withUsage = yield* serverSettings.updateSettings({
+          usageLimitSources: {
+            [hub]: {
+              kind: "cliproxy",
+              url: "https://hub.test",
+              managementKey: usageReference,
+              enabled: true,
+            },
+          },
+        });
+        const legacy = ServerSettingsModule.redactServerSettingsForClient(withUsage, {
+          secretReferences: false,
+        });
+        assert.notInclude(JSON.stringify(legacy), "op://");
+        assert.equal(legacy.sourceControlHosts.bitbucket?.accessToken, SECRET_REDACTED);
+        assert.equal(legacy.usageLimitSources[hub]?.managementKey, SECRET_REDACTED);
+        const echoed = yield* serverSettings.updateSettings({
+          sourceControlHosts: legacy.sourceControlHosts,
+          usageLimitSources: legacy.usageLimitSources,
+        });
+        assert.deepEqual(echoed.sourceControlHosts.bitbucket?.accessToken, reference);
+        assert.deepEqual(echoed.sourceControlHosts.github?.tokens, {
+          "github.com": gitHubReference,
+          "ghe.acme.test": "ghp_ghe",
+        });
+        assert.deepEqual(echoed.usageLimitSources[hub]?.managementKey, usageReference);
+        assert.isTrue(Option.isSome(yield* stored("github", "tokens", "ghe.acme.test")));
       }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
 
+  it.effect("knows every strictly decoded field that can hold a secret reference", () =>
+    Effect.sync(() => {
+      // Shipped clients decode these as strings. Each must be covered by the older-client case above.
+      assert.deepEqual(strictSecretReferencePaths(ServerSettings.ast), [
+        "usageLimitSources.*.managementKey",
+      ]);
+    }),
+  );
+
   it.effect("keeps the retired keys for another load when a token cannot be copied", () => {
     const cause = new ServerSecretStore.SecretStoreReadError({
       resource: "bitbucket-access-token",
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index 1ead9e27bfcf5..831a5fad4995b 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -18,6 +18,8 @@ import {
   type ServerSettingsPatch,
   type ManagedPolicySummary,
   globalIdleCompaction,
+  isSecretReference,
+  type SecretReference,
   withIdleCompaction,
 } from "@t3tools/contracts";
 import * as Cache from "effect/Cache";
@@ -60,7 +62,12 @@ import {
   sourceControlHostSecretName,
 } from "./sourceControl/sourceControlHostSecrets.ts";
 
-import { mapSettingsSecrets, SECRET_REDACTED, type SettingsSecret } from "./settingsSecrets.ts";
+import {
+  mapSettingsSecrets,
+  mapSettingsSecretValues,
+  SECRET_REDACTED,
+  type SettingsSecret,
+} from "./settingsSecrets.ts";
 
 export {
   resolveReviewGuideModelSelection,
@@ -131,13 +138,35 @@ const normalizeServerSettings = (
     ),
   );
 
-export function redactServerSettingsForClient(settings: ServerSettings): ServerSettings {
+export function redactServerSettingsForClient(
+  settings: ServerSettings,
+  client: { readonly secretReferences: boolean },
+): ServerSettings {
   const redacted = mapSettingsSecrets(settings, (secret) =>
     secret.sensitive
       ? { value: "", redacted: secret.redacted || secret.value.length > 0 }
       : { value: secret.value, redacted: false },
   );
-  return { ...redacted, secretProviders: withoutUnknownSecretProviderConfigs(redacted) };
+  // Older clients decode secret fields as strings and fail on a reference, so they see a saved secret.
+  const shaped = client.secretReferences
+    ? redacted
+    : mapSettingsSecretValues(redacted, (value) =>
+        isSecretReference(value) ? SECRET_REDACTED : value,
+      );
+  return { ...shaped, secretProviders: withoutUnknownSecretProviderConfigs(shaped) };
+}
+
+/** A client shown a reference as a saved secret sends that marker back; it keeps the reference. */
+function withEchoedSecretReferences(current: ServerSettings, next: ServerSettings): ServerSettings {
+  const references = new Map<string, SecretReference>();
+  mapSettingsSecretValues(current, (value, secretName) => {
+    if (isSecretReference(value)) references.set(secretName, value);
+    return value;
+  });
+  if (references.size === 0) return next;
+  return mapSettingsSecretValues(next, (value, secretName) =>
+    value === SECRET_REDACTED ? (references.get(secretName) ?? value) : value,
+  );
 }
 
 // A newer kind's config may hold credentials this build cannot recognize, so it never leaves the server.
@@ -1004,7 +1033,7 @@ const make = Effect.gen(function* () {
       });
       const changes: SecretChange[] = [];
       const nextSecretNames = new Set<string>();
-      const settings = mapSettingsSecrets(next, (secret) => {
+      const settings = mapSettingsSecrets(withEchoedSecretReferences(current, next), (secret) => {
         const metadata = {
           secretName: secret.secretName,
           ...(secret.providerInstanceId !== undefined
diff --git a/apps/server/src/settingsSecrets.ts b/apps/server/src/settingsSecrets.ts
index 1bebce51b3876..17640237ff5ca 100644
--- a/apps/server/src/settingsSecrets.ts
+++ b/apps/server/src/settingsSecrets.ts
@@ -3,7 +3,9 @@ import {
   ClaudeSettings,
   CodexSettings,
   EasDeviceHostConfig,
+  type ProviderInstanceConfig,
   type ServerSettings,
+  type SettingsSecretValue,
   SimlockDeviceHostConfig,
   UsageLimitSourceConfig,
   isSecretReference,
@@ -58,16 +60,19 @@ export interface SettingsSecret {
 }
 
 type SecretValue = Pick<SettingsSecret, "value" | "redacted">;
+type SecretSlotName = (field: string, serverHost: string | null) => string;
+type SecretFieldsMapper = (
+  fields: Readonly<Record<string, unknown>>,
+  secretFields: ReadonlyArray<string>,
+  name: SecretSlotName,
+) => Record<string, unknown>;
+type ProviderEnvironment = NonNullable<ProviderInstanceConfig["environment"]>;
 
 export function mapSettingsSecrets(
   settings: ServerSettings,
   map: (secret: SettingsSecret) => SecretValue,
 ): ServerSettings {
-  const mapFields = (
-    fields: Readonly<Record<string, unknown>>,
-    secretFields: ReadonlyArray<string>,
-    name: (field: string, serverHost: string | null) => string,
-  ) => {
+  const mapFields: SecretFieldsMapper = (fields, secretFields, name) => {
     const next = { ...fields };
     for (const field of secretFields) {
       if (!(field in next) || isSecretReference(next[field])) continue;
@@ -88,6 +93,70 @@ export function mapSettingsSecrets(
     return next;
   };
 
+  return mapSecretFieldGroups(settings, mapFields, (instanceId, environment) =>
+    environment.map((variable) => {
+      const { valueRedacted: _omit, ...rest } = variable;
+      // A secret reference is not itself secret; storage sees the value cleared.
+      const reference = typeof variable.value === "string" ? undefined : variable.value;
+      const result = map({
+        secretName: `provider-env-${encode(instanceId)}-${encode(variable.name)}`,
+        kind: "environment",
+        value: typeof variable.value === "string" ? variable.value : "",
+        redacted: reference === undefined && variable.valueRedacted === true,
+        sensitive: variable.sensitive,
+        providerInstanceId: instanceId,
+        environmentVariable: variable.name,
+      });
+      if (reference !== undefined) return { ...rest, value: reference };
+      return {
+        ...rest,
+        value: result.value,
+        ...(result.redacted ? { valueRedacted: true } : {}),
+      };
+    }),
+  );
+}
+
+/**
+ * Maps each value a secret field holds, literal or reference, with the secret name of its slot.
+ * Provider environment variables are left as they are.
+ */
+export function mapSettingsSecretValues(
+  settings: ServerSettings,
+  map: (value: SettingsSecretValue, secretName: string) => SettingsSecretValue,
+): ServerSettings {
+  const mapValue = (value: unknown, secretName: string) =>
+    typeof value === "string" || isSecretReference(value) ? map(value, secretName) : value;
+  return mapSecretFieldGroups(settings, (fields, secretFields, name) => {
+    const next = { ...fields };
+    for (const field of secretFields) {
+      if (!(field in next)) continue;
+      const value = next[field];
+      next[field] =
+        value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        !isSecretReference(value)
+          ? Object.fromEntries(
+              Object.entries(value).map(([serverHost, entry]) => [
+                serverHost,
+                mapValue(entry, name(field, serverHost.trim().toLowerCase())),
+              ]),
+            )
+          : mapValue(value, name(field, null));
+    }
+    return next;
+  });
+}
+
+function mapSecretFieldGroups(
+  settings: ServerSettings,
+  mapFields: SecretFieldsMapper,
+  mapEnvironment: (instanceId: string, environment: ProviderEnvironment) => ProviderEnvironment = (
+    _instanceId,
+    environment,
+  ) => environment,
+): ServerSettings {
   const providerInstances = Object.fromEntries(
     Object.entries(settings.providerInstances).map(([instanceId, instance]) => {
       const config = instance.config;
@@ -107,28 +176,7 @@ export function mapSettingsSecrets(
               }
             : {}),
           ...(instance.environment
-            ? {
-                environment: instance.environment.map((variable) => {
-                  const { valueRedacted: _omit, ...rest } = variable;
-                  // A secret reference is not itself secret; storage sees the value cleared.
-                  const reference = typeof variable.value === "string" ? undefined : variable.value;
-                  const result = map({
-                    secretName: `provider-env-${encode(instanceId)}-${encode(variable.name)}`,
-                    kind: "environment",
-                    value: typeof variable.value === "string" ? variable.value : "",
-                    redacted: reference === undefined && variable.valueRedacted === true,
-                    sensitive: variable.sensitive,
-                    providerInstanceId: instanceId,
-                    environmentVariable: variable.name,
-                  });
-                  if (reference !== undefined) return { ...rest, value: reference };
-                  return {
-                    ...rest,
-                    value: result.value,
-                    ...(result.redacted ? { valueRedacted: true } : {}),
-                  };
-                }),
-              }
+            ? { environment: mapEnvironment(instanceId, instance.environment) }
             : {}),
         },
       ];
diff --git a/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts b/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
index be1da6f3d610c..697e166c324a4 100644
--- a/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
+++ b/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
@@ -1,5 +1,5 @@
 import { assert, it } from "@effect/vitest";
-import { SecretProviderId } from "@t3tools/contracts";
+import { SecretProviderId, UsageLimitSourceId } from "@t3tools/contracts";
 import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Effect from "effect/Effect";
 
@@ -125,12 +125,31 @@ it.effect("reads a collected reference again once it is invalidated", () =>
         }),
     });
     const read = () => resolveSourceControlHostSecrets(resolver, hosts, "bitbucket");
+    const usageLimitSources = {
+      [UsageLimitSourceId.make("referenced")]: {
+        kind: "cliproxy",
+        url: "https://hub.test",
+        managementKey: source("cliproxy#key"),
+        enabled: true,
+      },
+      [UsageLimitSourceId.make("literal")]: {
+        kind: "cliproxy",
+        url: "https://hub.test",
+        managementKey: "plain-key",
+        enabled: true,
+      },
+    } as const;
+    cache.set("cliproxy#key", "stale");
     assert.deepEqual((yield* read()).bitbucket, {
       email: "me@example.test",
       accessToken: "stale",
     });
     current = "rotated";
-    yield* invalidateSettingsSecrets(resolver, Effect.succeed({ sourceControlHosts: hosts }));
+    yield* invalidateSettingsSecrets(
+      resolver,
+      Effect.succeed({ sourceControlHosts: hosts, usageLimitSources }),
+    );
+    assert.isFalse(cache.has("cliproxy#key"));
     assert.deepEqual((yield* read()).bitbucket, {
       email: "me@example.test",
       accessToken: "rotated",
diff --git a/apps/server/src/sourceControl/sourceControlHostSecrets.ts b/apps/server/src/sourceControl/sourceControlHostSecrets.ts
index 82de25be4de69..32d2f41f9c504 100644
--- a/apps/server/src/sourceControl/sourceControlHostSecrets.ts
+++ b/apps/server/src/sourceControl/sourceControlHostSecrets.ts
@@ -97,13 +97,23 @@ export const resolveSourceControlHostSecrets = Effect.fn("SourceControlHost.reso
   },
 );
 
+const collectUsageLimitSecretReferences = (
+  sources: ServerSettings["usageLimitSources"],
+): ReadonlyArray<SecretReference> =>
+  Object.values(sources).flatMap(({ managementKey }) =>
+    isSecretReference(managementKey) ? [managementKey] : [],
+  );
+
 /** Settings that cannot be read clear every cached secret, so a refresh never keeps a stale one. */
 export const invalidateSettingsSecrets = Effect.fn("SettingsSecrets.invalidate")(function* <E>(
   resolver: SecretResolver.SecretResolver["Service"],
-  settings: Effect.Effect<Pick<ServerSettings, "sourceControlHosts">, E>,
+  settings: Effect.Effect<Pick<ServerSettings, "sourceControlHosts" | "usageLimitSources">, E>,
 ) {
   const references = yield* settings.pipe(
-    Effect.map((current) => collectSourceControlHostSecretReferences(current.sourceControlHosts)),
+    Effect.map((current) => [
+      ...collectSourceControlHostSecretReferences(current.sourceControlHosts),
+      ...collectUsageLimitSecretReferences(current.usageLimitSources),
+    ]),
     Effect.orElseSucceed(() => undefined),
   );
   yield* resolver.invalidate(references);
diff --git a/apps/server/src/usage/UsageLimitSources.test.ts b/apps/server/src/usage/UsageLimitSources.test.ts
index b8976fca81e7d..1d955d497ef6b 100644
--- a/apps/server/src/usage/UsageLimitSources.test.ts
+++ b/apps/server/src/usage/UsageLimitSources.test.ts
@@ -1,10 +1,11 @@
 import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import { expect, it } from "@effect/vitest";
-import { ServerConfigStreamEvent, UsageLimitSourceId } from "@t3tools/contracts";
+import { SecretProviderId, ServerConfigStreamEvent, UsageLimitSourceId } from "@t3tools/contracts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
-import { HttpClient } from "effect/http";
+import { HttpClient, HttpClientResponse } from "effect/http";
 
 import * as BackgroundPolicy from "../background/BackgroundPolicy.ts";
 import * as ServerSettings from "../serverSettings.ts";
@@ -36,6 +37,10 @@ it.effect("keeps malformed source URLs encodable for config subscribers", () =>
     );
   }).pipe(
     Effect.provide([
+      Layer.succeed(SecretResolver.SecretResolver, {
+        read: (references) => Effect.succeed(references.map(() => undefined)),
+        invalidate: () => Effect.void,
+      }),
       ServerSettings.layerTest({
         usageLimitSources: {
           [UsageLimitSourceId.make("local-hub")]: {
@@ -83,3 +88,66 @@ it.effect("keeps malformed source URLs encodable for config subscribers", () =>
     Effect.scoped,
   ),
 );
+
+it.effect("reads a management key from its secret provider", () => {
+  const authorizations: Array<string | undefined> = [];
+  const keySource = (reference: string) => ({
+    provider: SecretProviderId.make("homelab"),
+    reference,
+  });
+  return Effect.gen(function* () {
+    const sources = yield* UsageLimitSources.make;
+    yield* sources.refresh;
+    const snapshots = yield* sources.current;
+    expect(snapshots.map(({ id, error }) => ({ id, error }))).toEqual([
+      { id: "resolved-hub", error: undefined },
+      {
+        id: "unresolved-hub",
+        error: "Could not read the management key from its secret provider.",
+      },
+    ]);
+    expect(authorizations).toEqual(["Bearer resolved-key"]);
+  }).pipe(
+    Effect.provide([
+      ServerSettings.layerTest({
+        usageLimitSources: {
+          [UsageLimitSourceId.make("resolved-hub")]: {
+            kind: "cliproxy",
+            url: "https://resolved.test",
+            managementKey: keySource("cliproxy#key"),
+            enabled: true,
+          },
+          [UsageLimitSourceId.make("unresolved-hub")]: {
+            kind: "cliproxy",
+            url: "https://unresolved.test",
+            managementKey: keySource("missing#key"),
+            enabled: true,
+          },
+        },
+      }),
+      Layer.mock(BackgroundPolicy.BackgroundPolicy)({
+        shouldRunScopeWork: () => Effect.succeed(false),
+      }),
+      Layer.succeed(SecretResolver.SecretResolver, {
+        read: (references) =>
+          Effect.succeed(
+            references.map((reference) =>
+              reference.reference === "cliproxy#key" ? "resolved-key" : undefined,
+            ),
+          ),
+        invalidate: () => Effect.void,
+      }),
+      Layer.succeed(
+        HttpClient.HttpClient,
+        HttpClient.make((request) =>
+          Effect.sync(() => {
+            authorizations.push(request.headers.authorization);
+            return HttpClientResponse.fromWeb(request, Response.json({ files: [] }));
+          }),
+        ),
+      ),
+      NodeCrypto.layer,
+    ]),
+    Effect.scoped,
+  );
+});
diff --git a/apps/server/src/usage/UsageLimitSources.ts b/apps/server/src/usage/UsageLimitSources.ts
index 7a068cde85f6c..7d40b0fb9ecea 100644
--- a/apps/server/src/usage/UsageLimitSources.ts
+++ b/apps/server/src/usage/UsageLimitSources.ts
@@ -4,7 +4,8 @@ import {
   type UsageLimitSourceConsumeResetCreditInput,
   type ProviderConsumeResetCreditResult,
   type ServerSettings,
-  type UsageLimitSourceConfig,
+  UsageLimitSourceConfig,
+  settingsSecretLiteral,
   type UsageLimitSourceId,
   type UsageLimitSourceSnapshot,
 } from "@t3tools/contracts";
@@ -21,6 +22,9 @@ import * as Semaphore from "effect/Semaphore";
 import * as Stream from "effect/Stream";
 
 import * as BackgroundPolicy from "../background/BackgroundPolicy.ts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as SecretResolverLayer from "../secrets/SecretResolver.ts";
+import { resolveSettingsSecrets } from "../secrets/settingsSecretValue.ts";
 import * as Settings from "../serverSettings.ts";
 import { makeCliproxyApi } from "./cliproxyApi.ts";
 
@@ -46,11 +50,24 @@ function sourceLabel(id: string, config: UsageLimitSourceConfig): string {
   }
 }
 
+function missingManagementKey(config: UsageLimitSourceConfig): string {
+  return typeof config.managementKey === "string"
+    ? "No management key configured."
+    : "Could not read the management key from its secret provider.";
+}
+
 /** @public */
 export const make = Effect.gen(function* () {
   const api = yield* makeCliproxyApi;
   const settingsService = yield* Settings.ServerSettingsService;
+  const secrets = yield* SecretResolver.SecretResolver;
   const backgroundPolicy = yield* BackgroundPolicy.BackgroundPolicy;
+  const readManagementKey = Effect.fn("UsageLimitSources.readManagementKey")(function* (
+    config: UsageLimitSourceConfig,
+  ) {
+    const resolved = yield* resolveSettingsSecrets(secrets, UsageLimitSourceConfig, config);
+    return settingsSecretLiteral(resolved.managementKey);
+  });
   const stateRef = yield* Ref.make<ReadonlyArray<UsageLimitSourceSnapshot>>([]);
   const changes = yield* Effect.acquireRelease(
     PubSub.unbounded<ReadonlyArray<UsageLimitSourceSnapshot>>(),
@@ -63,10 +80,13 @@ export const make = Effect.gen(function* () {
   ) {
     const checkedAt = DateTime.formatIso(yield* DateTime.now);
     const base = { id, kind: config.kind, label: sourceLabel(id, config), checkedAt } as const;
-    if (config.managementKey.length === 0) {
-      return { ...base, accounts: [], error: "No management key configured." };
+    const managementKey = yield* readManagementKey(config);
+    if (managementKey.length === 0) {
+      return { ...base, accounts: [], error: missingManagementKey(config) };
     }
-    const accounts = yield* api.readAccounts(config).pipe(Effect.result);
+    const accounts = yield* api
+      .readAccounts({ url: config.url, managementKey })
+      .pipe(Effect.result);
     if (accounts._tag === "Failure") {
       yield* Effect.logDebug("usage limit source read failed", { id, cause: accounts.failure });
       return { ...base, accounts: [], error: accounts.failure.detail };
@@ -108,12 +128,20 @@ export const make = Effect.gen(function* () {
       Effect.mapError(() => new UsageLimitSourceError({ detail: "Could not read hub settings." })),
     );
     const config = settings.usageLimitSources[input.sourceId];
-    if (!config?.enabled || !config.managementKey) {
+    if (!config?.enabled) {
       return yield* new UsageLimitSourceError({
         detail: "The usage limit source is missing or disabled.",
       });
     }
-    const result = yield* api.consume(config, input.accountId, input.creditId);
+    const managementKey = yield* readManagementKey(config);
+    if (managementKey.length === 0) {
+      return yield* new UsageLimitSourceError({ detail: missingManagementKey(config) });
+    }
+    const result = yield* api.consume(
+      { url: config.url, managementKey },
+      input.accountId,
+      input.creditId,
+    );
     const snapshot = yield* readSource(input.sourceId, config);
     const previous = yield* Ref.get(stateRef);
     yield* publish(previous.map((source) => (source.id === input.sourceId ? snapshot : source)));
@@ -167,4 +195,6 @@ export const make = Effect.gen(function* () {
   } satisfies UsageLimitSources["Service"];
 });
 
-export const layer = Layer.effect(UsageLimitSources, make);
+export const layer = Layer.effect(UsageLimitSources, make).pipe(
+  Layer.provide(SecretResolverLayer.layer),
+);
diff --git a/apps/server/src/usage/cliproxyApi.ts b/apps/server/src/usage/cliproxyApi.ts
index daa1ea909f034..4fb59d041c3d3 100644
--- a/apps/server/src/usage/cliproxyApi.ts
+++ b/apps/server/src/usage/cliproxyApi.ts
@@ -18,6 +18,12 @@ import { codexRateLimitsToLimits } from "../provider/codexUsageLimits.ts";
 import { claudeUsageResponseToLimits } from "../provider/claudeUsageLimits.ts";
 import { makeUnavailableUsageLimits } from "@t3tools/provider-core/server/usageLimits";
 
+/** A hub with its management key already read from wherever the setting keeps it. */
+export interface CliproxyHub {
+  readonly url: UsageLimitSourceConfig["url"];
+  readonly managementKey: string;
+}
+
 const AuthFile = Schema.Struct({
   id: Schema.String,
   auth_index: Schema.String,
@@ -173,7 +179,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
   const digest = yield* Digest.Digest;
 
   const management = Effect.fn("CliproxyApi.management")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
     path: string,
     body?: unknown,
   ) {
@@ -181,13 +187,13 @@ export const makeCliproxyApi = Effect.gen(function* () {
       try: () =>
         new URL(
           `v0/management/${path}`,
-          config.url.endsWith("/") ? config.url : `${config.url}/`,
+          hub.url.endsWith("/") ? hub.url : `${hub.url}/`,
         ).toString(),
       catch: () => new UsageLimitSourceError({ detail: "The hub URL is not valid." }),
     });
     const request = (
       body === undefined ? HttpClientRequest.get(url) : HttpClientRequest.post(url)
-    ).pipe(HttpClientRequest.setHeader("Authorization", `Bearer ${config.managementKey}`));
+    ).pipe(HttpClientRequest.setHeader("Authorization", `Bearer ${hub.managementKey}`));
     const response = yield* client
       .execute(body === undefined ? request : request.pipe(HttpClientRequest.bodyJsonUnsafe(body)))
       .pipe(
@@ -201,13 +207,13 @@ export const makeCliproxyApi = Effect.gen(function* () {
     return response;
   });
 
-  const authFiles = Effect.fn("CliproxyApi.authFiles")(function* (config: UsageLimitSourceConfig) {
-    const response = yield* management(config, "auth-files");
+  const authFiles = Effect.fn("CliproxyApi.authFiles")(function* (hub: CliproxyHub) {
+    const response = yield* management(hub, "auth-files");
     return (yield* decodeAuthFiles(response)).files;
   });
 
   const apiCall = Effect.fn("CliproxyApi.apiCall")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
     account: typeof AuthFile.Type,
     url: string,
     data?: unknown,
@@ -229,7 +235,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
             // The OAuth usage endpoint can return 429 without a Claude Code user agent.
             "User-Agent": "claude-code/2.1.273",
           };
-    const raw = yield* management(config, "api-call", {
+    const raw = yield* management(hub, "api-call", {
       auth_index: account.auth_index,
       method: data === undefined ? "GET" : "POST",
       url,
@@ -246,10 +252,10 @@ export const makeCliproxyApi = Effect.gen(function* () {
   });
 
   const credits = Effect.fn("CliproxyApi.credits")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
     account: typeof AuthFile.Type,
   ) {
-    const body = yield* apiCall(config, account, CREDIT_URL);
+    const body = yield* apiCall(hub, account, CREDIT_URL);
     const response = yield* decodeCreditList(body);
     const now = DateTime.toEpochMillis(yield* DateTime.now);
     return response.credits
@@ -263,7 +269,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
   });
 
   const readAccount = Effect.fn("CliproxyApi.readAccount")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
     account: typeof AuthFile.Type,
   ) {
     const checkedAt = DateTime.formatIso(yield* DateTime.now);
@@ -277,7 +283,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
     };
     const read = Effect.gen(function* () {
       if (account.provider === "claude") {
-        const body = yield* apiCall(config, account, "https://api.anthropic.com/api/oauth/usage");
+        const body = yield* apiCall(hub, account, "https://api.anthropic.com/api/oauth/usage");
         const usage = yield* decodeClaudeUsage(body);
         const model_scoped = (usage.limits ?? []).flatMap((limit) =>
           limit.kind === "weekly_scoped" && limit.scope?.model && typeof limit.percent === "number"
@@ -309,7 +315,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
           }).limits,
         };
       }
-      const body = yield* apiCall(config, account, `${CODEX_BASE}/usage`);
+      const body = yield* apiCall(hub, account, `${CODEX_BASE}/usage`);
       const usage = yield* decodeCodexUsage(body);
       const toWindow = (window: typeof CodexWindow.Type | null | undefined) =>
         window
@@ -321,7 +327,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
                 : { windowDurationMins: window.limit_window_seconds / 60 }),
             }
           : null;
-      const available = yield* credits(config, account).pipe(Effect.orElseSucceed(() => undefined));
+      const available = yield* credits(hub, account).pipe(Effect.orElseSucceed(() => undefined));
       const next = available?.[0];
       const planType =
         usage.plan_type ?? account.id_token?.plan_type ?? account.id_token?.chatgpt_plan_type;
@@ -366,9 +372,9 @@ export const makeCliproxyApi = Effect.gen(function* () {
   });
 
   const readAccounts = Effect.fn("CliproxyApi.readAccounts")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
   ): Effect.fn.Return<ReadonlyArray<UsageLimitSourceAccount>, UsageLimitSourceError> {
-    const accounts = yield* authFiles(config).pipe(
+    const accounts = yield* authFiles(hub).pipe(
       Effect.mapError((error) =>
         isUsageLimitSourceError(error)
           ? error
@@ -380,24 +386,24 @@ export const makeCliproxyApi = Effect.gen(function* () {
         (account) =>
           !account.disabled && (account.provider === "codex" || account.provider === "claude"),
       ),
-      (account) => readAccount(config, account),
+      (account) => readAccount(hub, account),
       { concurrency: 4 },
     );
   });
 
   const consume = Effect.fn("CliproxyApi.consume")(function* (
-    config: UsageLimitSourceConfig,
+    hub: CliproxyHub,
     accountId: string,
     creditId: string,
   ): Effect.fn.Return<ProviderConsumeResetCreditResult, UsageLimitSourceError> {
     const operation = Effect.gen(function* () {
-      const account = (yield* authFiles(config)).find((account) => account.id === accountId);
+      const account = (yield* authFiles(hub)).find((account) => account.id === accountId);
       if (!account || account.disabled || account.provider !== "codex") {
         return yield* new UsageLimitSourceError({
           detail: "The Codex hub account is missing or disabled.",
         });
       }
-      const body = yield* apiCall(config, account, `${CREDIT_URL}/consume`, {
+      const body = yield* apiCall(hub, account, `${CREDIT_URL}/consume`, {
         redeem_request_id: yield* creditRedeemRequestId(
           account.id_token?.chatgpt_account_id ?? account.id,
           creditId,
@@ -414,7 +420,7 @@ export const makeCliproxyApi = Effect.gen(function* () {
         } as const
       )[response.code];
       if (outcome !== "reset" && outcome !== "alreadyRedeemed") return { outcome };
-      const cleared = yield* management(config, "reset-quota", {
+      const cleared = yield* management(hub, "reset-quota", {
         auth_index: account.auth_index,
       }).pipe(Effect.result);
       return {
diff --git a/apps/server/src/ws.test.ts b/apps/server/src/ws.test.ts
index 4583d3f153054..d1d0d36414ab8 100644
--- a/apps/server/src/ws.test.ts
+++ b/apps/server/src/ws.test.ts
@@ -886,6 +886,7 @@ it.effect.each([
             {},
             yield* ServerBrowser.ServerBrowser,
             () => Effect.void,
+            { secretReferences: true },
           ).pipe(Layer.provide(configRpcServices)),
         ),
       );
@@ -930,8 +931,8 @@ it.effect.each([
         key: "mod+alt+z",
         command: "terminal.split",
       });
-      const expectedSettings = [duringDiscovery, latestSettings].map(
-        ServerSettings.redactServerSettingsForClient,
+      const expectedSettings = [duringDiscovery, latestSettings].map((value) =>
+        ServerSettings.redactServerSettingsForClient(value, { secretReferences: true }),
       );
       const expectedKeybindings = [duringAck.keybindings, latestKeybindings.keybindings];
       // The two sources can interleave, but each must retain its own publication order.
@@ -959,7 +960,7 @@ it.effect.each([
         assert.deepEqual(resolved.config.remoteOpenTargets, targets);
         assert.deepEqual(
           resolved.config.settings,
-          ServerSettings.redactServerSettingsForClient(latestSettings),
+          ServerSettings.redactServerSettingsForClient(latestSettings, { secretReferences: true }),
         );
         assert.deepEqual(resolved.config.keybindings, latestKeybindings.keybindings);
         yield* acknowledge;
@@ -974,7 +975,9 @@ it.effect.each([
           assert.deepEqual(resolved.config.directEndpoints, endpoints);
           assert.deepEqual(
             resolved.config.settings,
-            ServerSettings.redactServerSettingsForClient(latestSettings),
+            ServerSettings.redactServerSettingsForClient(latestSettings, {
+              secretReferences: true,
+            }),
           );
           assert.deepEqual(resolved.config.keybindings, latestKeybindings.keybindings);
           yield* acknowledge;
@@ -1104,6 +1107,7 @@ it.effect("on-demand clients get provider config without workspace snapshots", (
           {},
           yield* ServerBrowser.ServerBrowser,
           () => Effect.void,
+          { secretReferences: true },
         ).pipe(Layer.provide(configRpcServices)),
       ),
     );
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 06682ff4ae4c5..2bd0acc22b8c3 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -55,6 +55,8 @@ import {
   OrchestrationGetTurnDiffError,
   ORCHESTRATION_V2_WS_METHODS,
   ORCHESTRATION_PROTOCOL_QUERY_PARAM,
+  CLIENT_CAPABILITIES_QUERY_PARAM,
+  SETTINGS_SECRET_REFERENCES_CAPABILITY,
   ORCHESTRATION_PROTOCOL_VERSION,
   OrchestrationV2DispatchCommandError,
   OrchestrationV2GetShellSnapshotError,
@@ -695,6 +697,11 @@ function hasCompatibleOrchestrationProtocol(url: URL): boolean {
   );
 }
 
+function readSettingsClient(url: URL) {
+  const capabilities = url.searchParams.get(CLIENT_CAPABILITIES_QUERY_PARAM)?.split(",") ?? [];
+  return { secretReferences: capabilities.includes(SETTINGS_SECRET_REFERENCES_CAPABILITY) };
+}
+
 function shouldUseBoundedThreadSnapshot(input: {
   readonly acceptBoundedSnapshot?: boolean;
   readonly acceptDeferredWork?: boolean;
@@ -1341,6 +1348,7 @@ export const layerWsRpc = (
   clientAnalyticsProps: Readonly<Record<string, unknown>>,
   serverBrowser: ServerBrowser.ServerBrowser["Service"],
   reportProfiles: ServerBrowser.ProfileReporter,
+  settingsClient: { readonly secretReferences: boolean },
 ) =>
   Layer.effectContext(
     Effect.gen(function* () {
@@ -1854,6 +1862,7 @@ export const layerWsRpc = (
           : commandProviders;
         const settings = ServerSettings.redactServerSettingsForClient(
           yield* serverSettings.getSettings,
+          settingsClient,
         );
         const environment = yield* serverEnvironment.getDescriptor;
         const auth = yield* serverAuth.getDescriptor();
@@ -2415,13 +2424,13 @@ export const layerWsRpc = (
                 fresh: input.fresh,
               });
             }
+            if (input.reloadSecrets === true && input.instanceId === undefined) {
+              yield* invalidateSettingsSecrets(secretResolver, serverSettings.getSettings);
+            }
             // Await refresh; RPC scope closure would interrupt a fork before the hub answered.
             if (input.instanceId === undefined) {
               yield* usageLimitSources.refresh;
             }
-            if (input.reloadSecrets === true && input.instanceId === undefined) {
-              yield* invalidateSettingsSecrets(secretResolver, serverSettings.getSettings);
-            }
             let providers = yield* input.cwd !== undefined && input.instanceId !== undefined
               ? providerRegistry.refreshWorkspaceSnapshot({
                   instanceId: input.instanceId,
@@ -2629,7 +2638,7 @@ export const layerWsRpc = (
             const settings = yield* providerInstanceMutation === undefined
               ? serverSettings.updateSettings(nextPatch)
               : serverSettings.updateProviderInstance(providerInstanceMutation, nextPatch);
-            return ServerSettings.redactServerSettingsForClient(settings);
+            return ServerSettings.redactServerSettingsForClient(settings, settingsClient);
           }),
         [WS_METHODS.serverDiscoverSourceControl]: (_input) => sourceControlDiscovery.discover,
         [WS_METHODS.serverGetTraceDiagnostics]: (_input) =>
@@ -3288,7 +3297,9 @@ export const layerWsRpc = (
                     )
                   : Stream.empty;
               const settingsUpdates = settingsChanges.pipe(
-                Stream.map((settings) => ServerSettings.redactServerSettingsForClient(settings)),
+                Stream.map((settings) =>
+                  ServerSettings.redactServerSettingsForClient(settings, settingsClient),
+                ),
                 Stream.map((settings) => ({
                   version: 1 as const,
                   type: "settingsUpdated" as const,
@@ -3475,7 +3486,13 @@ export const layer = Layer.unwrap(
           return httpEffect;
         }).pipe(
           Effect.provide(
-            layerWsRpc(session, clientAnalyticsProps, serverBrowser, reportProfiles).pipe(
+            layerWsRpc(
+              session,
+              clientAnalyticsProps,
+              serverBrowser,
+              reportProfiles,
+              readSettingsClient(url.value),
+            ).pipe(
               Layer.provideMerge(RpcSerialization.layerJson),
               // Handler-context reporters see only request defects, not server-wide defects.
               Layer.provide(DefectReporter.layer),
diff --git a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
index e3abd8b951067..12b9bbe820869 100644
--- a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
+++ b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
@@ -1,4 +1,4 @@
-import type { EnvironmentId, UnifiedSettings } from "@t3tools/contracts";
+import type { EnvironmentId, SecretReference, UnifiedSettings } from "@t3tools/contracts";
 import { useState } from "react";
 
 import { useUpdateEnvironmentSettings } from "../../hooks/useSettings";
@@ -14,7 +14,7 @@ import {
 } from "../ui/dialog";
 import { Input } from "../ui/input";
 import { sourceIdFromUrl } from "./AddUsageLimitSourceDialog.logic";
-import { SecretInput } from "./SecretInput";
+import { SecretSourceInput, useSecretSources } from "./SecretSourceInput";
 import { Label } from "../ui/label";
 
 /** Send the management key once to server secret storage; settings retain only a redaction marker. */
@@ -34,14 +34,16 @@ export function AddUsageLimitSourceDialog({
   const updateSettings = useUpdateEnvironmentSettings(environmentId);
   const [label, setLabel] = useState("");
   const [url, setUrl] = useState("");
-  const [managementKey, setManagementKey] = useState("");
+  const secretSources = useSecretSources(environmentId);
+  const [keyDraft, setKeyDraft] = useState<string | SecretReference>("");
+  const managementKey = typeof keyDraft === "string" ? keyDraft.trim() : keyDraft;
   const trimmedUrl = url.trim();
-  const canSave = trimmedUrl.length > 0 && managementKey.trim().length > 0;
+  const canSave = trimmedUrl.length > 0 && managementKey !== "";
 
   const reset = () => {
     setLabel("");
     setUrl("");
-    setManagementKey("");
+    setKeyDraft("");
   };
 
   const save = () => {
@@ -53,7 +55,7 @@ export function AddUsageLimitSourceDialog({
           kind: "cliproxy",
           ...(label.trim() ? { label: label.trim() } : {}),
           url: trimmedUrl,
-          managementKey: managementKey.trim(),
+          managementKey,
           enabled: true,
         },
       },
@@ -98,10 +100,15 @@ export function AddUsageLimitSourceDialog({
             </div>
             <div className="grid gap-1.5">
               <Label htmlFor="usage-source-key">Management key</Label>
-              <SecretInput
+              <SecretSourceInput
                 id="usage-source-key"
-                value={managementKey}
-                onChange={(event) => setManagementKey(event.target.value)}
+                aria-label="Management key"
+                value={keyDraft}
+                sources={secretSources}
+                onChange={(event) => setKeyDraft(event.target.value)}
+                onSecretChange={(secret) => setKeyDraft(secret ?? "")}
+                onProviderPick={() => setKeyDraft("")}
+                onReferenceReject={() => setKeyDraft("")}
               />
             </div>
             <div className="grid gap-1.5">
diff --git a/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
index e1b67465c2168..18ff271e97974 100644
--- a/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
+++ b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
@@ -23,6 +23,7 @@ async function commitReference(screen: Screen, value: string) {
 describe("SecretSourceInput", () => {
   it("moves a reference to another provider only once one is committed for it", async () => {
     const onSecretChange = vi.fn();
+    const onProviderPick = vi.fn();
     await using screen = await render(
       <SecretSourceInput
         aria-label="API key"
@@ -30,12 +31,14 @@ describe("SecretSourceInput", () => {
         sources={sources}
         onCommit={() => {}}
         onSecretChange={onSecretChange}
+        onProviderPick={onProviderPick}
       />,
     );
 
     await userEvent.click(screen.getByRole("combobox", { name: "API key source" }));
     await userEvent.click(screen.getByRole("option", { name: "Work" }));
     expect(onSecretChange).not.toHaveBeenCalled();
+    expect(onProviderPick).toHaveBeenCalledOnce();
     await expect.element(reference(screen)).toHaveValue("");
 
     await commitReference(screen, "op://Shared/OpenAI/credential");
@@ -57,6 +60,8 @@ describe("SecretSourceInput", () => {
       />,
     );
 
+    await commitReference(screen, "invalid-reference");
+    await expect.element(reference(screen)).toHaveAttribute("aria-invalid", "true");
     await userEvent.clear(reference(screen));
     await userEvent.keyboard("{Enter}");
     expect(onSecretChange).toHaveBeenCalledExactlyOnceWith(undefined);
@@ -64,6 +69,7 @@ describe("SecretSourceInput", () => {
 
   it("rejects a reference 1Password cannot read", async () => {
     const onSecretChange = vi.fn();
+    const onReferenceReject = vi.fn();
     await using screen = await render(
       <SecretSourceInput
         aria-label="API key"
@@ -71,12 +77,29 @@ describe("SecretSourceInput", () => {
         sources={sources}
         onCommit={() => {}}
         onSecretChange={onSecretChange}
+        onReferenceReject={onReferenceReject}
       />,
     );
 
     await commitReference(screen, "Private/OpenAI/credential");
     expect(onSecretChange).not.toHaveBeenCalled();
+    expect(onReferenceReject).toHaveBeenCalledOnce();
+    await screen.rerender(
+      <SecretSourceInput
+        aria-label="API key"
+        value=""
+        sources={sources}
+        onCommit={() => {}}
+        onSecretChange={onSecretChange}
+        onReferenceReject={onReferenceReject}
+      />,
+    );
     await expect.element(reference(screen)).toHaveAttribute("aria-invalid", "true");
     await expect.element(reference(screen)).toHaveValue("Private/OpenAI/credential");
+    await commitReference(screen, "op://Private/OpenAI/corrected");
+    expect(onSecretChange).toHaveBeenCalledExactlyOnceWith({
+      provider: personal,
+      reference: "op://Private/OpenAI/corrected",
+    });
   });
 });
diff --git a/apps/web/src/components/settings/SecretSourceInput.tsx b/apps/web/src/components/settings/SecretSourceInput.tsx
index 2fed001b09e91..83ca9ad2ced71 100644
--- a/apps/web/src/components/settings/SecretSourceInput.tsx
+++ b/apps/web/src/components/settings/SecretSourceInput.tsx
@@ -64,6 +64,10 @@ type SecretSourceInputProps = Omit<ComponentProps<typeof SecretInput>, "value" |
   readonly value: string | SecretReference;
   readonly sources: ReadonlyArray<SecretSource>;
   readonly onSecretChange: (secret: SecretReference | undefined) => void;
+  /** Called when a provider is picked, before a reference for it exists. */
+  readonly onProviderPick?: () => void;
+  /** Called when an edited reference is rejected, so the committed one no longer matches the field. */
+  readonly onReferenceReject?: () => void;
   /** Places the parts in the caller's layout; `source` is null when there is nothing to pick. */
   readonly children?: (parts: {
     readonly source: ReactNode;
@@ -76,6 +80,8 @@ export function SecretSourceInput({
   value,
   sources,
   onSecretChange,
+  onProviderPick,
+  onReferenceReject,
   children,
   ...rest
 }: SecretSourceInputProps) {
@@ -106,6 +112,7 @@ export function SecretSourceInput({
             return;
           }
           const next = value as SecretProviderId;
+          if (next !== secret?.provider) onProviderPick?.();
           setPendingProvider(next === secret?.provider ? null : next);
         }}
       >
@@ -159,6 +166,8 @@ export function SecretSourceInput({
               definition?.isReference(decoded.value.reference) === false
             ) {
               setRejectedReference(next);
+              if (onReferenceReject !== undefined) setPendingProvider(provider);
+              onReferenceReject?.();
               return;
             }
             setRejectedReference(null);
diff --git a/packages/client-runtime/src/connection/compatibility.test.ts b/packages/client-runtime/src/connection/compatibility.test.ts
index 3f9dc8f992454..239aed398d77a 100644
--- a/packages/client-runtime/src/connection/compatibility.test.ts
+++ b/packages/client-runtime/src/connection/compatibility.test.ts
@@ -31,6 +31,7 @@ describe("orchestration protocol compatibility", () => {
     expect(socketUrl.searchParams.get("orchestrationProtocol")).toBe(
       String(ORCHESTRATION_PROTOCOL_VERSION),
     );
+    expect(socketUrl.searchParams.get("clientCapabilities")).toBe("settingsSecretReferences");
     expect(socketUrl.searchParams.get("wsTicket")).toBe("secret");
     expect(socketUrl.searchParams.get("connectionMethod")).toBe("relay");
   });
diff --git a/packages/client-runtime/src/connection/compatibility.ts b/packages/client-runtime/src/connection/compatibility.ts
index 3ca2e226db954..fccc68bff751e 100644
--- a/packages/client-runtime/src/connection/compatibility.ts
+++ b/packages/client-runtime/src/connection/compatibility.ts
@@ -1,6 +1,8 @@
 import {
+  CLIENT_CAPABILITIES_QUERY_PARAM,
   ORCHESTRATION_PROTOCOL_QUERY_PARAM,
   ORCHESTRATION_PROTOCOL_VERSION,
+  SETTINGS_SECRET_REFERENCES_CAPABILITY,
   type ExecutionEnvironmentDescriptor,
 } from "@t3tools/contracts";
 
@@ -37,5 +39,6 @@ function canSelfUpdate(descriptor: ExecutionEnvironmentDescriptor): boolean {
 export function appendOrchestrationProtocol(socketUrl: string): string {
   const url = new URL(socketUrl);
   url.searchParams.set(ORCHESTRATION_PROTOCOL_QUERY_PARAM, String(ORCHESTRATION_PROTOCOL_VERSION));
+  url.searchParams.set(CLIENT_CAPABILITIES_QUERY_PARAM, SETTINGS_SECRET_REFERENCES_CAPABILITY);
   return url.toString();
 }
diff --git a/packages/client-runtime/src/connection/resolver.test.ts b/packages/client-runtime/src/connection/resolver.test.ts
index b70b2ef17615f..82a2aafa00140 100644
--- a/packages/client-runtime/src/connection/resolver.test.ts
+++ b/packages/client-runtime/src/connection/resolver.test.ts
@@ -202,7 +202,7 @@ describe("ConnectionResolver", () => {
         label: "Primary",
         httpBaseUrl: "http://127.0.0.1:3777",
         socketUrl:
-          "ws://127.0.0.1:3777/ws?clientSurface=web&clientDeviceType=desktop&connectionMethod=direct&orchestrationProtocol=2",
+          "ws://127.0.0.1:3777/ws?clientSurface=web&clientDeviceType=desktop&connectionMethod=direct&orchestrationProtocol=2&clientCapabilities=settingsSecretReferences",
         httpAuthorization: null,
         target,
       });
diff --git a/packages/contracts/src/environment.ts b/packages/contracts/src/environment.ts
index f9cd98311d19d..9ac89ef499b3f 100644
--- a/packages/contracts/src/environment.ts
+++ b/packages/contracts/src/environment.ts
@@ -15,6 +15,11 @@ export const ORCHESTRATION_PROTOCOL_VERSION_TEXT = "2";
 export const ORCHESTRATION_PROTOCOL_QUERY_PARAM = "orchestrationProtocol";
 export const ORCHESTRATION_PROTOCOL_HEADER = "x-t3-orchestration-protocol";
 
+/** Wire shapes a client understands, comma-separated; a client that omits one gets the older shape. */
+export const CLIENT_CAPABILITIES_QUERY_PARAM = "clientCapabilities";
+/** Secret fields may hold a secret provider reference instead of a string. */
+export const SETTINGS_SECRET_REFERENCES_CAPABILITY = "settingsSecretReferences";
+
 export const ExecutionEnvironmentPlatformOs = Schema.Literals([
   "darwin",
   "linux",
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index cf8e6effe0570..7f6e8a4aea8dd 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -22,6 +22,7 @@ import {
 import { UsageLimitSourceId } from "./usageLimitSourceId.ts";
 import { UsageModelFilter } from "./usage.ts";
 import { SecretProviderId, SecretProviderSlug } from "./secretReference.ts";
+import { SettingsSecretValue } from "./settingsSecretValue.ts";
 import { EnvironmentMachineKind, ThreadEnvMode, WorktreeSubmodules } from "./environment.ts";
 import { KeybindingShortcut } from "./keybindings.ts";
 import {
@@ -858,7 +859,10 @@ export const UsageLimitSourceConfig = Schema.Struct({
   kind: Schema.Literal("cliproxy"),
   label: Schema.optional(TrimmedNonEmptyString),
   url: TrimmedNonEmptyString,
-  managementKey: TrimmedString.pipe(Schema.withDecodingDefault(Effect.succeed("")), secretSetting),
+  managementKey: SettingsSecretValue.pipe(
+    Schema.withDecodingDefault(Effect.succeed("")),
+    secretSetting,
+  ),
   enabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(true))),
 });
 export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;

From bd3cc5c22886f2dfb3b20eedbcfbbbbab67e466d Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Tue, 3 Nov 2026 16:15:23 -0500
Subject: [PATCH 050/167] feat(device): read the EAS access token from a secret
 provider (#27763)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/device/DeviceService.test.ts  | 14 +++-
 apps/server/src/device/DeviceService.ts       | 15 +++-
 apps/server/src/device/EasDeviceHost.test.ts  | 78 ++++++++++++++++++-
 apps/server/src/device/EasDeviceHost.ts       | 34 ++++++--
 .../server/src/secrets/settingsSecretValue.ts | 35 ++++++++-
 apps/server/src/serverSettings.test.ts        | 19 +++++
 .../sourceControlHostSecrets.test.ts          | 17 +++-
 .../sourceControl/sourceControlHostSecrets.ts | 11 ++-
 .../src/usage/UsageLimitSources.test.ts       |  8 +-
 .../settings/AddUsageLimitSourceDialog.tsx    |  7 +-
 .../settings/EasDeviceHostEditor.tsx          | 46 ++++++++---
 .../SecretSourceInput.browser.test.tsx        | 28 +++----
 .../components/settings/SecretSourceInput.tsx | 17 ++--
 packages/contracts/src/device.ts              | 11 +--
 14 files changed, 277 insertions(+), 63 deletions(-)

diff --git a/apps/server/src/device/DeviceService.test.ts b/apps/server/src/device/DeviceService.test.ts
index 8c7b400a2c5de..a551ffdf5a875 100644
--- a/apps/server/src/device/DeviceService.test.ts
+++ b/apps/server/src/device/DeviceService.test.ts
@@ -18,6 +18,7 @@ import * as Exit from "effect/Exit";
 import * as Deferred from "effect/Deferred";
 import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as PubSub from "effect/PubSub";
@@ -534,6 +535,11 @@ describe("device setup consent", () => {
   );
 });
 
+const layerSecretResolver = Layer.succeed(SecretResolver.SecretResolver, {
+  read: (references) => Effect.succeed(references.map(() => undefined)),
+  invalidate: () => Effect.void,
+});
+
 it.effect("publishes boot progress and does not restore sessions after support is disabled", () =>
   Effect.gen(function* () {
     const started = yield* Deferred.make<void>();
@@ -1437,7 +1443,12 @@ it.effect("reconciles SSH host settings without publishing no-op changes", () =>
   }).pipe(
     Effect.scoped,
     Effect.provide(
-      Layer.mergeAll(ServerSettings.layerTest(), NodeServices.layer, NodeCrypto.layer),
+      Layer.mergeAll(
+        ServerSettings.layerTest(),
+        layerSecretResolver,
+        NodeServices.layer,
+        NodeCrypto.layer,
+      ),
     ),
   ),
 );
@@ -1496,6 +1507,7 @@ it.effect("a failed tool update reports npm's exit code but not its output", ()
     Effect.provide(
       Layer.mergeAll(
         ServerSettings.layerTest({ enableDeviceSupport: true }),
+        layerSecretResolver,
         ServerConfig.layerTest(process.cwd(), { prefix: "t3-device-update-" }),
         NodeCrypto.layer,
         NetService.layer,
diff --git a/apps/server/src/device/DeviceService.ts b/apps/server/src/device/DeviceService.ts
index 2f6df7dace573..b18cf8a516a98 100644
--- a/apps/server/src/device/DeviceService.ts
+++ b/apps/server/src/device/DeviceService.ts
@@ -68,12 +68,14 @@ import { isLocalSshDeviceHost, remoteSshDeviceHosts } from "./localSshDeviceHost
 
 import { readDeviceDetail, runDeviceAction } from "./DeviceActions.ts";
 import * as ProcessRunner from "../processRunner.ts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import * as SecretResolverLayer from "../secrets/SecretResolver.ts";
 import * as DeviceHost from "./DeviceHost.ts";
 import * as SshDeviceHost from "./SshDeviceHost.ts";
 import * as EasDeviceHost from "./EasDeviceHost.ts";
 import * as SimlockDeviceHost from "./SimlockDeviceHost.ts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
-import { makeExpoApi, resolveExpoCredential } from "./ExpoApi.ts";
+import { makeExpoApi } from "./ExpoApi.ts";
 import * as Exit from "effect/Exit";
 import * as LocalDeviceHost from "./LocalDeviceHost.ts";
 
@@ -1220,6 +1222,7 @@ export const make = Effect.gen(function* () {
   const path = yield* Path.Path;
   const runner = yield* ProcessRunner.ProcessRunner;
   const settings = yield* ServerSettings.ServerSettingsService;
+  const secrets = yield* SecretResolver.SecretResolver;
   const scope = yield* Scope.Scope;
   const hosts = new Map<DeviceHostId, DeviceHost.DeviceHost["Service"]>([
     [localHost.id, localHost],
@@ -1537,7 +1540,10 @@ export const make = Effect.gen(function* () {
           ? ""
           : ((yield* settings.getSettings).easDeviceHosts.find((host) => host.id === input.hostId)
               ?.accessToken ?? "");
-      const credential = yield* resolveExpoCredential(input.accessToken ?? saved);
+      const credential = yield* EasDeviceHost.resolveSavedExpoCredential(
+        secrets,
+        input.accessToken ?? saved,
+      );
       const viewer = yield* makeExpoApi(yield* HttpClient.HttpClient, credential).viewer;
       return { signedInAs: viewer.name, credentialSource: credential.source, apps: viewer.apps };
     },
@@ -1618,7 +1624,10 @@ export const make = Effect.gen(function* () {
   };
 });
 
-export const layer = Layer.effect(DeviceService, make).pipe(Layer.provide(LocalDeviceHost.layer));
+export const layer = Layer.effect(DeviceService, make).pipe(
+  Layer.provide(LocalDeviceHost.layer),
+  Layer.provide(SecretResolverLayer.layer),
+);
 
 export const stateStream = (service: DeviceService["Service"]): Stream.Stream<DeviceServiceState> =>
   Stream.unwrap(
diff --git a/apps/server/src/device/EasDeviceHost.test.ts b/apps/server/src/device/EasDeviceHost.test.ts
index b5825d3f973e7..47d74e65b4743 100644
--- a/apps/server/src/device/EasDeviceHost.test.ts
+++ b/apps/server/src/device/EasDeviceHost.test.ts
@@ -1,8 +1,8 @@
 import { describe, expect, it } from "@effect/vitest";
 import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { type EasDeviceHostConfig, ThreadId } from "@t3tools/contracts";
-import * as HostProcess from "@t3tools/shared/HostProcess";
+import { type EasDeviceHostConfig, SecretProviderId, ThreadId } from "@t3tools/contracts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
@@ -13,6 +13,7 @@ import * as Path from "effect/Path";
 import * as Scope from "effect/Scope";
 import * as TestClock from "effect/testing/TestClock";
 import { HttpClient, HttpClientResponse } from "effect/http";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 
 import * as ServerConfig from "../config.ts";
 import * as ProcessRunner from "../processRunner.ts";
@@ -228,9 +229,24 @@ const fakeExpo = (
   return { http, named, stopped, allowPreview, allowCreate, releases, previews };
 };
 
+const makeSecretResolver = (values: Record<string, string> = {}) =>
+  Layer.succeed(SecretResolver.SecretResolver, {
+    read: (references) =>
+      Effect.succeed(references.map((reference) => values[reference.reference])),
+    invalidate: () => Effect.void,
+  });
+
+const layerWith = (secrets: Layer.Layer<SecretResolver.SecretResolver>) =>
+  Layer.mergeAll(
+    ProcessRunner.layer,
+    ServerConfig.layerTest(process.cwd(), { prefix: "t3-eas-host-" }),
+    secrets,
+  ).pipe(Layer.provideMerge(NodeServices.layer));
+
 const layer = Layer.mergeAll(
   ProcessRunner.layer,
   ServerConfig.layerTest(process.cwd(), { prefix: "t3-eas-host-" }),
+  makeSecretResolver(),
 ).pipe(Layer.provideMerge(NodeServices.layer));
 
 const makeHost = (
@@ -299,6 +315,64 @@ describe("EAS Simulator host", () => {
     }).pipe(Effect.scoped, Effect.provide(layer)),
   );
 
+  it.effect("reads its token from the secret provider the setting names", () =>
+    Effect.gen(function* () {
+      const expo = fakeExpo();
+      const source = { provider: SecretProviderId.make("homelab"), reference: "expo#token" };
+      const host = yield* makeHost(expo, config({ accessToken: source }), yield* Scope.make());
+      const ready = yield* host.ensureReady(() => Effect.void);
+      const [catalogDevice] = (yield* ready.devices.list).devices;
+      expect(yield* ready.devices.boot(catalogDevice!)).toBe("session-1");
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(layerWith(makeSecretResolver({ "expo#token": "expo-token" }))),
+    ),
+  );
+
+  it.effect("fails instead of using another Expo login when its secret cannot be read", () =>
+    Effect.gen(function* () {
+      const expo = fakeExpo();
+      const source = { provider: SecretProviderId.make("homelab"), reference: "expo#token" };
+      const host = yield* makeHost(expo, config({ accessToken: source }), yield* Scope.make()).pipe(
+        Effect.provideService(HostProcess.Environment, { EXPO_TOKEN: "expo-token" }),
+      );
+      const ready = yield* host.ensureReady(() => Effect.void);
+      const [catalogDevice] = (yield* ready.devices.list).devices;
+      const failure = yield* ready.devices.boot(catalogDevice!).pipe(Effect.flip);
+      expect(failure.message).toContain('secret provider "homelab"');
+      expect(expo.named("T3CreateEasSimulatorSession")).toHaveLength(0);
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
+  it.effect("still stops its sessions when the secret becomes unreadable after they start", () => {
+    const readable = { value: true };
+    return Effect.gen(function* () {
+      const expo = fakeExpo();
+      const source = { provider: SecretProviderId.make("homelab"), reference: "expo#token" };
+      const scope = yield* Scope.make();
+      const host = yield* makeHost(expo, config({ accessToken: source }), scope);
+      const ready = yield* host.ensureReady(() => Effect.void);
+      const [catalogDevice] = (yield* ready.devices.list).devices;
+      expect(yield* ready.devices.boot(catalogDevice!)).toBe("session-1");
+
+      readable.value = false;
+      yield* ready.devices.shutdown({ ...catalogDevice!, id: "session-1" });
+      expect(expo.stopped()).toEqual(["session-1"]);
+      yield* Scope.close(scope, Exit.void);
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        layerWith(
+          Layer.succeed(SecretResolver.SecretResolver, {
+            read: (references) =>
+              Effect.succeed(references.map(() => (readable.value ? "expo-token" : undefined))),
+            invalidate: () => Effect.void,
+          }),
+        ),
+      ),
+    );
+  });
+
   it.effect("runs an Android session through serve-emu beside an iOS one", () =>
     Effect.gen(function* () {
       const expo = fakeExpo();
diff --git a/apps/server/src/device/EasDeviceHost.ts b/apps/server/src/device/EasDeviceHost.ts
index e82638dbd76fa..719cfbf435a8a 100644
--- a/apps/server/src/device/EasDeviceHost.ts
+++ b/apps/server/src/device/EasDeviceHost.ts
@@ -11,6 +11,7 @@ import {
   DeviceOperationError,
   type DevicePlatform,
   type EasDeviceHostConfig,
+  type SettingsSecretValue,
 } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Clock from "effect/Clock";
@@ -32,6 +33,8 @@ import { writeFileStringAtomically } from "@t3tools/shared/atomicWrite";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 
 import * as ServerConfig from "../config.ts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import { requireSettingsSecret } from "../secrets/settingsSecretValue.ts";
 import { releaseAgentDeviceSession } from "./AgentDeviceTarget.ts";
 import * as DeviceHost from "./DeviceHost.ts";
 import { findEasProjectId } from "./easProjectId.ts";
@@ -140,11 +143,21 @@ const decodePathSegment = (segment: string): string | null => {
   }
 };
 
+/**
+ * The Expo credential a host's setting holds or names. Every session bills the account behind
+ * it, so a named secret that cannot be read fails rather than falling back to another login.
+ */
+export const resolveSavedExpoCredential = (
+  secrets: SecretResolver.SecretResolver["Service"],
+  saved: SettingsSecretValue,
+) => requireSettingsSecret(secrets, saved).pipe(Effect.flatMap(resolveExpoCredential));
+
 export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDeviceHostConfig) {
   const http = yield* HttpClient.HttpClient;
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const server = yield* ServerConfig.ServerConfig;
+  const secrets = yield* SecretResolver.SecretResolver;
   const services = yield* Effect.context<
     FileSystem.FileSystem | Path.Path | Effect.Services<ReturnType<typeof findEasProjectId>>
   >();
@@ -198,13 +211,24 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
       ...(cause === undefined ? {} : { cause }),
     });
 
-  const api: Effect.Effect<ExpoApi, DeviceHostUnavailableError> = resolveExpoCredential(
+  let lastApi: ExpoApi | undefined;
+  const api: Effect.Effect<ExpoApi, DeviceHostUnavailableError> = resolveSavedExpoCredential(
+    secrets,
     config.accessToken,
   ).pipe(
     Effect.map((credential) => makeExpoApi(http, credential)),
+    Effect.tap((expo) =>
+      Effect.sync(() => {
+        lastApi = expo;
+      }),
+    ),
     Effect.provide(services),
     Effect.mapError((error) => unavailable(error.message, error)),
   );
+  /** Stopping a billed session must not depend on the secret still being readable; starting one must. */
+  const apiForStop = api.pipe(
+    Effect.catch((error) => (lastApi === undefined ? Effect.fail(error) : Effect.succeed(lastApi))),
+  );
 
   /** A missing ledger is empty; an unreadable one is an error, never an empty list. */
   const readLedger = fs.readFileString(ledgerPath).pipe(
@@ -626,7 +650,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     if (stale.length === 0 && unresolved.size === 0 && uncertain.size === 0 && !reapDue) return;
     const reap = reapDue || uncertain.size > 0;
     if (reap) reapedAt = now;
-    const expo = yield* api.pipe(
+    const expo = yield* apiForStop.pipe(
       // Without a credential no sweep can look; a record Expo would have
       // listed by now still stops counting, so the limit is not held forever.
       Effect.tapError(() =>
@@ -723,7 +747,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
       Option.match(sessionFor(device.id), {
         onNone: () => Effect.void,
         onSome: (session) =>
-          api.pipe(
+          apiForStop.pipe(
             Effect.flatMap((expo) => stopTracked(expo, session)),
             Effect.asVoid,
             Effect.mapError(
@@ -853,7 +877,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     // Interrupted starts stop the sessions they created before this returns.
     yield* FiberSet.clear(starts);
     yield* FiberSet.clear(background);
-    const expo = yield* api;
+    const expo = yield* apiForStop;
     yield* Effect.forEach(
       [...sessions.values()],
       (session) => stopTracked(expo, session).pipe(Effect.ignore),
@@ -884,7 +908,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
   // Each server signs in on its own, so one with no Expo credential answers for itself. Reading
   // the credential is local; whether Expo accepts it is only known once a session starts.
   const platformAvailability = (platform: DevicePlatform) =>
-    resolveExpoCredential(config.accessToken).pipe(
+    resolveSavedExpoCredential(secrets, config.accessToken).pipe(
       Effect.provide(services),
       Effect.as({ platform, available: true }),
       Effect.catch((error) =>
diff --git a/apps/server/src/secrets/settingsSecretValue.ts b/apps/server/src/secrets/settingsSecretValue.ts
index 83a0adc5f11dd..50a99b953d327 100644
--- a/apps/server/src/secrets/settingsSecretValue.ts
+++ b/apps/server/src/secrets/settingsSecretValue.ts
@@ -1,7 +1,12 @@
-import { secretReferencesInSettings, withSettingsSecrets } from "@t3tools/contracts";
+import {
+  isSecretReference,
+  secretReferencesInSettings,
+  type SettingsSecretValue,
+  withSettingsSecrets,
+} from "@t3tools/contracts";
 import type * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Effect from "effect/Effect";
-import type * as Schema from "effect/Schema";
+import * as Schema from "effect/Schema";
 
 /**
  * Replaces each reference in the slots `schema` declares as `SettingsSecretValue` with the secret
@@ -18,3 +23,29 @@ export const resolveSettingsSecrets = Effect.fn("SettingsSecrets.resolve")(funct
     pending.map((slot, index) => ({ ...slot, value: values[index] ?? "" })),
   );
 });
+
+export class SettingsSecretUnresolvedError extends Schema.TaggedError<SettingsSecretUnresolvedError>()(
+  "SettingsSecretUnresolvedError",
+  { provider: Schema.String },
+) {
+  override get message(): string {
+    return `Could not read the credential from the secret provider "${this.provider}". Unlock or fix it in Settings, then try again.`;
+  }
+}
+
+/**
+ * The secret a credential setting holds or names. A named secret that cannot be read, or reads
+ * empty, fails instead of passing for a missing token, so callers that would fall back to another
+ * credential cannot silently switch accounts.
+ */
+export const requireSettingsSecret = Effect.fn("SettingsSecrets.require")(function* (
+  resolver: SecretResolver.SecretResolver["Service"],
+  value: SettingsSecretValue,
+) {
+  if (!isSecretReference(value)) return value;
+  const [secret] = yield* resolver.read([value]);
+  if (secret === undefined || secret.trim() === "") {
+    return yield* new SettingsSecretUnresolvedError({ provider: value.provider });
+  }
+  return secret;
+});
diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index 726756655740f..0e7ce34df0eae 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -1622,6 +1622,10 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
           provider: SecretProviderId.make("personal"),
           reference: "op://Private/Hub/key",
         };
+        const easReference = {
+          provider: SecretProviderId.make("personal"),
+          reference: "op://Private/Expo/token",
+        };
         const hub = UsageLimitSourceId.make("hub");
         const withUsage = yield* serverSettings.updateSettings({
           usageLimitSources: {
@@ -1632,6 +1636,17 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
               enabled: true,
             },
           },
+          easDeviceHosts: [
+            {
+              kind: "eas",
+              id: "eas",
+              label: "EAS Simulator",
+              accessToken: easReference,
+              maxSessionMinutes: 30,
+              idleMinutes: 10,
+              maxConcurrentSessions: 2,
+            },
+          ],
         });
         const legacy = ServerSettingsModule.redactServerSettingsForClient(withUsage, {
           secretReferences: false,
@@ -1639,9 +1654,11 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
         assert.notInclude(JSON.stringify(legacy), "op://");
         assert.equal(legacy.sourceControlHosts.bitbucket?.accessToken, SECRET_REDACTED);
         assert.equal(legacy.usageLimitSources[hub]?.managementKey, SECRET_REDACTED);
+        assert.equal(legacy.easDeviceHosts[0]?.accessToken, SECRET_REDACTED);
         const echoed = yield* serverSettings.updateSettings({
           sourceControlHosts: legacy.sourceControlHosts,
           usageLimitSources: legacy.usageLimitSources,
+          easDeviceHosts: legacy.easDeviceHosts,
         });
         assert.deepEqual(echoed.sourceControlHosts.bitbucket?.accessToken, reference);
         assert.deepEqual(echoed.sourceControlHosts.github?.tokens, {
@@ -1649,6 +1666,7 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
           "ghe.acme.test": "ghp_ghe",
         });
         assert.deepEqual(echoed.usageLimitSources[hub]?.managementKey, usageReference);
+        assert.deepEqual(echoed.easDeviceHosts[0]?.accessToken, easReference);
         assert.isTrue(Option.isSome(yield* stored("github", "tokens", "ghe.acme.test")));
       }).pipe(Effect.provide(layerServerSettingsWithSecrets())),
   );
@@ -1657,6 +1675,7 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("server settings"
     Effect.sync(() => {
       // Shipped clients decode these as strings. Each must be covered by the older-client case above.
       assert.deepEqual(strictSecretReferencePaths(ServerSettings.ast), [
+        "easDeviceHosts.[].accessToken",
         "usageLimitSources.*.managementKey",
       ]);
     }),
diff --git a/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts b/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
index 697e166c324a4..974fc7cc91c49 100644
--- a/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
+++ b/apps/server/src/sourceControl/sourceControlHostSecrets.test.ts
@@ -1,5 +1,5 @@
 import { assert, it } from "@effect/vitest";
-import { SecretProviderId, UsageLimitSourceId } from "@t3tools/contracts";
+import { DeviceHostId, SecretProviderId, UsageLimitSourceId } from "@t3tools/contracts";
 import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
 import * as Effect from "effect/Effect";
 
@@ -139,7 +139,19 @@ it.effect("reads a collected reference again once it is invalidated", () =>
         enabled: true,
       },
     } as const;
+    const easDeviceHosts = [
+      {
+        kind: "eas" as const,
+        id: DeviceHostId.make("ref"),
+        label: "Ref",
+        maxSessionMinutes: 30,
+        idleMinutes: 10,
+        maxConcurrentSessions: 2,
+        accessToken: source("expo#token"),
+      },
+    ];
     cache.set("cliproxy#key", "stale");
+    cache.set("expo#token", "stale");
     assert.deepEqual((yield* read()).bitbucket, {
       email: "me@example.test",
       accessToken: "stale",
@@ -147,9 +159,10 @@ it.effect("reads a collected reference again once it is invalidated", () =>
     current = "rotated";
     yield* invalidateSettingsSecrets(
       resolver,
-      Effect.succeed({ sourceControlHosts: hosts, usageLimitSources }),
+      Effect.succeed({ sourceControlHosts: hosts, usageLimitSources, easDeviceHosts }),
     );
     assert.isFalse(cache.has("cliproxy#key"));
+    assert.isFalse(cache.has("expo#token"));
     assert.deepEqual((yield* read()).bitbucket, {
       email: "me@example.test",
       accessToken: "rotated",
diff --git a/apps/server/src/sourceControl/sourceControlHostSecrets.ts b/apps/server/src/sourceControl/sourceControlHostSecrets.ts
index 32d2f41f9c504..21213d27bdb8b 100644
--- a/apps/server/src/sourceControl/sourceControlHostSecrets.ts
+++ b/apps/server/src/sourceControl/sourceControlHostSecrets.ts
@@ -104,15 +104,24 @@ const collectUsageLimitSecretReferences = (
     isSecretReference(managementKey) ? [managementKey] : [],
   );
 
+const collectEasSecretReferences = (
+  hosts: ServerSettings["easDeviceHosts"],
+): ReadonlyArray<SecretReference> =>
+  hosts.flatMap(({ accessToken }) => (isSecretReference(accessToken) ? [accessToken] : []));
+
 /** Settings that cannot be read clear every cached secret, so a refresh never keeps a stale one. */
 export const invalidateSettingsSecrets = Effect.fn("SettingsSecrets.invalidate")(function* <E>(
   resolver: SecretResolver.SecretResolver["Service"],
-  settings: Effect.Effect<Pick<ServerSettings, "sourceControlHosts" | "usageLimitSources">, E>,
+  settings: Effect.Effect<
+    Pick<ServerSettings, "sourceControlHosts" | "usageLimitSources" | "easDeviceHosts">,
+    E
+  >,
 ) {
   const references = yield* settings.pipe(
     Effect.map((current) => [
       ...collectSourceControlHostSecretReferences(current.sourceControlHosts),
       ...collectUsageLimitSecretReferences(current.usageLimitSources),
+      ...collectEasSecretReferences(current.easDeviceHosts),
     ]),
     Effect.orElseSucceed(() => undefined),
   );
diff --git a/apps/server/src/usage/UsageLimitSources.test.ts b/apps/server/src/usage/UsageLimitSources.test.ts
index 1d955d497ef6b..7b078b7b61202 100644
--- a/apps/server/src/usage/UsageLimitSources.test.ts
+++ b/apps/server/src/usage/UsageLimitSources.test.ts
@@ -5,6 +5,7 @@ import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretReso
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import * as Stream from "effect/Stream";
 import { HttpClient, HttpClientResponse } from "effect/http";
 
 import * as BackgroundPolicy from "../background/BackgroundPolicy.ts";
@@ -97,8 +98,11 @@ it.effect("reads a management key from its secret provider", () => {
   });
   return Effect.gen(function* () {
     const sources = yield* UsageLimitSources.make;
-    yield* sources.refresh;
-    const snapshots = yield* sources.current;
+    const snapshots = yield* sources.streamChanges.pipe(
+      Stream.filter((next) => next.length > 0),
+      Stream.runHead,
+      Effect.flatMap(Effect.fromOption),
+    );
     expect(snapshots.map(({ id, error }) => ({ id, error }))).toEqual([
       { id: "resolved-hub", error: undefined },
       {
diff --git a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
index 12b9bbe820869..780fba4a7007d 100644
--- a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
+++ b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
@@ -36,14 +36,16 @@ export function AddUsageLimitSourceDialog({
   const [url, setUrl] = useState("");
   const secretSources = useSecretSources(environmentId);
   const [keyDraft, setKeyDraft] = useState<string | SecretReference>("");
+  const [keyValid, setKeyValid] = useState(true);
   const managementKey = typeof keyDraft === "string" ? keyDraft.trim() : keyDraft;
   const trimmedUrl = url.trim();
-  const canSave = trimmedUrl.length > 0 && managementKey !== "";
+  const canSave = keyValid && trimmedUrl.length > 0 && managementKey !== "";
 
   const reset = () => {
     setLabel("");
     setUrl("");
     setKeyDraft("");
+    setKeyValid(true);
   };
 
   const save = () => {
@@ -107,8 +109,7 @@ export function AddUsageLimitSourceDialog({
                 sources={secretSources}
                 onChange={(event) => setKeyDraft(event.target.value)}
                 onSecretChange={(secret) => setKeyDraft(secret ?? "")}
-                onProviderPick={() => setKeyDraft("")}
-                onReferenceReject={() => setKeyDraft("")}
+                onValidityChange={setKeyValid}
               />
             </div>
             <div className="grid gap-1.5">
diff --git a/apps/web/src/components/settings/EasDeviceHostEditor.tsx b/apps/web/src/components/settings/EasDeviceHostEditor.tsx
index 220f5ffa3269b..1223fe09b7d7f 100644
--- a/apps/web/src/components/settings/EasDeviceHostEditor.tsx
+++ b/apps/web/src/components/settings/EasDeviceHostEditor.tsx
@@ -3,9 +3,11 @@ import { useId, useRef, useState } from "react";
 import * as Cause from "effect/Cause";
 import * as Option from "effect/Option";
 import {
+  isSecretReference,
   type DeviceEasAccount,
   type EasDeviceHostConfig,
   type EnvironmentId,
+  type SettingsSecretValue,
 } from "@t3tools/contracts";
 import { XIcon } from "lucide-react";
 
@@ -25,7 +27,7 @@ import { Input } from "../ui/input";
 import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../ui/select";
 import { Spinner } from "../ui/spinner";
 import { parseEasDeviceHostDraft } from "./easDeviceHostsSettings.logic";
-import { SecretInput } from "./SecretInput";
+import { SecretSourceInput, useSecretSources } from "./SecretSourceInput";
 
 const FROM_THREAD_PROJECT = "thread-project";
 
@@ -57,9 +59,12 @@ export function EasDeviceHostEditor(props: {
   const check = useAtomCommand(deviceEnvironment.easAccount, { reportFailure: false });
   const [draft, setDraft] = useState(props.host);
   const tokenId = useId();
+  const secretSources = useSecretSources(props.environmentId);
+  const [tokenValid, setTokenValid] = useState(true);
+  const [tokenInputKey, setTokenInputKey] = useState(0);
   // A saved token arrives redacted; only a replacement or a clear changes it.
   const [token, setToken] = useState<
-    { kind: "saved" } | { kind: "new"; value: string } | { kind: "cleared" }
+    { kind: "saved" } | { kind: "new"; value: SettingsSecretValue } | { kind: "cleared" }
   >(props.host.accessToken ? { kind: "saved" } : { kind: "cleared" });
   // Checking on open names the saved project and shows a rejected credential
   // before anything is changed. A manual check or a token edit replaces it.
@@ -87,13 +92,15 @@ export function EasDeviceHostEditor(props: {
     accessToken:
       token.kind === "saved" ? props.host.accessToken : token.kind === "new" ? token.value : "",
   };
-  const valid = Option.isSome(parseEasDeviceHostDraft(next));
+  const valid = tokenValid && Option.isSome(parseEasDeviceHostDraft(next));
   // Why Save is off, for the limits the fields' ranges do not show.
   const problem = valid
     ? null
-    : draft.maxSessionMinutes > 0 && draft.idleMinutes >= draft.maxSessionMinutes
-      ? "Idle minutes must be smaller than session minutes."
-      : "Give the host a label and limits within the ranges shown.";
+    : !tokenValid
+      ? "Enter a valid secret reference."
+      : draft.maxSessionMinutes > 0 && draft.idleMinutes >= draft.maxSessionMinutes
+        ? "Idle minutes must be smaller than session minutes."
+        : "Give the host a label and limits within the ranges shown.";
   const apps = account.status === "signed-in" ? account.account.apps : [];
 
   // A check answers for the credential it was asked about: a later check or a
@@ -192,11 +199,28 @@ export function EasDeviceHostEditor(props: {
                 Expo access token
               </label>
               <div className="flex items-center gap-2">
-                <SecretInput
+                <SecretSourceInput
+                  key={tokenInputKey}
                   id={tokenId}
+                  aria-label="Expo access token"
                   className="min-w-0 flex-1"
-                  configured={token.kind === "saved"}
-                  value={token.kind === "new" ? token.value : ""}
+                  configured={token.kind === "saved" && typeof props.host.accessToken === "string"}
+                  value={
+                    token.kind === "new"
+                      ? token.value
+                      : token.kind === "saved" && isSecretReference(props.host.accessToken)
+                        ? props.host.accessToken
+                        : ""
+                  }
+                  sources={secretSources}
+                  onValidityChange={(valid) => {
+                    setTokenValid(valid);
+                    resetAccount();
+                  }}
+                  onSecretChange={(secret) => {
+                    setToken(secret ? { kind: "new", value: secret } : { kind: "cleared" });
+                    resetAccount();
+                  }}
                   disabled={props.busy}
                   placeholder="Optional"
                   onChange={(event) => {
@@ -221,6 +245,8 @@ export function EasDeviceHostEditor(props: {
                     aria-label="Clear access token"
                     onClick={() => {
                       setToken({ kind: "cleared" });
+                      setTokenValid(true);
+                      setTokenInputKey((key) => key + 1);
                       resetAccount();
                     }}
                   >
@@ -243,7 +269,7 @@ export function EasDeviceHostEditor(props: {
                 type="button"
                 size="sm"
                 variant="outline"
-                disabled={props.busy || account.status === "checking"}
+                disabled={props.busy || !tokenValid || account.status === "checking"}
                 onClick={() => void checkAccount()}
               >
                 {account.status === "checking" ? <Spinner size="xs" /> : null} Check account
diff --git a/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
index 18ff271e97974..f7c598ab10568 100644
--- a/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
+++ b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
@@ -23,7 +23,7 @@ async function commitReference(screen: Screen, value: string) {
 describe("SecretSourceInput", () => {
   it("moves a reference to another provider only once one is committed for it", async () => {
     const onSecretChange = vi.fn();
-    const onProviderPick = vi.fn();
+    const onValidityChange = vi.fn();
     await using screen = await render(
       <SecretSourceInput
         aria-label="API key"
@@ -31,14 +31,14 @@ describe("SecretSourceInput", () => {
         sources={sources}
         onCommit={() => {}}
         onSecretChange={onSecretChange}
-        onProviderPick={onProviderPick}
+        onValidityChange={onValidityChange}
       />,
     );
 
     await userEvent.click(screen.getByRole("combobox", { name: "API key source" }));
     await userEvent.click(screen.getByRole("option", { name: "Work" }));
     expect(onSecretChange).not.toHaveBeenCalled();
-    expect(onProviderPick).toHaveBeenCalledOnce();
+    expect(onValidityChange).toHaveBeenLastCalledWith(false);
     await expect.element(reference(screen)).toHaveValue("");
 
     await commitReference(screen, "op://Shared/OpenAI/credential");
@@ -46,6 +46,7 @@ describe("SecretSourceInput", () => {
       provider: work,
       reference: "op://Shared/OpenAI/credential",
     });
+    expect(onValidityChange).toHaveBeenLastCalledWith(true);
   });
 
   it("removes the reference when its field is cleared", async () => {
@@ -69,7 +70,7 @@ describe("SecretSourceInput", () => {
 
   it("rejects a reference 1Password cannot read", async () => {
     const onSecretChange = vi.fn();
-    const onReferenceReject = vi.fn();
+    const onValidityChange = vi.fn();
     await using screen = await render(
       <SecretSourceInput
         aria-label="API key"
@@ -77,29 +78,20 @@ describe("SecretSourceInput", () => {
         sources={sources}
         onCommit={() => {}}
         onSecretChange={onSecretChange}
-        onReferenceReject={onReferenceReject}
+        onValidityChange={onValidityChange}
       />,
     );
 
     await commitReference(screen, "Private/OpenAI/credential");
     expect(onSecretChange).not.toHaveBeenCalled();
-    expect(onReferenceReject).toHaveBeenCalledOnce();
-    await screen.rerender(
-      <SecretSourceInput
-        aria-label="API key"
-        value=""
-        sources={sources}
-        onCommit={() => {}}
-        onSecretChange={onSecretChange}
-        onReferenceReject={onReferenceReject}
-      />,
-    );
+    expect(onValidityChange).toHaveBeenLastCalledWith(false);
     await expect.element(reference(screen)).toHaveAttribute("aria-invalid", "true");
     await expect.element(reference(screen)).toHaveValue("Private/OpenAI/credential");
-    await commitReference(screen, "op://Private/OpenAI/corrected");
+    await commitReference(screen, "op://Private/OpenAI/replacement");
+    expect(onValidityChange).toHaveBeenLastCalledWith(true);
     expect(onSecretChange).toHaveBeenCalledExactlyOnceWith({
       provider: personal,
-      reference: "op://Private/OpenAI/corrected",
+      reference: "op://Private/OpenAI/replacement",
     });
   });
 });
diff --git a/apps/web/src/components/settings/SecretSourceInput.tsx b/apps/web/src/components/settings/SecretSourceInput.tsx
index 83ca9ad2ced71..67053a054db38 100644
--- a/apps/web/src/components/settings/SecretSourceInput.tsx
+++ b/apps/web/src/components/settings/SecretSourceInput.tsx
@@ -64,10 +64,8 @@ type SecretSourceInputProps = Omit<ComponentProps<typeof SecretInput>, "value" |
   readonly value: string | SecretReference;
   readonly sources: ReadonlyArray<SecretSource>;
   readonly onSecretChange: (secret: SecretReference | undefined) => void;
-  /** Called when a provider is picked, before a reference for it exists. */
-  readonly onProviderPick?: () => void;
-  /** Called when an edited reference is rejected, so the committed one no longer matches the field. */
-  readonly onReferenceReject?: () => void;
+  /** Whether the selected source and committed field can be saved or used. */
+  readonly onValidityChange?: (valid: boolean) => void;
   /** Places the parts in the caller's layout; `source` is null when there is nothing to pick. */
   readonly children?: (parts: {
     readonly source: ReactNode;
@@ -80,8 +78,7 @@ export function SecretSourceInput({
   value,
   sources,
   onSecretChange,
-  onProviderPick,
-  onReferenceReject,
+  onValidityChange,
   children,
   ...rest
 }: SecretSourceInputProps) {
@@ -108,11 +105,12 @@ export function SecretSourceInput({
           setRejectedReference(null);
           if (value === STORED_VALUE || value === null) {
             setPendingProvider(null);
+            onValidityChange?.(true);
             if (secret !== undefined) onSecretChange(undefined);
             return;
           }
           const next = value as SecretProviderId;
-          if (next !== secret?.provider) onProviderPick?.();
+          onValidityChange?.(next === secret?.provider);
           setPendingProvider(next === secret?.provider ? null : next);
         }}
       >
@@ -157,6 +155,7 @@ export function SecretSourceInput({
           onCommit={(next) => {
             if (next.trim().length === 0) {
               setRejectedReference(null);
+              onValidityChange?.(pendingProvider === null && secret !== undefined);
               if (pendingProvider === null && secret !== undefined) onSecretChange(undefined);
               return;
             }
@@ -166,12 +165,12 @@ export function SecretSourceInput({
               definition?.isReference(decoded.value.reference) === false
             ) {
               setRejectedReference(next);
-              if (onReferenceReject !== undefined) setPendingProvider(provider);
-              onReferenceReject?.();
+              onValidityChange?.(false);
               return;
             }
             setRejectedReference(null);
             setPendingProvider(null);
+            onValidityChange?.(true);
             onSecretChange(decoded.value);
           }}
           autoComplete="off"
diff --git a/packages/contracts/src/device.ts b/packages/contracts/src/device.ts
index 24b72dbe26d7a..417d1c81b418e 100644
--- a/packages/contracts/src/device.ts
+++ b/packages/contracts/src/device.ts
@@ -3,6 +3,7 @@ import * as Schema from "effect/Schema";
 import * as SchemaTransformation from "effect/SchemaTransformation";
 
 import { ThreadId, TrimmedNonEmptyString, TrimmedString } from "./baseSchemas.ts";
+import { SettingsSecretValue } from "./settingsSecretValue.ts";
 
 export const DevicePlatform = Schema.Literals(["ios", "android"]);
 export type DevicePlatform = typeof DevicePlatform.Type;
@@ -40,11 +41,11 @@ export const EasDeviceHostConfig = Schema.Struct({
   /** EAS project that sessions run under, when the project's app config does not name one. */
   appId: Schema.optional(TrimmedNonEmptyString),
   /**
-   * Expo access token, kept in the secret store. When empty the server uses
-   * EXPO_TOKEN, then the `eas login` session. This is `secretSetting` from
-   * settings.ts, which imports this module.
+   * Expo access token, kept in the secret store, or the secret provider to read
+   * it from. When empty the server uses EXPO_TOKEN, then the `eas login` session.
+   * This is `secretSetting` from settings.ts, which imports this module.
    */
-  accessToken: TrimmedString.pipe(
+  accessToken: SettingsSecretValue.pipe(
     Schema.withDecodingDefaultKey(Effect.succeed("")),
     Schema.annotateKey({ settingsSecret: true }),
   ),
@@ -116,7 +117,7 @@ export const SimlockDeviceHostConfigs = Schema.Array(SimlockDeviceHostConfig).ch
 export const DeviceEasAccountInput = Schema.Struct({
   /** A saved EAS host whose stored token is checked when no new token is given. */
   hostId: Schema.optional(DeviceHostId),
-  accessToken: Schema.optional(TrimmedString),
+  accessToken: Schema.optional(SettingsSecretValue),
 });
 export type DeviceEasAccountInput = typeof DeviceEasAccountInput.Type;
 

From aee76a8b473694878e820ed642b4b4018991f378 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 15:16:14 -0600
Subject: [PATCH 051/167] fix(server): route missing read-only queries to
 readers

## Problem

Several read-only queries in projection reads, legacy shell reconciliation, and peer link lookups ran on the SQLite writer. This added avoidable work to the writer connection and could delay writes.

## Change

Marked `getThreadProjection`, the independent legacy importer selectors, and peer link reads with the SQLite `readOnly` context marker. The full projection read uses one reader transaction so concurrent commits cannot mix its local and inherited history. Reads inside existing write transactions retain the writer and see uncommitted changes. Added file-backed routing coverage for reader selection and transaction visibility.

## Scope and approval

This is a focused fix for missing read-only routing boundaries identified in the parent audit. It changes no SQL selection logic or pool configuration. Full projection reads now hold one consistent snapshot.

## Verification

The file-backed tests recorded projection queries, importer selectors, and peer link lookups on reader connections. They also confirmed that reads inside write transactions see uncommitted projection, repair, shell, and link updates. A deterministic concurrent-commit regression failed before the projection transaction fix and passes afterward. Focused suites passed, with 90 tests. `vp run check:changed` passed, including 72 tests in its final run, and `git diff --check` passed.

No startup time saving was measured. The existing shell snapshot query cost is unchanged.

GPT 6.1 Sol, Codex
---
 .../orchestration-v2/ProjectionStore.test.ts  | 92 +++++++++++++++++++
 .../src/orchestration-v2/ProjectionStore.ts   | 12 ++-
 .../legacy/LegacyV1ThreadImporter.test.ts     | 71 +++++++++++++-
 .../legacy/LegacyV1ThreadImporter.ts          |  8 +-
 apps/server/src/peer/PeerLinks.test.ts        | 43 +++++++++
 apps/server/src/peer/PeerLinks.testkit.ts     |  9 +-
 apps/server/src/peer/PeerLinks.ts             |  4 +-
 .../src/persistence/testkit/SqliteRouting.ts  | 52 +++++++++++
 8 files changed, 280 insertions(+), 11 deletions(-)
 create mode 100644 apps/server/src/persistence/testkit/SqliteRouting.ts

diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index f453dec956722..14bb72e3c78fb 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -31,11 +31,14 @@ import {
 } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Deferred from "effect/Deferred";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as Tracer from "effect/Tracer";
 import * as SqlClient from "effect/sql/SqlClient";
+import * as Statement from "effect/sql/Statement";
 import { projectThreadAwarenessV2 } from "@t3tools/shared/agentAwareness";
 
 import * as SqlitePersistence from "../persistence/Sqlite.ts";
@@ -51,6 +54,8 @@ import {
 } from "./threadHistoryPaging.ts";
 import { limitRecoveryCommand } from "./UsageLimitRecoveryWorker.ts";
 
+import { layerReaderDatabase, traceSqlRouting } from "../persistence/testkit/SqliteRouting.ts";
+
 const layerTest = Layer.mergeAll(
   ProjectionStore.layer.pipe(Layer.provideMerge(SqlitePersistence.layerMemory)),
   SqlitePersistence.layerMemory,
@@ -226,6 +231,93 @@ const addRolledBackRecoveryCandidate = Effect.fn("addRolledBackRecoveryCandidate
   return threadId;
 });
 
+it.effect("routes full projection reads to readers and retains uncommitted writer state", () =>
+  Effect.gen(function* () {
+    const store = yield* ProjectionStore.ProjectionStoreV2;
+    const sql = yield* SqlClient.SqlClient;
+    const parentId = yield* addRolledBackRecoveryCandidate("reader-routing");
+    const parent = yield* store.getThreadProjection(parentId);
+    const threadId = ThreadId.make("thread:reader-routing:fork");
+    yield* store.apply({
+      id: EventId.make("event:reader-routing:fork"),
+      type: "thread.created",
+      threadId,
+      occurredAt: parent.thread.createdAt,
+      payload: {
+        ...parent.thread,
+        id: threadId,
+        forkedFrom: { type: "run", threadId: parentId, runId: parent.runs[0]!.id },
+      },
+    });
+    const { queries, trace } = traceSqlRouting();
+    const projection = yield* store.getThreadProjection(threadId).pipe(trace);
+    assert.equal(projection.thread.id, threadId);
+    assert.deepEqual(
+      projection.visibleTurnItems
+        .filter((row) => row.visibility === "inherited")
+        .map((row) => row.sourceItemId),
+      parent.turnItems.map((item) => item.id),
+    );
+    assert.isAbove(queries.length, 1);
+    assert.deepEqual([...new Set(queries.map((row) => row.connection))], ["reader"]);
+    const commitRequested = yield* Deferred.make<void>();
+    const writer = yield* Deferred.await(commitRequested).pipe(
+      Effect.andThen(
+        sql.withTransaction(
+          Effect.gen(function* () {
+            yield* sql`
+          UPDATE orchestration_v2_projection_threads
+          SET payload_json = json_set(payload_json, '$.title', 'Committed title')
+          WHERE thread_id = ${threadId}
+        `;
+            yield* sql`
+          UPDATE orchestration_v2_projection_turn_items
+          SET payload_json = json_set(payload_json, '$.title', 'Committed command')
+          WHERE thread_id = ${parentId}
+        `;
+          }),
+        ),
+      ),
+      Effect.forkChild,
+    );
+    let commitInjected = false;
+    const duringCommit = yield* store.getThreadProjection(threadId).pipe(
+      Effect.provideService(Statement.CurrentTransformer, (statement) => {
+        const [query] = statement.compile();
+        if (!commitInjected && query.includes("FROM orchestration_v2_projection_turn_items")) {
+          commitInjected = true;
+          return Deferred.succeed(commitRequested, undefined).pipe(
+            Effect.andThen(Fiber.join(writer).pipe(Effect.orDie)),
+            Effect.as(statement),
+          );
+        }
+        return Effect.succeed(statement);
+      }),
+    );
+    assert.isTrue(commitInjected);
+    assert.deepEqual(duringCommit, projection);
+    const afterCommit = yield* store.getThreadProjection(threadId);
+    assert.equal(afterCommit.thread.title, "Committed title");
+    assert.equal(
+      afterCommit.visibleTurnItems.find((row) => row.visibility === "inherited")?.item.title,
+      "Committed command",
+    );
+    yield* sql.withTransaction(
+      Effect.gen(function* () {
+        yield* sql`
+        UPDATE orchestration_v2_projection_threads
+        SET payload_json = json_set(payload_json, '$.title', 'Uncommitted title')
+        WHERE thread_id = ${threadId}
+      `;
+        assert.equal(
+          (yield* store.getThreadProjection(threadId)).thread.title,
+          "Uncommitted title",
+        );
+      }),
+    );
+  }).pipe(Effect.provide(ProjectionStore.layer.pipe(Layer.provideMerge(layerReaderDatabase)))),
+);
+
 it.effect("record reads restrict provider histories to delivery identities", () =>
   Effect.gen(function* () {
     const store = yield* ProjectionStore.ProjectionStoreV2;
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 8726799153cee..3e6ca0d75a1fb 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -4522,7 +4522,15 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
     );
 
     const getThreadProjection: ProjectionStoreV2Shape["getThreadProjection"] = (threadId) =>
-      readProjection(threadId, new Set());
+      sql
+        .withTransaction(readProjection(threadId, new Set()))
+        .pipe(
+          Effect.mapError((cause) =>
+            isProjectionStoreThreadNotFoundError(cause) || isProjectionStoreReadError(cause)
+              ? cause
+              : new ProjectionStoreReadError({ threadId, cause }),
+          ),
+        );
 
     const getRuntimeRecoveryProjection: ProjectionStoreV2Shape["getRuntimeRecoveryProjection"] =
       Effect.fn("ProjectionStore.getRuntimeRecoveryProjection")(
@@ -7252,7 +7260,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       getThreadsWithPullRequests: readOnReader(getThreadsWithPullRequests),
       getThreadWorktreePaths: readOnReader(getThreadWorktreePaths),
       getOpenRemoteDelegatedTasks: getOpenRemoteDelegatedTasks.pipe(NodeSqliteClient.readOnly),
-      getThreadProjection,
+      getThreadProjection: readOnReader(getThreadProjection),
       getTurnStartContext: readOnReader(getTurnStartContext),
       getTurnStartHistory: readOnReader(getTurnStartHistory),
       getRuntimeRecoveryProjection: readOnReader(getRuntimeRecoveryProjection),
diff --git a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
index 50671194d46d2..a50b3ed3c1910 100644
--- a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
+++ b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.test.ts
@@ -14,7 +14,6 @@ import * as Layer from "effect/Layer";
 import * as SqlClient from "effect/sql/SqlClient";
 import * as Statement from "effect/sql/Statement";
 
-import * as SqlitePersistence from "../../persistence/Sqlite.ts";
 import { listLinkedPullRequestThreads } from "../../pullRequest/linkedThreads.ts";
 import * as EventSink from "../EventSink.ts";
 import * as EventStore from "../EventStore.ts";
@@ -22,7 +21,9 @@ import * as LegacyV1ThreadImporter from "./LegacyV1ThreadImporter.ts";
 import * as ProjectionReplay from "../testkit/ProjectionReplay.ts";
 import * as ProjectionStore from "../ProjectionStore.ts";
 
-const layerDatabase = SqlitePersistence.layerMemory;
+import { layerReaderDatabase, traceSqlRouting } from "../../persistence/testkit/SqliteRouting.ts";
+
+const layerDatabase = layerReaderDatabase;
 const layerEventStoreProvided = EventStore.layer.pipe(Layer.provideMerge(layerDatabase));
 const layerProjectionStoreProvided = ProjectionStore.layer.pipe(Layer.provideMerge(layerDatabase));
 const layerStoresProvided = Layer.mergeAll(
@@ -80,6 +81,72 @@ const seedPendingTranscripts = Effect.gen(function* () {
   yield* importer.reconcileShells;
 });
 
+it.effect("routes shell selectors to readers while imports stay writable", () =>
+  Effect.gen(function* () {
+    const importer = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
+    const sql = yield* SqlClient.SqlClient;
+    const { queries, trace } = traceSqlRouting();
+    yield* seedPendingTranscripts.pipe(trace);
+    const selectors = queries.filter(
+      ({ query }) =>
+        query.includes("FROM projection_threads AS thread") ||
+        query.includes("FROM orchestration_v2_legacy_imports AS legacy_import") ||
+        query.includes("FROM projection_thread_messages AS message"),
+    );
+    assert.lengthOf(selectors, 6);
+    assert.deepEqual([...new Set(selectors.map((row) => row.connection))], ["reader"]);
+    assert.deepEqual(yield* importer.reconcileShells, {
+      importedThreadCount: 0,
+      importedMessageCount: 0,
+    });
+    yield* sql.withTransaction(
+      Effect.gen(function* () {
+        yield* sql`
+        INSERT INTO projection_threads (
+          thread_id, project_id, title, model_selection_json, runtime_mode,
+          interaction_mode, created_at, updated_at
+        ) VALUES (
+          'thread:uncommitted', 'project:background', 'Uncommitted legacy title',
+          '{"instanceId":"codex","model":"gpt-5.4"}', 'full-access', 'default',
+          '2026-01-01T00:00:00.000Z', '2026-01-01T00:00:00.000Z'
+        )
+      `;
+        yield* sql`
+          INSERT INTO projection_thread_messages (
+            message_id, thread_id, role, text, is_streaming, created_at, updated_at
+          ) VALUES (
+            'message:uncommitted', 'thread:uncommitted', 'user', 'Uncommitted preview', 0,
+            '2026-01-01T00:00:00.000Z', '2026-01-01T00:00:00.000Z'
+          )
+        `;
+        yield* sql`
+          UPDATE orchestration_v2_projection_threads
+          SET payload_json = json_remove(payload_json, '$.pinnedAt')
+          WHERE thread_id = 'thread:first'
+        `;
+        yield* sql`
+          UPDATE projection_threads SET pinned_at = '2026-01-01T00:00:00.000Z'
+          WHERE thread_id = 'thread:first'
+        `;
+        const result = yield* importer.reconcileShells;
+        assert.deepEqual(result, { importedThreadCount: 2, importedMessageCount: 1 });
+        const projections = yield* ProjectionStore.ProjectionStoreV2;
+        const repaired = yield* projections.getThreadProjection(ThreadId.make("thread:first"));
+        assert.equal(DateTime.formatIso(repaired.thread.pinnedAt!), "2026-01-01T00:00:00.000Z");
+        const imported = yield* projections.getThreadProjection(
+          ThreadId.make("thread:uncommitted"),
+        );
+        assert.equal(imported.messages[0]?.text, "Uncommitted preview");
+        assert.equal(
+          (yield* projections.getThreadProjection(ThreadId.make("thread:uncommitted"))).thread
+            .title,
+          "Uncommitted legacy title",
+        );
+      }),
+    );
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.effect(
   "keeps hydrating later transcripts after a defect and leaves the failed thread pending",
   () =>
diff --git a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.ts b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.ts
index d82a9e80a23b5..8c134d3b57d71 100644
--- a/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.ts
+++ b/apps/server/src/orchestration-v2/legacy/LegacyV1ThreadImporter.ts
@@ -394,7 +394,7 @@ const make = Effect.gen(function* () {
           AND message.role IN ('user', 'assistant')
         ORDER BY message.created_at DESC, message.message_id DESC
         LIMIT 1
-      `;
+      `.pipe(NodeSqliteClient.readOnly);
     const latestUser = yield* sql<LegacyMessageRow>`
         SELECT
           message.message_id,
@@ -424,7 +424,7 @@ const make = Effect.gen(function* () {
           AND message.role = 'user'
         ORDER BY message.created_at DESC, message.message_id DESC
         LIMIT 1
-      `;
+      `.pipe(NodeSqliteClient.readOnly);
     return [latestUser[0], latest[0]].filter(
       (message, index, selected): message is LegacyMessageRow =>
         message !== undefined &&
@@ -476,7 +476,7 @@ const make = Effect.gen(function* () {
          OR json_type(projection.payload_json, '$.branchPullRequest') IS NULL
          OR json_type(projection.payload_json, '$.activeOrderKey') IS NULL
       ORDER BY thread.created_at ASC, thread.thread_id ASC
-    `;
+    `.pipe(NodeSqliteClient.readOnly);
     let repairedThreadCount = 0;
     for (const row of repairRows) {
       const decoded = decodeStoredThread(row.payload_json);
@@ -574,7 +574,7 @@ const make = Effect.gen(function* () {
           AND event.event_type = 'thread.created'
       )
       ORDER BY thread.created_at ASC, thread.thread_id ASC
-    `;
+    `.pipe(NodeSqliteClient.readOnly);
     let importedThreadCount = repairedThreadCount;
     let importedMessageCount = 0;
     for (const row of rows) {
diff --git a/apps/server/src/peer/PeerLinks.test.ts b/apps/server/src/peer/PeerLinks.test.ts
index 3c510c35e6904..a99cb7f9051c5 100644
--- a/apps/server/src/peer/PeerLinks.test.ts
+++ b/apps/server/src/peer/PeerLinks.test.ts
@@ -36,6 +36,8 @@ import {
 } from "./PeerLinks.testkit.ts";
 import * as PeerMcpClient from "./PeerMcpClient.ts";
 
+import { layerReaderDatabase, traceSqlRouting } from "../persistence/testkit/SqliteRouting.ts";
+
 /** What B's probe saw: the calling client and the modes it may start work with. */
 const Probe = Schema.Struct({ caller: Schema.String, modes: Schema.String });
 
@@ -115,6 +117,47 @@ const serveApart = (descriptor: ExecutionEnvironmentDescriptor) =>
     Effect.flatMap((server) => serveB(descriptor).pipe(Effect.provideContext(server))),
   );
 
+it.effect("routes peer reads to readers and sees uncommitted link updates", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const context = yield* layerLinkingEnvironment(
+        laptop,
+        ServerSecretStore.layer,
+        layerReaderDatabase,
+      ).pipe(Layer.build);
+      const links = Context.get(context, PeerLinks.PeerLinks);
+      const sql = Context.get(context, SqlClient.SqlClient);
+      yield* sql`
+      INSERT INTO peer_environment_links (
+        environment_id, secret_name, label, urls_json, access, linked_at, expires_at, fenced
+      ) VALUES (
+        ${box.environmentId}, 'test-secret', 'Box', '[]', 'auto',
+        '2026-01-01T00:00:00.000Z', '2026-01-02T00:00:00.000Z', 1
+      )
+    `;
+      const { queries, trace } = traceSqlRouting();
+      yield* links.list.pipe(trace);
+      expect(Option.getOrThrow(yield* links.get(box.environmentId).pipe(trace)).label).toBe("Box");
+      const reads = queries.filter(({ query }) =>
+        query.includes("SELECT * FROM peer_environment_links"),
+      );
+      expect(reads).toHaveLength(2);
+      expect(reads.map((row) => row.connection)).toEqual(["reader", "reader"]);
+      yield* sql.withTransaction(
+        Effect.gen(function* () {
+          yield* sql`UPDATE peer_environment_links SET label = 'Uncommitted box'`;
+          expect(Option.getOrThrow(yield* links.get(box.environmentId)).label).toBe(
+            "Uncommitted box",
+          );
+          expect((yield* links.list)[0]?.label).toBe("Uncommitted box");
+        }),
+      );
+      expect(yield* links.unlink(box.environmentId)).toBe(true);
+      expect(yield* links.list).toEqual([]);
+    }),
+  ),
+);
+
 it.effect("links with a pairing code, and the peer holds its agents to the limits they carry", () =>
   Effect.scoped(
     Effect.gen(function* () {
diff --git a/apps/server/src/peer/PeerLinks.testkit.ts b/apps/server/src/peer/PeerLinks.testkit.ts
index c72c5ba8c81bc..1ff940af9b3e1 100644
--- a/apps/server/src/peer/PeerLinks.testkit.ts
+++ b/apps/server/src/peer/PeerLinks.testkit.ts
@@ -21,6 +21,7 @@ import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
 import * as AuthHttp from "../auth/http.ts";
 import * as McpOAuth from "../auth/McpOAuth.ts";
 import * as McpOAuthHttp from "../auth/mcpOAuthHttp.ts";
+import type * as SqlClient from "effect/sql/SqlClient";
 import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
 import * as ServerConfig from "../config.ts";
 import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
@@ -154,14 +155,18 @@ export type ServedPeer = Effect.Success<ReturnType<typeof servePeer>>;
  * The environment that links: its own database and secret store, reaching
  * peers over plain HTTP. Provide it to anything built on its links.
  */
-export const layerLinkingEnvironment = (
+export const layerLinkingEnvironment = <E = never>(
   descriptor: ExecutionEnvironmentDescriptor,
   secrets: typeof ServerSecretStore.layer = ServerSecretStore.layer,
+  database: Layer.Layer<
+    SqlClient.SqlClient,
+    E | Layer.Error<typeof Sqlite.layerMemory>
+  > = Sqlite.layerMemory,
 ) =>
   PeerMcpClient.layer.pipe(
     Layer.provideMerge(PeerLinks.layer),
     Layer.provideMerge(ServerSettings.layerTest({ linkedEnvironmentsEnabled: true })),
-    Layer.provideMerge(Sqlite.layerMemory),
+    Layer.provideMerge(database),
     Layer.provide(Layer.mergeAll(secrets, FetchHttpClient.layer)),
     // Services that act for this environment, such as delegation, name it too.
     Layer.provideMerge(
diff --git a/apps/server/src/peer/PeerLinks.ts b/apps/server/src/peer/PeerLinks.ts
index adbc8cbd1edea..70aa68d25ccb7 100644
--- a/apps/server/src/peer/PeerLinks.ts
+++ b/apps/server/src/peer/PeerLinks.ts
@@ -12,6 +12,7 @@ import {
   type PeerLinkStatus,
   type PeerLinkSummary,
 } from "@t3tools/contracts";
+import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
 import * as Context from "effect/Context";
 import * as Digest from "effect/crypto/Digest";
 import * as SecureRandom from "effect/crypto/SecureRandom";
@@ -222,12 +223,13 @@ const make = Effect.gen(function* () {
 
   const readRows = sql<PeerLinkRow>`
     SELECT * FROM peer_environment_links ORDER BY label, environment_id
-  `.pipe(Effect.catch(failStorage));
+  `.pipe(NodeSqliteClient.readOnly, Effect.catch(failStorage));
 
   const readRow = (environmentId: EnvironmentId) =>
     sql<PeerLinkRow>`
       SELECT * FROM peer_environment_links WHERE environment_id = ${environmentId}
     `.pipe(
+      NodeSqliteClient.readOnly,
       Effect.catch(failStorage),
       Effect.map((rows) => Option.fromNullishOr(rows[0])),
     );
diff --git a/apps/server/src/persistence/testkit/SqliteRouting.ts b/apps/server/src/persistence/testkit/SqliteRouting.ts
new file mode 100644
index 0000000000000..2dcd65ec2b2f9
--- /dev/null
+++ b/apps/server/src/persistence/testkit/SqliteRouting.ts
@@ -0,0 +1,52 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Statement from "effect/sql/Statement";
+import * as Tracer from "effect/Tracer";
+
+import * as Sqlite from "../Sqlite.ts";
+
+export const layerReaderDatabase = Layer.unwrap(
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const directory = yield* fs.makeTempDirectoryScoped({ prefix: "t3-routing-" });
+    return Sqlite.layerFromPath(path.join(directory, "state.sqlite"));
+  }),
+).pipe(Layer.provide(NodeServices.layer));
+
+export const traceSqlRouting = () => {
+  const queries: Array<{ query: string; connection: unknown }> = [];
+  const tracer = Tracer.make({
+    span(options) {
+      const span = new Tracer.NativeSpan(options);
+      const end = span.end.bind(span);
+      span.end = (endTime, exit) => {
+        end(endTime, exit);
+        const query = span.attributes.get("db.query.text");
+        if (typeof query === "string") {
+          let owner: Tracer.AnySpan | undefined = span;
+          let connection: unknown;
+          while (owner?._tag === "Span") {
+            connection = owner.attributes.get("db.connection");
+            if (connection !== undefined) break;
+            owner = Option.getOrUndefined(owner.parent);
+          }
+          queries.push({ query, connection });
+        }
+      };
+      return span;
+    },
+  });
+  return {
+    queries,
+    trace: <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(
+        Effect.withTracer(tracer),
+        Effect.provideService(Statement.SpanPropagationEnabled, true),
+      ),
+  };
+};

From 96e887b6a866ba62ed3d6c2276651b4abb3441b1 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Tue, 3 Nov 2026 15:35:15 -0600
Subject: [PATCH 052/167] perf(server): index delegated recovery candidates
 (#30359)

Add guarded partial indexes for delegated recovery candidate selectors and retain existing recovery eligibility. Include migration and query-plan regression coverage, plus preview-upgrade expectations.

GPT 6.1 Sol, Codex.
---
 .../ProjectionRecovery.test.ts                | 103 +++++++++++++++++-
 .../src/orchestration-v2/ProjectionStore.ts   |   2 +-
 apps/server/src/persistence/Migrations.ts     |   3 +
 .../079_DelegatedRecoveryIndexes.ts           |  26 +++++
 .../reconcileV2PreviewMigration.test.ts       |   2 +
 5 files changed, 133 insertions(+), 3 deletions(-)
 create mode 100644 apps/server/src/persistence/Migrations/079_DelegatedRecoveryIndexes.ts

diff --git a/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts b/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
index 733238e62d2f3..a4914fdee4509 100644
--- a/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionRecovery.test.ts
@@ -24,6 +24,7 @@ import * as Layer from "effect/Layer";
 import * as SqlClient from "effect/sql/SqlClient";
 import * as Statement from "effect/sql/Statement";
 
+import delegatedRecoveryIndexes from "../persistence/Migrations/079_DelegatedRecoveryIndexes.ts";
 import * as SqlitePersistence from "../persistence/Sqlite.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import { CodexProviderCapabilitiesV2 } from "./Adapters/CodexAdapterV2.ts";
@@ -357,8 +358,28 @@ it.effect("selects unfinished recovery work without reading settled thread histo
       new Set(yield* projections.getRecoveryThreadIds("runtime")),
       new Set([queued, archived, blocked, background, outboxOnly, requestOnly]),
     );
-    assert.deepEqual(yield* projections.getRecoveryThreadIds("delegated-completions"), [delivery]);
-    assert.deepEqual(yield* projections.getRecoveryThreadIds("subagent-results"), []);
+    for (const [kind, expected, index] of [
+      ["delegated-completions", [delivery], "runs_delegated_delivery_idx"],
+      ["subagent-results", [], "threads_subagent_result_idx"],
+    ] as const) {
+      const statements: Array<ReturnType<Statement.Statement<unknown>["compile"]>> = [];
+      const observe: Statement.Transformer = (statement) => {
+        statements.push(statement.compile());
+        return Effect.succeed(statement);
+      };
+      assert.deepEqual(
+        yield* projections
+          .getRecoveryThreadIds(kind)
+          .pipe(Effect.provideService(Statement.CurrentTransformer, observe)),
+        expected,
+      );
+      const [query, params] = statements[0]!;
+      const plan = yield* sql.unsafe<{ detail: string }>(`EXPLAIN QUERY PLAN ${query}`, params);
+      assert.isTrue(
+        plan.some((row) => row.detail.includes(index)),
+        JSON.stringify(plan),
+      );
+    }
     const recoveryState = yield* projections.getRuntimeRecoveryProjection(queued);
     assert.deepEqual(
       recoveryState.runs.map((run) => run.id),
@@ -371,6 +392,84 @@ it.effect("selects unfinished recovery work without reading settled thread histo
   }).pipe(Effect.provide(layerTest)),
 );
 
+it.effect("maintains delegated candidate indexes across legacy rows and payload transitions", () =>
+  Effect.gen(function* () {
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const sql = yield* SqlClient.SqlClient;
+    const parent = yield* createThread("index-parent");
+    const child = yield* createThread("index-child");
+    const run = yield* createRun(child, "completed");
+    const rows = yield* sql<{ payload_json: string }>`
+      SELECT payload_json FROM orchestration_v2_projection_threads WHERE thread_id = ${child}
+    `;
+    const original = JSON.parse(rows[0]!.payload_json);
+    for (const payload of [
+      "{broken",
+      JSON.stringify({
+        ...original,
+        lineage: { parentThreadId: parent, relationshipToParent: "subagent" },
+        forkedFrom: { type: "provider_thread" },
+      }),
+      JSON.stringify({
+        ...original,
+        lineage: { parentThreadId: parent, relationshipToParent: "subagent" },
+        forkedFrom: { type: "node", nodeId: "node:index" },
+      }),
+      JSON.stringify({
+        ...original,
+        lineage: { parentThreadId: child, relationshipToParent: "subagent" },
+        forkedFrom: { type: "node", nodeId: "node:index" },
+      }),
+      JSON.stringify(original),
+    ]) {
+      yield* sql`UPDATE orchestration_v2_projection_threads SET payload_json = ${payload}
+        WHERE thread_id = ${child}`;
+      const expected = payload.includes('"type":"node"') ? [child] : [];
+      assert.deepEqual(yield* projections.getRecoveryThreadIds("subagent-results"), expected);
+    }
+    for (const entry of [
+      ["{broken", false],
+      ["{}", false],
+      ['{"delegatedCompletion":{"delivery":null}}', false],
+      ['{"delegatedCompletion":{"delivery":[]}}', false],
+      ['{"delegatedCompletion":{"delivery":{}}}', true],
+      ["{}", false],
+    ] as const) {
+      const [payload, included] = entry;
+      yield* sql`UPDATE orchestration_v2_projection_runs SET payload_json = ${payload}
+        WHERE run_id = ${run}`;
+      assert.deepEqual(
+        yield* projections.getRecoveryThreadIds("delegated-completions"),
+        included ? [child] : [],
+      );
+    }
+    yield* sql`UPDATE orchestration_v2_projection_threads SET payload_json = '{broken'
+      WHERE thread_id = ${parent}`;
+    yield* sql`UPDATE orchestration_v2_projection_runs SET payload_json = '{broken'
+      WHERE run_id = ${run}`;
+    const existing = yield* createThread("index-existing", {
+      lineage: { parentThreadId: child, relationshipToParent: "subagent", rootThreadId: parent },
+      forkedFrom: { type: "node", nodeId: NodeId.make("node:index-existing") },
+    });
+    yield* createRun(existing, "completed", {
+      delegatedCompletion: {
+        disposition: "open",
+        nextGeneration: 2,
+        delivery: {
+          generation: 1,
+          messageId: MessageId.make("message:index-existing"),
+          taskIds: [],
+        },
+      },
+    });
+    yield* sql`DROP INDEX orchestration_v2_projection_threads_subagent_result_idx`;
+    yield* sql`DROP INDEX orchestration_v2_projection_runs_delegated_delivery_idx`;
+    yield* delegatedRecoveryIndexes;
+    assert.deepEqual(yield* projections.getRecoveryThreadIds("subagent-results"), [existing]);
+    assert.deepEqual(yield* projections.getRecoveryThreadIds("delegated-completions"), [existing]);
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.effect("recovers terminal subagent results until their cross-thread transfer exists", () =>
   Effect.gen(function* () {
     const projections = yield* ProjectionStore.ProjectionStoreV2;
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 3e6ca0d75a1fb..f6be46d28ae67 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -4121,6 +4121,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                   json_extract(child.payload_json, '$.lineage.relationshipToParent') = 'subagent'
                   AND json_extract(child.payload_json, '$.lineage.parentThreadId') IS NOT NULL
                   AND json_extract(child.payload_json, '$.forkedFrom.type') = 'node'
+                  ELSE 0 END
                   AND (EXISTS (
                     SELECT 1 FROM orchestration_v2_projection_runs AS requested
                     JOIN orchestration_v2_projection_subagents AS task
@@ -4143,7 +4144,6 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                       AND target_thread_id = json_extract(child.payload_json, '$.lineage.parentThreadId')
                       AND type = 'subagent_result'
                   )))
-                  ELSE 0 END
               `;
             case "runtime":
               return sql`
diff --git a/apps/server/src/persistence/Migrations.ts b/apps/server/src/persistence/Migrations.ts
index 3ee83e5fe01bf..606770d1b6508 100644
--- a/apps/server/src/persistence/Migrations.ts
+++ b/apps/server/src/persistence/Migrations.ts
@@ -82,6 +82,8 @@ import Migration0076 from "./Migrations/076_ProjectionProjectsPinArchive.ts";
 import Migration0077 from "./Migrations/077_RepairBooleanSettledOverride.ts";
 import Migration0078 from "./Migrations/078_DropOrchestrationEventCorrelationIndex.ts";
 
+import Migration0079 from "./Migrations/079_DelegatedRecoveryIndexes.ts";
+
 const migrationEntries = [
   [1, "OrchestrationEvents", Migration0001],
   [2, "OrchestrationCommandReceipts", Migration0002],
@@ -162,6 +164,7 @@ const migrationEntries = [
   [76, "ProjectionProjectsPinArchive", Migration0076],
   [77, "RepairBooleanSettledOverride", Migration0077],
   [78, "DropOrchestrationEventCorrelationIndex", Migration0078],
+  [79, "DelegatedRecoveryIndexes", Migration0079],
 ] as const;
 
 export const migrationManifest = migrationEntries.map(([id, name]) => [id, name] as const);
diff --git a/apps/server/src/persistence/Migrations/079_DelegatedRecoveryIndexes.ts b/apps/server/src/persistence/Migrations/079_DelegatedRecoveryIndexes.ts
new file mode 100644
index 0000000000000..3ba72feaf1788
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/079_DelegatedRecoveryIndexes.ts
@@ -0,0 +1,26 @@
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/sql/SqlClient";
+
+export default Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+
+  // Include the parent ID so transfer checks do not reread each child payload.
+  yield* sql`
+    CREATE INDEX orchestration_v2_projection_threads_subagent_result_idx
+    ON orchestration_v2_projection_threads(
+      thread_id, json_extract(payload_json, '$.lineage.parentThreadId')
+    )
+    WHERE CASE WHEN json_valid(payload_json) THEN
+      json_extract(payload_json, '$.lineage.relationshipToParent') = 'subagent'
+      AND json_extract(payload_json, '$.lineage.parentThreadId') IS NOT NULL
+      AND json_extract(payload_json, '$.forkedFrom.type') = 'node'
+      ELSE 0 END
+  `;
+  yield* sql`
+    CREATE INDEX orchestration_v2_projection_runs_delegated_delivery_idx
+    ON orchestration_v2_projection_runs(thread_id)
+    WHERE CASE WHEN json_valid(payload_json)
+      THEN json_type(payload_json, '$.delegatedCompletion.delivery') = 'object'
+      ELSE 0 END
+  `;
+});
diff --git a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
index d062961b3af57..5f51c237fd763 100644
--- a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
+++ b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
@@ -58,6 +58,7 @@ describe("V2 preview upgrade", () => {
         [76, "ProjectionProjectsPinArchive"],
         [77, "RepairBooleanSettledOverride"],
         [78, "DropOrchestrationEventCorrelationIndex"],
+        [79, "DelegatedRecoveryIndexes"],
       ]);
       assert.deepStrictEqual(yield* runMigrations(), []);
       assert.deepStrictEqual(yield* sql`SELECT * FROM orchestration_v2_legacy_imports`, imports);
@@ -159,6 +160,7 @@ describe("V2 preview upgrade", () => {
         [76, "ProjectionProjectsPinArchive"],
         [77, "RepairBooleanSettledOverride"],
         [78, "DropOrchestrationEventCorrelationIndex"],
+        [79, "DelegatedRecoveryIndexes"],
       ]);
     }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: ":memory:" }))),
   );

From 251369d31cfdf520aabf3e3146531bdb2fb59477 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 13:44:18 -0800
Subject: [PATCH 053/167] feat(server,web,mobile,desktop): Copy thread copies a
 link that opens the thread (#26290)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../T3ComposerEditorModule.kt                 |   4 +
 .../t3composereditor/T3ComposerEditorView.kt  |  21 +++-
 .../ios/T3ComposerEditorModule.swift          |   5 +
 .../ios/T3ComposerEditorView.swift            |   6 ++
 .../src/features/threads/ThreadFeed.tsx       |   7 +-
 .../src/lib/composerContextClipboard.test.ts  |  33 ++++++
 .../src/lib/composerContextClipboard.ts       |  41 ++++++-
 apps/server/src/auth/McpOAuth.ts              |  11 +-
 apps/server/src/mcp/McpInvocationContext.ts   |  15 ++-
 .../src/mcp/toolkits/project/handlers.test.ts |  14 +--
 apps/web/src/components/ChatView.tsx          |   2 +
 apps/web/src/components/CommandPalette.tsx    |   2 +
 apps/web/src/components/Sidebar.tsx           |   5 +-
 .../components/chat/MarkdownThreadLink.tsx    |   8 +-
 .../composerInlineTokenPaste.test.ts          |  59 ++++++++++
 .../components/composerInlineTokenPaste.ts    |  65 +++++++----
 .../promptLinks/HostedPromptLinkLanding.tsx   |  41 +++++--
 apps/web/src/hooks/useThreadActionMenu.ts     |   5 +-
 apps/web/src/routeTree.gen.ts                 |  22 ++++
 .../threads.$environmentId.$threadId.tsx      |   9 ++
 .../orchestrator-mcp-server.md                |   5 +-
 docs/user/composer.md                         |   7 +-
 docs/user/prompt-links.md                     |   7 ++
 docs/user/thread-sidebar.md                   |   8 +-
 .../src/threadReference.test.ts               |  23 ++--
 .../client-runtime/src/threadReference.ts     |  19 ++--
 .../src/composerContextReferences.test.ts     |  63 +++++++++++
 .../shared/src/composerContextReferences.ts   |  41 +++++++
 packages/shared/src/promptLinks.test.ts       |  24 +++++
 packages/shared/src/promptLinks.ts            |   7 +-
 packages/shared/src/threadLinks.test.ts       |  63 +++++++++++
 packages/shared/src/threadLinks.ts            | 101 ++++++++++++++----
 32 files changed, 636 insertions(+), 107 deletions(-)
 create mode 100644 apps/web/src/components/composerInlineTokenPaste.test.ts
 create mode 100644 apps/web/src/routes/threads.$environmentId.$threadId.tsx

diff --git a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorModule.kt b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorModule.kt
index 1703a76702024..fd48492a11c9e 100644
--- a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorModule.kt
+++ b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorModule.kt
@@ -9,6 +9,10 @@ import org.json.JSONObject
 import org.json.JSONArray
 
 internal object T3ComposerClipboard {
+  // Pasted thread links become chips in JS; packages/shared/src/threadLinks.ts parses them.
+  fun hasThreadLink(text: String): Boolean =
+    text.contains("t3-thread://v2/") || text.contains("https://app.t3.codes/threads/")
+
   fun write(context: Context, text: String, fragment: String) {
     val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
     val payload = try {
diff --git a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
index efa54e2ec374a..6b0534fdaccbd 100644
--- a/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
+++ b/apps/mobile/modules/t3-composer-editor/android/src/main/java/expo/modules/t3composereditor/T3ComposerEditorView.kt
@@ -735,11 +735,24 @@ internal class SelectionAwareEditText(
 
   private fun pasteContextOrImages(): Boolean {
     val payload = T3ComposerClipboard.read(context)
-    if (payload["html"]?.contains("data-t3-context-fragment=") == true) {
-      pasteContextListener?.invoke(payload)
-      return true
+    return when {
+      payload["html"]?.contains("data-t3-context-fragment=") == true -> pasteContext(payload)
+      pasteImagesOrInterceptedText() -> true
+      isSingleItemClip() && T3ComposerClipboard.hasThreadLink(payload["text"].orEmpty()) ->
+        pasteContext(payload)
+      else -> false
     }
-    return pasteImagesOrInterceptedText()
+  }
+
+  // read() sees only the first item; native paste keeps every item of a longer clip.
+  private fun isSingleItemClip(): Boolean {
+    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as? ClipboardManager
+    return clipboard?.primaryClip?.itemCount == 1
+  }
+
+  private fun pasteContext(payload: Map<String, String>): Boolean {
+    pasteContextListener?.invoke(payload)
+    return true
   }
 
   private fun pasteImagesOrInterceptedText(): Boolean {
diff --git a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorModule.swift b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorModule.swift
index 99504e6de8936..e16582ce2b514 100644
--- a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorModule.swift
+++ b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorModule.swift
@@ -4,6 +4,11 @@ import UIKit
 enum T3ComposerClipboard {
   static let fragmentType = "app.t3.context-fragment"
 
+  // Pasted thread links become chips in JS; packages/shared/src/threadLinks.ts parses them.
+  static func hasThreadLink(_ text: String) -> Bool {
+    text.contains("t3-thread://v2/") || text.contains("https://app.t3.codes/threads/")
+  }
+
   static func write(text: String, fragment: String) {
     var items: [String: Any] = ["public.utf8-plain-text": text]
     if let data = fragment.data(using: .utf8),
diff --git a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
index f54f75caf5f50..188ab4a97b316 100644
--- a/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
+++ b/apps/mobile/modules/t3-composer-editor/ios/T3ComposerEditorView.swift
@@ -226,6 +226,12 @@ private final class ComposerTextView: UITextView {
       onPasteText?(text, selectedRange)
       return
     }
+    // read() sees only the first item; native paste keeps every item of a longer pasteboard.
+    if !bypassTextPasteInterception, pasteboard.numberOfItems == 1,
+       T3ComposerClipboard.hasThreadLink(context["text", default: ""]) {
+      onPasteContext?(context)
+      return
+    }
     super.paste(sender)
   }
 
diff --git a/apps/mobile/src/features/threads/ThreadFeed.tsx b/apps/mobile/src/features/threads/ThreadFeed.tsx
index e411b6a2b63f7..682f2cdb6b2ac 100644
--- a/apps/mobile/src/features/threads/ThreadFeed.tsx
+++ b/apps/mobile/src/features/threads/ThreadFeed.tsx
@@ -61,7 +61,7 @@ import {
 } from "@t3tools/contracts";
 import { renderAssistantCitationsAsText } from "@t3tools/shared/assistantCitations";
 import { encodeComposerContextFragment } from "@t3tools/shared/composerContextClipboard";
-import { parseThreadLinkHref } from "@t3tools/shared/threadLinks";
+import { hostedThreadLink, parseThreadLinkHref } from "@t3tools/shared/threadLinks";
 import { PROMPT_LINK_MAX_PROMPT_LENGTH } from "@t3tools/shared/promptLinks";
 import {
   parseComposerContextHref,
@@ -3058,9 +3058,10 @@ export const ThreadFeed = memo(function ThreadFeed({
         else if (actionId === "copy-skill") copyTextWithHaptic(`$${skill.name}`);
         return;
       }
-      if (resolveLinkedThread(href)) {
+      const thread = resolveLinkedThread(href);
+      if (thread) {
         if (actionId === "open-thread") onMarkdownLinkPress(href);
-        else if (actionId === "copy-thread-link") copyTextWithHaptic(href);
+        else if (actionId === "copy-thread-link") copyTextWithHaptic(hostedThreadLink(thread));
         return;
       }
       const target = resolveFileChipTarget(href, props.workspaceRoot);
diff --git a/apps/mobile/src/lib/composerContextClipboard.test.ts b/apps/mobile/src/lib/composerContextClipboard.test.ts
index b3fea2e6ded7d..77305cce84439 100644
--- a/apps/mobile/src/lib/composerContextClipboard.test.ts
+++ b/apps/mobile/src/lib/composerContextClipboard.test.ts
@@ -42,6 +42,9 @@ vi.mock("../state/session", () => ({
   environmentSession: { preparedConnectionValueAtom: vi.fn() },
 }));
 vi.mock("../state/assets", () => ({ assetEnvironment: { createUrl: (value: unknown) => value } }));
+vi.mock("../state/threads", () => ({
+  environmentThreadShells: { threadShellAtom: (value: unknown) => value },
+}));
 vi.mock("../state/use-composer-drafts", () => ({
   waitForComposerDraftsLoaded: async () => {},
   findLocalComposerClipboardAttachment: mocks.local,
@@ -336,4 +339,34 @@ describe("mobile context clipboard imports", () => {
       collectComposerContextReferences(result!.text).map((reference) => reference.contextId),
     ).toEqual(result!.context.records.map((record) => record.contextId));
   });
+
+  it("pastes a thread link as a chip only where the destination's agent reads its machine", async () => {
+    const text = [
+      "https://app.t3.codes/threads/destination/local-thread",
+      "<t3-thread://v2/source/foreign-thread>",
+    ].join(" ");
+    const result = await importComposerContextClipboard(
+      { text, fragment: "", html: "" },
+      0,
+      new AbortController().signal,
+      0,
+      EnvironmentId.make("destination"),
+    );
+    const [record] = result!.context.records;
+    expect(record).toMatchObject({
+      kind: "thread",
+      environmentId: "destination",
+      threadId: "local-thread",
+    });
+    expect(result!.text).toBe(
+      `[Thread](t3-context://v1/thread/${record!.contextId}) <t3-thread://v2/source/foreign-thread>`,
+    );
+    expect(
+      await importComposerContextClipboard(
+        { text: "plain text", fragment: "", html: "" },
+        0,
+        new AbortController().signal,
+      ),
+    ).toBeNull();
+  });
 });
diff --git a/apps/mobile/src/lib/composerContextClipboard.ts b/apps/mobile/src/lib/composerContextClipboard.ts
index 971191456cc20..8c5a31cdb7e44 100644
--- a/apps/mobile/src/lib/composerContextClipboard.ts
+++ b/apps/mobile/src/lib/composerContextClipboard.ts
@@ -13,13 +13,17 @@ import {
   decodeComposerContextFragment,
   encodeComposerContextFragment,
 } from "@t3tools/shared/composerContextClipboard";
-import { threadContextsOutsideEnvironment } from "@t3tools/shared/composerContextReferences";
+import {
+  threadContextsOutsideEnvironment,
+  threadLinkContextReferences,
+} from "@t3tools/shared/composerContextReferences";
 import { executeAtomQuery, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
 import { resolveAssetUrl } from "@t3tools/client-runtime/state/assets";
 import * as Option from "effect/Option";
 import { appAtomRegistry } from "../state/atom-registry";
 import { assetEnvironment } from "../state/assets";
 import { environmentSession } from "../state/session";
+import { environmentThreadShells } from "../state/threads";
 import { workspaceConnections } from "../state/workspace";
 import { downloadAttachmentForPreview } from "./attachmentDownload";
 import {
@@ -71,11 +75,38 @@ export async function importComposerContextClipboard(
   /** The machines the destination links to, whose threads its agent can read too. */
   linkedEnvironments: ReadonlyMap<EnvironmentId, string> = new Map(),
 ) {
-  const fragment =
+  const copied =
     decodeComposerContextFragment(input.fragment) ?? decodeComposerContextClipboardHtml(input.html);
-  if (!fragment) return null;
-  const selected = referencedComposerContext(input.text, { version: 1, records: fragment.records });
-  const imported = reidentifyComposerContext(input.text, selected?.records ?? [], uuidv4);
+  // A thread link becomes a chip only where this agent can read its machine; others stay links.
+  const threads = threadLinkContextReferences(
+    input.text,
+    copied?.records ?? [],
+    (ref) => appAtomRegistry.get(environmentThreadShells.threadShellAtom(ref))?.title,
+    (record) =>
+      destinationEnvironmentId === undefined ||
+      record.environmentId === destinationEnvironmentId ||
+      linkedEnvironments.has(record.environmentId)
+        ? record.contextId
+        : undefined,
+  );
+  const source =
+    copied?.source ??
+    (threads.records[0] ? { environmentId: threads.records[0].environmentId } : null);
+  if (!source) return null;
+  const fragment = {
+    source,
+    records: [
+      ...(copied?.records ?? []).filter((record) =>
+        threads.records.every((thread) => thread.contextId !== record.contextId),
+      ),
+      ...threads.records,
+    ],
+  };
+  const selected = referencedComposerContext(threads.text, {
+    version: 1,
+    records: fragment.records,
+  });
+  const imported = reidentifyComposerContext(threads.text, selected?.records ?? [], uuidv4);
   const skippedThreads =
     destinationEnvironmentId === undefined
       ? []
diff --git a/apps/server/src/auth/McpOAuth.ts b/apps/server/src/auth/McpOAuth.ts
index 0fb7f10d2ba14..3f4d7ff51f803 100644
--- a/apps/server/src/auth/McpOAuth.ts
+++ b/apps/server/src/auth/McpOAuth.ts
@@ -17,6 +17,7 @@ import {
   mcpClientScopes,
   type RuntimeMode,
 } from "@t3tools/contracts";
+import { DEFAULT_HOSTED_APP_URL } from "@t3tools/shared/connectAuth";
 import { encodeOAuthScope } from "@t3tools/shared/oauthScope";
 import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
@@ -30,6 +31,7 @@ import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
 import { HttpServerRequest } from "effect/http";
 
+import { hostedAppUrlConfig } from "../cloud/publicConfig.ts";
 import * as ServerEnvironment from "../environment/ServerEnvironment.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import * as McpHttpServer from "../mcp/McpHttpServer.ts";
@@ -577,6 +579,13 @@ export const layerMcpClientAuthenticator = Layer.effect(
     const environmentAuth = yield* EnvironmentAuth.EnvironmentAuth;
     const environment = yield* ServerEnvironment.ServerEnvironment;
     const environmentId = yield* environment.getEnvironmentId;
+    const hostedAppUrl = yield* hostedAppUrlConfig.pipe(
+      Effect.catch((cause) =>
+        Effect.logWarning("Outside MCP clients get app.t3.codes thread links", { cause }).pipe(
+          Effect.as(DEFAULT_HOSTED_APP_URL),
+        ),
+      ),
+    );
     return McpHttpServer.McpClientAuthenticator.of({
       authenticate: Effect.fn("McpHttpServer.McpClientAuthenticator.authenticate")(
         function (request) {
@@ -592,7 +601,7 @@ export const layerMcpClientAuthenticator = Layer.effect(
                     label: client.label,
                     access: client.access,
                     linked: client.peerLink,
-                    ...(client.peerLink ? {} : { webOrigin: requestUrls(request).issuer }),
+                    ...(client.peerLink ? {} : { hostedAppUrl }),
                   },
                   capabilities: new Set<McpInvocationContext.McpCapability>([
                     "orchestration",
diff --git a/apps/server/src/mcp/McpInvocationContext.ts b/apps/server/src/mcp/McpInvocationContext.ts
index 181ac3a9cfb2c..842d18ad9c8bc 100644
--- a/apps/server/src/mcp/McpInvocationContext.ts
+++ b/apps/server/src/mcp/McpInvocationContext.ts
@@ -12,7 +12,7 @@ import {
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
-import { formatThreadLink } from "@t3tools/shared/threadLinks";
+import { formatThreadLink, hostedThreadLink } from "@t3tools/shared/threadLinks";
 
 const ALL_MCP_CAPABILITIES = [
   "preview",
@@ -45,8 +45,8 @@ export interface McpClientCaller {
    * another environment passing on the limits of the agent it calls for.
    */
   readonly narrowedTo?: ClientModes | undefined;
-  /** The origin an outside client reached; its thread links open the web app there. */
-  readonly webOrigin?: string | undefined;
+  /** An outside client's thread links go through this hosted app, as Copy thread's do. */
+  readonly hostedAppUrl?: string | undefined;
 }
 
 /**
@@ -135,16 +135,15 @@ export interface McpInvocationScope {
 
 /**
  * T3 Code renders `t3-thread://` links as thread chips. Other MCP clients cannot open them, so
- * they get a web URL on the origin they reached instead.
+ * they get the hosted link Copy thread copies, which opens the thread in either app or a browser.
  */
 export const threadLinkFor = (
   scope: Pick<McpInvocationScope, "environmentId" | "client">,
   threadId: ThreadId,
 ): string => {
-  const origin = scope.client?.webOrigin;
-  return origin === undefined
-    ? formatThreadLink({ environmentId: scope.environmentId, threadId })
-    : `${origin}/${encodeURIComponent(scope.environmentId)}/${encodeURIComponent(threadId)}`;
+  const hostedAppUrl = scope.client?.hostedAppUrl;
+  const ref = { environmentId: scope.environmentId, threadId };
+  return hostedAppUrl === undefined ? formatThreadLink(ref) : hostedThreadLink(ref, hostedAppUrl);
 };
 
 export class McpInvocationContext extends Context.Service<
diff --git a/apps/server/src/mcp/toolkits/project/handlers.test.ts b/apps/server/src/mcp/toolkits/project/handlers.test.ts
index 8d7369bc85e8d..6721e89478550 100644
--- a/apps/server/src/mcp/toolkits/project/handlers.test.ts
+++ b/apps/server/src/mcp/toolkits/project/handlers.test.ts
@@ -50,7 +50,7 @@ const clientLaunchHarness = (input: {
   readonly launched: Array<ThreadLaunch.ThreadLaunchInput>;
   readonly workspaceRoot?: string;
   readonly checkWorktreeBase?: ThreadLaunch.ThreadLaunchService["Service"]["checkWorktreeBase"];
-  readonly webOrigin?: string;
+  readonly hostedAppUrl?: string;
   /** The orchestrator refuses the new thread's mode, as under a managed ceiling. */
   readonly refusedByCeiling?: true;
 }) => {
@@ -89,7 +89,7 @@ const clientLaunchHarness = (input: {
         sessionId: "session-1",
         label: "Claude Code",
         access: input.runtimeModeCeiling,
-        webOrigin: input.webOrigin,
+        hostedAppUrl: input.hostedAppUrl,
       },
       issuedAt: 0,
       capabilities: new Set(["orchestration" as const]),
@@ -187,18 +187,18 @@ it.effect(
           readonly runtimeMode?: RuntimeMode;
           readonly targeted?: false;
           readonly overrideModel?: ModelSelection;
-          readonly webOrigin?: string;
+          readonly hostedAppUrl?: string;
           readonly refusedByCeiling?: true;
         },
       ) {
-        const { targeted, overrideModel, webOrigin, refusedByCeiling, ...input } = params;
+        const { targeted, overrideModel, hostedAppUrl, refusedByCeiling, ...input } = params;
         const launched: Array<ThreadLaunch.ThreadLaunchInput> = [];
         const { projectId, modelSelection, dependencies } = clientLaunchHarness({
           runtimeModeCeiling,
           defaultRuntimeMode,
           launched,
           ...(overrideModel === undefined ? {} : { overrideModel }),
-          ...(webOrigin === undefined ? {} : { webOrigin }),
+          ...(hostedAppUrl === undefined ? {} : { hostedAppUrl }),
           ...(refusedByCeiling === undefined ? {} : { refusedByCeiling }),
         });
         const toolkit = yield* ProjectToolkit.pipe(
@@ -228,11 +228,11 @@ it.effect(
 
       const aboveCeiling = yield* launchWith("auto-accept-edits", "full-access", {
         title: "Fix",
-        webOrigin: "https://box.example.ts.net",
+        hostedAppUrl: "https://t3.example.com",
       });
       expect(aboveCeiling.launched[0]?.runtimeMode).toBe("auto-accept-edits");
       expect(aboveCeiling.result).toMatchObject({
-        link: `https://box.example.ts.net/environment/${encodeURIComponent(aboveCeiling.launched[0]?.threadId ?? "")}`,
+        link: `https://t3.example.com/threads/environment/${encodeURIComponent(aboveCeiling.launched[0]?.threadId ?? "")}`,
       });
 
       const requested = yield* launchWith("full-access", "approval-required", {
diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index a1c1c7bc91a5b..d1225065aeeca 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -5,6 +5,7 @@ import { resolveNewThreadModelSelection } from "@t3tools/shared/usageLimits";
 import { queuedRunEditBlockedReason } from "@t3tools/client-runtime/queued-run-edit";
 import { ScrollToEndButton, WorkspaceFileDropOverlay } from "./chat/TimelineOverlays";
 import { usePasteToFocusComposer } from "./chat/usePasteToFocusComposer";
+import { configuredHostedAppUrl } from "../hostedPairing";
 import { announcedRun, isDetailBehindShell } from "./chat/threadActivityAnnouncement";
 import {
   deriveAvailableRevertTurnCounts,
@@ -2322,6 +2323,7 @@ export default function ChatView(props: ChatViewProps) {
           openPanelPullRequestUrl,
           pullRequests: activeThread?.pullRequests,
           linkedPullRequestUrl: linkedThreadPullRequest?.url ?? null,
+          hostedAppUrl: configuredHostedAppUrl(),
         });
   const copyActiveThreadReference = () => {
     if (activeThreadReferenceCopyTarget === null) return;
diff --git a/apps/web/src/components/CommandPalette.tsx b/apps/web/src/components/CommandPalette.tsx
index ddac4fc4d7c17..f14a483d5332a 100644
--- a/apps/web/src/components/CommandPalette.tsx
+++ b/apps/web/src/components/CommandPalette.tsx
@@ -106,6 +106,7 @@ import {
 import { useClientSettings } from "../hooks/useSettings";
 import { useStableCallback } from "../hooks/useStableCallback";
 import { readLocalApi } from "../localApi";
+import { configuredHostedAppUrl } from "../hostedPairing";
 import { desktopLocalBackendId } from "../connection/desktopLocal";
 import { filesystemEnvironment, useFilesystemReadAccess } from "../state/filesystem";
 import { projectEnvironment } from "../state/projects";
@@ -489,6 +490,7 @@ function OpenCommandPaletteDialog(props: {
           pullRequests: activeThread?.pullRequests,
           linkedPullRequestUrl:
             activeThread?.linkedPullRequest?.url ?? activeThread?.branchPullRequest?.url ?? null,
+          hostedAppUrl: configuredHostedAppUrl(),
         });
   const copyActiveThreadReference = async () => {
     if (activeThreadReferenceCopyTarget === null) return;
diff --git a/apps/web/src/components/Sidebar.tsx b/apps/web/src/components/Sidebar.tsx
index 868aa85cec61b..18aa27709e4c0 100644
--- a/apps/web/src/components/Sidebar.tsx
+++ b/apps/web/src/components/Sidebar.tsx
@@ -103,6 +103,7 @@ import { isModelPickerOpen } from "../modelPickerVisibility";
 import { selectThreadTerminalUiState, useTerminalUiStateStore } from "../terminalUiStateStore";
 import { isMacPlatform } from "~/lib/utils";
 import { readLocalApi } from "../localApi";
+import { configuredHostedAppUrl } from "../hostedPairing";
 import { useSidebarPendingFileDropStore } from "../sidebarPendingFileDropStore";
 import {
   pickableProjectGroups,
@@ -2809,7 +2810,9 @@ export default function Sidebar({ routeReveal }: { routeReveal: SidebarRouteReve
             }
             return;
           case "copy-thread":
-            void copyThreadReference(threadChipCopyTarget(threadRef, thread.title));
+            void copyThreadReference(
+              threadChipCopyTarget(threadRef, thread.title, configuredHostedAppUrl()),
+            );
             return;
           case "copy-thread-id":
             copyThreadIdToClipboard(thread.id, { threadId: thread.id });
diff --git a/apps/web/src/components/chat/MarkdownThreadLink.tsx b/apps/web/src/components/chat/MarkdownThreadLink.tsx
index 68ab4cd569e0d..f3e95c026be28 100644
--- a/apps/web/src/components/chat/MarkdownThreadLink.tsx
+++ b/apps/web/src/components/chat/MarkdownThreadLink.tsx
@@ -1,13 +1,14 @@
 import { scopeThreadRef } from "@t3tools/client-runtime/environment";
 import type { EnvironmentId } from "@t3tools/contracts";
 import {
-  formatThreadLink,
+  formatHostedThreadLink,
   guessThreadLinkRef,
   percentDecodedThreadLinkId,
   type ThreadLink,
   unknownThreadLinkLabel,
 } from "@t3tools/shared/threadLinks";
 
+import { configuredHostedAppUrl } from "../../hostedPairing";
 import { useThreadRefs, useThreadShell } from "../../state/entities";
 import { UnresolvedChip } from "../contextChipParts";
 import { ThreadContextChip } from "../ThreadContextChip";
@@ -36,6 +37,9 @@ export function MarkdownThreadLink(props: {
   const ref = { environmentId: thread.environmentId, threadId: thread.id };
   const title = thread.title.trim() || props.label || "Untitled thread";
   return (
-    <ThreadContextChip record={{ ...ref, title }} copyMarkdown={formatThreadLink(ref, title)} />
+    <ThreadContextChip
+      record={{ ...ref, title }}
+      copyMarkdown={formatHostedThreadLink(ref, title, configuredHostedAppUrl())}
+    />
   );
 }
diff --git a/apps/web/src/components/composerInlineTokenPaste.test.ts b/apps/web/src/components/composerInlineTokenPaste.test.ts
new file mode 100644
index 0000000000000..1ab28a5b7ff51
--- /dev/null
+++ b/apps/web/src/components/composerInlineTokenPaste.test.ts
@@ -0,0 +1,59 @@
+import { threadChipCopyTarget } from "@t3tools/client-runtime/thread-reference";
+import { type ComposerContextClipboardFragment, EnvironmentId, ThreadId } from "@t3tools/contracts";
+import {
+  COMPOSER_CONTEXT_CLIPBOARD_MIME,
+  encodeComposerContextFragment,
+} from "@t3tools/shared/composerContextClipboard";
+import { threadContextRecord } from "@t3tools/shared/composerContextReferences";
+import { describe, expect, it } from "vite-plus/test";
+
+import { importPastedComposerText } from "./composerInlineTokenPaste";
+
+const thread = {
+  environmentId: EnvironmentId.make("env-1"),
+  threadId: ThreadId.make("thread-1"),
+};
+const clipboard = (data: Record<string, string>) => ({
+  getData: (type: string) => data[type] ?? "",
+});
+const chip = (title: string) =>
+  `[${title}](t3-context://v1/thread/${threadContextRecord(thread, title).contextId})`;
+
+/** Imports every record it is offered, as the composer does for a thread its agent can read. */
+const importAll =
+  (imported: Array<ComposerContextClipboardFragment>) =>
+  (fragment: ComposerContextClipboardFragment) => {
+    imported.push(fragment);
+    return new Map(fragment.records.map((record) => [record.contextId, record.contextId]));
+  };
+
+describe("importPastedComposerText", () => {
+  it("pastes a copied thread link back as the chip it was copied from", () => {
+    const target = threadChipCopyTarget(thread, "Fix the login flow");
+    const imported: Array<ComposerContextClipboardFragment> = [];
+    const text = importPastedComposerText(
+      clipboard({
+        "text/plain": `See ${target.value}`,
+        [COMPOSER_CONTEXT_CLIPBOARD_MIME]: encodeComposerContextFragment(target.fragment!)!,
+      }),
+      importAll(imported),
+    );
+    expect(text).toBe(`See ${chip("Fix the login flow")}`);
+    expect(imported.map((fragment) => fragment.records)).toEqual([target.fragment!.records]);
+  });
+
+  it("makes a chip of a v2 link pasted without T3's clipboard format", () => {
+    const text = importPastedComposerText(
+      clipboard({ "text/plain": "[Login](t3-thread://v2/env-1/thread-1)" }),
+      importAll([]),
+    );
+    expect(text).toBe(chip("Login"));
+  });
+
+  it("keeps the link when the composer cannot take the thread", () => {
+    const pasted = "https://app.t3.codes/threads/env-1/thread-1";
+    expect(importPastedComposerText(clipboard({ "text/plain": pasted }), () => new Map())).toBe(
+      pasted,
+    );
+  });
+});
diff --git a/apps/web/src/components/composerInlineTokenPaste.ts b/apps/web/src/components/composerInlineTokenPaste.ts
index 32722ad6a9571..0862f81ee8355 100644
--- a/apps/web/src/components/composerInlineTokenPaste.ts
+++ b/apps/web/src/components/composerInlineTokenPaste.ts
@@ -1,5 +1,9 @@
 import { ComposerContextId } from "@t3tools/contracts";
-import type { ComposerContextClipboardFragment } from "@t3tools/contracts";
+import type {
+  ComposerContextClipboardFragment,
+  ComposerContextRecord,
+  ScopedThreadRef,
+} from "@t3tools/contracts";
 import {
   COMPOSER_CONTEXT_CLIPBOARD_MIME,
   decodeComposerContextFragment,
@@ -9,7 +13,14 @@ import {
   collectComposerContextReferences,
   formatComposerContextReference,
   replaceComposerContextReferences,
+  threadLinkContextReferences,
 } from "@t3tools/shared/composerContextReferences";
+
+import { readThreadShell } from "~/state/entities";
+
+const threadTitle = (ref: ScopedThreadRef) => readThreadShell(ref)?.title;
+
+/** Pasted thread links count as context too, so they become chips like a copied chip does. */
 export function readPastedComposerContext(
   clipboardData: Pick<DataTransfer, "getData">,
 ): ComposerContextClipboardFragment | null {
@@ -17,11 +28,20 @@ export function readPastedComposerContext(
   const decodedFragment =
     decodeComposerContextFragment(clipboardData.getData(COMPOSER_CONTEXT_CLIPBOARD_MIME)) ??
     decodeComposerContextClipboardHtml(clipboardData.getData("text/html"));
-  if (decodedFragment === null) return null;
+  const threads = threadLinkContextReferences(
+    pastedText,
+    decodedFragment?.records ?? [],
+    threadTitle,
+  );
+  const source =
+    decodedFragment?.source ??
+    (threads.records[0] ? { environmentId: threads.records[0].environmentId } : null);
+  if (source === null) return null;
   const pastedIds = new Set<string>(
-    collectComposerContextReferences(pastedText).map((occurrence) => occurrence.contextId),
+    collectComposerContextReferences(threads.text).map((occurrence) => occurrence.contextId),
   );
-  for (const record of decodedFragment.records) {
+  const records = new Map<string, ComposerContextRecord>();
+  for (const record of [...(decodedFragment?.records ?? []), ...threads.records]) {
     if (
       record.kind === "preview-annotation" &&
       !("payload" in record) &&
@@ -30,10 +50,12 @@ export function readPastedComposerContext(
     ) {
       pastedIds.add(record.screenshotContextId);
     }
+    records.set(record.contextId, record);
   }
   return {
-    ...decodedFragment,
-    records: decodedFragment.records.filter((record) => pastedIds.has(record.contextId)),
+    version: 1,
+    source,
+    records: [...records.values()].filter((record) => pastedIds.has(record.contextId)),
   };
 }
 
@@ -47,18 +69,23 @@ export function importPastedComposerText(
   const fragment = importContextFragment ? readPastedComposerContext(clipboardData) : null;
   const rewrittenIds =
     fragment && fragment.records.length > 0 ? importContextFragment!(fragment) : null;
-  const text =
-    rewrittenIds && rewrittenIds.size > 0
-      ? replaceComposerContextReferences(pastedText, (occurrence) => {
-          const nextId = rewrittenIds.get(occurrence.contextId);
-          return nextId
-            ? formatComposerContextReference({
-                ...occurrence,
-                contextId: ComposerContextId.make(nextId),
-                kind: occurrence.kind === "element" ? "preview-annotation" : occurrence.kind,
-              })
-            : occurrence.source;
+  if (!rewrittenIds || rewrittenIds.size === 0) return pastedText;
+  const nextId = (contextId: string) => {
+    const id = rewrittenIds.get(contextId);
+    return id ? ComposerContextId.make(id) : undefined;
+  };
+  const text = replaceComposerContextReferences(pastedText, (occurrence) => {
+    const contextId = nextId(occurrence.contextId);
+    return contextId
+      ? formatComposerContextReference({
+          ...occurrence,
+          contextId,
+          kind: occurrence.kind === "element" ? "preview-annotation" : occurrence.kind,
         })
-      : pastedText;
-  return text;
+      : occurrence.source;
+  });
+  // A thread the import refused, on a machine this agent cannot read, stays the link it was.
+  return threadLinkContextReferences(text, fragment?.records ?? [], threadTitle, (record) =>
+    nextId(record.contextId),
+  ).text;
 }
diff --git a/apps/web/src/components/promptLinks/HostedPromptLinkLanding.tsx b/apps/web/src/components/promptLinks/HostedPromptLinkLanding.tsx
index 24facbea1911f..ca44345e177f0 100644
--- a/apps/web/src/components/promptLinks/HostedPromptLinkLanding.tsx
+++ b/apps/web/src/components/promptLinks/HostedPromptLinkLanding.tsx
@@ -23,19 +23,36 @@ const OPENER_STORAGE_KEY = "t3code:prompt-link-opener";
 const Opener = Schema.NullOr(Schema.Literals(["app", "browser"]));
 
 interface LinkSummary {
+  readonly title: string;
+  readonly description: string;
   readonly prompt: LinkedPrompt | null;
   readonly details: ReadonlyArray<string>;
 }
 
+const PROMPT_HEADER = {
+  title: "Open this prompt",
+  description: "It opens as a draft. Nothing runs until you press Send.",
+};
+
 function summarize(
   appPath: string,
 ): { ok: true; value: LinkSummary } | { ok: false; error: string } {
   const url = new URL(appPath, window.location.origin);
   if (url.pathname !== "/new") {
     const prompt = parseThreadLinkPrompt(url.search);
-    return prompt.ok
-      ? { ok: true, value: { prompt: prompt.value, details: ["Opens one of your threads."] } }
-      : prompt;
+    if (!prompt.ok) return prompt;
+    return {
+      ok: true,
+      value:
+        prompt.value === null
+          ? {
+              title: "Open this thread",
+              description: "It opens in T3 Code if you're connected to the machine it runs on.",
+              prompt: null,
+              details: [],
+            }
+          : { ...PROMPT_HEADER, prompt: prompt.value, details: ["Opens one of your threads."] },
+    };
   }
   const link = parseNewThreadLink(url.search);
   if (!link.ok) return link;
@@ -43,13 +60,18 @@ function summarize(
     const { owner, name, number } = link.value.pullRequest;
     return {
       ok: true,
-      value: { prompt: link.value.prompt, details: [`Pull request ${owner}/${name}#${number}`] },
+      value: {
+        ...PROMPT_HEADER,
+        prompt: link.value.prompt,
+        details: [`Pull request ${owner}/${name}#${number}`],
+      },
     };
   }
   const { repository, provider, model } = link.value;
   return {
     ok: true,
     value: {
+      ...PROMPT_HEADER,
       prompt: link.value.prompt,
       details: [
         repository ? `Repository ${repository.owner}/${repository.name}` : "No project",
@@ -119,13 +141,10 @@ function HostedPromptLinkLanding({
     );
   }
 
-  const { prompt, details } = summary.value;
+  const { title, description, prompt, details } = summary.value;
   return (
     <StandalonePage>
-      <StandalonePageHeader
-        title="Open this prompt"
-        description="It opens as a draft. Nothing runs until you press Send."
-      />
+      <StandalonePageHeader title={title} description={description} />
       {prompt !== null && prompt.hiddenCharacters > 0 ? (
         <Alert className="mt-5" variant="error">
           <AlertTitle>This prompt had hidden characters, it may be malicious</AlertTitle>
@@ -140,7 +159,9 @@ function HostedPromptLinkLanding({
           {prompt.text}
         </pre>
       ) : null}
-      <p className="mt-3 text-xs text-muted-foreground">{details.join(" · ")}</p>
+      {details.length > 0 ? (
+        <p className="mt-3 text-xs text-muted-foreground">{details.join(" · ")}</p>
+      ) : null}
       <div className="mt-6 flex flex-wrap gap-2">
         <Button render={<a href={deepLink} />} onClick={() => onChoose("app", remember)}>
           {onPhone ? "Open in app" : "Open in desktop app"}
diff --git a/apps/web/src/hooks/useThreadActionMenu.ts b/apps/web/src/hooks/useThreadActionMenu.ts
index cddef6046cf8b..d22b1d9cf6c4f 100644
--- a/apps/web/src/hooks/useThreadActionMenu.ts
+++ b/apps/web/src/hooks/useThreadActionMenu.ts
@@ -35,6 +35,7 @@ import {
 } from "../state/entities";
 import { usePrimaryEnvironmentId } from "../state/environments";
 import { readLocalApi } from "../localApi";
+import { configuredHostedAppUrl } from "../hostedPairing";
 import {
   deriveLogicalProjectKeyFromSettings,
   derivePhysicalProjectKey,
@@ -295,7 +296,9 @@ export function useThreadActionMenu(input: {
           }
           return;
         case "copy-thread":
-          void copyThreadReference(threadChipCopyTarget(threadRef, thread.title));
+          void copyThreadReference(
+            threadChipCopyTarget(threadRef, thread.title, configuredHostedAppUrl()),
+          );
           return;
         case "copy-thread-id":
           copyThreadIdToClipboard(thread.id, { threadId: thread.id });
diff --git a/apps/web/src/routeTree.gen.ts b/apps/web/src/routeTree.gen.ts
index 0e26ab6edd879..33843126b2a45 100644
--- a/apps/web/src/routeTree.gen.ts
+++ b/apps/web/src/routeTree.gen.ts
@@ -21,6 +21,7 @@ import { Route as ChatUsageRouteImport } from './routes/_chat.usage'
 import { Route as ChatSettingsRouteImport } from './routes/_chat.settings'
 import { Route as ChatPullRequestsRouteImport } from './routes/_chat.pull-requests'
 import { Route as ChatNewRouteImport } from './routes/_chat.new'
+import { Route as ThreadsEnvironmentIdThreadIdRouteImport } from './routes/threads.$environmentId.$threadId'
 import { Route as ChatSettingsWorktreesRouteImport } from './routes/_chat.settings.worktrees'
 import { Route as ChatSettingsThreadsRouteImport } from './routes/_chat.settings.threads'
 import { Route as ChatSettingsStorageRouteImport } from './routes/_chat.settings.storage'
@@ -109,6 +110,12 @@ const ChatNewRoute = ChatNewRouteImport.update({
   path: '/new',
   getParentRoute: () => ChatRoute,
 } as any)
+const ThreadsEnvironmentIdThreadIdRoute =
+  ThreadsEnvironmentIdThreadIdRouteImport.update({
+    id: '/threads/$environmentId/$threadId',
+    path: '/threads/$environmentId/$threadId',
+    getParentRoute: () => rootRouteImport,
+  } as any)
 const ChatSettingsWorktreesRoute = ChatSettingsWorktreesRouteImport.update({
   id: '/worktrees',
   path: '/worktrees',
@@ -295,6 +302,7 @@ export interface FileRoutesByFullPath {
   '/settings/storage': typeof ChatSettingsStorageRoute
   '/settings/threads': typeof ChatSettingsThreadsRoute
   '/settings/worktrees': typeof ChatSettingsWorktreesRoute
+  '/threads/$environmentId/$threadId': typeof ThreadsEnvironmentIdThreadIdRoute
 }
 export interface FileRoutesByTo {
   '/connect': typeof ConnectRoute
@@ -336,6 +344,7 @@ export interface FileRoutesByTo {
   '/settings/storage': typeof ChatSettingsStorageRoute
   '/settings/threads': typeof ChatSettingsThreadsRoute
   '/settings/worktrees': typeof ChatSettingsWorktreesRoute
+  '/threads/$environmentId/$threadId': typeof ThreadsEnvironmentIdThreadIdRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
@@ -379,6 +388,7 @@ export interface FileRoutesById {
   '/_chat/settings/storage': typeof ChatSettingsStorageRoute
   '/_chat/settings/threads': typeof ChatSettingsThreadsRoute
   '/_chat/settings/worktrees': typeof ChatSettingsWorktreesRoute
+  '/threads/$environmentId/$threadId': typeof ThreadsEnvironmentIdThreadIdRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
@@ -422,6 +432,7 @@ export interface FileRouteTypes {
     | '/settings/storage'
     | '/settings/threads'
     | '/settings/worktrees'
+    | '/threads/$environmentId/$threadId'
   fileRoutesByTo: FileRoutesByTo
   to:
     | '/connect'
@@ -463,6 +474,7 @@ export interface FileRouteTypes {
     | '/settings/storage'
     | '/settings/threads'
     | '/settings/worktrees'
+    | '/threads/$environmentId/$threadId'
   id:
     | '__root__'
     | '/_chat'
@@ -505,6 +517,7 @@ export interface FileRouteTypes {
     | '/_chat/settings/storage'
     | '/_chat/settings/threads'
     | '/_chat/settings/worktrees'
+    | '/threads/$environmentId/$threadId'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
@@ -515,6 +528,7 @@ export interface RootRouteChildren {
   PairRoute: typeof PairRoute
   WelcomeRoute: typeof WelcomeRoute
   ProjectsProjectKeyRoute: typeof ProjectsProjectKeyRoute
+  ThreadsEnvironmentIdThreadIdRoute: typeof ThreadsEnvironmentIdThreadIdRoute
 }
 
 declare module '@tanstack/react-router' {
@@ -603,6 +617,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof ChatNewRouteImport
       parentRoute: typeof ChatRoute
     }
+    '/threads/$environmentId/$threadId': {
+      id: '/threads/$environmentId/$threadId'
+      path: '/threads/$environmentId/$threadId'
+      fullPath: '/threads/$environmentId/$threadId'
+      preLoaderRoute: typeof ThreadsEnvironmentIdThreadIdRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/_chat/settings/worktrees': {
       id: '/_chat/settings/worktrees'
       path: '/worktrees'
@@ -894,6 +915,7 @@ const rootRouteChildren: RootRouteChildren = {
   PairRoute: PairRoute,
   WelcomeRoute: WelcomeRoute,
   ProjectsProjectKeyRoute: ProjectsProjectKeyRoute,
+  ThreadsEnvironmentIdThreadIdRoute: ThreadsEnvironmentIdThreadIdRoute,
 }
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)
diff --git a/apps/web/src/routes/threads.$environmentId.$threadId.tsx b/apps/web/src/routes/threads.$environmentId.$threadId.tsx
new file mode 100644
index 0000000000000..e3583b0737fdc
--- /dev/null
+++ b/apps/web/src/routes/threads.$environmentId.$threadId.tsx
@@ -0,0 +1,9 @@
+import { Navigate, createFileRoute } from "@tanstack/react-router";
+
+// A copied thread link. On the hosted app its chooser shows first; this opens the thread after it.
+export const Route = createFileRoute("/threads/$environmentId/$threadId")({
+  component: function ThreadLinkRedirect() {
+    const params = Route.useParams();
+    return <Navigate to="/$environmentId/$threadId" params={params} search replace />;
+  },
+});
diff --git a/docs/orchestration-v2/orchestrator-mcp-server.md b/docs/orchestration-v2/orchestrator-mcp-server.md
index 41146da1ed4c1..2f6ba5363703a 100644
--- a/docs/orchestration-v2/orchestrator-mcp-server.md
+++ b/docs/orchestration-v2/orchestrator-mcp-server.md
@@ -412,8 +412,9 @@ know renders as a label that opens nothing. Older `t3-thread://v1/<threadId>`
 links name no environment: clients resolve them in the message's environment,
 then by a unique match in another enabled environment. An outside OAuth client,
 one that is not a linked environment, cannot render `t3-thread://` links, so it
-gets a web URL on the origin it reached, `<origin>/<environmentId>/<threadId>`,
-for threads in this environment.
+gets the link Copy thread copies, `https://app.t3.codes/threads/<environmentId>/<threadId>`
+on the server's `T3CODE_HOSTED_APP_URL`, for threads in this environment. The
+hosted app offers the desktop app, the mobile app, or itself.
 
 List and read results report `snoozed` and `snoozedUntil`, and
 `t3_thread_list` filters on `snoozed`. The server's `isSnoozed` follows the
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 0008e15fce27a..aa670e0b4da8d 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -304,14 +304,15 @@ the repository by text. Choose a result to insert it as a chip.
 Another thread can be context too. Type `@` followed by part of its title to pick one from
 the same server, or from a machine it links to while the Linked environments beta is on; those
 show the machine's name. On web and desktop you can also drag a thread out of the sidebar and
-drop it on the composer; a multi-selection drops together. On any client, **Copy thread** puts a
-thread on the clipboard that pastes into a composer as its chip. The chip shows the thread's
+drop it on the composer; a multi-selection drops together. On any client, **Copy thread** copies a
+link to the thread that pastes into a composer as its chip. The chip shows the thread's
 current title and opens it when selected. Your prompt only carries a reference: the agent reads the thread's
 history on demand, so attaching a long thread costs nothing until the agent looks. Attaching a
 thread does not change it, and the agent cannot send messages to it unless you ask.
 
 A thread from a linked machine, picked, pasted or dropped, stays a reference that the agent reads
-on that machine. Dropping a thread from any other environment attaches a saved transcript file. The source
+on that machine. A pasted link to a thread on any other machine stays a link. Dropping a thread
+from any other environment attaches a saved transcript file. The source
 environment must be connected and up to date. The transcript includes the visible history and
 saved text context at the time of the drop; later messages and the contents of attached files
 are not copied. The agent can read the saved transcript after the source disconnects. Normal
diff --git a/docs/user/prompt-links.md b/docs/user/prompt-links.md
index 656cf39232a80..4553e33e50880 100644
--- a/docs/user/prompt-links.md
+++ b/docs/user/prompt-links.md
@@ -54,3 +54,10 @@ before it replaces it.
 T3 Code removes characters you cannot see, such as zero-width and hidden tag characters, because
 they can hide instructions for the agent. When a prompt had them, T3 Code warns you that it may be
 malicious.
+
+## Share a thread
+
+**Copy thread** copies a link such as `https://app.t3.codes/threads/<environment>/<thread>`. Paste
+it anywhere, such as Slack, a GitHub comment, or your notes. Opening it asks where to open it, like
+a prompt link, then opens the thread. Only someone connected to the machine that runs the thread
+can see it. In T3 Code, a thread link in a message opens the thread in the app.
diff --git a/docs/user/thread-sidebar.md b/docs/user/thread-sidebar.md
index 37f679725f81b..6a3145d17512f 100644
--- a/docs/user/thread-sidebar.md
+++ b/docs/user/thread-sidebar.md
@@ -230,9 +230,11 @@ palette.
 
 Use **Settings → Keybindings** to find or customize shortcuts for searching files
 and copying a thread reference. A copied reference uses the thread's pull request
-link when available, otherwise the thread itself, which pastes into a composer as
-a thread chip. To copy the thread even when it has a PR, choose **Copy → Thread**
-from its context menu, or **Copy thread** from its long-press menu on mobile.
+link when available, otherwise a link to the thread, which opens it from anywhere
+you paste it and pastes into a composer as a thread chip (see
+[sharing a thread](./prompt-links.md#share-a-thread)). To copy the thread even
+when it has a PR, choose **Copy → Thread** from its context menu, or **Copy
+thread** from its long-press menu on mobile.
 **Thread ID** copies the bare ID for scripts and the `t3` CLI. See
 [keybindings](./keybindings.md) for custom configuration.
 
diff --git a/packages/client-runtime/src/threadReference.test.ts b/packages/client-runtime/src/threadReference.test.ts
index 9fa3245df5754..88905f9cec532 100644
--- a/packages/client-runtime/src/threadReference.test.ts
+++ b/packages/client-runtime/src/threadReference.test.ts
@@ -3,7 +3,7 @@ import {
   decodeComposerContextFragment,
   encodeComposerContextFragment,
 } from "@t3tools/shared/composerContextClipboard";
-import { collectComposerContextReferences } from "@t3tools/shared/composerContextReferences";
+import { threadLinkContextReferences } from "@t3tools/shared/composerContextReferences";
 import { describe, expect, it } from "vite-plus/test";
 
 import { resolveThreadReferenceCopyTarget } from "./threadReference.ts";
@@ -98,13 +98,18 @@ describe("resolveThreadReferenceCopyTarget", () => {
         }),
       ],
     });
-    // A paste keeps only the records its plain text references.
-    expect(collectComposerContextReferences(target!.value)).toEqual([
-      expect.objectContaining({
-        kind: "thread",
-        contextId: pasted!.records[0]!.contextId,
-        label: "Fix the login flow",
-      }),
-    ]);
+    // The plain text opens the thread anywhere and pastes back as the copied record's chip.
+    expect(target!.value).toBe("https://app.t3.codes/threads/env-1/thread-1");
+    expect(threadLinkContextReferences(target!.value, pasted!.records, () => undefined)).toEqual({
+      text: `[Fix the login flow](t3-context://v1/thread/${pasted!.records[0]!.contextId})`,
+      records: pasted!.records,
+    });
+  });
+
+  it("links through the build's hosted app", () => {
+    expect(
+      resolveThreadReferenceCopyTarget({ ...thread, hostedAppUrl: "https://preview.t3.codes" })
+        ?.value,
+    ).toBe("https://preview.t3.codes/threads/env-1/thread-1");
   });
 });
diff --git a/packages/client-runtime/src/threadReference.ts b/packages/client-runtime/src/threadReference.ts
index 94f68202a62cf..17fa5df458935 100644
--- a/packages/client-runtime/src/threadReference.ts
+++ b/packages/client-runtime/src/threadReference.ts
@@ -3,16 +3,14 @@ import type {
   ScopedThreadRef,
   ThreadPullRequestLink,
 } from "@t3tools/contracts";
-import {
-  formatComposerContextReference,
-  threadContextRecord,
-} from "@t3tools/shared/composerContextReferences";
+import { threadContextRecord } from "@t3tools/shared/composerContextReferences";
+import { hostedThreadLink } from "@t3tools/shared/threadLinks";
 
 import { resolveThreadCurrentPullRequestLink } from "./threadPullRequests.ts";
 
 export interface ThreadReferenceCopyTarget {
   readonly kind: "pull-request" | "thread";
-  /** The plain text: a PR URL, or a thread chip's reference link. */
+  /** The plain text: a PR URL, or a link that opens the thread from anywhere. */
   readonly value: string;
   /** What a toast or palette row shows for the copy. */
   readonly description: string;
@@ -23,15 +21,19 @@ export interface ThreadReferenceCopyTarget {
   readonly failureTitle: string;
 }
 
-/** A thread chip pastes into any composer whose agent reads that thread's machine. */
+/**
+ * A link that opens the thread from anywhere, through `hostedAppUrl`, this build's hosted app. It
+ * pastes back as a chip into any composer whose agent reads that thread's machine.
+ */
 export function threadChipCopyTarget(
   threadRef: ScopedThreadRef,
   title: string,
+  hostedAppUrl?: string,
 ): ThreadReferenceCopyTarget {
   const record = threadContextRecord(threadRef, title);
   return {
     kind: "thread",
-    value: formatComposerContextReference(record),
+    value: hostedThreadLink(threadRef, hostedAppUrl),
     description: record.title,
     fragment: { version: 1, source: { environmentId: threadRef.environmentId }, records: [record] },
     clipboardTarget: "thread",
@@ -47,6 +49,7 @@ export function resolveThreadReferenceCopyTarget(input: {
   readonly openPanelPullRequestUrl?: string | null | undefined;
   readonly pullRequests?: ReadonlyArray<ThreadPullRequestLink> | undefined;
   readonly linkedPullRequestUrl?: string | null;
+  readonly hostedAppUrl?: string;
 }): ThreadReferenceCopyTarget | null {
   if (input.openPanelPullRequestUrl === null) return null;
   const pullRequestUrl =
@@ -62,5 +65,5 @@ export function resolveThreadReferenceCopyTarget(input: {
         successTitle: "PR link copied",
         failureTitle: "Failed to copy PR link",
       }
-    : threadChipCopyTarget(input.threadRef, input.title);
+    : threadChipCopyTarget(input.threadRef, input.title, input.hostedAppUrl);
 }
diff --git a/packages/shared/src/composerContextReferences.test.ts b/packages/shared/src/composerContextReferences.test.ts
index a12eed6a83995..6f27538f3728a 100644
--- a/packages/shared/src/composerContextReferences.test.ts
+++ b/packages/shared/src/composerContextReferences.test.ts
@@ -17,6 +17,7 @@ import {
   stripAttachmentOnlyBootstrapPrompt,
   threadContextRecord,
   threadContextsOutsideEnvironment,
+  threadLinkContextReferences,
   toComposerContextId,
   toKindScopedComposerContextId,
 } from "./composerContextReferences.ts";
@@ -478,3 +479,65 @@ describe("threadContextRecord", () => {
     ).toBe("thread_abc-123");
   });
 });
+
+describe("threadLinkContextReferences", () => {
+  const thread = (environmentId: string, threadId: string) => ({
+    environmentId: EnvironmentId.make(environmentId),
+    threadId: ThreadId.make(threadId),
+  });
+  const reference = (environmentId: string, threadId: string, label: string) =>
+    `[${label}](t3-context://v1/thread/${threadContextRecord(thread(environmentId, threadId), label).contextId})`;
+
+  it("makes a chip of a copied link, a v2 link, and a labeled link, titled here", () => {
+    const pasted = threadLinkContextReferences(
+      [
+        "https://app.t3.codes/threads/env-1/t1",
+        "<t3-thread://v2/env-1/t2>",
+        "[Written](https://app.t3.codes/threads/env-2/t3)",
+      ].join(" "),
+      [],
+      ({ threadId }) => (threadId === "t3" ? undefined : `Title ${threadId}`),
+    );
+    expect(pasted.text).toBe(
+      [
+        reference("env-1", "t1", "Title t1"),
+        reference("env-1", "t2", "Title t2"),
+        reference("env-2", "t3", "Written"),
+      ].join(" "),
+    );
+    expect(pasted.records).toEqual([
+      threadContextRecord(thread("env-1", "t1"), "Title t1"),
+      threadContextRecord(thread("env-1", "t2"), "Title t2"),
+      threadContextRecord(thread("env-2", "t3"), "Written"),
+    ]);
+  });
+
+  it("prefers the record the copy carried, and names an unknown thread plainly", () => {
+    const copied = threadContextRecord(thread("env-1", "t1"), "Copied title");
+    const pasted = threadLinkContextReferences(
+      "https://app.t3.codes/threads/env-1/t1 https://app.t3.codes/threads/env-9/t9",
+      [copied],
+      () => "Here",
+    );
+    expect(pasted.records).toEqual([copied, threadContextRecord(thread("env-9", "t9"), "Here")]);
+    expect(
+      threadLinkContextReferences("https://app.t3.codes/threads/env-9/t9", [], () => undefined)
+        .records,
+    ).toEqual([threadContextRecord(thread("env-9", "t9"), "Thread")]);
+  });
+
+  it("keeps links it may not chip, v1 links, and links in code as written", () => {
+    const text = [
+      "https://app.t3.codes/threads/elsewhere/t1",
+      "[Old](t3-thread://v1/t2)",
+      "`https://app.t3.codes/threads/env-1/t3`",
+    ].join(" ");
+    const pasted = threadLinkContextReferences(
+      text,
+      [],
+      () => "Title",
+      () => undefined,
+    );
+    expect(pasted).toEqual({ text, records: [] });
+  });
+});
diff --git a/packages/shared/src/composerContextReferences.ts b/packages/shared/src/composerContextReferences.ts
index 33e897379619e..a7aeb1373ae10 100644
--- a/packages/shared/src/composerContextReferences.ts
+++ b/packages/shared/src/composerContextReferences.ts
@@ -10,6 +10,8 @@ import {
   type ThreadContextRecord,
 } from "@t3tools/contracts";
 
+import { replaceThreadLinks, threadLinkCandidates } from "./threadLinks.ts";
+
 const CONTEXT_PROTOCOL = "t3-context:";
 const COMPOSER_CONTEXT_HREF_PREFIX = `${CONTEXT_PROTOCOL}//v1/`;
 const CONTEXT_KIND_PATTERN = /^[a-z][a-z0-9-]{0,39}$/;
@@ -93,6 +95,45 @@ export function threadContextRecord(ref: ScopedThreadRef, title: string): Thread
   };
 }
 
+/**
+ * Turns pasted thread links into thread chip references. A record the copy carried names its
+ * chip, else the thread's title here, read by key, or the link's own label. `accept` gives the
+ * chip's id, or none to keep the link as written. A v1 link names no machine, so it stays a link.
+ */
+export function threadLinkContextReferences(
+  text: string,
+  copied: ReadonlyArray<ComposerContextRecord>,
+  title: (ref: ScopedThreadRef) => string | undefined,
+  accept: (record: ThreadContextRecord) => ComposerContextId | undefined = (record) =>
+    record.contextId,
+): { readonly text: string; readonly records: ReadonlyArray<ThreadContextRecord> } {
+  const records = new Map<ComposerContextId, ThreadContextRecord>();
+  const rewritten = replaceThreadLinks(text, (link, label) => {
+    if (link.environmentId === null) return undefined;
+    const candidates = threadLinkCandidates(link, link.environmentId);
+    const record =
+      copied.find(
+        (candidate): candidate is ThreadContextRecord =>
+          candidate.kind === "thread" &&
+          "threadId" in candidate &&
+          candidates.some(
+            (ref) =>
+              ref.environmentId === candidate.environmentId && ref.threadId === candidate.threadId,
+          ),
+      ) ??
+      candidates.flatMap((ref) => {
+        const known = title(ref);
+        return known === undefined ? [] : [threadContextRecord(ref, known)];
+      })[0] ??
+      threadContextRecord(candidates[0]!, label?.trim() || "Thread");
+    const contextId = accept(record);
+    if (contextId === undefined) return undefined;
+    records.set(record.contextId, record);
+    return formatComposerContextReference({ ...record, contextId });
+  });
+  return { text: rewritten, records: [...records.values()] };
+}
+
 export function formatComposerContextReference(reference: {
   kind: ComposerContextKind;
   contextId: ComposerContextId;
diff --git a/packages/shared/src/promptLinks.test.ts b/packages/shared/src/promptLinks.test.ts
index afc5644f9ac3d..65d18eba07897 100644
--- a/packages/shared/src/promptLinks.test.ts
+++ b/packages/shared/src/promptLinks.test.ts
@@ -1,3 +1,4 @@
+import { EnvironmentId, ThreadId } from "@t3tools/contracts";
 import { describe, expect, it } from "vite-plus/test";
 
 import {
@@ -5,9 +6,11 @@ import {
   parseNewThreadLink,
   parseThreadLinkPrompt,
   promptLinkAppPath,
+  promptLinkDeepLink,
   sanitizeLinkedPrompt,
   withoutPromptLinkParams,
 } from "./promptLinks.ts";
+import { hostedThreadLink } from "./threadLinks.ts";
 
 describe("sanitizeLinkedPrompt", () => {
   it("removes characters a reader cannot see and counts them", () => {
@@ -105,12 +108,33 @@ describe("link round trips", () => {
     );
   });
 
+  it("opens a copied thread link in the app at that thread", () => {
+    const link = hostedThreadLink({
+      environmentId: EnvironmentId.make("env-1"),
+      threadId: ThreadId.make("mcp:1"),
+    });
+    const path = promptLinkAppPath(link);
+    expect(path).toBe("/env-1/mcp%3A1");
+    const deepLink = promptLinkDeepLink(path!);
+    expect(deepLink).toBe("t3code://threads/env-1/mcp%3A1");
+    expect(promptLinkAppPath(deepLink)).toBe(path);
+  });
+
   it("maps app scheme and hosted links to in-app paths, and nothing else", () => {
     expect(promptLinkAppPath("t3code://new?prompt=hi")).toBe("/new?prompt=hi");
     expect(promptLinkAppPath("t3code-dev://threads/env-1/thread-1")).toBe("/env-1/thread-1");
     expect(promptLinkAppPath("https://app.t3.codes/env-1/thread-1?prompt=go")).toBe(
       "/env-1/thread-1?prompt=go",
     );
+    expect(promptLinkAppPath("https://app.t3.codes/threads/env-1/thread-1")).toBe(
+      "/env-1/thread-1",
+    );
+    expect(promptLinkAppPath("https://app.t3.codes/threads/env-1/thread-1?prompt=go")).toBe(
+      "/env-1/thread-1?prompt=go",
+    );
+    // The web app's own thread route, reloaded, is no link.
+    expect(promptLinkAppPath("https://app.t3.codes/env-1/thread-1")).toBeNull();
+    expect(promptLinkAppPath("https://app.t3.codes/threads/env-1")).toBeNull();
     expect(promptLinkAppPath("https://app.t3.codes/settings/general")).toBeNull();
     expect(promptLinkAppPath("https://evil.test/new?prompt=hi")).toBeNull();
     expect(promptLinkAppPath("t3code://app/index.html")).toBeNull();
diff --git a/packages/shared/src/promptLinks.ts b/packages/shared/src/promptLinks.ts
index adff0135bfc02..223c0c4b9cfdc 100644
--- a/packages/shared/src/promptLinks.ts
+++ b/packages/shared/src/promptLinks.ts
@@ -199,7 +199,12 @@ export function promptLinkAppPath(
   }
   if (!URL.canParse(hostedAppUrl) || url.origin !== new URL(hostedAppUrl).origin) return null;
   if (url.pathname === "/new") return `/new${url.search}`;
-  const thread = url.searchParams.has("prompt") ? THREAD_PATH.exec(url.pathname) : null;
+  // The web app's own thread route is a link only with a prompt, so reloading a tab never asks.
+  const thread = url.pathname.startsWith("/threads/")
+    ? THREAD_PATH.exec(url.pathname.slice("/threads".length))
+    : url.searchParams.has("prompt")
+      ? THREAD_PATH.exec(url.pathname)
+      : null;
   return thread ? `/${thread[1]}/${thread[2]}${url.search}` : null;
 }
 
diff --git a/packages/shared/src/threadLinks.test.ts b/packages/shared/src/threadLinks.test.ts
index aa1c02fd4bed2..0c19f18163e64 100644
--- a/packages/shared/src/threadLinks.test.ts
+++ b/packages/shared/src/threadLinks.test.ts
@@ -2,8 +2,10 @@ import { describe, expect, it, vi } from "vite-plus/test";
 import { EnvironmentId, ThreadId, type ScopedThreadRef } from "@t3tools/contracts";
 
 import {
+  formatHostedThreadLink,
   formatThreadLink,
   guessThreadLinkRef,
+  hostedThreadLink,
   parseThreadLinkHref,
   relabelThreadLinks,
   threadLinkCandidates,
@@ -174,3 +176,64 @@ describe("thread links", () => {
     expect(formatThreadLink(ref("e", "t1"), " ] ")).toBe("<t3-thread://v2/e/t1>");
   });
 });
+
+describe("hosted thread links", () => {
+  it("escapes every id character a sentence or path could claim, and reads it back", () => {
+    const thread = ref("env.1", "thread:delegated/mcp%3A1.");
+    const link = hostedThreadLink(thread);
+    expect(link).toBe("https://app.t3.codes/threads/env%2E1/thread%3Adelegated%2Fmcp%253A1%2E");
+    expect(parseThreadLinkHref(link)).toEqual(thread);
+    expect(hostedThreadLink(thread, "https://preview.t3.codes/")).toMatch(
+      /^https:\/\/preview\.t3\.codes\/threads\//,
+    );
+  });
+
+  it("reads only a bare thread path on the hosted app", () => {
+    expect(parseThreadLinkHref("https://app.t3.codes/threads/env-1/thread-1")).toEqual(
+      ref("env-1", "thread-1"),
+    );
+    expect(parseThreadLinkHref("https://app.t3.codes/threads/env-1/thread-1?prompt=go")).toBeNull();
+    expect(parseThreadLinkHref("https://app.t3.codes/threads/env-1/thread-1/extra")).toBeNull();
+    expect(parseThreadLinkHref("https://app.t3.codes/threads/env-1")).toBeNull();
+    expect(parseThreadLinkHref("https://app.t3.codes/env-1/thread-1")).toBeNull();
+    expect(parseThreadLinkHref("https://evil.test/threads/env-1/thread-1")).toBeNull();
+  });
+
+  it("writes a copied link a reader can follow, labeled when it has a title", () => {
+    expect(formatHostedThreadLink(ref("e", "t1"), "Fix [ci]")).toBe(
+      "[Fix ci](https://app.t3.codes/threads/e/t1)",
+    );
+    expect(formatHostedThreadLink(ref("e", "t1"), " ")).toBe("https://app.t3.codes/threads/e/t1");
+  });
+
+  it("titles hosted links in every Markdown form and writes them as v2 links", () => {
+    const title = titlesIn({ there: { t1: "There" } });
+    expect(
+      relabelThreadLinks(
+        [
+          "See https://app.t3.codes/threads/there/t1.",
+          "[old](https://app.t3.codes/threads/there/t1)",
+          "<https://app.t3.codes/threads/there/t1>",
+          "`https://app.t3.codes/threads/there/t1`",
+          "https://app.t3.codes/threads/there/t1?prompt=go",
+        ].join("\n"),
+        local,
+        title,
+      ),
+    ).toBe(
+      [
+        "See [There](t3-thread://v2/there/t1).",
+        "[There](t3-thread://v2/there/t1)",
+        "[There](t3-thread://v2/there/t1)",
+        "`https://app.t3.codes/threads/there/t1`",
+        "https://app.t3.codes/threads/there/t1?prompt=go",
+      ].join("\n"),
+    );
+    expect(
+      relabelThreadLinks("https://app.t3.codes/threads/there/t1", local, () => undefined),
+    ).toBe("Thread on another machine");
+    expect(threadLinkRefs("Open https://app.t3.codes/threads/there/t%3A1", local)).toEqual([
+      ref("there", "t:1"),
+    ]);
+  });
+});
diff --git a/packages/shared/src/threadLinks.ts b/packages/shared/src/threadLinks.ts
index aceb87635c238..aba7d5f983a0a 100644
--- a/packages/shared/src/threadLinks.ts
+++ b/packages/shared/src/threadLinks.ts
@@ -2,12 +2,19 @@ import { EnvironmentId, ThreadId, type ScopedThreadRef } from "@t3tools/contract
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 
+import { DEFAULT_HOSTED_APP_URL } from "./connectAuth.ts";
+
 export const THREAD_LINK_PROTOCOL = "t3-thread";
 const V1_PREFIX = `${THREAD_LINK_PROTOCOL}://v1/`;
 const V2_PREFIX = `${THREAD_LINK_PROTOCOL}://v2/`;
+const HOSTED_PREFIX = `${DEFAULT_HOSTED_APP_URL}/threads/`;
+const HOSTED_SEGMENT = "[A-Za-z0-9_%-]+";
+const HOSTED_LINK = `${HOSTED_PREFIX.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}${HOSTED_SEGMENT}/${HOSTED_SEGMENT}`;
 // Code comes first in the alternation so a link written inside a code span or fence is skipped.
-const THREAD_LINK_OUTSIDE_CODE =
-  /(?<fence>(`{3,}|~{3,})[\s\S]*?(?:\2|$))|(?<span>(`+)[^\n]*?\4)|\[(?<label>[^\]\n]*)\]\((?<href>t3-thread:\/\/v[12]\/[^\s)]+)\)|<(?<autolink>t3-thread:\/\/v[12]\/[^\s<>]+)>/g;
+const THREAD_LINK_OUTSIDE_CODE = new RegExp(
+  String.raw`(?<fence>(\`{3,}|~{3,})[\s\S]*?(?:\2|$))|(?<span>(\`+)[^\n]*?\4)|\[(?<label>[^\]\n]*)\]\((?<href>t3-thread:\/\/v[12]\/[^\s)]+|${HOSTED_LINK})\)|<(?<autolink>t3-thread:\/\/v[12]\/[^\s<>]+|${HOSTED_LINK})>|(?<bare>${HOSTED_LINK})(?![\w%/?#-])`,
+  "g",
+);
 
 const decodeThreadId = Schema.decodeUnknownOption(ThreadId);
 const decodeEnvironmentId = Schema.decodeUnknownOption(EnvironmentId);
@@ -18,8 +25,39 @@ export interface ThreadLink {
   readonly threadId: ThreadId;
 }
 
-/** The ids as written. Thread ids can hold percent escapes of their own, so they are not decoded. */
+// Escapes even URL-safe punctuation, so a sentence's closing period never reads as part of an id.
+const hostedSegment = (id: string) =>
+  encodeURIComponent(id).replace(
+    /[.!~*'()]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+
+/** Opens the thread from anywhere: the hosted app offers the desktop app, the mobile app, or itself. */
+export function hostedThreadLink(ref: ScopedThreadRef, origin = DEFAULT_HOSTED_APP_URL): string {
+  const path = `/threads/${hostedSegment(ref.environmentId)}/${hostedSegment(ref.threadId)}`;
+  return new URL(path, origin).toString();
+}
+
+const HOSTED_PATH = new RegExp(`^(${HOSTED_SEGMENT})/(${HOSTED_SEGMENT})$`);
+
+function parseHostedThreadLink(href: string): ThreadLink | null {
+  const match = HOSTED_PATH.exec(href.slice(HOSTED_PREFIX.length));
+  if (!match) return null;
+  try {
+    const environmentId = Option.getOrNull(decodeEnvironmentId(decodeURIComponent(match[1]!)));
+    const threadId = Option.getOrNull(decodeThreadId(decodeURIComponent(match[2]!)));
+    return environmentId === null || threadId === null ? null : { environmentId, threadId };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The ids as written. Thread ids can hold percent escapes of their own, so they are not decoded,
+ * except in a hosted link, which escapes them itself.
+ */
 export function parseThreadLinkHref(href: string): ThreadLink | null {
+  if (href.startsWith(HOSTED_PREFIX)) return parseHostedThreadLink(href);
   if (href.startsWith(V1_PREFIX)) {
     const threadId = Option.getOrNull(decodeThreadId(href.slice(V1_PREFIX.length)));
     return threadId === null ? null : { environmentId: null, threadId };
@@ -78,17 +116,31 @@ function threadLinkHref(link: ThreadLink): string {
     : `${V2_PREFIX}${link.environmentId}/${link.threadId}`;
 }
 
-/** Without a label, an autolink: clients show the thread's current title. */
-export function formatThreadLink(ref: ThreadLink, label?: string): string {
-  const cleaned = label
+const linkLabel = (label: string | undefined) =>
+  label
     ?.replace(/[[\]\\\r\n]/g, " ")
     .replace(/\s+/g, " ")
     .trim();
+
+/** Without a label, an autolink: clients show the thread's current title. */
+export function formatThreadLink(ref: ThreadLink, label?: string): string {
+  const cleaned = linkLabel(label);
   return cleaned ? `[${cleaned}](${threadLinkHref(ref)})` : `<${threadLinkHref(ref)}>`;
 }
 
+/** What a person copies out of T3 Code: a Markdown link that opens the thread anywhere. */
+export function formatHostedThreadLink(
+  ref: ScopedThreadRef,
+  label: string,
+  origin?: string,
+): string {
+  const href = hostedThreadLink(ref, origin);
+  const cleaned = linkLabel(label);
+  return cleaned ? `[${cleaned}](${href})` : href;
+}
+
 export function hasThreadLinks(markdown: string): boolean {
-  return markdown.includes(`${THREAD_LINK_PROTOCOL}://v`);
+  return markdown.includes(`${THREAD_LINK_PROTOCOL}://v`) || markdown.includes(HOSTED_PREFIX);
 }
 
 /** Every thread the markdown's links can name, so their titles are keyed reads. */
@@ -100,7 +152,7 @@ export function threadLinkRefs(
   // Hermes' matchAll yields matches without `groups`; exec keeps them.
   const pattern = new RegExp(THREAD_LINK_OUTSIDE_CODE);
   for (let match = pattern.exec(markdown); match !== null; match = pattern.exec(markdown)) {
-    const href = match.groups?.href ?? match.groups?.autolink;
+    const href = match.groups?.href ?? match.groups?.autolink ?? match.groups?.bare;
     const link = href === undefined ? null : parseThreadLinkHref(href);
     if (link === null) continue;
     for (const ref of threadLinkCandidates(link, messageEnvironmentId)) {
@@ -119,22 +171,31 @@ export function unknownThreadLinkLabel(
     : "Thread on another machine";
 }
 
+/** Rewrites each link outside code `replace` answers for. `label` is a Markdown link's own text. */
+export function replaceThreadLinks(
+  markdown: string,
+  replace: (link: ThreadLink, label: string | undefined) => string | undefined,
+): string {
+  if (!hasThreadLinks(markdown)) return markdown;
+  return markdown.replace(THREAD_LINK_OUTSIDE_CODE, (source, ...args) => {
+    const groups = args.at(-1) as Partial<Record<"href" | "autolink" | "bare" | "label", string>>;
+    const href = groups.href ?? groups.autolink ?? groups.bare;
+    const link = href === undefined ? null : parseThreadLinkHref(href);
+    return (link && replace(link, groups.label)) ?? source;
+  });
+}
+
 /**
- * Writes each link with its thread's current title. A link `title` cannot resolve becomes plain
- * text, its written label or a neutral one, except a labeled v1 link, which may open elsewhere.
+ * Writes each link with its thread's current title, a hosted link as a v2 link. A link `title`
+ * cannot resolve becomes plain text, its written label or a neutral one, except a labeled v1
+ * link, which may open elsewhere.
  */
 export function relabelThreadLinks(
   markdown: string,
   messageEnvironmentId: EnvironmentId,
   title: (ref: ScopedThreadRef) => string | undefined,
 ): string {
-  if (!hasThreadLinks(markdown)) return markdown;
-  return markdown.replace(THREAD_LINK_OUTSIDE_CODE, (source, ...args) => {
-    const groups = args.at(-1) as { href?: string; autolink?: string; label?: string };
-    const href = groups.href ?? groups.autolink;
-    if (href === undefined) return source;
-    const written = parseThreadLinkHref(href);
-    if (written === null) return source;
+  return replaceThreadLinks(markdown, (written, label) => {
     const environmentId = written.environmentId ?? messageEnvironmentId;
     const decoded = percentDecodedThreadLinkId(written.threadId);
     const threadId =
@@ -145,12 +206,12 @@ export function relabelThreadLinks(
         : written.threadId;
     const current = title({ environmentId, threadId });
     if (current === undefined) {
-      if (groups.href !== undefined && written.environmentId === null) return source;
-      return groups.label?.trim() || unknownThreadLinkLabel(written, messageEnvironmentId);
+      if (label !== undefined && written.environmentId === null) return undefined;
+      return label?.trim() || unknownThreadLinkLabel(written, messageEnvironmentId);
     }
     return formatThreadLink(
       { environmentId: written.environmentId, threadId },
-      current.trim() || groups.label || threadId,
+      current.trim() || label || threadId,
     );
   });
 }

From b183048a823815175fd6991691f2acec456ea176 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 13:44:18 -0800
Subject: [PATCH 054/167] feat(mobile,web): copied thread links open the mobile
 app (#29815)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/mobile/app.config.test.ts                | 14 ++++++++
 apps/mobile/app.config.ts                     | 11 +++++++
 apps/mobile/src/App.tsx                       |  9 +++++-
 apps/mobile/src/lib/appLinking.test.ts        |  1 +
 apps/mobile/src/lib/appLinking.ts             |  8 +++--
 .../apple-app-site-association.json           | 14 ++++++++
 apps/web/public/.well-known/assetlinks.json   | 32 +++++++++++++++++++
 apps/web/vercel.ts                            |  9 +++++-
 docs/user/prompt-links.md                     |  7 ++--
 9 files changed, 97 insertions(+), 8 deletions(-)
 create mode 100644 apps/web/public/.well-known/apple-app-site-association.json
 create mode 100644 apps/web/public/.well-known/assetlinks.json

diff --git a/apps/mobile/app.config.test.ts b/apps/mobile/app.config.test.ts
index b8111f45587cf..9be2204d5132c 100644
--- a/apps/mobile/app.config.test.ts
+++ b/apps/mobile/app.config.test.ts
@@ -1,5 +1,9 @@
+import { DEFAULT_HOSTED_APP_URL } from "@t3tools/shared/connectAuth";
 import { afterEach, expect, it, vi } from "vite-plus/test";
 
+import appleAppSiteAssociation from "../web/public/.well-known/apple-app-site-association.json";
+import assetLinks from "../web/public/.well-known/assetlinks.json";
+
 // Keep config parsing independent of local env files and build credentials.
 vi.mock("../../scripts/lib/public-config.ts", () => ({
   loadRepoEnv: () => ({ APP_VARIANT: process.env.APP_VARIANT }),
@@ -30,4 +34,14 @@ it.each([
   const config = await loadConfig(value);
   expect(config.ios?.bundleIdentifier).toBe(identifier);
   expect(config.android?.package).toBe(identifier);
+  // Copied thread links open this app only while app.t3.codes lists it.
+  const host = new URL(DEFAULT_HOSTED_APP_URL).host;
+  expect(config.ios?.associatedDomains).toContain(`applinks:${host}`);
+  expect(appleAppSiteAssociation.applinks.details[0]?.appIDs).toContain(
+    `${config.ios?.appleTeamId}.${identifier}`,
+  );
+  expect(config.android?.intentFilters?.[0]?.data).toEqual([
+    { scheme: "https", host, pathPrefix: "/threads/" },
+  ]);
+  expect(assetLinks.map((link) => link.target.package_name)).toContain(identifier);
 });
diff --git a/apps/mobile/app.config.ts b/apps/mobile/app.config.ts
index b94367a64ebf4..3d5920932736d 100644
--- a/apps/mobile/app.config.ts
+++ b/apps/mobile/app.config.ts
@@ -116,6 +116,8 @@ function resolveAppVariant(value: string | undefined): AppVariant {
 }
 
 const variant = VARIANT_CONFIG[APP_VARIANT];
+// Copied thread links open the app. app.t3.codes/.well-known lists every variant's identifiers.
+const HOSTED_APP_HOST = "app.t3.codes";
 const iosBundleIdentifier = isIosPersonalTeamBuild
   ? personalTeamBundleIdentifier!
   : variant.iosBundleIdentifier;
@@ -252,6 +254,7 @@ const config: ExpoConfig = {
     associatedDomains: [
       `applinks:${variant.relyingParty}`,
       `webcredentials:${variant.relyingParty}`,
+      `applinks:${HOSTED_APP_HOST}`,
     ],
     entitlements: {
       "keychain-access-groups": [`$(AppIdentifierPrefix)${variant.iosBundleIdentifier}`],
@@ -302,6 +305,14 @@ const config: ExpoConfig = {
     predictiveBackGestureEnabled: true,
     // expo-sensors declares this for its pedometer, which the app does not use.
     blockedPermissions: ["android.permission.ACTIVITY_RECOGNITION"],
+    intentFilters: [
+      {
+        action: "VIEW",
+        autoVerify: true,
+        data: [{ scheme: "https", host: HOSTED_APP_HOST, pathPrefix: "/threads/" }],
+        category: ["BROWSABLE", "DEFAULT"],
+      },
+    ],
   },
   web: {
     favicon: variant.assets.appIcon,
diff --git a/apps/mobile/src/App.tsx b/apps/mobile/src/App.tsx
index 225496bb7a407..43b1c089c0b59 100644
--- a/apps/mobile/src/App.tsx
+++ b/apps/mobile/src/App.tsx
@@ -18,6 +18,7 @@ import {
   type NavigationState,
 } from "@react-navigation/native";
 import { pipe } from "effect/Function";
+import { DEFAULT_HOSTED_APP_URL } from "@t3tools/shared/connectAuth";
 
 import { RegistryContext } from "@effect/atom-react";
 import { ProjectChipIconRasterizer } from "./native/ProjectChipIconImages";
@@ -122,7 +123,13 @@ function getAppStateFromPath(path: string, options: Parameters<typeof getStateFr
 }
 
 const appLinking = {
-  prefixes: [Linking.createURL("/"), "t3code://", "t3code-dev://", "t3code-preview://"],
+  prefixes: [
+    Linking.createURL("/"),
+    "t3code://",
+    "t3code-dev://",
+    "t3code-preview://",
+    DEFAULT_HOSTED_APP_URL,
+  ],
   config: { initialRouteName: "Home" },
   filter: (url: string) => shouldHandleAppLink(url, hasCloudPublicConfig()),
   getInitialURL: async () => (await Linking.getInitialURL()) ?? (await launchWorkspaceURL()),
diff --git a/apps/mobile/src/lib/appLinking.test.ts b/apps/mobile/src/lib/appLinking.test.ts
index 977a5a5e41ef5..8b873318d72aa 100644
--- a/apps/mobile/src/lib/appLinking.test.ts
+++ b/apps/mobile/src/lib/appLinking.test.ts
@@ -21,6 +21,7 @@ describe("shouldHandleAppLink", () => {
     "t3code://threads/env-1/thread-1",
     "t3code://pair?pairingUrl=x",
     "t3code-dev://settings/usage?tab=limits",
+    "https://app.t3.codes/threads/env/thread?prompt=Fix%20expo-development-client%20and%20t3code://expo-sharing",
   ])("handles path-bearing URL %s", (url) => {
     expect(shouldHandleAppLink(url, true)).toBe(true);
   });
diff --git a/apps/mobile/src/lib/appLinking.ts b/apps/mobile/src/lib/appLinking.ts
index 9da768150f51b..570c86b36abf4 100644
--- a/apps/mobile/src/lib/appLinking.ts
+++ b/apps/mobile/src/lib/appLinking.ts
@@ -7,11 +7,13 @@ import type { NavigationState, PartialState } from "@react-navigation/native";
  * to the NotFound wildcard route on every dev launch.
  */
 export function shouldHandleAppLink(url: string, cloudConfigured: boolean): boolean {
+  // Only the route: a thread link's ?prompt= may mention either lifecycle URL.
+  const route = url.split(/[?#]/)[0] ?? "";
   return (
-    !url.includes("expo-development-client") &&
-    !url.includes("://expo-sharing") &&
+    !route.includes("expo-development-client") &&
+    !route.includes("://expo-sharing") &&
     !/^t3code(-dev|-preview)?:\/*$/.test(url) &&
-    (cloudConfigured || !CLOUD_ONLY_LINK_PATH.test(url.split(/[?#]/)[0] ?? ""))
+    (cloudConfigured || !CLOUD_ONLY_LINK_PATH.test(route))
   );
 }
 
diff --git a/apps/web/public/.well-known/apple-app-site-association.json b/apps/web/public/.well-known/apple-app-site-association.json
new file mode 100644
index 0000000000000..b5bcbc50e573b
--- /dev/null
+++ b/apps/web/public/.well-known/apple-app-site-association.json
@@ -0,0 +1,14 @@
+{
+  "applinks": {
+    "details": [
+      {
+        "appIDs": [
+          "ARK85ZXQ4Z.com.t3tools.t3code",
+          "ARK85ZXQ4Z.com.t3tools.t3code.preview",
+          "ARK85ZXQ4Z.com.t3tools.t3code.dev"
+        ],
+        "components": [{ "/": "/threads/*" }]
+      }
+    ]
+  }
+}
diff --git a/apps/web/public/.well-known/assetlinks.json b/apps/web/public/.well-known/assetlinks.json
new file mode 100644
index 0000000000000..317c04cf92d49
--- /dev/null
+++ b/apps/web/public/.well-known/assetlinks.json
@@ -0,0 +1,32 @@
+[
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.t3tools.t3code",
+      "sha256_cert_fingerprints": [
+        "B9:F5:1E:D5:A7:6C:D1:86:C9:51:08:F2:19:91:B7:D5:3A:58:FD:A9:83:12:A9:E3:53:E2:1A:59:B2:42:03:B6"
+      ]
+    }
+  },
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.t3tools.t3code.preview",
+      "sha256_cert_fingerprints": [
+        "BE:B8:BD:67:53:2F:12:95:0A:30:62:88:91:C1:2F:D0:CF:20:28:C3:81:5D:6D:31:45:E7:5A:AF:24:A2:8F:18"
+      ]
+    }
+  },
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "com.t3tools.t3code.dev",
+      "sha256_cert_fingerprints": [
+        "FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C"
+      ]
+    }
+  }
+]
diff --git a/apps/web/vercel.ts b/apps/web/vercel.ts
index 12a823a360e47..29684db87f063 100644
--- a/apps/web/vercel.ts
+++ b/apps/web/vercel.ts
@@ -62,5 +62,12 @@ export const config: VercelConfig = {
       dest: `${LATEST_ORIGIN}/$1`,
     },
   ],
-  rewrites: [routes.rewrite("/(.*)", "/index.html")],
+  rewrites: [
+    // Apple fetches it without an extension; the .json file is served as application/json.
+    routes.rewrite(
+      "/.well-known/apple-app-site-association",
+      "/.well-known/apple-app-site-association.json",
+    ),
+    routes.rewrite("/(.*)", "/index.html"),
+  ],
 };
diff --git a/docs/user/prompt-links.md b/docs/user/prompt-links.md
index 4553e33e50880..2c5ab07bec939 100644
--- a/docs/user/prompt-links.md
+++ b/docs/user/prompt-links.md
@@ -58,6 +58,7 @@ malicious.
 ## Share a thread
 
 **Copy thread** copies a link such as `https://app.t3.codes/threads/<environment>/<thread>`. Paste
-it anywhere, such as Slack, a GitHub comment, or your notes. Opening it asks where to open it, like
-a prompt link, then opens the thread. Only someone connected to the machine that runs the thread
-can see it. In T3 Code, a thread link in a message opens the thread in the app.
+it anywhere, such as Slack, a GitHub comment, or your notes. On a phone with T3 Code installed, it
+opens the thread in the app. Elsewhere, opening it asks where to open it, like a prompt link, then
+opens the thread. Only someone connected to the machine that runs the thread can see it. In T3 Code,
+a thread link in a message opens the thread in the app.

From 7c22e24e3fa1a3bb3a95f27aea000067f198fe7f Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 22:17:00 +0000
Subject: [PATCH 055/167] fix(antigravity): rate-limited turns keep their reset
 time (#29594)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../acp/AntigravityTurnOutcome.test.ts        | 20 +++++++++++++++++--
 .../provider/acp/AntigravityTurnOutcome.ts    |  5 ++++-
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/provider/acp/AntigravityTurnOutcome.test.ts b/apps/server/src/provider/acp/AntigravityTurnOutcome.test.ts
index d3ca431c50794..09b8730bd6001 100644
--- a/apps/server/src/provider/acp/AntigravityTurnOutcome.test.ts
+++ b/apps/server/src/provider/acp/AntigravityTurnOutcome.test.ts
@@ -22,9 +22,12 @@ const errorPayload = (error: string) =>
       `Agent execution terminated due to error.\u0012agent executor error: ${error}: ${error}\n(1) attached stack trace\n  -- stack trace:`,
     ),
   ]);
-// An unparsable reset timestamp must not hide the reset delay.
+// An unparsable reset timestamp must not hide the reset delay, nor a retry delay outrank it.
 const QUOTA_ERROR = errorPayload(
-  "Error 429, Message: Quota exhausted for test model., Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.ErrorInfo domain:googleapis.com metadata:map[quotaResetDelay:3600s quotaResetTimeStamp:soon] reason:QUOTA_EXHAUSTED]]",
+  "Error 429, Message: Quota exhausted for test model., Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.RetryInfo retryDelay:42s] map[@type:type.googleapis.com/google.rpc.ErrorInfo domain:googleapis.com metadata:map[quotaResetDelay:3600s quotaResetTimeStamp:soon] reason:QUOTA_EXHAUSTED]]",
+);
+const RATE_LIMIT_ERROR = errorPayload(
+  "Error 429, Message: Resource has been exhausted (e.g. check quota)., Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.ErrorInfo domain:cloudcode-pa.googleapis.com reason:RATE_LIMIT_EXCEEDED] map[@type:type.googleapis.com/google.rpc.RetryInfo retryDelay:42s]]",
 );
 const INVALID_ARGUMENT_ERROR = errorPayload(
   "Error 400, Message: Request contains an invalid argument., Status: INVALID_ARGUMENT, Details: []",
@@ -101,6 +104,19 @@ describe("watchAntigravityPromptOutcome", () => {
           },
         ),
       );
+      assert.deepEqual(
+        yield* turn([
+          [USER_INPUT, input],
+          [ERROR_MESSAGE, RATE_LIMIT_ERROR],
+        ]),
+        {
+          class: "usage_limit",
+          message: "Resource has been exhausted (e.g. check quota).",
+          code: "RESOURCE_EXHAUSTED",
+          retryable: true,
+          resetAt: "1970-01-01T00:00:42.000Z",
+        },
+      );
       assert.deepEqual(
         yield* turn([
           [USER_INPUT, input],
diff --git a/apps/server/src/provider/acp/AntigravityTurnOutcome.ts b/apps/server/src/provider/acp/AntigravityTurnOutcome.ts
index 874c28eeb1537..00de1e836296e 100644
--- a/apps/server/src/provider/acp/AntigravityTurnOutcome.ts
+++ b/apps/server/src/provider/acp/AntigravityTurnOutcome.ts
@@ -21,6 +21,8 @@ const API_ERROR = /Error (\d{3}), Message: (.+?), Status: ([A-Z_]+)/s;
 const QUOTA_EXHAUSTED = /\breason:QUOTA_EXHAUSTED\b/;
 const RESET_TIMESTAMP = /\bquotaResetTimeStamp:([^\s\]]+)/;
 const RESET_DELAY = /\bquotaResetDelay:((?:\d+(?:\.\d+)?(?:ns|us|µs|μs|ms|h|m|s))+)(?=[\s\]])/;
+// google.rpc.RetryInfo, which plain rate limits carry instead of a quota reset.
+const RETRY_DELAY = /\bretryDelay:((?:\d+(?:\.\d+)?(?:ns|us|µs|μs|ms|h|m|s))+)(?=[\s\]])/;
 const GO_DURATION_PART = /(\d+(?:\.\d+)?)(ns|us|µs|μs|ms|h|m|s)/g;
 const GO_DURATION_UNIT_MS: Record<string, number> = {
   ns: 1e-6,
@@ -76,7 +78,7 @@ function resetAtFrom(text: string, now: DateTime.Utc): string | undefined {
   // makeProviderFailure drops a timestamp that does not parse, so fall back to the delay.
   const timestamp = RESET_TIMESTAMP.exec(text)?.[1];
   if (timestamp !== undefined && Option.isSome(DateTime.make(timestamp))) return timestamp;
-  const delay = RESET_DELAY.exec(text)?.[1];
+  const delay = RESET_DELAY.exec(text)?.[1] ?? RETRY_DELAY.exec(text)?.[1];
   if (delay === undefined) return undefined;
   let delayMs = 0;
   for (const [, amount, unit] of delay.matchAll(GO_DURATION_PART)) {
@@ -120,6 +122,7 @@ function turnFailure(
     message: message!.trim(),
     code: status ?? null,
     retryable: rateLimited || Number(httpStatus) >= 500,
+    resetAt: resetAtFrom(text, now) ?? null,
   });
 }
 

From da3f97299f258eccf5ae80e7b6b3391ea7376ed8 Mon Sep 17 00:00:00 2001
From: AdEx-Partners-DE <stark.burns@adexpartners.com>
Date: Wed, 4 Nov 2026 00:04:36 +0100
Subject: [PATCH 056/167] fix(server): startup no longer hangs on a shell stuck
 in the kernel (#27938)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/shell/DesktopShellEnvironment.test.ts | 37 +++++++++++++++++++
 .../src/shell/DesktopShellEnvironment.ts      |  8 +++-
 packages/shared/src/shell.test.ts             | 31 +++++++++++++++-
 packages/shared/src/shell.ts                  | 12 +++++-
 4 files changed, 85 insertions(+), 3 deletions(-)

diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
index 79344567fcd6c..fbf4bf9713fd1 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
@@ -3,6 +3,7 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, describe, it } from "@effect/vitest";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Deferred from "effect/Deferred";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
@@ -14,6 +15,7 @@ import * as Schema from "effect/Schema";
 import * as Option from "effect/Option";
 import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as TestClock from "effect/testing/TestClock";
 import * as NodeOS from "node:os";
 import { vi } from "vite-plus/test";
 
@@ -60,6 +62,22 @@ function makeProcess(output: string, exitCode = 0): ChildProcessSpawner.ChildPro
   });
 }
 
+function makeHungProcess(): ChildProcessSpawner.ChildProcessHandle {
+  return ChildProcessSpawner.makeHandle({
+    pid: ChildProcessSpawner.ProcessId(124),
+    stdout: Stream.never,
+    stderr: Stream.never,
+    all: Stream.never,
+    exitCode: Effect.never,
+    isRunning: Effect.succeed(true),
+    kill: () => Effect.never,
+    stdin: Sink.drain,
+    getInputFd: () => Sink.drain,
+    getOutputFd: () => Stream.empty,
+    unref: Effect.succeed(Effect.void),
+  });
+}
+
 function withProcessEnv<A, E, R>(
   env: NodeJS.ProcessEnv,
   effect: Effect.Effect<A, E, R>,
@@ -673,6 +691,25 @@ describe("DesktopShellEnvironment", () => {
       }),
   );
 
+  it.effect("gives up on a Windows shell that survives the kill", () =>
+    Effect.gen(function* () {
+      const commands: Array<string> = [];
+      const fiber = yield* runShellEnvironment({
+        env: { PATH: "C:\\Windows", APPDATA: "C:\\Roaming" },
+        platform: "win32",
+        handler: () => "",
+        processSpawner: ChildProcessSpawner.make((command) => {
+          commands.push(command._tag === "StandardCommand" ? command.command : "");
+          return Effect.acquireRelease(Effect.succeed(makeHungProcess()), () => Effect.never);
+        }),
+      }).pipe(Effect.forkChild({ startImmediately: true }));
+
+      for (let probe = 0; probe < 4; probe++) yield* TestClock.adjust("5 seconds");
+      yield* Fiber.join(fiber);
+      assert.deepEqual([...new Set(commands)], ["pwsh.exe", "powershell.exe"]);
+    }),
+  );
+
   it.effect("replaces a Path-spelled Windows PATH instead of adding a second key", () =>
     Effect.gen(function* () {
       const env: NodeJS.ProcessEnv = { Path: "C:\\Windows\\System32" };
diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.ts b/apps/desktop/src/shell/DesktopShellEnvironment.ts
index 556f7090b422e..37826f8ee5aba 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.ts
@@ -8,6 +8,7 @@ import {
 import * as Context from "effect/Context";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Deferred from "effect/Deferred";
 import * as Path from "effect/Path";
 import * as PubSub from "effect/PubSub";
@@ -259,7 +260,7 @@ const runCommandOutput = Effect.fn("desktop.shellEnvironment.runCommandOutput")(
   readonly shell?: boolean;
 }): Effect.fn.Return<string, never, ChildProcessSpawner.ChildProcessSpawner> {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-  const output = yield* Effect.scoped(
+  const fiber = yield* Effect.scoped(
     Effect.gen(function* () {
       const child = yield* spawner.spawn(
         ChildProcess.make(input.command, input.args, {
@@ -302,7 +303,12 @@ const runCommandOutput = Effect.fn("desktop.shellEnvironment.runCommandOutput")(
       DesktopShellEnvironmentCommandError: (error) =>
         logShellEnvironmentCommandError(error).pipe(Effect.as("")),
     }),
+    Effect.forkDetach,
+  );
+  const output = yield* Fiber.join(fiber).pipe(
     Effect.timeoutOption(input.timeout),
+    // Interrupting awaits the child's exit, which a shell stuck in the kernel never reaches.
+    Effect.ensuring(Fiber.interrupt(fiber).pipe(Effect.forkDetach)),
   );
   if (Option.isSome(output)) {
     return output.value;
diff --git a/packages/shared/src/shell.test.ts b/packages/shared/src/shell.test.ts
index 6ae7401a48822..e3af0855ebfac 100644
--- a/packages/shared/src/shell.test.ts
+++ b/packages/shared/src/shell.test.ts
@@ -9,6 +9,7 @@ import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Option from "effect/Option";
+import * as TestClock from "effect/testing/TestClock";
 import * as NodeChildProcess from "node:child_process";
 import * as NodeFS from "node:fs";
 import * as NodeOS from "node:os";
@@ -42,10 +43,12 @@ const decodeDesktopHostMessage = Schema.decodeUnknownSync(DesktopHostTelemetryMe
 
 const nativeProbe = vi.hoisted(() => ({
   execFile: vi.fn<typeof import("node:child_process").execFile>(),
+  original: undefined as unknown as typeof import("node:child_process").execFile,
 }));
 
 vi.mock("node:child_process", async (importOriginal) => {
   const original = await importOriginal<typeof import("node:child_process")>();
+  nativeProbe.original = original.execFile;
   return { ...original, execFile: nativeProbe.execFile.mockImplementation(original.execFile) };
 });
 
@@ -275,7 +278,7 @@ describe("readEnvironmentFromWindowsShell", () => {
       Effect.gen(function* () {
         const started = Promise.withResolvers<void>();
         const kill = vi.fn(() => true);
-        const child = { kill } as unknown as ReturnType<
+        const child = { kill, unref: vi.fn() } as unknown as ReturnType<
           typeof import("node:child_process").execFile
         >;
         const execFile = nativeProbe.execFile;
@@ -297,6 +300,32 @@ describe("readEnvironmentFromWindowsShell", () => {
       }),
   );
 
+  effectIt.effect("gives up on a shell that survives the kill and holds stdout open", () =>
+    Effect.gen(function* () {
+      const stdout = { destroy: vi.fn() };
+      const unref = vi.fn();
+      const child = { kill: vi.fn(() => true), stdout, unref } as unknown as ReturnType<
+        typeof import("node:child_process").execFile
+      >;
+      const execFile = nativeProbe.execFile;
+      execFile.mockClear();
+      execFile.mockImplementation(() => child);
+      try {
+        const fiber = yield* readEnvironmentFromWindowsShell(["PATH"]).pipe(Effect.forkChild);
+        yield* Effect.yieldNow;
+        yield* TestClock.adjust("6 seconds");
+        expect(execFile.mock.calls.map(([file]) => file)).toEqual(["pwsh.exe", "powershell.exe"]);
+        yield* TestClock.adjust("6 seconds");
+        expect(yield* Fiber.join(fiber)).toEqual({});
+        expect(stdout.destroy).toHaveBeenCalledTimes(2);
+        expect(unref).toHaveBeenCalledTimes(2);
+      } finally {
+        execFile.mockReset();
+        execFile.mockImplementation(nativeProbe.original);
+      }
+    }),
+  );
+
   effectIt.effect("extracts environment variables from a PowerShell command", () =>
     Effect.gen(function* () {
       const execFile = vi.fn<
diff --git a/packages/shared/src/shell.ts b/packages/shared/src/shell.ts
index f3aaa4a11c4fd..28b666ce05531 100644
--- a/packages/shared/src/shell.ts
+++ b/packages/shared/src/shell.ts
@@ -5,6 +5,7 @@ import * as NodeChildProcess from "node:child_process";
 import * as NodeFS from "node:fs";
 import * as Cache from "effect/Cache";
 import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
@@ -17,6 +18,9 @@ const SHELL_ENV_NAME_PATTERN = /^[A-Z0-9_]+$/;
 const WINDOWS_PATH_DELIMITER = ";";
 const POSIX_PATH_DELIMITER = ":";
 const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"] as const;
+const WINDOWS_SHELL_PROBE_TIMEOUT_MS = 5000;
+// A shell stuck in the kernel survives the kill and holds stdout, so execFile's callback never fires.
+const WINDOWS_SHELL_PROBE_DEADLINE = Duration.millis(WINDOWS_SHELL_PROBE_TIMEOUT_MS + 1000);
 
 type ExecFileSyncLike = (
   file: string,
@@ -360,6 +364,9 @@ const execWindowsEnvironmentProbe = (
     }
     return Effect.sync(() => {
       child.kill();
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      child.unref();
     });
   });
 
@@ -380,7 +387,10 @@ export const readEnvironmentFromWindowsShell = Effect.fn("shell.readEnvironmentF
       command,
     ];
     for (const shell of WINDOWS_SHELL_CANDIDATES) {
-      const output = yield* execFile(shell, args, { encoding: "utf8", timeout: 5000 });
+      const output = yield* execFile(shell, args, {
+        encoding: "utf8",
+        timeout: WINDOWS_SHELL_PROBE_TIMEOUT_MS,
+      }).pipe(Effect.timeoutOption(WINDOWS_SHELL_PROBE_DEADLINE), Effect.map(Option.flatten));
       if (Option.isNone(output)) continue;
 
       const environment: Partial<Record<string, string>> = {};

From ac976026a9005527a058948347b83edbc8431670 Mon Sep 17 00:00:00 2001
From: Abhishek B R <byteblaster1468@gmail.com>
Date: Wed, 4 Nov 2026 04:34:55 +0530
Subject: [PATCH 057/167] fix(server): reverting files before the first commit
 no longer leaves them staged (#28647)

---
 apps/server/src/vcs/GitVcsDriver.test.ts | 41 ++++++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriver.ts      | 13 +++-----
 2 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriver.test.ts b/apps/server/src/vcs/GitVcsDriver.test.ts
index 9262688fd10b5..fd85564a7dadd 100644
--- a/apps/server/src/vcs/GitVcsDriver.test.ts
+++ b/apps/server/src/vcs/GitVcsDriver.test.ts
@@ -1134,6 +1134,47 @@ it.effect("restores empty checkpoints without changing paths outside the workspa
   }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
 );
 
+it.effect("restores a checkpoint before the first commit without staging its files", () =>
+  Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const driver = yield* GitVcsDriver.makeVcsDriverShape();
+    for (const nested of [false, true]) {
+      const root = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-unborn-restore-" });
+      yield* runGit(root, ["init"]);
+      yield* runGit(root, ["config", "user.email", "test@test.com"]);
+      yield* runGit(root, ["config", "user.name", "Test"]);
+      if (nested) {
+        yield* fileSystem.writeFileString(path.join(root, "outside.txt"), "staged\n");
+        yield* runGit(root, ["add", "outside.txt"]);
+      }
+      const cwd = nested ? path.join(root, "nested") : root;
+      yield* fileSystem.makeDirectory(cwd, { recursive: true });
+      yield* fileSystem.writeFileString(path.join(cwd, "file.txt"), "original\n");
+      const checkpointRef = CheckpointRef.make("refs/t3/checkpoints/unborn");
+      yield* driver.checkpoints.captureCheckpoint({ cwd, checkpointRef });
+      yield* fileSystem.writeFileString(path.join(cwd, "file.txt"), "changed\n");
+      yield* fileSystem.writeFileString(path.join(cwd, "added.txt"), "new\n");
+
+      assert.isTrue(
+        yield* driver.checkpoints.restoreCheckpoint({ cwd, checkpointRef, fallbackToHead: false }),
+      );
+
+      assert.strictEqual(
+        yield* fileSystem.readFileString(path.join(cwd, "file.txt")),
+        "original\n",
+      );
+      assert.isFalse(yield* fileSystem.exists(path.join(cwd, "added.txt")));
+      const staged = yield* driver.execute({
+        operation: "test",
+        cwd: root,
+        args: ["diff", "--cached", "--name-only"],
+      });
+      assert.strictEqual(staged.stdout.trim(), nested ? "outside.txt" : "");
+    }
+  }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
+);
+
 // The real VCS process, spawning `command` wherever the driver runs git.
 const vcsProcessSpawning = (command: string) =>
   Layer.effect(
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index 15392cb96ce5e..d3ecfcfa95d73 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -1367,14 +1367,11 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
       // On Windows the same clean can remove './' and exit 0.
       yield* recreateWorkspace;
 
-      const headExists = yield* hasHeadCommit(input.cwd);
-      if (headExists) {
-        yield* execute({
-          operation,
-          cwd: input.cwd,
-          args: [...longPaths, "reset", "--quiet", "--", "."],
-        });
-      }
+      yield* execute({
+        operation,
+        cwd: input.cwd,
+        args: [...longPaths, "reset", "--quiet", "--", "."],
+      });
 
       return true;
     }),

From eee9525fe4a8add18d6a5dedf11e8e73de3a0547 Mon Sep 17 00:00:00 2001
From: Abhishek B R <byteblaster1468@gmail.com>
Date: Wed, 4 Nov 2026 04:35:24 +0530
Subject: [PATCH 058/167] fix(server): truncated Claude task output no longer
 starts with a replacement character (#28643)

---
 .../Adapters/ClaudeTaskOutputTail.test.ts     | 28 ++++++++++++++++++-
 .../Adapters/ClaudeTaskOutputTail.ts          |  5 +++-
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts
index 8da21b20236e2..b70b7322d5e63 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.test.ts
@@ -20,7 +20,7 @@ const makeTaskFile = Effect.gen(function* () {
   return { root, tasks, file: path.join(tasks, `${TASK_ID}.output`) };
 });
 
-// TestClock cannot interleave with real filesystem I/O; use the live clock.
+// TestClock cannot interleave with real filesystem I/O; tests that wait on a poll use the live clock.
 describe("tailClaudeTaskOutput", () => {
   it.live("follows a file that appears after the task starts, across split characters", () =>
     Effect.scoped(
@@ -48,6 +48,32 @@ describe("tailClaudeTaskOutput", () => {
     ).pipe(Effect.provide(NodeServices.layer)),
   );
 
+  it.effect("drops a split character when the file is truncated and rewritten", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const fileSystem = yield* FileSystem.FileSystem;
+        const { root, tasks, file } = yield* makeTaskFile;
+        yield* fileSystem.makeDirectory(tasks, { recursive: true });
+        // End the first read inside the two-byte é.
+        yield* fileSystem.writeFile(file, new TextEncoder().encode("café").subarray(0, 4));
+        const chunks = yield* Queue.unbounded<string>();
+        const stop = yield* Deferred.make<void>();
+        yield* tailClaudeTaskOutput({
+          root,
+          sessionId: SESSION_ID,
+          taskId: TASK_ID,
+          stop,
+          onChunk: (chunk) => Queue.offer(chunks, chunk),
+        }).pipe(Effect.forkScoped);
+        assert.equal(yield* Queue.take(chunks), "caf");
+
+        yield* fileSystem.writeFileString(file, "ok\n");
+        yield* Deferred.succeed(stop, undefined);
+        assert.equal(yield* Queue.take(chunks), "ok\n");
+      }),
+    ).pipe(Effect.provide(NodeServices.layer)),
+  );
+
   it.live("skips ahead when the command writes faster than it is read", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.ts
index 0bd369eb4df3a..77505d24a5bbf 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeTaskOutputTail.ts
@@ -88,7 +88,10 @@ export const tailClaudeTaskOutput = Effect.fn("ClaudeTaskOutputTail.tail")(funct
       Effect.map((info) => Number(info.size)),
       Effect.orElseSucceed(() => offset),
     );
-    if (size < offset) offset = 0;
+    if (size < offset) {
+      offset = 0;
+      decoder = new TextDecoder("utf-8", { fatal: false });
+    }
     if (size > offset) {
       const start = size - offset > MAX_READ_BYTES ? size - MAX_READ_BYTES : offset;
       const bytes = yield* Effect.scoped(

From 65efae1adb7f2e326bc828b6fd8538343c5b9186 Mon Sep 17 00:00:00 2001
From: Abhishek B R <byteblaster1468@gmail.com>
Date: Wed, 4 Nov 2026 04:35:42 +0530
Subject: [PATCH 059/167] fix(shared): relative file links with routing
 punctuation open as files (#28637)

---
 packages/shared/src/markdownLinks.test.ts | 35 +++++++++++++++++++----
 packages/shared/src/markdownLinks.ts      | 11 +++----
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/packages/shared/src/markdownLinks.test.ts b/packages/shared/src/markdownLinks.test.ts
index 5337700871637..318f2e1c3333d 100644
--- a/packages/shared/src/markdownLinks.test.ts
+++ b/packages/shared/src/markdownLinks.test.ts
@@ -1,5 +1,6 @@
 import { workspaceRelativeFilePath } from "./path.ts";
 import { describe, expect, it } from "vite-plus/test";
+import { serializeComposerFileLink } from "./composerTrigger.ts";
 import { extractMarkdownLinkHrefs, resolveMarkdownFileLinkTarget } from "./markdownLinks.ts";
 
 import {
@@ -38,16 +39,38 @@ describe("parseMarkdownFileLink", () => {
     ["C:%5Crepo%5Cimage.png", "C:\\repo\\image.png"],
     ["</D:/Programme/t3code/ChatMarkdown.tsx:1>", "D:/Programme/t3code/ChatMarkdown.tsx"],
     ["file://localhost/home/me/notes.md", "/home/me/notes.md"],
+    ["app/routes/posts.$postId.tsx", "app/routes/posts.$postId.tsx"],
+    ["src/routes/+page.svelte", "src/routes/+page.svelte"],
+    ["app/(marketing)/page.tsx:12", "app/(marketing)/page.tsx"],
+    ["pages/posts/%5Bid%5D.tsx", "pages/posts/[id].tsx"],
+    ["+page.svelte", "+page.svelte"],
+    ["[id].tsx", "[id].tsx"],
   ])("recognizes %s as a file", (href, path) => {
     expect(parseMarkdownFileLink(href)?.path).toBe(path);
   });
 
-  it.each(["https://example.com/docs", "/chat/settings#L3", "TODO:12", "patches"])(
-    "does not treat %s as a file",
-    (href) => {
-      expect(parseMarkdownFileLink(href)).toBeNull();
-    },
-  );
+  it.each([
+    "app/routes/posts.$postId.tsx",
+    "pages/posts/[id].tsx",
+    "docs/My File (draft).md",
+    "@scope/package.json",
+    "$postId.tsx",
+  ])("reads back the composer's link to %s", (path) => {
+    const destination = /\]\((.*)\)$/.exec(serializeComposerFileLink(path))?.[1];
+    expect(parseMarkdownFileLink(destination ?? "")?.path).toBe(path);
+  });
+
+  it.each([
+    "https://example.com/docs",
+    "/chat/settings#L3",
+    "TODO:12",
+    "patches",
+    "me@example.com",
+    "foo(bar)",
+    "$HOME",
+  ])("does not treat %s as a file", (href) => {
+    expect(parseMarkdownFileLink(href)).toBeNull();
+  });
 
   it("recognizes a relative folder that ends in a slash", () => {
     expect(parseMarkdownFileLink("patches/")).toEqual({ path: "patches/" });
diff --git a/packages/shared/src/markdownLinks.ts b/packages/shared/src/markdownLinks.ts
index 177e6fcbf5008..6b76b61475ad5 100644
--- a/packages/shared/src/markdownLinks.ts
+++ b/packages/shared/src/markdownLinks.ts
@@ -14,14 +14,15 @@ import {
 
 const RELATIVE_PATH_PREFIX_PATTERN = /^(~\/|\.{1,2}\/)/;
 
-// Names may use any script (`線性代數/考試.pdf`). The final segment is optional so an
-// explicit folder link may end in `/` (`patches/`, `docs/My Folder/`). A bare name with no
-// slash still fails.
+// Names may use any script (`線性代數/考試.pdf`) and routing punctuation (`posts.$id.tsx`,
+// `(group)/[id]/+page.svelte`, `@scope/pkg`). The final segment is optional so an explicit
+// folder link may end in `/` (`patches/`, `docs/My Folder/`). A bare name with no slash still fails.
 const RELATIVE_FILE_PATH_PATTERN =
-  /^(?:[\p{L}\p{M}\p{N}._-]+(?: +[\p{L}\p{M}\p{N}._-]+)*\/)+(?:[\p{L}\p{M}\p{N}._-]+(?: +[\p{L}\p{M}\p{N}._-]+)*(?::\d+){0,2})?$/u;
+  /^(?:[\p{L}\p{M}\p{N}._$+@()[\]-]+(?: +[\p{L}\p{M}\p{N}._$+@()[\]-]+)*\/)+(?:[\p{L}\p{M}\p{N}._$+@()[\]-]+(?: +[\p{L}\p{M}\p{N}._$+@()[\]-]+)*(?::\d+){0,2})?$/u;
 
+// No `@` here: `me@example.com` is an address, not a file.
 const RELATIVE_FILE_NAME_PATTERN =
-  /^[\p{L}\p{M}\p{N}._-]+(?: +[\p{L}\p{M}\p{N}._-]+)*\.[\p{L}\p{M}\p{N}_-]+(?::\d+){0,2}$/u;
+  /^[\p{L}\p{M}\p{N}._$+()[\]-]+(?: +[\p{L}\p{M}\p{N}._$+()[\]-]+)*\.[\p{L}\p{M}\p{N}_-]+(?::\d+){0,2}$/u;
 
 const EXTERNAL_SCHEME_PATTERN = /^([A-Za-z][A-Za-z0-9+.-]*):(.*)$/;
 

From 7a03a74189158ec8468b21d5e744f75b0507d24a Mon Sep 17 00:00:00 2001
From: Abhishek B R <byteblaster1468@gmail.com>
Date: Wed, 4 Nov 2026 04:35:58 +0530
Subject: [PATCH 060/167] fix(server): messages cut by a restart no longer stay
 marked as streaming (#28646)

---
 .../ProviderRuntimeRecoveryService.test.ts    | 23 +++++++++++++++++++
 .../ProviderRuntimeRecoveryService.ts         |  8 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.test.ts b/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.test.ts
index 2fd9b13a35c33..120858ace279d 100644
--- a/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.test.ts
@@ -674,6 +674,14 @@ it.effect(
           nodeId: rootNodeId,
           status: "running",
         },
+        ...(["assistant_message", "reasoning", "proposed_plan"] as const).map((type) => ({
+          id: TurnItemId.make(`turn_item_recovery_cancel_${type}`),
+          runId,
+          nodeId: rootNodeId,
+          type,
+          status: "running",
+          streaming: true,
+        })),
       ],
     } as unknown as OrchestrationV2ThreadProjection;
     const layer = ProviderRuntimeRecovery.layer.pipe(
@@ -727,12 +735,27 @@ it.effect(
           ["provider-turn.updated", "cancelled"],
           ["message.updated", null],
           ["turn-item.updated", "cancelled"],
+          ["turn-item.updated", "cancelled"],
+          ["turn-item.updated", "cancelled"],
+          ["turn-item.updated", "cancelled"],
           ["provider-thread.updated", "idle"],
           ["provider-session.updated", "stopped"],
         ],
       );
       const messageEvent = events.find((event) => event.type === "message.updated");
       assert.isFalse(messageEvent?.type === "message.updated" && messageEvent.payload.streaming);
+      assert.deepEqual(
+        events.flatMap((event) =>
+          event.type === "turn-item.updated" && "streaming" in event.payload
+            ? [[event.payload.type, event.payload.streaming]]
+            : [],
+        ),
+        [
+          ["assistant_message", false],
+          ["reasoning", false],
+          ["proposed_plan", false],
+        ],
+      );
     }).pipe(Effect.provide(layer));
   },
 );
diff --git a/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.ts b/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.ts
index c344357972268..80747cb68f2bb 100644
--- a/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.ts
+++ b/apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.ts
@@ -154,7 +154,13 @@ const cancelledItem = (
 ): OrchestrationV2ThreadProjection["turnItems"][number] =>
   item.type === "secret_request" && item.secretStatus === "pending"
     ? { ...item, status: "cancelled", secretStatus: "cancelled", completedAt: now, updatedAt: now }
-    : { ...item, status: "cancelled", completedAt: now, updatedAt: now };
+    : {
+        ...item,
+        ...("streaming" in item ? { streaming: false } : {}),
+        status: "cancelled",
+        completedAt: now,
+        updatedAt: now,
+      };
 
 function latestStartedRun(
   projection: ProjectionStore.ProjectionRuntimeRecoveryState,

From b6bd84d1217f4345d5d5f7376d1d353137e44491 Mon Sep 17 00:00:00 2001
From: parmartejas <110296251+parmartejass@users.noreply.github.com>
Date: Wed, 4 Nov 2026 04:36:26 +0530
Subject: [PATCH 061/167] fix(server): Antigravity Auto asks instead of
 approving every request (#23698)

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../orchestration-v2/RuntimePolicy.test.ts    | 25 +++++++++++++++++++
 .../src/provider/AntigravityProvider.test.ts  | 15 +++++++++++
 .../src/provider/AntigravityProvider.ts       |  7 +++++-
 3 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/RuntimePolicy.test.ts b/apps/server/src/orchestration-v2/RuntimePolicy.test.ts
index 21647ef49bf28..ec610b093f7d3 100644
--- a/apps/server/src/orchestration-v2/RuntimePolicy.test.ts
+++ b/apps/server/src/orchestration-v2/RuntimePolicy.test.ts
@@ -15,6 +15,7 @@ import * as Layer from "effect/Layer";
 import * as Stream from "effect/Stream";
 
 import type { ProviderInstance } from "@t3tools/provider-core/server/driver";
+import { acpPermissionDisposition } from "@t3tools/provider-acp/server/clientPolicy";
 import * as ServerSettings from "../serverSettings.ts";
 import * as ProviderInstanceRegistry from "../provider/ProviderInstanceRegistry.ts";
 import * as ProjectStore from "./ProjectStore.ts";
@@ -63,8 +64,10 @@ function makeThread(input: {
 }
 
 const grokInstanceId = ProviderInstanceId.make("grok");
+const antigravityInstanceId = ProviderInstanceId.make("antigravity");
 const supportedRuntimeModesByInstance = new Map<ProviderInstanceId, ReadonlyArray<RuntimeMode>>([
   [grokInstanceId, ["approval-required", "auto", "full-access"]],
+  [antigravityInstanceId, ["approval-required", "auto-accept-edits", "full-access"]],
 ]);
 const providerInstanceFor = (instanceId: ProviderInstanceId) =>
   ({
@@ -113,6 +116,28 @@ const layerWithPolicy = (policy?: ManagedPolicySummary) =>
 const layerTest = layerWithPolicy();
 
 it.layer(layerTest)("RuntimePolicyV2", (it) => {
+  it.effect("asks for Antigravity command approval when a stored Auto thread falls back", () =>
+    Effect.gen(function* () {
+      const policy = yield* RuntimePolicy.RuntimePolicyV2;
+      const now = yield* DateTime.now;
+      const resolve = (runtimeMode: RuntimeMode) =>
+        policy.resolve({
+          thread: makeThread({ now, worktreePath: null, runtimeMode }),
+          modelSelection: { instanceId: antigravityInstanceId, model: "test-model" },
+        });
+      const request = {
+        sessionId: "session-1",
+        toolCall: { toolCallId: "command-1", title: "Run command", kind: "execute" as const },
+        options: [{ optionId: "allow", name: "Allow", kind: "allow_once" as const }],
+      };
+      const auto = yield* resolve("auto");
+      assert.equal(auto.runtimeMode, "approval-required");
+      assert.equal(acpPermissionDisposition(auto, request), "ask");
+      assert.equal(acpPermissionDisposition(yield* resolve("auto-accept-edits"), request), "ask");
+      assert.equal(acpPermissionDisposition(yield* resolve("full-access"), request), "allow");
+    }),
+  );
+
   it.effect("runs a mode the provider does not offer in Supervised", () =>
     Effect.gen(function* () {
       const policy = yield* RuntimePolicy.RuntimePolicyV2;
diff --git a/apps/server/src/provider/AntigravityProvider.test.ts b/apps/server/src/provider/AntigravityProvider.test.ts
index 44f8842fd9591..791ed748de2ef 100644
--- a/apps/server/src/provider/AntigravityProvider.test.ts
+++ b/apps/server/src/provider/AntigravityProvider.test.ts
@@ -348,6 +348,21 @@ it.layer(layerTest)("Antigravity provider snapshots", (it) => {
     ),
   );
 
+  it.effect("does not offer Auto, so Auto threads fall back to Supervised", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const harness = yield* makeHarness();
+        yield* harness.initialize;
+        // Antigravity has no automatic review; the shared ACP policy would approve every request.
+        expect((yield* harness.provider.snapshot.getSnapshot).supportedRuntimeModes).toEqual([
+          "approval-required",
+          "auto-accept-edits",
+          "full-access",
+        ]);
+      }),
+    ),
+  );
+
   it.effect("publishes session metadata and native commands without another health probe", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/server/src/provider/AntigravityProvider.ts b/apps/server/src/provider/AntigravityProvider.ts
index ff8805f43b371..ed047331e73ee 100644
--- a/apps/server/src/provider/AntigravityProvider.ts
+++ b/apps/server/src/provider/AntigravityProvider.ts
@@ -182,7 +182,12 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
   const checkedAt = DateTime.formatIso(yield* DateTime.now);
   const initialDraft = {
     ...buildServerProvider({
-      presentation: { displayName: "Antigravity", showInteractionModeToggle: false },
+      presentation: {
+        displayName: "Antigravity",
+        showInteractionModeToggle: false,
+        // No automatic review, so Auto falls back to Supervised instead of approving everything.
+        supportedRuntimeModes: ["approval-required", "auto-accept-edits", "full-access"],
+      },
       enabled: settings.enabled,
       checkedAt,
       models: [],

From a445272c789ec5009d23fa5ec6df7155e734dea3 Mon Sep 17 00:00:00 2001
From: Derek Trimm <275381468+derektrimm@users.noreply.github.com>
Date: Tue, 3 Nov 2026 17:06:43 -0600
Subject: [PATCH 062/167] fix(server): Codex threads open in another client are
 no longer silently replaced (#21045)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../Adapters/CodexAdapterV2.test.ts           | 72 +++++++++++++++++++
 .../Adapters/CodexAdapterV2.ts                | 37 +++++++---
 .../ProviderTurnStartService.test.ts          | 54 +++++++++++---
 .../ProviderTurnStartService.ts               |  8 +++
 .../src/server/ProviderAdapter.ts             | 19 +++++
 .../provider-core/src/server/failure.test.ts  | 17 +++++
 packages/provider-core/src/server/failure.ts  |  1 +
 7 files changed, 192 insertions(+), 16 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
index 4471be814bf39..3ea5a4cce154c 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
@@ -3256,6 +3256,78 @@ describe("CodexAdapterV2 post-settle continuation", () => {
     ),
   );
 
+  it.effect("reports a thread another Codex client is writing to as in use", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const nativeThreadId = "thread-open-elsewhere";
+        const harness = yield* makeCodexReplayHarness(
+          makeCodexReplayTranscript({
+            scenario: "codex-resume-active-writer",
+            entries: [
+              ...codexReplayPreamble({
+                nativeThreadId,
+                nativeTurnId: "unused-turn",
+                prompt: "unused-prompt",
+              }).slice(0, 5),
+              {
+                type: "expect_outbound",
+                label: "thread/resume",
+                frame: {
+                  id: 3,
+                  method: "thread/resume",
+                  params: {
+                    threadId: nativeThreadId,
+                    excludeTurns: true,
+                    cwd: CODEX_TEST_RUNTIME_POLICY.cwd,
+                    model: CODEX_TEST_MODEL_SELECTION.model,
+                    config: CodexAdapterV2.CODEX_THREAD_CONFIG,
+                  },
+                },
+              },
+              {
+                type: "emit_inbound",
+                label: "active writer",
+                frame: {
+                  id: 3,
+                  error: {
+                    code: -32600,
+                    message: `thread ${nativeThreadId} already has an active writer`,
+                  },
+                },
+              },
+            ],
+          }),
+        );
+
+        const error = yield* Effect.flip(
+          harness.runtime.resumeThread({
+            providerThread: harness.providerThread,
+            modelSelection: CODEX_TEST_MODEL_SELECTION,
+            runtimePolicy: CODEX_TEST_RUNTIME_POLICY,
+          }),
+        );
+
+        assert.equal(error._tag, "ProviderAdapterThreadInUseError");
+        assert.nestedPropertyVal(error, "providerThreadId", harness.providerThread.id);
+        assert.include(error.message, "open in another Codex client");
+        assert.nestedPropertyVal(
+          error,
+          "cause.errorMessage",
+          `thread ${nativeThreadId} already has an active writer`,
+        );
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(
+            IdAllocator.layer,
+            McpProviderSessions.layer,
+            NodeServices.layer,
+            NodeCrypto.layer,
+          ),
+        ),
+      ),
+    ),
+  );
+
   it.effect("resolves retryable app-server errors on resumed provider activity", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
index 688de092c03d0..78e14a0b9fc3a 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
@@ -341,6 +341,21 @@ function toProtocolError(
   });
 }
 
+const CODEX_THREAD_IN_USE_MESSAGE =
+  "This conversation is open in another Codex client, such as the Codex app, the Codex CLI, or an IDE extension. Codex lets one client write to a conversation at a time. Quit that client, then send your message again.";
+
+const isCodexAppServerRequestError = Schema.is(CodexErrors.CodexAppServerRequestError);
+
+// Codex holds a per-thread writer lock for as long as a thread stays loaded in
+// any app-server sharing the same CODEX_HOME, and reports a conflict this way.
+function isCodexActiveWriterError(error: unknown): boolean {
+  return (
+    isCodexAppServerRequestError(error) &&
+    error.code === -32600 &&
+    error.errorMessage.includes("already has an active writer")
+  );
+}
+
 function codexTimestamp(seconds: number | null | undefined): DateTime.Utc {
   return seconds === null || seconds === undefined
     ? DateTime.nowUnsafe()
@@ -7126,14 +7141,20 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
             },
             (effect, threadInput) =>
               effect.pipe(
-                Effect.mapError(
-                  (cause) =>
-                    new ProviderAdapter.ProviderAdapterResumeThreadError({
-                      driver: CODEX_PROVIDER,
-                      providerSessionId: input.providerSessionId,
-                      providerThreadId: threadInput.providerThread.id,
-                      cause,
-                    }),
+                Effect.mapError((cause) =>
+                  isCodexActiveWriterError(cause)
+                    ? new ProviderAdapter.ProviderAdapterThreadInUseError({
+                        driver: CODEX_PROVIDER,
+                        providerThreadId: threadInput.providerThread.id,
+                        detail: CODEX_THREAD_IN_USE_MESSAGE,
+                        cause,
+                      })
+                    : new ProviderAdapter.ProviderAdapterResumeThreadError({
+                        driver: CODEX_PROVIDER,
+                        providerSessionId: input.providerSessionId,
+                        providerThreadId: threadInput.providerThread.id,
+                        cause,
+                      }),
                 ),
               ),
           ),
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
index f7f9dc25ddc92..cdbd259440ab2 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
@@ -280,6 +280,7 @@ function makeLocalCommandHarness(input: {
   readonly openFailure?: unknown;
   readonly ensureThreadFailure?: unknown;
   readonly historyReadFailureAfterFallback?: unknown;
+  readonly resumeFailure?: ProviderAdapter.ProviderAdapterV2Error;
   readonly interruptOpen?: boolean;
   readonly interruptRunBeforeOpenFailure?: boolean;
   readonly writeFailure?: unknown;
@@ -648,7 +649,7 @@ function makeLocalCommandHarness(input: {
       ],
     };
   }
-  if ("historyReadFailureAfterFallback" in input) {
+  if ("historyReadFailureAfterFallback" in input || "resumeFailure" in input) {
     const nativeThreadRef = {
       driver: providerThread.driver,
       nativeId: "native-resume-thread",
@@ -755,17 +756,19 @@ function makeLocalCommandHarness(input: {
       ),
     ),
   );
+  const fallbackEnsureThread = vi.fn(() => Effect.succeed(providerThread));
   const resumeFallbackSession = {
     driver: providerThread.driver,
     resumeThread: () =>
       Effect.fail(
-        new ProviderAdapter.ProviderAdapterEventStreamError({
-          driver: providerThread.driver,
-          providerSessionId,
-          cause: "native thread is gone",
-        }),
+        input.resumeFailure ??
+          new ProviderAdapter.ProviderAdapterEventStreamError({
+            driver: providerThread.driver,
+            providerSessionId,
+            cause: "native thread is gone",
+          }),
       ),
-    ensureThread: () => Effect.succeed(providerThread),
+    ensureThread: fallbackEnsureThread,
   };
   const providerSession = {
     id: providerSessionId,
@@ -804,7 +807,7 @@ function makeLocalCommandHarness(input: {
       ? Effect.succeed(sideChatSession as never)
       : input.interruptOpen === true
         ? Effect.interrupt
-        : "historyReadFailureAfterFallback" in input
+        : "historyReadFailureAfterFallback" in input || "resumeFailure" in input
           ? Effect.succeed(resumeFallbackSession as never)
           : "ensureThreadFailure" in input
             ? Effect.succeed({ driver: providerThread.driver, ensureThread } as never)
@@ -1012,6 +1015,7 @@ function makeLocalCommandHarness(input: {
     resolveRuntimePolicy,
     createWorktree,
     open,
+    fallbackEnsureThread,
     writeIfRunCurrent,
     startRootRun,
     startTurn,
@@ -1730,6 +1734,40 @@ effectIt.effect("does not overwrite a run interrupted while its provider session
   }),
 );
 
+effectIt.effect("fails the run instead of replacing a native thread another client holds", () =>
+  Effect.gen(function* () {
+    const detail = "This conversation is open in another Codex client.";
+    const harness = makeLocalCommandHarness({
+      text: "Continue",
+      resumeFailure: new ProviderAdapter.ProviderAdapterThreadInUseError({
+        driver: ProviderDriverKind.make("codex"),
+        providerThreadId: ProviderThreadId.make("new-provider-thread"),
+        detail,
+        cause: new Error("thread native-resume-thread already has an active writer"),
+      }),
+    });
+
+    const exit = yield* Effect.exit(harness.start);
+
+    expect(harness.fallbackEnsureThread).not.toHaveBeenCalled();
+    expect(exit._tag).toBe("Success");
+    expect(harness.startRootRun).not.toHaveBeenCalled();
+    const projection = harness.projection();
+    expect(projection.providerThreads.at(-1)?.nativeThreadRef?.nativeId).toBe(
+      "native-resume-thread",
+    );
+    expect(projection.contextHandoffs).toEqual([]);
+    expect(projection.runs.at(-1)).toMatchObject({ status: "failed", startedAt: null });
+    expect(projection.turnItems).toMatchObject([
+      {
+        type: "error",
+        title: "Provider turn failed to start",
+        failure: { class: "provider_error", message: detail },
+      },
+    ]);
+  }),
+);
+
 effectIt.effect("does not mistake a failed state read for a superseded run", () =>
   Effect.gen(function* () {
     const harness = makeLocalCommandHarness({ text: "Continue", failReadsAfterRunning: true });
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
index cd121c7115a2a..e0797e784ba00 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
@@ -1336,6 +1336,14 @@ export const layer: Layer.Layer<
         resumedHandoffContext = undefined;
         resumedRetryHandoff = [];
         if (!(yield* isCurrentAttemptInStatus("starting"))) return undefined;
+        // Another client is still writing to the native thread. A fresh
+        // session here would silently split the conversation from it.
+        if (
+          resumed._tag === "Failure" &&
+          resumed.failure._tag === "ProviderAdapterThreadInUseError"
+        ) {
+          return yield* loadFromProvider(Effect.fail(resumed.failure));
+        }
 
         yield* Effect.logWarning("Recovering provider context in a fresh native session", {
           driver: session.driver,
diff --git a/packages/provider-core/src/server/ProviderAdapter.ts b/packages/provider-core/src/server/ProviderAdapter.ts
index 9d83da489b306..f9f55ec131180 100644
--- a/packages/provider-core/src/server/ProviderAdapter.ts
+++ b/packages/provider-core/src/server/ProviderAdapter.ts
@@ -235,6 +235,24 @@ export class ProviderAdapterResumeThreadError extends Schema.TaggedError<Provide
   }
 }
 
+/**
+ * The native thread is live in another process that owns its writes. Starting
+ * a replacement would split the conversation, so callers must not fall back.
+ */
+export class ProviderAdapterThreadInUseError extends Schema.TaggedError<ProviderAdapterThreadInUseError>()(
+  "ProviderAdapterThreadInUseError",
+  {
+    driver: ProviderDriverKind,
+    providerThreadId: ProviderThreadId,
+    detail: Schema.String,
+    cause: Schema.Defect(),
+  },
+) {
+  override get message(): string {
+    return this.detail;
+  }
+}
+
 export class ProviderAdapterEnsureThreadError extends Schema.TaggedError<ProviderAdapterEnsureThreadError>()(
   "ProviderAdapterEnsureThreadError",
   {
@@ -411,6 +429,7 @@ export const ProviderAdapterV2Error = Schema.Union([
   ProviderAdapterOpenSessionError,
   ProviderAdapterCloseSessionError,
   ProviderAdapterResumeThreadError,
+  ProviderAdapterThreadInUseError,
   ProviderAdapterEnsureThreadError,
   ProviderAdapterReadThreadSnapshotError,
   ProviderAdapterRollbackThreadError,
diff --git a/packages/provider-core/src/server/failure.test.ts b/packages/provider-core/src/server/failure.test.ts
index 5ca689509c007..04829ad8f263b 100644
--- a/packages/provider-core/src/server/failure.test.ts
+++ b/packages/provider-core/src/server/failure.test.ts
@@ -186,6 +186,23 @@ it("uses the innermost category without carrying an outer reason into it", () =>
   );
 });
 
+it("explains a native thread another client is writing to", () => {
+  const inUse = new ProviderAdapter.ProviderAdapterThreadInUseError({
+    driver: ProviderDriverKind.make("codex"),
+    providerThreadId: ProviderThreadId.make("provider-thread:in-use"),
+    detail: "This conversation is open in another Codex client.",
+    cause: new Error("thread provider-thread:in-use already has an active writer"),
+  });
+  const cause = new ProviderAdapter.ProviderAdapterTurnStartError({
+    driver: ProviderDriverKind.make("codex"),
+    threadId: ThreadId.make("thread:in-use"),
+    providerThreadId: ProviderThreadId.make("provider-thread:in-use"),
+    runId: RunId.make("run:in-use"),
+    cause: inUse,
+  });
+  assert.equal(makeProviderFailure({ cause: Cause.fail(cause) }).message, inUse.message);
+});
+
 it("does not expose defect text nested inside a known error category", () => {
   const failure = makeProviderFailure({
     cause: {
diff --git a/packages/provider-core/src/server/failure.ts b/packages/provider-core/src/server/failure.ts
index 8927a8c0ae9bd..edaf0aa97a743 100644
--- a/packages/provider-core/src/server/failure.ts
+++ b/packages/provider-core/src/server/failure.ts
@@ -115,6 +115,7 @@ function curatedCauseMessages(cause: unknown): {
         case "CursorModelUnavailableError":
         case "CodexGoalObjectiveTooLongError":
         case "ProviderSetupError":
+        case "ProviderAdapterThreadInUseError":
           return { known: stringField(cause, "message"), category: categoryMessage() };
         case "CodexAppServerRequestError": {
           // Only Codex's fixed-shape goal validation text is actionable and

From ef99d3f26ffbbe5561a17294163eb1f5073919e4 Mon Sep 17 00:00:00 2001
From: Tyler Jennings <tylerjennings2@outlook.com>
Date: Tue, 3 Nov 2026 18:06:59 -0500
Subject: [PATCH 063/167] fix(server): WSL servers avoid ports already used by
 Windows (#22962)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/cli/automaticPort.test.ts     | 165 ++++++++++++++++++
 apps/server/src/cli/automaticPort.ts          |  69 ++++++++
 apps/server/src/cli/config.test.ts            |  37 ++++
 apps/server/src/cli/config.ts                 |   6 +-
 apps/server/src/cli/server.ts                 |   5 +-
 apps/server/src/preview/PortScanner.ts        |  88 ++--------
 .../server/src/process/windowsTcpListeners.ts |  61 +++++++
 7 files changed, 355 insertions(+), 76 deletions(-)
 create mode 100644 apps/server/src/cli/automaticPort.test.ts
 create mode 100644 apps/server/src/cli/automaticPort.ts
 create mode 100644 apps/server/src/process/windowsTcpListeners.ts

diff --git a/apps/server/src/cli/automaticPort.test.ts b/apps/server/src/cli/automaticPort.test.ts
new file mode 100644
index 0000000000000..1f7805569744f
--- /dev/null
+++ b/apps/server/src/cli/automaticPort.test.ts
@@ -0,0 +1,165 @@
+import { describe, expect, it } from "@effect/vitest";
+import * as NetService from "@t3tools/shared/Net";
+import * as Effect from "effect/Effect";
+import * as CliError from "effect/cli/CliError";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as PlatformError from "effect/PlatformError";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+
+import * as ProcessRunner from "../processRunner.ts";
+import * as AutomaticPort from "./automaticPort.ts";
+
+const WSL_KERNEL = "6.6.87.2-microsoft-standard-WSL2\n";
+const NETSTAT_PATH = "/windows/c/Windows/System32/netstat.exe";
+
+const output = (stdout: string, code: number | null = null): ProcessRunner.ProcessRunOutput => ({
+  stdout,
+  stderr: "",
+  code: code === null ? null : ChildProcessSpawner.ExitCode(code),
+  timedOut: false,
+  stdoutTruncated: false,
+  stderrTruncated: false,
+  stdoutInvalidUtf8: false,
+  stderrInvalidUtf8: false,
+});
+
+const listening = (ports: ReadonlyArray<number>, host = "127.0.0.1", foreign = "0.0.0.0:0") =>
+  ports.map((port) => `  TCP    ${host}:${port}    ${foreign}    ABHÖREN    4242`).join("\r\n");
+
+interface Scenario {
+  readonly kernelRelease?: string;
+  readonly windowsPorts?: ReadonlyArray<number>;
+  readonly windowsPortsV6?: ReadonlyArray<number>;
+  readonly tcpv6ExitCode?: number;
+  readonly wslpathMissing?: boolean;
+  readonly reservedPorts?: ReadonlyArray<number>;
+}
+
+const select = (scenario: Scenario) => {
+  const commands: string[] = [];
+  const reserved = [...(scenario.reservedPorts ?? [50_001])];
+  const net: NetService.NetServiceShape = {
+    canListenOnHost: () => Effect.succeed(true),
+    hasListenerOnHost: () => Effect.succeed(false),
+    isPortAvailableOnLoopback: () => Effect.succeed(true),
+    reserveLoopbackPort: () => Effect.sync(() => reserved.shift() ?? 60_000),
+    findAvailablePort: Effect.succeed,
+  };
+  const run: ProcessRunner.ProcessRunner["Service"]["run"] = (input) => {
+    commands.push(input.command);
+    if (input.command === "wslpath") {
+      if (scenario.wslpathMissing) {
+        return Effect.fail(
+          new ProcessRunner.ProcessSpawnError({
+            command: input.command,
+            argumentCount: input.args.length,
+            cause: PlatformError.systemError({
+              _tag: "NotFound",
+              module: "ChildProcess",
+              method: "spawn",
+            }),
+          }),
+        );
+      }
+      return Effect.succeed(output(`${NETSTAT_PATH}\n`));
+    }
+    if (input.args.includes("tcpv6")) {
+      return Effect.succeed(
+        output(
+          listening(scenario.windowsPortsV6 ?? [], "[::1]", "[::]:0"),
+          scenario.tcpv6ExitCode ?? null,
+        ),
+      );
+    }
+    return Effect.succeed(output(listening(scenario.windowsPorts ?? [])));
+  };
+  const layer = Layer.mergeAll(
+    Layer.succeed(NetService.NetService, net),
+    Layer.succeed(ProcessRunner.ProcessRunner, { run }),
+    FileSystem.layerNoop({
+      readFileString: (path) =>
+        path === "/proc/sys/kernel/osrelease" && scenario.kernelRelease !== undefined
+          ? Effect.succeed(scenario.kernelRelease)
+          : Effect.fail(
+              PlatformError.systemError({
+                _tag: "NotFound",
+                module: "FileSystem",
+                method: "readFileString",
+              }),
+            ),
+    }),
+  );
+  return Effect.gen(function* () {
+    const selectAutomaticPort = yield* AutomaticPort.make;
+    const port = yield* selectAutomaticPort(3773);
+    return { port, commands };
+  }).pipe(Effect.provide(layer));
+};
+
+describe("automatic port selection", () => {
+  it.effect("moves off the default port only when Windows already listens on it", () =>
+    Effect.gen(function* () {
+      const free = yield* select({ kernelRelease: WSL_KERNEL, windowsPorts: [8080] });
+      expect(free.port).toBe(3773);
+      expect(free.commands).toEqual(["wslpath", NETSTAT_PATH, NETSTAT_PATH]);
+
+      const owned = yield* select({ kernelRelease: WSL_KERNEL, windowsPorts: [3773] });
+      expect(owned.port).toBe(50_001);
+    }),
+  );
+
+  it.effect("retries a fallback port that Windows already listens on", () =>
+    Effect.gen(function* () {
+      const result = yield* select({
+        kernelRelease: WSL_KERNEL,
+        windowsPorts: [3773],
+        windowsPortsV6: [50_001],
+        reservedPorts: [50_001, 50_002],
+      });
+      expect(result.port).toBe(50_002);
+    }),
+  );
+
+  it.effect("fails with an actionable error when every fallback belongs to Windows", () =>
+    Effect.gen(function* () {
+      const ports = Array.from({ length: 8 }, (_, index) => 50_001 + index);
+      const error = yield* select({
+        kernelRelease: WSL_KERNEL,
+        windowsPorts: [3773],
+        windowsPortsV6: ports,
+        reservedPorts: ports,
+      }).pipe(Effect.flip);
+      expect(error).toBeInstanceOf(CliError.UserError);
+      expect(error.cause).toContain("--port");
+    }),
+  );
+
+  it.effect("keeps the local choice when the Windows snapshot is unavailable", () =>
+    Effect.gen(function* () {
+      const partial = yield* select({
+        kernelRelease: WSL_KERNEL,
+        windowsPorts: [3773],
+        tcpv6ExitCode: 1,
+      });
+      expect(partial.port).toBe(3773);
+
+      const noInterop = yield* select({ kernelRelease: WSL_KERNEL, wslpathMissing: true });
+      expect(noInterop.port).toBe(3773);
+    }),
+  );
+
+  it.effect("never queries Windows outside WSL", () =>
+    Effect.gen(function* () {
+      for (const scenario of [
+        { kernelRelease: "6.8.0-45-generic\n" },
+        // macOS and Windows have no kernel release file.
+        {},
+      ] satisfies ReadonlyArray<Scenario>) {
+        const result = yield* select(scenario);
+        expect(result.port).toBe(3773);
+        expect(result.commands).toEqual([]);
+      }
+    }),
+  );
+});
diff --git a/apps/server/src/cli/automaticPort.ts b/apps/server/src/cli/automaticPort.ts
new file mode 100644
index 0000000000000..354de65d2519b
--- /dev/null
+++ b/apps/server/src/cli/automaticPort.ts
@@ -0,0 +1,69 @@
+import * as NetService from "@t3tools/shared/Net";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as CliError from "effect/cli/CliError";
+
+import { queryWindowsTcpListeners } from "../process/windowsTcpListeners.ts";
+import * as ProcessRunner from "../processRunner.ts";
+
+const KERNEL_RELEASE_PATH = "/proc/sys/kernel/osrelease";
+const WINDOWS_NETSTAT_PATH = String.raw`C:\Windows\System32\netstat.exe`;
+const FALLBACK_ATTEMPTS = 8;
+
+/**
+ * Picks the startup port when none was configured. Under WSL's default NAT networking, Windows
+ * reaches the server through localhost forwarding, which fails for a port a Windows process
+ * already listens on even though WSL can bind it.
+ */
+export const make = Effect.gen(function* () {
+  const net = yield* NetService.NetService;
+  const fs = yield* FileSystem.FileSystem;
+  const processRunner = yield* ProcessRunner.ProcessRunner;
+
+  // Services started by systemd lack WSL_DISTRO_NAME and WSL_INTEROP; the kernel release does not.
+  // Hosts without this file (macOS, Windows) are not WSL.
+  const isWsl = fs.readFileString(KERNEL_RELEASE_PATH).pipe(
+    Effect.map((release) => release.toLowerCase().includes("microsoft")),
+    Effect.orElseSucceed(() => false),
+  );
+
+  const readWindowsHostListeners = Effect.gen(function* () {
+    // The automount root is configurable, so `/mnt/c` is not guaranteed.
+    const netstat = yield* processRunner.run({
+      command: "wslpath",
+      args: ["-u", WINDOWS_NETSTAT_PATH],
+      timeout: Duration.seconds(5),
+    });
+    const netstatPath = netstat.stdout.trim();
+    if ((netstat.code !== null && netstat.code !== 0) || netstatPath.length === 0) {
+      return null;
+    }
+    const listeners = yield* queryWindowsTcpListeners(processRunner, netstatPath);
+    if (listeners === null) return null;
+    return new Set(listeners.map((listener) => listener.port));
+  }).pipe(Effect.orElseSucceed(() => null));
+
+  return Effect.fn("automaticPort.select")(function* (preferred: number) {
+    if (!(yield* isWsl)) return yield* net.findAvailablePort(preferred);
+    const windows = yield* readWindowsHostListeners;
+    if (windows === null) {
+      yield* Effect.logWarning(
+        "Could not list Windows TCP listeners from WSL; Windows may be unable to reach the selected port. Pass --port to choose one.",
+      );
+      return yield* net.findAvailablePort(preferred);
+    }
+    if (!windows.has(preferred) && (yield* net.isPortAvailableOnLoopback(preferred))) {
+      return preferred;
+    }
+    // Linux and Windows ephemeral ranges overlap, so fallback ports can collide too.
+    for (let attempt = 0; attempt < FALLBACK_ATTEMPTS; attempt += 1) {
+      const port = yield* net.reserveLoopbackPort();
+      if (!windows.has(port)) return port;
+    }
+    return yield* new CliError.UserError({
+      cause:
+        "Windows is already using every port T3 Code tried. Pass --port or set T3CODE_PORT to a port Windows is not using.",
+    });
+  });
+});
diff --git a/apps/server/src/cli/config.test.ts b/apps/server/src/cli/config.test.ts
index 297b225b6adce..5e09dda2c164f 100644
--- a/apps/server/src/cli/config.test.ts
+++ b/apps/server/src/cli/config.test.ts
@@ -754,6 +754,43 @@ it.layer(NodeServices.layer)("cli config resolution", (it) => {
     lan: Option.none<boolean>(),
   });
 
+  it.effect("uses the automatic port selector only when no port is configured", () =>
+    Effect.gen(function* () {
+      const baseDir = yield* FileSystem.FileSystem.pipe(
+        Effect.flatMap((fs) => fs.makeTempDirectoryScoped({ prefix: "t3-cli-auto-port-" })),
+      );
+      const selected: number[] = [];
+      const selectAutomaticPort = (preferred: number) =>
+        Effect.sync(() => {
+          selected.push(preferred);
+          return 50_123;
+        });
+      const resolvePort = (flags: {
+        readonly mode?: Option.Option<"web" | "desktop">;
+        readonly port: Option.Option<number>;
+      }) =>
+        resolveServerConfig({ ...minimalWebFlags(baseDir), ...flags }, Option.none(), {
+          selectAutomaticPort,
+        }).pipe(
+          Effect.map((config) => config.port),
+          Effect.provide(
+            Layer.merge(
+              NetService.layer,
+              ConfigProvider.layer(ConfigProvider.fromEnv({ env: {} })),
+            ),
+          ),
+        );
+
+      expect(yield* resolvePort({ port: Option.none() })).toBe(50_123);
+      expect(selected).toEqual([3773]);
+      expect(yield* resolvePort({ port: Option.some(8788) })).toBe(8788);
+      expect(
+        yield* resolvePort({ mode: Option.some("desktop" as const), port: Option.none() }),
+      ).toBe(3773);
+      expect(selected).toEqual([3773]);
+    }),
+  );
+
   it.effect(
     "resolves each signal's endpoint through T3CODE_OTLP_*_URL, an OTEL endpoint, the bootstrap envelope, and persisted Settings, in that order",
     () =>
diff --git a/apps/server/src/cli/config.ts b/apps/server/src/cli/config.ts
index f86fde0f59750..00aae0f3133b7 100644
--- a/apps/server/src/cli/config.ts
+++ b/apps/server/src/cli/config.ts
@@ -267,9 +267,13 @@ export const resolveServerConfig = Effect.fn("config.resolveServerConfig")(funct
     readonly startupPresentation?: ServerConfig.StartupPresentation;
     readonly forceAutoBootstrapProjectFromCwd?: boolean;
     readonly rejectRunningServer?: boolean;
+    readonly selectAutomaticPort?: (
+      preferred: number,
+    ) => Effect.Effect<number, NetService.NetError | CliError.UserError>;
   },
 ) {
   const { findAvailablePort } = yield* NetService.NetService;
+  const selectAutomaticPort = options?.selectAutomaticPort ?? findAvailablePort;
   const path = yield* Path.Path;
   const fs = yield* FileSystem.FileSystem;
   const env = yield* EnvServerConfig;
@@ -316,7 +320,7 @@ export const resolveServerConfig = Effect.fn("config.resolveServerConfig")(funct
         if (mode === "desktop") {
           return Effect.succeed(ServerConfig.DEFAULT_PORT);
         }
-        return findAvailablePort(ServerConfig.DEFAULT_PORT);
+        return selectAutomaticPort(ServerConfig.DEFAULT_PORT);
       },
     },
   );
diff --git a/apps/server/src/cli/server.ts b/apps/server/src/cli/server.ts
index cb21a08140e4b..3b2768499fdb6 100644
--- a/apps/server/src/cli/server.ts
+++ b/apps/server/src/cli/server.ts
@@ -8,6 +8,8 @@ import * as CliError from "effect/cli/CliError";
 
 import * as ServerConfig from "../config.ts";
 import { awaitLauncherLoss } from "../launcherWatch.ts";
+import * as ProcessRunner from "../processRunner.ts";
+import * as AutomaticPort from "./automaticPort.ts";
 import { type CliServerFlags, resolveServerConfig, sharedServerCommandFlags } from "./config.ts";
 
 const encodeCommand = Schema.encodeEffect(Schema.fromJsonString(Schema.String));
@@ -30,7 +32,8 @@ const runServerCommand = Effect.fn("server.runServerCommand")(function* (
   // Before config resolution, which claims a port and creates directories.
   const { runServer } = yield* Effect.promise(() => import("../server.ts"));
   const logLevel = yield* GlobalFlag.LogLevel;
-  const config = yield* resolveServerConfig(flags, logLevel, options);
+  const selectAutomaticPort = yield* AutomaticPort.make.pipe(Effect.provide(ProcessRunner.layer));
+  const config = yield* resolveServerConfig(flags, logLevel, { ...options, selectAutomaticPort });
   const run = runServer.pipe(Effect.provideService(ServerConfig.ServerConfig, config));
   if (config.mode !== "desktop" || config.desktopBootstrapToken === undefined) return yield* run;
   yield* Effect.sync(() => {
diff --git a/apps/server/src/preview/PortScanner.ts b/apps/server/src/preview/PortScanner.ts
index e026b204c03d8..b2b6e1ac9fbe0 100644
--- a/apps/server/src/preview/PortScanner.ts
+++ b/apps/server/src/preview/PortScanner.ts
@@ -24,6 +24,7 @@ import * as Scope from "effect/Scope";
 import * as Semaphore from "effect/Semaphore";
 import { FetchHttpClient, HttpClient } from "effect/http";
 
+import * as WindowsTcpListeners from "../process/windowsTcpListeners.ts";
 import * as ProcessRunner from "../processRunner.ts";
 
 export class PortDiscovery extends Context.Service<
@@ -76,8 +77,6 @@ const LSOF_TIMEOUT_MS = 5_000;
 const PROC_FD_WALK_LIMIT = 50_000;
 const SOCKET_OWNER_ATTEMPTS = 3;
 const WINDOWS_LISTENER_TIMEOUT_MS = 5_000;
-/** `netstat -ano` lists every connection, not just listeners; ~80 bytes per row, sized for ~200k rows. */
-const WINDOWS_NETSTAT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 const WEB_PROBE_TIMEOUT = Duration.seconds(1);
 const WEB_PROBE_CACHE_TTL_MS = Duration.toMillis(Duration.seconds(15));
 /** Bounds how long a cached Windows image name can outlive its process if Windows reuses the PID. */
@@ -272,53 +271,6 @@ const parsePortFromLsofName = (name: string): number | null => {
   return port;
 };
 
-const parseWindowsListenerLine = (
-  line: string,
-): {
-  readonly host: string;
-  readonly port: number;
-  readonly pid: number | null;
-  readonly processName: string | null;
-} | null => {
-  const trimmed = line.trim();
-  if (trimmed.length === 0) return null;
-
-  if (trimmed.includes("|")) {
-    const [hostRaw, portRaw, pidRaw, processNameRaw] = trimmed.split("|", 4);
-    const host = hostRaw?.trim() ?? "";
-    if (!LSOF_LOCAL_HOST_TOKENS.has(host) && host !== "::") return null;
-    const port = Number(portRaw);
-    const pid = Number(pidRaw);
-    if (!Number.isInteger(port) || port <= 0 || port >= 65536) return null;
-    return {
-      host,
-      port,
-      pid: Number.isInteger(pid) && pid > 0 ? pid : null,
-      processName: processNameRaw?.trim() || null,
-    };
-  }
-
-  // Foreign port `:0` identifies a listening TCP socket regardless of Windows locale.
-  const fields = trimmed.split(/\s+/);
-  if (fields.length < 4 || fields[0]?.toUpperCase() !== "TCP") return null;
-  const localEndpoint = fields[1] ?? "";
-  const foreignEndpoint = fields[2] ?? "";
-  if (!foreignEndpoint.endsWith(":0")) return null;
-  const lastColon = localEndpoint.lastIndexOf(":");
-  if (lastColon <= 0) return null;
-  const host = localEndpoint.slice(0, lastColon);
-  if (!LSOF_LOCAL_HOST_TOKENS.has(host) && host !== "::") return null;
-  const port = Number(localEndpoint.slice(lastColon + 1));
-  if (!Number.isInteger(port) || port <= 0 || port >= 65536) return null;
-  const pid = Number(fields.at(-1));
-  return {
-    host,
-    port,
-    pid: Number.isInteger(pid) && pid > 0 ? pid : null,
-    processName: null,
-  };
-};
-
 const exitedWithError = (result: ProcessRunner.ProcessRunOutput): boolean =>
   result.code !== null && result.code !== 0;
 
@@ -330,16 +282,13 @@ const parseTasklistProcessName = (raw: string, pid: number): string | null => {
   return null;
 };
 
-const parseWindowsListenerOutput = (
-  raw: string,
-  owners: ReadonlyMap<number, ServerOwner> = new Map(),
+const discoveredWindowsListeners = (
+  listeners: ReadonlyArray<WindowsTcpListeners.WindowsTcpListener>,
+  owners: ReadonlyMap<number, ServerOwner>,
 ): ReadonlyArray<DiscoveredLocalServer> => {
   const seen = new Map<number, DiscoveredLocalServer>();
-  for (const line of raw.split(/\r?\n/g)) {
-    const parsed = parseWindowsListenerLine(line);
-    if (!parsed) continue;
-    const { port, pid: normalizedPid, processName } = parsed;
-    const owner = normalizedPid === null ? undefined : owners.get(normalizedPid);
+  for (const { port, pid } of listeners) {
+    const owner = pid === null ? undefined : owners.get(pid);
     const existing = seen.get(port);
     if (existing) {
       if (owner === undefined) seen.set(port, { ...existing, ...UNOWNED });
@@ -349,8 +298,8 @@ const parseWindowsListenerOutput = (
       host: "localhost",
       port,
       url: `http://localhost:${port}`,
-      processName,
-      pid: normalizedPid,
+      processName: null,
+      pid,
       ...(owner ?? UNOWNED),
     });
   }
@@ -857,21 +806,12 @@ export const make = Effect.gen(function* PortDiscoveryMake() {
       agentsPossible ? withAgentOwners(terminalOwners, pids) : Effect.succeed(terminalOwners);
     if (hostPlatform === "win32") {
       const recoverWindowsProbeFailure = recoverProcessProbeFailure("windows-listeners");
-      const runNetstat = (protocol: "tcp" | "tcpv6") =>
-        processRunner.run({
-          command: "netstat.exe",
-          args: ["-ano", "-p", protocol],
-          timeout: Duration.millis(WINDOWS_LISTENER_TIMEOUT_MS),
-          maxOutputBytes: WINDOWS_NETSTAT_MAX_OUTPUT_BYTES,
-        });
-      const listeners = yield* Effect.all([runNetstat("tcp"), runNetstat("tcpv6")], {
-        concurrency: 2,
-      }).pipe(
-        // Failed queries can hide other IPv4/IPv6 listeners on the port; fall back to configured URLs.
-        Effect.map(([tcp4, tcp6]) =>
-          exitedWithError(tcp4) || exitedWithError(tcp6)
-            ? null
-            : parseWindowsListenerOutput(`${tcp4.stdout}\n${tcp6.stdout}`, terminalOwners),
+      const listeners = yield* WindowsTcpListeners.queryWindowsTcpListeners(
+        processRunner,
+        "netstat.exe",
+      ).pipe(
+        Effect.map((snapshot) =>
+          snapshot === null ? null : discoveredWindowsListeners(snapshot, terminalOwners),
         ),
         Effect.catchTags({
           ProcessSpawnError: recoverWindowsProbeFailure,
diff --git a/apps/server/src/process/windowsTcpListeners.ts b/apps/server/src/process/windowsTcpListeners.ts
new file mode 100644
index 0000000000000..789915fa4b193
--- /dev/null
+++ b/apps/server/src/process/windowsTcpListeners.ts
@@ -0,0 +1,61 @@
+import { LSOF_LOCAL_HOST_TOKENS } from "@t3tools/shared/preview";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+
+import type * as ProcessRunner from "../processRunner.ts";
+
+const NETSTAT_TIMEOUT = Duration.seconds(5);
+/** `netstat -ano` lists every connection, not just listeners; ~80 bytes per row, sized for ~200k rows. */
+const NETSTAT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
+
+export interface WindowsTcpListener {
+  readonly port: number;
+  readonly pid: number | null;
+}
+
+const parseWindowsTcpListenerLine = (line: string): WindowsTcpListener | null => {
+  // Foreign port `:0` identifies a listening TCP socket regardless of Windows locale.
+  const fields = line.trim().split(/\s+/);
+  if (fields.length < 4 || fields[0]?.toUpperCase() !== "TCP") return null;
+  const localEndpoint = fields[1] ?? "";
+  const foreignEndpoint = fields[2] ?? "";
+  if (!foreignEndpoint.endsWith(":0")) return null;
+  const lastColon = localEndpoint.lastIndexOf(":");
+  if (lastColon <= 0) return null;
+  const host = localEndpoint.slice(0, lastColon);
+  if (!LSOF_LOCAL_HOST_TOKENS.has(host) && host !== "::") return null;
+  const port = Number(localEndpoint.slice(lastColon + 1));
+  if (!Number.isInteger(port) || port <= 0 || port >= 65536) return null;
+  const pid = Number(fields.at(-1));
+  return { port, pid: Number.isInteger(pid) && pid > 0 ? pid : null };
+};
+
+const parseWindowsTcpListeners = (raw: string): ReadonlyArray<WindowsTcpListener> =>
+  raw.split(/\r?\n/g).flatMap((line) => {
+    const listener = parseWindowsTcpListenerLine(line);
+    return listener === null ? [] : [listener];
+  });
+
+const exitedWithError = (result: ProcessRunner.ProcessRunOutput): boolean =>
+  result.code !== null && result.code !== 0;
+
+/** Resolves to `null` when either query exits nonzero. */
+export const queryWindowsTcpListeners = Effect.fn("windowsTcpListeners.query")(function* (
+  processRunner: ProcessRunner.ProcessRunner["Service"],
+  netstatCommand: string,
+) {
+  const runNetstat = (protocol: "tcp" | "tcpv6") =>
+    processRunner.run({
+      command: netstatCommand,
+      args: ["-ano", "-p", protocol],
+      timeout: NETSTAT_TIMEOUT,
+      maxOutputBytes: NETSTAT_MAX_OUTPUT_BYTES,
+    });
+  const [tcp4, tcp6] = yield* Effect.all([runNetstat("tcp"), runNetstat("tcpv6")], {
+    concurrency: 2,
+  });
+  // One failed query leaves a partial snapshot that could hide another process sharing a
+  // port across IPv4/IPv6.
+  if (exitedWithError(tcp4) || exitedWithError(tcp6)) return null;
+  return parseWindowsTcpListeners(`${tcp4.stdout}\n${tcp6.stdout}`);
+});

From d61058debf93bc9d691a19001c9f35276d015e0d Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Tue, 3 Nov 2026 23:07:15 +0000
Subject: [PATCH 064/167] perf(web): reuse repeated inline skill lookups
 (#29008)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/shared/src/inlineSkills.test.ts | 25 +++++++++++++++++++++++-
 packages/shared/src/inlineSkills.ts      |  9 ++++++++-
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/packages/shared/src/inlineSkills.test.ts b/packages/shared/src/inlineSkills.test.ts
index 9413148cee9e7..dde40480cab01 100644
--- a/packages/shared/src/inlineSkills.test.ts
+++ b/packages/shared/src/inlineSkills.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vite-plus/test";
-import { formatProviderSkillDisplayName } from "./inlineSkills.ts";
+import { formatProviderSkillDisplayName, matchInlineSkills } from "./inlineSkills.ts";
 
 describe("formatProviderSkillDisplayName", () => {
   it.each([
@@ -17,3 +17,26 @@ describe("formatProviderSkillDisplayName", () => {
     );
   });
 });
+
+describe("matchInlineSkills", () => {
+  it("preserves offsets, skill identity, first-name precedence, and unknown tokens", () => {
+    const first = { name: "design", displayName: "Design" };
+    const duplicate = { name: "design", displayName: "Other design" };
+    const namespaced = { name: "pdf:pdf" };
+    const matches = [
+      ...matchInlineSkills("Use $design then $missing and $pdf:pdf, $pdf:pdf $design", [
+        first,
+        duplicate,
+        namespaced,
+      ]),
+    ];
+    expect(matches).toEqual([
+      { start: 4, end: 11, skill: first, rawText: "$design" },
+      { start: 40, end: 48, skill: namespaced, rawText: "$pdf:pdf" },
+      { start: 49, end: 56, skill: first, rawText: "$design" },
+    ]);
+    expect(matches[0]?.skill).toBe(first);
+    expect(matches[1]?.skill).toBe(namespaced);
+    expect(matches[2]?.skill).toBe(first);
+  });
+});
diff --git a/packages/shared/src/inlineSkills.ts b/packages/shared/src/inlineSkills.ts
index 7a8c05f4e2b5b..aacbc38cf65d2 100644
--- a/packages/shared/src/inlineSkills.ts
+++ b/packages/shared/src/inlineSkills.ts
@@ -15,9 +15,16 @@ export function* matchInlineSkills<Skill extends InlineSkill>(
   text: string,
   skills: readonly Skill[],
 ) {
+  const byName = new Map<string, Skill | undefined>();
   for (const match of text.matchAll(SKILL_TOKEN_REGEX)) {
     const name = match[2] ?? "";
-    const skill = skills.find((candidate) => candidate.name === name);
+    if (!byName.has(name)) {
+      byName.set(
+        name,
+        skills.find((candidate) => candidate.name === name),
+      );
+    }
+    const skill = byName.get(name);
     if (!skill) continue;
     const start = match.index + (match[1]?.length ?? 0);
     yield { start, end: match.index + match[0].length, skill, rawText: `$${name}` };

From 10cd1a5341b6d5c38a6d58a7e191e462c0da1260 Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 4 Nov 2026 04:37:41 +0530
Subject: [PATCH 065/167] fix(opencode): expand home-relative executable paths
 (#29326)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../src/server/driver.test.ts                 | 79 +++++++++++++++++++
 .../provider-opencode/src/server/driver.ts    | 10 ++-
 2 files changed, 87 insertions(+), 2 deletions(-)

diff --git a/packages/provider-opencode/src/server/driver.test.ts b/packages/provider-opencode/src/server/driver.test.ts
index 2281365ea23e8..665f4785459d9 100644
--- a/packages/provider-opencode/src/server/driver.test.ts
+++ b/packages/provider-opencode/src/server/driver.test.ts
@@ -18,6 +18,7 @@ import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Duration from "effect/Duration";
 import * as Fiber from "effect/Fiber";
+import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Logger from "effect/Logger";
 import * as References from "effect/References";
@@ -25,6 +26,7 @@ import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import * as ProviderLatestVersions from "@t3tools/provider-core/server/ProviderLatestVersions";
@@ -33,6 +35,7 @@ import * as McpProviderSessions from "@t3tools/provider-core/server/McpProviderS
 import * as ProviderEventLoggers from "@t3tools/provider-core/server/ProviderEventLoggers";
 import * as ProviderMaintenance from "@t3tools/provider-core/server/maintenanceResolver";
 import * as OpenCodeRuntime from "./OpenCodeRuntime.ts";
+import * as OpenCodeServerLedger from "./OpenCodeServerLedger.ts";
 import { OPENCODE_2_RESPONSES, replayOpenCodeServer } from "./probeResponses.fixture.ts";
 import { OpenCodeDriver, openCodeUpdateFor } from "./driver.ts";
 import * as TestProviderHost from "@t3tools/provider-testing/TestProviderHost";
@@ -78,6 +81,82 @@ const create = (config: Partial<OpenCodeSettings>, http: HttpClient.HttpClient)
 
 const noHttp = HttpClient.make(() => Effect.die("A local binary must not be probed over HTTP"));
 
+it.live("discovers models through a home-relative OpenCode wrapper", () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-opencode-home with spaces-" });
+    const binaryPath = NodePath.join(home, "opencode");
+    const scriptPath = NodePath.join(home, "opencode.cjs");
+    yield* fs.writeFileString(
+      scriptPath,
+      `if (process.argv.includes('--version')) {
+        console.log('1.18.32');
+      } else {
+        const server = require('node:http').createServer((req, res) => {
+          const route = new URL(req.url, 'http://localhost').pathname;
+          res.setHeader('content-type', 'application/json');
+          res.end(JSON.stringify(route === '/global/health'
+            ? { healthy: true, version: '1.18.32' }
+            : route === '/provider'
+              ? { connected: ['opencode'], default: {}, all: [{
+                  id: 'opencode', name: 'OpenCode', models: {
+                    'big-pickle': { id: 'big-pickle', name: 'Big Pickle' }
+                  }
+                }] }
+              : []));
+        });
+        server.listen(0, '127.0.0.1', () => {
+          console.log('opencode server listening on http://127.0.0.1:' + server.address().port);
+        });
+      }`,
+    );
+    const windows = (yield* HostProcess.Platform) === "win32";
+    const wrapperPath = windows ? `${binaryPath}.cmd` : binaryPath;
+    const node = yield* HostProcess.ExecutablePath;
+    yield* fs.writeFileString(
+      wrapperPath,
+      windows
+        ? `@echo off\r\n"${node}" "${scriptPath}" %*\r\n`
+        : `#!/bin/sh\nexec "${node}" "${scriptPath}" "$@"\n`,
+    );
+    if (!windows) yield* fs.chmod(wrapperPath, 0o755);
+
+    const instance = yield* OpenCodeDriver.create({
+      instanceId: ProviderInstanceId.make("opencode-home"),
+      displayName: undefined,
+      environment: [],
+      enabled: true,
+      config: {
+        ...OpenCodeDriver.defaultConfig(),
+        binaryPath: windows ? "~/opencode.cmd" : "~/opencode",
+      },
+    }).pipe(Effect.provideService(HostProcess.HomeDirectory, home));
+    const snapshot = yield* instance.snapshot.refresh;
+    assert.strictEqual(snapshot.status, "ready");
+    assert.strictEqual(snapshot.version, "1.18.32");
+    assert.isTrue(snapshot.models.some((model) => model.slug === "opencode/big-pickle"));
+  }).pipe(
+    Effect.scoped,
+    Effect.provide(
+      Layer.mergeAll(
+        IdAllocator.layer,
+        McpProviderSessions.layer,
+        ProviderLatestVersions.layer,
+        TestProviderHost.layer({ runBackgroundWork: false }),
+        Layer.succeed(
+          ProviderEventLoggers.ProviderEventLoggers,
+          ProviderEventLoggers.NoOpProviderEventLoggers,
+        ),
+        OpenCodeRuntime.layer.pipe(Layer.provide(OpenCodeServerLedger.layerTest)),
+      ).pipe(
+        Layer.provideMerge(
+          Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, FetchHttpClient.layer),
+        ),
+      ),
+    ),
+  ),
+);
+
 it.layer(layer)("OpenCodeDriver runtime selection", (it) => {
   it.effect("never starts a 1.x server for an OpenCode 2 instance", () =>
     Effect.gen(function* () {
diff --git a/packages/provider-opencode/src/server/driver.ts b/packages/provider-opencode/src/server/driver.ts
index 4f5f0f8d5b3e4..eb62d44b9aa94 100644
--- a/packages/provider-opencode/src/server/driver.ts
+++ b/packages/provider-opencode/src/server/driver.ts
@@ -16,6 +16,8 @@ import * as OpenCode2TextGeneration from "./v2/textGeneration.ts";
 import { makeOpenCodeTextGeneration } from "./textGeneration.ts";
 import * as ProviderLatestVersions from "@t3tools/provider-core/server/ProviderLatestVersions";
 import * as ProviderHost from "@t3tools/provider-core/server/ProviderHost";
+import { expandHomePath } from "@t3tools/provider-core/server/pathExpansion";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as OpenCodeAdapterV2 from "./adapter.ts";
 import * as OpenCode2AdapterV2 from "./v2/adapter.ts";
 import type * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
@@ -209,7 +211,11 @@ export const OpenCodeDriver: ProviderDriver<
       accentColor,
       continuationGroupKey: continuationIdentity.continuationKey,
     });
-    const effectiveConfig = { ...config, enabled } satisfies OpenCodeSettings;
+    const effectiveConfig = {
+      ...config,
+      enabled,
+      binaryPath: expandHomePath(config.binaryPath, yield* HostProcess.HomeDirectory),
+    } satisfies OpenCodeSettings;
     const runtimeProbe = yield* makeOpenCodeRuntimeProbe(
       probeOpenCodeRuntime(effectiveConfig, processEnv).pipe(
         Effect.provideService(HttpClient.HttpClient, httpClient),
@@ -254,7 +260,7 @@ export const OpenCodeDriver: ProviderDriver<
       accentColor,
       environment,
       enabled,
-      config,
+      config: effectiveConfig,
     }).pipe(
       Effect.mapError(
         (cause) =>

From 476a99c1b937d8150c89e440cdc0dd766f174827 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:07:59 +0000
Subject: [PATCH 066/167] fix(server): title regeneration works after a
 thread's worktree is cleaned up (#29606)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ThreadLaunchService.test.ts               |  7 ++-
 .../ThreadTitleRegenerationService.test.ts    | 61 ++++++++++++-------
 .../ThreadTitleRegenerationService.ts         |  9 ++-
 3 files changed, 54 insertions(+), 23 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts b/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
index ea2534241aed7..993ee5c3010f7 100644
--- a/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadLaunchService.test.ts
@@ -266,7 +266,12 @@ function makeHarness(options: HarnessOptions = {}) {
   });
   const layerTitleRegeneration = ThreadTitleRegeneration.layer.pipe(
     Layer.provide(
-      Layer.mergeAll(layerThreadManagement, layerProjectedProjects, layerExternalServices),
+      Layer.mergeAll(
+        layerThreadManagement,
+        layerProjectedProjects,
+        layerExternalServices,
+        NodeServices.layer,
+      ),
     ),
   );
   return {
diff --git a/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.test.ts b/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.test.ts
index 8f7de819f5718..c54e6e1f4815d 100644
--- a/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.test.ts
@@ -1,4 +1,5 @@
 import { assert, describe, it, vi } from "@effect/vitest";
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import {
   CommandId,
   ChatAttachmentId,
@@ -14,6 +15,7 @@ import {
 } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import { ATTACHMENT_ONLY_BOOTSTRAP_PROMPT } from "@t3tools/shared/composerContextReferences";
@@ -98,6 +100,7 @@ function makeHarness(
         layerProjectedProjects,
         Layer.mock(TextGeneration.TextGeneration)({ generateThreadTitle }),
         layerServerSettings,
+        NodeServices.layer,
       ),
     ),
   );
@@ -113,7 +116,11 @@ function makeHarness(
   };
 }
 
-function createThread(input: { readonly command: string; readonly thread: string }) {
+function createThread(input: {
+  readonly command: string;
+  readonly thread: string;
+  readonly worktreePath?: string;
+}) {
   return Effect.gen(function* () {
     const threads = yield* ThreadManagement.ThreadManagementService;
     const threadId = ThreadId.make(input.thread);
@@ -127,7 +134,7 @@ function createThread(input: { readonly command: string; readonly thread: string
       runtimeMode: "full-access",
       interactionMode: "default",
       branch: null,
-      worktreePath: null,
+      worktreePath: input.worktreePath ?? null,
       createdBy: "user",
       creationSource: "web",
     });
@@ -391,31 +398,43 @@ describe("ThreadTitleRegenerationService", () => {
       const harness = makeHarness({
         generateTitle: () => Effect.succeed({ title: "Fresh title" }),
       });
+      const fs = yield* FileSystem.FileSystem;
+      const existingWorktree = yield* fs.makeTempDirectoryScoped({ prefix: "title-worktree-" });
       yield* Effect.gen(function* () {
         const threads = yield* ThreadManagement.ThreadManagementService;
         const titleRegeneration = yield* ThreadTitleRegeneration.ThreadTitleRegenerationService;
-        const threadId = yield* createThread({
-          command: "command:title:landing:create",
-          thread: "thread:title:landing",
-        });
-        yield* dispatchUserMessage({
-          command: "command:title:landing:message",
-          threadId,
-          text: "Investigate the flaky login test",
-        });
-        const requestId = yield* armRegeneration({ command: "command:title:landing:1", threadId });
+        const cases = [
+          { name: "removed", worktreePath: "/repo-worktrees/removed-by-cleanup", cwd: "/repo" },
+          { name: "existing", worktreePath: existingWorktree, cwd: existingWorktree },
+        ];
+        for (const [index, testCase] of cases.entries()) {
+          const threadId = yield* createThread({
+            command: `command:title:landing:${testCase.name}:create`,
+            thread: `thread:title:landing:${testCase.name}`,
+            worktreePath: testCase.worktreePath,
+          });
+          yield* dispatchUserMessage({
+            command: `command:title:landing:${testCase.name}:message`,
+            threadId,
+            text: "Investigate the flaky login test",
+          });
+          const requestId = yield* armRegeneration({
+            command: `command:title:landing:${testCase.name}:1`,
+            threadId,
+          });
 
-        yield* titleRegeneration.execute({ threadId, requestId, kind: { type: "regenerate" } });
+          yield* titleRegeneration.execute({ threadId, requestId, kind: { type: "regenerate" } });
 
-        const call = harness.generateThreadTitle.mock.calls[0]?.[0];
-        assert.equal(call?.previousTitle, "Seed title");
-        assert.equal(call?.cwd, "/repo");
-        assert.include(call?.message, "USER:\nInvestigate the flaky login test");
-        const projection = yield* threads.getThreadProjection(threadId);
-        assert.equal(projection.thread.title, "Fresh title");
-        assert.isNotOk(projection.thread.titleRegeneration);
+          const call = harness.generateThreadTitle.mock.calls[index]?.[0];
+          assert.equal(call?.previousTitle, "Seed title");
+          assert.equal(call?.cwd, testCase.cwd);
+          assert.include(call?.message, "USER:\nInvestigate the flaky login test");
+          const projection = yield* threads.getThreadProjection(threadId);
+          assert.equal(projection.thread.title, "Fresh title");
+          assert.isNotOk(projection.thread.titleRegeneration);
+        }
       }).pipe(Effect.provide(harness.layer));
-    }),
+    }).pipe(Effect.provide(NodeServices.layer)),
   );
 
   it.effect("titles a fork's first message with the source history up to the fork point", () =>
diff --git a/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.ts b/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.ts
index 601b783675d0e..6c80def39059f 100644
--- a/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.ts
+++ b/apps/server/src/orchestration-v2/ThreadTitleRegenerationService.ts
@@ -13,6 +13,7 @@ import {
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
@@ -50,6 +51,7 @@ const make = Effect.gen(function* () {
   const projects = yield* ProjectStore.ProjectStoreV2;
   const serverSettings = yield* ServerSettings.ServerSettingsService;
   const textGeneration = yield* TextGeneration.TextGeneration;
+  const fileSystem = yield* FileSystem.FileSystem;
 
   const complete = (input: {
     readonly threadId: ThreadId;
@@ -160,8 +162,13 @@ const make = Effect.gen(function* () {
         yield* serverSettings.getSettings,
         projection.thread.projectId,
       ).settings;
+      // Storage cleanup removes worktrees but keeps the path; CLIs cannot spawn in a missing cwd.
+      const worktreePath = projection.thread.worktreePath;
+      const worktreeExists =
+        worktreePath !== null &&
+        (yield* fileSystem.exists(worktreePath).pipe(Effect.orElseSucceed(() => false)));
       const result = yield* textGeneration.generateThreadTitle({
-        cwd: projection.thread.worktreePath ?? project.value.workspaceRoot,
+        cwd: worktreeExists ? worktreePath : project.value.workspaceRoot,
         message: context.message,
         attachments: context.attachments,
         ...(input.kind.type === "regenerate" ? { previousTitle: projection.thread.title } : {}),

From b7add5a06d81061bb49b778d8e5420a89ff05383 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:08:21 +0000
Subject: [PATCH 067/167] fix(server): dev servers a Codex agent starts show
 under its thread (#29687)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/CodexAdapterV2.test.ts           | 61 +++++++++++++++++++
 .../Adapters/CodexAdapterV2.ts                |  9 ++-
 2 files changed, 69 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
index 3ea5a4cce154c..1199bf7738add 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
@@ -71,6 +71,7 @@ import * as ProviderReplayHarness from "../testkit/ProviderReplayHarness.ts";
 import * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
 import type * as ProviderContinuationRequests from "@t3tools/provider-core/server/ProviderContinuationRequests";
 import * as ModelManifest from "../../provider/ModelManifest.ts";
+import * as PortScanner from "../../preview/PortScanner.ts";
 import { resolveProviderCompatibility } from "../../provider/providerCompatibility.ts";
 import * as CodexAdapterV2 from "./CodexAdapterV2.ts";
 import { withCodexReplayChildMetadata } from "./CodexAdapterV2.testkit.ts";
@@ -886,6 +887,66 @@ describe("CodexAdapterV2 process exit", () => {
       ),
     ),
   );
+
+  it.effect("counts the app-server as a running agent until its session closes", () => {
+    let runningAgents = 0;
+    const factoryLayer = CodexAdapterV2.layerAppServerClientFactory.pipe(
+      Layer.provide(
+        Layer.mock(PortScanner.PortDiscovery)({
+          trackAgent: () => {
+            runningAgents += 1;
+            return () => {
+              runningAgents -= 1;
+            };
+          },
+        }),
+      ),
+      Layer.provide(
+        Layer.succeed(ProviderEventLoggers.ProviderEventLoggers, {
+          native: undefined,
+          canonical: undefined,
+        }),
+      ),
+      Layer.provide(
+        Layer.succeed(
+          ChildProcessSpawner.ChildProcessSpawner,
+          ChildProcessSpawner.make(() =>
+            Effect.succeed(
+              ChildProcessSpawner.makeHandle({
+                pid: ChildProcessSpawner.ProcessId(999_999_999),
+                exitCode: Effect.never,
+                isRunning: Effect.succeed(true),
+                kill: () => Effect.void,
+                unref: Effect.succeed(Effect.void),
+                stdin: Sink.drain,
+                stdout: Stream.never,
+                stderr: Stream.empty,
+                all: Stream.empty,
+                getInputFd: () => Sink.drain,
+                getOutputFd: () => Stream.empty,
+              }),
+            ),
+          ),
+        ),
+      ),
+    );
+    return Effect.gen(function* () {
+      const factory = yield* CodexAdapterV2.CodexAppServerClientFactory;
+      yield* Effect.scoped(
+        factory
+          .open({
+            instanceId: CodexAdapterV2.CODEX_DEFAULT_INSTANCE_ID,
+            threadId: ThreadId.make("thread-codex-agent"),
+            providerSessionId: ProviderSessionId.make("session-codex-agent"),
+            runtimePolicy: CODEX_TEST_RUNTIME_POLICY,
+            settings: DEFAULT_CODEX_SETTINGS,
+            environment: {},
+          })
+          .pipe(Effect.tap(() => Effect.sync(() => assert.equal(runningAgents, 1)))),
+      );
+      assert.equal(runningAgents, 0);
+    }).pipe(Effect.provide(factoryLayer));
+  });
 });
 
 describe("CodexAdapterV2 session initialize", () => {
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
index 78e14a0b9fc3a..83a5040059a2f 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
@@ -1557,13 +1557,16 @@ function isSensitiveCodexProtocolKey(key: string): boolean {
 export const layerAppServerClientFactory: Layer.Layer<
   CodexAppServerClientFactory,
   never,
-  ChildProcessSpawner.ChildProcessSpawner | ProviderEventLoggers.ProviderEventLoggers
+  | ChildProcessSpawner.ChildProcessSpawner
+  | PortScanner.PortDiscovery
+  | ProviderEventLoggers.ProviderEventLoggers
 > = Layer.effect(
   CodexAppServerClientFactory,
   Effect.gen(function* () {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const { native: nativeEventLogger } = yield* ProviderEventLoggers.ProviderEventLoggers;
     const agentScope = yield* AgentScope;
+    const portDiscovery = yield* PortScanner.PortDiscovery;
 
     return CodexAppServerClientFactory.of({
       open: Effect.fn("CodexAdapterV2.open")(function* (input) {
@@ -1591,6 +1594,10 @@ export const layerAppServerClientFactory: Layer.Layer<
               }),
           ),
         );
+        // Its shells carry each thread's T3CODE_THREAD_ID, so port discovery reads listeners' threads.
+        yield* Effect.acquireRelease(Effect.sync(portDiscovery.trackAgent), (release) =>
+          Effect.sync(release),
+        );
         const protocolLogger = makeCodexAppServerProtocolLogger({
           nativeEventLogger,
           threadId: input.threadId,

From 8ee7cf9a324e17832250feaa51be2b22a86a4a96 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:08:38 +0000
Subject: [PATCH 068/167] fix(server): status no longer fetches a remote named
 after a local tracked branch (#29670)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 30 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      | 22 ++++++++++----
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 7c9e764f441b3..80d89ca19d4ee 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -1516,6 +1516,36 @@ it.effect("retries a fetch that lost a ref update to another Git process", () =>
   ),
 );
 
+it.effect("does not fetch for status when the branch tracks a local branch", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const fetches: Array<ReadonlyArray<string>> = [];
+      const spawner = ChildProcessSpawner.make((command) => {
+        if (ChildProcess.isStandardCommand(command) && command.args.includes("fetch")) {
+          fetches.push(command.args.map(String));
+        }
+        return delegate.spawn(command);
+      });
+      const driver = yield* makeGitVcsDriverCore().pipe(
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+      );
+      const cwd = yield* makeTmpDir();
+      const remote = yield* makeTmpDir("git-vcs-driver-remote-");
+      yield* initRepoWithCommit(cwd);
+      yield* git(remote, ["init", "--bare"]);
+      yield* git(cwd, ["remote", "add", "feature", remote]);
+      yield* git(cwd, ["branch", "feature/base"]);
+      yield* git(cwd, ["checkout", "-b", "stacked", "--track", "feature/base"]);
+
+      const status = yield* driver.statusDetailsRemote(cwd);
+
+      assert.equal(status.upstreamRef, "feature/base");
+      assert.deepStrictEqual(fetches, []);
+    }),
+  ).pipe(Effect.provide(layerTest)),
+);
+
 it.effect("lets a worktree checkout that is still working run past five minutes", () =>
   Effect.gen(function* () {
     const checkoutStarted = yield* Deferred.make<void>();
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index f8b59f389567b..a1fd6e235cc0f 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -1652,15 +1652,25 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
   const refreshStatusUpstreamIfStale = Effect.fn("refreshStatusUpstreamIfStale")(function* (
     cwd: string,
   ) {
-    const upstream = yield* resolveCurrentUpstream(cwd);
-    if (!upstream) return;
+    const headRef = yield* runGitStdout(
+      "GitVcsDriver.refreshStatusUpstreamIfStale.headRef",
+      cwd,
+      ["symbolic-ref", "--quiet", "HEAD"],
+      true,
+    ).pipe(Effect.map((stdout) => stdout.trim()));
+    if (headRef.length === 0) return;
+    const remoteName = yield* runGitStdout(
+      "GitVcsDriver.refreshStatusUpstreamIfStale.upstreamRemote",
+      cwd,
+      ["for-each-ref", "--format=%(upstream:remotename)", headRef],
+      true,
+    ).pipe(Effect.map((stdout) => stdout.trim()));
+    // Empty means no upstream; `.` means the upstream is a local branch.
+    if (remoteName.length === 0 || remoteName === ".") return;
     const gitCommonDir = yield* resolveGitCommonDir(cwd);
     yield* Cache.get(
       statusRemoteRefreshCache,
-      new StatusRemoteRefreshCacheKey({
-        gitCommonDir,
-        remoteName: upstream.remoteName,
-      }),
+      new StatusRemoteRefreshCacheKey({ gitCommonDir, remoteName }),
     ).pipe(Effect.ignore);
   });
 

From 5bdc2afc230370ee225b75c21671f26e2560cdc2 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:08:55 +0000
Subject: [PATCH 069/167] fix(server): preview snapshots no longer cut an emoji
 in half (#29600)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/mcp/McpHttpServer.test.ts | 10 ++++++----
 apps/server/src/mcp/McpHttpServer.ts      |  8 ++++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/apps/server/src/mcp/McpHttpServer.test.ts b/apps/server/src/mcp/McpHttpServer.test.ts
index c3ba3db1c028a..e3622194ec40f 100644
--- a/apps/server/src/mcp/McpHttpServer.test.ts
+++ b/apps/server/src/mcp/McpHttpServer.test.ts
@@ -692,9 +692,9 @@ it.effect("bounds the snapshot text even when nothing but logs and the title are
     Effect.gen(function* () {
       const oversized = {
         ...snapshotResult,
-        title: "t".repeat(70_000),
+        title: `t${"😀".repeat(35_000)}`,
         interactiveElements: [],
-        consoleEntries: [{ level: "log", text: "x".repeat(70_000), timestamp: "t" }],
+        consoleEntries: [{ level: "log", text: `x${"😀".repeat(35_000)}`, timestamp: "t" }],
       };
       yield* serveSnapshots("mcp-bounded-logs-client", oversized);
 
@@ -709,8 +709,10 @@ it.effect("bounds the snapshot text even when nothing but logs and the title are
         readonly title: string;
         readonly consoleEntries: ReadonlyArray<{ readonly text: string }>;
       };
-      expect(parsed.title.length).toBe(2_049);
-      expect(parsed.consoleEntries[0]?.text.length).toBe(501);
+      expect(parsed.title.isWellFormed()).toBe(true);
+      expect(parsed.title.length).toBe(2_048);
+      expect(parsed.consoleEntries[0]?.text.isWellFormed()).toBe(true);
+      expect(parsed.consoleEntries[0]?.text.length).toBe(500);
       const notice = snapshot.content[2];
       const noticeText = notice?.type === "text" ? notice.text : "";
       expect(noticeText).toContain("url or title after 2048 characters");
diff --git a/apps/server/src/mcp/McpHttpServer.ts b/apps/server/src/mcp/McpHttpServer.ts
index 2ef080a7ef7e4..9bc3b9da43d94 100644
--- a/apps/server/src/mcp/McpHttpServer.ts
+++ b/apps/server/src/mcp/McpHttpServer.ts
@@ -258,8 +258,12 @@ const MAX_SNAPSHOT_IDENTIFIER_CHARS = 2_048;
 
 const encodeJsonText = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
 const utf8Length = (text: string) => Buffer.byteLength(text, "utf8");
-const cutText = (text: string, max: number) =>
-  text.length > max ? `${text.slice(0, max)}…` : text;
+const cutText = (text: string, max: number) => {
+  if (text.length <= max) return text;
+  // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+  const last = text.charCodeAt(max - 1);
+  return `${text.slice(0, last >= 0xd800 && last <= 0xdbff ? max - 1 : max)}…`;
+};
 
 const cutEntryStrings = <A>(entry: A): A =>
   typeof entry === "object" && entry !== null

From bbaa535fa4d7c0aa6a35a051d1ff3025c3a9a2be Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:09:12 +0000
Subject: [PATCH 070/167] fix(server): restart notes no longer split an emoji
 in a long background task label (#29647)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/orchestration-v2/RestartBackgroundNote.test.ts     | 7 +++++++
 apps/server/src/orchestration-v2/RestartBackgroundNote.ts  | 6 +++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/RestartBackgroundNote.test.ts b/apps/server/src/orchestration-v2/RestartBackgroundNote.test.ts
index 24269dfeaff24..954ba2f31a3eb 100644
--- a/apps/server/src/orchestration-v2/RestartBackgroundNote.test.ts
+++ b/apps/server/src/orchestration-v2/RestartBackgroundNote.test.ts
@@ -113,6 +113,13 @@ it("names a lost subagent by the id the agent resumes it with", () => {
     parentTaskId: "a".repeat(400),
   }).label;
   assert.lengthOf(longId, 160);
+  assert.isTrue(
+    cancelledRosterTaskWork({
+      kind: "command",
+      taskId: "shell-1",
+      description: `${"d".repeat(158)}🚀 deploy`,
+    }).label.isWellFormed(),
+  );
   assert.isFalse(isAwaitedWork(cancelledRosterTaskWork({ kind: "command", taskId: "shell-2" })));
   assert.isTrue(
     isAwaitedWork(cancelledRosterTaskWork({ kind: "command", taskId: "tests", awaited: true })),
diff --git a/apps/server/src/orchestration-v2/RestartBackgroundNote.ts b/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
index 24afd61d6186a..c495290ad0813 100644
--- a/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
+++ b/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
@@ -17,7 +17,11 @@ function compactLabel(value: unknown, maxLength = MAX_LABEL_LENGTH): string | un
   if (typeof value !== "string") return undefined;
   const text = value.replaceAll(/\s+/g, " ").trim();
   if (text.length === 0) return undefined;
-  return text.length > maxLength ? `${text.slice(0, maxLength - 1)}…` : text;
+  if (text.length <= maxLength) return text;
+  // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+  const last = text.charCodeAt(maxLength - 2);
+  const end = last >= 0xd800 && last <= 0xdbff ? maxLength - 2 : maxLength - 1;
+  return `${text.slice(0, end)}…`;
 }
 
 /** A bounded label that keeps its id suffix whole whenever it fits. */

From 21e4f980ca375dee6ac6305c0c021e7f08e8deb4 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Tue, 3 Nov 2026 18:09:29 -0500
Subject: [PATCH 071/167] fix(acp): Always allow no longer cancels the turn
 when an agent only offers allow-once (#29463)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/AcpAdapterV2.test.ts             | 134 ++++++++++++++++++
 packages/provider-acp/src/server/adapter.ts   |  14 +-
 2 files changed, 141 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
index a58a83bffa349..41034b1134e6a 100644
--- a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
@@ -4525,6 +4525,140 @@ describe("AcpAdapterV2", () => {
     }).pipe(Effect.provide(layerTest), Effect.scoped),
   );
 
+  it.effect.each([
+    {
+      label: "answers Always allow with the agent's allow-always option",
+      options: [
+        { optionId: "allow-once", name: "Allow once", kind: "allow_once" },
+        { optionId: "allow-always", name: "Always allow", kind: "allow_always" },
+        { optionId: "reject-once", name: "Reject", kind: "reject_once" },
+      ],
+      optionId: "allow-always",
+    },
+    {
+      label: "answers Always allow with allow-once when the agent offers no allow-always option",
+      options: [
+        { optionId: "allow-once", name: "Allow once", kind: "allow_once" },
+        { optionId: "reject-once", name: "Reject", kind: "reject_once" },
+      ],
+      optionId: "allow-once",
+    },
+  ] as const)("$label", ({ options, optionId }) =>
+    Effect.gen(function* () {
+      const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const path = yield* Path.Path;
+      const selfInvocation = yield* resolveSelfInvocation();
+      const mockAgentPath = yield* path.fromFileUrl(
+        new URL("../../../scripts/acp-mock-agent.ts", import.meta.url),
+      );
+      type RuntimeService = AcpSessionRuntime.AcpSessionRuntime["Service"];
+      let requestPermission: Parameters<RuntimeService["handleRequestPermission"]>[0] | undefined;
+      let runtimeInput: AcpAdapterV2RuntimeInput | undefined;
+      const makeRuntime = makeMockRuntime({
+        childProcessSpawner,
+        mockAgentPath,
+        environment: { T3_ACP_HANG_PROMPT_FOREVER: "1" },
+        wrapRuntime: (runtime) => ({
+          ...runtime,
+          handleRequestPermission: (handler) =>
+            Effect.sync(() => {
+              requestPermission = handler;
+            }).pipe(Effect.andThen(runtime.handleRequestPermission(handler))),
+        }),
+      });
+      const instanceId = ProviderInstanceId.make("acp-test-always-allow");
+      const adapter = yield* makeAcpAdapterV2({
+        instanceId,
+        flavor: {
+          driver: ACP_TEST_DRIVER,
+          capabilities: AcpProviderCapabilitiesV2,
+          interruptPromptOnCancel: true,
+          makeRuntime: (input) =>
+            Effect.sync(() => {
+              runtimeInput = input;
+            }).pipe(Effect.andThen(makeRuntime(input))),
+        },
+        selfInvocation,
+        clientTerminals: {},
+      });
+      const threadId = ThreadId.make("thread-acp-always-allow");
+      const runtimePolicy = ProviderAdapter.ProviderAdapterV2RuntimePolicy.make({
+        runtimeMode: "approval-required",
+        interactionMode: "default",
+        cwd: process.cwd(),
+      });
+      const modelSelection = { instanceId, model: "default" } as const;
+      const runtime = yield* adapter.openSession({
+        threadId,
+        providerSessionId: ProviderSessionId.make("provider-session-acp-always-allow"),
+        modelSelection,
+        runtimePolicy,
+      });
+      const providerThread = yield* runtime.ensureThread({
+        threadId,
+        modelSelection,
+        runtimePolicy,
+      });
+      const turnFiber = yield* runtime
+        .startTurn(
+          makeTurnInput({
+            threadId,
+            providerThread,
+            instanceId,
+            runtimePolicy,
+            now: yield* DateTime.now,
+          }),
+        )
+        .pipe(Effect.forkScoped);
+      if (requestPermission === undefined) {
+        return yield* Effect.die("ACP runtime must register a permission handler");
+      }
+
+      const permissionFiber = yield* requestPermission(
+        {
+          sessionId: "mock-session-1",
+          toolCall: { toolCallId: "always-allow-tool", title: "Run tests", kind: "execute" },
+          options,
+        },
+        { requestId: "always-allow-request", method: "session/request_permission" },
+      ).pipe(Effect.forkScoped);
+      const pending = Option.getOrThrow(
+        yield* runtime.events.pipe(
+          Stream.filter(
+            (event) =>
+              event.type === "runtime_request.updated" && event.runtimeRequest.status === "pending",
+          ),
+          Stream.runHead,
+        ),
+      );
+      if (
+        pending.type !== "runtime_request.updated" ||
+        pending.runtimeRequest.providerTurnId === null
+      ) {
+        return yield* Effect.die("Expected an ACP approval request");
+      }
+      const responseFiber = yield* runtime
+        .respondToRuntimeRequest({
+          requestId: pending.runtimeRequest.id,
+          decision: "acceptForSession",
+        })
+        .pipe(Effect.forkScoped);
+      const { outcome } = yield* Fiber.join(permissionFiber);
+      if (runtimeInput?.onOutgoingResponse === undefined) {
+        return yield* Effect.die("ACP runtime must expose native response acknowledgements");
+      }
+      yield* runtimeInput.onOutgoingResponse("always-allow-request");
+      yield* Fiber.join(responseFiber);
+
+      yield* runtime.interruptTurn({
+        providerThread,
+        providerTurnId: pending.runtimeRequest.providerTurnId,
+      });
+      yield* Fiber.join(turnFiber);
+      assert.deepEqual(outcome, { outcome: "selected", optionId });
+    }).pipe(Effect.provide(layerTest), Effect.scoped),
+  );
+
   it.effect("replaces the ACP session and clears conversation state on rollback", () =>
     Effect.gen(function* () {
       const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index 985f6c8ee9887..268dfbafa8d88 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -1256,13 +1256,13 @@ function selectPermissionOptionId(
   request: EffectAcpSchema.RequestPermissionRequest,
   decision: Exclude<ProviderApprovalDecision, "cancel">,
 ): string | undefined {
-  const kind =
-    decision === "acceptForSession"
-      ? "allow_always"
-      : decision === "accept"
-        ? "allow_once"
-        : "reject_once";
-  return request.options.find((option) => option.kind === kind)?.optionId.trim() || undefined;
+  const optionIdOfKind = (kind: EffectAcpSchema.PermissionOption["kind"]) =>
+    request.options.find((option) => option.kind === kind)?.optionId.trim() || undefined;
+  if (decision === "acceptForSession") {
+    // Agents may offer only allow_once, and answering "cancelled" would stop the turn the user approved.
+    return optionIdOfKind("allow_always") ?? optionIdOfKind("allow_once");
+  }
+  return optionIdOfKind(decision === "accept" ? "allow_once" : "reject_once");
 }
 
 // Prefer allow-once; allow-always can persist beyond the session.

From 9c8942480e84cf07edae0ea8eb554e44c9503f6d Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:10:53 +0000
Subject: [PATCH 072/167] fix(server): forking a Codex thread archived outside
 T3 Code no longer fails (#29618)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../Adapters/CodexAdapterV2.test.ts           | 78 +++++++++++++++++++
 .../Adapters/CodexAdapterV2.ts                | 38 +++++----
 2 files changed, 101 insertions(+), 15 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
index 1199bf7738add..9482bb5a3fe25 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
@@ -8244,6 +8244,84 @@ describe("CodexAdapterV2 post-settle continuation", () => {
       ),
   );
 
+  it.effect("unarchives an archived Codex source thread before forking it", () =>
+    Effect.gen(function* () {
+      const nativeThreadId = "archived-fork-source";
+      const forkThreadId = "archived-fork-target";
+      const forkParams = {
+        threadId: nativeThreadId,
+        lastTurnId: "native-turn-first",
+        config: CodexAdapterV2.CODEX_THREAD_CONFIG,
+      };
+      const exchange = (
+        id: number,
+        method: string,
+        params: unknown,
+        reply: { readonly result: unknown } | { readonly error: unknown },
+      ): Array<CodexReplay.CodexAppServerReplayEntry> => [
+        { type: "expect_outbound", label: method, frame: { id, method, params } },
+        { type: "emit_inbound", label: method, frame: { id, ...reply } },
+      ];
+      const transcript = makeCodexReplayTranscript({
+        scenario: "codex-archived-fork",
+        entries: [
+          ...codexReplayPreamble({
+            nativeThreadId,
+            nativeTurnId: "archived-fork-turn",
+            prompt: "unused",
+          }).slice(0, 5),
+          ...exchange(3, "thread/fork", forkParams, {
+            error: {
+              code: -32600,
+              message: `session ${nativeThreadId} is archived. Run \`codex unarchive ${nativeThreadId}\` to unarchive it first.`,
+            },
+          }),
+          ...exchange(
+            4,
+            "thread/unarchive",
+            { threadId: nativeThreadId },
+            { result: codexReplayThreadResult({ nativeThreadId, forkedFromId: null }) },
+          ),
+          ...exchange(5, "thread/fork", forkParams, {
+            result: codexReplayThreadResult({
+              nativeThreadId: forkThreadId,
+              forkedFromId: nativeThreadId,
+            }),
+          }),
+        ],
+      });
+      const harness = yield* makeCodexReplayHarness(transcript);
+      const now = yield* DateTime.now;
+      const firstTurn = codexReplaySourceTurn({
+        id: "provider-turn-first",
+        ordinal: 1,
+        nativeId: "native-turn-first",
+        providerThreadId: harness.providerThread.id,
+        now,
+      });
+
+      const forkedProviderThread = yield* harness.runtime.forkThread({
+        sourceProviderThread: harness.providerThread,
+        sourceProviderTurns: [firstTurn],
+        providerTurnId: firstTurn.id,
+        targetThreadId: ThreadId.make("thread-archived-fork-target"),
+      });
+
+      assert.equal(forkedProviderThread.nativeThreadRef?.nativeId, forkThreadId);
+      assert.equal(forkedProviderThread.forkedFrom?.providerTurnId, firstTurn.id);
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        Layer.mergeAll(
+          IdAllocator.layer,
+          McpProviderSessions.layer,
+          NodeServices.layer,
+          NodeCrypto.layer,
+        ),
+      ),
+    ),
+  );
+
   describe("native goals", () => {
     const nativeThreadId = "goal-thread";
     const objective = "Ship the feature";
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
index 83a5040059a2f..69fc35aa39b0d 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
@@ -7937,24 +7937,32 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
             function* (threadInput) {
               const threadId = yield* getNativeThreadId(threadInput.sourceProviderThread);
               const boundary = yield* resolveCodexForkBoundary(threadInput);
+              const fork = client.request("thread/fork", {
+                threadId,
+                ...(boundary.lastTurnId === undefined ? {} : { lastTurnId: boundary.lastTurnId }),
+                ...codexThreadRuntimeParams({
+                  threadId: threadInput.targetThreadId,
+                  mcpSession: yield* mcpSessions.read(threadInput.targetThreadId),
+                  ...(threadInput.modelSelection === undefined
+                    ? {}
+                    : { modelSelection: threadInput.modelSelection }),
+                  ...(threadInput.runtimePolicy === undefined
+                    ? {}
+                    : { runtimePolicy: threadInput.runtimePolicy }),
+                }),
+              });
               const response = yield* ensureInitialized.pipe(
                 Effect.andThen(
-                  client.request("thread/fork", {
-                    threadId,
-                    ...(boundary.lastTurnId === undefined
-                      ? {}
-                      : { lastTurnId: boundary.lastTurnId }),
-                    ...codexThreadRuntimeParams({
-                      threadId: threadInput.targetThreadId,
-                      mcpSession: yield* mcpSessions.read(threadInput.targetThreadId),
-                      ...(threadInput.modelSelection === undefined
-                        ? {}
-                        : { modelSelection: threadInput.modelSelection }),
-                      ...(threadInput.runtimePolicy === undefined
-                        ? {}
-                        : { runtimePolicy: threadInput.runtimePolicy }),
+                  fork.pipe(
+                    Effect.catchTags({
+                      CodexAppServerRequestError: (cause) =>
+                        /\bsession \S+ is archived\b|\bcodex unarchive\b/i.test(cause.errorMessage)
+                          ? client.raw
+                              .request("thread/unarchive", { threadId })
+                              .pipe(Effect.andThen(fork))
+                          : Effect.fail(cause),
                     }),
-                  }),
+                  ),
                 ),
                 Effect.mapError(
                   (cause) =>

From acad1d5a089875a52b710f2bf6558de7d96bf8de Mon Sep 17 00:00:00 2001
From: Hieu Le <78847613+hieu-lee@users.noreply.github.com>
Date: Wed, 4 Nov 2026 00:11:10 +0100
Subject: [PATCH 073/167] perf(shared): stop single-token message search at the
 best hit (#28930)

---
 packages/shared/src/paletteSearch.test.ts | 29 +++++++++++++++++++++++
 packages/shared/src/paletteSearch.ts      | 13 +++++++---
 2 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/packages/shared/src/paletteSearch.test.ts b/packages/shared/src/paletteSearch.test.ts
index 644a40912640a..d30b3189ee42c 100644
--- a/packages/shared/src/paletteSearch.test.ts
+++ b/packages/shared/src/paletteSearch.test.ts
@@ -661,6 +661,26 @@ describe("scoreMessageMatch", () => {
     expect(scoreMessageMatch("We trust the build", "rust")).toEqual({ quality: 0.3, offset: 4 });
     expect(scoreMessageMatch("Rust and trust", "rust")).toEqual({ quality: 1, offset: 0 });
     expect(scoreMessageMatch("Use the sidebar", '"sidebar"')).toEqual({ quality: 1, offset: 8 });
+    for (const [text, query, expected] of [
+      ["model mode mode", "mode", { quality: 1, offset: 6 }],
+      ["xmode model models", "mode", { quality: 0.8, offset: 6 }],
+      ["model models", "mode", { quality: 0.8, offset: 0 }],
+      ["xmode ymode", "mode", { quality: 0.3, offset: 1 }],
+      ["mode mode", "mode", { quality: 1, offset: 0 }],
+      ["fts fts", "fts", { quality: 1, offset: 0 }],
+      ["the theme", "he", null],
+      ["he theme", "he", { quality: 1, offset: 0 }],
+      ["notes", "", { quality: 1, offset: 0 }],
+      ["", "notes", null],
+      ["same same same", "same same", { quality: 1.25, offset: 0 }],
+      ["7cafe52bb8 cafe cafe", "cafe", { quality: 1, offset: 11 }],
+      ["7cafe52bb8 7cafe52bb8", "7cafe52", { quality: 1, offset: 0 }],
+      ["明天部署部署到生产环境", "部署", { quality: 1, offset: 2 }],
+      ["gannet’s gannet's", "gannet's", { quality: 1, offset: 9 }],
+      ["gannet's gannet’s", "gannet’s", { quality: 1, offset: 0 }],
+    ] as const) {
+      expect(scoreMessageMatch(text, query), `${query} in ${text}`).toEqual(expected);
+    }
     // Words written together as typed rank above the same words apart, and
     // the snippet starts where they are together.
     const together = "Run the tests, then vp run dev to check";
@@ -736,5 +756,14 @@ describe("scoreMessageMatch", () => {
     expect(scoreMessageMatch("İ Enable fts and model", "fts")).toMatchObject({ offset: 9 });
     expect(scoreMessageMatch("İ Enable fts and model", "model")?.quality).toBe(1);
     expect(scoreMessageMatch("Trip to İstanbul", "İstanbul")).toEqual({ quality: 1, offset: 8 });
+    for (const [text, query, expected] of [
+      ["İ cafeteria Café CAFÉ", "cafe", { quality: 1, offset: 12 }],
+      ["Café cafe", "cafe", { quality: 1, offset: 5 }],
+      ["İ Café Café", "café", { quality: 1, offset: 2 }],
+      ["İ Résumé Résumé", "resume", { quality: 1, offset: 2 }],
+      ["İ résuméprefix résumé", "resume", { quality: 1, offset: 15 }],
+    ] as const) {
+      expect(scoreMessageMatch(text, query), `${query} in ${text}`).toEqual(expected);
+    }
   });
 });
diff --git a/packages/shared/src/paletteSearch.ts b/packages/shared/src/paletteSearch.ts
index 8594100a27e70..af7d4ca48a0cf 100644
--- a/packages/shared/src/paletteSearch.ts
+++ b/packages/shared/src/paletteSearch.ts
@@ -535,6 +535,7 @@ function findMessageToken(
   text: string,
   folded: string,
   token: string,
+  firstOnly: boolean,
 ): { readonly at: ReadonlyArray<number>; readonly quality: number } | null {
   let quality = 0;
   let at: number[] = [];
@@ -559,7 +560,8 @@ function findMessageToken(
     if (found > quality) {
       quality = found;
       at = [index];
-    } else if (found === quality) {
+      if (firstOnly && quality === 1) return { at, quality };
+    } else if (!firstOnly && found === quality) {
       at.push(index);
     }
   }
@@ -611,10 +613,15 @@ export function messageMatcher(query: string): (text: string) => MessageMatch |
     let quality = 1;
     const positions: Array<ReadonlyArray<number>> = [];
     for (const { token, folded: foldedToken, nonAscii, mustStartWord, grades } of tokens) {
-      let found = findMessageToken(text, plain, token);
+      let found = findMessageToken(text, plain, token, tokens.length === 1);
       // Accents typed or left out: "cafe" finds "Café", also after "cafeteria".
       if (found?.quality !== 1 && foldedToken.length > 0 && (nonAscii || NON_ASCII.test(text))) {
-        found = findMessageToken(text, (folded ??= foldInPlace(text)), foldedToken);
+        found = findMessageToken(
+          text,
+          (folded ??= foldInPlace(text)),
+          foldedToken,
+          tokens.length === 1,
+        );
       }
       if (found === null) return null;
       if (found.quality === MID_WORD && mustStartWord) return null;

From c185d780fc3f5ad29695985f2f7f99428b414a73 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:11:27 +0000
Subject: [PATCH 074/167] fix(preview): a dropped stream withdraws its stale
 file picker (#29655)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/preview/serverBrowserStream.test.ts   | 25 +++++++++++++++++++
 .../src/preview/serverBrowserStream.ts        |  9 +++++++
 2 files changed, 34 insertions(+)

diff --git a/packages/client-runtime/src/preview/serverBrowserStream.test.ts b/packages/client-runtime/src/preview/serverBrowserStream.test.ts
index cfde00363a005..7b749acea4402 100644
--- a/packages/client-runtime/src/preview/serverBrowserStream.test.ts
+++ b/packages/client-runtime/src/preview/serverBrowserStream.test.ts
@@ -107,6 +107,31 @@ describe("preview stream control", () => {
     expect(client.send({ type: "dialog", accept: false })).toBe(false);
     client.stop();
   });
+
+  it("withdraws an offered file picker when the stream drops or stops", () => {
+    const onFileChooser = vi.fn();
+    const events = {
+      onFrame: vi.fn(),
+      onFileChooser,
+      onViewport: vi.fn(),
+      onConnectedChange: vi.fn(),
+      onUnauthorized: vi.fn(),
+    };
+    const client = createPreviewStreamClient(target, events);
+    const socket = FakeSocket.current;
+    socket.dispatchEvent(new Event("open"));
+    socket.message(JSON.stringify({ type: "fileChooser", id: "c1", multiple: false, accept: "" }));
+    socket.dispatchEvent(Object.assign(new Event("close"), { code: 1012 }));
+    expect(onFileChooser).toHaveBeenLastCalledWith(null);
+    client.stop();
+
+    const restarted = createPreviewStreamClient(target, events);
+    FakeSocket.current.message(
+      JSON.stringify({ type: "fileChooser", id: "c2", multiple: false, accept: "" }),
+    );
+    restarted.stop();
+    expect(onFileChooser).toHaveBeenLastCalledWith(null);
+  });
 });
 
 describe("preview stream downloads", () => {
diff --git a/packages/client-runtime/src/preview/serverBrowserStream.ts b/packages/client-runtime/src/preview/serverBrowserStream.ts
index b71fff335f881..617c1d18424f3 100644
--- a/packages/client-runtime/src/preview/serverBrowserStream.ts
+++ b/packages/client-runtime/src/preview/serverBrowserStream.ts
@@ -224,6 +224,13 @@ export function createPreviewStreamClient(
   let control: PreviewStreamControl | null = null;
   let fileChooser: string | null = null;
 
+  // The server re-offers a picker still open, under a new id, when this viewer reattaches.
+  const withdrawFileChooser = () => {
+    if (fileChooser === null) return;
+    fileChooser = null;
+    events.onFileChooser?.(null);
+  };
+
   const connect = () => {
     if (stopped) return;
     const ws = new WebSocket(url);
@@ -346,6 +353,7 @@ export function createPreviewStreamClient(
       if (socket !== ws) return;
       socket = null;
       control = null;
+      withdrawFileChooser();
       if (opened) events.onConnectedChange(false);
       if (stopped) return;
       if (event.code === 4404) {
@@ -385,6 +393,7 @@ export function createPreviewStreamClient(
       const ws = socket;
       socket = null;
       control = null;
+      withdrawFileChooser();
       ws?.close();
     },
   };

From b156a7d7f3190bf6921a91dc9b715ca3d0e600c7 Mon Sep 17 00:00:00 2001
From: Trevor <trevoedwards@users.noreply.github.com>
Date: Tue, 3 Nov 2026 16:11:45 -0700
Subject: [PATCH 075/167] fix(provider-acp): ACP threads keep receiving events
 after a rollback (#28987)

Co-authored-by: Trevor Edwards <9443483+trevoedwards@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/Adapters/AcpAdapterV2.test.ts  | 13 +++++++++++++
 packages/provider-acp/src/server/adapter.ts         | 10 ++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
index 41034b1134e6a..3efa9047d5817 100644
--- a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
@@ -4680,10 +4680,16 @@ describe("AcpAdapterV2", () => {
         browserToolsAvailable: false,
       });
       const runtimeInputs: Array<AcpAdapterV2RuntimeInput> = [];
+      const nativeRuntimes: Array<AcpSessionRuntime.AcpSessionRuntime["Service"]> = [];
+      let sessionEventCount = 0;
       const makeRuntime = makeMockRuntime({
         childProcessSpawner,
         mockAgentPath,
         environment: { T3_ACP_PROMPT_DELAY_MS: "100" },
+        wrapRuntime: (nativeRuntime) => {
+          nativeRuntimes.push(nativeRuntime);
+          return nativeRuntime;
+        },
       });
       const adapter = yield* makeAcpAdapterV2({
         instanceId,
@@ -4694,6 +4700,10 @@ describe("AcpAdapterV2", () => {
             Effect.sync(() => runtimeInputs.push(runtimeInput)).pipe(
               Effect.andThen(makeRuntime(runtimeInput)),
             ),
+          onSessionEvent: () =>
+            Effect.sync(() => {
+              sessionEventCount += 1;
+            }),
         },
         selfInvocation,
       });
@@ -4788,6 +4798,7 @@ describe("AcpAdapterV2", () => {
       });
       assert.deepEqual(snapshotAfterRollback.providerTurns, []);
       assert.deepEqual(snapshotAfterRollback.messages, []);
+      const sessionEventsBeforeSecondTurn = sessionEventCount;
 
       yield* runtime.startTurn(
         makeTurnInput({
@@ -4814,6 +4825,8 @@ describe("AcpAdapterV2", () => {
         }
       }
       assert.equal(secondStatus, "completed");
+      yield* nativeRuntimes[1]!.drainEvents;
+      assert.isAbove(sessionEventCount, sessionEventsBeforeSecondTurn);
     }).pipe(Effect.provide(layerTest), Effect.scoped),
   );
 
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index 268dfbafa8d88..ad0b716f37ce2 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -6300,6 +6300,7 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
             readonly sessionUpdates?: boolean;
             readonly terminals?: boolean;
             readonly mcp?: boolean;
+            readonly scope?: Scope.Scope;
           } = {},
         ) {
           yield* targetRuntime.getEvents().pipe(
@@ -6312,7 +6313,7 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                 flavor.onSessionEvent?.(event) ?? Effect.void,
               ).pipe(Effect.asVoid);
             }),
-            Effect.forkIn(runtimeScope ?? sessionScope),
+            Effect.forkIn(handlerOptions.scope ?? runtimeScope ?? sessionScope),
           );
           const requestUserInput = (
             request: AcpAdapterV2UserInputRequest,
@@ -6880,7 +6881,12 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                   yield* wireAcpRuntimeHandlers(
                     replacementExit.value.replacementRuntime,
                     replacementGeneration,
-                    { sessionUpdates: false, terminals: false, mcp: false },
+                    {
+                      sessionUpdates: false,
+                      terminals: false,
+                      mcp: false,
+                      scope: replacementScope,
+                    },
                   );
                   const lifecycle = yield* Ref.modify(
                     candidateLifecycle,

From 2f8de8d7bf8b5e316f3e2a07fa6ce67c278eeeb4 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:12:02 +0000
Subject: [PATCH 076/167] perf(opencode): provider event logs skip per-token
 reply deltas (#29673)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/provider-opencode/src/server/adapter.test.ts | 7 +++++++
 packages/provider-opencode/src/server/adapter.ts      | 3 ++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/provider-opencode/src/server/adapter.test.ts b/packages/provider-opencode/src/server/adapter.test.ts
index 2ef7f2c5bbd02..5313eb72a9d8f 100644
--- a/packages/provider-opencode/src/server/adapter.test.ts
+++ b/packages/provider-opencode/src/server/adapter.test.ts
@@ -2507,7 +2507,14 @@ describe("OpenCodeAdapterV2", () => {
         method: "session.prompt",
         payload: { prompt: secret, nested: { token: secret } },
       });
+      yield* logProtocolEvent({
+        direction: "incoming",
+        messageKind: "notification",
+        method: "message.part.delta",
+        payload: { type: "message.part.delta", properties: { delta: secret } },
+      });
 
+      assert.lengthOf(records, 1);
       const serialized = encodeUnknownJson(records);
       assert.notInclude(serialized, secret);
       assert.include(serialized, '"protocol":"opencode-sdk.sse"');
diff --git a/packages/provider-opencode/src/server/adapter.ts b/packages/provider-opencode/src/server/adapter.ts
index 271259631ea4c..b32528257944f 100644
--- a/packages/provider-opencode/src/server/adapter.ts
+++ b/packages/provider-opencode/src/server/adapter.ts
@@ -446,7 +446,8 @@ export function makeOpenCodeProtocolLogger(input: {
 }): (event: OpenCodeProtocolLogEvent) => Effect.Effect<void, never> {
   return (event) =>
     Effect.gen(function* () {
-      if (!input.nativeEventLogger) return;
+      // Per-token deltas; the part's final message.part.updated is still logged.
+      if (!input.nativeEventLogger || event.method === "message.part.delta") return;
       const observedAt = DateTime.formatIso(yield* DateTime.now);
       const method = structuralProtocolMethod(event.method);
       yield* input.nativeEventLogger.write(

From 300101f7e511a9a8e5ed71f69b776903b3aa9981 Mon Sep 17 00:00:00 2001
From: Johan Vaz <v.johan2234@gmail.com>
Date: Wed, 4 Nov 2026 07:12:19 +0800
Subject: [PATCH 077/167] fix(web): open files from Claude and ACP tool-call
 diffs (#29309)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/diffFileActions.test.ts | 54 +++++++++++++++++++---------
 apps/web/src/diffFileActions.ts      | 14 +++++++-
 2 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/apps/web/src/diffFileActions.test.ts b/apps/web/src/diffFileActions.test.ts
index b4fdb71f8d89a..f7faf72ef8bd3 100644
--- a/apps/web/src/diffFileActions.test.ts
+++ b/apps/web/src/diffFileActions.test.ts
@@ -69,23 +69,45 @@ describe("openDiffFilePrimaryAction", () => {
     ).toBe("index.ts");
   });
 
-  it.each(["backend/server.ts", "frontend2/app.ts", "frontend/../secret.ts", "C:secret.ts"])(
-    "does not open an out-of-project diff path: %s",
-    (filePath) => {
-      const openInEditor = vi.fn();
-
-      openDiffFilePrimaryAction({
-        threadRef: THREAD_REF,
-        filePath,
-        activeCwd: "/repo/frontend",
-        repositoryRoot: "/repo",
-        openInEditor,
-      });
-
+  it.each([
+    {
+      filePath: "/repo/frontend/src/index.ts",
+      workspaceRoot: "/repo/frontend",
+      expected: "src/index.ts",
+    },
+    { filePath: "c:\\Repo\\src\\index.ts", workspaceRoot: "C:\\repo", expected: "src/index.ts" },
+  ])(
+    "opens absolute diff paths inside the workspace: $filePath",
+    ({ filePath, workspaceRoot, expected }) => {
       expect(
-        selectThreadRightPanelState(useRightPanelStore.getState().byThreadKey, THREAD_REF),
-      ).toMatchObject({ isOpen: false });
-      expect(openInEditor).not.toHaveBeenCalled();
+        resolveDiffPathForWorkspace({ filePath, workspaceRoot, repositoryRoot: workspaceRoot }),
+      ).toBe(expected);
     },
   );
+
+  it.each([
+    "backend/server.ts",
+    "frontend2/app.ts",
+    "frontend/../secret.ts",
+    "C:secret.ts",
+    "/repo/backend/server.ts",
+    "/repo/frontend/../backend/server.ts",
+    "/repo/frontend",
+    "/etc/passwd",
+  ])("does not open an out-of-project diff path: %s", (filePath) => {
+    const openInEditor = vi.fn();
+
+    openDiffFilePrimaryAction({
+      threadRef: THREAD_REF,
+      filePath,
+      activeCwd: "/repo/frontend",
+      repositoryRoot: "/repo",
+      openInEditor,
+    });
+
+    expect(
+      selectThreadRightPanelState(useRightPanelStore.getState().byThreadKey, THREAD_REF),
+    ).toMatchObject({ isOpen: false });
+    expect(openInEditor).not.toHaveBeenCalled();
+  });
 });
diff --git a/apps/web/src/diffFileActions.ts b/apps/web/src/diffFileActions.ts
index 99baf13c94160..c6a3fa3d436fc 100644
--- a/apps/web/src/diffFileActions.ts
+++ b/apps/web/src/diffFileActions.ts
@@ -1,5 +1,10 @@
 import type { ScopedThreadRef } from "@t3tools/contracts";
-import { isWindowsAbsolutePath, normalizeProjectPathForComparison } from "@t3tools/shared/path";
+import {
+  isAbsolutePath,
+  isWindowsAbsolutePath,
+  normalizeProjectPathForComparison,
+  workspaceRelativeFilePath,
+} from "@t3tools/shared/path";
 
 import { useRightPanelStore } from "./rightPanelStore";
 import { resolvePathLinkTarget } from "@t3tools/shared/fileLinks";
@@ -52,6 +57,13 @@ export function resolveDiffPathForWorkspace(input: {
   readonly workspaceRoot: string | undefined;
   readonly repositoryRoot: string | undefined;
 }): string | null {
+  // Claude and ACP tool-call diffs name files by absolute path.
+  if (isAbsolutePath(input.filePath)) {
+    const relativePath = workspaceRelativeFilePath(input.filePath, input.workspaceRoot);
+    const segments = relativePath === null ? null : normalizedRelativePathSegments(relativePath);
+    return segments ? segments.join("/") : null;
+  }
+
   const fileSegments = normalizedRelativePathSegments(input.filePath);
   if (!fileSegments) return null;
 

From 04aed8f3eab6b2c44ef3f93eabeaa54276379112 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:12:36 +0000
Subject: [PATCH 078/167] fix(server): files tree labels ignored folders inside
 git submodules (#29650)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/workspace/WorkspaceEntries.test.ts    | 19 ++++++++++++
 apps/server/src/workspace/WorkspaceEntries.ts | 31 +++++++++++++++----
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/apps/server/src/workspace/WorkspaceEntries.test.ts b/apps/server/src/workspace/WorkspaceEntries.test.ts
index 154a260eea0f4..eedff4fc79c9a 100644
--- a/apps/server/src/workspace/WorkspaceEntries.test.ts
+++ b/apps/server/src/workspace/WorkspaceEntries.test.ts
@@ -108,6 +108,14 @@ it.layer(layerTest, { excludeTestServices: true })("WorkspaceEntries", (it) => {
         yield* writeTextFile(cwd, "node_modules/pkg/index.js");
         yield* writeTextFile(cwd, "src/index.ts");
         yield* fileSystem.makeDirectory(path.join(cwd, "empty"));
+        yield* git(cwd, ["init", "sub"]);
+        yield* writeTextFile(cwd, "sub/.gitignore", "dist/\n");
+        yield* writeTextFile(cwd, "sub/dist/out.js");
+        const gitlink = yield* git(cwd, ["hash-object", "tracked.txt"]);
+        yield* git(cwd, ["update-index", "--add", "--cacheinfo", `160000,${gitlink},sub`]);
+        // A nested clone that isn't a submodule keeps the outer repository's ignore rules.
+        yield* git(cwd, ["init", "node_modules/pkg"]);
+        yield* git(cwd, ["init", "sub/dist"]);
 
         const workspaceEntries = yield* WorkspaceEntries.WorkspaceEntries;
         const root = yield* workspaceEntries.list({ cwd, directoryPath: "" });
@@ -127,6 +135,17 @@ it.layer(layerTest, { excludeTestServices: true })("WorkspaceEntries", (it) => {
           entries: [{ path: "node_modules/pkg/index.js", kind: "file", ignored: true }],
           truncated: false,
         });
+        // Git refuses pathspecs inside a submodule from the outer repository.
+        expect((yield* workspaceEntries.list({ cwd, directoryPath: "sub" })).entries).toEqual(
+          expect.arrayContaining([
+            { path: "sub/.gitignore", kind: "file" },
+            { path: "sub/dist", kind: "directory", ignored: true },
+          ]),
+        );
+        expect(yield* workspaceEntries.list({ cwd, directoryPath: "sub/dist" })).toEqual({
+          entries: [{ path: "sub/dist/out.js", kind: "file", ignored: true }],
+          truncated: false,
+        });
         expect(yield* workspaceEntries.list({ cwd, directoryPath: "empty" })).toEqual({
           entries: [],
           truncated: false,
diff --git a/apps/server/src/workspace/WorkspaceEntries.ts b/apps/server/src/workspace/WorkspaceEntries.ts
index 0b853ccdaa437..d388170f93f5e 100644
--- a/apps/server/src/workspace/WorkspaceEntries.ts
+++ b/apps/server/src/workspace/WorkspaceEntries.ts
@@ -306,7 +306,7 @@ export const make = Effect.gen(function* () {
                   relativePath: directoryPath,
                 })
                 .pipe(Effect.mapError(toError));
-        const { entries, throughSymlink } = yield* Effect.tryPromise({
+        const { entries, throughSymlink, nestedGitRoots } = yield* Effect.tryPromise({
           try: async () => {
             const root = await NodeFSP.realpath(normalizedCwd);
             const directory = await NodeFSP.realpath(target.absolutePath);
@@ -378,7 +378,17 @@ export const make = Effect.gen(function* () {
                 )),
               );
             }
+            const nestedGitRoots: Array<string> = [];
+            const segments = target.relativePath.split("/").filter(Boolean);
+            for (let index = 1; index <= segments.length; index += 1) {
+              const candidate = segments.slice(0, index).join("/");
+              const dotGit = await NodeFSP.lstat(path.join(normalizedCwd, candidate, ".git")).catch(
+                () => null,
+              );
+              if (dotGit) nestedGitRoots.push(candidate);
+            }
             return {
+              nestedGitRoots,
               entries: children.flatMap((child, index): ProjectEntry[] => {
                 const kind = kinds[index];
                 if (kind === undefined) return [];
@@ -395,6 +405,8 @@ export const make = Effect.gen(function* () {
           },
           catch: toError,
         });
+        let gitRoot = "";
+        let gitPrefix = "";
         // stdin avoids argument limits; ignore classification is optional without git/repositories.
         const checkIgnore = (paths: ReadonlyArray<string>) =>
           vcsProcess
@@ -402,20 +414,27 @@ export const make = Effect.gen(function* () {
               operation: "WorkspaceEntries.list",
               command: "git",
               args: ["-c", "core.fsmonitor=false", "check-ignore", "-z", "--stdin"],
-              cwd: normalizedCwd,
-              stdin: `${paths.join("\0")}\0`,
+              cwd: path.join(normalizedCwd, gitRoot),
+              stdin: `${paths.map((entryPath) => entryPath.slice(gitPrefix.length)).join("\0")}\0`,
               allowNonZeroExit: true,
               timeoutMs: 10_000,
               maxOutputBytes: 16 * 1024 * 1024,
             })
             .pipe(Effect.orElseSucceed(() => undefined));
+        // Git refuses paths inside a submodule (128) but still answers for nested clones.
+        for (const nestedGitRoot of nestedGitRoots) {
+          if ((yield* checkIgnore([`${nestedGitRoot}/.git`]))?.exitCode !== 128) continue;
+          gitRoot = nestedGitRoot;
+          gitPrefix = `${gitRoot}/`;
+        }
+        const directoryGitPath = target.relativePath.slice(gitPrefix.length);
         // Check ignored folders once to avoid child index lookups; exit 0 guarantees no tracked descendants.
         // Symlinks and pathspec magic still need per-child checks.
         if (
           entries.length > IGNORE_CHECK_CHUNK_SIZE &&
-          target.relativePath !== "" &&
+          directoryGitPath !== "" &&
           !throughSymlink &&
-          !/^:|[*?[\\]/.test(target.relativePath) &&
+          !/^:|[*?[\\]/.test(directoryGitPath) &&
           (yield* checkIgnore([target.relativePath]))?.exitCode === 0
         ) {
           return {
@@ -429,7 +448,7 @@ export const make = Effect.gen(function* () {
             entries.slice(offset, offset + IGNORE_CHECK_CHUNK_SIZE).map((entry) => entry.path),
           );
           if (!result || (result.exitCode !== 0 && result.exitCode !== 1)) break;
-          for (const ignoredPath of result.stdout.split("\0")) ignored.add(ignoredPath);
+          for (const ignoredPath of result.stdout.split("\0")) ignored.add(gitPrefix + ignoredPath);
         }
         return {
           entries: entries.map((entry) =>

From eee8ed4f23b47379554da7d63f79542442bda537 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Tue, 3 Nov 2026 18:12:52 -0500
Subject: [PATCH 079/167] fix(server): server updates reclaim partial database
 backups left by killed updates (#29464)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/serviceLauncher.test.ts | 31 +++++++++++++++++++++++++
 apps/server/src/serviceLauncher.ts      | 12 ++++++++++
 2 files changed, 43 insertions(+)

diff --git a/apps/server/src/serviceLauncher.test.ts b/apps/server/src/serviceLauncher.test.ts
index 70550f2379272..1da6c2e195140 100644
--- a/apps/server/src/serviceLauncher.test.ts
+++ b/apps/server/src/serviceLauncher.test.ts
@@ -1,5 +1,7 @@
 // @effect-diagnostics-next-line nodeBuiltinImport:off - observes the children the launcher spawns with Node built-ins.
 import type * as NodeChildProcess from "node:child_process";
+// @effect-diagnostics-next-line nodeBuiltinImport:off - the free-space probe is a plain Promise callback.
+import * as NodeFS from "node:fs";
 
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, it } from "@effect/vitest";
@@ -618,6 +620,35 @@ setInterval(() => {}, 1_000);
     }),
   );
 
+  it.effect("reclaims partial backups left by killed updates before checking space", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-service-launcher-orphan-" });
+      const databasePath = path.join(root, "state.sqlite");
+      yield* writeSparseFile(databasePath, 10 * 1024 ** 3);
+      const backupRoot = path.join(root, "runtime", "db-backup");
+      const orphan = path.join(backupRoot, "earlier-update.staging");
+      const completed = path.join(backupRoot, "completed-update");
+      yield* fs.makeDirectory(orphan, { recursive: true });
+      yield* fs.writeFileString(path.join(orphan, "database"), "partial copy");
+      yield* fs.makeDirectory(completed);
+      yield* fs.writeFileString(path.join(completed, "database"), "complete copy");
+
+      // The orphan is what keeps this disk too full for a full copy.
+      const blocker = yield* Effect.promise(() =>
+        databaseBackupBlocker(root, databasePath, {
+          readFreeBytes: () => Promise.resolve((NodeFS.existsSync(orphan) ? 8 : 11) * 1024 ** 3),
+          canClone: () => Promise.resolve(false),
+        }),
+      );
+
+      assert.isUndefined(blocker);
+      assert.isFalse(yield* fs.exists(orphan));
+      assert.isTrue(yield* fs.exists(path.join(completed, "database")));
+    }),
+  );
+
   it.effect("checks database backup space against clone or full-copy needs", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/serviceLauncher.ts b/apps/server/src/serviceLauncher.ts
index 9f764b788efe2..ee05c63297843 100644
--- a/apps/server/src/serviceLauncher.ts
+++ b/apps/server/src/serviceLauncher.ts
@@ -219,6 +219,17 @@ const filesystemBackupSpaceProbe: BackupSpaceProbe = {
   canClone: backupCanClone,
 };
 
+// A killed launcher skips the backup's cleanup, and retries only clear their own update's copy.
+// Update requests are refused while one is pending, so no staging directory is still in use here.
+async function removeAbandonedBackupCopies(backupRoot: string): Promise<void> {
+  for (const entry of await NodeFSP.readdir(backupRoot)) {
+    if (!entry.endsWith(".staging")) continue;
+    await NodeFSP.rm(NodePath.join(backupRoot, entry), { recursive: true, force: true }).catch(
+      () => undefined,
+    );
+  }
+}
+
 /** Check before stopping the server so full disks refuse updates without an outage. */
 export async function databaseBackupBlocker(
   baseDir: string,
@@ -228,6 +239,7 @@ export async function databaseBackupBlocker(
   const { readFreeBytes, canClone } = { ...filesystemBackupSpaceProbe, ...probe };
   const backupRoot = NodePath.join(baseDir, "runtime", "db-backup");
   await NodeFSP.mkdir(backupRoot, { recursive: true, mode: 0o700 });
+  await removeAbandonedBackupCopies(backupRoot);
   const [files, free] = await Promise.all([statDatabaseFiles(dbPath), readFreeBytes(backupRoot)]);
   const size = files.reduce((total, file) => total + file.size, 0);
   const fullCopyBytes = size * 1.05;

From b63adbf54e2fe969b588a829ba6be7b4171c131d Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:13:09 +0000
Subject: [PATCH 080/167] fix(server): PR watch wakes no longer split an emoji
 in a long comment (#29633)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/pullRequestWatch.test.ts   | 17 +++++++++++++++++
 .../src/orchestration-v2/pullRequestWatch.ts    |  6 +++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/pullRequestWatch.test.ts b/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
index 0b6070f364662..adf1e9776ce02 100644
--- a/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
+++ b/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
@@ -8,6 +8,7 @@ import { assert, describe, it } from "@effect/vitest";
 import {
   PULL_REQUEST_WATCH_WAKE_LIMIT,
   evaluatePullRequestWatch as evaluate,
+  pullRequestWatchMessage,
 } from "./pullRequestWatch.ts";
 
 // These cases read the head once or at one moment, so the no-checks notice never comes due.
@@ -335,6 +336,22 @@ describe("evaluatePullRequestWatch", () => {
     assert.deepEqual(evaluatePullRequestWatch(report.next, detail(), comments).changes, []);
   });
 
+  it("cuts a long remark in the wake message without splitting an emoji", () => {
+    const body = `${"x".repeat(196)}🚀 and more`;
+    const report = evaluatePullRequestWatch(watch(), detail(), [
+      remark("reviewer", "2026-10-02T12:06:00Z", body),
+    ]);
+    const { text } = pullRequestWatchMessage({
+      number: 1,
+      url: "https://github.com/o/r/pull/1",
+      baseBranch: "main",
+      headSha: null,
+      report,
+    });
+    assert.isTrue(text.isWellFormed());
+    assert.include(text, `"${"x".repeat(196)}..."`);
+  });
+
   it("reports a conflict once, until the branch is clean again", () => {
     const conflicting = detail({ mergeability: "conflicting" });
     const first = evaluatePullRequestWatch(watch(), conflicting, noRemarks);
diff --git a/apps/server/src/orchestration-v2/pullRequestWatch.ts b/apps/server/src/orchestration-v2/pullRequestWatch.ts
index 033125a6d6c9d..c4f227f0520ef 100644
--- a/apps/server/src/orchestration-v2/pullRequestWatch.ts
+++ b/apps/server/src/orchestration-v2/pullRequestWatch.ts
@@ -160,7 +160,11 @@ function snippet(body: string): string {
     .replaceAll(/<!--[\s\S]*?-->/g, " ")
     .replaceAll(/\s+/g, " ")
     .trim();
-  return text.length <= SNIPPET_LENGTH ? text : `${text.slice(0, SNIPPET_LENGTH - 3)}...`;
+  if (text.length <= SNIPPET_LENGTH) return text;
+  // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+  const last = text.charCodeAt(SNIPPET_LENGTH - 4);
+  const end = last >= 0xd800 && last <= 0xdbff ? SNIPPET_LENGTH - 4 : SNIPPET_LENGTH - 3;
+  return `${text.slice(0, end)}...`;
 }
 
 function listed<T>(items: ReadonlyArray<T>, line: (item: T) => string): Array<string> {

From 30f7600ec82ba0d85b71ee220e779c9a0dc9d62c Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:13:26 +0000
Subject: [PATCH 081/167] fix(server): pinning a settled thread stamps its
 return to the active list (#29602)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/orchestration-v2/Orchestrator.ts   |  1 +
 .../src/orchestration-v2/runtimeLayer.test.ts      | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 16256585dc526..08ba4ab5cc0aa 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -3559,6 +3559,7 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
             settledOverride:
               thread.settledOverride === "settled" ? "active" : thread.settledOverride,
             settledAt: thread.settledOverride === "settled" ? null : thread.settledAt,
+            ...(thread.settledOverride === "settled" ? { unsettledAt: now } : {}),
             snoozedUntil: null,
             snoozedAt: null,
             lastSnoozeWakeAt: thread.snoozedUntil == null ? thread.lastSnoozeWakeAt : now,
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index 34d252457e63a..796a50435ab60 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -2659,6 +2659,20 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
       );
       assert.deepEqual(activeShell?.unsettledAt, activeProjection.thread.unsettledAt);
 
+      yield* orchestrator.dispatch({
+        type: "thread.settle",
+        commandId: CommandId.make("runtime-layer-lifecycle-resettle"),
+        threadId,
+      });
+      yield* orchestrator.dispatch({
+        type: "thread.pin",
+        commandId: CommandId.make("runtime-layer-lifecycle-pin-settled"),
+        threadId,
+      });
+      const pinnedProjection = yield* orchestrator.getThreadProjection(threadId);
+      assert.equal(pinnedProjection.thread.settledOverride, "active");
+      assert.isNotNull(pinnedProjection.thread.unsettledAt);
+
       const archive = yield* orchestrator.dispatch({
         type: "thread.archive",
         commandId: CommandId.make("runtime-layer-lifecycle-archive"),

From 6016aac5c23b34f7d73833f4332b5de16cc03aac Mon Sep 17 00:00:00 2001
From: u9g <43508353+u9g@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:13:44 -0800
Subject: [PATCH 082/167] fix(server): Claude's commands no longer run Electron
 apps as Node (#29413)

---
 apps/server/src/provider/Drivers/ClaudeHome.test.ts | 3 ++-
 apps/server/src/provider/Drivers/ClaudeHome.ts      | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/provider/Drivers/ClaudeHome.test.ts b/apps/server/src/provider/Drivers/ClaudeHome.test.ts
index ae2dacd0f2311..c772b79efe184 100644
--- a/apps/server/src/provider/Drivers/ClaudeHome.test.ts
+++ b/apps/server/src/provider/Drivers/ClaudeHome.test.ts
@@ -60,7 +60,7 @@ it.layer(NodeServices.layer)("ClaudeHome", (it) => {
   });
 
   it.effect(
-    "drops the launching Claude session and labels processes t3-code unless overridden",
+    "drops the launching Claude session and Electron's run-as-Node flag, and labels processes t3-code unless overridden",
     () =>
       Effect.gen(function* () {
         const fileSystem = yield* FileSystem.FileSystem;
@@ -72,6 +72,7 @@ it.layer(NodeServices.layer)("ClaudeHome", (it) => {
           CLAUDE_CODE_SESSION_ID: "host-session",
           CLAUDE_CODE_MESSAGING_SOCKET: "/tmp/host-claude.sock",
           CLAUDE_EFFORT: "high",
+          ELECTRON_RUN_AS_NODE: "1",
           KEEP: "1",
         };
         const instance = [
diff --git a/apps/server/src/provider/Drivers/ClaudeHome.ts b/apps/server/src/provider/Drivers/ClaudeHome.ts
index ed5d8fca2ad7c..8042a7f16e491 100644
--- a/apps/server/src/provider/Drivers/ClaudeHome.ts
+++ b/apps/server/src/provider/Drivers/ClaudeHome.ts
@@ -76,6 +76,9 @@ export const mergeClaudeProcessEnvironment = Effect.fn("mergeClaudeProcessEnviro
     CLAUDE_CODE_ENTRYPOINT: "t3-code",
   };
   for (const name of CLAUDE_HOST_SESSION_VARIABLES) delete baseEnvironment[name];
+  // The desktop runs the server as Node through Electron. Commands Claude runs inherit its env, so
+  // an Electron app they start (T3 Code itself, VS Code) would run as Node and exit.
+  delete baseEnvironment.ELECTRON_RUN_AS_NODE;
   const environment = yield* mergeProviderInstanceEnvironment(instanceEnvironment, baseEnvironment);
   const settingsEntrypoint = (yield* readClaudeSettingsEnv(config, undefined, environment))
     .CLAUDE_CODE_ENTRYPOINT;

From ddca6b1b3e5f525a7965bd2e8be187b006d82250 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:14:02 +0000
Subject: [PATCH 083/167] docs: keybindings guide lists the rightPanelOpen when
 key (#29677)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/user/keybindings.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/user/keybindings.md b/docs/user/keybindings.md
index dd256211a8516..3654c0b3b04cd 100644
--- a/docs/user/keybindings.md
+++ b/docs/user/keybindings.md
@@ -113,8 +113,10 @@ Join modifiers and a key with `+`, such as `mod+shift+d` or `ctrl+l`.
 ## When conditions
 
 Available context keys are `terminalFocus`, `terminalOpen`, `previewFocus`,
-`previewOpen`, `modelPickerOpen`, `usagePageOpen`, `composerFocus`, `draftThreadRoute`,
-`turnRunning`, `editableFocus`, `isWeb`, and `isDesktop`.
+`previewOpen`, `rightPanelOpen`, `modelPickerOpen`, `usagePageOpen`, `composerFocus`,
+`draftThreadRoute`, `turnRunning`, `editableFocus`, `isWeb`, and `isDesktop`.
+`rightPanelOpen` applies only to `rightPanel.new` and is true while the right panel is
+open; the default `mod+t` uses it to open the panel's new-tab menu.
 `draftThreadRoute` is true on a draft thread, including a restored draft, until it is first sent.
 `editableFocus` is true while a text field, the composer, or another editor has
 the keyboard. `isWeb` is true in a browser tab. `isDesktop` is true in the

From 0a86e157a0eaf80c34da089a29526c6201ac529a Mon Sep 17 00:00:00 2001
From: Hieu Le <78847613+hieu-lee@users.noreply.github.com>
Date: Wed, 4 Nov 2026 00:14:20 +0100
Subject: [PATCH 084/167] perf(shared): avoid redundant visibility work on
 status updates (#28965)

---
 .../src/orchestrationV2Timeline.test.ts       | 247 +++++++++++++++++-
 .../shared/src/orchestrationV2Timeline.ts     |  17 +-
 2 files changed, 247 insertions(+), 17 deletions(-)

diff --git a/packages/shared/src/orchestrationV2Timeline.test.ts b/packages/shared/src/orchestrationV2Timeline.test.ts
index 8d38d1db59b30..9ed07c4f09b2b 100644
--- a/packages/shared/src/orchestrationV2Timeline.test.ts
+++ b/packages/shared/src/orchestrationV2Timeline.test.ts
@@ -8,6 +8,20 @@ import {
 
 const runId = RunId.make("run:timeline-visibility");
 const nodeId = NodeId.make("node:timeline-visibility");
+const otherRunId = RunId.make("run:timeline-visibility:other");
+const otherNodeId = NodeId.make("node:timeline-visibility:other");
+type VisibilityInput = Parameters<typeof createOrchestrationV2TurnItemVisibility>[0];
+
+const ordinaryStatuses = [
+  "preparing",
+  "queued",
+  "starting",
+  "running",
+  "waiting",
+  "completed",
+  "interrupted",
+  "failed",
+] as const;
 
 describe.each([
   ["point", isOrchestrationV2TurnItemVisible],
@@ -28,19 +42,26 @@ describe.each([
     ).toBe(false);
   });
 
-  it("keeps paired interruption results from superseded attempts", () => {
-    expect(
-      isVisible({
-        item: { type: "run_interrupt_result", runId, nodeId },
-        runs: [{ id: runId, status: "running" }],
-        attempts: [{ runId, rootNodeId: nodeId, status: "superseded" }],
-        items: [
-          { type: "run_interrupt_request", runId, nodeId },
-          { type: "run_interrupt_result", runId, nodeId },
-        ],
-      }),
-    ).toBe(true);
-  });
+  it.each([
+    { status: "running", visible: true },
+    { status: "cancelled", visible: true },
+    { status: "rolled_back", visible: false },
+  ] as const)(
+    "keeps paired superseded results unless the run is rolled back ($status)",
+    ({ status, visible }) => {
+      expect(
+        isVisible({
+          item: { type: "run_interrupt_result", runId, nodeId },
+          runs: [{ id: runId, status }],
+          attempts: [{ runId, rootNodeId: nodeId, status: "superseded" }],
+          items: [
+            { type: "run_interrupt_request", runId, nodeId },
+            { type: "run_interrupt_result", runId, nodeId },
+          ],
+        }),
+      ).toBe(visible);
+    },
+  );
 
   it("keeps interruption results from terminal attempts without a request", () => {
     expect(
@@ -92,4 +113,204 @@ describe.each([
       }),
     ).toBe(true);
   });
+
+  it.each([
+    ...ordinaryStatuses.map((status) => ({ status, hidden: [] })),
+    { status: "cancelled", hidden: ["queued"] },
+    {
+      status: "rolled_back",
+      hidden: ["queued", "start", "steer", "promoted", "legacy", "assistant", "request", "result"],
+    },
+  ] satisfies ReadonlyArray<{
+    status: VisibilityInput["runs"][number]["status"];
+    hidden: string[];
+  }>)("keeps the correct transcript rows for $status runs", ({ status, hidden }) => {
+    const rows = [
+      { id: "queued", type: "user_message", inputIntent: "queued_turn", runId, nodeId },
+      { id: "start", type: "user_message", inputIntent: "turn_start", runId, nodeId },
+      { id: "steer", type: "user_message", inputIntent: "steer", runId, nodeId },
+      {
+        id: "promoted",
+        type: "user_message",
+        inputIntent: "promoted_queued_to_steer",
+        runId,
+        nodeId,
+      },
+      { id: "legacy", type: "user_message", runId, nodeId },
+      { id: "assistant", type: "assistant_message", inputIntent: "queued_turn", runId, nodeId },
+      { id: "request", type: "run_interrupt_request", runId, nodeId },
+      { id: "result", type: "run_interrupt_result", runId, nodeId },
+      { id: "null", type: "user_message", inputIntent: "queued_turn", runId: null, nodeId },
+      {
+        id: "missing",
+        type: "user_message",
+        inputIntent: "queued_turn",
+        runId: otherRunId,
+        nodeId,
+      },
+    ] satisfies ReadonlyArray<VisibilityInput["items"][number] & { id: string }>;
+    const input = {
+      runs: [{ id: runId, status }],
+      attempts: [],
+      items: rows,
+    } satisfies VisibilityInput;
+    expect(rows.filter((item) => isVisible({ ...input, item })).map((item) => item.id)).toEqual(
+      [
+        "queued",
+        "start",
+        "steer",
+        "promoted",
+        "legacy",
+        "assistant",
+        "request",
+        "result",
+        "null",
+        "missing",
+      ].filter((id) => !hidden.some((hiddenId) => hiddenId === id)),
+    );
+  });
+
+  it.each([
+    { name: "empty history", runs: [], attempts: [] },
+    {
+      name: "ordinary attempts",
+      runs: [{ id: runId, status: "completed" }],
+      attempts: [{ runId, rootNodeId: nodeId, status: "completed" }],
+    },
+  ] satisfies ReadonlyArray<Pick<VisibilityInput, "runs" | "attempts"> & { name: string }>)(
+    "keeps all rows with $name",
+    ({ runs, attempts }) => {
+      const items = [
+        { type: "user_message", inputIntent: "queued_turn", runId, nodeId },
+        { type: "run_interrupt_result", runId, nodeId },
+        { type: "assistant_message", runId: null, nodeId: null },
+      ] satisfies VisibilityInput["items"];
+      expect(items.filter((item) => isVisible({ item, runs, attempts, items }))).toEqual(items);
+    },
+  );
+
+  it.each([
+    { name: "unpaired", runId, nodeId, requests: [], visible: false },
+    { name: "second root", runId, nodeId: otherNodeId, requests: [], visible: false },
+    { name: "other run", runId: otherRunId, nodeId, requests: [], visible: true },
+    {
+      name: "unknown root",
+      runId,
+      nodeId: NodeId.make("node:unknown"),
+      requests: [],
+      visible: true,
+    },
+    { name: "null run", runId: null, nodeId, requests: [], visible: true },
+    { name: "null node", runId, nodeId: null, requests: [], visible: true },
+    { name: "other request", runId, nodeId, requests: [otherRunId], visible: false },
+    { name: "null request", runId, nodeId, requests: [null], visible: false },
+    { name: "paired request", runId, nodeId, requests: [runId], visible: true },
+  ] satisfies ReadonlyArray<{
+    name: string;
+    runId: VisibilityInput["items"][number]["runId"];
+    nodeId: VisibilityInput["items"][number]["nodeId"];
+    requests: VisibilityInput["items"][number]["runId"][];
+    visible: boolean;
+  }>)("matches superseded roots and requests for $name results", (row) => {
+    const item = { type: "run_interrupt_result", runId: row.runId, nodeId: row.nodeId } as const;
+    const requests = row.requests.map((requestRunId) => ({
+      type: "run_interrupt_request" as const,
+      runId: requestRunId,
+      nodeId: otherNodeId,
+    }));
+    for (const items of [
+      [...requests, item],
+      [item, ...requests],
+    ]) {
+      expect(
+        isVisible({
+          item,
+          runs: [],
+          attempts: [
+            { runId, rootNodeId: nodeId, status: "superseded" },
+            { runId, rootNodeId: otherNodeId, status: "superseded" },
+          ],
+          items,
+        }),
+      ).toBe(row.visible);
+    }
+  });
+});
+
+describe("indexed timeline visibility", () => {
+  it.each([
+    ...ordinaryStatuses.flatMap(
+      (status) =>
+        [
+          { statuses: ["rolled_back", status], visible: true, ordinaryVisible: true },
+          { statuses: ["cancelled", status], visible: true, ordinaryVisible: true },
+          { statuses: [status, "rolled_back"], visible: false, ordinaryVisible: false },
+          { statuses: [status, "cancelled"], visible: false, ordinaryVisible: true },
+        ] as const,
+    ),
+    { statuses: ["rolled_back", "cancelled"], visible: false, ordinaryVisible: true },
+    { statuses: ["cancelled", "rolled_back"], visible: false, ordinaryVisible: false },
+    {
+      statuses: ["rolled_back", "running", "cancelled", "completed"],
+      visible: true,
+      ordinaryVisible: true,
+    },
+  ] satisfies ReadonlyArray<{
+    statuses: ReadonlyArray<VisibilityInput["runs"][number]["status"]>;
+    visible: boolean;
+    ordinaryVisible: boolean;
+  }>)(
+    "uses the last duplicate run status in $statuses",
+    ({ statuses, visible, ordinaryVisible }) => {
+      const queued = { type: "user_message", inputIntent: "queued_turn", runId, nodeId } as const;
+      const ordinary = { type: "assistant_message", runId, nodeId } as const;
+      const isVisible = createOrchestrationV2TurnItemVisibility({
+        runs: statuses.map((status) => ({ id: runId, status })),
+        attempts: [],
+        items: [queued, ordinary],
+      });
+      expect(isVisible(queued)).toBe(visible);
+      expect(isVisible(ordinary)).toBe(ordinaryVisible);
+    },
+  );
+
+  it("preserves frozen rows and reads fresh status and attempt snapshots", () => {
+    const item = Object.freeze({ type: "run_interrupt_result", runId, nodeId } as const);
+    const queued = Object.freeze({
+      type: "user_message",
+      inputIntent: "queued_turn",
+      runId,
+      nodeId,
+    } as const);
+    const items = Object.freeze([item, queued]);
+    const attempts = Object.freeze([
+      Object.freeze({ runId, rootNodeId: nodeId, status: "superseded" } as const),
+    ]);
+    const runs = Object.freeze([Object.freeze({ id: runId, status: "running" } as const)]);
+    const input = Object.freeze({ runs, attempts, items });
+    const before = structuredClone(input);
+    const visible = items.filter(createOrchestrationV2TurnItemVisibility(input));
+    expect(visible).toEqual([queued]);
+    expect(visible[0]).toBe(queued);
+    expect(input).toEqual(before);
+    expect(
+      items.filter(createOrchestrationV2TurnItemVisibility({ ...input, attempts: [] })),
+    ).toEqual(items);
+    expect(
+      items.filter(
+        createOrchestrationV2TurnItemVisibility({
+          ...input,
+          runs: [{ id: runId, status: "cancelled" }],
+        }),
+      ),
+    ).toEqual([]);
+    expect(
+      items.filter(
+        createOrchestrationV2TurnItemVisibility({
+          ...input,
+          items: [...items, { type: "run_interrupt_request", runId, nodeId: null }],
+        }),
+      ),
+    ).toEqual(items);
+  });
 });
diff --git a/packages/shared/src/orchestrationV2Timeline.ts b/packages/shared/src/orchestrationV2Timeline.ts
index 6ca8a95f7fb5a..05f13557138ba 100644
--- a/packages/shared/src/orchestrationV2Timeline.ts
+++ b/packages/shared/src/orchestrationV2Timeline.ts
@@ -74,7 +74,12 @@ export function createOrchestrationV2TurnItemVisibility(input: {
   readonly attempts: ReadonlyArray<TimelineRunAttempt>;
   readonly items: ReadonlyArray<TimelineTurnItem>;
 }): (item: TimelineTurnItem) => boolean {
-  const statuses = new Map(input.runs.map((run) => [run.id, run.status]));
+  const statuses = new Map<TimelineRun["id"], TimelineRun["status"]>();
+  for (const run of input.runs) {
+    if (run.status === "rolled_back" || run.status === "cancelled")
+      statuses.set(run.id, run.status);
+    else statuses.delete(run.id);
+  }
   const supersededRoots = new Map<
     TimelineRunAttempt["runId"],
     Set<TimelineRunAttempt["rootNodeId"]>
@@ -85,9 +90,13 @@ export function createOrchestrationV2TurnItemVisibility(input: {
     if (roots === undefined) supersededRoots.set(attempt.runId, (roots = new Set()));
     roots.add(attempt.rootNodeId);
   }
-  const interruptRuns = new Set(
-    input.items.filter((item) => item.type === "run_interrupt_request").map((item) => item.runId),
-  );
+  if (statuses.size === 0 && supersededRoots.size === 0) return () => true;
+  const interruptRuns = new Set<TimelineTurnItem["runId"]>();
+  if (supersededRoots.size > 0) {
+    for (const item of input.items) {
+      if (item.type === "run_interrupt_request") interruptRuns.add(item.runId);
+    }
+  }
   return (item) => {
     const status = item.runId === null ? undefined : statuses.get(item.runId);
     if (status === "rolled_back") return false;

From b113eb0209952d404ecb66a0e49c6e7277add703 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:14:45 +0000
Subject: [PATCH 085/167] fix(desktop): failed settings saves no longer leave
 temp files behind (#29635)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/settings/DesktopAppSettings.test.ts   | 23 ++++++++++
 .../src/settings/DesktopAppSettings.ts        | 42 ++++++++++---------
 .../settings/DesktopClientSettings.test.ts    | 23 ++++++++++
 .../src/settings/DesktopClientSettings.ts     | 42 ++++++++++---------
 4 files changed, 90 insertions(+), 40 deletions(-)

diff --git a/apps/desktop/src/settings/DesktopAppSettings.test.ts b/apps/desktop/src/settings/DesktopAppSettings.test.ts
index ab3e2e4cd0755..7e4b530083097 100644
--- a/apps/desktop/src/settings/DesktopAppSettings.test.ts
+++ b/apps/desktop/src/settings/DesktopAppSettings.test.ts
@@ -264,6 +264,29 @@ describe("DesktopSettings", () => {
     ),
   );
 
+  it.effect("removes its temporary file when replacing the settings file fails", () =>
+    withSettings(
+      Effect.gen(function* () {
+        const environment = yield* DesktopEnvironment.DesktopEnvironment;
+        const fileSystem = yield* FileSystem.FileSystem;
+        const settings = yield* DesktopAppSettings.DesktopAppSettings;
+        yield* fileSystem.makeDirectory(`${environment.desktopSettingsPath}/occupied`, {
+          recursive: true,
+        });
+
+        const error = yield* settings.setServerExposureMode("network-accessible").pipe(Effect.flip);
+
+        assert.equal(error.operation, "replace-settings-file");
+        assert.deepEqual(
+          (yield* fileSystem.readDirectory(environment.stateDir)).filter((name) =>
+            name.endsWith(".tmp"),
+          ),
+          [],
+        );
+      }),
+    ),
+  );
+
   it.effect("migrates legacy implicit update channels to the runtime default", () =>
     withSettings(
       Effect.gen(function* () {
diff --git a/apps/desktop/src/settings/DesktopAppSettings.ts b/apps/desktop/src/settings/DesktopAppSettings.ts
index aa16502a16585..6cd34322d98c2 100644
--- a/apps/desktop/src/settings/DesktopAppSettings.ts
+++ b/apps/desktop/src/settings/DesktopAppSettings.ts
@@ -442,26 +442,28 @@ const writeSettings = Effect.fn("desktop.settings.writeSettings")(function* (inp
         }),
     ),
   );
-  yield* input.fileSystem.writeFileString(tempPath, `${encoded}\n`).pipe(
-    Effect.mapError(
-      (cause) =>
-        new DesktopSettingsWriteError({
-          operation: "write-temporary-file",
-          path: tempPath,
-          cause,
-        }),
-    ),
-  );
-  yield* input.fileSystem.rename(tempPath, targetPath).pipe(
-    Effect.mapError(
-      (cause) =>
-        new DesktopSettingsWriteError({
-          operation: "replace-settings-file",
-          path: input.settingsPath,
-          cause,
-        }),
-    ),
-  );
+  yield* Effect.gen(function* () {
+    yield* input.fileSystem.writeFileString(tempPath, `${encoded}\n`).pipe(
+      Effect.mapError(
+        (cause) =>
+          new DesktopSettingsWriteError({
+            operation: "write-temporary-file",
+            path: tempPath,
+            cause,
+          }),
+      ),
+    );
+    yield* input.fileSystem.rename(tempPath, targetPath).pipe(
+      Effect.mapError(
+        (cause) =>
+          new DesktopSettingsWriteError({
+            operation: "replace-settings-file",
+            path: input.settingsPath,
+            cause,
+          }),
+      ),
+    );
+  }).pipe(Effect.ensuring(input.fileSystem.remove(tempPath, { force: true }).pipe(Effect.ignore)));
 });
 
 /** @public */
diff --git a/apps/desktop/src/settings/DesktopClientSettings.test.ts b/apps/desktop/src/settings/DesktopClientSettings.test.ts
index 2d89754ac1150..0dab1c8d83cc6 100644
--- a/apps/desktop/src/settings/DesktopClientSettings.test.ts
+++ b/apps/desktop/src/settings/DesktopClientSettings.test.ts
@@ -144,6 +144,29 @@ describe("DesktopClientSettings", () => {
     ),
   );
 
+  it.effect("removes its temporary file when replacing the settings file fails", () =>
+    withClientSettings(
+      Effect.gen(function* () {
+        const environment = yield* DesktopEnvironment.DesktopEnvironment;
+        const fileSystem = yield* FileSystem.FileSystem;
+        const settings = yield* DesktopClientSettings.DesktopClientSettings;
+        yield* fileSystem.makeDirectory(`${environment.clientSettingsPath}/occupied`, {
+          recursive: true,
+        });
+
+        const error = yield* settings.set(clientSettings).pipe(Effect.flip);
+
+        assert.equal(error.operation, "replace-settings-file");
+        assert.deepEqual(
+          (yield* fileSystem.readDirectory(environment.stateDir)).filter((name) =>
+            name.endsWith(".tmp"),
+          ),
+          [],
+        );
+      }),
+    ),
+  );
+
   it.effect.each([
     { label: "permission", reason: "PermissionDenied" },
     { label: "I/O", reason: "Unknown" },
diff --git a/apps/desktop/src/settings/DesktopClientSettings.ts b/apps/desktop/src/settings/DesktopClientSettings.ts
index 52b619494626f..b840bb7a058e3 100644
--- a/apps/desktop/src/settings/DesktopClientSettings.ts
+++ b/apps/desktop/src/settings/DesktopClientSettings.ts
@@ -162,26 +162,28 @@ const writeClientSettings = Effect.fnUntraced(function* (input: {
         }),
     ),
   );
-  yield* input.fileSystem.writeFileString(tempPath, `${encoded}\n`).pipe(
-    Effect.mapError(
-      (cause) =>
-        new DesktopClientSettingsWriteError({
-          operation: "write-temporary-file",
-          path: tempPath,
-          cause,
-        }),
-    ),
-  );
-  yield* input.fileSystem.rename(tempPath, targetPath).pipe(
-    Effect.mapError(
-      (cause) =>
-        new DesktopClientSettingsWriteError({
-          operation: "replace-settings-file",
-          path: input.settingsPath,
-          cause,
-        }),
-    ),
-  );
+  yield* Effect.gen(function* () {
+    yield* input.fileSystem.writeFileString(tempPath, `${encoded}\n`).pipe(
+      Effect.mapError(
+        (cause) =>
+          new DesktopClientSettingsWriteError({
+            operation: "write-temporary-file",
+            path: tempPath,
+            cause,
+          }),
+      ),
+    );
+    yield* input.fileSystem.rename(tempPath, targetPath).pipe(
+      Effect.mapError(
+        (cause) =>
+          new DesktopClientSettingsWriteError({
+            operation: "replace-settings-file",
+            path: input.settingsPath,
+            cause,
+          }),
+      ),
+    );
+  }).pipe(Effect.ensuring(input.fileSystem.remove(tempPath, { force: true }).pipe(Effect.ignore)));
 });
 
 export const make = Effect.gen(function* () {

From 6d80df55bba5994c3d5faccb1dfc618c0f712520 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:15:01 +0000
Subject: [PATCH 086/167] fix(acp): a final agent message without a trailing
 newline is no longer dropped (#29605)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/effect-acp/src/protocol.test.ts | 22 ++++++++++++++++++++++
 packages/effect-acp/src/protocol.ts      | 23 +++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/packages/effect-acp/src/protocol.test.ts b/packages/effect-acp/src/protocol.test.ts
index eae3394a1653f..6eb9fe0ea3ca0 100644
--- a/packages/effect-acp/src/protocol.test.ts
+++ b/packages/effect-acp/src/protocol.test.ts
@@ -884,6 +884,7 @@ it.layer(NodeServices.layer)("effect-acp protocol", (it) => {
         .request("x/test", { hello: "world" })
         .pipe(Effect.flip, Effect.orDie, Effect.forkScoped);
       yield* Queue.take(output);
+      yield* Queue.offer(input, encoder.encode('{"jsonrpc":"2.0","id":1,"result":'));
       yield* Queue.end(input);
 
       const error = yield* Deferred.await(termination);
@@ -900,6 +901,27 @@ it.layer(NodeServices.layer)("effect-acp protocol", (it) => {
     }),
   );
 
+  it.effect("answers a pending request from a final response without a trailing newline", () =>
+    Effect.gen(function* () {
+      const { stdio, input, output } = yield* makeInMemoryStdio();
+      const transport = yield* AcpProtocol.makeAcpPatchedProtocol({
+        stdio,
+        serverRequestMethods: new Set(),
+      });
+      const pending = yield* transport
+        .request("x/test", { hello: "world" })
+        .pipe(Effect.forkScoped);
+      yield* Queue.take(output);
+      yield* Queue.offer(
+        input,
+        encoder.encode(encodeUnknownJsonString({ jsonrpc: "2.0", id: 1, result: { ok: true } })),
+      );
+      yield* Queue.end(input);
+
+      assert.deepEqual(yield* Fiber.join(pending), { ok: true });
+    }),
+  );
+
   it.effect("propagates the real child exit code when the input stream ends", () =>
     Effect.gen(function* () {
       const handle = yield* makeHandle({ ACP_MOCK_EXIT_IMMEDIATELY_CODE: "7" });
diff --git a/packages/effect-acp/src/protocol.ts b/packages/effect-acp/src/protocol.ts
index 8763e66361e12..c29656cd12e7a 100644
--- a/packages/effect-acp/src/protocol.ts
+++ b/packages/effect-acp/src/protocol.ts
@@ -180,6 +180,16 @@ const makeStrictNdJsonRpcParser = () => {
       buffer = chunk.slice(lastNewline + 1);
       return lines.flatMap((line) => codec.decode(line));
     },
+    // A truncated final line is left to the exit status, which explains a crash better.
+    end: (): ReadonlyArray<unknown> => {
+      const line = buffer + decoder.decode();
+      buffer = "";
+      try {
+        return line.trim() === "" ? [] : codec.decode(line);
+      } catch {
+        return [];
+      }
+    },
     encode: (response: Parameters<typeof codec.encode>[0]) => {
       const encoded = codec.encode(response);
       return encoded === undefined ? undefined : `${encoded}\n`;
@@ -748,6 +758,19 @@ export const makeAcpPatchedProtocol = Effect.fn("makeAcpPatchedProtocol")(functi
         ),
       ),
     ),
+    Effect.andThen(
+      Effect.suspend(() =>
+        Effect.forEach(
+          (
+            parser.end() as ReadonlyArray<
+              RpcMessage.FromClientEncoded | RpcMessage.FromServerEncoded
+            >
+          ).map(normalizeAcpJsonRpcError),
+          routeDecodedMessage,
+          { discard: true },
+        ),
+      ),
+    ),
     // Anything that ends the reader, including a defect in a callback it runs,
     // terminates the connection so pending requests fail instead of hanging.
     Effect.matchCauseEffect({

From 594532a73fc960981a43aebc65ae84ce41a3af8c Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:15:42 +0000
Subject: [PATCH 087/167] fix(server): terminal history keeps output after an
 unterminated OSC (#29604)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/terminal/Manager.test.ts | 16 ++++++++++------
 apps/server/src/terminal/Manager.ts      | 10 ++++++++--
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/terminal/Manager.test.ts b/apps/server/src/terminal/Manager.test.ts
index 05b8ea8c46387..c210e4a519dcd 100644
--- a/apps/server/src/terminal/Manager.test.ts
+++ b/apps/server/src/terminal/Manager.test.ts
@@ -1142,14 +1142,17 @@ it.layer(
       process.emitData("\u0090$q m\u009c\u00901$r0m\u009c");
       process.emitData("\u0090+q544e\u009c\u00901+r544e=1b\u009c");
       process.emitData('\u001b[!p\u001b["p\u001b[4 q\u001b[u');
+      process.emitData("\u001b]0;x\u001b\u001b[?2026$p");
       process.emitData("done\n");
 
       yield* manager.close({ threadId: "thread-1" });
 
       const reopened = yield* manager.open(openInput());
-      expect(reopened.history.startsWith('prompt \u001b[!p\u001b["p\u001b[4 q\u001b[udone\n')).toBe(
-        true,
-      );
+      expect(
+        reopened.history.startsWith(
+          'prompt \u001b[!p\u001b["p\u001b[4 q\u001b[u\u001b]0;x\u001bdone\n',
+        ),
+      ).toBe(true);
     }),
   );
 
@@ -1166,10 +1169,11 @@ it.layer(
     { name: "C1 CSI", sequence: "\u009b5" },
   ])("keeps output after a cancelled $name sequence in history", ({ sequence }) =>
     Effect.gen(function* () {
-      const { manager, ptyAdapter } = yield* createManager();
+      const { manager, ptyAdapter } = yield* createManager(10);
       yield* manager.open(openInput());
       const process = ptyAdapter.processes[0]!;
-      for (const cancel of ["\u0018", "\u001a"]) {
+      // A new escape sequence also aborts one, as in xterm.js; keep it last so CAN cannot end it.
+      for (const cancel of ["\u0018", "\u001a", "\u001b[0m"]) {
         process.emitData(sequence);
         process.emitData(cancel);
         process.emitData("next line\n");
@@ -1178,7 +1182,7 @@ it.layer(
       yield* manager.close({ threadId: "thread-1" });
 
       const reopened = yield* manager.open(openInput());
-      expect(reopened.history.match(/next line/g)).toHaveLength(4);
+      expect(reopened.history.match(/next line/g)).toHaveLength(6);
     }),
   );
 
diff --git a/apps/server/src/terminal/Manager.ts b/apps/server/src/terminal/Manager.ts
index c881dbd7b19a8..09a881d15ea43 100644
--- a/apps/server/src/terminal/Manager.ts
+++ b/apps/server/src/terminal/Manager.ts
@@ -1142,8 +1142,10 @@ function findStringTerminatorIndex(input: string, start: number): number | null
     if (codePoint === 0x07 || codePoint === 0x9c || isControlSequenceCancel(codePoint)) {
       return index + 1;
     }
-    if (codePoint === 0x1b && input.charCodeAt(index + 1) === 0x5c) {
-      return index + 2;
+    // Like xterm.js, an ESC that does not start ST ends the string and begins the next sequence.
+    if (codePoint === 0x1b) {
+      if (index + 1 >= input.length) return null;
+      return input.charCodeAt(index + 1) === 0x5c ? index + 2 : index;
     }
   }
   return null;
@@ -1165,6 +1167,10 @@ function findEscapeSequenceEndIndex(input: string, start: number): number | null
   if (cursor >= input.length) {
     return null;
   }
+  // A second ESC restarts the sequence, so leave it for the next pass.
+  if (input.charCodeAt(cursor) === 0x1b) {
+    return cursor;
+  }
   return isEscapeFinalByte(input.charCodeAt(cursor)) ? cursor + 1 : start + 1;
 }
 

From df2dfde0ee8f8a2273e9dfccf964c2df8cecdd3b Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:16:01 +0000
Subject: [PATCH 088/167] fix(cli): t3 up's pairing hint keeps --base-dir
 (#29684)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/up.test.ts |  3 ++-
 apps/server/src/cli/up.ts      | 14 ++++++++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/cli/up.test.ts b/apps/server/src/cli/up.test.ts
index aa32442f451c7..10fb3b421d247 100644
--- a/apps/server/src/cli/up.test.ts
+++ b/apps/server/src/cli/up.test.ts
@@ -182,6 +182,7 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NetService.layer))
     },
     {
       label: "the local network opens",
+      prints: "Run `t3 pair --base-dir <baseDir>`.",
       installed: true,
       env: "T3CODE_LAN=false\n",
       args: ["--lan"],
@@ -337,7 +338,7 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, NetService.layer))
         ),
       );
       if (input.prints !== undefined) {
-        expect(lines.join("\n")).toContain(input.prints);
+        expect(lines.join("\n")).toContain(input.prints.replace("<baseDir>", baseDir));
       }
       expect(exit._tag).toBe(input.restartFails === true ? "Failure" : "Success");
       expect({ installs, restarts }).toEqual({
diff --git a/apps/server/src/cli/up.ts b/apps/server/src/cli/up.ts
index b04b6fea7d331..5a0e820958c15 100644
--- a/apps/server/src/cli/up.ts
+++ b/apps/server/src/cli/up.ts
@@ -171,12 +171,12 @@ const formatSetup = (setup: Setup) => {
   ].join("\n");
 };
 
-const formatNextSteps = (routes: Routes, serviceInstalled: boolean) =>
+const formatNextSteps = (routes: Routes, serviceInstalled: boolean, pairCommand: string) =>
   [
     ...(routes.connect
       ? ["On your other device, sign in to T3 Connect with the same account."]
       : []),
-    ...(routes.lan ? ["Run `t3 pair`. Use the code on your other device."] : []),
+    ...(routes.lan ? [`Run \`${pairCommand}\`. Use the code on your other device.`] : []),
     ...(routes.connect || routes.lan
       ? []
       : [
@@ -197,6 +197,11 @@ const setUp = Effect.fn("cli.up")(function* (flags: {
 }) {
   const { baseDir } = yield* ServerConfig.ServerConfig;
   const service = yield* BootService.BootService;
+  const baseDirArgs = Option.match(flags.baseDir, {
+    onNone: () => [],
+    onSome: (dir) => ["--base-dir", dir],
+  });
+  const { command: pairCommand } = yield* resolveHostCliCommand("pair", baseDirArgs);
   const before = yield* readSetup();
   if (before.connect === null && Option.getOrElse(flags.connect, () => false)) {
     return yield* new CliError.UserError({
@@ -252,7 +257,7 @@ const setUp = Effect.fn("cli.up")(function* (flags: {
       yield* disconnectCloud({ clearAuthorization: false });
     }
     if (current.lan) yield* CliService.writeServiceEnv(baseDir, { T3CODE_LAN: "false" });
-    return yield* Console.log(formatNextSteps(routes, false));
+    return yield* Console.log(formatNextSteps(routes, false, pairCommand));
   }
   const { installedVersion } = before.service;
   const newer =
@@ -327,7 +332,7 @@ const setUp = Effect.fn("cli.up")(function* (flags: {
 
   const printServeCommand = Effect.fn(function* (reason: string) {
     const { command } = yield* resolveHostCliCommand("serve", [
-      ...Option.match(flags.baseDir, { onNone: () => [], onSome: (dir) => ["--base-dir", dir] }),
+      ...baseDirArgs,
       // Explicit either way, so a T3CODE_LAN in the shell cannot override the choice.
       routes.lan ? "--lan" : "--no-lan",
     ]);
@@ -408,6 +413,7 @@ const setUp = Effect.fn("cli.up")(function* (flags: {
     `\nThis machine\n${formatSetup(after)}\n\n${formatNextSteps(
       { connect: after.connect === true, lan: after.lan },
       after.service.installed,
+      pairCommand,
     )}`,
   );
 });

From 1b6336d237d7c800dd5c620d96627f2a9c71140c Mon Sep 17 00:00:00 2001
From: Johan Vaz <v.johan2234@gmail.com>
Date: Wed, 4 Nov 2026 07:16:27 +0800
Subject: [PATCH 089/167] fix(shared): preserve omitted components in
 zero-major caret ranges (#29335)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/shared/src/semver.test.ts | 8 ++++++++
 packages/shared/src/semver.ts      | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/packages/shared/src/semver.test.ts b/packages/shared/src/semver.test.ts
index a66e5b07d8bcc..57766584a0439 100644
--- a/packages/shared/src/semver.test.ts
+++ b/packages/shared/src/semver.test.ts
@@ -59,12 +59,18 @@ describe("semver helpers", () => {
   });
 
   it("honors caret range upper bounds for zero-major versions", () => {
+    expect(satisfiesSemverRange("0.5.0", "^0")).toBe(true);
+    expect(satisfiesSemverRange("0.0.4", "^0.0")).toBe(true);
+    expect(satisfiesSemverRange("1.0.0", "^0")).toBe(false);
+    expect(satisfiesSemverRange("0.1.0", "^0.0")).toBe(false);
     expect(satisfiesSemverRange("0.2.3", "^0.2.3")).toBe(true);
     expect(satisfiesSemverRange("0.2.9", "^0.2.3")).toBe(true);
     expect(satisfiesSemverRange("0.3.0", "^0.2.3")).toBe(false);
     expect(satisfiesSemverRange("0.5.0", "^0.2.3")).toBe(false);
     expect(satisfiesSemverRange("0.0.3", "^0.0.3")).toBe(true);
     expect(satisfiesSemverRange("0.0.4", "^0.0.3")).toBe(false);
+    expect(satisfiesSemverRange("0.0.0", "^0.0.0")).toBe(true);
+    expect(satisfiesSemverRange("0.0.1", "^0.0.0")).toBe(false);
   });
 
   it("keeps the range checker stringifiable and executable as plain JavaScript", () => {
@@ -74,6 +80,8 @@ describe("semver helpers", () => {
     expect(source).toContain("function satisfiesSemverRange");
     expect(source).not.toContain(": string");
     expect(source).not.toContain(": boolean");
+    expect(recreated("0.5.0", "^0")).toBe(true);
+    expect(recreated("0.0.4", "^0.0")).toBe(true);
     expect(recreated("24.10.0", ">=24.10")).toBe(true);
     expect(recreated("24.9.9", ">=24.10")).toBe(false);
   });
diff --git a/packages/shared/src/semver.ts b/packages/shared/src/semver.ts
index 8d1a354f008bc..dc0e34f102dfb 100644
--- a/packages/shared/src/semver.ts
+++ b/packages/shared/src/semver.ts
@@ -198,10 +198,10 @@ export const satisfiesSemverRange: (rawVersion: string, range: string) => boolea
             if (compared < 0) {
               return false;
             }
-            if (target.major > 0) {
+            if (target.major > 0 || targetMatch[2] === undefined) {
               return version.major === target.major;
             }
-            if (target.minor > 0) {
+            if (target.minor > 0 || targetMatch[3] === undefined) {
               return version.major === 0 && version.minor === target.minor;
             }
             return version.major === 0 && version.minor === 0 && version.patch === target.patch;

From 4f58294ca821c53c84f1502bf01b7beb3f9e5b46 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:16:51 +0000
Subject: [PATCH 090/167] fix(server): thread titles use linked PR context when
 the URL is followed by a colon or bold markers (#29656)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/textGeneration/ThreadTitleLinks.test.ts | 2 +-
 apps/server/src/textGeneration/ThreadTitleLinks.ts      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/textGeneration/ThreadTitleLinks.test.ts b/apps/server/src/textGeneration/ThreadTitleLinks.test.ts
index ccb4cbfde9fce..d7a34a70884e9 100644
--- a/apps/server/src/textGeneration/ThreadTitleLinks.test.ts
+++ b/apps/server/src/textGeneration/ThreadTitleLinks.test.ts
@@ -20,7 +20,7 @@ it.effect(
       const result = yield* resolveThreadTitleLinks({
         cwd: "/tmp/project",
         message:
-          "https://docs.test/guide [https://forge.test/change/1] https://forge.test/change/1#discussion https://forge.test/change/1?view=full `https://forge.test/change/2` https://forge.test/change/2. https://forge.test/change/3",
+          "https://docs.test/guide **https://forge.test/change/1**: [https://forge.test/change/1] https://forge.test/change/1#discussion https://forge.test/change/1?view=full `https://forge.test/change/2` https://forge.test/change/2. https://forge.test/change/3",
       }).pipe(
         Effect.provide(
           layerRegistry({
diff --git a/apps/server/src/textGeneration/ThreadTitleLinks.ts b/apps/server/src/textGeneration/ThreadTitleLinks.ts
index 695e93e1f2d33..cb6f0d924d275 100644
--- a/apps/server/src/textGeneration/ThreadTitleLinks.ts
+++ b/apps/server/src/textGeneration/ThreadTitleLinks.ts
@@ -13,7 +13,7 @@ export const resolveThreadTitleLinks = Effect.fn("resolveThreadTitleLinks")(func
   const providers = yield* SourceControlProviderRegistry.SourceControlProviderRegistry;
   const links = new Map<string, NonNullable<ReturnType<typeof providers.resolveLink>>>();
   for (const match of input.message.matchAll(/https:\/\/[^\s<>"')\]`]+/g)) {
-    const candidate = match[0].replace(/[.,;!?]+$/, "");
+    const candidate = match[0].replace(/[.,:;!?*]+$/, "");
     if (!URL.canParse(candidate)) continue;
     const url = new URL(candidate);
     url.hash = "";

From 2b4d6a3141fc4acf9c9ea4d67107fb46681ebdd4 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Tue, 3 Nov 2026 18:17:08 -0500
Subject: [PATCH 091/167] fix(source-control): remotes like
 github.com:owner/repo reach their host (#29457)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../RepositoryIdentityResolver.test.ts        | 19 ++++++++++++++
 .../SourceControlProviderRegistry.test.ts     | 18 +++++++++++++
 .../sourceControlDefinitions.test.ts          | 12 +++++++++
 packages/shared/src/sourceControl.test.ts     | 25 +++++++++++++++++++
 packages/shared/src/sourceControl.ts          | 14 ++++++++++-
 .../src/server/SourceControlProvider.test.ts  | 15 ++++++++++-
 .../src/server/SourceControlProvider.ts       |  2 +-
 .../src/shared/definition.ts                  |  3 ++-
 .../server/GitCafeSourceControlProvider.ts    |  3 ++-
 .../src/server/gitCafeHosts.test.ts           |  1 +
 .../src/server/gitCafeHosts.ts                |  2 +-
 .../src/server/GitLabSourceControlProvider.ts |  4 +--
 12 files changed, 109 insertions(+), 9 deletions(-)
 create mode 100644 packages/shared/src/sourceControl.test.ts

diff --git a/apps/server/src/project/RepositoryIdentityResolver.test.ts b/apps/server/src/project/RepositoryIdentityResolver.test.ts
index 0cef7d96bbdfe..4604da894a86c 100644
--- a/apps/server/src/project/RepositoryIdentityResolver.test.ts
+++ b/apps/server/src/project/RepositoryIdentityResolver.test.ts
@@ -51,6 +51,25 @@ it.layer(NodeServices.layer)("RepositoryIdentityResolverLive", (it) => {
     }).pipe(Effect.provide(RepositoryIdentityResolver.layer)),
   );
 
+  it.effect("identifies the host of an SSH remote that leaves its user to ssh config", () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const cwd = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-repository-identity-userless-remote-test-",
+      });
+
+      yield* git(cwd, ["init"]);
+      yield* git(cwd, ["remote", "add", "origin", "github.com:T3Tools/t3code.git"]);
+
+      const resolver = yield* RepositoryIdentityResolver.RepositoryIdentityResolver;
+      const identity = yield* resolver.resolve(cwd);
+
+      expect(identity?.canonicalKey).toBe("github.com/t3tools/t3code");
+      expect(identity?.provider).toBe("github");
+      expect(identity?.displayName).toBe("T3Tools/t3code");
+    }).pipe(Effect.provide(RepositoryIdentityResolver.layer)),
+  );
+
   it.effect("resolves the fetch remote of a partial clone", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts b/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
index 05b6a1a8d0e42..c532d93e81ad9 100644
--- a/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
+++ b/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
@@ -199,6 +199,24 @@ it.effect("leaves a remote no integration claims unknown, with its server's addr
   }),
 );
 
+it.effect.each([
+  ["github.com:team/project.git", "github"],
+  ["gitlab.com:team/project.git", "gitlab"],
+  ["bitbucket.org:team/project.git", "bitbucket"],
+  ["code.example.test:team/project.git", "unknown"],
+] as const)(
+  "reads the host of an SSH remote that leaves its user to ssh config: %s",
+  ([url, expected]) =>
+    Effect.gen(function* () {
+      const registry = yield* makeRegistry({ remotes: [{ name: "origin", url }] });
+
+      const handle = yield* registry.resolveHandle({ cwd: "/repo" });
+
+      assert.strictEqual(handle.provider.kind, kind(expected));
+      assert.strictEqual(handle.context?.remoteUrl, url);
+    }),
+);
+
 it.effect("refines the caller-selected remote instead of choosing another configured remote", () =>
   Effect.gen(function* () {
     const registry = yield* makeRegistry({
diff --git a/apps/server/src/sourceControl/sourceControlDefinitions.test.ts b/apps/server/src/sourceControl/sourceControlDefinitions.test.ts
index e21efd8173a73..36996bdf3f370 100644
--- a/apps/server/src/sourceControl/sourceControlDefinitions.test.ts
+++ b/apps/server/src/sourceControl/sourceControlDefinitions.test.ts
@@ -10,3 +10,15 @@ it("runs a driver for every host the server and clients read, in their order", (
     sourceControlDefinitions.definitions,
   );
 });
+
+it.each([
+  "C:/repos/project",
+  "C:\\repos\\project",
+  "/srv/git/repo.git",
+  "./team:group/repo",
+  "file:///srv/git/repo.git",
+  "hg::team/repo",
+  "codecommit::us-east-1://repo",
+])("finds no host in %s, which git does not read as SSH", (remoteUrl) => {
+  expect(sourceControlDefinitions.recognizeRemote(remoteUrl)).toBeNull();
+});
diff --git a/packages/shared/src/sourceControl.test.ts b/packages/shared/src/sourceControl.test.ts
new file mode 100644
index 0000000000000..4e892996d34c4
--- /dev/null
+++ b/packages/shared/src/sourceControl.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { isSshRemoteUrl } from "./sourceControl.ts";
+
+describe("isSshRemoteUrl", () => {
+  it.each([
+    "git@github.com:owner/repo.git",
+    "ssh://git@github.com/owner/repo.git",
+    "github.com:owner/repo.git",
+    "github-work:owner/repo.git",
+  ])("reads %s as SSH", (remoteUrl) => {
+    expect(isSshRemoteUrl(remoteUrl)).toBe(true);
+  });
+
+  it.each([
+    "https://github.com/owner/repo.git",
+    "C:/repos/repo",
+    "/srv/git/repo.git",
+    "./team:group/repo",
+    "file:///srv/git/repo.git",
+    "hg::owner/repo",
+  ])("does not read %s as SSH", (remoteUrl) => {
+    expect(isSshRemoteUrl(remoteUrl)).toBe(false);
+  });
+});
diff --git a/packages/shared/src/sourceControl.ts b/packages/shared/src/sourceControl.ts
index 31fba958776e4..6be2669a1930d 100644
--- a/packages/shared/src/sourceControl.ts
+++ b/packages/shared/src/sourceControl.ts
@@ -1,6 +1,18 @@
 const SCP_SSH_REMOTE_PATTERN = /^[a-zA-Z0-9._-]+@([^:/]+):/;
+// Git reads `host:path` as SSH too, leaving the user to ssh config. A single letter is a Windows
+// drive and `::` names a remote helper.
+const USERLESS_SCP_SSH_REMOTE_PATTERN = /^([^@:/\\\s]{2,}):(?!:)\/?[^/\s]+(?:\/[^/\s]+)+\/?$/u;
+
+/** Null unless the remote is `host:path`, with no user. */
+export function userlessScpRemoteHost(remoteUrl: string): string | null {
+  return USERLESS_SCP_SSH_REMOTE_PATTERN.exec(remoteUrl.trim())?.[1] ?? null;
+}
 
 export function isSshRemoteUrl(remoteUrl: string): boolean {
   const trimmed = remoteUrl.trim();
-  return SCP_SSH_REMOTE_PATTERN.test(trimmed) || trimmed.toLowerCase().startsWith("ssh://");
+  return (
+    SCP_SSH_REMOTE_PATTERN.test(trimmed) ||
+    trimmed.toLowerCase().startsWith("ssh://") ||
+    userlessScpRemoteHost(trimmed) !== null
+  );
 }
diff --git a/packages/source-control-core/src/server/SourceControlProvider.test.ts b/packages/source-control-core/src/server/SourceControlProvider.test.ts
index 8a6b434d78403..4e20f8872c4b4 100644
--- a/packages/source-control-core/src/server/SourceControlProvider.test.ts
+++ b/packages/source-control-core/src/server/SourceControlProvider.test.ts
@@ -1,6 +1,9 @@
 import { assert, it } from "@effect/vitest";
 
-import { transportSafeSourceControlErrorValue } from "./SourceControlProvider.ts";
+import {
+  repositoryPathFromRemoteUrl,
+  transportSafeSourceControlErrorValue,
+} from "./SourceControlProvider.ts";
 
 it("removes URL credentials, query parameters, and fragments from error transport values", () => {
   assert.strictEqual(
@@ -10,3 +13,13 @@ it("removes URL credentials, query parameters, and fragments from error transpor
     "https://example.test/org/repo/pull/42",
   );
 });
+
+it.each([
+  ["git@github.com:T3Tools/t3code.git", "T3Tools/t3code"],
+  ["github.com:T3Tools/t3code.git", "T3Tools/t3code"],
+  ["gitlab.com:T3Tools/platform/t3code", "T3Tools/platform/t3code"],
+  ["https://github.com/T3Tools/t3code.git", "T3Tools/t3code"],
+  ["C:/repos/t3code", null],
+])("reads the repository path of %s", (remoteUrl, expected) => {
+  assert.strictEqual(repositoryPathFromRemoteUrl(remoteUrl), expected);
+});
diff --git a/packages/source-control-core/src/server/SourceControlProvider.ts b/packages/source-control-core/src/server/SourceControlProvider.ts
index c128b683ad731..a54e47921065c 100644
--- a/packages/source-control-core/src/server/SourceControlProvider.ts
+++ b/packages/source-control-core/src/server/SourceControlProvider.ts
@@ -106,7 +106,7 @@ export function repositoryPathFromRemoteUrl(url: string | null): string | null {
   }
 
   const match =
-    /^(?:[^@/\s]+@[^:/\s]+:|(?:ssh|https?|git):\/\/[^/]+\/)((?:[^/\s]+\/)+[^/\s]+?)(?:\.git)?\/?$/iu.exec(
+    /^(?:[^@/\s]+@[^:/\s]+:|[^@:/\\\s]{2,}:(?!:)|(?:ssh|https?|git):\/\/[^/]+\/)((?:[^/\s]+\/)+[^/\s]+?)(?:\.git)?\/?$/iu.exec(
       trimmed,
     );
   const path = match?.[1]?.trim() ?? "";
diff --git a/packages/source-control-core/src/shared/definition.ts b/packages/source-control-core/src/shared/definition.ts
index ed12267c25a09..c515aaa47db6f 100644
--- a/packages/source-control-core/src/shared/definition.ts
+++ b/packages/source-control-core/src/shared/definition.ts
@@ -10,6 +10,7 @@ import {
   TrimmedString,
 } from "@t3tools/contracts";
 import { normalizeGitRemoteUrl, parseGitRemoteRepository } from "@t3tools/shared/git";
+import { userlessScpRemoteHost } from "@t3tools/shared/sourceControl";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import * as SchemaTransformation from "effect/SchemaTransformation";
@@ -498,7 +499,7 @@ export function parseGitRemoteHost(remoteUrl: string): GitRemoteHost | null {
   const trimmed = remoteUrl.trim();
   if (trimmed.length === 0) return null;
   let host: string;
-  const scpHost = SCP_REMOTE.exec(trimmed)?.[1];
+  const scpHost = SCP_REMOTE.exec(trimmed)?.[1] ?? userlessScpRemoteHost(trimmed);
   if (scpHost) {
     host = scpHost.toLowerCase();
   } else {
diff --git a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
index e02ebd0b45527..6c7b413541d67 100644
--- a/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
+++ b/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts
@@ -20,6 +20,7 @@ import {
 import { randomUuidV4 } from "@t3tools/provider-core/server/randomUuid";
 import * as SourceControlHost from "@t3tools/source-control-core/server/SourceControlHost";
 import * as SourceControlProvider from "@t3tools/source-control-core/server/SourceControlProvider";
+import { isSshRemoteUrl } from "@t3tools/shared/sourceControl";
 import { parsePullRequestUrl } from "../shared/definition.ts";
 
 import * as GitCafeApi from "./GitCafeApi.ts";
@@ -165,7 +166,7 @@ const cloneUrls = (target: Target) => ({
 });
 
 const isSshRemote = (remoteUrl: string | undefined) =>
-  remoteUrl !== undefined && (/^ssh:\/\//iu.test(remoteUrl) || /^[^/:]+@[^/:]+:/u.test(remoteUrl));
+  remoteUrl !== undefined && isSshRemoteUrl(remoteUrl);
 
 export const make = Effect.gen(function* () {
   const api = yield* GitCafeApi.GitCafeApi;
diff --git a/packages/source-control-gitcafe/src/server/gitCafeHosts.test.ts b/packages/source-control-gitcafe/src/server/gitCafeHosts.test.ts
index 77fa0ed78609d..5fd9a25127b08 100644
--- a/packages/source-control-gitcafe/src/server/gitCafeHosts.test.ts
+++ b/packages/source-control-gitcafe/src/server/gitCafeHosts.test.ts
@@ -16,6 +16,7 @@ describe("gitCafeHosts", () => {
     ["https://staging.git.cafe/team/project.git/", "staging.git.cafe"],
     ["ssh@git.cafe:team/project.git", "git.cafe"],
     ["ssh://git@git.cafe/team/project.git", "git.cafe"],
+    ["git.cafe:team/project.git", "git.cafe"],
   ])("reads the host and repository of %s", (url, host) => {
     assert.deepStrictEqual(GitCafeHosts.parseGitCafeRemote(url), {
       host,
diff --git a/packages/source-control-gitcafe/src/server/gitCafeHosts.ts b/packages/source-control-gitcafe/src/server/gitCafeHosts.ts
index 33f3aa3204b72..9f73a6d794239 100644
--- a/packages/source-control-gitcafe/src/server/gitCafeHosts.ts
+++ b/packages/source-control-gitcafe/src/server/gitCafeHosts.ts
@@ -14,7 +14,7 @@ const REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
 const REMOTE_PATTERNS = [
   /^https?:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/iu,
   /^ssh:\/\/[^@/]+@([^/:]+)(?::\d+)?\/(.+)$/iu,
-  /^[^@/:]+@([^/:]+):(.+)$/u,
+  /^(?:[^@/:]+@)?([^/:]+):(.+)$/u,
 ];
 
 export function gitCafeRepositoryPath(path: string): string | null {
diff --git a/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts b/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
index 21c499cae9ed1..9f599794057fc 100644
--- a/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
+++ b/packages/source-control-gitlab/src/server/GitLabSourceControlProvider.ts
@@ -110,9 +110,7 @@ function refineUnknownGitLabRemote(input: SourceControlUnknownRemoteRefinementIn
 
 /** The caller refines only an identity no host recognised, so its remote is on an unknown host. */
 function unknownRemoteProvider(remoteUrl: string) {
-  // Remote host parsing does not recognize userless SCP remotes.
-  const scpHost = /^([^@:/\\\s]{2,}):\/?[^/\s]+(?:\/[^/\s]+)+$/u.exec(remoteUrl.trim())?.[1];
-  const remote = parseGitRemoteHost(scpHost ? `ssh://${scpHost}` : remoteUrl);
+  const remote = parseGitRemoteHost(remoteUrl);
   return remote === null ? null : unknownHostProvider(remote);
 }
 

From 663cd0822d7d1cf043a2233b6025824c67609efc Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:17:39 +0000
Subject: [PATCH 092/167] fix(server): terminal history keeps text with C1
 characters (#29649)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/terminal/Manager.test.ts | 22 +++++-------
 apps/server/src/terminal/Manager.ts      | 44 ++----------------------
 2 files changed, 10 insertions(+), 56 deletions(-)

diff --git a/apps/server/src/terminal/Manager.test.ts b/apps/server/src/terminal/Manager.test.ts
index c210e4a519dcd..7accdb958372f 100644
--- a/apps/server/src/terminal/Manager.test.ts
+++ b/apps/server/src/terminal/Manager.test.ts
@@ -1115,7 +1115,8 @@ it.layer(
       const { manager, ptyAdapter } = yield* createManager();
       yield* manager.open(openInput());
       const process = ptyAdapter.processes[0]!;
-      const before = "café\t界🙂\u0007\u009c\u0085";
+      // Mojibake like "â€\u009d" (for ”) carries C1 code points that libghostty prints as text.
+      const before = "café\t界🙂\u0007\u009c\u0085 â€\u009d Ð\u0090 \u009e\u009f\u009b6n";
       const after = "e\u0301\r\n";
 
       process.emitData(before);
@@ -1139,8 +1140,6 @@ it.layer(
       process.emitData("\u001b[?2026$p\u001b[?2026;2$y\u001b[>q\u001b[?u\u001b[?31u");
       process.emitData("\u001bP$q m\u001b\\\u001bP1$r0m\u001b\\");
       process.emitData("\u001bP+q544e\u001b\\\u001bP1+r544e=1b\u001b\\");
-      process.emitData("\u0090$q m\u009c\u00901$r0m\u009c");
-      process.emitData("\u0090+q544e\u009c\u00901+r544e=1b\u009c");
       process.emitData('\u001b[!p\u001b["p\u001b[4 q\u001b[u');
       process.emitData("\u001b]0;x\u001b\u001b[?2026$p");
       process.emitData("done\n");
@@ -1162,11 +1161,6 @@ it.layer(
     { name: "PM", sequence: "\u001b^unfinished" },
     { name: "APC", sequence: "\u001b_unfinished" },
     { name: "CSI", sequence: "\u001b[5" },
-    { name: "C1 OSC", sequence: "\u009d0;unfinished" },
-    { name: "C1 DCS", sequence: "\u0090unfinished" },
-    { name: "C1 PM", sequence: "\u009eunfinished" },
-    { name: "C1 APC", sequence: "\u009funfinished" },
-    { name: "C1 CSI", sequence: "\u009b5" },
   ])("keeps output after a cancelled $name sequence in history", ({ sequence }) =>
     Effect.gen(function* () {
       const { manager, ptyAdapter } = yield* createManager(10);
@@ -1200,10 +1194,10 @@ it.layer(
       process.emitData("\u001bP$q ");
       process.emitData("m\u001b");
       process.emitData("\\after ");
-      process.emitData("\u009b?3");
+      process.emitData("\u001b[?3");
       process.emitData("1uafter ");
-      process.emitData("\u0090+q544e");
-      process.emitData("\u009cafter\n");
+      process.emitData("\u001bP+q544e");
+      process.emitData("\u001b\\after\n");
 
       yield* manager.close({ threadId: "thread-1" });
 
@@ -1226,10 +1220,10 @@ it.layer(
       yield* Effect.addFinalizer(() => Effect.sync(unsubscribe));
       const sequences = [
         { prefix: `\u001b]52;c;${"YWJj".repeat(16_384)}\u001b`, terminator: "\\" },
-        { prefix: `\u0090q${"?".repeat(65_536)}`, terminator: "\u009c" },
+        { prefix: `\u001bPq${"?".repeat(65_536)}`, terminator: "\u001b\\" },
       ];
-      const stripped = "\u001b]11;?\u0007\u0090$q m\u009c";
-      const preserved = "\u001b[31m\u009d52;c;YWJj\u009c";
+      const stripped = "\u001b]11;?\u0007\u001bP$q m\u001b\\";
+      const preserved = "\u001b[31m\u001b]52;c;YWJj\u0007";
       const expected =
         sequences.map(({ prefix, terminator }) => prefix + terminator + preserved).join("") +
         "done\n";
diff --git a/apps/server/src/terminal/Manager.ts b/apps/server/src/terminal/Manager.ts
index 09a881d15ea43..6a661db4e09d6 100644
--- a/apps/server/src/terminal/Manager.ts
+++ b/apps/server/src/terminal/Manager.ts
@@ -1174,7 +1174,8 @@ function findEscapeSequenceEndIndex(input: string, start: number): number | null
   return isEscapeFinalByte(input.charCodeAt(cursor)) ? cursor + 1 : start + 1;
 }
 
-const HISTORY_SEQUENCE_START = /[\u001b\u0090\u009b\u009d\u009e\u009f]/;
+// libghostty prints UTF-8 C1 code points (U+0080-U+009F) as text, so only ESC starts a sequence.
+const HISTORY_SEQUENCE_START = /\u001b/;
 const NEXT_HISTORY_SEQUENCE_START = new RegExp(HISTORY_SEQUENCE_START.source, "g");
 
 function sanitizeTerminalHistoryChunk(
@@ -1259,47 +1260,6 @@ function sanitizeTerminalHistoryChunk(
       continue;
     }
 
-    if (codePoint === 0x9b) {
-      let cursor = index + 1;
-      while (cursor < input.length) {
-        const cancelled = isControlSequenceCancel(input.charCodeAt(cursor));
-        if (cancelled || isCsiFinalByte(input.charCodeAt(cursor))) {
-          const sequence = input.slice(index, cursor + 1);
-          const body = input.slice(index + 1, cursor);
-          if (cancelled || !shouldStripCsiSequence(body, input[cursor] ?? "")) {
-            append(sequence);
-          }
-          index = cursor + 1;
-          break;
-        }
-        cursor += 1;
-      }
-      if (cursor >= input.length) {
-        return { visibleText, pendingControlSequence: input.slice(index) };
-      }
-      continue;
-    }
-
-    if (codePoint === 0x9d || codePoint === 0x90 || codePoint === 0x9e || codePoint === 0x9f) {
-      const terminatorIndex = findStringTerminatorIndex(
-        input,
-        Math.max(index + 1, pendingScanStart),
-      );
-      if (terminatorIndex === null) {
-        return { visibleText, pendingControlSequence: input.slice(index) };
-      }
-      const sequence = input.slice(index, terminatorIndex);
-      const content = stripStringTerminator(input.slice(index + 1, terminatorIndex));
-      const strip =
-        (codePoint === 0x9d && shouldStripOscSequence(content)) ||
-        (codePoint === 0x90 && shouldStripDcsSequence(content));
-      if (!strip) {
-        append(sequence);
-      }
-      index = terminatorIndex;
-      continue;
-    }
-
     // One slice per printable run: every chunk of coloured output reaches this loop.
     NEXT_HISTORY_SEQUENCE_START.lastIndex = index + 1;
     const nextSequenceStart = NEXT_HISTORY_SEQUENCE_START.exec(input)?.index ?? input.length;

From ce89cd1cc38ad83f058a2b87e35510feca122a94 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:22:10 +0000
Subject: [PATCH 093/167] fix(server): worktree handoff follows the project's
 start-from-origin setting (#29810)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../server/src/mcp/WorktreeMcpService.test.ts | 22 ++++++++++++++++++-
 apps/server/src/mcp/WorktreeMcpService.ts     | 18 ++++++++++-----
 2 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/mcp/WorktreeMcpService.test.ts b/apps/server/src/mcp/WorktreeMcpService.test.ts
index 51c86f3e3a165..eb8b4b5b1e31c 100644
--- a/apps/server/src/mcp/WorktreeMcpService.test.ts
+++ b/apps/server/src/mcp/WorktreeMcpService.test.ts
@@ -96,6 +96,7 @@ interface HarnessOptions {
   readonly currentBranch?: string | null;
   readonly notARepo?: boolean;
   readonly newWorktreesStartFromOrigin?: boolean;
+  readonly projectNewWorktreesStartFromOrigin?: boolean;
   readonly setupScript?: "started" | "no-script" | "fails" | "dies";
   readonly dispatchFails?: boolean;
   readonly dispatchDies?: boolean;
@@ -302,6 +303,15 @@ const makeHarness = (options: HarnessOptions = {}) => {
         } satisfies Partial<ProjectService.ProjectService["Service"]>),
         ServerSettings.layerTest({
           newWorktreesStartFromOrigin: options.newWorktreesStartFromOrigin ?? false,
+          ...(options.projectNewWorktreesStartFromOrigin === undefined
+            ? {}
+            : {
+                projectSettingsOverrides: {
+                  [projectId]: {
+                    newWorktreesStartFromOrigin: options.projectNewWorktreesStartFromOrigin,
+                  },
+                },
+              }),
         }),
         Layer.mock(GitWorkflowService.GitWorkflowService)({
           listRefs,
@@ -522,6 +532,15 @@ describe("t3_worktree_handoff", () => {
     });
   });
 
+  it.effect("defaults startFromOrigin to the project's override", () => {
+    const harness = makeHarness({ projectNewWorktreesStartFromOrigin: true });
+    return Effect.gen(function* () {
+      const result = yield* runHandoff(harness, { branch: "feature/project-origin" });
+      expect(harness.fetchWorktreeBaseCommit).toHaveBeenCalled();
+      expect(result.startedFromOrigin).toBe(true);
+    });
+  });
+
   it.effect("removes the created worktree when the thread update dies with a defect", () => {
     const harness = makeHarness({ dispatchDies: true });
     return Effect.gen(function* () {
@@ -679,6 +698,7 @@ describe("t3_worktree_status", () => {
         worktreePath: "/worktrees/project/existing",
         branch: "feature/existing",
       },
+      projectNewWorktreesStartFromOrigin: true,
     });
     return Effect.gen(function* () {
       const result = yield* runStatus(harness);
@@ -686,7 +706,7 @@ describe("t3_worktree_status", () => {
         attached: true,
         worktreePath: "/worktrees/project/existing",
         branch: "feature/existing",
-        defaultStartFromOrigin: false,
+        defaultStartFromOrigin: true,
       });
     });
   });
diff --git a/apps/server/src/mcp/WorktreeMcpService.ts b/apps/server/src/mcp/WorktreeMcpService.ts
index 8a2231f6e4df4..bffae891d5f23 100644
--- a/apps/server/src/mcp/WorktreeMcpService.ts
+++ b/apps/server/src/mcp/WorktreeMcpService.ts
@@ -9,6 +9,7 @@ import {
   type WorktreeMcpSetupScriptStatus,
   type WorktreeMcpStatusResult,
 } from "@t3tools/contracts";
+import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as SecureRandom from "effect/crypto/SecureRandom";
@@ -116,10 +117,14 @@ const make = Effect.gen(function* () {
       ),
     );
 
-  const readDefaultStartFromOrigin = serverSettings.getSettings.pipe(
-    Effect.map((settings) => settings.newWorktreesStartFromOrigin),
-    asOperationFailed("Unable to read server settings"),
-  );
+  const readDefaultStartFromOrigin = (projectId: ProjectId) =>
+    serverSettings.getSettings.pipe(
+      Effect.map(
+        (settings) =>
+          resolveProjectSettings(settings, projectId).settings.newWorktreesStartFromOrigin,
+      ),
+      asOperationFailed("Unable to read server settings"),
+    );
 
   const handoffIds = (scope: McpThreadInvocationScope) =>
     random.uuidV4().pipe(
@@ -205,7 +210,8 @@ const make = Effect.gen(function* () {
       baseRef = localStatus.refName;
     }
 
-    const startFromOrigin = input.startFromOrigin ?? (yield* readDefaultStartFromOrigin);
+    const startFromOrigin =
+      input.startFromOrigin ?? (yield* readDefaultStartFromOrigin(project.id));
 
     let worktreeBaseRef = baseRef;
     let baseRefName = baseRef;
@@ -415,7 +421,7 @@ const make = Effect.gen(function* () {
       const projection = yield* loadThread(scope);
       const project = yield* loadProject(scope, projection.thread.projectId);
 
-      const defaultStartFromOrigin = yield* readDefaultStartFromOrigin;
+      const defaultStartFromOrigin = yield* readDefaultStartFromOrigin(project.id);
 
       const result: WorktreeMcpStatusResult = {
         attached: projection.thread.worktreePath !== null,

From 4461b84a9df39758ecc664fb9ff8fccda8c1bac8 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:22:27 +0000
Subject: [PATCH 094/167] fix(server): review keeps tracked changes when
 untracked files overflow the listing (#29615)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 57 +++++++++++---------
 apps/server/src/vcs/GitVcsDriverCore.ts      |  7 +--
 2 files changed, 33 insertions(+), 31 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 80d89ca19d4ee..922d14f2682ea 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -2545,33 +2545,40 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
       }),
     );
 
-    it.effect("keeps tracked changes visible when untracked discovery fails", () =>
-      Effect.gen(function* () {
-        const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
-        const failingLsFilesSpawner = ChildProcessSpawner.make((command) => {
-          if (!ChildProcess.isStandardCommand(command)) {
-            return Effect.die("expected a standard Git command");
-          }
-          return command.args[0] === "ls-files" && command.args[1] === "--others"
-            ? Effect.succeed(makeNonRepositoryHandle())
-            : delegate.spawn(command);
-        });
-        const driver = yield* makeGitVcsDriverCore().pipe(
-          Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, failingLsFilesSpawner),
-          Effect.provide(layerServerConfig),
-        );
-        const cwd = yield* makeTmpDir();
-        yield* initRepoWithCommit(cwd).pipe(
-          Effect.provideService(GitVcsDriver.GitVcsDriver, driver),
-        );
-        yield* writeTextFile(cwd, "README.md", "# tracked change\n");
+    it.effect.each(["fails", "exceeds the output limit"] as const)(
+      "keeps tracked changes visible when untracked discovery %s",
+      (scenario) =>
+        Effect.gen(function* () {
+          const delegate = yield* ChildProcessSpawner.ChildProcessSpawner;
+          const failingLsFilesSpawner = ChildProcessSpawner.make((command) => {
+            if (!ChildProcess.isStandardCommand(command)) {
+              return Effect.die("expected a standard Git command");
+            }
+            if (command.args[0] !== "ls-files" || command.args[1] !== "--others") {
+              return delegate.spawn(command);
+            }
+            return Effect.succeed(
+              scenario === "fails"
+                ? makeNonRepositoryHandle()
+                : makeSuccessfulHandle("a".repeat(16 * 1024 * 1024 + 1)),
+            );
+          });
+          const driver = yield* makeGitVcsDriverCore().pipe(
+            Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, failingLsFilesSpawner),
+            Effect.provide(layerServerConfig),
+          );
+          const cwd = yield* makeTmpDir();
+          yield* initRepoWithCommit(cwd).pipe(
+            Effect.provideService(GitVcsDriver.GitVcsDriver, driver),
+          );
+          yield* writeTextFile(cwd, "README.md", "# tracked change\n");
 
-        const preview = yield* driver.getReviewDiffPreview({ cwd, ignoreWhitespace: false });
-        const diff = preview.sources.find((source) => source.kind === "working-tree")?.diff ?? "";
+          const preview = yield* driver.getReviewDiffPreview({ cwd, ignoreWhitespace: false });
+          const diff = preview.sources.find((source) => source.kind === "working-tree")?.diff ?? "";
 
-        assert.include(diff, "-# test");
-        assert.include(diff, "+# tracked change");
-      }),
+          assert.include(diff, "-# test");
+          assert.include(diff, "+# tracked change");
+        }),
     );
 
     it.effect.each([
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index a1fd6e235cc0f..7b8d34df8cb2b 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -3118,12 +3118,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       cwd,
       ["ls-files", "--others", "--exclude-standard", "-z", "--", ...pathArgs],
       { maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
-    ).pipe(
-      Effect.catchIf(
-        (error) => error.outputLength === undefined,
-        () => Effect.succeed(null),
-      ),
-    );
+    ).pipe(Effect.orElseSucceed(() => null));
     if (untracked === null) return null;
     const paths = splitNullSeparatedGitStdoutPaths(untracked).filter(
       (candidate) => onlyPath === undefined || candidate === onlyPath,

From e91595ba0a1a52623bd96a3f63a625c9e14c91a6 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:22:44 +0000
Subject: [PATCH 095/167] fix(server): browser setup advice names the server's
 T3 home (#29646)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/htmlRender/HtmlRender.test.ts | 29 +++++++++++++++++++
 apps/server/src/htmlRender/HtmlRender.ts      |  6 +++-
 apps/server/src/preview/ServerBrowser.ts      |  6 +++-
 3 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/htmlRender/HtmlRender.test.ts b/apps/server/src/htmlRender/HtmlRender.test.ts
index 1916327672516..7d555c46a4e6c 100644
--- a/apps/server/src/htmlRender/HtmlRender.test.ts
+++ b/apps/server/src/htmlRender/HtmlRender.test.ts
@@ -22,6 +22,7 @@ import * as ServerConfig from "../config.ts";
 import * as HtmlRender from "./HtmlRender.ts";
 import { HtmlRenderBrowserError } from "./headlessChrome.ts";
 import * as PreviewBrowser from "../preview/PreviewBrowser.ts";
+import * as PreviewBrowserHost from "../preview/PreviewBrowserHost.ts";
 
 const TEST_BROWSER_ENV = "T3CODE_TEST_HEADLESS_SHELL";
 
@@ -365,6 +366,34 @@ fs.createReadStream(null, { fd: 3 }).on("end", quit).on("data", (chunk) => {
           expect(Option.getOrElse(exitedBy, () => "killed by a signal")).toBe("asked to close");
         }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
       );
+
+      it.live("names this server's home in the browser setup command", () =>
+        Effect.gen(function* () {
+          const fileSystem = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const directory = yield* fileSystem.makeTempDirectoryScoped({
+            prefix: "t3-fake-browser-",
+          });
+          const executable = path.join(directory, "chrome-headless-shell");
+          yield* fileSystem.writeFileString(
+            executable,
+            `#!${process.execPath}\nprocess.stderr.write(${JSON.stringify(PreviewBrowserHost.NO_SANDBOX_SIGNATURE)});\nprocess.exit(1);\n`,
+            { mode: 0o755 },
+          );
+
+          const { error, baseDir } = yield* Effect.gen(function* () {
+            const { baseDir } = yield* ServerConfig.ServerConfig;
+            const htmlRender = yield* HtmlRender.HtmlRender;
+            const error = yield* htmlRender.preview({ html: "<p>x</p>" }).pipe(Effect.flip);
+            return { error, baseDir };
+          }).pipe(
+            Effect.provide(layerHtmlRender(executable)),
+            Effect.provideService(HostProcess.UserId, 1000),
+          );
+          expect(error).toBeInstanceOf(PreviewBrowserHost.PreviewBrowserSandboxError);
+          expect(error.message).toContain(`browser setup --base-dir ${baseDir}`);
+        }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+      );
     },
   );
 
diff --git a/apps/server/src/htmlRender/HtmlRender.ts b/apps/server/src/htmlRender/HtmlRender.ts
index 44ea627ceab72..d1330cc679ab5 100644
--- a/apps/server/src/htmlRender/HtmlRender.ts
+++ b/apps/server/src/htmlRender/HtmlRender.ts
@@ -340,7 +340,11 @@ const make = Effect.gen(function* () {
   const browsers = yield* Semaphore.make(MAX_CONCURRENT_BROWSERS);
   // Keep Chrome sandboxed unless explicitly disabled; root must opt out to run.
   const noSandbox = PreviewBrowserHost.sandboxDisabled(yield* HostProcess.Environment);
-  const setupCommand = yield* resolveRootCliCommand(PreviewBrowserHost.SETUP_SUBCOMMAND);
+  // sudo resets the environment, so the command has to name this server's home.
+  const setupCommand = yield* resolveRootCliCommand(PreviewBrowserHost.SETUP_SUBCOMMAND, [
+    "--base-dir",
+    config.baseDir,
+  ]);
 
   const launching = <A>(
     executable: string,
diff --git a/apps/server/src/preview/ServerBrowser.ts b/apps/server/src/preview/ServerBrowser.ts
index 7444b84f906e3..6c147bbf9fe66 100644
--- a/apps/server/src/preview/ServerBrowser.ts
+++ b/apps/server/src/preview/ServerBrowser.ts
@@ -469,7 +469,11 @@ const make = Effect.gen(function* () {
   const runFork = Effect.runForkWith(yield* Effect.context<never>());
   const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
   const launchServices = yield* Effect.context<ChildProcessSpawner.ChildProcessSpawner>();
-  const setupCommand = yield* resolveRootCliCommand(PreviewBrowserHost.SETUP_SUBCOMMAND);
+  // sudo resets the environment, so the command has to name this server's home.
+  const setupCommand = yield* resolveRootCliCommand(PreviewBrowserHost.SETUP_SUBCOMMAND, [
+    "--base-dir",
+    config.baseDir,
+  ]);
   const agentScope = yield* AgentScope;
   const launchersDir = NodePath.join(config.stateDir, "server-browser", "launchers");
 

From 48e73f6ca905f87e3432b19112c704d68fe9319c Mon Sep 17 00:00:00 2001
From: Johan Vaz <v.johan2234@gmail.com>
Date: Wed, 4 Nov 2026 07:23:01 +0800
Subject: [PATCH 096/167] fix: honor generic MIME aliases in attachment
 previews (#29360)

---
 packages/shared/src/filePreview.test.ts | 22 ++++++++++++++++++++--
 packages/shared/src/filePreview.ts      |  4 ++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/packages/shared/src/filePreview.test.ts b/packages/shared/src/filePreview.test.ts
index 9024954ebf1ad..d23a82bc2042e 100644
--- a/packages/shared/src/filePreview.test.ts
+++ b/packages/shared/src/filePreview.test.ts
@@ -24,7 +24,16 @@ describe("workspace file previews", () => {
     ["db", "sqlite", "application/vnd.sqlite3"],
   ])("recognizes binary preview %s", (extension, kind, mimeType) => {
     const name = `files#draft/sample.${extension.toUpperCase()}`;
-    expect(filePreviewKind({ name, mimeType: "application/octet-stream" })).toBe(kind);
+    for (const genericMime of [
+      "",
+      "application/octet-stream",
+      "binary/octet-stream",
+      "application/unknown",
+      " APPLICATION/UNKNOWN ; charset=utf-8",
+      "text/plain",
+    ]) {
+      expect(filePreviewKind({ name, mimeType: genericMime })).toBe(kind);
+    }
     expect(filePreviewKind({ name: "download", mimeType })).toBe(kind);
     expect(isWorkspacePreviewEntryPath(name)).toBe(true);
     expect(isWorkspacePreviewEntryPath(`${name}?download=1`)).toBe(false);
@@ -79,7 +88,16 @@ describe("workspace file previews", () => {
     ["analysis.ipynb", "ipynb", "application/x-ipynb+json"],
   ])("recognizes Office assets at literal path %s", (name, kind, mimeType) => {
     expect(officePreviewKind({ name })).toBe(kind);
-    expect(filePreviewKind({ name, mimeType: "application/octet-stream" })).toBe(kind);
+    for (const genericMime of [
+      "",
+      "application/octet-stream",
+      "binary/octet-stream",
+      "application/unknown",
+      " APPLICATION/UNKNOWN ; charset=utf-8",
+      "text/plain",
+    ]) {
+      expect(filePreviewKind({ name, mimeType: genericMime })).toBe(kind);
+    }
     expect(isWorkspacePreviewEntryPath(name)).toBe(true);
     expect(hostPreviewMimeTypeFromExtension(`.${kind}`)).toBe(mimeType);
     expect(filePreviewKind({ name: "download", mimeType })).toBe(kind);
diff --git a/packages/shared/src/filePreview.ts b/packages/shared/src/filePreview.ts
index 2cd77e2e59779..ef8d6f2d0cff2 100644
--- a/packages/shared/src/filePreview.ts
+++ b/packages/shared/src/filePreview.ts
@@ -126,7 +126,7 @@ export function binaryPreviewKind(file: {
     ].includes(mime)
   )
     return "archive";
-  if (mime && mime !== "application/octet-stream" && mime !== "text/plain") return null;
+  if (mime && !GENERIC_MIME_TYPES.has(mime) && mime !== "text/plain") return null;
   const extension = file.name.slice(file.name.lastIndexOf(".")).toLowerCase();
   const inferred = BINARY_MIME_TYPES.get(extension);
   return inferred === "application/vnd.sqlite3" ? "sqlite" : inferred ? "archive" : null;
@@ -158,7 +158,7 @@ export function officePreviewKind(file: {
     if (mime === OFFICE_MIME_TYPES[kind]) return kind;
     if (
       (!mime ||
-        mime === "application/octet-stream" ||
+        GENERIC_MIME_TYPES.has(mime) ||
         mime === "text/plain" ||
         (kind === "ipynb" && mime === "application/json")) &&
       file.name.toLowerCase().endsWith(`.${kind}`)

From ee265cc53999dbc8f16b75398088780f85f4d166 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:23:18 +0000
Subject: [PATCH 097/167] fix(client-runtime): terminals fit their pane again
 after a reconnect (#29696)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/state/terminalSession.test.ts           |  4 ++++
 .../client-runtime/src/state/terminalSession.ts | 17 +++++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/packages/client-runtime/src/state/terminalSession.test.ts b/packages/client-runtime/src/state/terminalSession.test.ts
index 7cbcd14f819fb..4eef70e099750 100644
--- a/packages/client-runtime/src/state/terminalSession.test.ts
+++ b/packages/client-runtime/src/state/terminalSession.test.ts
@@ -245,10 +245,14 @@ describe("terminal session reducers", () => {
       snapshot: BASE_SNAPSHOT,
     });
     let cursor = readTerminalOutputUpdate(state.output, INITIAL_TERMINAL_OUTPUT_CURSOR).cursor;
+    const attachedGeneration = state.output.generation;
+    // A socket reconnect resubscribes the same stream, so the server's new snapshot gets no seed.
     state = applyTerminalAttachStreamEvent(state, { type: "snapshot", snapshot: BASE_SNAPSHOT });
     const repeated = readTerminalOutputUpdate(state.output, cursor);
     expect(repeated).toMatchObject({ type: "reset", data: "hello" });
     expect(state.version).toBe(2);
+    // Viewers replay their measured grid once per generation; the new attachment holds the old size.
+    expect(state.output.generation).not.toBe(attachedGeneration);
     cursor = repeated.cursor;
 
     state = applyTerminalAttachStreamEvent(state, {
diff --git a/packages/client-runtime/src/state/terminalSession.ts b/packages/client-runtime/src/state/terminalSession.ts
index f67184ef710b6..e03dc30507685 100644
--- a/packages/client-runtime/src/state/terminalSession.ts
+++ b/packages/client-runtime/src/state/terminalSession.ts
@@ -162,12 +162,21 @@ export function applyTerminalAttachStreamEvent(
   maxBufferBytes = DEFAULT_MAX_TERMINAL_BUFFER_BYTES,
 ): TerminalBufferState {
   switch (event.type) {
-    case "snapshot":
+    case "snapshot": {
+      if (current.version === 0) {
+        return terminalBufferStateFromSnapshot(event.snapshot, maxBufferBytes, current);
+      }
+      // A later snapshot is a new server attachment, as after a socket reconnect. It starts a
+      // new generation because viewers replay their measured grid once per generation.
+      const reattached = {
+        ...current,
+        output: { ...current.output, generation: ++terminalAttachGeneration },
+      };
       return {
-        ...terminalBufferStateFromSnapshot(event.snapshot, maxBufferBytes, current),
-        lifecycleVersion:
-          current.version === 0 ? current.lifecycleVersion : current.lifecycleVersion + 1,
+        ...terminalBufferStateFromSnapshot(event.snapshot, maxBufferBytes, reattached),
+        lifecycleVersion: current.lifecycleVersion + 1,
       };
+    }
     case "restarted":
       return {
         ...terminalBufferStateFromSnapshot(event.snapshot, maxBufferBytes, current),

From c64117dc8ae52ebb613b861f3559f918e92809e6 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:23:39 +0000
Subject: [PATCH 098/167] fix(server): Run now on a scheduled task says why it
 was refused (#29620)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/scheduledTasks/ScheduledTaskService.test.ts | 2 ++
 apps/server/src/scheduledTasks/ScheduledTaskService.ts      | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.test.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.test.ts
index b37932dc1c9eb..c7b0e31f4f04d 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.test.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.test.ts
@@ -399,6 +399,8 @@ it.effect("thread cleanup notifies subscribers and a finishing run cannot recrea
       const run = yield* service.runNow({ id: task.id }).pipe(Effect.forkChild);
       yield* Deferred.await(started);
       yield* Deferred.await(running);
+      const refused = yield* service.runNow({ id: task.id }).pipe(Effect.flip);
+      assert.equal(refused.message, "Schedule task is already running.");
       yield* service.deleteForThread(threadId);
       yield* Deferred.await(removed);
       yield* Deferred.succeed(release, undefined);
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
index afeb73de3df96..8e859d98a368f 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
@@ -1494,7 +1494,9 @@ export const layer = Layer.effect(
       }
       return yield* runTask(task, "manual").pipe(
         Effect.mapError((cause) =>
-          taskError("Could not run schedule task.", { taskId: input.id, cause }),
+          isScheduledTaskError(cause)
+            ? cause
+            : taskError("Could not run schedule task.", { taskId: input.id, cause }),
         ),
       );
     });

From 8ca8fddbeba83937b28ef6585de03e98e6e70f97 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:23:59 +0000
Subject: [PATCH 099/167] fix(server): a preview_open whose first load fails no
 longer leaves a hidden tab behind (#29865)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/preview/ServerBrowser.test.ts | 51 ++++++++++++++++++-
 apps/server/src/preview/ServerBrowser.ts      | 11 +++-
 2 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/preview/ServerBrowser.test.ts b/apps/server/src/preview/ServerBrowser.test.ts
index 7111b17eb5b28..90b1fc440720e 100644
--- a/apps/server/src/preview/ServerBrowser.test.ts
+++ b/apps/server/src/preview/ServerBrowser.test.ts
@@ -481,7 +481,8 @@ it.live("tells the desktop once per thread when its agent turns start and end",
 it.live("preview_open reports its navigation timeout instead of the request budget", () =>
   Effect.scoped(
     Effect.gen(function* () {
-      const { broker } = yield* ready;
+      const { broker, tabId } = yield* ready;
+      const manager = yield* Manager.PreviewManager;
       initialNavigation = async () => {
         throw Object.assign(new Error("page.goto: Timeout 15000ms exceeded."), {
           name: "TimeoutError",
@@ -505,6 +506,54 @@ it.live("preview_open reports its navigation timeout instead of the request budg
         timeoutMs: 15_000,
       });
       expect(error.message).toBe("Preview automation open timed out after 15000ms.");
+      // The failed open returned no tabId, so its tab must not linger and block later opens.
+      const { sessions } = yield* manager.list({ threadId: scope.thread.threadId });
+      expect(sessions.map((session) => session.tabId)).toEqual([tabId]);
+      expect(contexts[1]!.page.close).toHaveBeenCalled();
+    }),
+  ).pipe(Effect.provide(layer)),
+);
+
+it.live("an initial download stays available after preview_open reports the navigation error", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { broker, tabId } = yield* ready;
+      const manager = yield* Manager.PreviewManager;
+      const released = Promise.withResolvers<void>();
+      initialNavigation = async () => {
+        contexts[1]!.page.emit("download", {
+          failure: async () => null,
+          delete: async () => released.resolve(),
+          saveAs: (path: string) => NodeFSP.writeFile(path, "a,b"),
+          suggestedFilename: () => "report.csv",
+          url: () => "http://localhost:1337/report.csv",
+        });
+        throw new Error("page.goto: Download is starting");
+      };
+      const error = yield* broker
+        .invoke<PreviewAutomationStatus>({
+          scope,
+          operation: "open",
+          input: { url: "http://localhost:1337/report.csv", reuseExistingTab: false, open: false },
+        })
+        .pipe(Effect.flip);
+      expect(error.message).toContain("Download is starting");
+      yield* Effect.promise(() => released.promise);
+      const { sessions } = yield* manager.list({ threadId: scope.thread.threadId });
+      expect(sessions).toHaveLength(2);
+      const downloadTabId = PreviewTabId.make(sessions.find((tab) => tab.tabId !== tabId)!.tabId);
+      const status = yield* broker.invoke<PreviewAutomationStatus>({
+        scope,
+        tabId: downloadTabId,
+        operation: "status",
+        input: {},
+      });
+      expect(status.downloads).toEqual([
+        expect.objectContaining({ fileName: "report.csv", sizeBytes: 3 }),
+      ]);
+      expect(yield* (yield* FileSystem.FileSystem).readFileString(status.downloads![0]!.path)).toBe(
+        "a,b",
+      );
     }),
   ).pipe(Effect.provide(layer)),
 );
diff --git a/apps/server/src/preview/ServerBrowser.ts b/apps/server/src/preview/ServerBrowser.ts
index 6c147bbf9fe66..5206e67ddadd9 100644
--- a/apps/server/src/preview/ServerBrowser.ts
+++ b/apps/server/src/preview/ServerBrowser.ts
@@ -2013,7 +2013,16 @@ const make = Effect.gen(function* () {
             if (existing) {
               if (url) await navigate(tab, url, "load", navigationTimeout);
             } else {
-              await tab.initialNavigation;
+              // A failed open returns no tabId; a leftover hidden tab would block later reuse.
+              await tab.initialNavigation?.catch(async (cause: unknown) => {
+                // Playwright rejects downloads too; their tab must survive to save the file.
+                if (cause instanceof Error && cause.message.includes("Download is starting")) {
+                  throw cause;
+                }
+                await runPromise(manager.close({ threadId: tab.threadId, tabId: tab.tabId }));
+                dropTab(tab, false);
+                throw cause;
+              });
             }
             const reveal = open.open ?? open.show;
             if (reveal !== false) {

From 47057a3cac9db2c9a0b34510ea5a258bac3fb3a9 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:24:18 +0000
Subject: [PATCH 100/167] fix(cursor): Cursor text generation names usage-limit
 failures (#29748)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/server/textGeneration.test.ts         | 28 +++++++++++++------
 .../src/server/textGeneration.ts              |  6 +++-
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/packages/provider-cursor/src/server/textGeneration.test.ts b/packages/provider-cursor/src/server/textGeneration.test.ts
index 1085a9564175d..bfb02df390d83 100644
--- a/packages/provider-cursor/src/server/textGeneration.test.ts
+++ b/packages/provider-cursor/src/server/textGeneration.test.ts
@@ -194,14 +194,28 @@ describe("CursorTextGeneration", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
-  it.effect.each(["error", "cancelled"] as const)(
-    "rejects a %s Cursor SDK run that includes valid title JSON",
-    (status) =>
+  it.effect.each([
+    {
+      status: "error",
+      error: { message: "Raw Cursor usage text", code: "PRO_USER_USAGE_LIMIT" },
+      detail:
+        "Cursor usage limit reached. Try again later or choose another text-generation provider.",
+    },
+    {
+      status: "error",
+      error: { message: "Raw Cursor backend text", code: "internal" },
+      detail: "Cursor SDK request finished with an error.",
+    },
+    { status: "cancelled", error: undefined, detail: "Cursor SDK request was cancelled." },
+  ] as const)(
+    "rejects a $status Cursor SDK run ($error.code) that includes valid title JSON",
+    ({ status, error, detail }) =>
       Effect.gen(function* () {
         const promptResult = {
           id: "run-cursor-partial-title-test",
           status,
           result: '{"title":"Partial title from a failed run."}',
+          ...(error ? { error } : {}),
         } satisfies RunResult;
         cursorSdkMock.prompt.mockResolvedValueOnce(promptResult);
         const generation = yield* makeCursorTextGeneration(cursorSettings, {
@@ -219,11 +233,9 @@ describe("CursorTextGeneration", () => {
         );
         expect(failure).toBeInstanceOf(TextGenerationError);
         expect(failure.operation).toBe("generateThreadTitle");
-        expect(failure.detail).toBe(
-          status === "cancelled"
-            ? "Cursor SDK request was cancelled."
-            : "Cursor SDK request finished with an error.",
-        );
+        expect(failure.detail).toBe(detail);
+        expect(failure.message).not.toContain("Raw Cursor");
+        expect(failure.cause).toBe(error);
         expect(cursorSdkMock.close).toHaveBeenCalledOnce();
       }).pipe(Effect.provide(layerTest)),
   );
diff --git a/packages/provider-cursor/src/server/textGeneration.ts b/packages/provider-cursor/src/server/textGeneration.ts
index fc62b779c4984..fa8228d0ba012 100644
--- a/packages/provider-cursor/src/server/textGeneration.ts
+++ b/packages/provider-cursor/src/server/textGeneration.ts
@@ -11,6 +11,7 @@ import type { CursorSettings } from "../settings.ts";
 import * as TextGenerationOperations from "@t3tools/provider-core/server/textGenerationOperations";
 import { cursorSdkModelSelection } from "./sdkModel.ts";
 import type { CursorAuth } from "./auth.ts";
+import * as CursorAgentSdk from "./CursorAgentSdk.ts";
 import * as CursorSdk from "./CursorSdk.ts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 
@@ -23,7 +24,9 @@ function cursorSdkResultDetail(result: RunResult): string {
     case "cancelled":
       return "Cursor SDK request was cancelled.";
     case "error":
-      return "Cursor SDK request finished with an error.";
+      return CursorAgentSdk.isCursorUsageLimitError(result.error)
+        ? "Cursor usage limit reached. Try again later or choose another text-generation provider."
+        : "Cursor SDK request finished with an error.";
     case "finished":
       return "Cursor SDK returned empty output.";
   }
@@ -182,6 +185,7 @@ export const makeCursorTextGeneration = Effect.fn("makeCursorTextGeneration")(fu
         return yield* new TextGenerationError({
           operation,
           detail: cursorSdkResultDetail(promptResult),
+          ...(promptResult.error ? { cause: promptResult.error } : {}),
         });
       }
 

From 54223c32e07ffd356e6a48246fa8a33b0fbde087 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:24:36 +0000
Subject: [PATCH 101/167] fix(server): review diffs keep working with untracked
 files outside the sparse cone (#29880)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 21 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 922d14f2682ea..1cecf781bf721 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -2489,6 +2489,27 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
       }),
     );
 
+    it.effect("reviews untracked files outside the sparse-checkout cone", () =>
+      Effect.gen(function* () {
+        const cwd = yield* makeTmpDir();
+        yield* initRepoWithCommit(cwd);
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+        yield* writeTextFile(cwd, "excluded/tracked.ts", "tracked\n");
+        yield* git(cwd, ["add", "excluded/tracked.ts"]);
+        yield* git(cwd, ["commit", "-m", "add excluded directory"]);
+        yield* git(cwd, ["sparse-checkout", "set", "--cone", "included"]);
+        yield* writeTextFile(cwd, "excluded/new.ts", "outside the cone\n");
+
+        const preview = yield* driver.getReviewDiffPreview({ cwd, ignoreWhitespace: false });
+
+        const source = preview.sources.find((candidate) => candidate.kind === "working-tree")!;
+        assert.deepStrictEqual(source.files, [
+          { path: "excluded/new.ts", previousPath: null, additions: 1, deletions: 0 },
+        ]);
+        assert.include(source.diff, "+outside the cone");
+      }),
+    );
+
     it.effect("detects an unstaged rename with edits without mutating a split index", () =>
       Effect.gen(function* () {
         const cwd = yield* makeTmpDir();
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 7b8d34df8cb2b..107544eacc810 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -3087,6 +3087,9 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         // Avoid redundant tracked-entry pathspec matching in this disposable index.
         "-c",
         "core.preloadIndex=false",
+        // Sparse checkout refuses to add untracked files outside the cone, failing the whole review.
+        "-c",
+        "core.sparseCheckout=false",
         "--literal-pathspecs",
         "add",
         "--intent-to-add",

From 136fe433681740cd2b4de102b64ba4a7d80f2b4b Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:24:52 +0000
Subject: [PATCH 102/167] fix(opencode): nested custom commands like
 /git/commit run as commands (#29765)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts    | 6 +++---
 packages/provider-opencode/src/server/adapter.test.ts       | 6 +++---
 packages/provider-opencode/src/server/adapter.ts            | 2 +-
 packages/provider-opencode/src/server/v2/adapter.ts         | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
index c334af4fad113..10006c532e92c 100644
--- a/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
@@ -2453,7 +2453,7 @@ it.layer(McpProviderSessions.layer)("OpenCode2 adapter", (it) => {
       // session.command returns 204 without an inbox id; the stream drops before session.inbox.enqueued provides it.
       const { runtime, thread } = yield* resumed([
         out("command.list", "<any>"),
-        reply("command.list", { location: { directory: WORK }, data: [{ name: "hello" }] }),
+        reply("command.list", { location: { directory: WORK }, data: [{ name: "git/hello" }] }),
         out("message.list", { sessionID: SESSION, order: "desc", limit: "1" }),
         reply("message.list", {
           data: [
@@ -2461,7 +2461,7 @@ it.layer(McpProviderSessions.layer)("OpenCode2 adapter", (it) => {
           ],
           cursor: {},
         }),
-        out("session.command", { sessionID: SESSION, name: "hello", text: "WORLD" }),
+        out("session.command", { sessionID: SESSION, name: "git/hello", text: "WORLD" }),
         reply("session.command", null),
         { type: "runtime_exit", status: "success" } as const,
         out("event.subscribe"),
@@ -2498,7 +2498,7 @@ it.layer(McpProviderSessions.layer)("OpenCode2 adapter", (it) => {
       );
       yield* runtime.startTurn({
         ...turnInput(thread),
-        message: { ...turnInput(thread).message, text: "/hello WORLD" },
+        message: { ...turnInput(thread).message, text: "/git/hello WORLD" },
       });
       const collected = yield* Fiber.join(events);
       const texts = collected.flatMap((event) =>
diff --git a/packages/provider-opencode/src/server/adapter.test.ts b/packages/provider-opencode/src/server/adapter.test.ts
index 5313eb72a9d8f..4ff3c3efd0de8 100644
--- a/packages/provider-opencode/src/server/adapter.test.ts
+++ b/packages/provider-opencode/src/server/adapter.test.ts
@@ -1363,7 +1363,7 @@ describe("OpenCodeAdapterV2", () => {
             return { stream: nativeEvents.stream };
           },
         },
-        command: { list: async () => ({ data: [{ name: "review" }] }) },
+        command: { list: async () => ({ data: [{ name: "git/review" }] }) },
         session: {
           create: async () => ({ data: { id: sessionId, time: { created: 1, updated: 1 } } }),
           command: async (input: {
@@ -1382,9 +1382,9 @@ describe("OpenCodeAdapterV2", () => {
           },
         },
       });
-      const start = yield* harness.startTurn("/review staged changes").pipe(Effect.forkScoped);
+      const start = yield* harness.startTurn("/git/review staged changes").pipe(Effect.forkScoped);
       const call = yield* Queue.take(calls);
-      assert.equal(call.command, "review");
+      assert.equal(call.command, "git/review");
       assert.equal(call.arguments, "staged changes");
       assert.equal(call.model, "anthropic/claude-sonnet");
       yield* Effect.promise(() =>
diff --git a/packages/provider-opencode/src/server/adapter.ts b/packages/provider-opencode/src/server/adapter.ts
index b32528257944f..14b203b608787 100644
--- a/packages/provider-opencode/src/server/adapter.ts
+++ b/packages/provider-opencode/src/server/adapter.ts
@@ -2978,7 +2978,7 @@ export const makeOpenCodeAdapterV2 = Effect.fn("makeOpenCodeAdapterV2")(function
             .map((part) => part.text)
             .join("\n")
             .trim();
-          const match = text?.match(/^\/([^\s/]+)(?:\s+([\s\S]*))?$/);
+          const match = text?.match(/^\/(\S+)(?:\s+([\s\S]*))?$/);
           const command = match
             ? (yield* OpenCodeRuntime.loadOpenCodeCommands(client).pipe(
                 Effect.timeout("10 seconds"),
diff --git a/packages/provider-opencode/src/server/v2/adapter.ts b/packages/provider-opencode/src/server/v2/adapter.ts
index 2e0f76c34ea74..a6f7af4496461 100644
--- a/packages/provider-opencode/src/server/v2/adapter.ts
+++ b/packages/provider-opencode/src/server/v2/adapter.ts
@@ -627,7 +627,7 @@ const agentFor = (input: ProviderAdapter.ProviderAdapterV2TurnInput) =>
   input.runtimePolicy.interactionMode === "plan" ? "plan" : "build";
 
 const commandOf = (text: string) => {
-  const match = /^\/([^\s/]+)(?:\s+([\s\S]*))?$/.exec(text.trim());
+  const match = /^\/(\S+)(?:\s+([\s\S]*))?$/.exec(text.trim());
   return match === null ? undefined : { name: match[1]!, text: match[2] ?? "" };
 };
 

From 8bfe94af18e11f6a9e57a158bca69e5b3094cb24 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:25:10 +0000
Subject: [PATCH 103/167] fix(source-control): renamed files in GitHub, GitLab
 and Azure DevOps diffs show as renames (#29774)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/server/azureDevOpsDiff.test.ts                          | 2 ++
 .../source-control-azure-devops/src/server/azureDevOpsDiff.ts   | 2 ++
 .../src/server/gitHubPullRequestJson.test.ts                    | 2 ++
 .../source-control-github/src/server/gitHubPullRequestJson.ts   | 2 ++
 .../src/server/gitLabMergeRequestJson.test.ts                   | 1 +
 .../source-control-gitlab/src/server/gitLabMergeRequestJson.ts  | 2 ++
 6 files changed, 11 insertions(+)

diff --git a/packages/source-control-azure-devops/src/server/azureDevOpsDiff.test.ts b/packages/source-control-azure-devops/src/server/azureDevOpsDiff.test.ts
index 25e68f8caedd3..d82d586f5a69f 100644
--- a/packages/source-control-azure-devops/src/server/azureDevOpsDiff.test.ts
+++ b/packages/source-control-azure-devops/src/server/azureDevOpsDiff.test.ts
@@ -80,6 +80,7 @@ describe("azureDevOpsFilePatch", () => {
     expect(patch.section).toBe(
       [
         "diff --git a/docs/old.md b/docs/new.md",
+        "similarity index 100%",
         "rename from docs/old.md",
         "rename to docs/new.md",
         "--- a/docs/old.md",
@@ -209,6 +210,7 @@ describe("a file Azure names something a patch header cannot carry plainly", ()
     expect(patch.section).toBe(
       [
         'diff --git "a/docs/old\\tname.md" "b/docs/new\\tname.md"',
+        "similarity index 100%",
         'rename from "docs/old\\tname.md"',
         'rename to "docs/new\\tname.md"',
         '--- "a/docs/old\\tname.md"',
diff --git a/packages/source-control-azure-devops/src/server/azureDevOpsDiff.ts b/packages/source-control-azure-devops/src/server/azureDevOpsDiff.ts
index 839935ccbd56e..15bddb5a63183 100644
--- a/packages/source-control-azure-devops/src/server/azureDevOpsDiff.ts
+++ b/packages/source-control-azure-devops/src/server/azureDevOpsDiff.ts
@@ -91,7 +91,9 @@ function patchHeader(change: AzureDevOpsChangeEntry): string {
   if (change.changeKind === "new") lines.push("new file mode 100644");
   if (change.changeKind === "deleted") lines.push("deleted file mode 100644");
   if (change.changeKind === "rename-pure" || change.changeKind === "rename-changed") {
+    // Pierre needs this header to keep the rename.
     lines.push(
+      `similarity index ${change.changeKind === "rename-pure" ? 100 : 0}%`,
       `rename from ${quoteGitPatchPath(change.oldPath)}`,
       `rename to ${quoteGitPatchPath(change.path)}`,
     );
diff --git a/packages/source-control-github/src/server/gitHubPullRequestJson.test.ts b/packages/source-control-github/src/server/gitHubPullRequestJson.test.ts
index 622b48db3b85d..c816f76a7801d 100644
--- a/packages/source-control-github/src/server/gitHubPullRequestJson.test.ts
+++ b/packages/source-control-github/src/server/gitHubPullRequestJson.test.ts
@@ -1460,6 +1460,7 @@ describe("decodePullRequestFilesJson", () => {
     expect(result.patch).toBe(
       [
         String.raw`diff --git "a/ old\\name.ts " "b/ new\\name.ts "`,
+        "similarity index 100%",
         String.raw`rename from " old\\name.ts "`,
         String.raw`rename to " new\\name.ts "`,
         String.raw`--- "a/ old\\name.ts "`,
@@ -1515,6 +1516,7 @@ describe("decodePullRequestFilesJson", () => {
     expect(result.patch).toBe(
       [
         "diff --git a/src/old.ts b/src/new.ts",
+        "similarity index 0%",
         "rename from src/old.ts",
         "rename to src/new.ts",
         "--- a/src/old.ts",
diff --git a/packages/source-control-github/src/server/gitHubPullRequestJson.ts b/packages/source-control-github/src/server/gitHubPullRequestJson.ts
index e7c05a4aa8445..7b8851f7bed2d 100644
--- a/packages/source-control-github/src/server/gitHubPullRequestJson.ts
+++ b/packages/source-control-github/src/server/gitHubPullRequestJson.ts
@@ -1639,6 +1639,8 @@ function toFilesPatch(entries: ReadonlyArray<unknown>): GitHubPullRequestFilesPa
       ...(status === "removed" ? ["deleted file mode 100644"] : []),
       ...(status === "renamed"
         ? [
+            // The files API has no similarity score; Pierre needs this header to keep the rename.
+            `similarity index ${hunks.length > 0 || (value.additions ?? 0) + (value.deletions ?? 0) > 0 ? 0 : 100}%`,
             `rename from ${quoteGitPatchPath(oldPath)}`,
             `rename to ${quoteGitPatchPath(value.filename)}`,
           ]
diff --git a/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts b/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
index 371c2e3f3c70a..7b755d559c578 100644
--- a/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
+++ b/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.test.ts
@@ -372,6 +372,7 @@ describe("decodeMergeRequestDiffsJson", () => {
     expect(result.patch).toBe(
       [
         String.raw`diff --git "a/ old\\name.ts " "b/ new\\name.ts "`,
+        "similarity index 100%",
         String.raw`rename from " old\\name.ts "`,
         String.raw`rename to " new\\name.ts "`,
         String.raw`--- "a/ old\\name.ts "`,
diff --git a/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts b/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts
index 79ab379ffbd44..c6fdafad94b2e 100644
--- a/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts
+++ b/packages/source-control-gitlab/src/server/gitLabMergeRequestJson.ts
@@ -724,6 +724,8 @@ function mergeRequestPatch(entries: ReadonlyArray<unknown>): GitLabMergeRequestP
       ...(value.deleted_file === true ? [`deleted file mode ${value.a_mode ?? "100644"}`] : []),
       ...(value.renamed_file === true
         ? [
+            // GitLab has no similarity score; Pierre needs this header to keep the rename.
+            `similarity index ${hunks.length > 0 || value.too_large === true || value.collapsed === true ? 0 : 100}%`,
             `rename from ${quoteGitPatchPath(value.old_path)}`,
             `rename to ${quoteGitPatchPath(value.new_path)}`,
           ]

From 0992f51696834fda5fc1e880fde1f2ba2000f5ef Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:25:26 +0000
Subject: [PATCH 104/167] fix(opencode): a command that exits non-zero is
 stored as failed, not completed (#29824)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/OpenCode2AdapterV2.test.ts       | 50 +++++++++++++++++++
 .../src/server/adapter.test.ts                | 35 ++++++++++++-
 .../provider-opencode/src/server/adapter.ts   |  6 ++-
 .../provider-opencode/src/server/toolItems.ts | 10 ++++
 .../src/server/v2/adapter.ts                  | 10 ++--
 5 files changed, 104 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
index 10006c532e92c..f9819070fd885 100644
--- a/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/OpenCode2AdapterV2.test.ts
@@ -2759,6 +2759,56 @@ it.layer(McpProviderSessions.layer)("OpenCode2 adapter", (it) => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect("stores a shell command that exits non-zero as failed", () =>
+    Effect.gen(function* () {
+      const tool = { sessionID: SESSION, assistantMessageID: "msg_assistant", id: "call-exit" };
+      const { runtime, thread } = yield* resumed([
+        out("session.prompt", { sessionID: SESSION, text: "<any>" }),
+        promptAccepted,
+        event("session.tool.input.started", { ...tool, name: "shell" }),
+        event("session.tool.called", { ...tool, input: { command: "vp test" }, executed: false }),
+        {
+          type: "emit_inbound",
+          frame: {
+            type: "sdk.event",
+            event: {
+              id: "evt_toolsuccess_call-exit",
+              created: 1,
+              type: "session.tool.success",
+              data: {
+                ...tool,
+                content: [{ type: "text", text: "1 failed\n" }],
+                metadata: { status: "completed", truncated: false, exit: 1 },
+                executed: false,
+              },
+              durable: { aggregateID: SESSION, seq: 1, version: 2 },
+            },
+          },
+        },
+        event("session.execution.succeeded", { sessionID: SESSION }),
+      ]);
+      const events = yield* runtime.events.pipe(
+        Stream.takeUntil((event) => event.type === "turn.terminal"),
+        Stream.runCollect,
+        Effect.forkScoped,
+      );
+      yield* runtime.startTurn(turnInput(thread));
+      const collected = yield* Fiber.join(events);
+      const item = collected
+        .flatMap((event) => (event.type === "turn_item.updated" ? [event.turnItem] : []))
+        .findLast((item) => item.nativeItemRef?.nativeId?.endsWith(tool.id));
+      assert.equal(item?.type, "command_execution");
+      assert.equal(item?.status, "failed");
+      assert.equal(item?.type === "command_execution" ? item.exitCode : null, 1);
+      assert.equal(
+        collected
+          .flatMap((event) => (event.type === "node.updated" ? [event.node] : []))
+          .findLast((node) => node.id === item?.nodeId)?.status,
+        "failed",
+      );
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("re-registers T3 MCP each turn and drops its instructions when adding fails", () =>
     Effect.gen(function* () {
       const mcpSessions = yield* McpProviderSessions.McpProviderSessions;
diff --git a/packages/provider-opencode/src/server/adapter.test.ts b/packages/provider-opencode/src/server/adapter.test.ts
index 4ff3c3efd0de8..49cc166f805f0 100644
--- a/packages/provider-opencode/src/server/adapter.test.ts
+++ b/packages/provider-opencode/src/server/adapter.test.ts
@@ -803,6 +803,30 @@ describe("OpenCodeAdapterV2", () => {
             }),
           );
         }
+        yield* Effect.promise(() =>
+          nativeEvents.push({
+            type: "message.part.updated",
+            properties: {
+              sessionID: nativeSessionId,
+              part: {
+                id: "part-exit",
+                sessionID: nativeSessionId,
+                messageID: "late-assistant",
+                type: "tool",
+                callID: "call-exit",
+                tool: "bash",
+                state: {
+                  status: "completed",
+                  input: { command: "vp test" },
+                  output: "1 failed\n",
+                  title: "Run tests",
+                  metadata: { output: "1 failed\n", exit: 1, truncated: false },
+                  time: { start: 4, end: 5 },
+                },
+              },
+            },
+          }),
+        );
         yield* Effect.promise(() =>
           nativeEvents.push({
             type: "message.part.updated",
@@ -877,14 +901,21 @@ describe("OpenCodeAdapterV2", () => {
         const commands = items.filter((item) => item.type === "command_execution");
         assert.deepEqual(
           commands.map((item) => item.status),
-          ["pending", "running", "completed", "failed"],
+          ["pending", "running", "completed", "failed", "failed"],
         );
         assert.deepEqual(
           commands.map((item) => item.input),
-          ["pwd", "pwd", "pwd", "pwd"],
+          ["pwd", "pwd", "pwd", "pwd", "vp test"],
         );
         assert.equal(commands[2]?.output, "/repo\n");
         assert.equal(commands[3]?.output, "Command failed");
+        assert.equal(commands[4]?.exitCode, 1);
+        assert.equal(
+          events
+            .flatMap((event) => (event.type === "node.updated" ? [event.node] : []))
+            .findLast((node) => node.id === commands[4]?.nodeId)?.status,
+          "failed",
+        );
         assert.isTrue(
           events.some(
             (event) =>
diff --git a/packages/provider-opencode/src/server/adapter.ts b/packages/provider-opencode/src/server/adapter.ts
index 14b203b608787..d0c646fa051a8 100644
--- a/packages/provider-opencode/src/server/adapter.ts
+++ b/packages/provider-opencode/src/server/adapter.ts
@@ -80,7 +80,7 @@ import {
   makeSubagentChildThread,
   subagentThreadTitle,
 } from "@t3tools/provider-core/server/subagentProjection";
-import { openCodeToolTurnItem } from "./toolItems.ts";
+import { openCodeCommandFailed, openCodeToolTurnItem } from "./toolItems.ts";
 
 export const OPENCODE_PROVIDER = ProviderDriverKind.make("opencode");
 export const OPENCODE_DEFAULT_INSTANCE_ID = defaultInstanceIdForDriver(OPENCODE_PROVIDER);
@@ -742,7 +742,9 @@ function toolStatus(part: ToolPart): {
     case "running":
       return { node: "running", item: "running" };
     case "completed":
-      return { node: "completed", item: "completed" };
+      return openCodeCommandFailed(part.tool, part.state.metadata)
+        ? { node: "failed", item: "failed" }
+        : { node: "completed", item: "completed" };
     case "error":
       return { node: "failed", item: "failed" };
   }
diff --git a/packages/provider-opencode/src/server/toolItems.ts b/packages/provider-opencode/src/server/toolItems.ts
index d7652c89bbcc3..c4188914e5b25 100644
--- a/packages/provider-opencode/src/server/toolItems.ts
+++ b/packages/provider-opencode/src/server/toolItems.ts
@@ -81,6 +81,16 @@ function nativeReadOutput(output: string): string {
   return envelope === null ? output : envelope[1] + body.slice(envelope[0].length);
 }
 
+/** OpenCode's shell tool succeeds when the command exits non-zero. */
+export function openCodeCommandFailed(toolName: string, completedMetadata: unknown): boolean {
+  const exitCode = recordNumber(completedMetadata, "exit", "exitCode");
+  return (
+    openCodeToolProjectionKind(toolName) === "command_execution" &&
+    exitCode !== undefined &&
+    exitCode !== 0
+  );
+}
+
 export function openCodeToolTurnItem(
   base: ToolItemBase,
   tool: {
diff --git a/packages/provider-opencode/src/server/v2/adapter.ts b/packages/provider-opencode/src/server/v2/adapter.ts
index a6f7af4496461..81871b4b69829 100644
--- a/packages/provider-opencode/src/server/v2/adapter.ts
+++ b/packages/provider-opencode/src/server/v2/adapter.ts
@@ -87,7 +87,7 @@ import {
 import * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
 import { turnScopedSelectionTransition } from "@t3tools/provider-core/server/selectionTransition";
 import { OPENCODE_PROVIDER, openCodePermissionRequestKind } from "../adapter.ts";
-import { openCodeToolTurnItem } from "../toolItems.ts";
+import { openCodeCommandFailed, openCodeToolTurnItem } from "../toolItems.ts";
 
 const OpenCode2ProviderCapabilities = {
   sessions: {
@@ -1004,12 +1004,16 @@ export const make = Effect.fn("OpenCode2Adapter.make")(function* (instanceId: Pr
       const startedAt = turn.startedAt.get(id) ?? updatedAt;
       const completedAt = status === "running" ? null : updatedAt;
       const nativeId = `${turn.scope}${id}`;
-      yield* emitNode(state, turn, nativeId, "tool_call", status, startedAt, completedAt);
+      const settled =
+        status === "completed" && openCodeCommandFailed(tool.name, result?.metadata)
+          ? "failed"
+          : status;
+      yield* emitNode(state, turn, nativeId, "tool_call", settled, startedAt, completedAt);
       yield* emit({
         type: "turn_item.updated",
         driver,
         turnItem: openCodeToolTurnItem(
-          itemBase(state, turn, nativeId, status, startedAt, completedAt, updatedAt),
+          itemBase(state, turn, nativeId, settled, startedAt, completedAt, updatedAt),
           {
             name: tool.name,
             input: tool.input,

From ddaf9996a180ad1b452262dcaf7407ca32fded8a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:25:43 +0000
Subject: [PATCH 105/167] fix(server): linked environments pick up the other
 machine's new name (#29779)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/peer/PeerLinks.test.ts | 21 +++++++++
 apps/server/src/peer/PeerLinks.ts      | 60 +++++++++++++++++---------
 2 files changed, 60 insertions(+), 21 deletions(-)

diff --git a/apps/server/src/peer/PeerLinks.test.ts b/apps/server/src/peer/PeerLinks.test.ts
index a99cb7f9051c5..36c9b09fb4459 100644
--- a/apps/server/src/peer/PeerLinks.test.ts
+++ b/apps/server/src/peer/PeerLinks.test.ts
@@ -453,6 +453,27 @@ it.effect("reads one stored link without asking the peer", () =>
   ).pipe(Effect.provide(NodeHttpServer.layerTest)),
 );
 
+it.effect("a linked peer that is renamed shows its new name", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const b = yield* serveB(box);
+      const a = yield* makeA(laptop);
+      const pairing = yield* b.auth.issuePairingCredential();
+      yield* a.links.link({ url: b.url, pairingCode: pairing.credential, access: "auto" });
+
+      yield* Ref.set(b.descriptor, descriptorOf(box.environmentId, "Box Mini"));
+      expect((yield* a.links.resolve(box.environmentId)).link.label).toBe("Box Mini");
+      const stored = yield* a.links.get(box.environmentId);
+      expect(Option.map(stored, (link) => link.label)).toEqual(Option.some("Box Mini"));
+
+      yield* Ref.set(b.descriptor, descriptorOf(box.environmentId, "Box Studio"));
+      expect((yield* a.links.list).map((link) => link.label)).toEqual(["Box Studio"]);
+      const storedAfterList = yield* a.links.get(box.environmentId);
+      expect(Option.map(storedAfterList, (link) => link.label)).toEqual(Option.some("Box Studio"));
+    }),
+  ).pipe(Effect.provide(NodeHttpServer.layerTest)),
+);
+
 it.effect("tells the agent to link again once the peer revokes the link or it expires", () =>
   Effect.scoped(
     Effect.gen(function* () {
diff --git a/apps/server/src/peer/PeerLinks.ts b/apps/server/src/peer/PeerLinks.ts
index 70aa68d25ccb7..dfcab9f11f273 100644
--- a/apps/server/src/peer/PeerLinks.ts
+++ b/apps/server/src/peer/PeerLinks.ts
@@ -9,7 +9,6 @@ import {
   type PeerLink,
   type PeerLinkCreateInput,
   PeerLinkError,
-  type PeerLinkStatus,
   type PeerLinkSummary,
 } from "@t3tools/contracts";
 import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
@@ -496,29 +495,42 @@ const make = Effect.gen(function* () {
       Effect.orElseSucceed(() => Option.none()),
     );
 
-  const statusOf = (link: PeerLink, now: DateTime.Utc) =>
-    DateTime.isLessThanOrEqualTo(link.expiresAt, now)
-      ? Effect.succeed<PeerLinkStatus>("expired")
-      : Effect.findFirst(link.urls, (url) =>
-          describe(url).pipe(
-            Effect.map(
-              (found) => Option.isSome(found) && found.value.environmentId === link.environmentId,
-            ),
-          ),
-        ).pipe(
-          Effect.map((answered): PeerLinkStatus =>
-            Option.isSome(answered) ? "reachable" : "unreachable",
-          ),
-        );
+  /** A peer's label follows its machine name, so the link takes the one its own address answers with. */
+  const withLabel = (link: PeerLink, label: string) =>
+    label === link.label
+      ? Effect.succeed(link)
+      : sql`
+          UPDATE peer_environment_links SET label = ${label}
+          WHERE environment_id = ${link.environmentId}
+        `.pipe(Effect.ignoreCause({ log: true }), Effect.as({ ...link, label }));
+
+  const statusOf = Effect.fn("PeerLinks.statusOf")(function* (
+    link: PeerLink,
+    now: DateTime.Utc,
+  ): Effect.fn.Return<PeerLinkSummary> {
+    if (DateTime.isLessThanOrEqualTo(link.expiresAt, now)) return { ...link, status: "expired" };
+    let label = link.label;
+    const answered = yield* Effect.findFirst(link.urls, (url) =>
+      describe(url).pipe(
+        Effect.map((found) => {
+          if (Option.isNone(found) || found.value.environmentId !== link.environmentId) {
+            return false;
+          }
+          label = found.value.label;
+          return true;
+        }),
+      ),
+    );
+    if (Option.isNone(answered)) return { ...link, status: "unreachable" };
+    return { ...(yield* withLabel(link, label)), status: "reachable" };
+  });
 
   const list: PeerLinks["Service"]["list"] = Effect.gen(function* () {
     const links = yield* Effect.forEach(yield* readRows, toLink);
     const now = yield* DateTime.now;
-    return yield* Effect.forEach(
-      links,
-      (link) => statusOf(link, now).pipe(Effect.map((status) => ({ ...link, status }))),
-      { concurrency: "unbounded" },
-    );
+    return yield* Effect.forEach(links, (link) => statusOf(link, now), {
+      concurrency: "unbounded",
+    });
   });
 
   const get: PeerLinks["Service"]["get"] = (environmentId) =>
@@ -570,11 +582,13 @@ const make = Effect.gen(function* () {
       // The token goes only to an address that proves it is this peer, so a
       // reused LAN address or a moved hostname never receives it.
       let fenced = true;
+      let label = link.label;
       const url = yield* Effect.findFirst(link.urls, (candidate) =>
         describe(candidate).pipe(
           Effect.map((found) => {
             if (Option.isNone(found) || found.value.environmentId !== environmentId) return false;
             fenced = linkLimitsHold(found.value);
+            label = found.value.label;
             return true;
           }),
         ),
@@ -593,7 +607,11 @@ const make = Effect.gen(function* () {
           message: `${link.label} runs a T3 Code version that cannot keep a linked agent's limits. Update it, then link again.`,
         });
       }
-      return { link, url: url.value, token: new TextDecoder().decode(stored.value) };
+      return {
+        link: yield* withLabel(link, label),
+        url: url.value,
+        token: new TextDecoder().decode(stored.value),
+      };
     },
   );
 

From b8fb45eb4ccab968051cd41f04ca7f3785bd4469 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:26:00 +0000
Subject: [PATCH 106/167] fix(server): document text skips tracked deletions
 and field codes (#29796)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../server/src/provider/documentTextWorker.ts | 24 +++++++++++++------
 .../src/provider/userInputAttachments.test.ts | 20 ++++++++++++++++
 2 files changed, 37 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/provider/documentTextWorker.ts b/apps/server/src/provider/documentTextWorker.ts
index 569493906d385..9138d951d207c 100644
--- a/apps/server/src/provider/documentTextWorker.ts
+++ b/apps/server/src/provider/documentTextWorker.ts
@@ -14,6 +14,20 @@ const CELL_END = Symbol("cell-end");
 type TextPart = string | typeof CELL_START | typeof CELL_END | { fallback: string };
 
 const TRUNCATED = "\n\n[Extracted text truncated at document extraction limits.]";
+// Parts the document never displays: tracked deletions and moves, field codes, phonetic guides,
+// paragraph properties such as tab-stop definitions.
+const HIDDEN = new Set([
+  "script",
+  "style",
+  "binary-data",
+  "rPh",
+  "delText",
+  "moveFrom",
+  "instrText",
+  "delInstrText",
+  "tracked-changes",
+  "pPr",
+]);
 
 class Truncation extends Error {}
 
@@ -67,7 +81,7 @@ function* all(node: XmlNode, name: string | readonly string[]): Generator<XmlNod
   }
 }
 function* text(node: XmlNode): Generator<string, void> {
-  if (["script", "style", "binary-data", "rPh"].includes(node.name)) return;
+  if (HIDDEN.has(node.name)) return;
   if (["tab", "cell"].includes(node.name)) yield "\t";
   else if (["br", "line-break", "cr"].includes(node.name)) yield "\n";
   else if (node.spaceCount !== undefined) {
@@ -80,7 +94,7 @@ function* text(node: XmlNode): Generator<string, void> {
     }
 }
 function* paragraphs(node: XmlNode): Generator<TextPart, void> {
-  if (["script", "style", "binary-data"].includes(node.name)) return;
+  if (HIDDEN.has(node.name)) return;
   for (const child of node.children) {
     if (typeof child === "string") yield child;
     else if (["br", "line-break", "cr"].includes(child.name)) yield "\n";
@@ -137,11 +151,7 @@ function odfValue(cell: XmlNode): string {
 function hasCellText(cell: XmlNode): boolean {
   if (odfValue(cell).trim()) return true;
   // Space markers can have enormous repeat counts; emptiness never requires expanding them.
-  if (
-    ["script", "style", "binary-data", "rPh"].includes(cell.name) ||
-    cell.spaceCount !== undefined
-  )
-    return false;
+  if (HIDDEN.has(cell.name) || cell.spaceCount !== undefined) return false;
   return cell.children.some((child) =>
     typeof child === "string" ? !!child.trim() : hasCellText(child),
   );
diff --git a/apps/server/src/provider/userInputAttachments.test.ts b/apps/server/src/provider/userInputAttachments.test.ts
index 81c167c038d87..887a2d5febb8a 100644
--- a/apps/server/src/provider/userInputAttachments.test.ts
+++ b/apps/server/src/provider/userInputAttachments.test.ts
@@ -572,6 +572,26 @@ describe("question answer paths", () => {
           },
           expected: ["First\nSecond\nThird"],
         },
+        {
+          ext: "docx",
+          bounded: true,
+          parts: {
+            "word/document.xml":
+              '<w:document xmlns:w="urn:w"><w:body><w:p><w:r><w:t>Intro</w:t></w:r><w:r><w:fldChar w:fldCharType="begin"/></w:r><w:r><w:instrText> PAGEREF _Toc1 \\h </w:instrText></w:r><w:r><w:fldChar w:fldCharType="separate"/></w:r><w:r><w:t> 3</w:t></w:r><w:r><w:fldChar w:fldCharType="end"/></w:r></w:p><w:p><w:pPr><w:tabs><w:tab w:val="right" w:pos="9350"/></w:tabs></w:pPr><w:r><w:t xml:space="preserve">Fee </w:t></w:r><w:del><w:r><w:delText>$500</w:delText></w:r></w:del><w:ins><w:r><w:t>$700</w:t></w:r></w:ins><w:moveFrom><w:r><w:t>Moved</w:t></w:r></w:moveFrom><w:r><w:tab/><w:t>due</w:t></w:r></w:p></w:body></w:document>',
+          },
+          expected: ["Intro 3\nFee $700\tdue"],
+          absent: ["PAGEREF", "$500", "Moved"],
+        },
+        {
+          ext: "odt",
+          bounded: true,
+          parts: {
+            "content.xml":
+              "<document><text><tracked-changes><changed-region><deletion><change-info><creator>Reviewer</creator></change-info><p>$500</p></deletion></changed-region></tracked-changes><p>Fee <change/>$700</p></text></document>",
+          },
+          expected: ["Fee $700"],
+          absent: ["Reviewer", "$500"],
+        },
         {
           ext: "docx",
           bounded: true,

From cedcc3109659f5d8fdbdddaeb916c6dedd72921a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:26:17 +0000
Subject: [PATCH 107/167] fix(server): OTLP export settings survive a saved
 token streaming mode (#29786)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/shared/src/serverSettings.test.ts |  9 +++++++++
 packages/shared/src/serverSettings.ts      | 11 ++++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index cfbc9339e4eef..01c921d80c631 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -271,6 +271,15 @@ describe("serverSettings helpers", () => {
       otlpMetricsUrl: "http://localhost:4318/v1/metrics",
       otlpLogsUrl: "http://localhost:4318/v1/logs",
     });
+    // The server still loads a file holding the retired token streaming mode.
+    expect(
+      parsePersistedServerObservabilitySettings(
+        JSON.stringify({
+          responseStreamingMode: "token",
+          observability: { otlpTracesUrl: "http://localhost:4318/v1/traces" },
+        }),
+      ).otlpTracesUrl,
+    ).toBe("http://localhost:4318/v1/traces");
   });
 
   it("falls back cleanly when persisted settings are invalid", () => {
diff --git a/packages/shared/src/serverSettings.ts b/packages/shared/src/serverSettings.ts
index 0db213a90f7b6..d6ba8c89fe5f3 100644
--- a/packages/shared/src/serverSettings.ts
+++ b/packages/shared/src/serverSettings.ts
@@ -35,8 +35,13 @@ import {
   resolveBackgroundActivitySettings,
 } from "./backgroundActivitySettings.ts";
 
-const ServerSettingsJson = fromLenientJson(ServerSettings);
-const decodeServerSettingsJson = Schema.decodeUnknownOption(ServerSettingsJson);
+// Only observability: a value the server migrates on load elsewhere in the file must not drop it.
+const ServerObservabilitySettingsJson = fromLenientJson(
+  Schema.Struct({ observability: ServerSettings.fields.observability }),
+);
+const decodeServerObservabilitySettingsJson = Schema.decodeUnknownOption(
+  ServerObservabilitySettingsJson,
+);
 
 export function isModelSelectionProviderEnabled(
   settings: ServerSettings,
@@ -181,7 +186,7 @@ function extractPersistedServerObservabilitySettings(input: {
 export function parsePersistedServerObservabilitySettings(
   raw: string,
 ): PersistedServerObservabilitySettings {
-  const decoded = decodeServerSettingsJson(raw);
+  const decoded = decodeServerObservabilitySettingsJson(raw);
   if (Option.isSome(decoded)) {
     return extractPersistedServerObservabilitySettings(decoded.value);
   }

From eb303366182d538409621a932a9cbc4086ab7225 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:26:33 +0000
Subject: [PATCH 108/167] fix(server): Word text boxes are no longer extracted
 twice for agents (#29827)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../server/src/provider/documentTextWorker.ts | 18 ++++++++++++++++--
 .../src/provider/userInputAttachments.test.ts | 19 +++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/provider/documentTextWorker.ts b/apps/server/src/provider/documentTextWorker.ts
index 9138d951d207c..4abadfbdb173b 100644
--- a/apps/server/src/provider/documentTextWorker.ts
+++ b/apps/server/src/provider/documentTextWorker.ts
@@ -36,6 +36,8 @@ interface XmlNode {
   attrs: Record<string, string>;
   children: Array<XmlNode | string>;
   spaceCount?: number;
+  hasText?: boolean;
+  hasTextChoice?: boolean;
 }
 
 function xml(source: string, odfSpaces = false, htmlEntities = false): XmlNode {
@@ -61,10 +63,22 @@ function xml(source: string, odfSpaces = false, htmlEntities = false): XmlNode {
     stack.push(node);
   });
   parser.on("closetag", () => {
-    stack.pop();
+    const node = stack.pop()!;
+    const parent = stack.at(-1)!;
+    // Markup-compatibility fallbacks repeat their mc:Choice content, e.g. Word text boxes.
+    // Keep one when no Choice carries text, such as a chart with a VML caption.
+    if (node.name === "Fallback" && parent.hasTextChoice) {
+      parent.children.pop();
+      return;
+    }
+    if (!node.hasText) return;
+    parent.hasText = true;
+    if (node.name === "Choice") parent.hasTextChoice = true;
   });
   const text = (value: string) => {
-    stack.at(-1)!.children.push(value);
+    const node = stack.at(-1)!;
+    node.children.push(value);
+    if (value.trim() !== "") node.hasText = true;
   };
   parser.on("text", text);
   parser.on("cdata", text);
diff --git a/apps/server/src/provider/userInputAttachments.test.ts b/apps/server/src/provider/userInputAttachments.test.ts
index 887a2d5febb8a..90793ce3f821e 100644
--- a/apps/server/src/provider/userInputAttachments.test.ts
+++ b/apps/server/src/provider/userInputAttachments.test.ts
@@ -554,6 +554,25 @@ describe("question answer paths", () => {
           expected: ["Start", "[Extracted text truncated at document extraction limits.]"],
           absent: ["Unneeded"],
         },
+        {
+          ext: "docx",
+          bounded: true,
+          parts: {
+            "word/document.xml":
+              '<w:document xmlns:w="urn:w" xmlns:mc="urn:mc"><w:body><w:p><w:r><w:t>Body</w:t></w:r></w:p><w:p><w:r><mc:AlternateContent><mc:Choice Requires="wps"><w:drawing><wps:wsp><wps:txbx><w:txbxContent><w:p><w:r><w:t>Callout box</w:t></w:r></w:p></w:txbxContent></wps:txbx></wps:wsp></w:drawing></mc:Choice><mc:Fallback><w:pict><v:shape><v:textbox><w:txbxContent><w:p><w:r><w:t>Callout box</w:t></w:r></w:p></w:txbxContent></v:textbox></v:shape></w:pict></mc:Fallback></mc:AlternateContent></w:r></w:p></w:body></w:document>',
+          },
+          expected: ["Body\nCallout box"],
+          occurrences: { text: "Callout box", count: 1 },
+        },
+        {
+          ext: "docx",
+          bounded: true,
+          parts: {
+            "word/document.xml":
+              '<w:document xmlns:w="urn:w" xmlns:mc="urn:mc"><w:body><w:p><w:r><mc:AlternateContent><mc:Choice Requires="cx"><w:drawing><cx:chart/></w:drawing></mc:Choice><mc:Fallback><w:pict><v:shape><v:textbox><w:txbxContent><w:p><w:r><w:t>Chart caption</w:t></w:r></w:p></w:txbxContent></v:textbox></v:shape></w:pict></mc:Fallback></mc:AlternateContent></w:r></w:p></w:body></w:document>',
+          },
+          expected: ["Chart caption"],
+        },
         {
           ext: "docx",
           bounded: true,

From 9f7b2ee93ccbcd96533840d7f5e0c458314b8cb1 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:26:50 +0000
Subject: [PATCH 109/167] fix(server): new projects are created when
 core.safecrlf refuses LF files (#29843)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/project/ManagedProjectFolders.test.ts | 6 ++++++
 apps/server/src/project/ManagedProjectFolders.ts      | 5 +++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/project/ManagedProjectFolders.test.ts b/apps/server/src/project/ManagedProjectFolders.test.ts
index b5e3ef9a13b29..7990537355ed2 100644
--- a/apps/server/src/project/ManagedProjectFolders.test.ts
+++ b/apps/server/src/project/ManagedProjectFolders.test.ts
@@ -349,6 +349,12 @@ it.effect("starts a named project as a committed repository, and suffixes a take
         const path = yield* Path.Path;
         const root = path.resolve(baseDir, "projects");
         assert.equal(folders.namedProjectsRoot, root);
+        const attributes = path.join(baseDir, "crlf.gitattributes");
+        const crlfConfig = path.join(baseDir, "crlf.gitconfig");
+        yield* fileSystem.writeFileString(attributes, "* text=auto eol=crlf\n");
+        yield* git(baseDir, ["config", "--file", crlfConfig, "core.safecrlf", "true"]);
+        yield* git(baseDir, ["config", "--file", crlfConfig, "core.attributesFile", attributes]);
+        process.env.GIT_CONFIG_GLOBAL = crlfConfig;
 
         const first = yield* folders.createNamedProject({ name: "Pinball Stats" });
         const second = yield* folders.createNamedProject({ name: "pinball stats" });
diff --git a/apps/server/src/project/ManagedProjectFolders.ts b/apps/server/src/project/ManagedProjectFolders.ts
index c187424870c61..4b0991e1a64ce 100644
--- a/apps/server/src/project/ManagedProjectFolders.ts
+++ b/apps/server/src/project/ManagedProjectFolders.ts
@@ -395,11 +395,12 @@ const make = Effect.gen(function* () {
       path.join(cwd, "assets", "icon.svg"),
       namedProjectIconSvg(name),
     );
-    // Force explicit filenames so global ignore rules cannot drop them.
+    // Force explicit filenames so global ignore rules cannot drop them, and keep
+    // core.safecrlf=true from refusing the LF files under CRLF conversion.
     yield* git.execute({
       operation: "ManagedProjectFolders.add",
       cwd,
-      args: ["add", "--force", "--", "README.md", "assets/icon.svg"],
+      args: ["-c", "core.safecrlf=false", "add", "--force", "--", "README.md", "assets/icon.svg"],
       timeoutMs: 10_000,
     });
     return yield* git

From 228e2895062459db8b00895d314388fa7df71ff1 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:27:07 +0000
Subject: [PATCH 110/167] fix(web): drafts saved by older versions load instead
 of being wiped (#29828)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/composerDraftStore.test.ts | 46 +++++++++++++++++++++++++
 apps/web/src/composerDraftStore.ts      | 29 ++++++++++++----
 2 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/apps/web/src/composerDraftStore.test.ts b/apps/web/src/composerDraftStore.test.ts
index d92417ba96d88..eee264170e01c 100644
--- a/apps/web/src/composerDraftStore.test.ts
+++ b/apps/web/src/composerDraftStore.test.ts
@@ -2160,6 +2160,52 @@ describe("composerDraftStore model seed migration", () => {
       vi.useRealTimers();
     }
   });
+
+  it("upgrades v5 selections that name a provider and keep options in an object", async () => {
+    vi.useFakeTimers();
+    try {
+      const legacySelection = {
+        provider: "codex",
+        model: "gpt-5.4",
+        options: { reasoningEffort: "high", fastMode: true },
+      };
+      const storage = useComposerDraftStore.persist.getOptions().storage;
+      expect(storage).toBeDefined();
+      storage?.setItem(COMPOSER_DRAFT_STORAGE_KEY, {
+        version: 5,
+        state: {
+          draftsByThreadKey: {
+            [serverThreadKey]: {
+              prompt: "keep this draft",
+              attachments: [],
+              modelSelectionByProvider: { codex: legacySelection },
+              activeProvider: "codex",
+            },
+          },
+          draftThreadsByThreadKey: {},
+          stickyModelSelectionByProvider: { codex: legacySelection },
+          stickyActiveProvider: "codex",
+        },
+      } as never);
+      await vi.advanceTimersByTimeAsync(300);
+
+      await useComposerDraftStore.persist.rehydrate();
+
+      const upgraded = modelSelection(CODEX_DRIVER, "gpt-5.4", {
+        reasoningEffort: "high",
+        fastMode: true,
+      });
+      expect(draftByKey(serverThreadKey)).toMatchObject({
+        prompt: "keep this draft",
+        modelSelectionByProvider: { [CODEX_INSTANCE]: upgraded },
+      });
+      expect(useComposerDraftStore.getState().stickyModelSelectionByProvider).toEqual({
+        [CODEX_INSTANCE]: upgraded,
+      });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });
 
 function createMockStorage() {
diff --git a/apps/web/src/composerDraftStore.ts b/apps/web/src/composerDraftStore.ts
index 4e6dfe04a7ebb..669b186c59230 100644
--- a/apps/web/src/composerDraftStore.ts
+++ b/apps/web/src/composerDraftStore.ts
@@ -1786,6 +1786,22 @@ function normalizePersistedDraftThreads(
   return { draftThreadsByThreadKey, logicalProjectDraftThreadKeyByLogicalProjectKey };
 }
 
+const decodePersistedModelSelection = Schema.decodeUnknownOption(ModelSelection);
+
+/** Storage v3-v5 wrote `provider` and object-shaped options; the schema upgrades both. */
+function normalizePersistedModelSelectionByProvider(
+  value: object,
+): Partial<Record<ProviderInstanceId, ModelSelection>> {
+  return Object.fromEntries(
+    Object.entries(value).flatMap(([instanceId, selection]) =>
+      Option.match(decodePersistedModelSelection(selection), {
+        onNone: () => [],
+        onSome: (decoded) => [[instanceId, decoded] as const],
+      }),
+    ),
+  );
+}
+
 function normalizePersistedDraftsByThreadId(
   rawDraftMap: unknown,
   draftThreadsByThreadKey: PersistedComposerDraftStoreState["draftThreadsByThreadKey"],
@@ -1913,9 +1929,9 @@ function normalizePersistedDraftsByThreadId(
       draftCandidate.modelSelectionByProvider &&
       typeof draftCandidate.modelSelectionByProvider === "object"
     ) {
-      modelSelectionByProvider = draftCandidate.modelSelectionByProvider as Partial<
-        Record<ProviderInstanceId, ModelSelection>
-      >;
+      modelSelectionByProvider = normalizePersistedModelSelectionByProvider(
+        draftCandidate.modelSelectionByProvider,
+      );
       activeProvider = normalizeProviderInstanceId(draftCandidate.activeProvider);
       modelSelectionExplicit = draftCandidate.modelSelectionExplicit === true ? true : undefined;
     } else {
@@ -2210,10 +2226,9 @@ function normalizeCurrentPersistedComposerDraftStoreState(
     normalizedPersistedState.stickyModelSelectionByProvider &&
     typeof normalizedPersistedState.stickyModelSelectionByProvider === "object"
   ) {
-    stickyModelSelectionByProvider =
-      normalizedPersistedState.stickyModelSelectionByProvider as Partial<
-        Record<ProviderInstanceId, ModelSelection>
-      >;
+    stickyModelSelectionByProvider = normalizePersistedModelSelectionByProvider(
+      normalizedPersistedState.stickyModelSelectionByProvider,
+    );
     stickyActiveProvider = normalizeProviderInstanceId(
       normalizedPersistedState.stickyActiveProvider,
     );

From 9d7f77127edb4914b2cdac217ffa0f6b34c4180c Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:27:23 +0000
Subject: [PATCH 111/167] fix(server): Antigravity text generation shows
 sign-in and setup errors (#29823)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../AntigravityTextGeneration.test.ts         | 24 ++++++++++++++++++-
 .../AntigravityTextGeneration.ts              | 13 ++++++++--
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts b/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
index 7e1f1446d1a55..62205d2835985 100644
--- a/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
+++ b/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
@@ -16,7 +16,7 @@ import * as Queue from "effect/Queue";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
-import { type AcpError } from "effect-acp/errors";
+import { type AcpError, AcpRequestError } from "effect-acp/errors";
 import type * as AcpSchema from "effect-acp/compat";
 import { expect } from "vite-plus/test";
 
@@ -452,6 +452,27 @@ it.layer(NodeServices.layer)("AntigravityTextGeneration", (it) => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect.each([
+    {
+      code: -32000,
+      detail: "Sign in to Antigravity in Settings before you continue.",
+    },
+    { code: -32603, detail: "Antigravity text generation failed." },
+  ])("maps ACP error $code from the prompt request to a fixed detail", ({ code, detail }) =>
+    Effect.gen(function* () {
+      const fixture = yield* makeFixture({
+        prompt: () =>
+          Effect.fail(new AcpRequestError({ code, errorMessage: "Raw provider failure text." })),
+      });
+      const error = yield* fixture.textGeneration
+        .generateThreadTitle(fixture.titleInput)
+        .pipe(Effect.flip);
+      expect(error.detail).toBe(detail);
+      expect(error.detail).not.toContain("Raw provider failure text.");
+      yield* fixture.assertCleaned;
+    }).pipe(Effect.scoped),
+  );
+
   it.effect.each([
     { relativePath: "unexpected.txt", kind: "file" },
     { relativePath: ".agents/skills/unexpected.txt", kind: "file" },
@@ -551,6 +572,7 @@ it.layer(NodeServices.layer)("AntigravityTextGeneration", (it) => {
         .generateThreadTitle(fixture.titleInput)
         .pipe(Effect.flip);
       expect(error._tag).toBe("TextGenerationError");
+      expect(error.detail).toBe("Sign in before starting Antigravity.");
       expect(fixture.state.workspaces).toEqual([]);
       yield* fixture.assertCleaned;
     }).pipe(Effect.scoped),
diff --git a/apps/server/src/textGeneration/AntigravityTextGeneration.ts b/apps/server/src/textGeneration/AntigravityTextGeneration.ts
index 22fce172b1836..b7e7cfaeb40e8 100644
--- a/apps/server/src/textGeneration/AntigravityTextGeneration.ts
+++ b/apps/server/src/textGeneration/AntigravityTextGeneration.ts
@@ -1,4 +1,4 @@
-import { type ProviderSetupError, TextGenerationError } from "@t3tools/contracts";
+import { ProviderSetupError, TextGenerationError } from "@t3tools/contracts";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
@@ -13,12 +13,17 @@ import { type AcpError, AcpRequestError } from "effect-acp/errors";
 
 import { applyAntigravityAcpModelSelection } from "../provider/acp/AntigravityAcpSupport.ts";
 import { removeAntigravitySessionFiles } from "../provider/acp/AntigravitySessionFiles.ts";
+import {
+  ANTIGRAVITY_SIGN_IN_REQUIRED_MESSAGE,
+  isAntigravitySignInRequiredError,
+} from "../provider/antigravityAuthSupport.ts";
 import type * as AcpSessionRuntime from "@t3tools/provider-acp/server/AcpSessionRuntime";
 import * as TextGenerationOperations from "@t3tools/provider-core/server/textGenerationOperations";
 
 const ANTIGRAVITY_TIMEOUT_MS = 180_000;
 const MAX_OUTPUT_CHARS = 128_000;
 const isTextGenerationError = Schema.is(TextGenerationError);
+const isProviderSetupError = Schema.is(ProviderSetupError);
 const isNativeSessionId = Schema.is(Schema.String.check(Schema.isUUID(4)));
 const Configuration = Schema.Record(Schema.String, Schema.Unknown);
 const decodeConfiguration = Schema.decodeEffect(Schema.fromJsonString(Configuration));
@@ -322,7 +327,11 @@ export const makeAntigravityTextGeneration = Effect.fn("makeAntigravityTextGener
             ? cause
             : new TextGenerationError({
                 operation: input.operation,
-                detail: "Antigravity text generation failed.",
+                detail: isProviderSetupError(cause)
+                  ? cause.detail
+                  : isAntigravitySignInRequiredError(cause)
+                    ? ANTIGRAVITY_SIGN_IN_REQUIRED_MESSAGE
+                    : "Antigravity text generation failed.",
                 cause,
               }),
         ),

From 92388d5a083b7b077ed4aeddaca6b7f1b6971e6f Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:27:49 +0000
Subject: [PATCH 112/167] fix(web): picking a custom model named like a Codex
 alias keeps that model (#29789)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/composerDraftStore.test.ts | 14 ++++++++++++++
 apps/web/src/composerDraftStore.ts      | 12 ++++++++----
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/apps/web/src/composerDraftStore.test.ts b/apps/web/src/composerDraftStore.test.ts
index eee264170e01c..cd0e74d231aac 100644
--- a/apps/web/src/composerDraftStore.test.ts
+++ b/apps/web/src/composerDraftStore.test.ts
@@ -1754,6 +1754,7 @@ describe("composerDraftStore modelSelection", () => {
     ).toEqual(
       expect.objectContaining({
         instanceId: CODEX_SECONDARY_INSTANCE,
+        model: "gpt-5-codex",
         options: [{ id: "reasoningEffort", value: "low" }],
       }),
     );
@@ -1770,6 +1771,19 @@ describe("composerDraftStore modelSelection", () => {
         options: [{ id: "reasoningEffort", value: "low" }],
       }),
     );
+    expect(
+      useComposerDraftStore.getState().stickyOptionsByModelByProvider[CODEX_SECONDARY_INSTANCE],
+    ).toEqual({ "gpt-5-codex": [{ id: "reasoningEffort", value: "low" }] });
+
+    // A custom slug that matches a Codex alias stays exact; the picker already resolved it.
+    store.setModelSelection(threadRef, createModelSelection(CODEX_SECONDARY_INSTANCE, "gpt-5.3"), {
+      explicit: true,
+      replaceOptions: true,
+    });
+    expect(
+      draftFor(threadId, TEST_ENVIRONMENT_ID)?.modelSelectionByProvider[CODEX_SECONDARY_INSTANCE]
+        ?.model,
+    ).toBe("gpt-5.3");
   });
 });
 
diff --git a/apps/web/src/composerDraftStore.ts b/apps/web/src/composerDraftStore.ts
index 669b186c59230..aef9e88a38572 100644
--- a/apps/web/src/composerDraftStore.ts
+++ b/apps/web/src/composerDraftStore.ts
@@ -42,6 +42,7 @@ import { DeepMutable } from "effect/Types";
 import {
   createModelSelection,
   draftModelPickMatchesThread,
+  normalizeCustomModelSlug,
   normalizeModelSlug,
 } from "@t3tools/shared/model";
 import { AsyncResult, Atom, type AtomRegistry } from "effect/reactivity";
@@ -990,7 +991,11 @@ function normalizeModelSelection(
   const driverKindHint =
     normalizeProviderDriverKind(candidate?.provider ?? legacy?.provider) ??
     ProviderDriverKind.make("codex");
-  const model = normalizeModelSlug(rawModel, driverKindHint);
+  // Instance-scoped picks are already resolved slugs; a custom slug can match a static alias.
+  const model =
+    candidate?.instanceId === undefined
+      ? normalizeModelSlug(rawModel, driverKindHint)
+      : normalizeCustomModelSlug(rawModel);
   if (!model) {
     return null;
   }
@@ -3066,7 +3071,7 @@ const composerDraftStore = create<ComposerDraftStoreState>()(
           }
           const instanceKey = options?.instanceId ?? defaultInstanceIdForDriver(normalizedProvider);
           const fallbackModel =
-            normalizeModelSlug(options?.model, normalizedProvider) ??
+            normalizeCustomModelSlug(options?.model) ??
             DEFAULT_MODEL_BY_PROVIDER[normalizedProvider] ??
             DEFAULT_MODEL;
           const providerOpts =
@@ -3098,8 +3103,7 @@ const composerDraftStore = create<ComposerDraftStoreState>()(
                 nextStickyMap[instanceKey] ??
                 base.modelSelectionByProvider[instanceKey] ??
                 createModelSelection(instanceKey, fallbackModel);
-              const rememberedModel =
-                normalizeModelSlug(options?.model, normalizedProvider) ?? stickyBase.model;
+              const rememberedModel = normalizeCustomModelSlug(options?.model) ?? stickyBase.model;
               if (providerOpts) {
                 nextStickyMap[instanceKey] = createModelSelection(
                   instanceKey,

From 940afd65e059078bce26ffd7948c63edf52de5a9 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:28:06 +0000
Subject: [PATCH 113/167] fix(server): turn checkpoints keep LF files when
 core.safecrlf is true (#29826)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriver.test.ts | 20 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriver.ts      |  3 +++
 2 files changed, 23 insertions(+)

diff --git a/apps/server/src/vcs/GitVcsDriver.test.ts b/apps/server/src/vcs/GitVcsDriver.test.ts
index fd85564a7dadd..fed1c484d0d16 100644
--- a/apps/server/src/vcs/GitVcsDriver.test.ts
+++ b/apps/server/src/vcs/GitVcsDriver.test.ts
@@ -323,6 +323,26 @@ it.effect("checkpoint capture still fails when a clean filter rejects a file", (
   }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
 );
 
+it.effect("checkpoint capture keeps LF files that core.safecrlf would refuse to commit", () =>
+  Effect.gen(function* () {
+    const fileSystem = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const driver = yield* GitVcsDriver.makeVcsDriverShape();
+    const cwd = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-checkpoint-safecrlf-" });
+    const { git, checkpointRef } = yield* makeCheckpointFixture(driver, cwd);
+    yield* fileSystem.writeFileString(path.join(cwd, ".gitattributes"), "*.txt text eol=crlf\n");
+    yield* git(["config", "core.safecrlf", "true"]);
+    yield* fileSystem.writeFileString(path.join(cwd, "untracked.txt"), "new\n");
+    const originalIndex = yield* fileSystem.readFile(path.join(cwd, ".git", "index"));
+
+    yield* driver.checkpoints.captureCheckpoint({ cwd, checkpointRef });
+
+    assert.strictEqual((yield* git(["show", `${checkpointRef}:file.txt`])).stdout, "unstaged\n");
+    assert.strictEqual((yield* git(["show", `${checkpointRef}:untracked.txt`])).stdout, "new\n");
+    assert.deepEqual(yield* fileSystem.readFile(path.join(cwd, ".git", "index")), originalIndex);
+  }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
+);
+
 it.effect("checkpoint capture refuses a truncated nested repository listing", () =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index d3ecfcfa95d73..42459d8450ab2 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -1168,6 +1168,9 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
               ...indexConfig,
               ...durableWrite,
               ...longPaths,
+              // safecrlf=true refuses LF files under CRLF conversion; capture them as Git's default does.
+              "-c",
+              "core.safecrlf=false",
               "add",
               ...(sparseCheckout ? ["--sparse"] : []),
               // add -A rejects ignored directories even when they contain tracked files.

From 31564dece84fa99e2abde8a22ed346b675384565 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:28:33 +0000
Subject: [PATCH 114/167] fix(shared): find in thread matches a word typed with
 a curly apostrophe (#29759)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/shared/src/threadSearch.test.ts | 5 +++++
 packages/shared/src/threadSearch.ts      | 7 +++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/packages/shared/src/threadSearch.test.ts b/packages/shared/src/threadSearch.test.ts
index 83b87841c789a..fb52b2ec16a29 100644
--- a/packages/shared/src/threadSearch.test.ts
+++ b/packages/shared/src/threadSearch.test.ts
@@ -12,3 +12,8 @@ it("matches both Greek sigma forms without changing source offsets", () => {
   expect(findThreadSearchOccurrences("ΟΣ ος οσ", "ς")).toEqual([1, 4, 7]);
   expect(findThreadSearchOccurrences("İ ΟΣ", "Σ")).toEqual([3]);
 });
+
+it("matches straight and curly apostrophes without changing source offsets", () => {
+  expect(findThreadSearchOccurrences("don't don’t", "don’t")).toEqual([0, 6]);
+  expect(findThreadSearchOccurrences("İ don‘t", "don't")).toEqual([2]);
+});
diff --git a/packages/shared/src/threadSearch.ts b/packages/shared/src/threadSearch.ts
index 5cca036d7bed4..6ffa12fcc1523 100644
--- a/packages/shared/src/threadSearch.ts
+++ b/packages/shared/src/threadSearch.ts
@@ -1,10 +1,13 @@
+// A typed straight apostrophe finds a curly one: iOS keyboards type "’".
+const foldCharacters = (text: string) => text.replace(/ς/g, "σ").replace(/[‘’]/g, "'");
+
 function foldThreadSearchCase(text: string): string {
-  const lowered = text.toLowerCase().replace(/ς/g, "σ");
+  const lowered = foldCharacters(text.toLowerCase());
   if (lowered.length === text.length) return lowered;
 
   let folded = "";
   for (const character of text) {
-    const loweredCharacter = character.toLowerCase().replace(/ς/g, "σ");
+    const loweredCharacter = foldCharacters(character.toLowerCase());
     folded += loweredCharacter.length === character.length ? loweredCharacter : character;
   }
   return folded;

From 2f2e81f6bcf49c71c793ca271a277a5abf14cad6 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:28:50 +0000
Subject: [PATCH 115/167] fix(server): review rows for nested repositories load
 in large diffs (#29693)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 5 ++++-
 apps/server/src/vcs/GitVcsDriverCore.ts      | 4 +++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 1cecf781bf721..7d9d68b28566a 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -2310,6 +2310,9 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
         yield* writeTextFile(cwd, "untracked.txt", "new\n");
         const driver = yield* GitVcsDriver.GitVcsDriver;
         const nestedCwd = path.join(cwd, "nested");
+        const clone = path.join(nestedCwd, "clone");
+        yield* fileSystem.makeDirectory(clone);
+        yield* initRepoWithCommit(clone);
         const projectDirectories = [nestedCwd];
         if (symlinksSupported) {
           const alias = path.join(directory, "alias");
@@ -2323,7 +2326,7 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
           });
           assert.equal(
             preview.sources.find((source) => source.kind === "working-tree")!.files!.length,
-            2,
+            3,
           );
           for (const source of preview.sources) {
             for (const file of source.files ?? []) {
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 107544eacc810..0d1d2c9b1c7e6 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -3123,8 +3123,10 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       { maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
     ).pipe(Effect.orElseSucceed(() => null));
     if (untracked === null) return null;
+    // ls-files lists a nested repository with a trailing slash; its diff path has none.
     const paths = splitNullSeparatedGitStdoutPaths(untracked).filter(
-      (candidate) => onlyPath === undefined || candidate === onlyPath,
+      (candidate) =>
+        onlyPath === undefined || candidate === onlyPath || candidate === `${onlyPath}/`,
     );
     if (paths.length === 0) return { env: undefined };
     if (paths.length > REVIEW_UNTRACKED_MAX_FILES) return null;

From 0a41bbce4f63b0ae9275c1e3de56f7396050ffcd Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:29:12 +0000
Subject: [PATCH 116/167] fix(server): t3_worktree_list lists refs after
 storage cleanup removes a thread's worktree (#29645)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../server/src/mcp/WorktreeMcpService.test.ts | 49 ++++++++++++++++++-
 apps/server/src/mcp/WorktreeMcpService.ts     | 26 +++++++++-
 .../src/mcp/toolkits/worktree/handlers.ts     | 11 +++--
 .../server/src/mcp/toolkits/worktree/tools.ts |  3 +-
 4 files changed, 81 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/mcp/WorktreeMcpService.test.ts b/apps/server/src/mcp/WorktreeMcpService.test.ts
index eb8b4b5b1e31c..90cf3c7f8401a 100644
--- a/apps/server/src/mcp/WorktreeMcpService.test.ts
+++ b/apps/server/src/mcp/WorktreeMcpService.test.ts
@@ -19,6 +19,7 @@ import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import * as PlatformError from "effect/PlatformError";
 import * as Schema from "effect/Schema";
 
 import * as GitWorkflowService from "../git/GitWorkflowService.ts";
@@ -115,6 +116,7 @@ interface HarnessOptions {
   readonly removeWorktreeFails?: boolean;
   readonly deleteLocalBranchFails?: boolean;
   readonly createWorktreeGate?: Effect.Effect<void>;
+  readonly existsFails?: boolean;
 }
 
 const makeHarness = (options: HarnessOptions = {}) => {
@@ -234,7 +236,7 @@ const makeHarness = (options: HarnessOptions = {}) => {
             ),
           ),
   );
-  const listRefs = vi.fn((input: { readonly query?: string | undefined }) =>
+  const listRefs = vi.fn((input: { readonly cwd: string; readonly query?: string | undefined }) =>
     Effect.succeed({
       refs:
         options.existingBranchWorktreePath === undefined
@@ -331,6 +333,19 @@ const makeHarness = (options: HarnessOptions = {}) => {
         } satisfies Partial<VcsStatusBroadcaster.VcsStatusBroadcaster["Service"]>),
         NodeServices.layer,
         NodeCrypto.layer,
+        options.existsFails
+          ? FileSystem.layerNoop({
+              exists: (path) =>
+                Effect.fail(
+                  PlatformError.systemError({
+                    _tag: "PermissionDenied",
+                    module: "FileSystem",
+                    method: "exists",
+                    pathOrDescriptor: path,
+                  }),
+                ),
+            })
+          : Layer.empty,
       ),
     ),
   );
@@ -338,6 +353,7 @@ const makeHarness = (options: HarnessOptions = {}) => {
   return {
     layer,
     scope,
+    listRefs,
     dispatch,
     sendToThread,
     fetchWorktreeBaseCommit,
@@ -711,3 +727,34 @@ describe("t3_worktree_status", () => {
     });
   });
 });
+
+describe("t3_worktree_list", () => {
+  const listRefs = (harness: ReturnType<typeof makeHarness>, worktreePath: string | null) =>
+    Effect.gen(function* () {
+      const service = yield* WorktreeMcpService.WorktreeMcpService;
+      return yield* service.listRefs({ worktreePath, workspaceRoot });
+    }).pipe(Effect.provide(harness.layer));
+
+  it.effect("lists refs from the thread's worktree, or the project root once it was removed", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const worktreePath = yield* fs.makeTempDirectoryScoped({ prefix: "worktree-list-" });
+      const harness = makeHarness();
+      yield* listRefs(harness, worktreePath);
+      yield* listRefs(harness, `${worktreePath}/removed`);
+      expect(harness.listRefs.mock.calls.map(([input]) => input.cwd)).toEqual([
+        worktreePath,
+        workspaceRoot,
+      ]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
+  it.effect("fails instead of falling back when the worktree cannot be checked", () => {
+    const harness = makeHarness({ existsFails: true });
+    return Effect.gen(function* () {
+      const exit = yield* Effect.exit(listRefs(harness, "/worktrees/project/unreadable"));
+      expectTypedFailure(exit, { _tag: "PlatformError" });
+      expect(harness.listRefs).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/apps/server/src/mcp/WorktreeMcpService.ts b/apps/server/src/mcp/WorktreeMcpService.ts
index bffae891d5f23..0ee45bb7f8bb3 100644
--- a/apps/server/src/mcp/WorktreeMcpService.ts
+++ b/apps/server/src/mcp/WorktreeMcpService.ts
@@ -1,5 +1,6 @@
 import {
   CommandId,
+  type GitCommandError,
   MessageId,
   type ProjectId,
   WorktreeMcpFailure,
@@ -8,14 +9,18 @@ import {
   type WorktreeMcpHandoffResult,
   type WorktreeMcpSetupScriptStatus,
   type WorktreeMcpStatusResult,
+  type VcsListRefsInput,
+  type VcsListRefsResult,
 } from "@t3tools/contracts";
 import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
 import * as Cause from "effect/Cause";
 import * as Context from "effect/Context";
 import * as SecureRandom from "effect/crypto/SecureRandom";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
+import type * as PlatformError from "effect/PlatformError";
 
 import * as GitWorkflowService from "../git/GitWorkflowService.ts";
 import * as ThreadManagementService from "../orchestration-v2/ThreadManagementService.ts";
@@ -35,6 +40,12 @@ export class WorktreeMcpService extends Context.Service<
     readonly status: (
       scope: McpInvocationScope,
     ) => Effect.Effect<WorktreeMcpStatusResult, WorktreeMcpFailure>;
+    readonly listRefs: (
+      input: Omit<VcsListRefsInput, "cwd"> & {
+        readonly worktreePath: string | null;
+        readonly workspaceRoot: string;
+      },
+    ) => Effect.Effect<VcsListRefsResult, GitCommandError | PlatformError.PlatformError>;
   }
 >()("t3/mcp/WorktreeMcpService") {}
 
@@ -57,6 +68,7 @@ const asOperationFailed = (prefix: string) =>
 
 const make = Effect.gen(function* () {
   const random = yield* SecureRandom.SecureRandom;
+  const fileSystem = yield* FileSystem.FileSystem;
   const threadManagement = yield* ThreadManagementService.ThreadManagementService;
   const projects = yield* ProjectService.ProjectService;
   const serverSettings = yield* ServerSettings.ServerSettingsService;
@@ -434,13 +446,25 @@ const make = Effect.gen(function* () {
     },
   );
 
-  return WorktreeMcpService.of({ handoff, status });
+  const listRefs: WorktreeMcpService["Service"]["listRefs"] = Effect.fn(
+    "WorktreeMcpService.listRefs",
+  )(function* ({ worktreePath, workspaceRoot, ...refs }) {
+    // Storage cleanup removes a worktree but keeps its path on the thread.
+    const cwd =
+      worktreePath !== null && (yield* fileSystem.exists(worktreePath))
+        ? worktreePath
+        : workspaceRoot;
+    return yield* gitWorkflow.listRefs({ ...refs, cwd });
+  });
+
+  return WorktreeMcpService.of({ handoff, status, listRefs });
 });
 
 export const layer: Layer.Layer<
   WorktreeMcpService,
   never,
   | SecureRandom.SecureRandom
+  | FileSystem.FileSystem
   | ThreadManagementService.ThreadManagementService
   | ProjectService.ProjectService
   | ServerSettings.ServerSettingsService
diff --git a/apps/server/src/mcp/toolkits/worktree/handlers.ts b/apps/server/src/mcp/toolkits/worktree/handlers.ts
index c6fabe18c6fb8..2e78dd2a4f996 100644
--- a/apps/server/src/mcp/toolkits/worktree/handlers.ts
+++ b/apps/server/src/mcp/toolkits/worktree/handlers.ts
@@ -1,6 +1,5 @@
 import { OrchestratorMcpFailure } from "@t3tools/contracts";
 import * as Option from "effect/Option";
-import * as GitWorkflow from "../../../git/GitWorkflowService.ts";
 import * as Project from "../../../project/ProjectService.ts";
 import { readThread, unavailable } from "../../threadAccess.ts";
 import * as Effect from "effect/Effect";
@@ -30,9 +29,13 @@ const handlers = {
           code: "invalid_request",
           message: "The project was not found.",
         });
-      const git = yield* GitWorkflow.GitWorkflowService;
-      return yield* git
-        .listRefs({ ...refs, cwd: thread.worktreePath ?? project.value.workspaceRoot })
+      const service = yield* WorktreeMcpService.WorktreeMcpService;
+      return yield* service
+        .listRefs({
+          ...refs,
+          worktreePath: thread.worktreePath,
+          workspaceRoot: project.value.workspaceRoot,
+        })
         .pipe(Effect.mapError(unavailable));
     }),
   ),
diff --git a/apps/server/src/mcp/toolkits/worktree/tools.ts b/apps/server/src/mcp/toolkits/worktree/tools.ts
index 81a39a5e30a42..18d6840d72291 100644
--- a/apps/server/src/mcp/toolkits/worktree/tools.ts
+++ b/apps/server/src/mcp/toolkits/worktree/tools.ts
@@ -10,7 +10,6 @@ import {
   ThreadId,
 } from "@t3tools/contracts";
 import * as Schema from "effect/Schema";
-import * as GitWorkflowService from "../../../git/GitWorkflowService.ts";
 import * as ProjectService from "../../../project/ProjectService.ts";
 import * as ThreadManagementService from "../../../orchestration-v2/ThreadManagementService.ts";
 import { Tool, Toolkit } from "effect/ai";
@@ -78,7 +77,7 @@ const WorktreeListTool = Tool.make("t3_worktree_list", {
     McpInvocationContext.McpInvocationContext,
     ThreadManagementService.ThreadManagementService,
     ProjectService.ProjectService,
-    GitWorkflowService.GitWorkflowService,
+    WorktreeMcpService.WorktreeMcpService,
   ],
 })
   .annotate(Tool.Readonly, true)

From 2ad6712c6d8054f32de9e04df89bd659380f48a3 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:29:28 +0000
Subject: [PATCH 117/167] fix(provider-core): text generation context cuts no
 longer split an emoji (#29653)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../provider-core/src/server/textGenerationUtils.test.ts | 8 +++++++-
 packages/provider-core/src/server/textGenerationUtils.ts | 4 +++-
 .../provider-core/src/server/threadTitleContext.test.ts  | 7 ++++++-
 packages/provider-core/src/server/threadTitleContext.ts  | 9 +++++++--
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/packages/provider-core/src/server/textGenerationUtils.test.ts b/packages/provider-core/src/server/textGenerationUtils.test.ts
index d82bb50df862a..885e09c4fe77b 100644
--- a/packages/provider-core/src/server/textGenerationUtils.test.ts
+++ b/packages/provider-core/src/server/textGenerationUtils.test.ts
@@ -1,6 +1,12 @@
 import { describe, expect, it } from "vite-plus/test";
 
-import { sanitizeCommitSubject, sanitizeThreadTitle } from "./textGenerationUtils.ts";
+import { limitSection, sanitizeCommitSubject, sanitizeThreadTitle } from "./textGenerationUtils.ts";
+
+describe("limitSection", () => {
+  it("cuts a long section without splitting an emoji", () => {
+    expect(limitSection(`${"a".repeat(9)}🚀 more`, 10)).toBe(`${"a".repeat(9)}\n\n[truncated]`);
+  });
+});
 
 describe("sanitizeCommitSubject", () => {
   // regression: #19181 truncation split grapheme clusters at the subject limit
diff --git a/packages/provider-core/src/server/textGenerationUtils.ts b/packages/provider-core/src/server/textGenerationUtils.ts
index 072999fd74969..d2afb675ae936 100644
--- a/packages/provider-core/src/server/textGenerationUtils.ts
+++ b/packages/provider-core/src/server/textGenerationUtils.ts
@@ -19,7 +19,9 @@ export function toJsonSchemaObject(schema: Schema.Top): unknown {
 
 export function limitSection(value: string, maxChars: number): string {
   if (value.length <= maxChars) return value;
-  const truncated = value.slice(0, maxChars);
+  // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+  const last = value.charCodeAt(maxChars - 1);
+  const truncated = value.slice(0, last >= 0xd800 && last <= 0xdbff ? maxChars - 1 : maxChars);
   return `${truncated}\n\n[truncated]`;
 }
 
diff --git a/packages/provider-core/src/server/threadTitleContext.test.ts b/packages/provider-core/src/server/threadTitleContext.test.ts
index 253f167c639c0..4c19d6f573134 100644
--- a/packages/provider-core/src/server/threadTitleContext.test.ts
+++ b/packages/provider-core/src/server/threadTitleContext.test.ts
@@ -1,7 +1,7 @@
 import { describe, expect, it } from "vite-plus/test";
 import { ChatAttachmentId } from "@t3tools/contracts";
 import { ATTACHMENT_ONLY_BOOTSTRAP_PROMPT } from "@t3tools/shared/composerContextReferences";
-import { formatThreadTitleContext } from "./threadTitleContext.ts";
+import { formatThreadTitleContext, limitTitleMessage } from "./threadTitleContext.ts";
 
 describe("thread title context", () => {
   it.each(["", "Ultrathink:\n"])("keeps attachments without bootstrap text (%j)", (prefix) => {
@@ -54,4 +54,9 @@ describe("thread title context", () => {
     expect(result.message).not.toContain("System instructions");
     expect(result.message.match(/USER:/g)).toHaveLength(1);
   });
+
+  it("cuts both ends of a long message without splitting an emoji", () => {
+    const result = limitTitleMessage(`${"a".repeat(9)}🚀${"b".repeat(20)}🚀${"c".repeat(9)}`, 41);
+    expect(result).toBe(`${"a".repeat(9)}\n[Content truncated]\n${"c".repeat(9)}`);
+  });
 });
diff --git a/packages/provider-core/src/server/threadTitleContext.ts b/packages/provider-core/src/server/threadTitleContext.ts
index f1840891e96bb..1bff106003958 100644
--- a/packages/provider-core/src/server/threadTitleContext.ts
+++ b/packages/provider-core/src/server/threadTitleContext.ts
@@ -17,8 +17,13 @@ export function limitTitleMessage(text: string, budget: number): string {
   if (text.length <= budget) return text;
   if (budget <= TRUNCATED.length) return "";
   const available = budget - TRUNCATED.length;
-  const head = Math.ceil(available / 2);
-  const tail = available - head;
+  let head = Math.ceil(available / 2);
+  let tail = available - head;
+  // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+  const last = text.charCodeAt(head - 1);
+  if (last >= 0xd800 && last <= 0xdbff) head -= 1;
+  const first = text.charCodeAt(text.length - tail);
+  if (tail > 0 && first >= 0xdc00 && first <= 0xdfff) tail -= 1;
   return `${text.slice(0, head)}${TRUNCATED}${tail > 0 ? text.slice(-tail) : ""}`;
 }
 

From 7767a95b57a9e5fab1b7b9d38d7a15893d99afa4 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:29:46 +0000
Subject: [PATCH 118/167] fix(server): html_preview no longer splits an emoji
 in a long console line (#29844)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/htmlRender/HtmlRender.test.ts | 12 ++++++++++--
 apps/server/src/htmlRender/headlessChrome.ts  |  7 +++++--
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/htmlRender/HtmlRender.test.ts b/apps/server/src/htmlRender/HtmlRender.test.ts
index 7d555c46a4e6c..645f863a16b47 100644
--- a/apps/server/src/htmlRender/HtmlRender.test.ts
+++ b/apps/server/src/htmlRender/HtmlRender.test.ts
@@ -351,16 +351,24 @@ fs.createReadStream(null, { fd: 3 }).on("end", quit).on("data", (chunk) => {
   for (const { id, method, sessionId } of messages.map((raw) => JSON.parse(raw))) {
     if (method === "Browser.close") quit();
     reply({ id, sessionId, result: results[method] ?? {} });
-    if (method === "Page.navigate") reply({ sessionId, method: "Page.loadEventFired", params: {} });
+    if (method === "Page.navigate") {
+      const value = "x" + "\u{1F600}".repeat(300);
+      const params = { type: "log", args: [{ type: "string", value }] };
+      reply({ sessionId, method: "Runtime.consoleAPICalled", params });
+      reply({ sessionId, method: "Page.loadEventFired", params: {} });
+    }
   }
 });
 `,
             { mode: 0o755 },
           );
 
-          yield* HtmlRender.HtmlRender.use((htmlRender) =>
+          const preview = yield* HtmlRender.HtmlRender.use((htmlRender) =>
             htmlRender.preview({ html: "<p>x</p>" }),
           ).pipe(Effect.provide(layerHtmlRender(executable)));
+          const logged = preview.consoleMessages[0]?.text ?? "";
+          expect(logged.isWellFormed()).toBe(true);
+          expect(logged).toHaveLength(500);
 
           const exitedBy = yield* fileSystem.readFileString(exitRecord).pipe(Effect.option);
           expect(Option.getOrElse(exitedBy, () => "killed by a signal")).toBe("asked to close");
diff --git a/apps/server/src/htmlRender/headlessChrome.ts b/apps/server/src/htmlRender/headlessChrome.ts
index 13ce0c6845740..5e2a5bb0d5891 100644
--- a/apps/server/src/htmlRender/headlessChrome.ts
+++ b/apps/server/src/htmlRender/headlessChrome.ts
@@ -316,10 +316,13 @@ const launchBrowser = Effect.fnUntraced(function* (input: {
       return yield* Effect.void;
     }
     const text = consoleMessage.text.replaceAll(PAGE_URL, PAGE_NAME);
+    // Half an emoji serializes to a lone surrogate escape, which provider JSON parsers reject.
+    const last = text.charCodeAt(MAX_CONSOLE_TEXT_CHARS - 1);
+    const end =
+      last >= 0xd800 && last <= 0xdbff ? MAX_CONSOLE_TEXT_CHARS - 1 : MAX_CONSOLE_TEXT_CHARS;
     page.consoleMessages.push({
       level: consoleMessage.level,
-      text:
-        text.length > MAX_CONSOLE_TEXT_CHARS ? `${text.slice(0, MAX_CONSOLE_TEXT_CHARS)}…` : text,
+      text: text.length > MAX_CONSOLE_TEXT_CHARS ? `${text.slice(0, end)}…` : text,
     });
     return yield* Effect.void;
   });

From 0673e7e61046087b2d714b7d064f555c778f0087 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:30:05 +0000
Subject: [PATCH 119/167] fix(server): diffs keep submodule changes under
 diff.submodule=log (#29852)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/checkpointing/CheckpointStore.test.ts | 7 +++++++
 apps/server/src/vcs/GitVcsDriver.ts                   | 1 +
 apps/server/src/vcs/GitVcsDriverCore.ts               | 3 ++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/checkpointing/CheckpointStore.test.ts b/apps/server/src/checkpointing/CheckpointStore.test.ts
index 51c461d4a6d59..36e58024adbae 100644
--- a/apps/server/src/checkpointing/CheckpointStore.test.ts
+++ b/apps/server/src/checkpointing/CheckpointStore.test.ts
@@ -159,6 +159,10 @@ it.layer(layerTest)("CheckpointStore.layer", (it) => {
         yield* initRepoWithCommit(tmp);
         yield* git(tmp, ["config", "diff.noprefix", "true"]);
         yield* git(tmp, ["config", "diff.suppressBlankEmpty", "true"]);
+        yield* git(tmp, ["config", "diff.submodule", "log"]);
+        const sub = NodePath.join(tmp, "sub");
+        yield* git(tmp, ["init", "sub"]);
+        yield* initRepoWithCommit(sub);
         const checkpointStore = yield* CheckpointStore.CheckpointStore;
         const threadId = ThreadId.make("thread-checkpoint-store-noprefix");
         const fromCheckpointRef = checkpointRefForThreadTurn(threadId, 0);
@@ -170,6 +174,7 @@ it.layer(layerTest)("CheckpointStore.layer", (it) => {
           checkpointRef: fromCheckpointRef,
         });
         yield* writeTextFile(NodePath.join(tmp, "README.md"), "# test\n\nafter\n");
+        yield* git(sub, ["commit", "--allow-empty", "-m", "moved"]);
         yield* checkpointStore.captureCheckpoint({
           cwd: tmp,
           checkpointRef: toCheckpointRef,
@@ -184,6 +189,8 @@ it.layer(layerTest)("CheckpointStore.layer", (it) => {
 
         expect(diff).toContain("diff --git a/README.md b/README.md");
         expect(diff).toContain(" # test\n \n-before\n+after\n");
+        expect(diff).toContain("diff --git a/sub b/sub");
+        expect(diff).toContain("+Subproject commit ");
       }),
     );
 
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index 42459d8450ab2..48f1f56b9b06e 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -1428,6 +1428,7 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
           "--no-color",
           "--no-ext-diff",
           "--no-textconv",
+          "--submodule=short",
           ...PATCH_RENDER_PREFIX_ARGS,
           ...(input.ignoreWhitespace ? ["--ignore-all-space"] : []),
           `${fromRevision}^{commit}`,
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 0d1d2c9b1c7e6..5e5aaa0fddce2 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -81,7 +81,7 @@ const REVIEW_BRANCH_SUBJECT_LIMIT = 300;
 const REVIEW_BRANCH_COMMIT_MAX_OUTPUT_BYTES = 128 * 1024;
 // Client patch parsers require a/ and b/ prefixes; override user diff prefix settings.
 export const PATCH_RENDER_PREFIX_ARGS = ["--src-prefix=a/", "--dst-prefix=b/"] as const;
-// Client patch parsers drop blank context lines that diff.suppressBlankEmpty prints without a space.
+// Client patch parsers drop blank context lines under diff.suppressBlankEmpty and summaries under diff.submodule.
 const REVIEW_DIFF_ARGS = [
   "-c",
   "diff.suppressBlankEmpty=false",
@@ -90,6 +90,7 @@ const REVIEW_DIFF_ARGS = [
   "--no-color",
   "--no-ext-diff",
   "--no-textconv",
+  "--submodule=short",
   ...PATCH_RENDER_PREFIX_ARGS,
 ];
 const STATUS_UPSTREAM_REFRESH_INTERVAL = Duration.seconds(15);

From 5e53057afbfe08e8d0e3af59e899f696582af981 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:30:23 +0000
Subject: [PATCH 120/167] fix(opencode): OpenCode 2 titles for image messages
 skip images the server cannot open (#29819)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../OpenCode2TextGeneration.test.ts           | 79 +++++++++++++------
 .../src/server/v2/textGeneration.ts           | 19 ++++-
 2 files changed, 71 insertions(+), 27 deletions(-)

diff --git a/apps/server/src/textGeneration/OpenCode2TextGeneration.test.ts b/apps/server/src/textGeneration/OpenCode2TextGeneration.test.ts
index 2cfe556ebf58f..869cd1b4fb5e7 100644
--- a/apps/server/src/textGeneration/OpenCode2TextGeneration.test.ts
+++ b/apps/server/src/textGeneration/OpenCode2TextGeneration.test.ts
@@ -1,12 +1,15 @@
 import { assert, it } from "@effect/vitest";
 import * as NodeServices from "@effect/platform-node/NodeServices";
-import { ProviderInstanceId } from "@t3tools/contracts";
+import * as NodeURL from "node:url";
+import { ChatAttachmentId, ChatImageAttachment, ProviderInstanceId } from "@t3tools/contracts";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import { TestClock } from "effect/testing";
 
+import * as ProviderHost from "@t3tools/provider-core/server/ProviderHost";
 import * as TestProviderHost from "@t3tools/provider-testing/TestProviderHost";
 import * as OpenCode2AdapterV2Testkit from "../orchestration-v2/Adapters/OpenCode2AdapterV2.testkit.ts";
 import * as OpenCode2Server from "@t3tools/provider-opencode/server/v2/OpenCode2Server";
@@ -16,28 +19,58 @@ import { OPENCODE2_TITLE_GENERATION } from "./OpenCode2TextGeneration.fixture.ts
 const layer = TestProviderHost.layer().pipe(Layer.provideMerge(NodeServices.layer));
 
 it.layer(layer)("OpenCode2TextGeneration", (it) => {
-  it.effect("generates a title in a temporary session on the free tier and removes it", () =>
-    Effect.gen(function* () {
-      const server = yield* OpenCode2AdapterV2Testkit.replayServer({
-        provider: "opencode",
-        protocol: OpenCode2AdapterV2Testkit.OPENCODE2_HTTP_PROTOCOL,
-        version: "2.0.18",
-        scenario: "opencode2_title_generation",
-        entries: [...OPENCODE2_TITLE_GENERATION, { type: "runtime_exit", status: "success" }],
-      });
-      const textGeneration = yield* OpenCode2TextGeneration.make().pipe(
-        Effect.provideService(OpenCode2Server.OpenCode2Server, server),
-      );
-      const title = yield* textGeneration.generateThreadTitle({
-        cwd: process.cwd(),
-        message: "fix the login redirect loop after oauth",
-        modelSelection: {
-          instanceId: ProviderInstanceId.make("opencode"),
-          model: "opencode/big-pickle",
-        },
-      });
-      assert.equal(title.title, "Fix OAuth Login Redirect Loop");
-    }).pipe(Effect.scoped),
+  it.effect.each([false, true] as const)(
+    "generates a title in a temporary session on the free tier and removes it (external: %s)",
+    (external) =>
+      Effect.gen(function* () {
+        const host = yield* ProviderHost.ProviderHost;
+        const fileSystem = yield* FileSystem.FileSystem;
+        const image = (id: string, name: string, mimeType: string) =>
+          ChatImageAttachment.make({
+            type: "image",
+            id: ChatAttachmentId.make(id),
+            name,
+            mimeType,
+            sizeBytes: 4,
+          });
+        const screenshot = image("oc2-title-screenshot", "screen.png", "image/png");
+        const missing = image("oc2-title-missing", "missing.png", "image/png");
+        const unsupported = image("oc2-title-diagram", "diagram.svg", "image/svg+xml");
+        const screenshotPath = host.resolveAttachmentPath(screenshot)!;
+        yield* fileSystem.writeFileString(screenshotPath, "data");
+        yield* fileSystem.writeFileString(host.resolveAttachmentPath(unsupported)!, "<svg/>");
+        const prompts: Array<unknown> = [];
+        const server = yield* OpenCode2AdapterV2Testkit.replayServer(
+          {
+            provider: "opencode",
+            protocol: OpenCode2AdapterV2Testkit.OPENCODE2_HTTP_PROTOCOL,
+            version: "2.0.18",
+            scenario: "opencode2_title_generation",
+            entries: [...OPENCODE2_TITLE_GENERATION, { type: "runtime_exit", status: "success" }],
+          },
+          { external, onPrompt: (input) => prompts.push(input) },
+        );
+        const textGeneration = yield* OpenCode2TextGeneration.make().pipe(
+          Effect.provideService(OpenCode2Server.OpenCode2Server, server),
+        );
+        const title = yield* textGeneration.generateThreadTitle({
+          cwd: process.cwd(),
+          message: "fix the login redirect loop after oauth",
+          attachments: [screenshot, missing, unsupported],
+          modelSelection: {
+            instanceId: ProviderInstanceId.make("opencode"),
+            model: "opencode/big-pickle",
+          },
+        });
+        assert.equal(title.title, "Fix OAuth Login Redirect Loop");
+        if (external) {
+          assert.notProperty(prompts[0], "files");
+        } else {
+          assert.deepInclude(prompts[0], {
+            files: [{ uri: NodeURL.pathToFileURL(screenshotPath).href, name: "screen.png" }],
+          });
+        }
+      }).pipe(Effect.scoped),
   );
 
   it.effect("keeps a provider's own error message out of the caller-visible detail", () =>
diff --git a/packages/provider-opencode/src/server/v2/textGeneration.ts b/packages/provider-opencode/src/server/v2/textGeneration.ts
index 4897b58afdc17..64c8293771954 100644
--- a/packages/provider-opencode/src/server/v2/textGeneration.ts
+++ b/packages/provider-opencode/src/server/v2/textGeneration.ts
@@ -2,11 +2,14 @@
 import { AbsolutePath, Location, Model, Provider, Session } from "@opencode/client/effect";
 import { TextGenerationError } from "@t3tools/contracts";
 import { getModelSelectionStringOptionValue } from "@t3tools/shared/model";
+import * as NodeURL from "node:url";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 
+import { isProviderNativeImageAttachment } from "@t3tools/provider-core/server/attachmentPrompt";
 import * as ProviderHost from "@t3tools/provider-core/server/ProviderHost";
 import * as OpenCode2Server from "./OpenCode2Server.ts";
 import * as OpenCodeRuntime from "../OpenCodeRuntime.ts";
@@ -29,6 +32,7 @@ const runOnServer = Effect.fn("Opencode2TextGeneration.runOnServer")(function* (
   input: TextGenerationOperations.Request<Schema.Top>,
 ) {
   const { resolveAttachmentPath } = yield* ProviderHost.ProviderHost;
+  const fileSystem = yield* FileSystem.FileSystem;
   const { client } = connection;
   const parsed = OpenCodeRuntime.parseOpenCodeModelSlug(input.modelSelection.model);
   if (parsed === null) {
@@ -131,11 +135,16 @@ const runOnServer = Effect.fn("Opencode2TextGeneration.runOnServer")(function* (
         .remove({ sessionID: session.id })
         .pipe(Effect.timeout("5 seconds"), Effect.ignore({ log: true })),
     );
-    const images = (input.attachments ?? []).flatMap((attachment) => {
-      if (attachment.type !== "image") return [];
+    const images: Array<{ uri: string; name: string }> = [];
+    // As in the adapter: an external server may not share T3's attachment directory, and
+    // OpenCode rejects the whole prompt if an attached file is missing.
+    for (const attachment of connection.external ? [] : (input.attachments ?? [])) {
+      if (!isProviderNativeImageAttachment(attachment)) continue;
       const path = resolveAttachmentPath(attachment);
-      return path === null ? [] : [{ uri: `file://${path}`, name: attachment.name }];
-    });
+      if (path === null) continue;
+      const exists = yield* fileSystem.exists(path).pipe(Effect.orElseSucceed(() => false));
+      if (exists) images.push({ uri: NodeURL.pathToFileURL(path).href, name: attachment.name });
+    }
     yield* client.session.prompt({
       sessionID: session.id,
       text: input.prompt,
@@ -179,11 +188,13 @@ const runOnServer = Effect.fn("Opencode2TextGeneration.runOnServer")(function* (
 export const make = Effect.fn("OpenCode2TextGeneration.make")(function* () {
   const server = yield* OpenCode2Server.OpenCode2Server;
   const host = yield* ProviderHost.ProviderHost;
+  const fileSystem = yield* FileSystem.FileSystem;
   const run: TextGenerationOperations.Runner = (input) =>
     server
       .withConnection((connection) => runOnServer(connection, input))
       .pipe(
         Effect.provideService(ProviderHost.ProviderHost, host),
+        Effect.provideService(FileSystem.FileSystem, fileSystem),
         Effect.mapError((cause) =>
           isTextGenerationError(cause)
             ? cause

From aeaf3633b53b0a6faab4e5f20d83a03483c04141 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:30:50 +0000
Subject: [PATCH 121/167] fix(server): orchestrator_capabilities no longer
 offers providers the project turned off (#29842)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/mcp/OrchestratorMcpService.test.ts    | 35 ++++++++++++++++++-
 apps/server/src/mcp/OrchestratorMcpService.ts | 11 +++++-
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/mcp/OrchestratorMcpService.test.ts b/apps/server/src/mcp/OrchestratorMcpService.test.ts
index 3bd9439d308b4..0faf43acb9dd5 100644
--- a/apps/server/src/mcp/OrchestratorMcpService.test.ts
+++ b/apps/server/src/mcp/OrchestratorMcpService.test.ts
@@ -1392,6 +1392,7 @@ describe("OrchestratorMcpService provider resolution", () => {
       Effect.gen(function* () {
         const disabledAntigravityInstanceId = ProviderInstanceId.make("antigravity-alt");
         const disabledWithoutAdapterInstanceId = ProviderInstanceId.make("codex-without-adapter");
+        const projectDisabledInstanceId = ProviderInstanceId.make("codex-project-off");
         const forkOnlyInstanceId = ProviderInstanceId.make("forkOnly");
         const forkShadow = yield* buildUnavailableProviderSnapshot({
           driverKind: "forkOnly",
@@ -1437,6 +1438,11 @@ describe("OrchestratorMcpService provider resolution", () => {
             model: "gpt-5.4",
             enabled: false,
           }),
+          providerSnapshot({
+            instanceId: projectDisabledInstanceId,
+            driver: ProviderDriverKind.make("codex"),
+            model: "gpt-5.4",
+          }),
           forkShadow,
         ];
         const layerDependencies = Layer.mergeAll(
@@ -1445,12 +1451,34 @@ describe("OrchestratorMcpService provider resolution", () => {
           Layer.mock(ThreadManagementService.ThreadManagementService)({
             getThreadRecords: () => Effect.succeed(parentProjection([])),
           }),
-          ServerSettings.layerTest(),
+          ServerSettings.layerTest({
+            providerInstances: {
+              [ProviderInstanceId.make("pi")]: {
+                driver: ProviderDriverKind.make("pi"),
+                enabled: true,
+              },
+              [ProviderInstanceId.make("acpRegistry")]: {
+                driver: ProviderDriverKind.make("acpRegistry"),
+                enabled: true,
+              },
+              [antigravityInstanceId]: {
+                driver: ProviderDriverKind.make("antigravity"),
+                enabled: true,
+              },
+              [projectDisabledInstanceId]: { driver: ProviderDriverKind.make("codex") },
+            },
+            projectSettingsOverrides: {
+              [projectId]: {
+                providerInstances: { [projectDisabledInstanceId]: { enabled: false } },
+              },
+            },
+          }),
           Layer.mock(ProviderRegistry.ProviderRegistry)({
             getProviders: Effect.sync(() => providers),
           }),
           adapterRegistryLayer([
             codexInstanceId,
+            projectDisabledInstanceId,
             ProviderInstanceId.make("claudeAgent"),
             ProviderInstanceId.make("pi"),
             ProviderInstanceId.make("acpRegistry"),
@@ -1521,6 +1549,11 @@ describe("OrchestratorMcpService provider resolution", () => {
           assert.isFalse(disabled!.canRunCrossProviderChildTask);
           assert.deepEqual(disabled!.constraints, ["Provider instance is disabled."]);
 
+          const projectDisabled = byId.get(projectDisabledInstanceId);
+          assert.isDefined(projectDisabled);
+          assert.isFalse(projectDisabled!.canRunChildTask);
+          assert.deepEqual(projectDisabled!.constraints, ["Provider instance is disabled."]);
+
           const disabledWithoutAdapter = byId.get(disabledWithoutAdapterInstanceId);
           assert.isDefined(disabledWithoutAdapter);
           assert.isFalse(disabledWithoutAdapter!.canRunChildTask);
diff --git a/apps/server/src/mcp/OrchestratorMcpService.ts b/apps/server/src/mcp/OrchestratorMcpService.ts
index b937453f39b22..e84212cab0023 100644
--- a/apps/server/src/mcp/OrchestratorMcpService.ts
+++ b/apps/server/src/mcp/OrchestratorMcpService.ts
@@ -62,6 +62,7 @@ import {
   type ServerProviderModel,
   ThreadId,
   isOrchestrationV2WorkActive,
+  resolveProjectProviderInstanceEnabled,
 } from "@t3tools/contracts";
 import { getProviderOptionCurrentValue } from "@t3tools/shared/model";
 import { runRanAfter } from "@t3tools/shared/orchestrationV2ThreadError";
@@ -2275,8 +2276,16 @@ const make = Effect.gen(function* () {
         runtimeMode: limits.runtimeMode,
         interactionMode: limits.interactionMode,
         providers: providers.map((provider) => {
+          // Snapshots list instances any project enables; delegate_task checks the caller's project.
+          const enabledForCaller =
+            parent === undefined ||
+            resolveProjectProviderInstanceEnabled(
+              settings,
+              parent.thread.projectId,
+              provider.instanceId,
+            );
           const constraints = providerConstraints(
-            provider,
+            enabledForCaller ? provider : { ...provider, enabled: false },
             orchestrationCapableInstanceIds.has(provider.instanceId),
           );
           const { listed, omitted } = listCapabilityModels({

From 77b948e3e78d53e2c0ff52b2c36ab02edc59fd4c Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:31:13 +0000
Subject: [PATCH 122/167] fix(web): big terminal selections no longer break
 sending (#29804)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/lib/composerContextRecords.test.ts | 17 ++++++++++++++++-
 apps/web/src/lib/composerContextRecords.ts      | 12 ++++++++++--
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/lib/composerContextRecords.test.ts b/apps/web/src/lib/composerContextRecords.test.ts
index f612a302ac8c8..212f214d59570 100644
--- a/apps/web/src/lib/composerContextRecords.test.ts
+++ b/apps/web/src/lib/composerContextRecords.test.ts
@@ -255,7 +255,7 @@ describe("composerContextRecords", () => {
     expect(removeInlineContextReference(prompt, reference.contextId).prompt).toBe("prose tail");
   });
 
-  it("clamps an oversized review selection so the record still encodes", () => {
+  it("clamps oversized review and terminal selections so the records still encode", () => {
     const build = (diffLength: number) =>
       reviewCommentContextRecord({
         id: "rc-big",
@@ -276,6 +276,21 @@ describe("composerContextRecords", () => {
     expect(overLimit.diff.endsWith("… truncated …")).toBe(true);
     expect(() => decodeMessageContext({ version: 1, records: [atLimit] })).not.toThrow();
     expect(() => decodeMessageContext({ version: 1, records: [overLimit] })).not.toThrow();
+
+    const terminal = terminalContextRecord({
+      id: "term-big",
+      threadId: ThreadId.make("t"),
+      createdAt: "2026-01-01T00:00:00.000Z",
+      terminalId: "default",
+      terminalLabel: "Terminal 1",
+      lineStart: 1,
+      lineEnd: 2_000,
+      text: `${"t".repeat(63_985)}${"😀".repeat(8)}`,
+    });
+    expect(terminal.text).toBe(`${"t".repeat(63_985)}\n… truncated …`);
+    expect(decodeMessageContext({ version: 1, records: [terminal] }).records).toMatchObject([
+      { kind: "terminal", text: terminal.text },
+    ]);
   });
 
   it("finds the destination collision for different legacy terminal messages", () => {
diff --git a/apps/web/src/lib/composerContextRecords.ts b/apps/web/src/lib/composerContextRecords.ts
index c4f123f73dcc4..2779950ed22a0 100644
--- a/apps/web/src/lib/composerContextRecords.ts
+++ b/apps/web/src/lib/composerContextRecords.ts
@@ -5,6 +5,7 @@ import {
 import {
   COMPOSER_CONTEXT_REVIEW_DIFF_MAX_CHARS,
   COMPOSER_CONTEXT_REVIEW_TEXT_MAX_CHARS,
+  COMPOSER_CONTEXT_TERMINAL_TEXT_MAX_CHARS,
 } from "@t3tools/contracts";
 import type {
   ComposerContextId,
@@ -52,7 +53,11 @@ const TRUNCATION_MARKER = "\n… truncated …";
 
 function clampContextText(value: string, max: number): string {
   if (value.length <= max) return value;
-  return `${value.slice(0, Math.max(0, max - TRUNCATION_MARKER.length))}${TRUNCATION_MARKER}`;
+  let end = Math.max(0, max - TRUNCATION_MARKER.length);
+  // Never end on a lone high surrogate.
+  const last = value.charCodeAt(end - 1);
+  if (last >= 0xd800 && last <= 0xdbff) end -= 1;
+  return `${value.slice(0, end)}${TRUNCATION_MARKER}`;
 }
 
 type ReviewCommentPresentation = ReviewCommentContext | ReviewCommentContextRecord;
@@ -187,7 +192,10 @@ export function terminalContextRecord(context: TerminalContextDraft): TerminalCo
     terminalLabel: context.terminalLabel,
     lineStart: context.lineStart,
     lineEnd: context.lineEnd,
-    text: normalizeTerminalContextText(context.text),
+    text: clampContextText(
+      normalizeTerminalContextText(context.text),
+      COMPOSER_CONTEXT_TERMINAL_TEXT_MAX_CHARS,
+    ),
   };
 }
 

From fcad9de8cee5ec3e8486dc05eb2b662ab0c3e7c9 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 15:31:19 -0800
Subject: [PATCH 123/167] test(web): file editor dismissal test waits for the
 editor to render (#30350)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../files/fileEditorDismissal.browser.test.tsx       | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/components/files/fileEditorDismissal.browser.test.tsx b/apps/web/src/components/files/fileEditorDismissal.browser.test.tsx
index 7f7d6601c68ca..efc7d0fcc82e2 100644
--- a/apps/web/src/components/files/fileEditorDismissal.browser.test.tsx
+++ b/apps/web/src/components/files/fileEditorDismissal.browser.test.tsx
@@ -1,3 +1,4 @@
+import { DEFAULT_THEMES, preloadHighlighter } from "@pierre/diffs";
 import { Editor, type EditorFactory } from "@pierre/diffs/edit";
 import { EditProvider, File } from "@pierre/diffs/react";
 import { describe, expect, it, vi } from "vite-plus/test";
@@ -12,6 +13,8 @@ describe("installFileEditorDismissal", () => {
     let editor: Editor<"file" | "file-diff", undefined, undefined> | undefined;
     const createEditor: EditorFactory<undefined, undefined> = (...args) =>
       (editor = new Editor(...args));
+    // File paints nothing until the shared highlighter has loaded; once it has, mount renders synchronously.
+    await preloadHighlighter({ themes: Object.values(DEFAULT_THEMES), langs: ["typescript"] });
     await using screen = await render(
       <>
         <p>Assistant reply</p>
@@ -23,17 +26,14 @@ describe("installFileEditorDismissal", () => {
       </>,
     );
     const shadowRoot = () => screen.container.querySelector("diffs-container")?.shadowRoot;
-    const content = await vi.waitFor(() => {
-      const element = shadowRoot()?.querySelector<HTMLElement>("[data-content]");
-      expect(element).toBeTruthy();
-      return element!;
-    });
+    const content = shadowRoot()?.querySelector<HTMLElement>("[data-content]");
+    expect(content).toBeTruthy();
 
     editor!.setSelections([
       { start: { line: 0, character: 8 }, end: { line: 0, character: 8 }, direction: "none" },
     ]);
     const isMac = isMacPlatform(navigator.platform);
-    content.dispatchEvent(
+    content!.dispatchEvent(
       new KeyboardEvent("keydown", {
         key: "f",
         code: "KeyF",

From fb8e6d8656a2c4ca8e089736593944cd21b4de07 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 15:31:23 -0800
Subject: [PATCH 124/167] test(web): worked-for heading test clicks once the
 list is revealed (#30404)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../web/src/components/chat/MessagesTimeline.browser.test.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx b/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
index 6b1df4ca16927..775d32da13d27 100644
--- a/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
+++ b/apps/web/src/components/chat/MessagesTimeline.browser.test.tsx
@@ -236,7 +236,9 @@ describe("MessagesTimeline work rows", () => {
       { container },
     );
     const heading = screen.getByRole("button", { name: /^Worked for/ });
-    await expect.element(heading).toBeVisible();
+    // LegendList keeps rows click-through until its initial scroll settles on animation
+    // frames, which the fake clock below would freeze.
+    await expect.element(heading).toHaveStyle({ pointerEvents: "auto" });
     const viewport = props.listRef.current!.getScrollableNode()!;
     await vi.waitFor(() =>
       expect(viewport.scrollHeight - viewport.clientHeight - viewport.scrollTop).toBeLessThan(2),

From 19a2bad15553a4e1b8bb07350a75c178d390d1fc Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:32:21 +0000
Subject: [PATCH 125/167] fix(azure-devops): legacy DefaultCollection pull
 request URLs can be pasted to check out (#29763)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/client-runtime/src/pullRequestLinkInput.test.ts     | 5 +++++
 .../source-control-azure-devops/src/shared/definition.ts     | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/client-runtime/src/pullRequestLinkInput.test.ts b/packages/client-runtime/src/pullRequestLinkInput.test.ts
index 79bbc96bdea3b..49404975ab6e2 100644
--- a/packages/client-runtime/src/pullRequestLinkInput.test.ts
+++ b/packages/client-runtime/src/pullRequestLinkInput.test.ts
@@ -159,6 +159,11 @@ describe("parsePullRequestReference", () => {
     expect(
       parsePullRequestReference("https://acme.visualstudio.com/project/_git/t3code/pullrequest/42"),
     ).toBe("https://acme.visualstudio.com/project/_git/t3code/pullrequest/42");
+    expect(
+      parsePullRequestReference(
+        "https://acme.visualstudio.com/DefaultCollection/project/_git/t3code/pullrequest/42",
+      ),
+    ).toBe("https://acme.visualstudio.com/DefaultCollection/project/_git/t3code/pullrequest/42");
   });
 
   it.each([
diff --git a/packages/source-control-azure-devops/src/shared/definition.ts b/packages/source-control-azure-devops/src/shared/definition.ts
index e0491368d7203..5f6fca54f089c 100644
--- a/packages/source-control-azure-devops/src/shared/definition.ts
+++ b/packages/source-control-azure-devops/src/shared/definition.ts
@@ -15,7 +15,7 @@ const CHANGE_REQUEST_PATH = /^\/((?:[^/]+\/)*_git\/[^/]+)\/pullrequest\/(\d+)(?:
 const COMMIT_PATH = /^\/((?:[^/]+\/)*_git\/[^/]+)\/commit\/([0-9a-f]+)\/?$/iu;
 const CHECKOUT_COMMAND = /^az\s+repos\s+pr\s+checkout\s+(.+)$/i;
 const CHANGE_REQUEST_REFERENCE =
-  /^https:\/\/(?:dev\.azure\.com\/[^/\s]+\/[^/\s]+|[^/\s]+\.visualstudio\.com\/[^/\s]+)\/_git\/[^/\s]+\/pullrequest\/(\d+)(?:[/?#].*)?$/i;
+  /^https:\/\/(?:dev\.azure\.com\/[^/\s]+\/[^/\s]+|[^/\s]+\.visualstudio\.com\/(?:DefaultCollection\/)?[^/\s]+)\/_git\/[^/\s]+\/pullrequest\/(\d+)(?:[/?#].*)?$/i;
 
 /**
  * Azure alone addresses one repository under two names that share no part: `ssh.dev.azure.com` and

From 87049668615717241c1bd4449e872ae82ab1702e Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:36:13 +0000
Subject: [PATCH 126/167] fix(shared): preview_open reports about: and mailto:
 as unsupported instead of misreading them (#29614)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/shared/src/preview.test.ts | 14 ++++++++++++++
 packages/shared/src/preview.ts      |  8 ++++++++
 2 files changed, 22 insertions(+)

diff --git a/packages/shared/src/preview.test.ts b/packages/shared/src/preview.test.ts
index 231b141bf036f..d381156090b57 100644
--- a/packages/shared/src/preview.test.ts
+++ b/packages/shared/src/preview.test.ts
@@ -179,4 +179,18 @@ describe("normalizePreviewUrl", () => {
       );
     }
   });
+
+  it("reports explicit non-web schemes instead of reading them as a host", () => {
+    for (const [rawUrl, protocol] of [
+      ["about:blank", "about:"],
+      ["mailto:alice@example.com", "mailto:"],
+      ["javascript:alert(1)", "javascript:"],
+    ] as const) {
+      expect(() => normalizePreviewUrl(rawUrl)).toThrow(
+        expect.objectContaining({ reason: "unsupported-protocol", protocol }),
+      );
+    }
+    expect(normalizePreviewUrl("localhost:3000")).toBe("http://localhost:3000/");
+    expect(normalizePreviewUrl("devbox:8080")).toBe("https://devbox:8080/");
+  });
 });
diff --git a/packages/shared/src/preview.ts b/packages/shared/src/preview.ts
index f279c07f73866..6740b50d26eb0 100644
--- a/packages/shared/src/preview.ts
+++ b/packages/shared/src/preview.ts
@@ -185,6 +185,14 @@ export function normalizePreviewUrl(rawUrl: string): string {
   if (trimmed.length === 0) {
     throw new PreviewUrlNormalizationError({ inputLength: rawUrl.length, reason: "empty" });
   }
+  const explicitProtocol = previewUrlProtocol(trimmed);
+  if (explicitProtocol !== undefined && KNOWN_NON_WEB_SCHEMES.has(explicitProtocol)) {
+    throw new PreviewUrlNormalizationError({
+      inputLength: rawUrl.length,
+      reason: "unsupported-protocol",
+      protocol: explicitProtocol,
+    });
+  }
   const useHttp = LOOPBACK_PREFIX_PATTERN.test(trimmed);
   const candidate = URL_SCHEME_WITH_AUTHORITY_PATTERN.test(trimmed)
     ? trimmed

From 67861fd9fbc8d65d755ee94f5a23c92f4dab7baa Mon Sep 17 00:00:00 2001
From: Taylor Dolezal <onlydole@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:36:30 -0800
Subject: [PATCH 127/167] fix(server): delegated threads no longer share one
 provider event log (#29770)

Co-authored-by: Taylor Dolezal <117500+onlydole@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/attachmentStore.ts            |  2 +-
 .../src/provider/EventNdjsonLogger.test.ts    | 33 +++++++++++++++++++
 apps/server/src/provider/EventNdjsonLogger.ts | 18 +++++++---
 3 files changed, 48 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/attachmentStore.ts b/apps/server/src/attachmentStore.ts
index 5d8ab2e90181b..616b0d90c17b2 100644
--- a/apps/server/src/attachmentStore.ts
+++ b/apps/server/src/attachmentStore.ts
@@ -13,7 +13,7 @@ import {
 import { inferImageExtension, SAFE_IMAGE_FILE_EXTENSIONS } from "./imageMime.ts";
 
 const ATTACHMENT_FILENAME_EXTENSIONS = [...SAFE_IMAGE_FILE_EXTENSIONS, ".bin"];
-const ATTACHMENT_ID_THREAD_SEGMENT_MAX_CHARS = 80;
+export const ATTACHMENT_ID_THREAD_SEGMENT_MAX_CHARS = 80;
 const ATTACHMENT_ID_THREAD_SEGMENT_PATTERN = "[a-z0-9_]+(?:-[a-z0-9_]+)*";
 const ATTACHMENT_ID_UUID_PATTERN = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
 const ATTACHMENT_ID_FILE_EXTENSION_PATTERN = "[a-z0-9]{1,10}";
diff --git a/apps/server/src/provider/EventNdjsonLogger.test.ts b/apps/server/src/provider/EventNdjsonLogger.test.ts
index c04150dce8df6..3cb7870f3f518 100644
--- a/apps/server/src/provider/EventNdjsonLogger.test.ts
+++ b/apps/server/src/provider/EventNdjsonLogger.test.ts
@@ -156,6 +156,39 @@ it.layer(NodeServices.layer)("EventNdjsonLogger", (it) => {
     }),
   );
 
+  it.effect("keeps long thread ids that share a prefix in separate files", () =>
+    Effect.gen(function* () {
+      const tempDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-provider-log-"));
+      const basePath = NodePath.join(tempDir, "events.log");
+      const prefix =
+        "thread:delegated-task:command%3Amcp%3A00000000-0000-4000-8000-000000000000%3Adelegate-task%3A";
+
+      try {
+        const store = yield* makeEventNdjsonLogStore(basePath, { batchWindowMs: 0 });
+        const logger = store.logger("native");
+        yield* logger.write({ id: "first" }, ThreadId.make(`${prefix}review-the-diff`));
+        yield* logger.write({ id: "second" }, ThreadId.make(`${prefix}write-the-tests`));
+        yield* store.close();
+
+        const files = NodeFS.readdirSync(tempDir);
+        assert.equal(files.length, 2);
+        assert.deepEqual(
+          files
+            .map((name) =>
+              NodeFS.readFileSync(NodePath.join(tempDir, name), "utf8")
+                .trim()
+                .split("\n")
+                .map((line) => parseLogLine(line).payload),
+            )
+            .toSorted(),
+          [['{"id":"first"}'], ['{"id":"second"}']],
+        );
+      } finally {
+        NodeFS.rmSync(tempDir, { recursive: true, force: true });
+      }
+    }),
+  );
+
   it.effect("keeps shared store views non-owning when one adapter closes", () =>
     Effect.gen(function* () {
       const tempDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-provider-log-"));
diff --git a/apps/server/src/provider/EventNdjsonLogger.ts b/apps/server/src/provider/EventNdjsonLogger.ts
index 0e8c9043dcf0f..6a1d3844b2373 100644
--- a/apps/server/src/provider/EventNdjsonLogger.ts
+++ b/apps/server/src/provider/EventNdjsonLogger.ts
@@ -1,5 +1,6 @@
 // @effect-diagnostics nodeBuiltinImport:off
 /** Native and canonical views share write state to avoid races on the same thread file. */
+import * as NodeCrypto from "node:crypto";
 import * as NodeFS from "node:fs";
 import * as NodePath from "node:path";
 
@@ -18,7 +19,10 @@ import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as SynchronizedRef from "effect/SynchronizedRef";
 
-import { toSafeThreadAttachmentSegment } from "../attachmentStore.ts";
+import {
+  ATTACHMENT_ID_THREAD_SEGMENT_MAX_CHARS,
+  toSafeThreadAttachmentSegment,
+} from "../attachmentStore.ts";
 import type * as ResourceAttribution from "../resourceTelemetry/ResourceAttribution.ts";
 
 const MEBIBYTE = 1024 * 1024;
@@ -145,8 +149,13 @@ function logWarning(message: string, context: Record<string, unknown>): Effect.E
 }
 
 function resolveThreadSegment(raw: string | null | undefined): string {
-  const normalized = typeof raw === "string" ? toSafeThreadAttachmentSegment(raw) : null;
-  return normalized ?? GLOBAL_THREAD_SEGMENT;
+  if (typeof raw !== "string") return GLOBAL_THREAD_SEGMENT;
+  const normalized = toSafeThreadAttachmentSegment(raw);
+  if (normalized === null) return GLOBAL_THREAD_SEGMENT;
+  // Delegated thread ids share a prefix longer than the segment, so ids that may be cut get a hash.
+  if (raw.length <= ATTACHMENT_ID_THREAD_SEGMENT_MAX_CHARS) return normalized;
+  const hash = NodeCrypto.createHash("sha256").update(raw).digest("hex").slice(0, 16);
+  return `${normalized}-${hash}`;
 }
 
 function resolveStreamLabel(stream: EventNdjsonStream): string {
@@ -725,12 +734,13 @@ export const makeEventNdjsonLogStore = Effect.fnUntraced(function* (
       const observedAt = yield* DateTime.now.pipe(Effect.map(DateTime.formatIso));
       const line = `[${observedAt}] ${resolveStreamLabel(stream)}: ${payload}\n`;
       const bytes = Buffer.byteLength(line);
+      const threadSegment = resolveThreadSegment(threadId);
       const action = yield* SynchronizedRef.modifyEffect(stateRef, (state) => {
         if (state.closed) {
           return Effect.succeed([{ flush: false }, state] as const);
         }
         const pending = state.pending;
-        pending.push({ stream, threadSegment: resolveThreadSegment(threadId), line, bytes });
+        pending.push({ stream, threadSegment, line, bytes });
         const pendingBytes = state.pendingBytes + bytes;
         const flush =
           resolved.batchWindowMs === 0 ||

From 6049196c5004d95ea7ea9a1781a2b4245a2a6e93 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Tue, 3 Nov 2026 15:36:37 -0800
Subject: [PATCH 128/167] fix(server): a queued provider switch no longer ends
 background work (#30401)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/orchestration-v2/Orchestrator.ts      | 111 ++++++++++------
 .../ProviderSwitch.integration.test.ts        | 123 ++++++++++++++++--
 2 files changed, 186 insertions(+), 48 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 08ba4ab5cc0aa..f20ca8bdc92c1 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -1167,6 +1167,35 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         return withId;
       });
 
+  // Detaching kills background work running inside the provider process.
+  // Probe even with an empty roster: Claude's native subagents never reach
+  // pendingBackgroundTasks. Sessions shared across threads probe per thread.
+  const sessionHasBackgroundWork = Effect.fn("Orchestrator.sessionHasBackgroundWork")(function* (
+    detaching: OrchestrationV2ThreadProjection["providerSessions"][number],
+    providerThreads: OrchestrationV2ThreadProjection["providerThreads"],
+  ) {
+    const session = yield* providerSessions
+      .get(detaching.id)
+      .pipe(Effect.orElseSucceed(() => Option.none()));
+    if (Option.isNone(session)) return false;
+    const runtime = session.value;
+    const probes =
+      !detaching.capabilities.sessions.supportsMultipleProviderThreadsPerSession &&
+      runtime.hasPendingBackgroundWork !== undefined
+        ? [runtime.hasPendingBackgroundWork]
+        : providerThreads.flatMap((providerThread) =>
+            providerThread.providerSessionId === detaching.id &&
+            runtime.hasPendingBackgroundWorkForThread !== undefined
+              ? [runtime.hasPendingBackgroundWorkForThread(providerThread)]
+              : [],
+          );
+    for (const probe of probes) {
+      // A failed probe cannot confirm that the work ended.
+      if (yield* probe.pipe(Effect.catchCause(() => Effect.succeed(true)))) return true;
+    }
+    return false;
+  });
+
   // Runs in every command transaction; avoid reading thousands of finished leaf nodes.
   const readCommandProjection = (threadId: ThreadId) =>
     projectionStore
@@ -1827,6 +1856,42 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
                 ),
               )
           : null;
+      const releasableSessions = projection.providerSessions.filter(
+        (session) =>
+          switchPlan?.releaseProviderSessionIds.includes(session.id) &&
+          session.status !== "stopped" &&
+          session.status !== "error",
+      );
+      const busySessionIds = new Set<ProviderSessionId>();
+      for (const session of releasableSessions) {
+        if (yield* sessionHasBackgroundWork(session, projection.providerThreads)) {
+          busySessionIds.add(session.id);
+        }
+      }
+      // Nobody waits on a queued start to refuse it. A handoff runs in its own session, so a
+      // busy one stays up; a restart resumes the busy session's native thread, so wait instead.
+      if (busySessionIds.size > 0 && switchPlan?.transition.type === "restart_and_resume") {
+        yield* Effect.logInfo(
+          "Holding the queue: the replaced provider session still runs background work",
+          { threadId, runId: queuedRun.id, providerSessionIds: Array.from(busySessionIds) },
+        );
+        yield* writeSystemEvents(
+          projection.runs
+            .filter((run) => run.status === "queued")
+            .map((run) => ({
+              type: "run.updated" as const,
+              threadId,
+              runId: run.id,
+              providerInstanceId: run.providerInstanceId,
+              occurredAt: now,
+              payload: { ...run, queueHeld: true },
+            })),
+        );
+        return;
+      }
+      const sessionsToDetach = releasableSessions.filter(
+        (session) => !busySessionIds.has(session.id),
+      );
       const canResumeAcrossInstances =
         switchPlan?.instanceChanged === true &&
         switchPlan.transition.type === "restart_and_resume" &&
@@ -2165,12 +2230,6 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
               },
             ]
           : [];
-      const sessionsToDetach = projection.providerSessions.filter(
-        (session) =>
-          switchPlan?.releaseProviderSessionIds.includes(session.id) &&
-          session.status !== "stopped" &&
-          session.status !== "error",
-      );
       yield* writeSystemEvents(
         [
           ...(selectionChanged
@@ -6284,40 +6343,14 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         session.status !== "stopped" &&
         session.status !== "error",
     );
-    // Detaching kills background work running inside the provider process.
-    // Probe even with an empty roster: Claude's native subagents never reach
-    // pendingBackgroundTasks. Sessions shared across threads probe per thread.
     for (const detaching of sessionsToDetach) {
-      const session = yield* providerSessions
-        .get(detaching.id)
-        .pipe(Effect.orElseSucceed(() => Option.none()));
-      if (Option.isNone(session)) {
-        continue;
-      }
-      const runtime = session.value;
-      const probes =
-        !detaching.capabilities.sessions.supportsMultipleProviderThreadsPerSession &&
-        runtime.hasPendingBackgroundWork !== undefined
-          ? [runtime.hasPendingBackgroundWork]
-          : projection.providerThreads.flatMap((providerThread) =>
-              providerThread.providerSessionId === detaching.id &&
-              runtime.hasPendingBackgroundWorkForThread !== undefined
-                ? [runtime.hasPendingBackgroundWorkForThread(providerThread)]
-                : [],
-            );
-      for (const probe of probes) {
-        const stillRunning = yield* probe.pipe(
-          // A failed probe cannot confirm that the work ended.
-          Effect.catchCause(() => Effect.succeed(true)),
-        );
-        if (stillRunning) {
-          return yield* new OrchestratorDispatchError({
-            commandId: command.commandId,
-            commandType: command.type,
-            cause:
-              "The previous provider is still running background agents or commands, and switching would end them. Wait for them to finish, or press Stop, then send the message again.",
-          });
-        }
+      if (yield* sessionHasBackgroundWork(detaching, projection.providerThreads)) {
+        return yield* new OrchestratorDispatchError({
+          commandId: command.commandId,
+          commandType: command.type,
+          cause:
+            "The previous provider is still running background agents or commands, and switching would end them. Wait for them to finish, or press Stop, then send the message again.",
+        });
       }
     }
 
diff --git a/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts b/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
index 2570c28e36b77..629b3902e763d 100644
--- a/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
+++ b/apps/server/src/orchestration-v2/testkit/ProviderSwitch.integration.test.ts
@@ -2529,21 +2529,36 @@ describe("orchestration v2 provider switching", () => {
 
   // regression: #20343 sending to an instance with separate history must release the old session
   it.live.each([
-    ["detaches the previous instance's session when a send hands off to another instance", false],
-    ["refuses the hand-off while the previous instance still runs background work", true],
-  ] as const)("%s", ([, backgroundRunning]) =>
+    [
+      "detaches the previous instance's session when a send hands off to another instance",
+      { background: false, queued: false, sharedHistory: false },
+    ],
+    [
+      "refuses the hand-off while the previous instance still runs background work",
+      { background: true, queued: false, sharedHistory: false },
+    ],
+    [
+      "keeps a busy previous session running when a queued hand-off starts",
+      { background: true, queued: true, sharedHistory: false },
+    ],
+    [
+      "holds a queued account switch while the replaced session still runs background work",
+      { background: true, queued: true, sharedHistory: true },
+    ],
+  ] as const)("%s", ([, { background, queued, sharedHistory }]) =>
     Effect.scoped(
       Effect.gen(function* () {
         const cwd = yield* checkpointWorkspace("handoff-releases-session");
         const capturedTurns = yield* Ref.make<ReadonlyArray<CapturedTurn>>([]);
-        const backgroundWork = yield* Ref.make(backgroundRunning);
+        const backgroundWork = yield* Ref.make(background);
         const closedSessions = yield* Ref.make<ReadonlyArray<string>>([]);
+        const firstStarted = yield* Deferred.make<void>();
+        const releaseFirst = yield* Deferred.make<void>();
         const secondSelection: ModelSelection = {
           ...CLAUDE_MODEL_SELECTION,
           instanceId: ProviderInstanceId.make("claude-second-account"),
         };
-        // No shared continuation key: each Claude instance owns its own native history.
-        const layerRegistry = ProviderAdapterRegistry.layerFromAdapters([
+        const adapters = [
           makeTestAdapter({
             instanceId: CLAUDE_MODEL_SELECTION.instanceId,
             driver: CLAUDE_DRIVER,
@@ -2553,6 +2568,7 @@ describe("orchestration v2 provider switching", () => {
             capturedTurns,
             backgroundWork,
             closedSessions,
+            ...(queued ? { holdFirstTurn: firstStarted, releaseFirstTurn: releaseFirst } : {}),
           }),
           makeTestAdapter({
             instanceId: secondSelection.instanceId,
@@ -2562,7 +2578,33 @@ describe("orchestration v2 provider switching", () => {
             responseByRunOrdinal: { 2: "Second account complete" },
             capturedTurns,
           }),
-        ]);
+        ];
+        // Without a shared continuation key, each Claude instance owns its own native history.
+        const layerRegistry = sharedHistory
+          ? Layer.succeed(
+              ProviderAdapterRegistry.ProviderAdapterRegistryV2,
+              ProviderAdapterRegistry.ProviderAdapterRegistryV2.of({
+                get: (instanceId) => {
+                  const adapter = adapters.find((candidate) => candidate.instanceId === instanceId);
+                  return adapter === undefined
+                    ? Effect.fail(
+                        new ProviderAdapterRegistry.ProviderAdapterRegistryLookupError({
+                          instanceId,
+                        }),
+                      )
+                    : Effect.succeed(adapter);
+                },
+                list: () => Effect.succeed(adapters.map((adapter) => adapter.instanceId)),
+                getMetadata: () =>
+                  Effect.succeed({
+                    driver: CLAUDE_DRIVER,
+                    continuationKey: "claude:shared-native-account-history",
+                    enabled: true,
+                    capabilities: ClaudeProviderCapabilitiesV2,
+                  }),
+              }),
+            )
+          : ProviderAdapterRegistry.layerFromAdapters(adapters);
         const handoffThreadId = ThreadId.make("thread:handoff-releases-session");
         yield* Effect.gen(function* () {
           const orchestrator = yield* Orchestrator.OrchestratorV2;
@@ -2578,7 +2620,7 @@ describe("orchestration v2 provider switching", () => {
               text: `Prompt ${ordinal}`,
               attachments: [],
               modelSelection,
-              dispatchMode: { type: "start_immediately" },
+              dispatchMode: { type: queued ? "queue_after_active" : "start_immediately" },
             });
           yield* orchestrator.dispatch({
             type: "thread.create",
@@ -2595,6 +2637,69 @@ describe("orchestration v2 provider switching", () => {
             worktreePath: cwd,
           });
           yield* send(1, CLAUDE_MODEL_SELECTION);
+
+          if (queued) {
+            yield* Deferred.await(firstStarted);
+            yield* send(2, secondSelection);
+            const queuedRunId = (yield* orchestrator.getThreadProjection(handoffThreadId)).runs[1]
+              ?.id;
+            assert.isDefined(queuedRunId);
+            yield* Deferred.succeed(releaseFirst, undefined);
+            yield* orchestrator.streamStoredEvents.pipe(
+              Stream.filter(
+                ({ event }) =>
+                  event.type === "run.updated" &&
+                  event.runId === queuedRunId &&
+                  (event.payload.queueHeld === true || event.payload.status === "completed"),
+              ),
+              Stream.runHead,
+            );
+            yield* worker.drain();
+            const afterQueue = yield* orchestrator.getThreadProjection(handoffThreadId);
+            const firstSession = afterQueue.providerSessions.find(
+              (session) => session.providerInstanceId === CLAUDE_MODEL_SELECTION.instanceId,
+            );
+            // Detaching would end the background agents, so the busy session must stay up.
+            assert.deepEqual(yield* Ref.get(closedSessions), []);
+            assert.equal(firstSession?.status, "ready");
+            if (!sharedHistory) {
+              assert.deepEqual(
+                afterQueue.runs.map((run) => [run.providerInstanceId, run.status]),
+                [
+                  [CLAUDE_MODEL_SELECTION.instanceId, "completed"],
+                  [secondSelection.instanceId, "completed"],
+                ],
+              );
+              return;
+            }
+            // Resuming the native thread beside the busy session would fork its history.
+            assert.deepEqual(
+              afterQueue.runs.map((run) => [run.status, run.queueHeld === true]),
+              [
+                ["completed", false],
+                ["queued", true],
+              ],
+            );
+            assert.lengthOf(yield* Ref.get(capturedTurns), 1);
+            yield* Ref.set(backgroundWork, false);
+            yield* orchestrator.dispatch({
+              type: "queue.resume",
+              commandId: CommandId.make("command:handoff-releases-session:resume"),
+              threadId: handoffThreadId,
+            });
+            yield* worker.drain();
+            const resumed = yield* waitForIdle(handoffThreadId);
+            assert.deepEqual(
+              resumed.runs.map((run) => [run.providerInstanceId, run.status]),
+              [
+                [CLAUDE_MODEL_SELECTION.instanceId, "completed"],
+                [secondSelection.instanceId, "completed"],
+              ],
+            );
+            assert.deepEqual(yield* Ref.get(closedSessions), [firstSession!.id]);
+            return;
+          }
+
           yield* worker.drain();
           const afterFirst = yield* waitForIdle(handoffThreadId);
           const firstSession = afterFirst.providerSessions.find(
@@ -2602,7 +2707,7 @@ describe("orchestration v2 provider switching", () => {
           );
           assert.equal(firstSession?.status, "ready");
 
-          if (backgroundRunning) {
+          if (background) {
             // Native subagents live only in the adapter's roster, so the projection's
             // pendingBackgroundTasks stays empty while the probe still reports work.
             assert.deepEqual(afterFirst.providerThreads[0]?.pendingBackgroundTasks ?? [], []);

From 8198b2ed5e1286afa46b26e65290d31977555dce Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:36:52 +0000
Subject: [PATCH 129/167] fix(kiro): slow kiro-cli starts no longer show Kiro
 as unavailable (#29841)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/provider/KiroProvider.test.ts | 45 +++++++++++++++++--
 packages/provider-kiro/src/server/status.ts   |  4 +-
 2 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/provider/KiroProvider.test.ts b/apps/server/src/provider/KiroProvider.test.ts
index b0b9143d97a55..1877c131e3158 100644
--- a/apps/server/src/provider/KiroProvider.test.ts
+++ b/apps/server/src/provider/KiroProvider.test.ts
@@ -3,13 +3,16 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, describe, it } from "@effect/vitest";
 import { KiroSettings } from "@t3tools/provider-kiro/settings";
 import * as Deferred from "effect/Deferred";
+import type * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Queue from "effect/Queue";
 import * as Schema from "effect/Schema";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import * as TestClock from "effect/testing/TestClock";
 
 import {
   checkKiroProviderStatus,
@@ -23,18 +26,25 @@ const settings = Schema.decodeSync(KiroSettings)({ enabled: true });
 interface CliOutput {
   readonly stdout: string;
   readonly code: number;
+  /** Holds stdout and the exit back this long, like a CLI slow to answer. */
+  readonly delay?: Duration.Input;
 }
 
 function processHandle(output: CliOutput) {
+  const answered = Effect.sleep(output.delay ?? 0);
   return ChildProcessSpawner.makeHandle({
     pid: ChildProcessSpawner.ProcessId(900_000_002),
-    exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(output.code)),
+    exitCode: Effect.as(answered, ChildProcessSpawner.ExitCode(output.code)),
     isRunning: Effect.succeed(false),
     kill: () => Effect.void,
     unref: Effect.succeed(Effect.void),
     stdin: Sink.drain,
-    stdout:
-      output.stdout.length === 0 ? Stream.empty : Stream.succeed(encoder.encode(output.stdout)),
+    stdout: Stream.unwrap(
+      Effect.as(
+        answered,
+        output.stdout.length === 0 ? Stream.empty : Stream.succeed(encoder.encode(output.stdout)),
+      ),
+    ),
     stderr: Stream.empty,
     all: Stream.empty,
     getInputFd: () => Sink.drain,
@@ -123,6 +133,35 @@ const check = (
   }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer)));
 
 describe("KiroProvider", () => {
+  it.effect.each([
+    {
+      label: "answers after 6 s",
+      delay: "6 seconds",
+      status: "ready",
+      version: "2.27.0",
+      message: undefined,
+    },
+    {
+      label: "never answers",
+      delay: "Infinity",
+      status: "error",
+      version: null,
+      message: "Failed to run `kiro-cli --version`.",
+    },
+  ] as const)("gives `kiro-cli --version` 10 s when it $label", (row) =>
+    Effect.gen(function* () {
+      const fiber = yield* check({
+        "--version": { stdout: "kiro-cli 2.27.0\n", code: 0, delay: row.delay },
+        "whoami --format json": { stdout: '{"accountType":"ApiKey","email":null}\n', code: 0 },
+      }).pipe(Effect.forkChild);
+      yield* TestClock.adjust("10 seconds");
+      const { snapshot } = yield* Fiber.join(fiber);
+      assert.equal(snapshot.status, row.status);
+      assert.equal(snapshot.version, row.version);
+      assert.equal(snapshot.message, row.message);
+    }),
+  );
+
   it.effect("reports a CLI whose version probe exits nonzero as failing to run", () =>
     Effect.gen(function* () {
       const { snapshot, invoked } = yield* check({
diff --git a/packages/provider-kiro/src/server/status.ts b/packages/provider-kiro/src/server/status.ts
index 39eed259b4be9..83de43df93a8e 100644
--- a/packages/provider-kiro/src/server/status.ts
+++ b/packages/provider-kiro/src/server/status.ts
@@ -26,7 +26,6 @@ import {
   AUTH_PROBE_TIMEOUT_MS,
   buildServerProvider,
   COMPACT_SLASH_COMMAND,
-  DEFAULT_TIMEOUT_MS,
   isCommandMissingCause,
   parseGenericCliVersion,
   buildSelectOptionDescriptor,
@@ -54,6 +53,7 @@ const KIRO_BUILT_IN_MODELS: ReadonlyArray<ServerProviderModel> = [
   },
 ];
 const KIRO_API_KEY_ENV = "KIRO_API_KEY";
+const VERSION_PROBE_TIMEOUT_MS = 10_000;
 
 /**
  * The agent picker is not a model trait, but the composer reads options per
@@ -374,7 +374,7 @@ export const checkKiroProviderStatus = Effect.fn("checkKiroProviderStatus")(func
   }
 
   const versionResult = yield* runKiroCli(settings, ["--version"], environment).pipe(
-    Effect.timeoutOption(DEFAULT_TIMEOUT_MS),
+    Effect.timeoutOption(VERSION_PROBE_TIMEOUT_MS),
     Effect.result,
   );
   if (Result.isFailure(versionResult) || Option.isNone(versionResult.success)) {

From 480eb8d219a5103b84c029cd32ee31819e028e2b Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:37:08 +0000
Subject: [PATCH 130/167] fix(client): mark unread sticks on a thread reopened
 within ten minutes (#29814)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/state/threadVisits.test.ts            | 19 +++++++++++++++++++
 .../client-runtime/src/state/threadVisits.ts  |  7 ++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/packages/client-runtime/src/state/threadVisits.test.ts b/packages/client-runtime/src/state/threadVisits.test.ts
index adcac7139e82a..c67ca4fa807c9 100644
--- a/packages/client-runtime/src/state/threadVisits.test.ts
+++ b/packages/client-runtime/src/state/threadVisits.test.ts
@@ -111,6 +111,25 @@ it("keeps a mark-unread on the open thread until new activity lands", () => {
   expect(t.visits.slice(1)).toEqual([{ threadId: t.ref.threadId, visitedAt: at(30) }]);
 });
 
+it("keeps a mark-unread on a read thread reopened within the open dedupe window", () => {
+  using t = setup("thread-unread-reopened", {
+    updatedAt: at(10),
+    lastVisitedAt: at(10),
+    latestRun: { completedAt: at(9) },
+  });
+  claimThreadOpen(environmentId, t.ref.threadId, Date.UTC(2026, 0, 1));
+  t.mount();
+  t.update({ lastVisitedAt: at(8) });
+  vi.advanceTimersByTime(VISIT_DISPATCH_THROTTLE_MS);
+  expect(t.visits).toEqual([]);
+
+  // An authoritative snapshot can briefly replace the row with an older one.
+  t.update({ updatedAt: at(5), lastVisitedAt: at(5), latestRun: { completedAt: at(4) } });
+  t.update({ updatedAt: at(10), lastVisitedAt: at(8), latestRun: { completedAt: at(9) } });
+  vi.advanceTimersByTime(VISIT_DISPATCH_THROTTLE_MS);
+  expect(t.visits).toEqual([]);
+});
+
 it("keeps mark unread sticky after an expired wake is retired", () => {
   using t = setup("thread-unread-retired-wake", {
     updatedAt: at(10),
diff --git a/packages/client-runtime/src/state/threadVisits.ts b/packages/client-runtime/src/state/threadVisits.ts
index c08f47ed01436..e63c2ad9c0279 100644
--- a/packages/client-runtime/src/state/threadVisits.ts
+++ b/packages/client-runtime/src/state/threadVisits.ts
@@ -114,7 +114,12 @@ export function createThreadVisitTracker(options: ThreadVisitTrackerOptions) {
           return;
         }
         const lastVisitedAtMs = shell.lastVisitedAt ? Date.parse(shell.lastVisitedAt) : NaN;
-        if (!Number.isNaN(lastVisitedAtMs) && lastVisitedAtMs >= updatedAtMs) return;
+        if (!Number.isNaN(lastVisitedAtMs) && lastVisitedAtMs >= updatedAtMs) {
+          // Already seen, so a later mark-unread stays sticky even when no open was sent.
+          if (lastDispatchedUpdatedAt === null || Date.parse(lastDispatchedUpdatedAt) < updatedAtMs)
+            lastDispatchedUpdatedAt = visitedAt;
+          return;
+        }
         if (lastDispatchedUpdatedAt !== null && Date.parse(lastDispatchedUpdatedAt) >= updatedAtMs)
           return;
 

From d7ee7b31f4dd73671fd6a74965cf075041d56079 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:37:26 +0000
Subject: [PATCH 131/167] fix(pi): extension errors name folder extensions
 instead of "index" (#29768)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/provider-pi/src/server/adapter.test.ts | 10 ++++++++--
 packages/provider-pi/src/server/adapter.ts      |  6 ++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/packages/provider-pi/src/server/adapter.test.ts b/packages/provider-pi/src/server/adapter.test.ts
index dc994f90cac5a..e52505ce249dc 100644
--- a/packages/provider-pi/src/server/adapter.test.ts
+++ b/packages/provider-pi/src/server/adapter.test.ts
@@ -1533,7 +1533,10 @@ describe("PiAdapterV2", () => {
   it.effect("gives notify and extension-error items distinct ids in each thread", () =>
     Effect.gen(function* () {
       const itemIds = new Set<string>();
-      for (const threadId of [THREAD_ID, ThreadId.make("thread-pi-test-2")]) {
+      for (const [threadId, extensionPath] of [
+        [THREAD_ID, "/ext/a.ts"],
+        [ThreadId.make("thread-pi-test-2"), "/ext/a/index.ts"],
+      ] as const) {
         const fake = yield* makeFakePi;
         const { runtime, takeEvent } = yield* openRuntime(fake, "default", threadId);
         const providerThread = yield* runtime.ensureThread({
@@ -1558,7 +1561,7 @@ describe("PiAdapterV2", () => {
           method: "notify",
           message: "note",
         });
-        yield* fake.emit({ type: "extension_error", extensionPath: "/ext/a.ts", error: "boom" });
+        yield* fake.emit({ type: "extension_error", extensionPath, error: "boom" });
         for (const prefix of ["notify:", "extension-error:"]) {
           const item = yield* takeEvent(
             (event) =>
@@ -1566,6 +1569,9 @@ describe("PiAdapterV2", () => {
               event.turnItem.nativeItemRef?.nativeId?.startsWith(prefix) === true,
           );
           if (item.type === "turn_item.updated") itemIds.add(item.turnItem.id);
+          if (item.type === "turn_item.updated" && prefix === "extension-error:") {
+            assert.equal(item.turnItem.title, "a");
+          }
         }
       }
       assert.equal(itemIds.size, 4);
diff --git a/packages/provider-pi/src/server/adapter.ts b/packages/provider-pi/src/server/adapter.ts
index a8e140f02b784..4f3a6175aa39a 100644
--- a/packages/provider-pi/src/server/adapter.ts
+++ b/packages/provider-pi/src/server/adapter.ts
@@ -3376,8 +3376,10 @@ function piSubagentOutput(result: unknown): string {
 
 function piExtensionDisplayName(extensionPath: string | undefined): string {
   if (extensionPath === undefined) return "Pi extension";
-  const normalized = extensionPath.replace(/\\/g, "/").replace(/\/+$/, "");
-  const name = normalized.slice(normalized.lastIndexOf("/") + 1).replace(/\.[^.]+$/, "");
+  const segments = extensionPath.replace(/\\/g, "/").split("/").filter(Boolean);
+  const fileName = segments.at(-1)?.replace(/\.[^.]+$/, "") ?? "";
+  // Pi loads a directory extension from its index file; the folder names it.
+  const name = fileName === "index" ? (segments.at(-2) ?? fileName) : fileName;
   return name.length === 0 ? "Pi extension" : name;
 }
 

From 40aba09b445f00df14eb773ef7d1701fe6fbfbc6 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:37:43 +0000
Subject: [PATCH 132/167] fix(github): Enterprise Server pull request URLs can
 be pasted to check out (#29892)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/client-runtime/src/pullRequestLinkInput.test.ts | 8 ++++++++
 packages/source-control-github/src/shared/definition.ts  | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/client-runtime/src/pullRequestLinkInput.test.ts b/packages/client-runtime/src/pullRequestLinkInput.test.ts
index 49404975ab6e2..9cc80830efec1 100644
--- a/packages/client-runtime/src/pullRequestLinkInput.test.ts
+++ b/packages/client-runtime/src/pullRequestLinkInput.test.ts
@@ -173,6 +173,14 @@ describe("parsePullRequestReference", () => {
     expect(parsePullRequestReference(url)).toBe(url);
   });
 
+  it.each([
+    "https://github.acme.test/acme/web/pull/42",
+    "https://git.corp.example/acme/web/pull/42/files?diff=split",
+  ])("accepts GitHub Enterprise Server pull request URL %s", (url) => {
+    expect(parsePullRequestReference(url)).toBe(url);
+    expect(parsePullRequestReference(`gh pr checkout ${url}`)).toBe(url);
+  });
+
   it("accepts gh pr checkout commands with raw numbers", () => {
     expect(parsePullRequestReference("gh pr checkout 42")).toBe("42");
   });
diff --git a/packages/source-control-github/src/shared/definition.ts b/packages/source-control-github/src/shared/definition.ts
index 8244e10d9e72c..3c33cfb3a3f64 100644
--- a/packages/source-control-github/src/shared/definition.ts
+++ b/packages/source-control-github/src/shared/definition.ts
@@ -19,7 +19,7 @@ import { gitHubReferenceAutolinks } from "./referenceAutolinks.ts";
 
 const CHECKOUT_COMMAND = /^gh\s+pr\s+checkout\s+(.+)$/i;
 const CHANGE_REQUEST_REFERENCE =
-  /^https:\/\/github\.com\/[^/\s]+\/[^/\s]+\/pull\/(\d+)(?:[/?#].*)?$/i;
+  /^https?:\/\/[^/?#\s]+\/[^/\s]+\/[^/\s]+\/pull\/(\d+)(?:[/?#].*)?$/i;
 
 // GitHub Enterprise Server runs on any hostname, so the `<owner>/<repo>/pull/<n>` route alone
 // identifies a GitHub pull request.

From b7fcb7c11122f216eabfc0ff61f80ac071cd2dfb Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:38:01 +0000
Subject: [PATCH 133/167] fix(server): a peer refusing one call no longer marks
 its link as failing (#29914)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/peer/PeerMcpClient.test.ts | 80 +++++++++++++++++++---
 apps/server/src/peer/PeerMcpClient.ts      | 30 +++++---
 2 files changed, 93 insertions(+), 17 deletions(-)

diff --git a/apps/server/src/peer/PeerMcpClient.test.ts b/apps/server/src/peer/PeerMcpClient.test.ts
index 7d19f4e856bf7..cd2b0a9e52b16 100644
--- a/apps/server/src/peer/PeerMcpClient.test.ts
+++ b/apps/server/src/peer/PeerMcpClient.test.ts
@@ -1,5 +1,6 @@
 import { NodeHttpServer } from "@effect/platform-node";
 import { expect, it } from "@effect/vitest";
+import { OrchestratorMcpFailure } from "@t3tools/contracts";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
@@ -30,8 +31,19 @@ const toolkit = Toolkit.make(
     success: Result,
     dependencies: [McpInvocationContext.McpInvocationContext],
   }),
+  Tool.make("refuse", {
+    description: "Refuses the call.",
+    success: Result,
+    failure: OrchestratorMcpFailure,
+    failureMode: "return",
+  }),
 );
 
+const refusal = new OrchestratorMcpFailure({
+  code: "thread_not_found",
+  message: "Thread thread-gone was not found.",
+});
+
 it.effect.each([false, true])(
   "reuses an initialized session before its first call finishes (cancelled: %s)",
   (cancelFirst) =>
@@ -47,6 +59,7 @@ it.effect.each([false, true])(
         );
         const handlers = McpToolAccess.toLayer(toolkit, {
           probe: McpToolAccess.reads(() => modes),
+          refuse: McpToolAccess.reads(() => Effect.fail(refusal)),
           hold: McpToolAccess.reads(() =>
             Deferred.succeed(entered, undefined).pipe(
               Effect.andThen(Deferred.await(release)),
@@ -91,10 +104,45 @@ it.effect.each([false, true])(
     ).pipe(Effect.provide(NodeHttpServer.layerTest)),
 );
 
+it.effect("keeps a link healthy when the peer refuses a call", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const handlers = McpToolAccess.toLayer(toolkit, {
+        probe: McpToolAccess.reads(() => Effect.succeed({ modes: "" })),
+        hold: McpToolAccess.reads(() => Effect.succeed({ modes: "" })),
+        refuse: McpToolAccess.reads(() => Effect.fail(refusal)),
+      });
+      const box = descriptorOf("environment-box", "Box");
+      const b = yield* servePeer(box, McpHttpServer.toolkitRegistration(toolkit, handlers));
+      const context = yield* Layer.build(
+        layerLinkingEnvironment(descriptorOf("environment-a", "A")),
+      );
+      const links = Context.get(context, PeerLinks.PeerLinks);
+      const client = Context.get(context, PeerMcpClient.PeerMcpClient);
+      yield* linkTo(links, b);
+      yield* links.recordOutcome(box.environmentId, { error: "earlier outage" });
+      const refused = yield* client
+        .call({
+          environmentId: box.environmentId,
+          tool: "refuse",
+          arguments: {},
+          limits: { runtimeMode: "full-access", interactionMode: "default" },
+          success: Result,
+        })
+        .pipe(Effect.flip);
+      // The agent hears the peer's own refusal; the link answered, so it is not failing.
+      expect(refused).toMatchObject({ code: refusal.code, message: refusal.message });
+      const link = yield* links.get(box.environmentId);
+      expect(link._tag === "Some" ? link.value.lastError : "missing").toBeNull();
+    }),
+  ).pipe(Effect.provide(NodeHttpServer.layerTest)),
+);
+
 it.effect("renews a missing peer session once and reuses its replacement", () =>
   Effect.gen(function* () {
     const sessionHeaders: Array<string | undefined> = [];
-    const statuses = [200, 202, 404, 200, 202, 200, 200];
+    const statuses = [200, 202, 404, 200, 202, 200, 200, 200];
+    const outcomes: Array<string | null> = [];
     const http = HttpClient.make((request) =>
       Effect.sync(() => {
         const index = sessionHeaders.length;
@@ -104,13 +152,15 @@ it.effect("renews a missing peer session once and reuses its replacement", () =>
         return HttpClientResponse.fromWeb(
           request,
           new Response(
-            index >= 5
-              ? JSON.stringify({
-                  result: {
-                    content: [{ type: "text", text: '{"modes":"approval-required/plan"}' }],
-                  },
-                })
-              : "",
+            index === 7
+              ? "{}"
+              : index >= 5
+                ? JSON.stringify({
+                    result: {
+                      content: [{ type: "text", text: '{"modes":"approval-required/plan"}' }],
+                    },
+                  })
+                : "",
             {
               status,
               headers:
@@ -146,7 +196,7 @@ it.effect("renews a missing peer session once and reuses its replacement", () =>
                   url: "https://peer.example",
                   token: "fixture",
                 }),
-              recordOutcome: () => Effect.void,
+              recordOutcome: (_, outcome) => Effect.sync(() => outcomes.push(outcome.error)),
             }),
           ),
         ),
@@ -164,6 +214,17 @@ it.effect("renews a missing peer session once and reuses its replacement", () =>
         }),
       ).toEqual({ modes: "approval-required/plan" });
     }
+    // An answer with neither a result nor an error is the link's problem, not the call's.
+    const empty = yield* client
+      .call({
+        environmentId: box.environmentId,
+        tool: "probe",
+        arguments: {},
+        limits: { runtimeMode: "approval-required", interactionMode: "plan" },
+        success: Result,
+      })
+      .pipe(Effect.flip);
+    expect(outcomes).toEqual([null, null, empty.message]);
     expect(sessionHeaders).toEqual([
       undefined,
       "old",
@@ -172,6 +233,7 @@ it.effect("renews a missing peer session once and reuses its replacement", () =>
       "renewed",
       "renewed",
       "renewed",
+      "renewed",
     ]);
   }).pipe(Effect.scoped),
 );
diff --git a/apps/server/src/peer/PeerMcpClient.ts b/apps/server/src/peer/PeerMcpClient.ts
index 27397d54ba7de..885c91dce8665 100644
--- a/apps/server/src/peer/PeerMcpClient.ts
+++ b/apps/server/src/peer/PeerMcpClient.ts
@@ -9,6 +9,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Ref from "effect/Ref";
+import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
 import * as HttpBody from "effect/http/HttpBody";
 import * as HttpClient from "effect/http/HttpClient";
@@ -210,25 +211,36 @@ const make = Effect.gen(function* () {
             }),
         ),
       );
-      if (body.error !== undefined || body.result === undefined) {
+      if (body.error !== undefined) {
+        return Result.fail(
+          new OrchestratorMcpFailure({ code: "invalid_request", message: body.error.message }),
+        );
+      }
+      if (body.result === undefined) {
         return yield* new OrchestratorMcpFailure({
           code: "invalid_request",
-          message: body.error?.message ?? "The linked environment returned no result.",
+          message: "The linked environment returned no result.",
         });
       }
       const text = body.result.content.map((part) => part.text ?? "").join("");
       if (body.result.isError === true) {
         // A refusal keeps the peer's own code, so the agent sees why it was refused.
         const refused = decodeFailure(text);
-        return yield* refused._tag === "Some"
-          ? new OrchestratorMcpFailure({ code: refused.value.code, message: refused.value.message })
-          : new OrchestratorMcpFailure({
-              code: "orchestration_error",
-              message: text || "The linked environment refused the call.",
-            });
+        return Result.fail(
+          refused._tag === "Some"
+            ? new OrchestratorMcpFailure({
+                code: refused.value.code,
+                message: refused.value.message,
+              })
+            : new OrchestratorMcpFailure({
+                code: "orchestration_error",
+                message: text || "The linked environment refused the call.",
+              }),
+        );
       }
       const success = Schema.fromJsonString(input.success);
       return yield* Schema.decodeEffect(success)(text).pipe(
+        Effect.map(Result.succeed),
         Effect.mapError(
           () =>
             new OrchestratorMcpFailure({
@@ -244,6 +256,7 @@ const make = Effect.gen(function* () {
         Effect.tapError((error) =>
           links.recordOutcome(input.environmentId, { error: error.message }),
         ),
+        // A refusal is still an answer: the link works, so only this call fails.
         Effect.tap(() => links.recordOutcome(input.environmentId, { error: null })),
         // Recorded above with the transport's own message; the agent hears it plainly.
         Effect.catchTags({
@@ -255,6 +268,7 @@ const make = Effect.gen(function* () {
               }),
             ),
         }),
+        Effect.flatMap(Effect.fromResult),
       ),
   );
 

From 0bd447e51ee6e62f9e4cea5bf8753e7c01fc4c6d Mon Sep 17 00:00:00 2001
From: Taylor Dolezal <onlydole@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:38:19 -0800
Subject: [PATCH 134/167] perf(server): Claude skill discovery resolves each
 repository root once (#29757)

Co-authored-by: Taylor Dolezal <117500+onlydole@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/provider/Drivers/ClaudeSkills.test.ts | 65 +++++++++++++++++++
 .../src/provider/Drivers/ClaudeSkills.ts      | 19 ++++--
 2 files changed, 77 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/provider/Drivers/ClaudeSkills.test.ts b/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
index 860280aa91e89..b4ce31cac866c 100644
--- a/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
+++ b/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
@@ -209,6 +209,71 @@ it.layer(NodeServices.layer)("discoverClaudeSkills", (it) => {
     }),
   );
 
+  it.effect("resolves each install record's project repository once per discovery", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      // Real path: macOS temp dirs sit behind a /var -> /private/var symlink.
+      const tempDir = yield* fs.realPath(
+        yield* fs.makeTempDirectoryScoped({ prefix: "t3-claude-skills-" }),
+      );
+      const configDir = path.join(tempDir, "claude-home");
+      const workspace = path.join(tempDir, "workspace");
+      const otherProject = path.join(tempDir, "other", "packages", "app");
+      const sameRepoProject = path.join(workspace, "packages", "app");
+      yield* fs.makeDirectory(path.join(workspace, ".git"), { recursive: true });
+      yield* fs.makeDirectory(path.join(tempDir, "other", ".git"), { recursive: true });
+      yield* fs.makeDirectory(otherProject, { recursive: true });
+      yield* fs.makeDirectory(sameRepoProject, { recursive: true });
+      const elsewhereInstall = path.join(configDir, "plugins", "elsewhere");
+      const sameRepoInstall = path.join(configDir, "plugins", "same-repo");
+      yield* writeSkill(path.join(elsewhereInstall, "skills"), "elsewhere", "# Elsewhere");
+      yield* writeSkill(path.join(sameRepoInstall, "skills"), "same-repo", "# Same repo");
+      const records = Array.from({ length: 4 }, () => ({
+        scope: "project",
+        projectPath: otherProject,
+        installPath: elsewhereInstall,
+      }));
+      const plugins = ["a@shop", "b@shop", "c@shop"];
+      yield* fs.writeFileString(
+        path.join(configDir, "plugins", "installed_plugins.json"),
+        JSON.stringify({
+          plugins: {
+            ...Object.fromEntries(plugins.map((key) => [key, records])),
+            "d@shop": [
+              { scope: "project", projectPath: sameRepoProject, installPath: sameRepoInstall },
+            ],
+          },
+        }),
+      );
+      yield* fs.writeFileString(
+        path.join(configDir, "settings.json"),
+        JSON.stringify({
+          enabledPlugins: Object.fromEntries([...plugins, "d@shop"].map((key) => [key, true])),
+        }),
+      );
+
+      const probed: Array<string> = [];
+      const skills = yield* discoverClaudeSkills({ homePath: configDir }, workspace).pipe(
+        Effect.provideService(FileSystem.FileSystem, {
+          ...fs,
+          exists: (target) => {
+            probed.push(target);
+            return fs.exists(target);
+          },
+        }),
+      );
+      assert.strictEqual(
+        probed.filter((target) => target === path.join(otherProject, ".git")).length,
+        1,
+      );
+      assert.deepEqual(
+        skills.map((skill) => skill.name),
+        ["d:same-repo"],
+      );
+    }),
+  );
+
   it.effect("publishes and dispatches canonical plugin folder names regardless of aliases", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/provider/Drivers/ClaudeSkills.ts b/apps/server/src/provider/Drivers/ClaudeSkills.ts
index c73385374fbc0..2bcf9ca472f0c 100644
--- a/apps/server/src/provider/Drivers/ClaudeSkills.ts
+++ b/apps/server/src/provider/Drivers/ClaudeSkills.ts
@@ -143,7 +143,8 @@ function claudeSettingsPaths(
   ];
 }
 
-const findRepositoryRoot = Effect.fn("findRepositoryRoot")(function* (
+// Untraced: skill discovery resolves every distinct plugin project path, too often for spans.
+const findRepositoryRoot = Effect.fnUntraced(function* (
   cwd: string,
 ): Effect.fn.Return<string | undefined, never, FileSystem.FileSystem | Path.Path> {
   const fileSystem = yield* FileSystem.FileSystem;
@@ -164,7 +165,7 @@ const findRepositoryRoot = Effect.fn("findRepositoryRoot")(function* (
   }
 });
 
-const findPluginRepositoryRoot = Effect.fn("findPluginRepositoryRoot")(function* (cwd: string) {
+const findPluginRepositoryRoot = Effect.fnUntraced(function* (cwd: string) {
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const root = yield* findRepositoryRoot(cwd);
@@ -336,6 +337,8 @@ const discoverPluginSkillRoots = Effect.fn("discoverPluginSkillRoots")(function*
     cwd === undefined
       ? undefined
       : yield* fileSystem.realPath(cwd).pipe(Effect.orElseSucceed(() => path.resolve(cwd)));
+  // Install records repeat project paths, often hundreds of times per discovery.
+  const projectRepositoryRoots = new Map<string, string | undefined>();
   const repositoryRoot =
     workspace === undefined ? undefined : yield* findPluginRepositoryRoot(workspace);
 
@@ -347,11 +350,13 @@ const discoverPluginSkillRoots = Effect.fn("discoverPluginSkillRoots")(function*
         Effect.gen(function* () {
           if (record.scope === "user" || record.scope === "managed") return true;
           if (record.projectPath === undefined || workspace === undefined) return false;
-          if (path.resolve(record.projectPath) === workspace) return true;
-          return (
-            repositoryRoot !== undefined &&
-            (yield* findPluginRepositoryRoot(record.projectPath)) === repositoryRoot
-          );
+          const projectPath = path.resolve(record.projectPath);
+          if (projectPath === workspace) return true;
+          if (repositoryRoot === undefined) return false;
+          if (!projectRepositoryRoots.has(projectPath)) {
+            projectRepositoryRoots.set(projectPath, yield* findPluginRepositoryRoot(projectPath));
+          }
+          return projectRepositoryRoots.get(projectPath) === repositoryRoot;
         }),
     );
     // The native loader keeps registry order, preferring the first install that exists.

From 99ccd4785af939aa771d882c68cb42485411285a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:38:36 +0000
Subject: [PATCH 135/167] fix(server): t3 service uninstall leaves another T3
 home's service alone (#29872)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/service.test.ts | 52 +++++++++++++++++++++++++++--
 apps/server/src/cli/service.ts      | 16 +++++++++
 2 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/cli/service.test.ts b/apps/server/src/cli/service.test.ts
index 4358165958a1b..7ab52e82a3995 100644
--- a/apps/server/src/cli/service.test.ts
+++ b/apps/server/src/cli/service.test.ts
@@ -32,6 +32,7 @@ function makeTestService(
 ) {
   const installOptions: Array<Parameters<BootService.BootService["Service"]["install"]>[0]> = [];
   const restarts: Array<true> = [];
+  const uninstalls: Array<true> = [];
   const service = BootService.BootService.of({
     status: Effect.succeed(serviceStatus),
     withStopped: (operation) => operation,
@@ -49,9 +50,12 @@ function makeTestService(
           logPath: serviceStatus.logPath,
         };
       }),
-    uninstall: Effect.succeed(false),
+    uninstall: Effect.sync(() => {
+      uninstalls.push(true);
+      return serviceStatus.installed;
+    }),
   });
-  return { service, installOptions, restarts };
+  return { service, installOptions, restarts, uninstalls };
 }
 
 it.layer(Layer.mergeAll(NodeServices.layer, NetService.layer))("service commands", (it) => {
@@ -194,4 +198,48 @@ it.layer(Layer.mergeAll(NodeServices.layer, NetService.layer))("service commands
         expect(installOptions).toEqual([]);
       }),
   );
+
+  it.effect.each([
+    { label: "this home's service", otherHome: false, unreadable: false, removed: [true] },
+    { label: "another home's service", otherHome: true, unreadable: false, removed: [] },
+    { label: "an unreadable service", otherHome: false, unreadable: true, removed: [true] },
+  ])("uninstall removes only $label", (input) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-service-cli-test-" });
+      const { service, uninstalls } = makeTestService({
+        ...status,
+        installedBaseDir: input.otherHome ? "/home/me/.t3" : baseDir,
+      });
+      vi.spyOn(BootService, "layer").mockReturnValue(
+        Layer.succeed(
+          BootService.BootService,
+          input.unreadable
+            ? {
+                ...service,
+                status: Effect.fail(new BootService.BootServiceInstallError({ cause: "EACCES" })),
+              }
+            : service,
+        ),
+      );
+
+      const output = yield* Command.runWith(serviceCommand, { version: packageJson.version })([
+        "uninstall",
+        "--base-dir",
+        baseDir,
+      ]).pipe(
+        Effect.andThen(TestConsole.logLines),
+        Effect.map((lines) => lines.join("\n")),
+        Effect.provideService(HostProcess.Environment, {}),
+        Effect.provide(
+          Layer.mergeAll(
+            ConfigProvider.layer(ConfigProvider.fromEnv({ env: {} })),
+            Layer.fresh(TestConsole.layer),
+          ),
+        ),
+      );
+      expect(uninstalls).toEqual(input.removed);
+      expect(output).toContain(input.otherHome ? "another T3 home" : "Removed");
+    }),
+  );
 });
diff --git a/apps/server/src/cli/service.ts b/apps/server/src/cli/service.ts
index b78ee31c9fa4d..4ba17aa17c6de 100644
--- a/apps/server/src/cli/service.ts
+++ b/apps/server/src/cli/service.ts
@@ -278,6 +278,22 @@ const serviceUninstallCommand = Command.make("uninstall", projectLocationFlags).
       flags,
       Effect.gen(function* () {
         const service = yield* BootService.BootService;
+        const path = yield* Path.Path;
+        const { baseDir } = yield* ServerConfig.ServerConfig;
+        // An unreadable unit stays removable; only a unit known to serve another home is kept.
+        const installedBaseDir = yield* service.status.pipe(
+          Effect.map((status) => status.installedBaseDir),
+          Effect.orElseSucceed(() => undefined),
+        );
+        if (
+          installedBaseDir !== undefined &&
+          path.resolve(installedBaseDir) !== path.resolve(baseDir)
+        ) {
+          yield* Console.log(
+            "The installed service runs another T3 home, so it was not removed. Pass its --base-dir.",
+          );
+          return;
+        }
         const removed = yield* service.uninstall;
         yield* Console.log(
           removed ? "Removed the T3 Code service." : "T3 Code service is not installed.",

From b95ff1131706d4c1a8dc7de325ce2b3920c8bb47 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:38:53 +0000
Subject: [PATCH 136/167] fix(server): PR watches wake again when a push leaves
 the branch conflicting (#29767)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../PullRequestWatchReactor.ts                 |  2 +-
 .../orchestration-v2/pullRequestWatch.test.ts  | 18 ++++++++++++++++++
 .../src/orchestration-v2/pullRequestWatch.ts   |  9 ++++++---
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/orchestration-v2/PullRequestWatchReactor.ts b/apps/server/src/orchestration-v2/PullRequestWatchReactor.ts
index e1669f011e6c0..2b588b1d2e23e 100644
--- a/apps/server/src/orchestration-v2/PullRequestWatchReactor.ts
+++ b/apps/server/src/orchestration-v2/PullRequestWatchReactor.ts
@@ -508,9 +508,9 @@ export const make = Effect.gen(function* () {
     }
     readFailures.delete(group.key);
     const [detail, activity] = read.value;
-    const headSha = detail.headSha ?? null;
     for (const target of group.targets) {
       const life = lifeOf(target);
+      const headSha = detail.headSha ?? life.headSha;
       const pushed = life.headSha !== null && headSha !== life.headSha;
       lives.set(lifeKey(target), {
         ...life,
diff --git a/apps/server/src/orchestration-v2/pullRequestWatch.test.ts b/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
index adf1e9776ce02..6ab0191649490 100644
--- a/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
+++ b/apps/server/src/orchestration-v2/pullRequestWatch.test.ts
@@ -356,6 +356,10 @@ describe("evaluatePullRequestWatch", () => {
     const conflicting = detail({ mergeability: "conflicting" });
     const first = evaluatePullRequestWatch(watch(), conflicting, noRemarks);
     assert.deepEqual(first.changes, [{ kind: "conflicting" }]);
+    const { headSha: _unreadHead, ...headUnread } = conflicting;
+    const unread = evaluatePullRequestWatch(first.next, headUnread, noRemarks);
+    assert.deepEqual(unread.changes, []);
+    assert.deepEqual(evaluatePullRequestWatch(unread.next, conflicting, noRemarks).changes, []);
     const recomputing = evaluatePullRequestWatch(
       first.next,
       detail({ mergeability: "unknown" }),
@@ -369,6 +373,20 @@ describe("evaluatePullRequestWatch", () => {
     assert.deepEqual(evaluatePullRequestWatch(clean.next, conflicting, noRemarks).changes, [
       { kind: "conflicting" },
     ]);
+    const pushed = { headSha: "bbbbbbbbbb" };
+    const recomputed = evaluatePullRequestWatch(
+      first.next,
+      detail({ ...pushed, mergeability: "unknown" }),
+      noRemarks,
+    );
+    assert.deepEqual(
+      evaluatePullRequestWatch(
+        recomputed.next,
+        detail({ ...pushed, mergeability: "conflicting" }),
+        noRemarks,
+      ).changes,
+      [{ kind: "conflicting" }],
+    );
   });
 
   it("does not spend the comment wake limit on check results", () => {
diff --git a/apps/server/src/orchestration-v2/pullRequestWatch.ts b/apps/server/src/orchestration-v2/pullRequestWatch.ts
index c4f227f0520ef..f4c0000847236 100644
--- a/apps/server/src/orchestration-v2/pullRequestWatch.ts
+++ b/apps/server/src/orchestration-v2/pullRequestWatch.ts
@@ -41,7 +41,8 @@ export function evaluatePullRequestWatch(
   now: number,
 ): PullRequestWatchReport {
   const changes: Array<PullRequestWatchChange> = [];
-  const headSha = detail.headSha ?? null;
+  // Azure DevOps omits the head when its iteration read fails; that is not a push.
+  const headSha = detail.headSha ?? watch.headSha;
   const headMoved = headSha !== watch.headSha;
 
   // Hosts can return no checks on read failure; preserve prior state.
@@ -126,12 +127,14 @@ export function evaluatePullRequestWatch(
     ...atLatest.map((remark) => remark.id),
   ];
 
-  if (detail.mergeability === "conflicting" && !watch.conflicting) {
+  // Like a failed check, a conflict a push did not resolve is news for the new head.
+  const toldConflict = !headMoved && watch.conflicting;
+  if (detail.mergeability === "conflicting" && !toldConflict) {
     changes.push({ kind: "conflicting" });
   }
   // "unknown" is a host still computing after a push; only a clean answer clears a conflict.
   const conflicting =
-    detail.mergeability === "unknown" ? watch.conflicting : detail.mergeability === "conflicting";
+    detail.mergeability === "unknown" ? toldConflict : detail.mergeability === "conflicting";
 
   const commentsOnly = changes.length > 0 && changes.every((change) => change.kind === "remarks");
   const progress = headMoved || (changes.length > 0 && !commentsOnly);

From 1f87f64bfd4ee7a28540ef8f125a319ff0b65b76 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:39:09 +0000
Subject: [PATCH 137/167] fix(muse): the thread error banner no longer shows
 unredacted failure text (#29910)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/provider-muse/src/server/adapter.test.ts | 12 ++++++++++--
 packages/provider-muse/src/server/adapter.ts      |  9 ++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/packages/provider-muse/src/server/adapter.test.ts b/packages/provider-muse/src/server/adapter.test.ts
index da740b92d2e8c..847c2b4551c59 100644
--- a/packages/provider-muse/src/server/adapter.test.ts
+++ b/packages/provider-muse/src/server/adapter.test.ts
@@ -767,12 +767,20 @@ describe("MuseAdapterV2", () => {
       yield* fake.emit("turn/completed", {
         turnId: nativeId,
         terminal: "failed",
-        error: { message: "Provider rejected this turn" },
+        error: { message: "Provider rejected this turn: api_key=abc123" },
       });
       const terminal = yield* harness.takeEvent("turn.terminal");
       assert.strictEqual(terminal.status, "failed");
       assert.strictEqual(terminal.threadDisposition, "reusable");
-      assert.isNotNull(terminal.failure);
+      assert.strictEqual(
+        terminal.failure?.message,
+        "Provider rejected this turn: api_key=[REDACTED]",
+      );
+      assert.strictEqual(
+        harness.allEvents.findLast((event) => event.type === "provider_session.updated")
+          ?.providerSession.lastError,
+        terminal.failure?.message,
+      );
       assert.isTrue(
         harness.allEvents.some(
           (event) =>
diff --git a/packages/provider-muse/src/server/adapter.ts b/packages/provider-muse/src/server/adapter.ts
index 575562948c949..354e457b2ca81 100644
--- a/packages/provider-muse/src/server/adapter.ts
+++ b/packages/provider-muse/src/server/adapter.ts
@@ -395,7 +395,14 @@ export const makeMuseAdapterV2 = Effect.fn("makeMuseAdapterV2")(function* (
         status: OrchestrationV2ProviderSession["status"],
         lastError: string | null = null,
       ) {
-        session = { ...session, status, lastError, updatedAt: yield* DateTime.now };
+        session = {
+          ...session,
+          status,
+          // lastError is the thread banner, so it gets the failure item's bounded, redacted text.
+          lastError:
+            lastError === null ? null : makeProviderFailure({ message: lastError }).message,
+          updatedAt: yield* DateTime.now,
+        };
         yield* emit({
           type: "provider_session.updated",
           driver: MUSE_PROVIDER,

From 655977ab8cd548072db1609d559771e33df11abc Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:39:27 +0000
Subject: [PATCH 138/167] fix(server): provider settings changed mid-refresh no
 longer revert to the old status (#29894)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/provider/ProviderRegistry.test.ts     | 133 ++++++++++++++++++
 apps/server/src/provider/ProviderRegistry.ts  |  64 +++++----
 2 files changed, 166 insertions(+), 31 deletions(-)

diff --git a/apps/server/src/provider/ProviderRegistry.test.ts b/apps/server/src/provider/ProviderRegistry.test.ts
index 93fec081ebb9c..1fb343eb2de5c 100644
--- a/apps/server/src/provider/ProviderRegistry.test.ts
+++ b/apps/server/src/provider/ProviderRegistry.test.ts
@@ -1934,6 +1934,139 @@ it.layer(
       }),
     );
 
+    it.effect("ignores a probe from an instance that settings replaced mid-refresh", () =>
+      Effect.gen(function* () {
+        const scenario = Effect.fn(function* (
+          probeFails: boolean,
+          run: (
+            registry: ProviderRegistry.ProviderRegistry["Service"],
+          ) => Effect.Effect<ReadonlyArray<ServerProvider>>,
+        ) {
+          const driver = ProviderDriverKind.make("codex");
+          const instanceId = ProviderInstanceId.make("codex");
+          const provider = {
+            instanceId,
+            driver,
+            status: "ready",
+            enabled: true,
+            installed: true,
+            auth: { status: "authenticated" },
+            checkedAt: "2026-06-10T00:00:00.000Z",
+            version: "2.0.0",
+            models: [],
+            slashCommands: [],
+            skills: [],
+          } as const satisfies ServerProvider;
+          const retiredProbe = {
+            ...provider,
+            status: "error",
+            installed: false,
+            version: "1.0.0",
+            message: "Codex CLI is not installed.",
+          } as const satisfies ServerProvider;
+          const probeStarted = yield* Deferred.make<void>();
+          const releaseProbe = yield* Deferred.make<void>();
+          const makeInstance = (snapshot: ServerProvider, refresh: Effect.Effect<void>) =>
+            ({
+              instanceId,
+              driverKind: driver,
+              continuationIdentity: { driverKind: driver, continuationKey: "codex:instance:codex" },
+              displayName: undefined,
+              enabled: true,
+              snapshot: {
+                resolveMaintenance: () =>
+                  Effect.succeed(
+                    makeManualOnlyProviderMaintenanceCapabilities({
+                      provider: driver,
+                      packageName: null,
+                    }),
+                  ),
+                getSnapshot: Effect.succeed(snapshot),
+                refresh: Effect.as(refresh, snapshot),
+                streamChanges: Stream.empty,
+                applyUsageLimits: () => Effect.void,
+              },
+              orchestrationAdapter: {} as ProviderInstance["orchestrationAdapter"],
+              textGeneration: {} as ProviderInstance["textGeneration"],
+            }) satisfies ProviderInstance;
+          const retiredInstance = makeInstance(
+            retiredProbe,
+            Deferred.succeed(probeStarted, undefined).pipe(
+              Effect.andThen(Deferred.await(releaseProbe)),
+              Effect.andThen(probeFails ? Effect.die(new Error("probe failed")) : Effect.void),
+            ),
+          );
+          const rebuiltInstance = makeInstance(provider, Effect.void);
+          const instances = yield* Ref.make<ReadonlyArray<ProviderInstance>>([retiredInstance]);
+          const changes = yield* PubSub.unbounded<void>();
+          const instanceRegistryLayer = Layer.succeed(
+            ProviderInstanceRegistry.ProviderInstanceRegistry,
+            {
+              getInstance: (requestedId) =>
+                Ref.get(instances).pipe(
+                  Effect.map((current) =>
+                    current.find((instance) => instance.instanceId === requestedId),
+                  ),
+                ),
+              listInstances: Ref.get(instances),
+              listUnavailable: Effect.succeed([]),
+              streamChanges: Stream.empty,
+              subscribeChanges: PubSub.subscribe(changes),
+            },
+          );
+          const scope = yield* Scope.make();
+          yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
+          const runtimeServices = yield* Layer.build(
+            ProviderRegistry.layer.pipe(
+              Layer.provide(layerUnusedMutator),
+              Layer.provideMerge(instanceRegistryLayer),
+              Layer.provideMerge(
+                ServerConfig.layerTest(process.cwd(), {
+                  prefix: "t3-provider-registry-retired-refresh-",
+                }),
+              ),
+              Layer.provideMerge(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer)),
+            ),
+          ).pipe(Scope.provide(scope));
+
+          return yield* Effect.gen(function* () {
+            const registry = yield* ProviderRegistry.ProviderRegistry;
+            const rebuiltPublished = yield* Stream.toPull(
+              registry.streamChanges.pipe(
+                Stream.filter((providers) => providers[0]?.version === provider.version),
+              ),
+            );
+            const refresh = yield* run(registry).pipe(Effect.forkChild);
+            yield* Deferred.await(probeStarted);
+            yield* Ref.set(instances, [rebuiltInstance]);
+            yield* PubSub.publish(changes, undefined);
+            yield* rebuiltPublished;
+            yield* Deferred.succeed(releaseProbe, undefined);
+            return {
+              provider,
+              result: yield* Fiber.join(refresh),
+              providers: yield* registry.getProviders,
+            };
+          }).pipe(Effect.provide(runtimeServices));
+        });
+        const driver = ProviderDriverKind.make("codex");
+        const instanceId = ProviderInstanceId.make("codex");
+
+        const manual = yield* scenario(false, (registry) => registry.refresh());
+        expect(manual.result).toEqual([expect.objectContaining(manual.provider)]);
+        expect(manual.providers).toEqual([expect.objectContaining(manual.provider)]);
+
+        // Neither the retired probe's failure nor its cached row can stand in for the replacement.
+        for (const probeFails of [true, false]) {
+          const afterUpdate = yield* scenario(probeFails, (registry) =>
+            registry.refreshAfterUpdate(driver, instanceId),
+          );
+          expect(afterUpdate.result).toEqual([]);
+          expect(afterUpdate.providers).toEqual([expect.objectContaining(afterUpdate.provider)]);
+        }
+      }),
+    );
+
     it.effect("keeps an enriched snapshot that streams in before a manual refresh returns", () =>
       Effect.gen(function* () {
         const driver = ProviderDriverKind.make("acpRegistry");
diff --git a/apps/server/src/provider/ProviderRegistry.ts b/apps/server/src/provider/ProviderRegistry.ts
index 76f2723cd9d4f..fb6aeaac26b63 100644
--- a/apps/server/src/provider/ProviderRegistry.ts
+++ b/apps/server/src/provider/ProviderRegistry.ts
@@ -444,10 +444,6 @@ export const layer = Layer.effect(
     );
     const syncSemaphore = yield* Semaphore.make(1);
 
-    const getLiveSources: Effect.Effect<ReadonlyArray<ProviderSnapshotSource>> = Ref.get(
-      liveSubsRef,
-    ).pipe(Effect.map((map) => Array.from(map.values(), buildSnapshotSource)));
-
     const persistProvider = Effect.fn("ProviderRegistry.persistProvider")(function* (
       provider: ServerProvider,
     ) {
@@ -601,17 +597,25 @@ export const layer = Layer.effect(
       },
     );
 
-    const refreshOneSource = Effect.fn("refreshOneSource")(function* (
-      providerSource: ProviderSnapshotSource,
-    ) {
+    const isCurrentInstance = (instance: ProviderInstance) =>
+      instanceRegistry
+        .getInstance(instance.instanceId)
+        .pipe(Effect.map((current) => current === instance));
+
+    const refreshOneSource = Effect.fn("refreshOneSource")(function* (instance: ProviderInstance) {
+      const providerSource = buildSnapshotSource(instance);
       // Enrichment can publish a newer snapshot before refresh returns its pre-enrichment probe.
-      return yield* providerSource.refresh.pipe(
+      const probe = yield* providerSource.refresh.pipe(
         Effect.andThen(providerSource.getSnapshot),
-        Effect.flatMap((nextProvider) =>
-          correlateSnapshotWithSource(providerSource, nextProvider).pipe(
-            Effect.flatMap(syncProvider),
-          ),
-        ),
+        Effect.exit,
+      );
+      // Settings can replace or remove the instance mid-probe; its late result or failure is stale.
+      if (!(yield* isCurrentInstance(instance))) {
+        return yield* Ref.get(providersRef);
+      }
+      const nextProvider = yield* probe;
+      return yield* correlateSnapshotWithSource(providerSource, nextProvider).pipe(
+        Effect.flatMap(syncProvider),
       );
     });
 
@@ -640,9 +644,9 @@ export const layer = Layer.effect(
         // Detach shared passes so the first caller's interruption cannot cancel other callers' work.
         // Syncing first keeps a refresh right after a rebuild from probing the replaced instance.
         yield* syncLiveSourcesAndContinue.pipe(
-          Effect.andThen(getLiveSources),
-          Effect.flatMap((sources) =>
-            Effect.forEach(sources, (source) => refreshOneSource(source), {
+          Effect.andThen(Ref.get(liveSubsRef)),
+          Effect.flatMap((instances) =>
+            Effect.forEach(instances.values(), (instance) => refreshOneSource(instance), {
               concurrency: "unbounded",
               discard: true,
             }),
@@ -663,27 +667,22 @@ export const layer = Layer.effect(
       if (provider === undefined) {
         return yield* refreshAll();
       }
-      const defaultInstanceId = defaultInstanceIdForDriver(provider);
-      const sources = yield* getLiveSources;
-      const providerSource = sources.find(
-        (candidate) => candidate.instanceId === defaultInstanceId,
-      );
-      if (!providerSource) {
+      const instance = (yield* Ref.get(liveSubsRef)).get(defaultInstanceIdForDriver(provider));
+      if (!instance) {
         return yield* Ref.get(providersRef);
       }
-      return yield* refreshOneSource(providerSource);
+      return yield* refreshOneSource(instance);
     });
 
     const refreshInstance = Effect.fn("refreshInstance")(function* (
       instanceId: ProviderInstanceId,
     ) {
       yield* syncLiveSourcesAndContinue;
-      const sources = yield* getLiveSources;
-      const providerSource = sources.find((candidate) => candidate.instanceId === instanceId);
-      if (!providerSource) {
+      const instance = (yield* Ref.get(liveSubsRef)).get(instanceId);
+      if (!instance) {
         return yield* Ref.get(providersRef);
       }
-      return yield* refreshOneSource(providerSource);
+      return yield* refreshOneSource(instance);
     });
 
     const reloadSecretsAndRefresh = Effect.fn("reloadSecretsAndRefresh")(function* (
@@ -744,15 +743,18 @@ export const layer = Layer.effect(
       yield* Effect.forEach(
         instances.filter((instance) => !failedInstances.has(instance.instanceId)),
         (instance) =>
-          refreshOneSource(buildSnapshotSource(instance)).pipe(
+          refreshOneSource(instance).pipe(
             Effect.catchCause((cause) => recoverInstanceFailure(instance.instanceId, cause)),
           ),
         { concurrency: "unbounded", discard: true },
       );
+      // A replaced instance's cached row did not come from this pass's probe.
+      const refreshedInstances = yield* Effect.filter(
+        instances.filter((instance) => !failedInstances.has(instance.instanceId)),
+        isCurrentInstance,
+      );
       const refreshedInstanceIds = new Set(
-        instances
-          .filter((instance) => !failedInstances.has(instance.instanceId))
-          .map((instance) => instance.instanceId),
+        refreshedInstances.map((instance) => instance.instanceId),
       );
       return (yield* Ref.get(providersRef)).filter((candidate) =>
         refreshedInstanceIds.has(candidate.instanceId),

From e1cd7f0e15813b2bc4f2ec4b51889b9027eedb2b Mon Sep 17 00:00:00 2001
From: Romil <romilbij@gmail.com>
Date: Wed, 4 Nov 2026 10:40:06 +1100
Subject: [PATCH 139/167] fix(shared): accept whitespace after engine range
 operators (#29730)

---
 packages/shared/src/semver.test.ts | 6 ++++++
 packages/shared/src/semver.ts      | 6 +++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/packages/shared/src/semver.test.ts b/packages/shared/src/semver.test.ts
index 57766584a0439..824dd7d6f98d4 100644
--- a/packages/shared/src/semver.test.ts
+++ b/packages/shared/src/semver.test.ts
@@ -56,6 +56,12 @@ describe("semver helpers", () => {
   it("supports comparison comparators", () => {
     expect(satisfiesSemverRange("24.9.0", ">=24.0 <24.10")).toBe(true);
     expect(satisfiesSemverRange("24.10.0", ">=24.0 <24.10")).toBe(false);
+    for (const gap of [" ", "\t", "\n"]) {
+      const range = `>=${gap}24.0 <${gap}24.10`;
+      expect(satisfiesSemverRange("24.9.0", range)).toBe(true);
+      expect(satisfiesSemverRange("24.10.0", range)).toBe(false);
+      expect(satisfiesSemverRange("22.16.0", `^${gap}22.16 || >=${gap}24.10`)).toBe(true);
+    }
   });
 
   it("honors caret range upper bounds for zero-major versions", () => {
diff --git a/packages/shared/src/semver.ts b/packages/shared/src/semver.ts
index dc0e34f102dfb..720ea68a75066 100644
--- a/packages/shared/src/semver.ts
+++ b/packages/shared/src/semver.ts
@@ -156,7 +156,11 @@ export const satisfiesSemverRange: (rawVersion: string, range: string) => boolea
     };
 
     return range.split("||").some((group) => {
-      const comparators = group.trim().split(/\s+/).filter(Boolean);
+      const comparators = group
+        .trim()
+        .replace(/(\^|>=|>|<=|<|=)\s+(?=v?\d)/g, "$1")
+        .split(/\s+/)
+        .filter(Boolean);
       if (comparators.length === 0) {
         return false;
       }

From 93b0db1bc826fddc41a493b0f87a04dabf60801c Mon Sep 17 00:00:00 2001
From: Taylor Dolezal <onlydole@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:40:24 -0800
Subject: [PATCH 140/167] perf(server): stop tracing per-event live coalescer
 work (#29758)

Co-authored-by: Taylor Dolezal <117500+onlydole@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/orchestration-v2/ThreadLiveEventCoalescer.ts     | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadLiveEventCoalescer.ts b/apps/server/src/orchestration-v2/ThreadLiveEventCoalescer.ts
index b3b8af0e64d96..00adbb0cb5445 100644
--- a/apps/server/src/orchestration-v2/ThreadLiveEventCoalescer.ts
+++ b/apps/server/src/orchestration-v2/ThreadLiveEventCoalescer.ts
@@ -95,7 +95,8 @@ export const makeThreadLiveEventCoalescer = Effect.fn(
   let windowFiber: Fiber.Fiber<void, never> | null = null;
   let closed = false;
 
-  const cancelWindow = Effect.fn("ThreadLiveEventCoalescer.cancelWindow")(function* () {
+  // cancelWindow/flushPending/offerAll run per live event or batch; sub-ms spans here would flood the rotating trace.
+  const cancelWindow = Effect.fnUntraced(function* () {
     const fiber = windowFiber;
     if (!fiber) {
       return;
@@ -104,7 +105,7 @@ export const makeThreadLiveEventCoalescer = Effect.fn(
     yield* Fiber.interrupt(fiber);
   });
 
-  const flushPending = Effect.fn("ThreadLiveEventCoalescer.flushPending")(function* () {
+  const flushPending = Effect.fnUntraced(function* () {
     if (pendingUpdates.length === 0) {
       return;
     }
@@ -135,9 +136,7 @@ export const makeThreadLiveEventCoalescer = Effect.fn(
 
   // Keep each source batch together so a synchronization marker cannot pass
   // events already pulled from PubSub but still being coalesced.
-  const offerAll = Effect.fn("ThreadLiveEventCoalescer.offerAll")(function* (
-    inputs: ReadonlyArray<ThreadLiveInput>,
-  ) {
+  const offerAll = Effect.fnUntraced(function* (inputs: ReadonlyArray<ThreadLiveInput>) {
     yield* mutex.withPermits(1)(
       Effect.forEach(
         inputs,

From ece461e3e8af869540707f2933898c89b61204d6 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Tue, 3 Nov 2026 23:40:40 +0000
Subject: [PATCH 141/167] test(desktop): the Windows shell kill test waits for
 each spawn before advancing the clock (#30463)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../src/shell/DesktopShellEnvironment.test.ts     | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
index fbf4bf9713fd1..124dbbeae89e0 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
@@ -694,17 +694,28 @@ describe("DesktopShellEnvironment", () => {
   it.effect("gives up on a Windows shell that survives the kill", () =>
     Effect.gen(function* () {
       const commands: Array<string> = [];
+      // Both PowerShell probes spawn pwsh, time out, then spawn powershell. Each probe's timeout
+      // is armed before its spawn runs, so waiting for the spawns keeps the clock in step.
+      const spawned = yield* Effect.forEach([0, 1, 2, 3], () => Deferred.make<void>());
       const fiber = yield* runShellEnvironment({
         env: { PATH: "C:\\Windows", APPDATA: "C:\\Roaming" },
         platform: "win32",
         handler: () => "",
         processSpawner: ChildProcessSpawner.make((command) => {
+          const spawn = spawned[commands.length];
           commands.push(command._tag === "StandardCommand" ? command.command : "");
-          return Effect.acquireRelease(Effect.succeed(makeHungProcess()), () => Effect.never);
+          return (spawn ? Deferred.succeed(spawn, undefined) : Effect.void).pipe(
+            Effect.andThen(
+              Effect.acquireRelease(Effect.succeed(makeHungProcess()), () => Effect.never),
+            ),
+          );
         }),
       }).pipe(Effect.forkChild({ startImmediately: true }));
 
-      for (let probe = 0; probe < 4; probe++) yield* TestClock.adjust("5 seconds");
+      yield* Effect.forEach(spawned.slice(0, 2), Deferred.await);
+      yield* TestClock.adjust("5 seconds");
+      yield* Effect.forEach(spawned.slice(2), Deferred.await);
+      yield* TestClock.adjust("5 seconds");
       yield* Fiber.join(fiber);
       assert.deepEqual([...new Set(commands)], ["pwsh.exe", "powershell.exe"]);
     }),

From 7f92cb0e49c5e76b0379b5cf3e560789f3a8d47b Mon Sep 17 00:00:00 2001
From: Romil <romilbij@gmail.com>
Date: Wed, 4 Nov 2026 10:41:04 +1100
Subject: [PATCH 142/167] fix(shared): ignore unsupported command output
 control parameters (#29736)

---
 packages/shared/src/terminalOutput.test.ts | 13 +++++++++++++
 packages/shared/src/terminalOutput.ts      |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/shared/src/terminalOutput.test.ts b/packages/shared/src/terminalOutput.test.ts
index aaaf8c6335255..233ee6cbb53cc 100644
--- a/packages/shared/src/terminalOutput.test.ts
+++ b/packages/shared/src/terminalOutput.test.ts
@@ -43,6 +43,9 @@ describe("appendTerminalOutput", () => {
     const first = appendTerminalOutput(EMPTY_TERMINAL_OUTPUT, "red: \u001b[3");
     expect(first.text).toBe("red: ");
     expect(feed(["red: \u001b[3", "1mR\u001b[0m"]).text).toBe("red: \u001b[0;31mR\u001b[0m");
+    expect(
+      terminalOutputSpans(feed(["\u001b[38:2::12:", "34:56mR"]).text, TERMINAL_PALETTES.dark),
+    ).toEqual([{ text: "R", style: { color: "rgb(12,34,56)" } }]);
   });
 
   it("keeps a bounded tail that starts on a fresh line", () => {
@@ -105,6 +108,16 @@ describe("appendTerminalOutput edge cases from review", () => {
 });
 
 describe("appendTerminalOutput under adversarial output", () => {
+  it("ignores unsupported cursor-control parameters without corrupting the screen", () => {
+    for (const sequence of ["1.5A", "1.5G", "1$K", "1$J", ">1A", "?25l", "1:2A", "1:2K", "1:2J"]) {
+      const input = `a\nb\nc\u001b[${sequence}X`;
+      expect(feed([input]).text).toBe("a\nb\ncX");
+      for (let cut = 1; cut < input.length; cut += 1) {
+        expect(feed([input.slice(0, cut), input.slice(cut)]).text).toBe("a\nb\ncX");
+      }
+    }
+  });
+
   it("gives the same result however the output is split into chunks", () => {
     const input =
       "abcdef\rX\u001b[31mred\u001b[0m\nnext line\r\u001b[2Kdone\n" +
diff --git a/packages/shared/src/terminalOutput.ts b/packages/shared/src/terminalOutput.ts
index b930282f77786..6bf4e318ef639 100644
--- a/packages/shared/src/terminalOutput.ts
+++ b/packages/shared/src/terminalOutput.ts
@@ -393,7 +393,7 @@ class Terminal {
   }
 
   csi(params: string, final: string): void {
-    if (/^[?>=]/u.test(params)) return; // Mode switches (cursor visibility, bracketed paste).
+    if (!/^[\d;:]*$/u.test(params) || (final !== "m" && params.includes(":"))) return;
     if (final === "m") {
       const key = `${this.pen}|${params}`;
       let pen = penTransitions.get(key);

From 2b37449c85557e1dfdc28b88fa8f666b69ba7f78 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:41:30 +0000
Subject: [PATCH 143/167] fix(cli): t3 update no longer says a service awaiting
 restart runs the new version (#29901)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/update.test.ts | 97 +++++++++++++++++++++++++++++-
 apps/server/src/cli/update.ts      |  9 ++-
 2 files changed, 104 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/cli/update.test.ts b/apps/server/src/cli/update.test.ts
index ecd837e37ac01..7540c678f59d4 100644
--- a/apps/server/src/cli/update.test.ts
+++ b/apps/server/src/cli/update.test.ts
@@ -10,12 +10,14 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as TestClock from "effect/testing/TestClock";
+import * as TestConsole from "effect/testing/TestConsole";
 import { HttpClient, HttpClientResponse } from "effect/http";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 import { afterEach, vi } from "vite-plus/test";
 
+import packageJson from "../../package.json" with { type: "json" };
 import * as BootService from "../cloud/bootService.ts";
-import { prunePinnedRuntimes } from "../cloud/pinnedRuntime.ts";
+import { pinnedRuntimePaths, prunePinnedRuntimes } from "../cloud/pinnedRuntime.ts";
 import * as ManagedPolicy from "../policy/ManagedPolicy.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import {
@@ -434,3 +436,96 @@ it.layer(NodeServices.layer)("t3 update launcher", (it) => {
     }).pipe(Effect.scoped, Effect.provideService(HostProcess.Platform, "linux")),
   );
 });
+
+// Without terminals, update skips its restart prompt whatever runs the test.
+const withoutTerminals = Effect.acquireRelease(
+  Effect.sync(() =>
+    [process.stdin, process.stdout].map((stream) => {
+      const descriptor = Object.getOwnPropertyDescriptor(stream, "isTTY");
+      Object.defineProperty(stream, "isTTY", { configurable: true, value: false });
+      return { stream, descriptor };
+    }),
+  ),
+  (saved) =>
+    Effect.sync(() => {
+      for (const { stream, descriptor } of saved) {
+        if (descriptor === undefined) Reflect.deleteProperty(stream, "isTTY");
+        else Object.defineProperty(stream, "isTTY", descriptor);
+      }
+    }),
+);
+
+it.layer(NodeServices.layer)("t3 update with a background service", (it) => {
+  it.effect("names the version a service with a pending restart still runs", () =>
+    Effect.gen(function* () {
+      yield* withoutTerminals;
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const baseDir = yield* fs.makeTempDirectoryScoped({ prefix: "t3-update-" });
+      const version = packageJson.version;
+      const runtime = pinnedRuntimePaths(path, baseDir, version, "linux");
+      yield* fs.makeDirectory(runtime.versionDir, { recursive: true });
+      yield* fs.writeFileString(runtime.entryPath, "");
+      yield* fs.writeFileString(runtime.sentinelPath, `${version}\n`);
+      const unitPath = path.join(baseDir, "t3code.service");
+      const logPath = path.join(baseDir, "boot-service.log");
+      // An earlier `t3 update` pointed the service at this version without restarting it.
+      const service = Layer.mock(BootService.BootService, {
+        status: Effect.succeed<BootService.BootServiceStatus>({
+          supported: true,
+          installed: true,
+          current: false,
+          installedVersion: version,
+          installedBaseDir: baseDir,
+          problems: ["restart-pending"],
+          unitPath,
+          logPath,
+        }),
+        install: () => Effect.succeed({ program: [runtime.entryPath], baseDir, unitPath, logPath }),
+      });
+      vi.spyOn(BootService, "layer").mockReturnValue(service);
+      const runner = ProcessRunner.ProcessRunner.of({
+        run: (input) =>
+          input.args?.includes("--version") === true
+            ? unrelatedLsof
+                .run(input)
+                .pipe(Effect.map((result) => ({ ...result, stdout: `t3 v${version}\n` })))
+            : unrelatedLsof.run(input),
+      });
+
+      const output = yield* runUpdate({
+        baseDir,
+        logsDir: baseDir,
+        serverRuntimeStatePath: path.join(baseDir, "server-runtime.json"),
+        channel: undefined,
+        requestedVersion: version,
+        allowDowngrade: false,
+        assumeYes: false,
+      }).pipe(
+        Effect.andThen(TestConsole.logLines),
+        Effect.map((lines) => lines.join("\n")),
+        Effect.provide(
+          Layer.mergeAll(
+            service,
+            Layer.succeed(ProcessRunner.ProcessRunner, runner),
+            ManagedPolicy.layerTest(),
+            Layer.succeed(
+              HttpClient.HttpClient,
+              HttpClient.make(() => Effect.die("unexpected release lookup")),
+            ),
+            Layer.fresh(TestConsole.layer),
+          ),
+        ),
+      );
+
+      assert.include(
+        output,
+        `Background service still running the version before ${version}. Run \`t3 service restart\` when you are ready to switch it to ${version}.`,
+      );
+    }).pipe(
+      Effect.scoped,
+      Effect.provideService(HostProcess.Platform, "linux"),
+      Effect.provideService(HostProcess.Environment, { PATH: "" }),
+    ),
+  );
+});
diff --git a/apps/server/src/cli/update.ts b/apps/server/src/cli/update.ts
index be36b1184d88d..99bf380f1c0dd 100644
--- a/apps/server/src/cli/update.ts
+++ b/apps/server/src/cli/update.ts
@@ -603,8 +603,15 @@ export const runUpdate = Effect.fn("cli.update.run")(function* (input: {
   } else if (serviceInstalled && serviceCurrent) {
     yield* Console.log(`  Background service already on ${targetVersion}`);
   } else if (serviceInstalled) {
+    // A pending restart means the service already points at serviceVersion but runs an older one.
+    const running =
+      serviceVersion === undefined
+        ? "an unknown version"
+        : restartPending
+          ? `the version before ${serviceVersion}`
+          : serviceVersion;
     yield* Console.log(
-      `  Background service still running ${serviceVersion ?? "an unknown version"}. Run \`t3 service restart\` when you are ready to switch it to ${targetVersion}.`,
+      `  Background service still running ${running}. Run \`t3 service restart\` when you are ready to switch it to ${targetVersion}.`,
     );
   } else if (status.installed && !servesThisHome) {
     yield* Console.log(

From 76f29667c6c51b19adc8108e4c52752c35e06111 Mon Sep 17 00:00:00 2001
From: Romil <romilbij@gmail.com>
Date: Wed, 4 Nov 2026 10:41:48 +1100
Subject: [PATCH 144/167] fix(mcp): accept CR and mixed line endings in
 response streams (#29727)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../shared/src/mcpResponsePayloads.test.ts    | 71 +++++++++++++++++++
 packages/shared/src/mcpResponsePayloads.ts    | 14 ++--
 2 files changed, 79 insertions(+), 6 deletions(-)
 create mode 100644 packages/shared/src/mcpResponsePayloads.test.ts

diff --git a/packages/shared/src/mcpResponsePayloads.test.ts b/packages/shared/src/mcpResponsePayloads.test.ts
new file mode 100644
index 0000000000000..9a3737ab93f53
--- /dev/null
+++ b/packages/shared/src/mcpResponsePayloads.test.ts
@@ -0,0 +1,71 @@
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Stream from "effect/Stream";
+
+import { responsePayloads } from "./mcpResponsePayloads.ts";
+
+it.effect("reads SSE line endings across byte-chunk boundaries without splitting CRLF", () =>
+  Effect.gen(function* () {
+    for (const separator of [
+      "\n\n",
+      "\r\r",
+      "\r\n\r\n",
+      "\r\n\n",
+      "\n\r",
+      "\n\r\n",
+      "\r\r\n",
+      "\r\n\r",
+    ]) {
+      for (const dataLineSeparator of ["\n", "\r", "\r\n"]) {
+        const bytes = new TextEncoder().encode(
+          `: keep-alive${separator}data: {"id":1,${dataLineSeparator}data: "result":{"text":"café😀"}}${separator}` +
+            'data: {"id":2,"result":{}}\n\ndata: {"id":3}',
+        );
+        for (let cut = 0; cut <= bytes.length; cut += 1) {
+          const response = new Response(
+            new ReadableStream<Uint8Array>({
+              start(controller) {
+                controller.enqueue(bytes.subarray(0, cut));
+                controller.enqueue(bytes.subarray(cut));
+                controller.close();
+              },
+            }),
+            { headers: { "content-type": "text/event-stream" } },
+          );
+          const payloads = yield* Stream.runCollect(
+            responsePayloads(response, (cause) => ({
+              _tag: "ResponsePayloadError" as const,
+              cause,
+              separator,
+              dataLineSeparator,
+              cut,
+            })),
+          );
+          expect(
+            Array.from(payloads),
+            JSON.stringify({ separator, dataLineSeparator, cut }),
+          ).toEqual([
+            { id: 1, result: { text: "café😀" } },
+            { id: 2, result: {} },
+          ]);
+        }
+      }
+      const response = new Response(
+        new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(new TextEncoder().encode(`data: {"id":4}${separator}`));
+          },
+        }),
+        { headers: { "content-type": "text/event-stream" } },
+      );
+      const payloads = yield* Stream.runCollect(
+        responsePayloads(response, (cause) => ({
+          _tag: "ResponsePayloadError" as const,
+          cause,
+          separator,
+        })).pipe(Stream.take(1)),
+      );
+      expect(Array.from(payloads)).toEqual([{ id: 4 }]);
+    }
+  }),
+);
diff --git a/packages/shared/src/mcpResponsePayloads.ts b/packages/shared/src/mcpResponsePayloads.ts
index fe5a89153d6e0..0d40e8ba7fd33 100644
--- a/packages/shared/src/mcpResponsePayloads.ts
+++ b/packages/shared/src/mcpResponsePayloads.ts
@@ -2,23 +2,25 @@
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
 
+const SSE_EVENT_SEPARATOR = /(?:\r\n|\r(?!\n)|\n){2}/u;
+
 async function* sseDataLines(response: Response): AsyncGenerator<string> {
   if (response.body === null) return;
   const decoder = new TextDecoder();
   let buffered = "";
   for await (const chunk of response.body) {
     buffered += decoder.decode(chunk as Uint8Array, { stream: true });
-    let separatorIndex = buffered.search(/\n\n|\r\n\r\n/u);
-    while (separatorIndex !== -1) {
-      const rawEvent = buffered.slice(0, separatorIndex);
-      buffered = buffered.slice(separatorIndex).replace(/^(?:\r?\n){2}/u, "");
+    let separator = SSE_EVENT_SEPARATOR.exec(buffered);
+    while (separator !== null) {
+      const rawEvent = buffered.slice(0, separator.index);
+      buffered = buffered.slice(separator.index + separator[0].length);
       const data = rawEvent
-        .split(/\r?\n/u)
+        .split(/\r\n|\r|\n/u)
         .filter((line) => line.startsWith("data:"))
         .map((line) => line.slice("data:".length).trimStart())
         .join("\n");
       if (data.length > 0) yield data;
-      separatorIndex = buffered.search(/\n\n|\r\n\r\n/u);
+      separator = SSE_EVENT_SEPARATOR.exec(buffered);
     }
   }
 }

From 350dcf4c042acf72200d1735bb6bd5e67d0ee982 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:42:05 +0000
Subject: [PATCH 145/167] fix(server): preview tabs that fail during setup no
 longer leave their page open (#29885)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/preview/ServerBrowser.test.ts | 15 ++++++++++++++
 apps/server/src/preview/ServerBrowser.ts      | 20 ++++++++++++++++---
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/preview/ServerBrowser.test.ts b/apps/server/src/preview/ServerBrowser.test.ts
index 90b1fc440720e..c558631fd2a51 100644
--- a/apps/server/src/preview/ServerBrowser.test.ts
+++ b/apps/server/src/preview/ServerBrowser.test.ts
@@ -52,6 +52,12 @@ vi.mock("./ServerBrowserContexts.ts", () => ({
       if (contextFailure) throw contextFailure;
       await contextGate?.promise;
       const context = makeContext(this.onClose);
+      const setupFailure = pageSetupFailure;
+      if (setupFailure) {
+        context.newCDPSession = async () => {
+          throw setupFailure;
+        };
+      }
       contexts.push(context);
       return context as unknown as BrowserContext;
     }
@@ -298,6 +304,7 @@ let pageCopy = "";
 let keyCopy = "";
 let focusedFrame: ReturnType<typeof makeFrame> | null = null;
 let contextFailure: Error | null = null;
+let pageSetupFailure: Error | null = null;
 let initialNavigation: (() => Promise<void>) | null = null;
 let desktopRendersNext = false;
 let desktopPageUrl = "about:blank";
@@ -442,6 +449,7 @@ beforeEach(() => {
   contextRequests.length = 0;
   contextGate = null;
   contextFailure = null;
+  pageSetupFailure = null;
   initialNavigation = null;
   pageCopy = "";
   keyCopy = "";
@@ -2284,6 +2292,13 @@ it.live("failed session and browser launches release capacity, as does closing a
       // A failed launch must not leave a session a viewer can relaunch past the budget.
       expect((yield* manager.list({ threadId: scope.thread.threadId })).sessions).toHaveLength(7);
       contextFailure = null;
+      pageSetupFailure = new Error("Target page, context or browser has been closed");
+      expect(yield* open.pipe(Effect.result)).toMatchObject({ _tag: "Failure" });
+      pageSetupFailure = null;
+      // Setup that fails after the page exists must not leave the page or its context open.
+      expect(contexts.at(-1)!.close).toHaveBeenCalled();
+      expect(contexts.at(-1)!.page.isClosed()).toBe(true);
+      expect((yield* manager.list({ threadId: scope.thread.threadId })).sessions).toHaveLength(7);
       expect((yield* open).available).toBe(true);
       expect(yield* open.pipe(Effect.flip)).toMatchObject({ reason: "tabLimit" });
       expect(
diff --git a/apps/server/src/preview/ServerBrowser.ts b/apps/server/src/preview/ServerBrowser.ts
index 5206e67ddadd9..e03d7e3b35db1 100644
--- a/apps/server/src/preview/ServerBrowser.ts
+++ b/apps/server/src/preview/ServerBrowser.ts
@@ -784,12 +784,27 @@ const make = Effect.gen(function* () {
   };
 
   const createTab = async (snapshot: PreviewSessionSnapshot): Promise<ServerTab> => {
+    const opened: Array<() => Promise<void>> = [];
+    try {
+      return await setUpTab(snapshot, opened);
+    } catch (cause) {
+      // An unpublished tab is in no list, so nothing else would ever close it.
+      for (const close of opened.reverse()) await close().catch(constVoid);
+      throw cause;
+    }
+  };
+
+  const setUpTab = async (
+    snapshot: PreviewSessionSnapshot,
+    opened: Array<() => Promise<void>>,
+  ): Promise<ServerTab> => {
     const adopted = adoptedPages.get(tabKey(snapshot.threadId, snapshot.tabId));
     adoptedPages.delete(tabKey(snapshot.threadId, snapshot.tabId));
     const desktop =
       adopted === undefined && (await desktopRenders(snapshot))
         ? await connectDesktop(snapshot)
         : null;
+    if (desktop) opened.push(desktop.close);
     // Otherwise a desktop that attaches late shows its own page, and the agent drives another.
     if (!desktop && desktopChannel.available) {
       await runPromise(
@@ -810,9 +825,11 @@ const make = Effect.gen(function* () {
         snapshot.profileId ?? "default",
         isolatedContext ? tabKey(snapshot.threadId, snapshot.tabId) : undefined,
       ));
+    if (isolatedContext) opened.push(() => context.close());
     if (adopted?.page.isClosed()) throw new Error("The popup closed before it opened.");
     if (!desktop) await prepareContext(context);
     const page = adopted?.page ?? desktop?.page ?? (await context.newPage());
+    if (!desktop) opened.push(() => page.close());
     const cdp = await context.newCDPSession(page);
     await installPdfDocumentNavigation(cdp);
     // The desktop's page is already a normal browser. A popup's first request
@@ -986,9 +1003,6 @@ const make = Effect.gen(function* () {
     const key = tabKey(tab.threadId, tab.tabId);
     if (closedPendingTabs.delete(key)) {
       await control.close().catch(constVoid);
-      if (desktop) await desktop.close().catch(constVoid);
-      else await page.close().catch(constVoid);
-      if (isolatedContext) await context.close().catch(constVoid);
       throw new ServerBrowserTabNotFoundError({ threadId: tab.threadId, tabId: tab.tabId });
     }
     page.on("close", () => dropTab(tab, true));

From 86b7dc6bfa12123abef683811c852ec320537690 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:42:31 +0000
Subject: [PATCH 146/167] fix(provider-core): long subagent titles no longer
 end in a broken character (#29906)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/server/subagentProjection.test.ts           | 13 +++++++++++++
 .../provider-core/src/server/subagentProjection.ts  | 10 ++++++++--
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 packages/provider-core/src/server/subagentProjection.test.ts

diff --git a/packages/provider-core/src/server/subagentProjection.test.ts b/packages/provider-core/src/server/subagentProjection.test.ts
new file mode 100644
index 0000000000000..767764db0cae5
--- /dev/null
+++ b/packages/provider-core/src/server/subagentProjection.test.ts
@@ -0,0 +1,13 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { subagentThreadTitle } from "./subagentProjection.ts";
+
+describe("subagentThreadTitle", () => {
+  it("clips a long prompt without splitting a surrogate pair", () => {
+    const title = (prompt: string) =>
+      subagentThreadTitle({ parentTitle: "Parent", prompt, ordinal: 1 });
+
+    expect(title(`${"a".repeat(68)}😀 and more work.`)).toBe(`${"a".repeat(68)}...`);
+    expect(title(`${"a".repeat(67)}😀 and more work.`)).toBe(`${"a".repeat(67)}😀...`);
+  });
+});
diff --git a/packages/provider-core/src/server/subagentProjection.ts b/packages/provider-core/src/server/subagentProjection.ts
index 3775818892502..dbd929192e04d 100644
--- a/packages/provider-core/src/server/subagentProjection.ts
+++ b/packages/provider-core/src/server/subagentProjection.ts
@@ -39,8 +39,14 @@ export function subagentThreadTitle(input: {
   if (detail === undefined) {
     return `${input.parentTitle} subagent ${input.ordinal}`;
   }
-  const clipped = detail.length > 72 ? `${detail.slice(0, 69)}...` : detail;
-  return clipped;
+  if (detail.length <= 72) return detail;
+  let end = 69;
+  const previous = detail.charCodeAt(end - 1);
+  const next = detail.charCodeAt(end);
+  if (previous >= 0xd800 && previous <= 0xdbff && next >= 0xdc00 && next <= 0xdfff) {
+    end -= 1;
+  }
+  return `${detail.slice(0, end)}...`;
 }
 
 export function makeSubagentChildThread(input: {

From 16ca47b3d3590462747deccead8f0ae46d62d25c Mon Sep 17 00:00:00 2001
From: Romil <romilbij@gmail.com>
Date: Wed, 4 Nov 2026 10:42:48 +1100
Subject: [PATCH 147/167] fix(shared): ignore unsupported command output erase
 modes (#29737)

---
 packages/shared/src/terminalOutput.test.ts | 10 ++++++++++
 packages/shared/src/terminalOutput.ts      |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/shared/src/terminalOutput.test.ts b/packages/shared/src/terminalOutput.test.ts
index 233ee6cbb53cc..578db81961410 100644
--- a/packages/shared/src/terminalOutput.test.ts
+++ b/packages/shared/src/terminalOutput.test.ts
@@ -87,6 +87,16 @@ describe("appendTerminalOutput", () => {
 });
 
 describe("appendTerminalOutput edge cases from review", () => {
+  it("leaves the screen and cursor alone for unsupported erase modes", () => {
+    for (const sequence of ["3K", "4J", "99K", "99J"]) {
+      const input = `a\nb\nc\u001b[${sequence}X`;
+      expect(feed([input]).text).toBe("a\nb\ncX");
+      for (let cut = 1; cut < input.length; cut += 1) {
+        expect(feed([input.slice(0, cut), input.slice(cut)]).text).toBe("a\nb\ncX");
+      }
+    }
+  });
+
   it("clears only scrollback on ESC[3J", () => {
     const lines = Array.from({ length: 70 }, (_, index) => `line ${index}`).join("\n");
     const state = feed([lines, "\u001b[3J"]);
diff --git a/packages/shared/src/terminalOutput.ts b/packages/shared/src/terminalOutput.ts
index 6bf4e318ef639..afeee8fdf344c 100644
--- a/packages/shared/src/terminalOutput.ts
+++ b/packages/shared/src/terminalOutput.ts
@@ -132,7 +132,7 @@ function eraseLine(line: Line, col: number, mode: number): Line {
     for (const run of sliceLine(line, col + 1, length)) pushRun(runs, run);
     return runs;
   }
-  return [];
+  return mode === 2 ? [] : line;
 }
 
 function serializeLine(line: Line): string {
@@ -443,7 +443,7 @@ class Terminal {
           if (this.settledHead !== "" || this.settledTail !== "") this.dropped = true;
           this.settledHead = "";
           this.settledTail = "";
-        } else {
+        } else if (mode === 2) {
           this.lines = [[]];
           this.row = 0;
           this.col = 0;

From 741bcaea1463a9e5a9ad8244369f81a5d2ca3109 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:43:04 +0000
Subject: [PATCH 148/167] fix(server): a failed scheduled run shows its error
 without a stack trace (#29889)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/scheduledTasks/ScheduledTaskService.ts       | 5 ++---
 .../src/scheduledTasks/ScheduledTaskService.webhook.test.ts  | 1 +
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
index 8e859d98a368f..6f220fc58c51b 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
@@ -334,9 +334,8 @@ function requireFutureOnce(
 }
 
 function errorMessage(error: unknown): string {
-  if (Cause.isCause(error)) return Cause.pretty(error);
-  if (error instanceof Error) return error.message;
-  return String(error);
+  const failure = Cause.isCause(error) ? Cause.squash(error) : error;
+  return failure instanceof Error ? failure.message : String(failure);
 }
 
 function webhookPath(taskId: string, token: string): string {
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
index 6303b38c05ce6..90d2ccc329cbf 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.webhook.test.ts
@@ -1399,6 +1399,7 @@ it.effect("start failures release both replay keys and relay claims for redelive
         yield* Queue.take(launches);
         assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_replay_keys`).length, 0);
         assert.equal((yield* sql`SELECT * FROM scheduled_task_webhook_relay_deliveries`).length, 0);
+        assert.equal((yield* service.list()).tasks[0]!.lastRunError, "injected start failure");
         const retry = yield* waitForSpan(
           service.triggerWebhook(request),
           "ScheduledTaskService.runWebhookDelivery",

From ebfca09e91e94536d16bcc958e07d1b68fa3a880 Mon Sep 17 00:00:00 2001
From: Entrpi <133157614+Entrpi@users.noreply.github.com>
Date: Wed, 4 Nov 2026 10:43:21 +1100
Subject: [PATCH 149/167] perf(web): long threads stream with 70% less work-row
 derivation (#29971)

---
 .../src/work-log/presentation.ts              | 27 +++++++++++++++++--
 packages/shared/src/t3McpToolPresentation.ts  | 18 ++++++++++++-
 2 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/packages/client-runtime/src/work-log/presentation.ts b/packages/client-runtime/src/work-log/presentation.ts
index 29c5f938b5bf0..9fa515e793947 100644
--- a/packages/client-runtime/src/work-log/presentation.ts
+++ b/packages/client-runtime/src/work-log/presentation.ts
@@ -291,12 +291,31 @@ function workEntryIndicatesToolFailureFromOutput(
   return output.length > 0 && toolOutputIndicatesFailure(output);
 }
 
+// Rows are re-derived on every timeline update but entries are reused while
+// their item is unchanged, so these per-entry checks are computed once.
+const entryChecks = new WeakMap<
+  WorkLogPresentationEntry,
+  { failure?: boolean; displayFailure?: boolean; action?: ToolGroupAction }
+>();
+
+function checksFor(entry: WorkLogPresentationEntry) {
+  let checks = entryChecks.get(entry);
+  if (!checks) {
+    checks = {};
+    entryChecks.set(entry, checks);
+  }
+  return checks;
+}
+
 export function workEntryIndicatesToolFailure(entry: WorkLogPresentationEntry): boolean {
-  return workEntryIndicatesToolFailureFromOutput(entry, true);
+  return (checksFor(entry).failure ??= workEntryIndicatesToolFailureFromOutput(entry, true));
 }
 
 export function workEntryDisplayIndicatesToolFailure(entry: WorkLogPresentationEntry): boolean {
-  return workEntryIndicatesToolFailureFromOutput(entry, false);
+  return (checksFor(entry).displayFailure ??= workEntryIndicatesToolFailureFromOutput(
+    entry,
+    false,
+  ));
 }
 
 function workLogEntryIsLocalCodeSearch(entry: WorkLogPresentationEntry): boolean {
@@ -308,6 +327,10 @@ function workLogEntryIsLocalCodeSearch(entry: WorkLogPresentationEntry): boolean
 }
 
 export function toolGroupAction(entry: WorkLogPresentationEntry): ToolGroupAction {
+  return (checksFor(entry).action ??= computeToolGroupAction(entry));
+}
+
+function computeToolGroupAction(entry: WorkLogPresentationEntry): ToolGroupAction {
   if (entry.itemType === "thread_created") return "thread-create";
   const presentation = resolveWorkEntryToolPresentation(entry);
   if (presentation?.action !== undefined) return presentation.action;
diff --git a/packages/shared/src/t3McpToolPresentation.ts b/packages/shared/src/t3McpToolPresentation.ts
index 864bcd8950d41..7a6c2fab91187 100644
--- a/packages/shared/src/t3McpToolPresentation.ts
+++ b/packages/shared/src/t3McpToolPresentation.ts
@@ -380,8 +380,24 @@ function normalizeT3McpToolLabel(value: string): string {
   return value.replace(/\s+(?:complete|completed)\s*$/i, "").trim();
 }
 
-// ACP tool prefixes vary; match loosely but require a known display-name entry.
+// Timelines resolve every work row's tool name on each update; names repeat across updates.
+// ACP titles can carry whole commands, so long labels are parsed but not kept.
+const toolNameCache = new Map<string, string | null>();
+const TOOL_NAME_CACHE_LIMIT = 10_000;
+const TOOL_NAME_CACHE_MAX_KEY_LENGTH = 256;
+
 function resolveT3McpToolName(value: string): string | null {
+  if (value.length > TOOL_NAME_CACHE_MAX_KEY_LENGTH) return parseT3McpToolName(value);
+  const cached = toolNameCache.get(value);
+  if (cached !== undefined) return cached;
+  const name = parseT3McpToolName(value);
+  if (toolNameCache.size >= TOOL_NAME_CACHE_LIMIT) toolNameCache.clear();
+  toolNameCache.set(value, name);
+  return name;
+}
+
+// ACP tool prefixes vary; match loosely but require a known display-name entry.
+function parseT3McpToolName(value: string): string | null {
   const label = normalizeT3McpToolLabel(value);
   const mcpMatch = /^mcp__(?<server>.+?)__(?<tool>.+)$/i.exec(label);
   if (mcpMatch?.groups) {

From 5c72faa7731a9eab49094a863e83ba9df8d936c9 Mon Sep 17 00:00:00 2001
From: yaacovcorcos <coryacos1@gmail.com>
Date: Wed, 4 Nov 2026 01:43:33 +0200
Subject: [PATCH 150/167] fix(pi): send SIGTERM before closing Pi's stdin on
 teardown (#30025)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../provider-pi/src/server/adapter.test.ts    | 32 +++++++++++++++++++
 packages/provider-pi/src/server/rpc.ts        |  2 ++
 2 files changed, 34 insertions(+)

diff --git a/packages/provider-pi/src/server/adapter.test.ts b/packages/provider-pi/src/server/adapter.test.ts
index e52505ce249dc..58d38fd03add0 100644
--- a/packages/provider-pi/src/server/adapter.test.ts
+++ b/packages/provider-pi/src/server/adapter.test.ts
@@ -4738,3 +4738,35 @@ describe("PiRpc early process exit", () => {
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
 });
+
+describe("PiRpc teardown", () => {
+  // Like pi, quits once stdin ends; it survives SIGTERM, so teardown's SIGKILL ends it otherwise.
+  const recordShutdownCues = `
+const fs = require("node:fs");
+const note = (cue) => fs.appendFileSync(process.argv[1], cue + "\\n");
+process.on("SIGTERM", () => note("SIGTERM"));
+process.stdin.on("end", () => note("stdin end")).resume();
+process.stdout.write('{"type":"ready"}\\n');
+`;
+
+  it.live.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+    "signals pi before its stdin reaches EOF",
+    () =>
+      Effect.gen(function* () {
+        const fileSystem = yield* FileSystem.FileSystem;
+        const cuesPath = `${yield* fileSystem.makeTempDirectoryScoped()}/cues`;
+        yield* Effect.gen(function* () {
+          const connection = yield* makePiRpcConnection({
+            command: process.execPath,
+            args: ["-e", recordShutdownCues, cuesPath],
+            cwd: undefined,
+            env: {},
+          });
+          assert.equal((yield* Queue.take(connection.events))["type"], "ready");
+        }).pipe(Effect.scoped);
+
+        const cues = (yield* fileSystem.readFileString(cuesPath)).split("\n").filter(Boolean);
+        assert.deepEqual(cues, ["SIGTERM"]);
+      }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
diff --git a/packages/provider-pi/src/server/rpc.ts b/packages/provider-pi/src/server/rpc.ts
index 0af3fade61c33..98eacd790139e 100644
--- a/packages/provider-pi/src/server/rpc.ts
+++ b/packages/provider-pi/src/server/rpc.ts
@@ -199,6 +199,8 @@ export const makePiRpcConnection = Effect.fnUntraced(function* (options: PiRpcSp
         extendEnv: false,
         shell: spawnCommand.shell,
         detached: platform !== "win32",
+        // On stdin EOF Pi quits without its SIGTERM handler, so the later SIGTERM kills it mid-cleanup.
+        stdin: { stream: "pipe", endOnDone: false },
       }),
     )
     .pipe(Effect.mapError((cause) => new PiRpcError({ operation: "spawn", cause })));

From b6307ee88a721d48887f2f31774bf1cddad833ca Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 4 Nov 2026 05:13:50 +0530
Subject: [PATCH 151/167] fix(server): clean up child worktrees after their
 parent settles (#30026)

---
 apps/server/src/storageCleanup.test.ts | 156 +++++++++++++++++++++++++
 apps/server/src/storageCleanup.ts      |  72 +++++++++++-
 2 files changed, 224 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/storageCleanup.test.ts b/apps/server/src/storageCleanup.test.ts
index 937af138d9db1..b4c9ac3e68945 100644
--- a/apps/server/src/storageCleanup.test.ts
+++ b/apps/server/src/storageCleanup.test.ts
@@ -778,6 +778,162 @@ it.live("preserves late tracked edits when submodules were never initialized", (
 );
 
 describe("subagent worktree ownership", () => {
+  it.effect.each([
+    "child",
+    "grandchild",
+    "immediate",
+    "active-parent",
+    "recent-settle",
+    "settle-grace",
+    "recent-child-activity",
+    "running-child",
+    "pending-child",
+    "running-parent",
+    "pending-parent",
+    "unsettled-child",
+    "pinned-child",
+    "fork",
+    "missing-parent",
+    "cycle",
+  ] as const)("checks isolated subagent settlement (%s)", (scenario) =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(NOW_MS);
+      const fixture = yield* cleanupFixture({
+        ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+        worktreeSettledAfterDays: scenario === "immediate" ? 0 : 8,
+      });
+      const root = shell({
+        settledAt:
+          scenario === "active-parent"
+            ? null
+            : scenario === "recent-settle" || scenario === "settle-grace"
+              ? at(-30_000)
+              : scenario === "immediate"
+                ? at(-120_000)
+                : at(-20 * DAY_MS),
+        settledOverride: scenario === "active-parent" ? null : "settled",
+        updatedAt: scenario === "settle-grace" ? at(-30_000) : at(-10 * DAY_MS),
+      });
+      const child = shell({
+        id: ThreadId.make("child"),
+        branch: "feature",
+        worktreePath: fixture.worktree,
+        lineage: {
+          parentThreadId:
+            scenario === "missing-parent"
+              ? ThreadId.make("missing")
+              : scenario === "cycle"
+                ? ThreadId.make("child")
+                : ["grandchild", "running-parent", "pending-parent"].includes(scenario)
+                  ? ThreadId.make("middle")
+                  : root.id,
+          rootThreadId: root.id,
+          relationshipToParent: scenario === "fork" ? "fork" : "subagent",
+        },
+        status: scenario === "running-child" ? "running" : "completed",
+        pendingBackgroundTasks:
+          scenario === "pending-child" ? [{ taskId: "task", kind: "command" }] : [],
+        latestRunCompletedAt: scenario === "recent-child-activity" ? at(-2 * DAY_MS) : null,
+        settledOverride: scenario === "unsettled-child" ? "active" : null,
+        pinnedAt: scenario === "pinned-child" ? at(-DAY_MS) : null,
+      });
+      const middle = shell({
+        id: ThreadId.make("middle"),
+        status: scenario === "running-parent" ? "running" : "idle",
+        pendingBackgroundTasks:
+          scenario === "pending-parent" ? [{ taskId: "task", kind: "command" }] : [],
+        lineage: {
+          parentThreadId: root.id,
+          rootThreadId: root.id,
+          relationshipToParent: "subagent",
+        },
+      });
+      fixture.setThreads([child, middle, root]);
+      const report = yield* fixture.service.runNow;
+      const removed = ["child", "grandchild", "immediate"].includes(scenario);
+      expect(yield* fixture.fs.exists(fixture.worktree)).toBe(!removed);
+      expect(report.entries[0]).toMatchObject({
+        threadId: child.id,
+        outcome: removed ? "removed" : "kept",
+        reason: removed
+          ? scenario === "immediate"
+            ? "Settled for 0 days"
+            : "Settled for 20 days"
+          : scenario === "settle-grace"
+            ? "Settled moments ago"
+            : scenario === "recent-settle"
+              ? "Settled for 0 of 8 days"
+              : scenario === "recent-child-activity"
+                ? "Settled for 2 of 8 days"
+                : scenario === "running-child" || scenario === "pending-child"
+                  ? "Thread is running or has pending work"
+                  : "Not settled",
+      });
+    }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.live.each([
+    "parent-unsettled",
+    "parent-resettled",
+    "child-unsettled",
+    "intermediate-running",
+    "intermediate-pending",
+  ] as const)("cancels inherited settlement during measurement (%s)", (change) =>
+    runCleanupTest(
+      Effect.gen(function* () {
+        const fixture = yield* pausedMeasurementFixture({
+          ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+          worktreeSettledAfterDays: 0,
+        });
+        const root = shell({ settledAt: at(-20 * DAY_MS), settledOverride: "settled" });
+        const middle = shell({
+          id: ThreadId.make("middle"),
+          lineage: {
+            parentThreadId: root.id,
+            rootThreadId: root.id,
+            relationshipToParent: "subagent",
+          },
+        });
+        const child = shell({
+          id: ThreadId.make("child"),
+          branch: "feature",
+          worktreePath: fixture.worktree,
+          lineage: {
+            parentThreadId: middle.id,
+            rootThreadId: root.id,
+            relationshipToParent: "subagent",
+          },
+        });
+        fixture.setThreads([child, middle, root]);
+        const run = yield* fixture.service.runNow.pipe(Effect.forkChild);
+        yield* Deferred.await(fixture.measuring);
+        fixture.setThreads([
+          { ...child, settledOverride: change === "child-unsettled" ? "active" : null },
+          {
+            ...middle,
+            status: change === "intermediate-running" ? "running" : "idle",
+            pendingBackgroundTasks:
+              change === "intermediate-pending" ? [{ taskId: "task", kind: "command" }] : [],
+          },
+          change === "child-unsettled" || change.startsWith("intermediate-")
+            ? root
+            : {
+                ...root,
+                settledAt: change === "parent-resettled" ? at(0) : null,
+                settledOverride: change === "parent-resettled" ? "settled" : "active",
+                updatedAt: at(0),
+              },
+        ]);
+        yield* Deferred.succeed(fixture.resume, undefined);
+        expect((yield* Fiber.join(run)).entries[0]).toMatchObject({
+          outcome: "kept",
+          reason: "Parent settlement changed since check",
+        });
+        expect(yield* fixture.fs.exists(fixture.worktree)).toBe(true);
+      }),
+    ),
+  );
+
   it.effect.each([
     "idle",
     "grandchild",
diff --git a/apps/server/src/storageCleanup.ts b/apps/server/src/storageCleanup.ts
index cf3759519c679..9714d9175afdf 100644
--- a/apps/server/src/storageCleanup.ts
+++ b/apps/server/src/storageCleanup.ts
@@ -14,6 +14,7 @@ import type {
   WorktreeCleanupRules,
   StorageCleanupReport,
   StorageCleanupReportEntry,
+  ThreadId,
 } from "@t3tools/contracts";
 import { resolveWorktreeCleanup } from "@t3tools/shared/projectSettings";
 import { makeDrainableWorker } from "@t3tools/shared/DrainableWorker";
@@ -124,9 +125,16 @@ export function storageCleanupThreadIdle(
   thread: OrchestrationV2ThreadShell,
   now: number,
   settings: LimitRecoverySettings,
+): boolean {
+  return thread.worktreePath !== null && threadIdle(thread, now, settings);
+}
+
+function threadIdle(
+  thread: OrchestrationV2ThreadShell,
+  now: number,
+  settings: LimitRecoverySettings,
 ): boolean {
   return (
-    thread.worktreePath !== null &&
     thread.activeRunId === null &&
     (thread.status === "idle" ||
       thread.status === "completed" ||
@@ -213,6 +221,36 @@ function worktreeOwner<T extends Pick<OrchestrationV2ThreadShell, "id" | "lineag
   return owner;
 }
 
+function worktreeSettlementChain(
+  thread: OrchestrationV2ThreadShell,
+  byId: ReadonlyMap<ThreadId, OrchestrationV2ThreadShell>,
+  now: number,
+  settings: LimitRecoverySettings,
+) {
+  const chain = [thread];
+  let current = thread;
+  while (current.settledAt === null) {
+    if (
+      current.lineage.relationshipToParent !== "subagent" ||
+      current.settledOverride === "active" ||
+      current.pinnedAt != null
+    )
+      return [];
+    const parent = byId.get(current.lineage.parentThreadId!);
+    if (
+      parent === undefined ||
+      chain.some((member) => member.id === parent.id) ||
+      parent.projectId !== thread.projectId ||
+      parent.lineage.rootThreadId !== thread.lineage.rootThreadId ||
+      !threadIdle(parent, now, settings)
+    )
+      return [];
+    chain.push(parent);
+    current = parent;
+  }
+  return chain;
+}
+
 /** Squash/rebase merges require the merged PR to name this exact head commit. */
 export function storageCleanupPullRequestMerged(
   pullRequest: Pick<
@@ -775,6 +813,7 @@ const make = Effect.gen(function* () {
       ),
     )).filter((thread) => thread.worktreePath !== null && thread.branch !== null);
     const snapshot = yield* readThreads();
+    const threadsById = new Map(snapshot.threads.map((thread) => [thread.id, thread]));
     const refreshedDefaultRefs = new Map<string, Set<string>>();
     const defaultBranches = new Map<string, string | null>();
     const groups = Map.groupBy(
@@ -808,6 +847,10 @@ const make = Effect.gen(function* () {
       const group = groups.get(worktreePath) ?? [];
       const activityAt = Math.max(...group.map(storageCleanupActivityAt));
       const deleted = "workspaceRoot" in thread;
+      const settlementChain = deleted
+        ? []
+        : worktreeSettlementChain(thread, threadsById, now, serverSettings);
+      const settledThread = settlementChain.at(-1);
       const members = deleted ? [thread, ...group] : group;
       const project = deleted
         ? { workspaceRoot: thread.workspaceRoot }
@@ -862,7 +905,7 @@ const make = Effect.gen(function* () {
         const changes = yield* localChangesReason(worktreePath, settings);
         if (changes !== null) return keep(changes);
         if (
-          group.some(
+          [...group, ...settlementChain.slice(1)].some(
             (member) =>
               member.settledAt !== null &&
               now - Math.max(DateTime.toEpochMillis(member.updatedAt), activityAt) <
@@ -876,9 +919,9 @@ const make = Effect.gen(function* () {
           settings.worktreeAfterDays !== null &&
           activityAt < now - settings.worktreeAfterDays * DAY_MS;
         const settledFor =
-          deleted || thread.settledAt === null
+          settledThread?.settledAt == null
             ? null
-            : now - Math.max(DateTime.toEpochMillis(thread.settledAt), activityAt);
+            : now - Math.max(DateTime.toEpochMillis(settledThread.settledAt), activityAt);
         const settledDays = settledFor === null ? null : Math.floor(settledFor / DAY_MS);
         const settled =
           settledFor !== null &&
@@ -1045,6 +1088,27 @@ const make = Effect.gen(function* () {
             })
           )
             return waitForStop("thread activity or shared worktree changed since check");
+          if (settlementChain.length > 1) {
+            const ancestors = yield* Effect.forEach(settlementChain.slice(1), (ancestor) =>
+              projections.getThreadShell(ancestor.id),
+            );
+            const latestSettlement = worktreeSettlementChain(
+              latestGroup.find((shell) => shell.id === thread.id)!,
+              new Map(
+                [...latestGroup, ...ancestors.filter((ancestor) => ancestor !== null)].map(
+                  (ancestor) => [ancestor.id, ancestor],
+                ),
+              ),
+              now,
+              serverSettings,
+            ).at(-1);
+            if (
+              latestSettlement?.id !== settledThread?.id ||
+              !Equal.equals(latestSettlement?.settledAt, settledThread?.settledAt) ||
+              !Equal.equals(latestSettlement?.updatedAt, settledThread?.updatedAt)
+            )
+              return "parent settlement changed since check";
+          }
           // Sessions can outlive their run and can be shared across app threads.
           const sessionRows = yield* sql<{ payload_json: string }>`
             SELECT payload_json FROM orchestration_v2_projection_provider_sessions

From 7fd859aeef7e8a151551e7888d7732c136ffc7f0 Mon Sep 17 00:00:00 2001
From: Chunhao Zhang <55630163+hahhforest@users.noreply.github.com>
Date: Wed, 4 Nov 2026 07:44:15 +0800
Subject: [PATCH 152/167] fix(server): Claude context meter shows the window
 for models outside the catalog (#30051)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../Adapters/ClaudeAdapterV2.test.ts          |  89 +++++++++++++++-
 .../Adapters/ClaudeAdapterV2.ts               | 100 +++++++++---------
 .../src/provider/ClaudeTurnTokenUsage.ts      |  13 +++
 3 files changed, 149 insertions(+), 53 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index c75b99832e4cc..ef721644f6a8f 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -738,7 +738,7 @@ describe("ClaudeAdapterV2 context usage", () => {
         output_tokens: 1,
         cache_creation: { ephemeral_1h_input_tokens: 0, ephemeral_5m_input_tokens: 300 },
       },
-      CLAUDE_TEST_MODEL_SELECTION,
+      null,
       "2026-08-29T00:03:00.000Z",
       "",
       DateTime.makeUnsafe("2026-08-29T00:00:00.000Z"),
@@ -2990,6 +2990,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
       readonly cache_creation_input_tokens: number;
       readonly cache_read_input_tokens: number;
     };
+    readonly modelUsage?: SDKResultMessage["modelUsage"];
   }) =>
     claudeSdkFrame({
       type: "result",
@@ -3007,7 +3008,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
         cache_creation_input_tokens: 0,
         cache_read_input_tokens: 0,
       },
-      modelUsage: {},
+      modelUsage: input.modelUsage ?? {},
       permission_denials: [],
       uuid: input.uuid,
       session_id: WAKE_NATIVE_SESSION,
@@ -7131,6 +7132,67 @@ describe("ClaudeAdapterV2 background wake turns", () => {
     ),
   );
 
+  it.effect("measures a model outside the catalog against the window Claude reports", () =>
+    Effect.gen(function* () {
+      const harness = yield* makeWakeHarness;
+      const modelSelection = {
+        instanceId: ProviderInstanceId.make(ClaudeAdapterV2.CLAUDE_PROVIDER),
+        model: "gateway-model",
+      } satisfies ModelSelection;
+      assert.strictEqual(harness.runtime.getModelContextWindow?.(modelSelection), undefined);
+      yield* harness.runtime.startTurn(
+        makeClaudeTestTurnInput({
+          threadId: harness.threadId,
+          providerThread: harness.providerThread,
+          now: yield* DateTime.now,
+          attemptId: RunAttemptId.make("attempt-reported-context-window"),
+          text: "Continue.",
+          attachments: [],
+          modelSelection,
+        }),
+      );
+      const usage = { ...zeroUsage, input_tokens: 9_667, output_tokens: 2 };
+      const frames = [
+        usageStreamFrame({ type: "message_start", message: { id: "msg_gateway", usage } }),
+        makeResultFrame({
+          uuid: "00000000-0000-4000-8000-000000000680",
+          result: "OK",
+          modelUsage: {
+            "gateway-model": {
+              inputTokens: 9_667,
+              outputTokens: 2,
+              cacheReadInputTokens: 0,
+              cacheCreationInputTokens: 0,
+              webSearchRequests: 0,
+              costUSD: 0,
+              contextWindow: 1_048_576,
+              maxOutputTokens: 32_000,
+            },
+          },
+        }),
+      ];
+      for (const frame of frames) yield* Queue.offer(harness.sdkMessages, frame);
+      const terminal = yield* Queue.take(harness.terminalReceipts);
+      assert.equal(terminal.status, "completed");
+      const windows = harness.events.flatMap((event) =>
+        event.type === "provider_turn.updated" && event.providerTurn.tokenUsage
+          ? [event.providerTurn.tokenUsage.maxTokens]
+          : [],
+      );
+      assert.deepEqual(windows, [null, 1_048_576]);
+      assert.strictEqual(harness.runtime.getModelContextWindow?.(modelSelection), 1_048_576);
+    }).pipe(
+      Effect.provide(
+        Layer.mergeAll(
+          IdAllocator.layer,
+          McpProviderSessions.layer,
+          NodeServices.layer,
+          NodeCrypto.layer,
+        ),
+      ),
+    ),
+  );
+
   it.effect("merges cumulative stream usage into the message_start counts", () =>
     Effect.gen(function* () {
       const harness = yield* makeWakeHarnessWithOptions({
@@ -7372,6 +7434,10 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             providerThread: harness.providerThread,
             now,
             attemptId: RunAttemptId.make("claude-native-compact-attempt"),
+            modelSelection: {
+              instanceId: ProviderInstanceId.make(ClaudeAdapterV2.CLAUDE_PROVIDER),
+              model: "gateway-model",
+            },
             text: " /COMPACT ",
             attachments: [],
           }),
@@ -7391,6 +7457,18 @@ describe("ClaudeAdapterV2 background wake turns", () => {
           makeResultFrame({
             uuid: "00000000-0000-4000-8000-000000000202",
             result: "Compacted conversation.",
+            modelUsage: {
+              "gateway-model": {
+                inputTokens: 1,
+                outputTokens: 1,
+                cacheReadInputTokens: 0,
+                cacheCreationInputTokens: 0,
+                webSearchRequests: 0,
+                costUSD: 0,
+                contextWindow: 200_000,
+                maxOutputTokens: 32_000,
+              },
+            },
           }),
         );
         yield* Queue.take(harness.terminalReceipts);
@@ -7411,6 +7489,12 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             event.providerTurn.tokenUsage?.usedTokens === 400,
         );
         assert.isDefined(watermark);
+        const windows = harness.events.flatMap((event) =>
+          event.type === "provider_turn.updated" && event.providerTurn.tokenUsage
+            ? [event.providerTurn.tokenUsage.maxTokens]
+            : [],
+        );
+        assert.deepEqual(windows, [null, 200_000]);
         const completed = harness.events.findLast(
           (event) => event.type === "provider_turn.updated",
         );
@@ -7424,6 +7508,7 @@ describe("ClaudeAdapterV2 background wake turns", () => {
             outputTokens: 1,
             cachedInputTokens: 0,
             cacheCreationTokens: 0,
+            otherUsage: { inputTokens: 0, outputTokens: 0 },
           });
         }
       }).pipe(
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index b306bcf52d888..d2ae14545d965 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -25,6 +25,7 @@ import {
   addClaudeLedgerUsage,
   claudeLedgerDelta,
   claudeModelLedger,
+  claudeReportedContextWindows,
   normalizeClaudeTurnTokenUsage,
   type ClaudeLedgerUsage,
   type ClaudeModelLedger,
@@ -221,12 +222,6 @@ import {
 export const CLAUDE_PROVIDER = ProviderDriverKind.make("claudeAgent");
 const CLAUDE_AGENT_SDK_QUERY_PROTOCOL = "claude-agent-sdk.query" as const;
 
-function claudeContextWindow(modelSelection: ModelSelection): number | null {
-  return (
-    resolveClaudeCatalogContextWindowTokens(BUNDLED_CLAUDE_MODEL_CATALOG, modelSelection) ?? null
-  );
-}
-
 interface ClaudeCacheCreation {
   readonly ephemeral_1h_input_tokens: number;
   readonly ephemeral_5m_input_tokens: number;
@@ -273,7 +268,7 @@ export function claudeProviderTurnTokenUsage(
     readonly cache_creation?: ClaudeCacheCreation | null;
     readonly output_tokens: number;
   },
-  modelSelection: ModelSelection,
+  maxTokens: number | null,
   updatedAt: string,
   autoCompactWindow = "",
   requestedAt?: DateTime.Utc,
@@ -281,7 +276,6 @@ export function claudeProviderTurnTokenUsage(
   const inputTokens = claudeMessageInputTokens(usage);
   const outputTokens = usage.output_tokens;
   const promptCacheTtlMs = claudePromptCacheTtlMs(usage.cache_creation);
-  const maxTokens = claudeContextWindow(modelSelection);
   // The cache lifetime starts with the request, not when its response ends.
   const promptCacheExpiresAt =
     promptCacheTtlMs === undefined || requestedAt === undefined
@@ -4123,6 +4117,7 @@ interface ActiveClaudeTurnContext {
     requestedAt?: DateTime.Utc;
     usage: ClaudeMessageUsage | null;
   } | null;
+  compactionTokens: number | undefined;
   readonly toolCalls: Map<string, ActiveClaudeToolCall>;
   // A successful status can precede the boundary that supplies its token counts.
   compaction: Extract<OrchestrationV2TurnItem, { type: "compaction" }> | null;
@@ -4621,6 +4616,12 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
     BUNDLED_CLAUDE_MODEL_CATALOG,
     adapterOptions.settings.customModels,
   );
+  // Results report the window Claude Code compacts against; outside the catalog it is the only source.
+  const reportedContextWindows = new Map<string, number>();
+  const claudeContextWindow = (modelSelection: ModelSelection): number | null =>
+    resolveClaudeCatalogContextWindowTokens(BUNDLED_CLAUDE_MODEL_CATALOG, modelSelection) ??
+    reportedContextWindows.get(compileClaudeModelSelection(modelSelection).apiModelId) ??
+    null;
   const continuationRequests = adapterOptions.continuationRequests ?? {
     offer: () => Effect.void,
   };
@@ -4853,6 +4854,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
         const queryContext = yield* Ref.make<ClaudeLiveQueryContext | null>(null);
         // Wake buffers replay result frames, so ledger growth is measured once on arrival.
         const resultLedgerUsage = new WeakMap<SDKMessage, ClaudeLedgerUsage>();
+        const resultsReportingNewContextWindow = new WeakSet<SDKMessage>();
         // A worktree handoff changes the project settings even within one session.
         let bypassCache: { cwd: string | null; availability: ClaudeBypassAvailability } | null =
           null;
@@ -5139,21 +5141,36 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
         // Usage without input is a placeholder, not a context measurement.
         const emitContextUsage = Effect.fnUntraced(function* (
           context: ActiveClaudeTurnContext,
-          usage: ClaudeMessageUsage,
+          usage: ClaudeMessageUsage | number,
           requestStarted = false,
         ) {
           const now = yield* DateTime.now;
           // Only message_start marks the request start; an assistant snapshot
           // arrives after generation, so it leaves the cache expiry unknown.
           if (requestStarted && context.streamUsage !== null) context.streamUsage.requestedAt = now;
-          const tokenUsage = claudeProviderTurnTokenUsage(
-            usage,
-            context.input.modelSelection,
-            DateTime.formatIso(now),
-            adapterOptions.settings.autoCompactWindow,
-            context.streamUsage?.requestedAt,
-          );
-          if (tokenUsage.inputTokens <= 0) return;
+          const maxTokens = claudeContextWindow(context.input.modelSelection);
+          const tokenUsage =
+            typeof usage === "number"
+              ? {
+                  usedTokens: usage,
+                  maxTokens,
+                  ...claudeAutoCompactThreshold(
+                    adapterOptions.settings.autoCompactWindow,
+                    maxTokens,
+                  ),
+                  updatedAt: DateTime.formatIso(now),
+                }
+              : claudeProviderTurnTokenUsage(
+                  usage,
+                  maxTokens,
+                  DateTime.formatIso(now),
+                  adapterOptions.settings.autoCompactWindow,
+                  context.streamUsage?.requestedAt,
+                );
+          if (typeof usage !== "number") {
+            if (claudeMessageInputTokens(usage) <= 0) return;
+            context.compactionTokens = undefined;
+          }
           yield* emitProviderEvent({
             type: "provider_turn.updated",
             driver: CLAUDE_PROVIDER,
@@ -8828,38 +8845,8 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
               typeof postTokens === "number" && Number.isFinite(postTokens) && postTokens > 0
                 ? Math.round(postTokens)
                 : undefined;
-            if (afterTokenCount !== undefined) {
-              const maxTokens = claudeContextWindow(context.input.modelSelection);
-              yield* emitProviderEvent({
-                type: "provider_turn.updated",
-                driver: CLAUDE_PROVIDER,
-                threadId: context.input.threadId,
-                providerTurn: {
-                  id: context.providerTurnId,
-                  providerThreadId: context.input.providerThread.id,
-                  nodeId: context.input.rootNodeId,
-                  runAttemptId: context.input.attemptId,
-                  nativeTurnRef: {
-                    driver: CLAUDE_PROVIDER,
-                    nativeId: context.nativeTurnId,
-                    strength: "strong",
-                  },
-                  ordinal: context.providerTurnOrdinal,
-                  status: "running",
-                  startedAt: context.startedAt,
-                  completedAt: null,
-                  tokenUsage: {
-                    usedTokens: afterTokenCount,
-                    maxTokens,
-                    ...claudeAutoCompactThreshold(
-                      adapterOptions.settings.autoCompactWindow,
-                      maxTokens,
-                    ),
-                    updatedAt: DateTime.formatIso(now),
-                  },
-                },
-              });
-            }
+            context.compactionTokens = afterTokenCount;
+            if (afterTokenCount !== undefined) yield* emitContextUsage(context, afterTokenCount);
             yield* emitProviderEvent({
               type: "turn_item.updated",
               driver: CLAUDE_PROVIDER,
@@ -9585,6 +9572,10 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
           }
 
           if (message.type === "result") {
+            const contextUsage = context.streamUsage?.usage ?? context.compactionTokens;
+            if (resultsReportingNewContextWindow.has(message) && contextUsage !== undefined) {
+              yield* emitContextUsage(context, contextUsage);
+            }
             const completedAt = yield* DateTime.now;
             const interrupted = (yield* Ref.get(interruptedTurns)).has(context.providerTurnId);
             const wasSteered = (yield* Ref.get(steeredTurns)).has(context.providerTurnId);
@@ -10647,6 +10638,13 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
                       growth === undefined && context.modelLedger !== undefined
                         ? undefined
                         : ledger;
+                    for (const [model, window] of claudeReportedContextWindows(
+                      message.modelUsage,
+                    )) {
+                      if (reportedContextWindows.get(model) === window) continue;
+                      reportedContextWindows.set(model, window);
+                      resultsReportingNewContextWindow.add(message);
+                    }
                   }
                   return handleSdkMessage({ query: querySession, message });
                 }),
@@ -10785,6 +10783,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
                 blocks: new Map(),
               },
               streamUsage: null,
+              compactionTokens: undefined,
               toolCalls: new Map(),
               compaction: null,
               ignoredTaskIds: new Set(),
@@ -11349,8 +11348,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
           driver: CLAUDE_PROVIDER,
           providerSessionId: input.providerSessionId,
           providerSession: session,
-          getModelContextWindow: (selection) =>
-            resolveClaudeCatalogContextWindowTokens(BUNDLED_CLAUDE_MODEL_CATALOG, selection),
+          getModelContextWindow: (selection) => claudeContextWindow(selection) ?? undefined,
           events: Stream.fromEffectRepeat(Queue.take(events)),
           backgroundTasksEndWithProcess: true,
           hasPendingBackgroundWork: Effect.gen(function* () {
diff --git a/apps/server/src/provider/ClaudeTurnTokenUsage.ts b/apps/server/src/provider/ClaudeTurnTokenUsage.ts
index 2fa6a11bac1e5..118716c55c26d 100644
--- a/apps/server/src/provider/ClaudeTurnTokenUsage.ts
+++ b/apps/server/src/provider/ClaudeTurnTokenUsage.ts
@@ -77,6 +77,19 @@ export function claudeModelLedger(modelUsage: unknown): ClaudeModelLedger | unde
   return ledger;
 }
 
+/** The window each model in the SDK's `modelUsage` is measured against, as Claude Code resolved it. */
+export function claudeReportedContextWindows(modelUsage: unknown): ReadonlyMap<string, number> {
+  const windows = new Map<string, number>();
+  if (typeof modelUsage !== "object" || modelUsage === null) return windows;
+  for (const [model, entry] of Object.entries(modelUsage as Record<string, unknown>)) {
+    const window = finiteNonNegativeInteger(
+      (entry as Record<string, unknown> | null)?.contextWindow,
+    );
+    if (window !== undefined && window > 0) windows.set(model, window);
+  }
+  return windows;
+}
+
 /** Ledger growth since `previous`. Unknown without a baseline or when a counter goes backwards. */
 export function claudeLedgerDelta(
   previous: ClaudeModelLedger | undefined,

From ece6322f611ae68bf2aa13961124ffa1ba87ee4f Mon Sep 17 00:00:00 2001
From: levelorbit <172493156+levelorbit@users.noreply.github.com>
Date: Wed, 4 Nov 2026 00:44:32 +0100
Subject: [PATCH 153/167] fix(server): quitting no longer waits on an
 unreachable telemetry endpoint (#30033)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/telemetry/AnalyticsService.test.ts    | 65 ++++++++++++-------
 apps/server/src/telemetry/AnalyticsService.ts |  8 ++-
 2 files changed, 49 insertions(+), 24 deletions(-)

diff --git a/apps/server/src/telemetry/AnalyticsService.test.ts b/apps/server/src/telemetry/AnalyticsService.test.ts
index 98e3d640c604c..4d3c2d5421279 100644
--- a/apps/server/src/telemetry/AnalyticsService.test.ts
+++ b/apps/server/src/telemetry/AnalyticsService.test.ts
@@ -5,8 +5,11 @@ import { assert, it } from "@effect/vitest";
 import * as Clock from "effect/Clock";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import * as Scope from "effect/Scope";
 import * as TestClock from "effect/testing/TestClock";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientError from "effect/http/HttpClientError";
@@ -110,6 +113,30 @@ const recordTwentyEvents = Effect.gen(function* () {
   }
 });
 
+const analyticsLayerWith = (client: HttpClient.HttpClient, policy?: ManagedPolicyDocument) =>
+  AnalyticsService.layer.pipe(
+    Layer.provideMerge(
+      ServerConfig.ServerConfig.layerTest(process.cwd(), { prefix: "t3-telemetry-retry-" }),
+    ),
+    Layer.provide(
+      ConfigProvider.layer(
+        ConfigProvider.fromUnknown({
+          T3CODE_TELEMETRY_ENABLED: true,
+          T3CODE_POSTHOG_KEY: "phc_test_key",
+          T3CODE_POSTHOG_HOST: "http://localhost",
+        }),
+      ),
+    ),
+    Layer.provide(
+      Layer.mergeAll(
+        Layer.succeed(HostProcess.Platform, "win32"),
+        Layer.succeed(HostProcess.Architecture, "x64"),
+        Layer.succeed(HttpClient.HttpClient, client),
+        ManagedPolicy.layerTest(policy),
+      ),
+    ),
+  );
+
 /**
  * Runs `record` (20 events by default), then lets `minutes` of background
  * flushes run against a client that answers every send with `respond`.
@@ -138,28 +165,7 @@ const sendFor = (
         return yield* respond(request);
       }),
     );
-    const runtimeLayer = AnalyticsService.layer.pipe(
-      Layer.provideMerge(
-        ServerConfig.ServerConfig.layerTest(process.cwd(), { prefix: "t3-telemetry-retry-" }),
-      ),
-      Layer.provide(
-        ConfigProvider.layer(
-          ConfigProvider.fromUnknown({
-            T3CODE_TELEMETRY_ENABLED: true,
-            T3CODE_POSTHOG_KEY: "phc_test_key",
-            T3CODE_POSTHOG_HOST: "http://localhost",
-          }),
-        ),
-      ),
-      Layer.provide(
-        Layer.mergeAll(
-          Layer.succeed(HostProcess.Platform, "win32"),
-          Layer.succeed(HostProcess.Architecture, "x64"),
-          Layer.succeed(HttpClient.HttpClient, client),
-          ManagedPolicy.layerTest(policy),
-        ),
-      ),
-    );
+    const runtimeLayer = analyticsLayerWith(client, policy);
 
     yield* Effect.gen(function* () {
       yield* record;
@@ -271,6 +277,21 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("AnalyticsService
     }),
   );
 
+  it.effect("shutdown stops waiting for a telemetry endpoint that never answers", () =>
+    Effect.gen(function* () {
+      const scope = yield* Scope.make();
+      const context = yield* Layer.buildWithScope(
+        analyticsLayerWith(HttpClient.make(() => Effect.never)),
+        scope,
+      );
+      yield* recordTwentyEvents.pipe(Effect.provide(context));
+
+      const shutdown = yield* Scope.close(scope, Exit.void).pipe(Effect.forkChild);
+      yield* TestClock.adjust("1 second");
+      yield* Fiber.join(shutdown);
+    }),
+  );
+
   it.effect("flush drains all buffered events across multiple batches", () =>
     Effect.gen(function* () {
       const capturedRequests: Array<RecordedBatchRequest> = [];
diff --git a/apps/server/src/telemetry/AnalyticsService.ts b/apps/server/src/telemetry/AnalyticsService.ts
index 91b00eeb12335..384da92b3f312 100644
--- a/apps/server/src/telemetry/AnalyticsService.ts
+++ b/apps/server/src/telemetry/AnalyticsService.ts
@@ -41,8 +41,10 @@ interface DeliveryState {
 
 // Retry delays shorter than this still wait for the next background check.
 const FLUSH_INTERVAL_MS = 10_000;
-// A hung send would hold the flush lock, and with it the shutdown flush.
+// A hung send would hold the flush lock for the next background flush.
 const SEND_TIMEOUT = "10 seconds";
+// Quit and restart wait for this flush; events it cannot send in time are dropped.
+const SHUTDOWN_FLUSH_TIMEOUT = "1 second";
 // A failed batch is tried again until it has failed for this long. Ingest answers 503 when it
 // cannot store a batch, and a broken Cloudflare location can take about 5 minutes to fail over.
 // The waiting batch holds newer events back; `maxBufferedEvents` bounds them meanwhile.
@@ -352,7 +354,9 @@ export const make = Effect.gen(function* () {
     disableYield: true,
   }).pipe(Effect.forkScoped);
 
-  yield* Effect.addFinalizer(() => flush);
+  yield* Effect.addFinalizer(() =>
+    flush.pipe(Effect.timeout(SHUTDOWN_FLUSH_TIMEOUT), Effect.ignore),
+  );
 
   return AnalyticsService.of({ record, flush, recordOwners });
 });

From dd8c122c5d5221eddacb553ae07512bace76a759 Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 4 Nov 2026 05:14:50 +0530
Subject: [PATCH 154/167] fix(client): keep snoozed failures hidden without
 completion times (#30063)

---
 packages/client-runtime/src/state/threadSettled.ts   |  6 +++---
 .../client-runtime/src/state/threadSnoozed.test.ts   | 12 ++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/packages/client-runtime/src/state/threadSettled.ts b/packages/client-runtime/src/state/threadSettled.ts
index 6ad788e0a6623..fa1c33fb8341f 100644
--- a/packages/client-runtime/src/state/threadSettled.ts
+++ b/packages/client-runtime/src/state/threadSettled.ts
@@ -96,14 +96,14 @@ export function threadRaisedHandWhileSnoozed(shell: ThreadSnoozeShell): boolean
   );
 }
 
-// V2 runtime.updatedAt includes metadata writes; prefer the failed run's completion.
+// V2 runtime.updatedAt includes metadata writes, not just failures.
 // Legacy sessions only expose the runtime timestamp.
 function failureEdgeAt(shell: ThreadSnoozeShell): string | null | undefined {
   const runtime = shell.runtime ?? shell.session ?? null;
   if (runtime?.status !== "error" && runtime?.status !== "failed") return undefined;
   const latestRun = shell.latestRun ?? shell.latestTurn ?? null;
-  if (latestRun?.status === "failed" && latestRun.completedAt != null) {
-    return latestRun.completedAt;
+  if (latestRun?.status === "failed") {
+    return latestRun.completedAt ?? null;
   }
   return runtime.updatedAt ?? null;
 }
diff --git a/packages/client-runtime/src/state/threadSnoozed.test.ts b/packages/client-runtime/src/state/threadSnoozed.test.ts
index adf9227bf010c..f8f01ec6a1d9a 100644
--- a/packages/client-runtime/src/state/threadSnoozed.test.ts
+++ b/packages/client-runtime/src/state/threadSnoozed.test.ts
@@ -96,6 +96,18 @@ describe("effectiveSnoozed", () => {
       pending: undefined,
       wokeAt: null,
     },
+    {
+      reason: "failure without a completion timestamp",
+      completedAt: null,
+      pending: undefined,
+      wokeAt: null,
+    },
+    {
+      reason: "approval without a failure completion timestamp",
+      completedAt: null,
+      pending: "approval",
+      wokeAt: "2026-04-10T11:00:00.000Z",
+    },
     {
       reason: "fresh failure",
       completedAt: "2026-04-10T10:00:00.000Z",

From ffa39e2f0478da07675fe283cd56eb7c212174fb Mon Sep 17 00:00:00 2001
From: Advait Paliwal <advaitspaliwal@gmail.com>
Date: Tue, 3 Nov 2026 15:45:07 -0800
Subject: [PATCH 155/167] perf(server): PR sync stops reading pull requests
 closed over a day ago (#30071)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../PullRequestSyncReactor.test.ts            | 124 +++++++++++++-----
 .../PullRequestSyncReactor.ts                 |  26 ++--
 2 files changed, 102 insertions(+), 48 deletions(-)

diff --git a/apps/server/src/orchestration-v2/PullRequestSyncReactor.test.ts b/apps/server/src/orchestration-v2/PullRequestSyncReactor.test.ts
index a1bacda0806ed..0161054781567 100644
--- a/apps/server/src/orchestration-v2/PullRequestSyncReactor.test.ts
+++ b/apps/server/src/orchestration-v2/PullRequestSyncReactor.test.ts
@@ -979,6 +979,49 @@ describe("PullRequestSyncReactor", () => {
     ),
   );
 
+  it.effect("stops reading a pull request a day after it closed, until a refresh asks", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        yield* TestClock.setTime(Date.parse(NOW));
+        const closed = (closedAt: string | null) => ({ state: "closed" as const, closedAt });
+        const fixture = yield* makeHarness({
+          snapshot: makeSnapshot([
+            makeThread("closed", {
+              pullRequests: [
+                makeLink(1, closed("2026-08-20T00:00:00.000Z")),
+                makeLink(2, closed("2026-08-26T00:00:00.000Z")),
+                makeLink(3, closed("2026-08-28T11:00:00.000Z")),
+                makeLink(4, closed(null)),
+              ],
+            }),
+          ]),
+          summary: (input) =>
+            Effect.succeed(makeSummary(input, { state: "closed", closedAt: NOW })),
+        });
+        const reads = Ref.get(fixture.summaryCalls).pipe(
+          Effect.map((calls) => calls.map((call) => call.number).toSorted()),
+        );
+
+        yield* Effect.gen(function* () {
+          const reactor = yield* startAndSweep(fixture);
+          // Closed within the day, or with no close time, keeps the fifteen-minute cadence.
+          assert.deepStrictEqual(yield* reads, [3, 4]);
+          for (let index = 0; index < 15; index += 1) yield* sweepAgain(fixture, reactor);
+          assert.deepStrictEqual(yield* reads, [3, 3, 4, 4]);
+
+          yield* reactor.requestSync({
+            host: "github.com",
+            repository: "owner/repository",
+            number: 1,
+          });
+          yield* Queue.take(fixture.snapshotReads);
+          yield* reactor.drain;
+          assert.deepStrictEqual(yield* reads, [1, 3, 3, 4, 4]);
+        }).pipe(Effect.provide(fixture.layer));
+      }),
+    ),
+  );
+
   it.effect("re-reads a merged pull request until the host supplies its merge time", () =>
     Effect.scoped(
       Effect.gen(function* () {
@@ -1579,46 +1622,55 @@ describe("PullRequestSyncReactor", () => {
     ),
   );
 
-  it.effect("reads open links fresh as soon as a merge command ends, before its run ends", () =>
-    Effect.scoped(
-      Effect.gen(function* () {
-        yield* TestClock.setTime(Date.parse(NOW));
-        const state = yield* Ref.make<PullRequestSummary["state"]>("open");
-        const fixture = yield* makeHarness({
-          snapshot: makeSnapshot([
-            makeThread("agent", { pullRequests: [makeLink(7, { state: "open" })] }),
-          ]),
-          summary: (input) =>
-            Ref.get(state).pipe(
-              Effect.map((current) =>
-                makeSummary(input, current === "merged" ? { state: current, mergedAt: NOW } : {}),
+  it.effect.each(["open", "closed"] as const)(
+    "reads %s links fresh as soon as a merge command ends, before its run ends",
+    (initialState) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          yield* TestClock.setTime(Date.parse(NOW));
+          const state = yield* Ref.make<PullRequestSummary["state"]>(initialState);
+          const initialSnapshot = {
+            state: initialState,
+            closedAt: initialState === "closed" ? "2026-08-20T00:00:00.000Z" : null,
+          };
+          const fixture = yield* makeHarness({
+            snapshot: makeSnapshot([
+              makeThread("agent", { pullRequests: [makeLink(7, initialSnapshot)] }),
+            ]),
+            summary: (input) =>
+              Ref.get(state).pipe(
+                Effect.map((current) =>
+                  makeSummary(
+                    input,
+                    current === "merged" ? { state: current, mergedAt: NOW } : initialSnapshot,
+                  ),
+                ),
               ),
-            ),
-        });
+          });
 
-        yield* Effect.gen(function* () {
-          const reactor = yield* startAndSweep(fixture);
-          yield* Ref.set(state, "merged");
-          yield* Ref.set(fixture.summaryCalls, []);
+          yield* Effect.gen(function* () {
+            const reactor = yield* startAndSweep(fixture);
+            yield* Ref.set(state, "merged");
+            yield* Ref.set(fixture.summaryCalls, []);
 
-          yield* Queue.offer(
-            fixture.domainEvents,
-            commandRan(ThreadId.make("agent"), "gh pr merge 7"),
-          );
-          yield* Queue.take(fixture.snapshotReads);
-          yield* Queue.take(fixture.snapshotReads);
-          yield* reactor.drain;
+            yield* Queue.offer(
+              fixture.domainEvents,
+              commandRan(ThreadId.make("agent"), "gh pr merge 7"),
+            );
+            yield* Queue.take(fixture.snapshotReads);
+            yield* Queue.take(fixture.snapshotReads);
+            yield* reactor.drain;
 
-          assert.deepStrictEqual(
-            (yield* Ref.get(fixture.syncCommands)).map((command) => [
-              command.number,
-              command.snapshot.state,
-            ]),
-            [[7, "merged"]],
-          );
-        }).pipe(Effect.provide(fixture.layer));
-      }),
-    ),
+            assert.deepStrictEqual(
+              (yield* Ref.get(fixture.syncCommands)).map((command) => [
+                command.number,
+                command.snapshot.state,
+              ]),
+              [[7, "merged"]],
+            );
+          }).pipe(Effect.provide(fixture.layer));
+        }),
+      ),
   );
 
   it.effect.each([
diff --git a/apps/server/src/orchestration-v2/PullRequestSyncReactor.ts b/apps/server/src/orchestration-v2/PullRequestSyncReactor.ts
index 25c062301e35f..9dffe4babb424 100644
--- a/apps/server/src/orchestration-v2/PullRequestSyncReactor.ts
+++ b/apps/server/src/orchestration-v2/PullRequestSyncReactor.ts
@@ -44,6 +44,9 @@ const SLOW_SYNC_INTERVAL_MS = 15 * 60 * 1_000;
 // requested refreshes, watches and a host CLI's merge command still read it at once.
 const QUIET_AFTER_MS = 30 * 60 * 1_000;
 const QUIET_SYNC_INTERVAL_MS = 5 * 60 * 1_000;
+// A pull request closed this long ago is rarely reopened, so the sweep stops reading it, as it
+// does merged ones. A reader that sees it open, or a requested refresh, still reads it at once.
+const CLOSED_FINAL_AFTER_MS = 24 * 60 * 60 * 1_000;
 
 const isChangeRequestCloseCommand = (command: string) =>
   sourceControlDefinitions.definitions.some(
@@ -351,13 +354,12 @@ export const make = Effect.gen(function* () {
     if (entries.some((entry) => entry.link.snapshot === null)) return true;
     const active = entries.filter((entry) => isUnsettled(entry.thread));
     // Merged snapshots without mergedAt cannot settle threads; reread slowly until supplied.
-    if (
-      active.every(
-        (entry) => entry.link.snapshot?.state === "merged" && entry.link.snapshot.mergedAt != null,
-      )
-    ) {
-      return false;
-    }
+    const isFinal = ({ link: { snapshot } }: LinkEntry) =>
+      snapshot?.state === "merged"
+        ? snapshot.mergedAt != null
+        : snapshot?.state === "closed" &&
+          nowMs - Date.parse(snapshot.closedAt ?? "") >= CLOSED_FINAL_AFTER_MS;
+    if (active.every(isFinal)) return false;
     const last = lastSyncedAt.get(key);
     const sinceLastMs = last === undefined ? Number.POSITIVE_INFINITY : nowMs - last;
     const open = active.filter((entry) => entry.link.snapshot?.state === "open");
@@ -627,13 +629,13 @@ export const make = Effect.gen(function* () {
 
   // Threads that ran a close command this run, with the commands already read for.
   const closeCommands = new Map<ThreadId, Set<string>>();
-  const refreshOpenLinks = (threadId: ThreadId) =>
+  const refreshUnmergedLinks = (threadId: ThreadId) =>
     projections.getThreadsWithPullRequests(threadId).pipe(
       Effect.flatMap((threads) =>
         Effect.forEach(
           threads.flatMap((thread) =>
             visibleThreadPullRequests(thread.pullRequests ?? []).filter(
-              (link) => link.snapshot?.state === "open",
+              (link) => link.snapshot?.state === "open" || link.snapshot?.state === "closed",
             ),
           ),
           requestSync,
@@ -698,7 +700,7 @@ export const make = Effect.gen(function* () {
               { discard: true },
             );
           // An agent can merge or close its pull request from a shell with its host's CLI, which
-          // sends no merge notification. Read the thread's open links fresh once that command
+          // sends no merge notification. Read the thread's unmerged links fresh once that command
           // ends, while the agent usually still replies, so settlement can land before the run
           // ends. Read again when the run ends, since `merge --auto` returns before it merges.
           case "turn-item.updated": {
@@ -710,11 +712,11 @@ export const make = Effect.gen(function* () {
             closeCommands.set(event.threadId, ended);
             if (isOrchestrationV2WorkActive(item.status) || ended.has(item.id)) return linked;
             ended.add(item.id);
-            return Effect.andThen(linked, refreshOpenLinks(event.threadId));
+            return Effect.andThen(linked, refreshUnmergedLinks(event.threadId));
           }
           case "run.updated":
             return isTerminalRunStatus(event.payload.status) && closeCommands.delete(event.threadId)
-              ? refreshOpenLinks(event.threadId)
+              ? refreshUnmergedLinks(event.threadId)
               : Effect.void;
           default:
             return Effect.void;

From ddd36a53a59f24799a81f2b8e0a497ef81a4819a Mon Sep 17 00:00:00 2001
From: Abhishek B R <byteblaster1468@gmail.com>
Date: Wed, 4 Nov 2026 05:15:24 +0530
Subject: [PATCH 156/167] fix(acp): file changes show the patch of every diff
 in a tool call (#28631)

---
 .../Adapters/AcpAdapterV2.test.ts             | 65 +++++++++++++++++++
 packages/provider-acp/src/server/adapter.ts   | 30 ++++++---
 2 files changed, 87 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
index 3efa9047d5817..7234c561b9163 100644
--- a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
@@ -342,6 +342,71 @@ describe("acpToolCallDiffPatch", () => {
         "",
       ].join("\n"),
     );
+    assert.equal(
+      acpToolCallDiffPatch([
+        {
+          type: "diff",
+          changes: [{ operation: "modify", path: "/repo/a.ts" }],
+          patch: {
+            format: "git_patch",
+            text: "diff --git a/repo/a.ts b/repo/a.ts\n@@ -1 +1 @@\n-a\n+A\n",
+          },
+        },
+        {
+          type: "diff",
+          changes: [{ operation: "modify", path: "/repo/b.ts" }],
+          patch: {
+            format: "git_patch",
+            text: "diff --git a/repo/b.ts b/repo/b.ts\n@@ -1 +1 @@\n-b\n+B\n",
+          },
+        },
+        { type: "diff", path: "/repo/c.ts", oldText: "c\n", newText: "C\n" },
+      ]),
+      [
+        "diff --git a/repo/a.ts b/repo/a.ts",
+        "@@ -1 +1 @@",
+        "-a",
+        "+A",
+        "",
+        "diff --git a/repo/b.ts b/repo/b.ts",
+        "@@ -1 +1 @@",
+        "-b",
+        "+B",
+        "",
+        'diff --git "a//repo/c.ts" "b//repo/c.ts"',
+        "--- /repo/c.ts",
+        "+++ /repo/c.ts",
+        "@@ -1,1 +1,1 @@",
+        "-c",
+        "+C",
+        "",
+      ].join("\n"),
+    );
+    assert.equal(
+      acpToolCallDiffPatch([
+        { type: "diff", path: "/repo/new.txt", oldText: null, newText: "hello\n" },
+        {
+          type: "diff",
+          changes: [{ operation: "modify", path: "/repo/a.ts" }],
+          patch: { format: "git_patch", text: "@@ -1 +1 @@\n-a\n+A\n" },
+        },
+      ]),
+      [
+        'diff --git "a//repo/new.txt" "b//repo/new.txt"',
+        "--- /dev/null",
+        "+++ /repo/new.txt",
+        "@@ -0,0 +1,1 @@",
+        "+hello",
+        "",
+        'diff --git "a//repo/a.ts" "b//repo/a.ts"',
+        '--- "a//repo/a.ts"',
+        '+++ "b//repo/a.ts"',
+        "@@ -1 +1 @@",
+        "-a",
+        "+A",
+        "",
+      ].join("\n"),
+    );
   });
 });
 
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index ad0b716f37ce2..622bc63c933d8 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -1095,7 +1095,7 @@ export function acpToolCallDiffPatch(content: unknown): string | undefined {
     const diff = unknownRecord(entry);
     return diff?.type === "diff" ? [diff] : [];
   });
-  for (const diff of diffs) {
+  const patches = diffs.flatMap((diff): ReadonlyArray<{ text: string; path?: string }> => {
     const patch = unknownRecord(diff.patch);
     if (typeof patch?.text === "string") {
       const change =
@@ -1111,15 +1111,17 @@ export function acpToolCallDiffPatch(content: unknown): string | undefined {
         const before = change.operation === "add" ? "/dev/null" : JSON.stringify(`a/${oldPath}`);
         const after =
           change.operation === "delete" ? "/dev/null" : JSON.stringify(`b/${change.path}`);
-        return `diff --git ${JSON.stringify(`a/${oldPath}`)} ${JSON.stringify(`b/${change.path}`)}\n--- ${before}\n+++ ${after}\n${patch.text.trimStart()}`;
+        return [
+          {
+            text: `diff --git ${JSON.stringify(`a/${oldPath}`)} ${JSON.stringify(`b/${change.path}`)}\n--- ${before}\n+++ ${after}\n${patch.text.trimStart()}`,
+          },
+        ];
       }
-      return patch.text;
+      return [{ text: patch.text }];
     }
-  }
-  const v1Patches = diffs.flatMap((diff) => {
     if (typeof diff.path !== "string" || typeof diff.newText !== "string") return [];
     const oldText = typeof diff.oldText === "string" ? diff.oldText : undefined;
-    const patch = structuredPatch(
+    const structured = structuredPatch(
       oldText === undefined ? "/dev/null" : diff.path,
       diff.path,
       oldText ?? "",
@@ -1131,9 +1133,21 @@ export function acpToolCallDiffPatch(content: unknown): string | undefined {
         maxEditLength: oldText && diff.newText ? ACP_V1_DIFF_MAX_EDITS : Number.POSITIVE_INFINITY,
       },
     );
-    return patch === undefined || patch.hunks.length === 0 ? [] : [patch];
+    return structured === undefined || structured.hunks.length === 0
+      ? []
+      : [{ text: formatPatch(structured, FILE_HEADERS_ONLY), path: diff.path }];
   });
-  return v1Patches.length === 0 ? undefined : formatPatch(v1Patches, FILE_HEADERS_ONLY);
+  // Diff parsers split at Git headers once one exists, so every section then needs its own.
+  const hasGitHeader = patches.some(({ text }) => /^diff --git /m.test(text));
+  return patches.length === 0
+    ? undefined
+    : patches
+        .map(({ text, path }) =>
+          hasGitHeader && path !== undefined
+            ? `diff --git ${JSON.stringify(`a/${path}`)} ${JSON.stringify(`b/${path}`)}\n${text}`
+            : text,
+        )
+        .join("\n");
 }
 
 function pathFromToolCall(toolCall: AcpToolCallState): string | undefined {

From d075bed70f7b8cee456f06d299a11e99ea19673c Mon Sep 17 00:00:00 2001
From: wenshen18643 <wenshen18643@gmail.com>
Date: Wed, 4 Nov 2026 07:45:51 +0800
Subject: [PATCH 157/167] fix(server): Antigravity sign-in no longer blames the
 network while the runtime starts (#30079)

Co-authored-by: wenshen <wlum0002@student.monash.edu>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/provider/AntigravityAuth.test.ts      | 58 ++++++++++++++++---
 apps/server/src/provider/AntigravityAuth.ts   | 14 +++--
 2 files changed, 58 insertions(+), 14 deletions(-)

diff --git a/apps/server/src/provider/AntigravityAuth.test.ts b/apps/server/src/provider/AntigravityAuth.test.ts
index 4664c299e8a5c..d7099ec2bfa41 100644
--- a/apps/server/src/provider/AntigravityAuth.test.ts
+++ b/apps/server/src/provider/AntigravityAuth.test.ts
@@ -84,17 +84,21 @@ const makeHarness = Effect.fn("makeAuthTestHarness")(function* (
             yield* Deferred.succeed(closed, undefined);
           }),
         );
+        // Like AcpSessionRuntime, `start` reuses one memoized initialize handshake.
+        const initialize = yield* Effect.cached(
+          Effect.gen(function* () {
+            events.push("initialize");
+            yield* options.beforeInitialize ?? Effect.void;
+            return options.supportsLogout === false
+              ? { ...initialized, agentCapabilities: {} }
+              : initialized;
+          }),
+        );
         return {
-          initialize: () =>
-            Effect.gen(function* () {
-              events.push("initialize");
-              yield* options.beforeInitialize ?? Effect.void;
-              return options.supportsLogout === false
-                ? { ...initialized, agentCapabilities: {} }
-                : initialized;
-            }),
+          initialize: () => initialize,
           start: () =>
             Effect.gen(function* () {
+              yield* initialize;
               events.push("authenticate");
               yield* Deferred.succeed(authenticateCalled, undefined);
               if (options.interactive !== false && input.onAuthorizationUrl) {
@@ -280,6 +284,42 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("AntigravityAuth"
     }),
   );
 
+  it.effect("does not blame the network while the runtime is still starting", () =>
+    Effect.gen(function* () {
+      const initializing = yield* Deferred.make<void>();
+      const ready = yield* Deferred.make<void>();
+      const harness = yield* makeHarness({
+        interactive: false,
+        beforeInitialize: Deferred.succeed(initializing, undefined).pipe(
+          Effect.andThen(Deferred.await(ready)),
+        ),
+      });
+      const hasHint = harness.auth.controller.subscribe(owner).pipe(
+        Stream.runHead,
+        Effect.map((state) => Option.getOrThrow(state).message?.includes("Broken IPv6") === true),
+      );
+      yield* harness.auth.controller.start(owner);
+      yield* Deferred.await(initializing);
+
+      // A one-file runtime can take about a minute to unpack before it answers initialize.
+      yield* TestClock.adjust("60 seconds");
+      assert.isFalse(yield* hasHint);
+
+      yield* Deferred.succeed(ready, undefined);
+      yield* Deferred.await(harness.authenticateCalled);
+      yield* TestClock.adjust("29 seconds");
+      assert.isFalse(yield* hasHint);
+
+      yield* TestClock.adjust("1 second");
+      const stalled = yield* harness.auth.controller.subscribe(owner).pipe(
+        Stream.filter((state) => state.message?.includes("Broken IPv6") === true),
+        Stream.runHead,
+        Effect.map(Option.getOrThrow),
+      );
+      assert.equal(stalled.phase, "starting");
+    }),
+  );
+
   it.effect("keeps the expired message once the Google link was shown", () =>
     Effect.gen(function* () {
       const harness = yield* makeHarness();
@@ -385,7 +425,7 @@ it.layer(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))("AntigravityAuth"
       assert.isTrue(Exit.isFailure(competing));
       const resumed = yield* phase(harness.auth, "waiting");
       assert.equal(resumed.flowId, first.flowId);
-      assert.deepEqual(harness.events, ["process-open", "authenticate"]);
+      assert.deepEqual(harness.events, ["process-open", "initialize", "authenticate"]);
       yield* harness.auth.controller.cancel(owner, first.flowId!);
     }),
   );
diff --git a/apps/server/src/provider/AntigravityAuth.ts b/apps/server/src/provider/AntigravityAuth.ts
index 7f19bd3a9b077..d1ebb7d53954f 100644
--- a/apps/server/src/provider/AntigravityAuth.ts
+++ b/apps/server/src/provider/AntigravityAuth.ts
@@ -31,8 +31,10 @@ import {
 import type { ProviderAuthController } from "./ProviderAuthService.ts";
 
 const AUTH_TIMEOUT_MS = 300_000;
-// A healthy agent shows the Google link or finishes within seconds. Its bundled Python has no
-// IPv4 fallback race, so a host with broken IPv6 waits about two minutes per Google request.
+// Once initialized, a healthy agent shows the Google link or finishes within seconds. Its bundled
+// Python has no IPv4 fallback race, so a host with broken IPv6 waits about two minutes per Google
+// request. The hint is timed from initialize, not spawn: the one-file runtime unpacks itself on
+// every launch, which can take about a minute on Windows before it answers at all.
 const NO_RESPONSE_HINT_MS = 30_000;
 const NO_RESPONSE_MESSAGE =
   "Antigravity has not reached Google after 30 seconds. Check this machine's network connection. Broken IPv6 is a common cause.";
@@ -271,6 +273,11 @@ export const makeAntigravityAuth = Effect.fn("makeAntigravityAuth")(function* <
   const runSignIn = Effect.fn("AntigravityAuth.runSignIn")(
     function* (flow: AuthFlow, stopSessions: Effect.Effect<void, ProviderSetupError>) {
       yield* stopSessions.pipe(Effect.ensuring(stopOwnedProcesses));
+      const runtime = yield* options.makeRuntime({
+        onAuthorizationUrl: (url) => receiveAuthorizationUrl(flow, url),
+      });
+      // `start` reuses this memoized handshake.
+      yield* runtime.initialize();
       yield* Effect.sleep(NO_RESPONSE_HINT_MS).pipe(
         Effect.andThen(
           lock.withPermits(1)(
@@ -282,9 +289,6 @@ export const makeAntigravityAuth = Effect.fn("makeAntigravityAuth")(function* <
         ),
         Effect.forkScoped,
       );
-      const runtime = yield* options.makeRuntime({
-        onAuthorizationUrl: (url) => receiveAuthorizationUrl(flow, url),
-      });
       const started = yield* runtime.start();
       yield* lock.withPermits(1)(
         Effect.gen(function* () {

From 4a23e9e1bf126e858037060996f5278e2ecddaa9 Mon Sep 17 00:00:00 2001
From: domvox <126301539+domvox@users.noreply.github.com>
Date: Wed, 4 Nov 2026 00:46:18 +0100
Subject: [PATCH 158/167] fix(relay): read migrations in checkout paths with
 spaces (#30080)

Co-authored-by: Dominik <git@domko.sbs>
---
 infra/relay/src/environments/ManagedTunnelLimits.test.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/infra/relay/src/environments/ManagedTunnelLimits.test.ts b/infra/relay/src/environments/ManagedTunnelLimits.test.ts
index 6b8dd817ee01c..4842d019eb23c 100644
--- a/infra/relay/src/environments/ManagedTunnelLimits.test.ts
+++ b/infra/relay/src/environments/ManagedTunnelLimits.test.ts
@@ -4,6 +4,7 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
 import * as Semaphore from "effect/Semaphore";
 import { PGlite } from "@electric-sql/pglite";
 import { drizzle } from "drizzle-orm/pglite";
@@ -187,7 +188,10 @@ describe("ManagedTunnelLimits", () => {
         Effect.promise(() => PGlite.create()),
         (client) => Effect.promise(() => client.close()),
       );
-      const migrationsDir = new URL("../../migrations/postgres/", import.meta.url).pathname;
+      const path = yield* Path.Path;
+      const migrationsDir = yield* path.fromFileUrl(
+        new URL("../../migrations/postgres/", import.meta.url),
+      );
       const migrations = (yield* fs.readDirectory(migrationsDir)).toSorted();
       const applyMigrations = (names: ReadonlyArray<string>) =>
         Effect.forEach(names, (name) =>

From bf046e3456d36055c6d3ade885bbbf708d4520d3 Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 4 Nov 2026 05:16:33 +0530
Subject: [PATCH 159/167] fix(cli): validate npm runtime before caching it
 (#30099)

---
 scripts/build-npm-launcher.test.ts | 111 +++++++++++++++++++++++++----
 scripts/npm-launcher/t3.mjs        |  29 +++++++-
 2 files changed, 125 insertions(+), 15 deletions(-)

diff --git a/scripts/build-npm-launcher.test.ts b/scripts/build-npm-launcher.test.ts
index 4c7edd4763359..fd241e7543bae 100644
--- a/scripts/build-npm-launcher.test.ts
+++ b/scripts/build-npm-launcher.test.ts
@@ -47,7 +47,15 @@ const run = Effect.fn("test.run")(function* (
   return { stdout, stderr, exitCode };
 }, Effect.scoped);
 
-const serveFakeRelease = Effect.fn("test.serveFakeRelease")(function* (root: string) {
+const serveFakeRelease = Effect.fn("test.serveFakeRelease")(function* (
+  root: string,
+  executable = `#!/bin/sh
+if [ -n "$T3CODE_TEST_CALLS" ]; then echo "$*|$T3CODE_NPM_LAUNCHER_PATH" >> "$T3CODE_TEST_CALLS"; fi
+if [ "$1" = "--version" ]; then echo "${VERSION}"; exit 0; fi
+echo "stub $* launcher=$T3CODE_NPM_LAUNCHER_PATH"
+exit 7
+`,
+) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const key = `${yield* HostProcess.Platform}-${yield* HostProcess.Architecture}`;
@@ -56,10 +64,7 @@ const serveFakeRelease = Effect.fn("test.serveFakeRelease")(function* (root: str
   yield* fs.makeDirectory(path.join(root, "release", stem, "node_modules/native"), {
     recursive: true,
   });
-  yield* fs.writeFileString(
-    path.join(root, "release", stem, "t3"),
-    '#!/bin/sh\necho "stub $* launcher=$T3CODE_NPM_LAUNCHER_PATH"\nexit 7\n',
-  );
+  yield* fs.writeFileString(path.join(root, "release", stem, "t3"), executable);
   yield* fs.chmod(path.join(root, "release", stem, "t3"), 0o755);
   const tar = yield* run("tar", ["-czf", archiveName, stem], {
     cwd: path.join(root, "release"),
@@ -136,6 +141,7 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
         const env = {
           PATH: process.env.PATH,
           T3CODE_HOME: home,
+          T3CODE_TEST_CALLS: path.join(root, "calls"),
           T3CODE_RELEASE_BASE_URL: release.baseUrl,
         };
         const launcher = path.join(packageDir, "bin/t3.mjs");
@@ -145,6 +151,10 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
         });
         assert.equal(first.stdout.trim(), `stub serve a b launcher=${launcher}`, first.stderr);
         assert.equal(first.exitCode, 7);
+        assert.deepStrictEqual(
+          (yield* fs.readFileString(env.T3CODE_TEST_CALLS)).trim().split("\n"),
+          ["--version|", `serve a b|${launcher}`],
+        );
         const versionDir = path.join(home, "runtime/versions", VERSION);
         assert.equal(
           (yield* fs.readFileString(path.join(versionDir, ".install-complete"))).trim(),
@@ -158,8 +168,24 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
 
         const requestsAfterFirst = release.requests.length;
         const second = yield* run(process.execPath, [launcher, "--version"], { cwd: root, env });
-        assert.equal(second.exitCode, 7);
+        assert.equal(second.exitCode, 0);
         assert.equal(release.requests.length, requestsAfterFirst);
+        assert.deepStrictEqual(
+          (yield* fs.readFileString(env.T3CODE_TEST_CALLS)).trim().split("\n"),
+          ["--version|", `serve a b|${launcher}`, `--version|${launcher}`],
+        );
+
+        yield* fs.writeFileString(path.join(versionDir, "t3"), "#!/t3-test-missing-loader\n");
+        for (const _attempt of [1, 2]) {
+          const cached = yield* run(process.execPath, [launcher, "serve"], { cwd: root, env });
+          assert.equal(cached.exitCode, 1, cached.stderr);
+          assert.include(cached.stderr, "could not run");
+          assert.equal(release.requests.length, requestsAfterFirst);
+          assert.equal(
+            yield* fs.readFileString(path.join(versionDir, ".install-complete")),
+            `${VERSION}\n`,
+          );
+        }
 
         const ipcServer = path.join(home, "runtime/versions", VERSION, "t3");
         yield* fs.writeFileString(
@@ -189,8 +215,8 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
           env: { ...env, T3CODE_HOME: raceHome },
         });
         const [one, two] = yield* Effect.all([launch, launch], { concurrency: "unbounded" });
-        assert.equal(one.exitCode, 7, one.stderr);
-        assert.equal(two.exitCode, 7, two.stderr);
+        assert.equal(one.exitCode, 0, one.stderr);
+        assert.equal(two.exitCode, 0, two.stderr);
         assert.deepStrictEqual(yield* fs.readDirectory(path.join(raceHome, "runtime/versions")), [
           VERSION,
         ]);
@@ -296,12 +322,8 @@ fs.readFileSync = (file, ...rest) => {
           cwd: root,
           env: { ...env, T3CODE_HOME: staleOnlyHome },
         });
-        assert.equal(
-          replaced.stdout.trim(),
-          `stub --version launcher=${launcher}`,
-          replaced.stderr,
-        );
-        assert.equal(replaced.exitCode, 7);
+        assert.equal(replaced.stdout.trim(), VERSION, replaced.stderr);
+        assert.equal(replaced.exitCode, 0);
         assert.deepStrictEqual(
           yield* fs.readDirectory(path.join(staleOnlyHome, "runtime/versions")),
           [VERSION],
@@ -320,4 +342,65 @@ fs.readFileSync = (file, ...rest) => {
         );
       }),
   );
+  it.effect.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+    "does not publish an unusable release",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        for (const executable of [
+          "#!/t3-test-missing-loader\n",
+          '#!/bin/sh\necho "runtime loader failed" >&2\nexit 42\n',
+          "#!/bin/sh\nkill -TERM $$\n",
+          '#!/bin/sh\ntrap \'echo caught > "$T3CODE_TEST_TERM"; exit 42\' TERM\necho ready > "$T3CODE_TEST_READY"\nwhile :; do :; done\n',
+        ]) {
+          const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-npm-validation-test-" });
+          const output = yield* buildNpmLauncher({
+            version: VERSION,
+            outputDir: path.join(root, "out"),
+          });
+          const release = yield* serveFakeRelease(root, executable);
+          const home = path.join(root, "home");
+          const dir = path.join(home, "runtime/versions", VERSION);
+          const probeTimeoutHook = path.join(root, "probe-timeout.mjs");
+          yield* fs.writeFileString(
+            probeTimeoutHook,
+            `import childProcess from "node:child_process";
+import { syncBuiltinESMExports } from "node:module";
+const { spawnSync } = childProcess;
+childProcess.spawnSync = (command, args, options) => spawnSync(command, args,
+  options?.timeout === undefined ? options : { ...options, timeout: 500 });
+syncBuiltinESMExports();
+`,
+          );
+          const env = {
+            PATH: process.env.PATH,
+            T3CODE_HOME: home,
+            T3CODE_RELEASE_BASE_URL: release.baseUrl,
+            T3CODE_TEST_READY: path.join(root, "probe-ready"),
+            T3CODE_TEST_TERM: path.join(root, "probe-term"),
+          };
+          const launcher = path.join(output.packageDir, "bin/t3.mjs");
+          const failed = yield* run(
+            process.execPath,
+            ["--import", probeTimeoutHook, launcher, "serve"],
+            { cwd: root, env },
+          );
+          assert.equal(failed.exitCode, 1, failed.stderr);
+          assert.deepStrictEqual(yield* fs.readDirectory(path.dirname(dir)), [], failed.stderr);
+          assert.include(failed.stderr, "could not run");
+          if (executable.includes("runtime loader failed")) {
+            assert.include(failed.stderr, "runtime loader failed");
+          }
+          if (executable.includes("trap")) {
+            assert.isTrue(yield* fs.exists(env.T3CODE_TEST_READY));
+            assert.isFalse(yield* fs.exists(env.T3CODE_TEST_TERM));
+          }
+          if ((yield* HostProcess.Platform) === "linux") {
+            assert.include(failed.stderr, "glibc");
+            assert.include(failed.stderr, "musl");
+          }
+        }
+      }),
+  );
 });
diff --git a/scripts/npm-launcher/t3.mjs b/scripts/npm-launcher/t3.mjs
index f8828210862e3..207814ba9d311 100644
--- a/scripts/npm-launcher/t3.mjs
+++ b/scripts/npm-launcher/t3.mjs
@@ -90,6 +90,24 @@ async function install(dir, key) {
     });
     if (extract.status !== 0) throw new Error(`could not extract ${archive}`);
     fs.rmSync(file);
+    const validate = spawnSync(
+      path.join(staging, process.platform === "win32" ? "t3.exe" : "t3"),
+      ["--version"],
+      {
+        stdio: ["ignore", "ignore", "pipe"],
+        encoding: "utf8",
+        timeout: 30_000,
+        killSignal: "SIGKILL",
+      },
+    );
+    if (validate.status !== 0) {
+      throw executableError(
+        key,
+        validate.error?.message ||
+          validate.stderr?.trim() ||
+          `--version exited with ${validate.signal || validate.status}`,
+      );
+    }
     fs.writeFileSync(path.join(staging, ".install-complete"), `${version}\n`);
     publish(staging, dir);
   } finally {
@@ -172,12 +190,21 @@ async function main() {
   for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
     process.on(signal, () => (ipc || signal !== "SIGINT") && child.kill(signal));
   }
-  child.on("error", (error) => fail(error));
+  child.on("error", (error) => fail(executableError(key, error.message)));
   child.on("exit", (code, signal) =>
     process.exit(code ?? 128 + (os.constants.signals[signal] || 1)),
   );
 }
 
+function executableError(key, detail) {
+  return new Error(
+    `could not run T3 Code ${version} for ${key}: ${detail}` +
+      (process.platform === "linux"
+        ? "\nThe Linux release requires glibc; musl-based systems such as Alpine are not supported. Use a glibc-based Linux environment."
+        : ""),
+  );
+}
+
 function fail(error) {
   process.stderr.write(`t3: ${error.message}\n`);
   process.exit(1);

From b9d7239dcb42e1dea14620381c180182de52921c Mon Sep 17 00:00:00 2001
From: gyurix <barathgy@gmail.com>
Date: Wed, 4 Nov 2026 00:46:50 +0100
Subject: [PATCH 160/167] fix(server): SSH device host no longer reconnects on
 a single slow health probe (#30159)

---
 apps/server/src/device/SshDeviceHost.test.ts | 77 ++++++++++++++++++++
 apps/server/src/device/SshDeviceHost.ts      |  8 +-
 2 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/device/SshDeviceHost.test.ts b/apps/server/src/device/SshDeviceHost.test.ts
index 80b669732eb37..6600425331c8f 100644
--- a/apps/server/src/device/SshDeviceHost.test.ts
+++ b/apps/server/src/device/SshDeviceHost.test.ts
@@ -11,6 +11,7 @@ import * as Stream from "effect/Stream";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as TestClock from "effect/testing/TestClock";
 import * as ServerConfig from "../config.ts";
 import * as DeviceHost from "./DeviceHost.ts";
 import * as SshDeviceHost from "./SshDeviceHost.ts";
@@ -309,3 +310,79 @@ it.effect("lists Android devices without probing the host again once it reports
     yield* host.stop;
   }).pipe(Effect.scoped, Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))),
 );
+
+it.effect(
+  "keeps the SSH forward through slow health probes and reconnects once the hub stays down",
+  () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const home = yield* fs.makeTempDirectoryScoped();
+      let forwardSpawns = 0;
+      let hubAnswers = true;
+      const spawner = ChildProcessSpawner.make((command) =>
+        Effect.gen(function* () {
+          if (command._tag !== "StandardCommand") return yield* Effect.die("Unexpected command");
+          const forwarding = command.args.includes("-L");
+          // A fresh forward reaches a working hub again.
+          if (forwarding && ++forwardSpawns > 1) hubAnswers = true;
+          const output = JSON.stringify({
+            nodePath: "/node",
+            platforms: [{ platform: "ios", available: true }],
+            hubPort: 1234,
+            helpers: { serveSimAxSettings: null, serveSimCli: null },
+          });
+          return ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(123),
+            stdout: Stream.make(new TextEncoder().encode(output)),
+            stderr: Stream.empty,
+            all: Stream.empty,
+            exitCode: forwarding ? Effect.never : Effect.succeed(ChildProcessSpawner.ExitCode(0)),
+            isRunning: Effect.succeed(forwarding),
+            kill: () => Effect.void,
+            stdin: Sink.drain,
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+            unref: Effect.succeed(Effect.void),
+          });
+        }),
+      );
+      const host = yield* SshDeviceHost.make({
+        kind: "ssh",
+        id: "test",
+        label: "Test",
+        target: "test.example",
+      }).pipe(
+        Effect.provide(Layer.mergeAll(ServerConfig.layerTest(home, home), Net.layer)),
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+        Effect.provideService(
+          HttpClient.HttpClient,
+          HttpClient.make((request) =>
+            hubAnswers
+              ? Effect.succeed(HttpClientResponse.fromWeb(request, new Response("ok")))
+              : Effect.never,
+          ),
+        ),
+      );
+      yield* host.ensureReady(() => Effect.void);
+      expect(forwardSpawns).toBe(1);
+
+      // A loaded host can miss a probe or two without being gone; the forward stays up.
+      hubAnswers = false;
+      yield* TestClock.adjust("30 seconds");
+      hubAnswers = true;
+      yield* TestClock.adjust("2 minutes");
+      expect(forwardSpawns).toBe(1);
+
+      // A hub that keeps missing probes is still replaced.
+      hubAnswers = false;
+      // Recovery reset the miss count, so two new misses do not reconnect yet.
+      yield* TestClock.adjust("30 seconds");
+      expect(forwardSpawns).toBe(1);
+      yield* TestClock.adjust("30 seconds");
+      expect(forwardSpawns).toBe(2);
+      yield* host.stop;
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer, TestClock.layer())),
+    ),
+);
diff --git a/apps/server/src/device/SshDeviceHost.ts b/apps/server/src/device/SshDeviceHost.ts
index 789b700308b8d..ef051cb90756c 100644
--- a/apps/server/src/device/SshDeviceHost.ts
+++ b/apps/server/src/device/SshDeviceHost.ts
@@ -27,6 +27,8 @@ import * as DeviceHost from "./DeviceHost.ts";
 import { makeDeviceHubOperations } from "./DeviceHubOperations.ts";
 import { quoteRemoteArg, remoteDeviceEnvironment, remoteDeviceScript } from "./sshDeviceScript.ts";
 
+const UNHEALTHY_PROBE_LIMIT = 3;
+
 const Probe = Schema.Struct({
   nodePath: Schema.String,
   tools: Schema.optional(DeviceToolVersions),
@@ -365,7 +367,10 @@ export const make = Effect.fn("SshDeviceHost.make")(function* (
       : next;
     yield* onStatus("ready");
     // Reconnect also repairs helpers that died while SSH itself stayed connected.
+    // A loaded host can miss a probe or two while still working, and reconnecting
+    // then drops the forward in use, so only consecutive misses count.
     const unhealthy = Effect.gen(function* () {
+      let misses = 0;
       while (true) {
         yield* Effect.sleep("10 seconds");
         const alive = yield* http.get(`${next.hub.origin}/readyz`).pipe(
@@ -380,7 +385,8 @@ export const make = Effect.fn("SshDeviceHost.make")(function* (
               Effect.orElseSucceed(() => false),
             )
           : true;
-        if (!alive || !daemonAlive) return;
+        misses = alive && daemonAlive ? 0 : misses + 1;
+        if (misses >= UNHEALTHY_PROBE_LIMIT) return;
       }
     });
     yield* Effect.gen(function* () {

From 8bc344bd9c311de4b8cab9e0e5d9db8f2d963502 Mon Sep 17 00:00:00 2001
From: Harjot Singh <42799925+imharjot@users.noreply.github.com>
Date: Wed, 4 Nov 2026 05:17:07 +0530
Subject: [PATCH 161/167] fix(server): read continued core.bare values during
 onboarding (#30174)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/shared/src/git.test.ts | 10 ++++++++++
 packages/shared/src/git.ts      | 25 ++++++++++++++++++++++++-
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/packages/shared/src/git.test.ts b/packages/shared/src/git.test.ts
index ede9f059c578c..a788abb1d1d7e 100644
--- a/packages/shared/src/git.test.ts
+++ b/packages/shared/src/git.test.ts
@@ -7,6 +7,7 @@ import {
   formatGeneratedBranchName,
   buildTemporaryWorktreeBranchName,
   flattenTemporaryWorktreeBranchName,
+  isBareGitConfig,
   isTemporaryWorktreeBranch,
   normalizeGitRemoteUrl,
   parseOriginUrlFromGitConfig,
@@ -64,6 +65,15 @@ describe("normalizeGitRemoteUrl", () => {
   });
 });
 
+describe("isBareGitConfig", () => {
+  it("reads continued bare values after comments and at end of input", () => {
+    const config = ["[core] bare = false # ignored backslash \\", 'bare = "tr\\', 'ue"'].join("\n");
+
+    expect(isBareGitConfig(config)).toBe(true);
+    expect(isBareGitConfig("[core]\nbare = tr\\\nue\\")).toBe(true);
+  });
+});
+
 describe("parseOriginUrlFromGitConfig", () => {
   it("reads the origin url and ignores other remotes", () => {
     const config = [
diff --git a/packages/shared/src/git.ts b/packages/shared/src/git.ts
index 4ac89394c213f..ba7c9f0a97b70 100644
--- a/packages/shared/src/git.ts
+++ b/packages/shared/src/git.ts
@@ -170,6 +170,29 @@ export function normalizeGitRemoteUrl(value: string): string {
   return repository === null ? lowerCaseRemote(value) : `${repository.host}/${repository.path}`;
 }
 
+function* gitConfigLines(configText: string) {
+  let pending = "";
+  let quoted = false;
+  for (const line of configText.split(/\r?\n/)) {
+    let continued = false;
+    if (line.endsWith("\\")) {
+      for (const [token] of line.matchAll(/\\[\s\S]?|["#;]/g)) {
+        if (token === '"') quoted = !quoted;
+        else if (!quoted && (token === "#" || token === ";")) break;
+        else if (token === "\\") continued = true;
+      }
+    }
+    if (continued) {
+      pending += line.slice(0, -1);
+      continue;
+    }
+    yield pending + line;
+    pending = "";
+    quoted = false;
+  }
+  if (pending.length > 0) yield pending;
+}
+
 function parseGitConfigValue(raw: string): string {
   let out = "";
   let quoted = false;
@@ -193,7 +216,7 @@ function parseGitConfigValue(raw: string): string {
 export function isBareGitConfig(configText: string): boolean {
   let inCore = false;
   let bare = false;
-  for (const rawLine of configText.split(/\r?\n/)) {
+  for (const rawLine of gitConfigLines(configText)) {
     let line = rawLine.trim();
     // Git accepts the first setting on the section header's own line.
     const header = /^\[\s*([^\]]*?)\s*\](.*)$/.exec(line);

From 6ea23bd4264e77442d2e29ffeab4d9c550559c7a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:47:25 +0000
Subject: [PATCH 162/167] fix(server): published repos fall back to HTTPS when
 SSH is refused (#30142)

Co-authored-by: SAPHID <saphid@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../SourceControlRepositoryService.test.ts    | 46 ++++++++++++++++
 .../SourceControlRepositoryService.ts         | 52 +++++++++++++------
 2 files changed, 83 insertions(+), 15 deletions(-)

diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
index dedf3636df4ec..326b7931da292 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
@@ -648,6 +648,52 @@ it.effect("explains a rejected SSH push after creating the repository", () =>
   }).pipe(Effect.provide(layer({ git: failingPush("authentication_failed") }))),
 );
 
+// regression: an auto-selected SSH remote kept failing every later fetch after a refused push
+it.effect("switches an auto-selected remote to HTTPS when the SSH push is refused", () => {
+  const gitArgs: Array<ReadonlyArray<string>> = [];
+  let pushAttempts = 0;
+  return Effect.gen(function* () {
+    const service = yield* SourceControlRepositoryService.SourceControlRepositoryService;
+    const result = yield* service.publishRepository({
+      cwd: "/workspace",
+      provider: SourceControlProviderKind.make("github"),
+      repository: "octocat/t3code",
+      visibility: "private",
+    });
+
+    assert.strictEqual(result.status, "pushed");
+    assert.strictEqual(result.remoteUrl, CLONE_URLS.url);
+    assert.strictEqual(pushAttempts, 2);
+    assert.deepStrictEqual(gitArgs, [
+      ["rev-parse", "--verify", "HEAD"],
+      ["remote", "set-url", "origin", CLONE_URLS.url],
+    ]);
+  }).pipe(
+    Effect.provide(
+      layer({
+        git: {
+          execute: (input) =>
+            Effect.sync(() => {
+              gitArgs.push(input.args);
+              return processOutput();
+            }),
+          pushCurrentBranch: (cwd) => {
+            pushAttempts += 1;
+            return pushAttempts === 1
+              ? failingPush("authentication_failed").pushCurrentBranch(cwd)
+              : Effect.succeed({
+                  status: "pushed" as const,
+                  branch: "main",
+                  upstreamBranch: "origin/main",
+                  setUpstream: true,
+                });
+          },
+        },
+      }),
+    ),
+  );
+});
+
 // regression: #19219 publishing did not explain why the first push failed
 it.effect("says the repository exists when an unclassified publish push fails", () =>
   Effect.gen(function* () {
diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
index 1e9c48893dad7..64242b72d4d58 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
@@ -502,28 +502,50 @@ export const make = Effect.gen(function* () {
         };
       }
 
-      const pushResult = yield* git.pushCurrentBranch(input.cwd, null, { remoteName }).pipe(
-        Effect.mapError(
-          (cause) =>
-            new SourceControlRepositoryError({
-              operation: "publishRepository",
-              provider: providerKind,
-              detail: publishPushFailureDetail({
-                urls,
-                remoteName,
-                remoteUrl,
-                reason: cause.reason,
+      const push = (pushUrl: string) =>
+        git.pushCurrentBranch(input.cwd, null, { remoteName }).pipe(
+          Effect.map((result) => ({ branch: result.branch, remoteUrl: pushUrl })),
+          Effect.mapError(
+            (cause) =>
+              new SourceControlRepositoryError({
+                operation: "publishRepository",
+                provider: providerKind,
+                detail: publishPushFailureDetail({
+                  urls,
+                  remoteName,
+                  remoteUrl: pushUrl,
+                  reason: cause.reason,
+                }),
+                cause,
               }),
-              cause,
-            }),
+          ),
+        );
+
+      // Like clone, an auto-selected SSH remote switches to HTTPS when SSH is refused;
+      // otherwise the remote keeps failing every later fetch and push.
+      const canSwitchToHttps = input.protocol !== "ssh" && remoteUrl === urls.sshUrl;
+      const pushed = yield* push(remoteUrl).pipe(
+        Effect.catchIf(
+          (error) => canSwitchToHttps && isSshRejection(error),
+          (sshError) =>
+            git
+              .execute({
+                operation: "SourceControlRepositoryService.publishRepository.switchToHttps",
+                cwd: input.cwd,
+                args: ["remote", "set-url", remoteName, urls.url],
+              })
+              .pipe(
+                Effect.mapError(() => sshError),
+                Effect.andThen(push(urls.url)),
+              ),
         ),
       );
 
       return {
         repository: toRepositoryInfo(providerKind, urls),
         remoteName,
-        remoteUrl,
-        branch: pushResult.branch,
+        remoteUrl: pushed.remoteUrl,
+        branch: pushed.branch,
         status: "pushed" as const,
       };
     },

From 5ad00e9a0ab7a9bb204ec56aab1d812a1ac9266e Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Wed, 4 Nov 2026 05:17:43 +0530
Subject: [PATCH 163/167] fix(opencode): fail stalled event subscriptions
 promptly (#30201)

---
 .../src/server/v2/OpenCode2Client.test.ts     | 34 +++++++++++++++++++
 .../src/server/v2/OpenCode2Client.ts          |  5 ++-
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/packages/provider-opencode/src/server/v2/OpenCode2Client.test.ts b/packages/provider-opencode/src/server/v2/OpenCode2Client.test.ts
index cf99beeecb256..5ce763e024b86 100644
--- a/packages/provider-opencode/src/server/v2/OpenCode2Client.test.ts
+++ b/packages/provider-opencode/src/server/v2/OpenCode2Client.test.ts
@@ -1,9 +1,13 @@
 import { assert, it } from "@effect/vitest";
 import { Session } from "@opencode/client/effect";
+import * as Cause from "effect/Cause";
+import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Redacted from "effect/Redacted";
 import * as Schema from "effect/Schema";
+import * as TestClock from "effect/testing/TestClock";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import { describe } from "vite-plus/test";
@@ -48,6 +52,36 @@ describe("OpenCode2Client authorization", () => {
   );
 });
 
+describe("OpenCode2Client event subscription", () => {
+  it.effect("times out and cancels a subscription with no response headers", () =>
+    Effect.gen(function* () {
+      const cancelled = yield* Deferred.make<void>();
+      const transport = Layer.succeed(
+        HttpClient.HttpClient,
+        HttpClient.make((request) => {
+          assert.strictEqual(request.url, "http://127.0.0.1:4096/api/event");
+          return Effect.never.pipe(Effect.ensuring(Deferred.succeed(cancelled, undefined)));
+        }),
+      );
+      const opencode = yield* OpenCode2Client.OpenCode2Client.pipe(
+        Effect.provide(OpenCode2Client.layer.pipe(Layer.provide(transport))),
+      );
+      const { events } = yield* opencode.connect({
+        baseUrl: "http://127.0.0.1:4096",
+        password: "test-password",
+      });
+      const opening = yield* events.pipe(Effect.flip, Effect.forkScoped);
+
+      yield* TestClock.adjust("10 seconds");
+      assert.isTrue(yield* Deferred.isDone(cancelled));
+      const error = yield* Fiber.join(opening);
+      assert.strictEqual(error._tag, "HttpClientError");
+      assert.strictEqual(error.reason._tag, "TransportError");
+      assert.isTrue(Cause.isTimeoutError(error.cause));
+    }).pipe(Effect.scoped),
+  );
+});
+
 const previous = {
   id: "msg_repro088",
   type: "synthetic",
diff --git a/packages/provider-opencode/src/server/v2/OpenCode2Client.ts b/packages/provider-opencode/src/server/v2/OpenCode2Client.ts
index dc7de72ae13f9..71fb1d70ce7d4 100644
--- a/packages/provider-opencode/src/server/v2/OpenCode2Client.ts
+++ b/packages/provider-opencode/src/server/v2/OpenCode2Client.ts
@@ -74,6 +74,7 @@ export class OpenCode2Client extends Context.Service<
 
 // Heartbeats arrive every 10-15 seconds; longer silence means stuck, not idle.
 const SILENT_STREAM_TIMEOUT = "45 seconds";
+const SUBSCRIPTION_TIMEOUT = "10 seconds";
 
 const decodeEvent = Schema.decodeUnknownResult(Schema.fromJsonString(OpenCodeEvent));
 const decodeEnvelope = Schema.decodeUnknownOption(
@@ -214,7 +215,9 @@ export const make = Effect.gen(function* () {
           events: readEvents.pipe(
             Effect.provideService(
               HttpClient.HttpClient,
-              HttpClient.mapRequest(authenticated, HttpClientRequest.prependUrl(baseUrl)),
+              HttpClient.mapRequest(authenticated, HttpClientRequest.prependUrl(baseUrl)).pipe(
+                HttpClient.timeout(SUBSCRIPTION_TIMEOUT),
+              ),
             ),
           ),
         })),

From c60950044a1ee19b651087fb0979422fa3b4298a Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:48:26 +0000
Subject: [PATCH 164/167] fix(server): a link card the user moved past no
 longer blocks auto-settle (#29847)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/orchestration-v2/ProjectionStore.ts | 10 ++++++++++
 apps/server/src/peer/PeerLinkRequests.test.ts       |  3 +++
 2 files changed, 13 insertions(+)

diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index f6be46d28ae67..9696286f7b42e 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -6496,6 +6496,16 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
                   INDEXED BY orchestration_v2_projection_turn_items_waiting_link_idx
                 WHERE link.thread_id = t.thread_id
                   AND link.type = 'link_request' AND link.status = 'waiting'
+                  -- linkCardStillAsks: once the user writes after the card, it stops asking.
+                  AND NOT EXISTS (
+                    SELECT 1 FROM orchestration_v2_projection_messages message
+                    WHERE message.thread_id = t.thread_id AND message.role = 'user'
+                      AND json_extract(message.payload_json, '$.createdBy') = 'user'
+                      AND NOT ${isIdleCompactionMessage("message")}
+                      AND message.updated_at > COALESCE(
+                        json_extract(link.payload_json, '$.startedAt'), link.updated_at
+                      )
+                  )
               )
             ORDER BY t.updated_at ASC, t.thread_id ASC
           `;
diff --git a/apps/server/src/peer/PeerLinkRequests.test.ts b/apps/server/src/peer/PeerLinkRequests.test.ts
index ccc7a8d8bd0eb..c3ca78cbcb6a7 100644
--- a/apps/server/src/peer/PeerLinkRequests.test.ts
+++ b/apps/server/src/peer/PeerLinkRequests.test.ts
@@ -528,6 +528,9 @@ it.live("the agent asks without waiting, and the user links the box after its tu
           yield* a.orchestrator.getThreadProjection(threadId),
         ).pendingRuntimeRequest,
       ).toBeNull();
+      expect(
+        (yield* a.projections.getSettlementCandidates(threadId)).map((thread) => thread.id),
+      ).toEqual([threadId]);
       expect(yield* cardOf(a)).toMatchObject({ status: "waiting", linkStatus: "pending" });
 
       // The user's client mints a code on the box and picks more than the agent suggested.

From 2863eded441c2bae96cf7c7aa30ce25083c4e645 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:48:43 +0000
Subject: [PATCH 165/167] fix(server): deleting a thread also removes its agent
 preview recordings (#29853)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/attachmentStore.ts            | 10 ++++++++--
 .../src/orchestration-v2/ProjectionStore.ts   |  3 ++-
 .../orchestration-v2/TurnStartReads.test.ts   | 19 +++++++++++++++++++
 packages/shared/src/toolOutput.ts             | 15 +++++++++++++++
 4 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/attachmentStore.ts b/apps/server/src/attachmentStore.ts
index 616b0d90c17b2..a2b531e3fa5b0 100644
--- a/apps/server/src/attachmentStore.ts
+++ b/apps/server/src/attachmentStore.ts
@@ -4,7 +4,11 @@ import * as NodeFS from "node:fs";
 import * as NodePath from "node:path";
 
 import type { ChatAttachment } from "@t3tools/contracts";
-import { htmlRenderFromToolItem, mcpAppFromToolItem } from "@t3tools/shared/toolOutput";
+import {
+  htmlRenderFromToolItem,
+  mcpAppFromToolItem,
+  previewRecordingIdFromToolItem,
+} from "@t3tools/shared/toolOutput";
 
 import {
   normalizeAttachmentRelativePath,
@@ -133,7 +137,9 @@ export function threadHtmlRenderAttachmentIds(
   if (segment === null) return [];
   return Array.from(items).flatMap((item) => {
     const attachmentId =
-      htmlRenderFromToolItem(item)?.attachmentId ?? mcpAppFromToolItem(item)?.attachmentId;
+      htmlRenderFromToolItem(item)?.attachmentId ??
+      mcpAppFromToolItem(item)?.attachmentId ??
+      previewRecordingIdFromToolItem(item);
     return attachmentId !== undefined &&
       parseThreadSegmentFromAttachmentId(attachmentId) === segment
       ? [attachmentId]
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 9696286f7b42e..a46c8017731d5 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -5504,7 +5504,8 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       FROM orchestration_v2_projection_turn_items
       WHERE thread_id = ${threadId}
         AND type = 'dynamic_tool'
-        AND (payload_json LIKE '%htmlRender%' OR payload_json LIKE ${`%${MCP_APP_OUTPUT_KEY}%`})
+        AND (payload_json LIKE '%htmlRender%' OR payload_json LIKE ${`%${MCP_APP_OUTPUT_KEY}%`}
+          OR payload_json LIKE '%preview_recording_stop%')
     `,
         sql<{ id: string }>`
       SELECT DISTINCT json_extract(attachment.value, '$.id') AS id
diff --git a/apps/server/src/orchestration-v2/TurnStartReads.test.ts b/apps/server/src/orchestration-v2/TurnStartReads.test.ts
index 6db6b4c308827..cfc362c9db080 100644
--- a/apps/server/src/orchestration-v2/TurnStartReads.test.ts
+++ b/apps/server/src/orchestration-v2/TurnStartReads.test.ts
@@ -406,11 +406,30 @@ it.effect.each(["sqlite"] as const)(
           },
         },
       });
+      const recordingId = "thread-completion-reads-0b9f6c1e-3c1d-4f7a-9d2e-5a6b7c8d9e0f-webm";
+      yield* store.apply({
+        id: EventId.make("attachment:recording-event"),
+        type: "turn-item.updated",
+        threadId,
+        runId: oldRunId,
+        occurredAt: now,
+        payload: {
+          ...item,
+          id: TurnItemId.make("attachment:recording"),
+          type: "dynamic_tool",
+          toolName: "mcp__t3-code__preview_recording_stop",
+          input: {},
+          output: [
+            { type: "text", text: JSON.stringify({ id: recordingId, mimeType: "video/webm" }) },
+          ],
+        },
+      });
       assert.deepEqual((yield* store.getThreadAttachmentIds(threadId)).toSorted(), [
         "answer-document",
         "answer-image",
         "attachment:old",
         "message-file",
+        recordingId,
       ]);
     }).pipe(Effect.provide(layerDatabase)),
 );
diff --git a/packages/shared/src/toolOutput.ts b/packages/shared/src/toolOutput.ts
index 05bb49fc6a5e3..b3a88e59de1e5 100644
--- a/packages/shared/src/toolOutput.ts
+++ b/packages/shared/src/toolOutput.ts
@@ -191,6 +191,21 @@ export function htmlRenderFromToolItem(item: {
   return output?.isError ? undefined : output?.htmlRender;
 }
 
+/** The thread-owned file `preview_recording_stop` stored for the agent. */
+export function previewRecordingIdFromToolItem(item: {
+  readonly toolName: string | null | undefined;
+  readonly output?: unknown;
+}): string | undefined {
+  if (resolveT3McpToolId(item.toolName) !== "preview_recording_stop") return undefined;
+  const budget: ResultReadBudget = {
+    remainingBytes: MAX_PARSED_BYTES,
+    remainingNodes: MAX_ENVELOPE_NODES,
+    exceeded: false,
+  };
+  const result = readResult(item.output, budget);
+  return result.failed || budget.exceeded ? undefined : boundedId(result.data?.id);
+}
+
 /** Accept app references only when server and tool match the item, so tools cannot impersonate another app source. */
 export function mcpAppFromToolItem(item: {
   readonly toolName: string | null | undefined;

From e1cf10bae46b22a5064bb67bd0a39c80ace71783 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Tue, 3 Nov 2026 23:49:00 +0000
Subject: [PATCH 166/167] fix(server): review guides no longer fail on the
 repository's checkout hooks (#29907)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../PullRequestReviewGuideService.test.ts            | 12 ++++++++----
 .../src/pullRequest/PullRequestReviewGuideService.ts | 12 +++++++++++-
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/pullRequest/PullRequestReviewGuideService.test.ts b/apps/server/src/pullRequest/PullRequestReviewGuideService.test.ts
index 4f567142fbed5..3ee929f923a57 100644
--- a/apps/server/src/pullRequest/PullRequestReviewGuideService.test.ts
+++ b/apps/server/src/pullRequest/PullRequestReviewGuideService.test.ts
@@ -467,7 +467,7 @@ it.layer(layerBase, { excludeTestServices: true })("PullRequestReviewGuideServic
     ),
   );
 
-  it.effect("keeps excerpts of source lines a configured diff driver would convert away", () =>
+  it.effect("keeps excerpts despite the checkout's diff driver and a failing hook", () =>
     Effect.scoped(
       Effect.gen(function* () {
         const repositories = yield* makeRepositories;
@@ -477,6 +477,9 @@ it.layer(layerBase, { excludeTestServices: true })("PullRequestReviewGuideServic
           "feature.txt diff=blank\n",
         );
         yield* git(repositories.workspace, ["config", "diff.blank.textconv", "true"]);
+        const hook = `${repositories.workspace}/.git/hooks/post-checkout`;
+        yield* fs.writeFileString(hook, "#!/bin/sh\nexit 1\n");
+        yield* fs.chmod(hook, 0o755);
         const stored = yield* Deferred.make<void>();
         const context = yield* Layer.build(
           makeLayer({
@@ -502,9 +505,10 @@ it.layer(layerBase, { excludeTestServices: true })("PullRequestReviewGuideServic
           context,
           PullRequestReviewGuideService.PullRequestReviewGuideService,
         );
-        yield* service.generate(reference);
-        yield* Deferred.await(stored);
-        const result = yield* service.get(reference);
+        const runs = yield* watchRuns;
+        yield* runs.generate(service, reference);
+        const result = yield* runs.settled(service, reference);
+        assert.notStrictEqual(result.run?._tag, "Failed", JSON.stringify(result.run));
         assert.deepStrictEqual(result.guide?.stops[0]?.excerpts, [
           { path: "feature.txt", side: "new", start: 1, end: 3, caption: "" },
         ]);
diff --git a/apps/server/src/pullRequest/PullRequestReviewGuideService.ts b/apps/server/src/pullRequest/PullRequestReviewGuideService.ts
index a7618a23d27ae..8994837fcdd80 100644
--- a/apps/server/src/pullRequest/PullRequestReviewGuideService.ts
+++ b/apps/server/src/pullRequest/PullRequestReviewGuideService.ts
@@ -305,7 +305,17 @@ const make = Effect.gen(function* () {
     yield* git.execute({
       operation: "PullRequestReviewGuideService.addWorktree",
       cwd: workspaceRoot,
-      args: ["worktree", "add", "--detach", "--quiet", path, resolvedHead.commitSha],
+      // Scratch checkout for reading the change: repository hooks (installs, LFS) only slow or fail it.
+      args: [
+        "-c",
+        "core.hooksPath=/dev/null",
+        "worktree",
+        "add",
+        "--detach",
+        "--quiet",
+        path,
+        resolvedHead.commitSha,
+      ],
       timeoutMs: 5 * 60_000,
     });
     yield* Effect.addFinalizer(() =>

From ad4bb6d6fa0af9072fef92b540c12f04997036d5 Mon Sep 17 00:00:00 2001
From: Valtrizt Khalifah Warri <108137942+valuin@users.noreply.github.com>
Date: Wed, 4 Nov 2026 06:49:18 +0700
Subject: [PATCH 167/167] fix(desktop): bump Electron to 44.10.1 for October
 Chromium security backports (#30161)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/desktop/package.json |  2 +-
 pnpm-lock.yaml            | 18 +++++++++---------
 pnpm-workspace.yaml       |  2 +-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 68321456683eb..729690b88c989 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -22,7 +22,7 @@
     "@t3tools/tailscale": "workspace:*",
     "dbus-next": "0.10.2",
     "effect": "catalog:",
-    "electron": "44.10.0",
+    "electron": "44.10.1",
     "electron-store": "^8.2.0",
     "electron-updater": "^6.8.9",
     "electron-webauthn": "catalog:",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 84d25ab15249a..efc7f6e902d4c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -424,7 +424,7 @@ importers:
     dependencies:
       '@clerk/electron':
         specifier: 0.1.3
-        version: 0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.0(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.1(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@clerk/electron-passkeys':
         specifier: 0.0.3
         version: 0.0.3
@@ -459,8 +459,8 @@ importers:
         specifier: 4.1.2
         version: 4.1.2
       electron:
-        specifier: 44.10.0
-        version: 44.10.0(supports-color@8.1.1)
+        specifier: 44.10.1
+        version: 44.10.1(supports-color@8.1.1)
       electron-store:
         specifier: ^8.2.0
         version: 8.2.0
@@ -1037,7 +1037,7 @@ importers:
         version: 6.40.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@clerk/electron':
         specifier: 0.1.3
-        version: 0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.0(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.1(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@clerk/react':
         specifier: 6.18.0
         version: 6.18.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
@@ -8640,8 +8640,8 @@ packages:
     resolution: {integrity: sha512-bO3y10YikuUwUuDUQRM4KfwNkKhnpVO7IPdbsrejwN9/AABJzzTQ4GeHwyzNSrVO+tEH3/Np255a3sVZpZDjvg==}
     engines: {node: '>=8.0.0'}
 
-  electron@44.10.0:
-    resolution: {integrity: sha512-ss4pCfrQKV4TWkuVYtWB4HmeysPZgB96cSYNKYZv1UVCRP4vQMGNW5oopFbvx6Bbfce1XtP5pm5RDuKehp0svQ==}
+  electron@44.10.1:
+    resolution: {integrity: sha512-CTqxvx02P+xCR/xUxAWBexQEJ42g9Rzy1/0N+ofGAtI/atgSYZKQnTX9/juwzftocWbZtoF2ftEGMGJujJDeBw==}
     engines: {node: '>= 22.12.0'}
     hasBin: true
 
@@ -13443,12 +13443,12 @@ snapshots:
       '@clerk/electron-passkeys-win32-arm64-msvc': 0.0.3
       '@clerk/electron-passkeys-win32-x64-msvc': 0.0.3
 
-  '@clerk/electron@0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.0(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@clerk/electron@0.1.3(@clerk/electron-passkeys@0.0.3)(electron-store@8.2.0)(electron@44.10.1(supports-color@8.1.1))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
     dependencies:
       '@clerk/clerk-js': 6.40.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@clerk/react': 6.18.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@clerk/shared': 4.41.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      electron: 44.10.0(supports-color@8.1.1)
+      electron: 44.10.1(supports-color@8.1.1)
       react: 19.3.0
       tslib: 2.8.1
     optionalDependencies:
@@ -18315,7 +18315,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  electron@44.10.0(supports-color@8.1.1):
+  electron@44.10.1(supports-color@8.1.1):
     dependencies:
       '@electron-internal/extract-zip': 1.0.5
       '@electron/get': 5.1.0(supports-color@8.1.1)
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index df77b847c3418..40583e9402d49 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -174,7 +174,7 @@ minimumReleaseAgeExclude:
   - expo-sharing@58.0.19
   - expo-sqlite@58.0.13
   - expo-symbols@58.0.4
-  - electron@44.10.0
+  - electron@44.10.1
   - "@shadcn/lint@0.1.5"
   - cn@0.3.2
   - uniwind@1.13.0