[andrewcai8]

Brings the fork up to upstream a21d788: 511 upstream commits since #277's d897d3f, with upstream CI green at that commit. It is a merge commit, not a squash, so the next sync's merge base stays upstream's sha.

Why

The PC's T3 server froze and then crashed on a V8 heap OOM. Its statev2.sqlite is 54 GB, with 8.46M rows in orchestration_events, because the fork's event log never shrinks. Upstream now prunes events the projections already cover (pingdotgg#29806).

Notable upstream changes

• Event store pruning (perf(server): prune events the projections already cover pingdotgg/t3code#29806), plus the prunedThroughSequence fallback so a client that resumes past pruned events takes a snapshot.
• Child worktrees are cleaned up after their parent settles (fix(server): clean up child worktrees after their parent settles pingdotgg/t3code#30026). Recovery and settlement stop scanning message order (fix(server): avoid message ordering scans during recovery and settlement pingdotgg/t3code#30582). Delegated threads get their own provider event logs (fix(server): delegated threads no longer share one provider event log pingdotgg/t3code#29770).
• Effect 4.1.2 (chore(deps): upgrade Effect to 4.1.2 and alchemy to beta.85 pingdotgg/t3code#26833) and typecheck through @effect/tsgo with Effect's rules (build: typecheck with tsrs and Effect's rules through @effect/tsgo pingdotgg/t3code#31028). jose is replaced by effect/jose (refactor: replace jose with effect/jose pingdotgg/t3code#30474).
• Kiro as an ACP provider (feat(provider-kiro): add Kiro as an ACP provider pingdotgg/t3code#14693). Agents ask for secrets through request_secret (feat(server): agents ask for secrets through request_secret instead of chat pingdotgg/t3code#30257). MCP Apps render from Claude tool calls (feat(server): render MCP Apps from Claude tool calls pingdotgg/t3code#29803).
• Thread tags, hiding tagged threads while recording (feat: tag threads and hide tagged threads while recording pingdotgg/t3code#29053). Copy thread copies a link that opens it (feat(server,web,mobile,desktop): Copy thread copies a link that opens the thread pingdotgg/t3code#26290). Usage filters by provider and model (feat(usage): filter Usage totals by provider and model pingdotgg/t3code#28952).
• Mobile: medium windows float the sidebar (feat(mobile): medium windows float the sidebar over the page pingdotgg/t3code#27088), the inspector becomes a sheet (feat(mobile): without an inspector column, the inspector is a sheet pingdotgg/t3code#27090), on-device Android dictation (feat(mobile): add on-device Android dictation pingdotgg/t3code#26734).
• Many server perf fixes for recovery, PR sync and idle compaction (perf(server): bound runtime recovery reads by thread ownership pingdotgg/t3code#29429, perf(server): narrow delegated recovery reads to delivery records pingdotgg/t3code#29435, perf(server): bound streaming recovery reads by active runs pingdotgg/t3code#30357, perf(server): idle compaction reads only the latest run, live work and newest usage pingdotgg/t3code#29648, perf(server): PR sync stops reading pull requests closed over a day ago pingdotgg/t3code#30071).

New server migrations

• 077 RepairBooleanSettledOverride: one UPDATE on orchestration_v2_projection_threads, limited to rows whose override is a JSON boolean.
• 078 DropOrchestrationEventCorrelationIndex: drops idx_orch_events_correlation_id. Cheap, and it frees pages. No fork code reads by correlation id.
• 079 DelegatedRecoveryIndexes: two partial indexes. One full scan of the threads table and one of the runs table, with JSON functions per row. Expect a slower first start on the PC.
• Fork 009 DropDuplicateDelegatedCompletionIndex: fork 008 built the same partial index as upstream 079's runs index. Two identical indexes double the write cost, so 009 drops the fork's.

None of them scans, backfills or indexes orchestration_events, the turn items, turn item positions, nodes or message search tables.

First pruning pass on a large backlog

• The first compaction runs 1 minute after start. It only records the prune mark at the current head, and it starts paced pruning of imported v1 history.
• Event deletion starts on the first pass after the mark is a day old. Passes run every 6 hours, so expect the first deletes 24 to 30 hours after the first start.
• Each delete transaction removes at most 50 rows. The pruner runs at 10% duty: after a 25 ms slice it rests nine times as long. It never holds a transaction or the reader lock across a rest.
• Discovery runs on the reader pool. Its largest read groups every stream head once, which holds a WAL snapshot for that one statement.
• pruned-through is published before rows go, so resuming clients take a snapshot instead of missing events.

Conflict resolutions (34 files)

• Projections: ProjectionStore takes upstream's node and streaming-message queries. Recovery liveness takes upstream's perf(server): bound runtime recovery reads by thread ownership pingdotgg/t3code#29429 provider-thread clauses over the fork's narrowing (e9860a5), which had dropped live turn items from that check.
• Server wiring: server.ts and ws.ts keep the fork's environment control, cloud RPCs and local nodeHttpServer, and drop the model manifest and latest-version RPCs as upstream did. DatabaseStorage gets ProjectionMaintenance as upstream wires it.
• Codex: upstream's environment merge (fix(server): Codex switches respect each instance's CODEX_HOME variable pingdotgg/t3code#24664) keeps the fork rule that only an instance's own CODEX_HOME picks its home.
• Claude adapter: upstream's buffered result arrivals and the fork's process-ended handling both stay. The wake check keeps the fork's opaque task notification case.
• MCP: orchestrator capabilities check the caller's project when it is known. Project and thread tools keep Home routing on SecureRandom.
• Usage: the Cursor scan follows upstream's instance list. API keys win. With a key, only key sources are shown, so a replaced key never shows the previous account. On the CLI-login path, the fork keeps per-instance logins and stored history for removed logins.
• Web: cloud delete hooks, the cloud machine pill, the environment setup card and guest server updates are re-applied on upstream's reshaped components. Upstream removed the unreachable thread status priority.
• Mobile: upstream moved the sidebar into WorkspaceThreadSidebar.tsx. The fork's useNewThreadNavigation is wired there now.
• Root: package.json keeps the fork's case:check, the protobuf, connect, e2b and modal dependencies, and drops jose as upstream did. The lockfile is upstream's, re-resolved.

Fixes the merge needed

• Effect 4.1.2 in fork code:
  • effect/Crypto became SecureRandom and Digest in the fleet, Home, cloud host and worker fork code and in scripts/cloud.
  • Layers and scripts add NodeCrypto.layer, since NodeServices no longer carries crypto.
  • NodeWS imports moved.
  • SpawnHost unwraps Redacted args and env.
  • boxUsage chunks its inserts.
  • The provisioned gateway refuses an unknown HTTP method with 405.
• tsgo: five stale @effect-diagnostics directives are removed. A fork benchmark keeps its JSON printing outside Effect code.
• Scheduled tasks: upstream fix(server): a failed scheduled run shows its error without a stack trace pingdotgg/t3code#29889 records only a failed run's outer error message. On a cloud-only host, local runs are now refused before launch, so the run's error still says why.
• Tests:
  • Fake Claude sessions gain the four new SDK methods.
  • In-process MCP tests use layerInProcessMcpServer.
  • ServerSecretStore mocks answer get.
  • Registry mocks carry entries.
  • ForkMigrations.test.ts gains 077–079 and fork 009.
  • The writer-worker pruning test expects one remaining event, since upstream now prunes message.updated rows too.
  • The cloud task test expects upstream's fix(server): Run now on a scheduled task says why it was refused pingdotgg/t3code#29620 refusal message.
  • The client-runtime server test types its registry mock's entries (separate commit, after CI's typecheck caught it).
• Agent context budget shrank (5153 → 5133, 6883 → 6863, 54149 → 54109), so no label is needed.

Verification

• Typecheck clean (vp run typecheck, which now includes Effect's rules) in server, web, mobile, desktop, scripts, contracts, shared, client-runtime, provider-core and provider-cursor.
• Lint and format clean on every file that differs from upstream. knip:check, case:check, both generate checks and vp i --frozen-lockfile pass. The pre-commit hook re-ran fmt, lint and knip on the merge.
• Full vp test run:
  • Server: 7736 of 7746 pass, 8 skipped. Two failed under load (SpawnHost "spawns directly once the host keeps dying", DeviceHubProxy.stream). Both pass alone.
  • client-runtime (1872), provider-cursor (125) and mobile (3310) pass.
  • Web: 5578 of 5598. Five browser files failed under load and pass alone. GuestPage "follows the end" fails locally on upstream too. The *.renders.tsx files need T3CODE_RENDER_REPORT_DIR.
  • Desktop: all pass except the DesktopLinuxUrlHandler icon names (case-insensitive APFS).
• Pruning on the writer worker: a temporary copy of ProjectionMaintenance.test.ts on a file database with writerWorker: true passed. It is not committed.
• No upstream line was lost in the fork-delta files touched by perf(server): prune events the projections already cover pingdotgg/t3code#29806, fix(server): clean up child worktrees after their parent settles pingdotgg/t3code#30026 and fix(server): avoid message ordering scans during recovery and settlement pingdotgg/t3code#30582. fix(server): delegated threads no longer share one provider event log pingdotgg/t3code#29770 touches no fork-delta file.

Not verified

• No real client was run, and no cloud box or provider was exercised.
• Pruning was not run against a copy of the PC's 54 GB database. Its wall time on the 8.46M-event backlog is an estimate: about 169K delete pages, likely 5 to 25 hours of paced work.
• The 079 index build time on the PC is not measured.

Follow-ups

• Upstream build: run Effect rules on mobile and lock in clean suggestion rules pingdotgg/t3code#31111 (one commit past a21d788) turns on Effect rules for mobile and locks the suggestion rules. Expect fork-code fixes on the next sync.
• Label PR size fails on this PR with spawnSync git ENOBUFS, from the upstream .repos vendor diff (about 27,800 files). It is not required, and it runs from the base branch, so this PR cannot fix it.
• Kiro is new. The fork's account switching and cloud box credential handoff make no decision for it yet.
• Back up the PC's database before the first start. Expect migration 079 to slow that start, and the first event deletes a day later.

Merged and verified by Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	−35 B (−0.7%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−35 B (−2.7%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.5 KiB	−41 B (−0.2%)	24.4 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−29 B (−0.6%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−29 B (−2.3%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	−41 B (−0.2%)	24.4 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: cad73c7 · PR result: 5440425 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[andrewcai8]

PASS+NOTES for head 5440425 (independent Shipping verifier, fresh worktree)

Resolutions (git show --remerge-diff abfacdbea5, 75 files outside .repos/lockfile)

• ProjectionStore takes upstream's perf(server): bound runtime recovery reads by thread ownership pingdotgg/t3code#29429 liveness clauses and the run-indexed streaming-message query. The other fork recovery code is intact.
• server.ts keeps SpawnHost and adds NodeCrypto. DatabaseStorage is wired as upstream does it. ws.ts keeps EnvironmentControl and layerCloudWsRpc and takes upstream's readSettingsClient.
• No fork-added line reads orchestration_events by sequence, so pruning only reaches upstream paths, and those have the pruned-through snapshot fallback.
• Fork 009 drops ..._runs_delegated_completion_idx. It is byte-identical to upstream 079's ..._delegated_delivery_idx. No INDEXED BY names it. ForkMigrations.test.ts lists 77–79 and fork 9.

Tests (local)

• vp test run on ProjectionMaintenance, FoundationPersistence, src/persistence, and ws.test.ts passed: 32 files, 140 passed, 1 skipped.
• These include "discovers on the reader worker and deletes on the writer worker" and the five pruned-boundary resume tests.
• Prune reads use NodeSqliteClient.readOnly. Deletes run inside sql.withTransaction on the writer.

Real-data boot on a .backup copy of ~/.t3-host/userdata/statev2.sqlite (1.2 GB, 210,969 events)

• Before boot I sanitized the copy. I cleared schedules, outbox, launch workflows, auth and peer links, and marked the 1 running run interrupted.
• The server ran with env -i, a fake HOME, and a PATH without provider CLIs.
• Migrations: 077 0.28 s, 078 0.92 s, 079 0.43 s, fork 009 3 ms. It was listening about 3 s after the migrations. Recovery completed and launched no runs.
• At 1 min the prune mark was recorded in orchestration_v2_projection_metadata (event-log-prune-mark, seq 218697). That pass took about 12 s.
• I then backdated the mark on the copy and rebooted. event-log-pruned-through was published first. Then Compacted orchestration history logged deletedEventCount: 209302 in about 29 min (about 7K events/min at 10% duty), leaving 1,667 events and 708 MB reclaimable (auto_vacuum=2).
• A third boot after pruning was healthy: 381 threads, /.well-known/t3/environment 200.
• The only WARNs came from the sandbox: no gh credential, no cloud config. No ERROR lines.

CI: every required check is green. Label PR size failed with ENOBUFS, which is known and not required.

Notes

• At the measured rate, 8.46M events on the PC is roughly 20 h of paced deletes after the first day. That is an extrapolation, not a measurement on that hardware.
• 54 GB of file space comes back only if the PC's DB is auto_vacuum=incremental. Otherwise t3 doctor must VACUUM it. I did not check the PC.
• Two event-loop stalls (5.9 s and 2.1 s) had low CPU and thousands of major page faults. This Mac is swapping heavily, so I attribute them to paging, not pruning (inferred).
• A short-lived claude child spawned at boot and exited. No turn ran (likely a provider probe).
• Not verified: the 54 GB DB itself, the box's 079 build time, real clients, cloud boxes.

🤖 Generated with Claude Code