[andrewcai8]

Brings the fork up to upstream 23bdb9ef1c (34 commits since 291bcc392c; upstream checks green on that sha). No new migrations.

Notable upstream changes

• The background service launcher uses 75% less memory (perf(server): background service launcher uses 75% less memory pingdotgg/t3code#29284): bin.ts is now a tiny launcher and the CLI dispatch moved to binMain.ts.
• Provider-thread reads start from owned rows (perf(server): provider-thread reads start from owned rows, not every node of the thread pingdotgg/t3code#31012); background PR discovery no longer delays git status after a restart (perf(server): background PR discovery no longer delays git status after a restart pingdotgg/t3code#32162); less per-event tracing (perf(cursor): stop tracing the per-event account usage hash pingdotgg/t3code#31017, perf(server): stop tracing the per-event background-work probe pingdotgg/t3code#31584, perf(server): stop tracing each transcript file in usage scans pingdotgg/t3code#31586).
• A usage-limit auto-resume survives a server restart (fix(server): a usage-limit auto-resume survives a server restart pingdotgg/t3code#31292); remote subagents stay in the lineage list (fix(web): remote subagents no longer split from the lineage list pingdotgg/t3code#29285).
• Mobile fixes: Android composer font, iOS filter menus, review diff blanking.

Conflict resolutions (3 files)

• apps/server/src/bin.ts: upstream's launcher and binMain split are kept, including single-executable loading. guardStderr runs first in the launcher and covers every path. __spawn-host stays in the launcher because it is long-lived and uses only Node built-ins; going through binMain would load the whole CLI in the single-executable build. The fork's other fast paths (__document-text, __managed-chatgpt-token, ACP MCP bridge/call, fork-exec) dispatch from binMain.ts beside upstream's __speech-worker, after ignoreMacosTypeOfServiceEinval. That macOS socket guard no longer runs before the spawn host, which makes no outbound connections.
• runtimeLayer.test.ts: imports from both sides.
• package.json: upstream's build:desktop:bundle plus the fork's build:t3-runtime-artifact.

Verification

• vp run typecheck: server, contracts, client-runtime, web, mobile, desktop clean.
• apps/server build: node dist/bin.mjs --version runs; fork-exec loads without binCli, and __spawn-host loads only its own chunk and the stderr guard. build-runtime-artifact.ts copies all of dist, so the new chunks ship.
• Tests: cliCompileCache, entrypoint, SpawnHost, forkExec, invocation and runtimeLayer pass (155/157). The two failures are invocation.test.ts comparing /var against /private/var, a macOS temp-path quirk in a file this PR doesn't change.
• vp lint on all fork-changed TS files, vp run knip:check.

Not verified

• The single-executable t3 binary build.

🤖 Generated with Claude Code