[andrewcai8]

Brings the fork up to upstream 22c37a8 (142 commits since #272's 612a8e5; upstream CI green at that commit). Merge commit, not squash, so the next sync's merge base stays upstream's sha.

Notable upstream changes

• Fall back to another provider's model when the default is out of usage (feat(server,web,mobile): fall back when the default provider is out of usage pingdotgg/t3code#26164); usage refreshes when a turn hits its limit (fix(server,cursor,opencode): refresh provider usage when a turn hits its usage limit pingdotgg/t3code#26234). This complements the fork's feat(server): a local chat that hits a usage limit moves to another account with room #239, which moves a limited chat to another account of the same provider.
• Turn a No project thread into a project (feat: turn a No project thread into a project pingdotgg/t3code#26767); choose what the thread details card shows (feat(web): choose what the thread details card shows pingdotgg/t3code#26904); find in thread from the title menu (fix(web): find in thread opens from the thread title menu, so phones can reach it pingdotgg/t3code#22352).
• Switch the whole fleet between Stable and Nightly (feat(updates): switch your whole fleet between Stable and Nightly in one step pingdotgg/t3code#26288); updates refuse unsafe release-track crossings.
• Security: Electron 44.10.0 for the Node.js Brotli CVE (fix(desktop): bump Electron to 44.10.0 for the Node.js Brotli fix (CVE-2026-111497) pingdotgg/t3code#26348); guest links no longer return file diffs (fix(server): guest links no longer return file diffs pingdotgg/t3code#26538); credential redaction fixes.
• Server stability: thread lists past the SQLite variable limit (fix(server): thread lists load beyond SQLite variable limit pingdotgg/t3code#25696), SQLite temp files off the event loop (fix(server): SQLite temp files no longer block the event loop pingdotgg/t3code#24194), session stops no longer trigger storage sweeps (fix(server): session stops no longer trigger storage sweeps unless a deleted worktree waits pingdotgg/t3code#26038), run preparation 15x faster (perf(server): preparing a run is 15x faster and uses 200x less memory pingdotgg/t3code#27105).
• Usage host identity persists across container recreation (fix(usage): keep host identity across container recreation pingdotgg/t3code#25220).
• Outside MCP clients get openable web thread links (fix(server): outside MCP clients get thread links they can open pingdotgg/t3code#26642).
• New server migration 073 (ActiveTurnItemIndexes). Each host runs it on first start.

Conflict resolutions (20 files + lockfile)

• Usage host identity: upstream's persisted host id (T3CODE_HOST_ID, else usage-host-id seeded from the hostname) replaces per-call hostname(). A cloud box's T3CODE_USAGE_HOST_ID (its lease) still takes precedence. The fork's usageHostId helper is gone; box-usage folding now receives the service's own host id, so a host's own sources and its retired-home rows agree when T3CODE_HOST_ID is set.
• MCP links: upstream's threadLinkFor(scope, …) for list/read/search/launch. The fork's Home fleet reads (FleetService) share listItemFromShell/readThreadPage and pass a scope with no MCP client, so they keep t3-thread:// links. t3_thread_search keeps the fork's Home all-projects default.
• t3_thread_launch: the fork's Home/fleet routing, with upstream's project-default fallback model and web links reapplied.
• Storage cleanup: upstream's { waiting, kept } sweep result, with the fork's orphan-worktree policy still able to run the sweep when every worktree policy is off.
• Scheduled tasks: the fork's launchInput (cloud fires) beside upstream's sendBound retry for threads that move project.
• Mobile outbox: the fork's claimFirstTurnCloudBox before upstream's sequence-aware delivery completion.
• Contracts: autoApproveFullAccessPrompts and fallbackModelSelection both in the settings patch.
• Web:
  • Server updates: guest upgrades through the manager are kept, and the bulk Update all list also skips upstream's refused release-track crossings.
  • Thread menu: the fork's machine-gone/stop-cloud-machine items beside upstream's find and turn-into-project.
  • Thread details card: upstream's configurable card, with the fork's cloudRunOn on the environment toolbar.
  • Chat header: the fork's Home breadcrumb rule. New-thread hook: the fork's cloud placement and upstream's fallback model.
• apps/server/package.json: both diff (upstream) and e2b (fork).
• Tests: ForkMigrations.test.ts gains migration 73. ProviderRegistry mocks added to fork MCP launch tests, since the launch handler now reads providers for the fallback. Upstream's ScheduledTasksSettings browser test now looks for the fork's "Server" label (upstream's "Runs on"; the fork uses "Run on" for local/cloud). The guest-update unit test mocks useServerConfigs.
• Agent context budget: mcpToolListJsonBytes 52518 → 52618 from upstream tool text (needs agent-context-increase).

Verification

• Typecheck clean: server, web, mobile, desktop, scripts, contracts, client-runtime, shared.
• Lint and format clean on all 730 files the fork changes relative to upstream; vp run knip:check clean.
• Full vp test run: contracts, client-runtime, shared, web, mobile, desktop, scripts. Server: src/mcp, src/home, src/usage, src/scheduledTasks, src/storageCleanup, src/persistence, src/provider, src/environmentControl, src/textGeneration, src/orchestration-v2.
• vp i --frozen-lockfile passes.
• Locally failing, all from this Mac's environment, and none in files the fork changes: *.renders.tsx (need T3CODE_RENDER_REPORT_DIR), ClaudeSkills.test.ts install order, build-npm-launcher.test.ts and two UsageService.test.ts cases (/private/var tmp symlink; both pass with a resolved TMPDIR), DesktopLinuxUrlHandler.test.ts icon names (case-insensitive APFS).

Independent review (Opus, medium effort) of the resolutions and the auto-merged orchestration files found no blocking defects; its stale-comment note is fixed in a007208.

Not verified

• Web, desktop and mobile not run in a real client.
• Cloud-box usage identity and guest server upgrades not exercised against a real box.

Follow-ups

• Home's fleet threads.launch on another environment still uses that environment's plain default model, without upstream's out-of-usage fallback or project overrides.
• Fleet-routed thread links stay t3-thread:// even when the outside MCP client has a web origin.
• scripts/import-machine-usage.ts keeps its own usage-host-id under its cache dir, separate from the server's. Both start from the hostname, so they only drift if the hostname changes between their first runs; then imported and live usage for that machine would stop deduplicating.
• No fork test exercises the project-default fallback inside t3_thread_launch (the fork's launch tests mock an empty ProviderRegistry).
• Carried from chore: sync upstream through 612a8e59f0 #272: removed cloud chats in the folder-row sidebar layout lack a touch-only settle; cloud-box create paths pair without expectedEnvironmentId; resumed-path turn-start budget notes; Home's fleet t3_thread_interrupt ignores stop; fleet launch doesn't dedupe by clientRequestId.

Model: Claude Opus 5.5 in Claude Code.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	−6 B (−0.1%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.3 KiB	1.2 KiB	−6 B (−0.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.6 KiB	21.6 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.1 KiB	5.1 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.3 KiB	1.3 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 147434f · PR result: a007208 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.