chore: merge upstream T3 Code through v0.0.35

[roughcoder]

Integrates the full pingdotgg/t3code main branch into Phoenix as a three-way semantic merge.

Phoenix head	e6574640b
Upstream head	d3c24a14b (v0.0.35)
Merge base	f2d5fc91e

153 upstream commits against 119 of ours. 56 textual conflicts and 98 further files both branches had changed without one.

Important

Merge this with a merge commit, not a squash. A squash drops the second parent, upstream history stops being reachable from main, and the next sync recomputes its merge base from the sync before last and replays every commit this PR already resolved. If it has to be squashed, record the ancestry afterwards — docs/operations/upstream-integration.md §7.

What we received

Codex 0.150 multi-agent events and thread feedback, Claude compaction before usage runs out, OpenCode skill discovery, orphaned-session reconciliation, worktree recreation before a turn, submodule checkout, push no longer writing a feature branch's commits to its base, PR-to-thread linking and live PR reads, thread settle/restore shortcuts, work-log tool collapsing, redesigned usage insights and skills menus, unified workspace navigation, direct image uploads with HEIC→JPEG, file-manager reveal, a pile of terminal fixes, mobile device analytics and Android/tablet fixes, client-origin attribution, semver-aware version skew, macOS service PATH, and a sharded CI suite.

What we kept

Every Phoenix feature survives. Where both branches had rewritten the same code, the resolution puts our requirement on top of upstream's current implementation rather than picking a side:

• upstream's redesigned work-log row carries our provider-retry collapsing
• upstream's redesigned usage page carries our subscription capacity section and per-environment filter
• upstream's extracted sidebar utility menu carries our Schedules (with its failure badge) and Environments entries
• upstream's client-origin dispatch threads through our extracted ThreadTurnBootstrap, which is shared with the sessions MCP toolkit

Two decisions went the other way, both recorded in full in the report:

• Adopted upstream's Claude stop. It closes the query and lets the SDK escalate to SIGKILL. That subsumes our stopTask fleet-stop and still emits the same task-stopped events, so it is strictly better at the thing our docs promise.
• Excluded upstream's interrupt-failure escalation (fix(server): recover from provider interrupt failures pingdotgg/t3code#7412). It marks a session stopped after a failed interrupt, which contradicts a deliberate, commented, tested Phoenix rule that such a session keeps running — the provider may still be working, and claiming otherwise lets the next message interleave with live work. Its three tests were removed with the reason recorded beside the ones we keep.

Upstream's three new migrations were renumbered to 54–56. Ours at 41–53 are already applied on live databases, and the migration ledger guard refuses to start when a recorded id changes name.

Defects caught in clean auto-merges

Eight, including one that would have broken every client at import: Phoenix had added orchestration.ts → providerRuntime.ts and upstream had added providerRuntime.ts → orchestration.ts. Neither is a cycle alone; together ProviderApprovalOption was undefined at module-init. Typecheck cannot see it. Fixed by moving our ProviderRuntimeErrorKind into the leaf module both already import.

The rest — a branded string that broke upstream's new tests, a removed prop our retry rows depend on, a field rename our retry detection missed, spawn cards folding into upstream's new tool groups, and four fixture/mock gaps — are listed in the report.

Verification

• vpr typecheck — 16/16 packages, no errors
• vp check — 0 errors, 19 warnings (three fewer than the pre-merge baseline of 22; no new categories)
• Tests — server 3353 passed / 8 skipped, web 2977 passed, mobile 804 passed, plus every other workspace package. No failures.
• Baselines came from a scratch worktree at e6574640b.

No real-client pass was run; this was verified by tests only.

Follow-ups

• Branch protection needs Test Server 1/2/3 and Rust as required checks — the old single Test check no longer covers the server.
• gh workflow disable "Desktop macOS Preview" (new upstream workflow, recorded in docs/internals/ci.md).

Full conflict-by-conflict record: docs/operations/upstream-integrations/2026-08-27.md.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}