chore(upstream): sync marcode through d29c56a5

[maarco]

What Changed

Merges pingdotgg/t3code@d29c56a5c404cb0f58d3b2ac41762fa0d0ac28d4 into Marcode.

This supersedes the open sync drafts #76, #78 and #80. Those three stacked up because none was merged; this branch is built on #80's head (claude/gracious-bohr-a02fbt, upstream through 6c583620) and adds the remaining 17 upstream commits, so it contains everything all three carried. Merging this one closes the whole backlog — the other three can be closed unmerged.

Upstream delta on top of 6c583620 (17 commits), headlined by:

• afb84898 link multiple pull requests to threads (feat(pull-requests): link multiple pull requests to threads pingdotgg/t3code#10839)
• de37964d navigate, merge and rebase GitHub stacks (feat(prs): navigate, merge and rebase GitHub stacks pingdotgg/t3code#10875)
• f0401c62 find threads by linked pull request (feat(search): find threads by linked pull request pingdotgg/t3code#10870)
• 33242d01 preserve recent PR reads across server restarts (fix(server): preserve recent PR reads across server restarts pingdotgg/t3code#11007)
• d29c56a5 resolve project identity before legacy PR relinks (fix(server): resolve project identity before legacy pr relinks pingdotgg/t3code#11045)
• plus web/mobile fixes: image zoom & pan, touch copy buttons, Linux middle-click paste, Zed remote projects, Android glass text bleed, duplicate tool-call expansion, provider model bulk toggle, diff palette.

Conflict decisions (10 files)

Path	Decision
packages/contracts/src/environment.ts	Additive. Keep Marcode's workspaceLayoutMutations, take upstream's threadPullRequests / pullRequestStackActions and its reworded threadPullRequestLinking doc.
apps/server/src/environment/ServerEnvironment.ts + .test.ts	Same: all three capabilities advertised and asserted.
apps/server/src/persistence/Migrations.ts	Upstream's 050_ProjectionThreadPullRequests lands as Marcode 051, one past the Marcode-offset tail, so no applied id moves. Migration and its test renamed; the test's toMigrationInclusive bounds shifted by the same offset.
apps/server/src/provider/RuntimeInstructions.ts	Keep Marcode's product name, take upstream's PULL_REQUEST_LINKING_INSTRUCTIONS. The t3-code MCP server id inside it stays upstream-shaped on purpose.
apps/server/src/provider/Layers/ClaudeAdapter.test.ts	Take upstream's refactor to buildRuntimeInstructions() over Marcode's inlined literal — it now derives the Marcode branding automatically.
apps/web/src/rightPanelStore.ts	Keep Marcode's RIGHT_PANEL_KINDS export; take upstream's pull-requests singleton, leave files out.
apps/web/src/marcodeRightPanelPolicy.ts	Adopt upstream's new thread-linked pull-requests surface (see below).
apps/web/src/components/RightPanelTabs.tsx	Resolved to Marcode's side, which delegates launcher/add-menu chrome to marcodeRightPanelChrome.tsx; upstream's "Linked pull requests" entries ported into that module rather than re-inlining their copy.
apps/web/src/components/ChatView.tsx	Take upstream's addPullRequestsSurface; drop openFileSurface — files open in the floating Code editor here, not the right panel.
apps/web/src/components/pullRequest/PullRequestDetailPanel.tsx	Take upstream's Tooltip/MenuTrigger nesting, keep Marcode's side="bottom".

The one judgement call worth a look

Upstream's new pull-requests right-panel surface (the thread's own linked PRs, stacks included) reuses the same kind id as the repo-wide PR list panel Marcode retired in right-panel storage v11. I adopted it rather than retiring it again, because:

• it is different content — the thread's linked PRs, not the repo's list, which Marcode still shows as a full page;
• the auto-merge already gave RightPanelTabsProps upstream's onAddPullRequests / pullRequestsAvailable, and ChatView already renders ThreadPullRequestsPanel for that kind, so retiring it would have left the feature half-wired;
• Marcode's retired-kind sweep (file/files/plan) is untouched and still pinned.

If you'd rather keep it out, that's a one-line revert in marcodeRightPanelPolicy.ts plus the ChatView opener.

Fork-boundary breaks that merged with no conflict

These are the silent ones — caught by typecheck, not by git:

1. Five upstream test fixtures build OrchestrationProjectShell literals without workspaceLayoutVersion / workspaceLayout, which Marcode requires (linkCreatedPullRequest, mcp/toolkits/pullRequests/handlers, PullRequestSyncReactor, decider.pullRequests, projector).
2. Marcode's own decider.workspaceLayout.test.ts thread fixture predates upstream's now-required pullRequests field.
3. The link_pull_request MCP tool description named "T3 Code" where Marcode uses its own product identity.

Identity sweep over the whole merged tree came back clean: T3CODE_HOME appears only in Marcode comments and the tests documenting the divergence, marcode.service is the unit, WORKTREE_BRANCH_PREFIX is referenced through the constant, and the right-panel storage key is Marcode's. T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, com.t3tools.t3code.service, @t3tools/*, the t3 CLI name and the t3-code MCP id are all left upstream-shaped deliberately.

Pins added

• Migrations.test.ts offset pin extended to cover ids 50 and 51. It had stopped at 49, so the last two syncs added migrations the pin never saw — the "fails here loudly" comment was no longer true.
• New rightPanelStore.test.ts case pinning the adopted pull-requests surface, so a future sync cannot drop the kind while ChatView still renders ThreadPullRequestsPanel for it.

Why

Daily upstream sync. Nothing here is a Marcode feature change beyond the surface decision called out above; the goal is to take upstream's correctness, protocol and dependency work while keeping Marcode's floating editor, unified workspace, branding and migration offsets intact.

No coupled-subtree work needed: neither pnpm-workspace.yaml nor infra/relay/package.json moved in this delta.

UI Changes

Not captured. This run is headless — no browser or simulator verification was possible, so the web/mobile surfaces upstream touched (the new linked-PR panel, PR stack navigation, image zoom/pan, Android glass fixes) have not been driven live. That verification is still owed before this leaves draft, per the runbook's step 5.

Checklist

• This PR is small and focused — no, it is an upstream sync; scope is upstream's delta.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this environment, see above.
• I included a video for animation/interaction changes — same.

Verification run

• typecheck: web, server (t3), contracts, shared, client-runtime, desktop, mobile — all clean.
• Focused tests, all passing: migrations + new 051_ProjectionThreadPullRequests, ServerEnvironment, RuntimeInstructions, ClaudeAdapter, decider.workspaceLayout, decider.pullRequests, projector, PullRequestSyncReactor, linkCreatedPullRequest, mcp/toolkits/pullRequests/handlers, rightPanelStore, RightPanelTabs, contracts/orchestration, plus the fork-identity suites (forkIdentity, git, bootService, serviceLauncher, upstream-sync-workflow).
• vp fmt --check on the 23 changed files: clean. vp lint on the changed dirs: 0 errors, pre-existing warnings only.
• Not run: the full workspace suite, and the live client verification noted above. CI owns the former.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LSPeSBiGm2QzZWPdsL2zuy

---

Generated by Claude Code

[maarco]

claude-review is red, and it is not this PR's

Standing down on this one, with the evidence.

What's failing: the claude-review job in Claude Code Review (run 34495728410), exit 1 after ~28s, before it reviews anything.

Why it isn't this diff: .github/workflows/claude-code-review.yml:37 passes claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}, and the job log shows the credential reaching the action empty (ANTHROPIC_API_KEY: with no value). It has failed identically on all ten most recent runs of that workflow — runs 90 through 99 — across five different branches, including run 90 on chore/upstream-52b2bf77a941, which is part of main today. No commit in this merge touches the workflow, the action, or anything it reads.

The fix, and why it isn't here: setting the CLAUDE_CODE_OAUTH_TOKEN repository secret. That's a repo-settings change, not a code change, so there is nothing to port into this branch — the job will keep failing on every PR until the secret exists.

On the one re-run: not spending it. The re-run allowance is for confirming a suspected not-ours failure; an empty secret visible in the log with ten identical reproductions across other branches is already stronger evidence than one more run would give, and the outcome cannot change while the secret is unset.

claude-review is not in requiredPullRequestChecks in .github/upstream-sync.yml (Check, Test, Mobile Native Static Analysis, Release Smoke), so it does not gate this PR.

Required checks on fc92084

• Release Smoke — ✅ success
• Check — in progress
• Test — in progress
• Mobile Native Static Analysis — in progress

Base main (a9836f5) is green on all four, so there's no base-branch failure in play. I'm watching these to a terminal result and will fix anything real that lands.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.5 KiB	+10 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+10 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	0 B (0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.6 KiB	+190 B (+1.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.1 KiB	+11 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+179 B (+2.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.9 KiB	+928 B (+1.6%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: a9836f5 · PR result: fc92084 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

All four required checks are now green on fc92084: Check ✅ · Test ✅ · Mobile Native Static Analysis ✅ · Release Smoke ✅. No review threads open, nothing still running.

claude-review remains red for the repo-secret reason above — not required, not this PR's, nothing to fix here.

Two things stand between this and merge, both yours:

1. The live client verification the runbook asks for on UI hotspots — this run was headless, so the surfaces upstream touched haven't been driven. That's why it's still a draft.
2. The judgement call on adopting upstream's thread-linked pull-requests surface, described in the PR body.

Leaving it in draft; I won't mark it ready or merge.

---

Generated by Claude Code