chore(upstream): sync marcode through 223ff449

[maarco]

What Changed

Merges pingdotgg/t3code@223ff449 (today's upstream head) into main.

This PR supersedes the whole open sync backlog. It is built on the resolution in #73 (upstream 761d4bac) and then merges the remaining 99 upstream commits, so it carries every unmerged sync from f035a0f4 through 223ff449 in one reviewable change. Merging it should let #58, #61, #63, #65, #68, #69, #71, #72 and #73 be closed.

Merge commit 1218ed4e, parents cfa4587a (Marcode) and 223ff449 (upstream). 546 files, +22,612 / −7,728. 26 conflicted paths, all resolved by hand.

Conflict decisions

Path	Decision
.github/workflows/ci.yml	Kept both Marcode's standalone ripgrep step (pinned by upstream-sync-workflow.test.ts) and upstream's new nightly-release check
knip.jsonc	Kept both Marcode's fork-seam ignore list and upstream's new ui/*.tsx ignoreIssues
packages/ssh/src/tunnel.ts	Kept Marcode's .marcode paths and @@MARCODE_STATE_KEY@@. Upstream's @@T3_STATE_KEY@@ would have silently broken placeholder substitution
Migrations.ts	Upstream's new 048_ProjectionThreadBranchPullRequest renamed to Marcode's next free id 049; ProjectWorkspaceLayout keeps 033 so applied ids never renumber
contracts/src/rpc.ts	Kept Marcode's project-file RPCs; took upstream's un-export of WsShellOpenInEditorRpc
versionSkew.ts, relayClient.ts, clientPersistenceStorage.ts	Kept Marcode's key/env values, followed upstream's un-export refactor
client-runtime/rpc/client.ts	Took upstream's relocation of catchCause after its new onDefect tap; re-applied Marcode's isTerminalFailure guard onto it
client-runtime/state/threads.ts	Combined upstream's string setStreamError + onDefect with Marcode's sawMissingSnapshot terminal-deletion handling
rightPanelStore.ts	Kept the retired file/files surfaces removed and took upstream's whole openProactive / user-action-revision feature. Dropped openFile, openAttachment, reconcileFileSurfaces and the normalizeRevealLine helper that only served them
ChatView.tsx	Took upstream's activeThreadMetadata + proactive-panel observation (replacing its own relink machinery); kept Marcode's threadRepository/openThreadPullRequest for pill-nav thread actions and Marcode's ambient-only ChatHeader props
_chat.index.tsx	Took upstream's clearer connection-prerequisite copy under Marcode Connect branding
RepositoryIdentityResolver.test.ts	Took upstream's parameterized add/replace rewrite — its fixture names carry no Marcode meaning and the surrounding merged code already uses them
DesktopServerExposure.test.ts	Marcode's MARCODE_DESKTOP_* names with upstream's 100.90.1.2 fixture value, which upstream's merged assertions expect
DesktopClerk.test.ts	Upstream un-exported createDesktopClerkBridge and deleted the test pinning Marcode's desktop schemes. Replaced with a focused pin on ElectronProtocol.getDesktopScheme/getDesktopUrl so a future rename fails loudly

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — all found by audit, all fixed:

• ProjectSetupScriptRunner.test.ts used T3CODE_PROJECT_ROOT / T3CODE_WORKTREE_PATH; the producer emits MARCODE_*.
• rightPanelStore.test.ts (+106 lines) and ChatView.logic.test.ts (+270 lines) absorbed upstream tests driving openFile / reconcileFileSurfaces. That proactive-panel coverage was ported onto surfaces this fork has rather than deleted.
• useUnifiedWorkspaceProject.ts imported useDiscoveredPorts, which upstream removed in favour of useDiscoveredPortsState().servers.
• ThreadPullRequestReactor.test.ts and serverRuntimeStartup.test.ts built Project fixtures without Marcode's required workspaceLayoutVersion / workspaceLayout.
• Layout.astro shipped upstream's new social-card meta as T3 Code (og:site_name, og:image:alt, @t3dotgg) and index.astro labelled the Git illustration "T3 Code" — rebranded to Marcode.
• Migrations.test.ts window widened to -17 so id 33 stays anchored, per the instruction written in that test.

Why

The daily upstream sync has not landed since f035a0f4, and each run was re-deriving an ever-larger delta into a new draft PR. Building on #73's resolution instead of restarting from main reduced today's work from 131 conflicts to 26 and produces one branch that is actually current.

UI Changes

Not captured — this container has no browser session. Upstream touched web surfaces (right panel, chat header, sidebar, marketing site), so the runbook's runtime verification step still needs to be run before this leaves draft.

Needs a decision before merge

• apps/marketing /95 page. Upstream added a complete retro landing page (95.astro, retro.css, 32 image assets, ~1,727 lines) branded "T3 Code '95", including T3 Code product box art. It is carried here unmodified because rebranding it is a product decision, not a merge mechanic. Marcode should not publish it as-is — either rebrand/replace the assets or drop the page.

Pre-existing issues noticed (not touched by this merge)

• t3.json line 13: the Windows setup command still expands $env:T3CODE_PROJECT_ROOT, while the macOS/Linux command uses $MARCODE_PROJECT_ROOT. The Windows path expands to empty today.
• apps/marketing/src/lib/site.ts: GITHUB_REPOSITORY_URL still points at pingdotgg/t3code.

Checklist

• This PR is small and focused — as focused as an upstream sync can be; every hunk is upstream's or a named fork-boundary resolution
• I explained what changed and why
• I included before/after screenshots for any UI changes — not captured, see above
• I included a video for animation/interaction changes — n/a

Verification run

• Typecheck clean: contracts, client-runtime, web, server, shared, ssh, desktop, marketing, scripts
• Focused tests green: rightPanelStore, ChatView.logic, threads-atoms, threads-sync, Migrations, RepositoryIdentityResolver, ProjectSetupScriptRunner, ThreadPullRequestReactor, serverRuntimeStartup, DesktopServerExposure, DesktopClerk, ElectronProtocol, upstream-sync-workflow, serviceLauncher, bootService
• vp fmt --check and vp lint clean (lint exit 0, zero errors)
• No coupled vendored subtree moved — pnpm-workspace.yaml and infra/relay/package.json unchanged, so no sync:repos needed
• Not run locally: full workspace suite (CI owns it) and live client verification

🤖 Generated with Claude Code

https://claude.ai/code/session_01LYMf1kJ1QNpoF5EvYsC7p9

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.5 KiB	+116 B (+0.8%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+143 B (+2.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−27 B (−0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	57.0 KiB	+1.9 KiB (+3.5%)	66.4 KiB	✅
Codex	Live turn messages	16	8	−8 (−50.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.6 KiB	+153 B (+1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+155 B (+2.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.8 KiB	+2.0 KiB (+3.6%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 200e149 · PR result: 0167ae6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Verification record for the merged head 0167ae6739bfe4e40167d16a5c488e323adfad3e:

• Isolated web runtime: server http://127.0.0.1:14648, web http://localhost:6608, disposable home /tmp/marcode-pr74-web.8aKCIo.
• At 390x844, the live composer showed the responsive icon header, Expand composer, and More composer controls with Reasoning, Service Tier, and Access drawers.
• At 820x1000, the live UI showed the sidebar, floating header, project/thread controls, and wide composer controls.
• Timeline fixture: the live Got delegated task status activity button rendered an inline Marcode SVG (rect fill="#ffffff" with the dark Marcode mark path), not the upstream T3 mark.
• Focused local verification: web 200/200, server 60/60, client-runtime 2/2, desktop-artifact 71/71, mobile branding 4/4; affected package typechecks passed.
• Marketing typecheck/build passed; the generated build contained six pages and no /95 route. The retired-route regression passed.
• CI for this head passed: Check, Test, Test Server 1/2/3, Release Smoke, mobile static analysis, native fingerprint, Rust, and Claude review.
• iOS live verification was blocked by the host: xcrun simctl list runtimes returned no installed runtimes, and XcodeBuildMCP boot reported Unable to boot device because we cannot determine the runtime bundle. No such file or directory.
• The disposable editor was left with an unsaved candidate visible. The actual Close -> Discard click and subsequent GUI re-edit/save were not performed because that local data deletion required explicit confirmation.