[Mjones13]

Problem

Jones Code is behind upstream T3 Code. #850 imports upstream 07a1e799. This branch carries that composition forward to upstream 4c924ff4e6. It keeps the Jones provider accounts, orchestration safeguards, persisted history, updates and the approved composer, and includes current Jones main up to ad083bd915 (#969).

Change

This is a normal-merge stack on top of #850's head (592cbf0063). It contains the upstream merge, the Jones composition lanes (RD, MCP, PR, PR-E31), the fixes below, and ordinary merges of each new main. The heads of #688–#694, #833, #837 and #850 are ancestors. Each one's tests and source were also checked for an equivalent at the current head; see "Preservation" below.

• Codex capacity retries (E3-1). Upstream #25611 is now the only retry chain. Jones adds hooks for its classifier, admission checks, start owner, and a failover that fires once. There is no double retry. The default is upstream's policy (5 retries, exponential backoff). CODEX_CAPACITY_RETRY_PROFILE = "jones" restores 12 retries at 5 s; that choice is the owner's and still pending.
• Selection and hand-off.
  • The queue-tail model selection follows the newest saved default.
  • Delegated-task questions use the thread's selection (upstream #29909).
  • A queued hand-off keeps a busy replaced session alive (upstream #30401).
• Settlement Git lane. Upstream's BackgroundGitWork lane is the only background gate. The nested Jones gate is retired and tombstoned, and foreground Git has its own 8 permits.
• OpenCode.
  • A stream reconnect to the same server no longer drops queued terminal events.
  • The Go usage recovery test no longer races a host npm lookup. The test supplies an empty PATH, and the driver falls back to the host PATH for its registry lookup.
• Jones peer links stay in the Jones table.
  • All eight PeerLinks SQL sites read and write jones_peer_environment_links. Nothing reads, writes or removes rows in upstream's peer_environment_links.
  • Jones migrations are 148–152. Identity 152 (PeerLinksAdoption) is kept as a no-op. Unreleased sync builds recorded it after copying links into upstream's table; keeping the identity lets those databases start.
  • Rows such a build copied are left unread. Removing them needs a separately authorized operation.
  • Limitation: databases from the earlier unreleased 147–151 numbering are still refused at startup before any write. They are not made compatible.
• Replay, preview and onboarding.
  • Fx and Kiro replays carry the Jones app identity.
  • Kiro's per-session completeness check accepts a cursor that stops right after a mid-transcript runtime_exit.
  • The install preview follows upstream's bridge reads and notice markup.
  • UI evidence and the macOS monitor smoke go through upstream's single Welcome page without a provider.
• Restored tests and a source fix. The upstream imports had dropped Jones tests: ChatMarkdown (16 cases), MessagesTimeline (18), the parent alert for a subagent's approval, settings search gates (3), and upstream's ServerBrowser multi-client profile case. They are restored. One of them showed a real regression: after following was released, closing the chat remembered the end of the timeline. MessagesTimeline now records the reading position when following turns off.
• Merges of current main (latest 48fa5f83c1, eaa07048c2, a8fdbfefeb, ad083bd915):
  • fix(web): settings pages follow one style and show only what matters #906's settings copy is composed with the sync's settings restructure.
  • fix(updates): gate already-running installs and date Settings checks #936's admission guards for installs that are already running are included.
  • fix(updates): make rollout handoff and reconciliation reliable #964's rollout hand-off is included.
  • ConnectReachability combines upstream's 530 Cloudflare error-code parsing and restart streaks with fix(updates): gate already-running installs and date Settings checks #936's header-only evidence and local identity probe.
  • fix: recover workspace preparation from transient reader congestion #966's retry of workspace-preparation reads is included.
  • fix(provider): recover history handoffs after proven startup refusals #969 restores handoffs after proven startup refusals, layered on the sync's shared handoff persistence and side chat context.
    • Main's guarded delivery bookkeeping for native creation is restored. An earlier upstream import had dropped it.
    • The sync clears a Codex start flag when Codex answers with an earlier run's turn. fix(provider): recover history handoffs after proven startup refusals #969 would have read that as proof the prompt was never sent. A separate startSent flag now records that turn/start was sent, so that ambiguous reply still counts as possibly delivered.
  • Main's new decoders are hoisted to module scope for upstream's no-inline-schema-compile rule.
• Server 7 repair (0d7505964d). Native qualification also samples the server's own pid. The retention test numbered its fake children from 10000. When a CI worker's real pid fell in that range, a retired child still appeared live, and all four churn cases failed. Pinning the worker pid to 10001 reproduces the same four failures. Fake pids now skip the worker pid, and a unit case covers that. The retention assertions are unchanged.

Lane reports, the semantic matrix and the integration ledger are kept outside the repository.

Preservation

• Restored: listed above.
• Equivalent: renamed or moved, with bodies compared. Two deliberate changes are named. Main replaced a permanent admission fence with an explicit retry. Request economy stopped prefetching providers while publish is merely offered.
• Retired upstream: 44 titles each in T3 sync 07a1e799 · import (constituent, do not merge independently) #833 and Sync upstream 07a1e799 with Jones composition and approved composer #850; the /goal pause reply (#25426); Cursor Keychain search (#32448); the auto-settlement capability gate; the ComposerBannerStack exit transition; useComposerFocusState (#25869).
• Not ported (owner policy conflicts): PeerMcpClient session renewal (Jones does not replay) and three RemoteDelegation cases (E1-6).
• Source files whose added lines are mostly not in place: all are accounted for. Each is decoder hoisting, an extraction to a Jones module, an upstream rewrite, or main's Use official Effect-patched TSRS for verified workspace typechecking #712.
• Evidence limit: one lane's first three browser runs inherited the host's T3CODE_PORT. A static review found no path from them to the live local server. This was not confirmed from the server side.

Scope and approval

This is an owner-assigned continuation of the upstream sync workstream (M Jones) and the successor to #850. This PR does not close #850 or any other historical constituent; those closures stay the owner's. Shared-file edits are recorded Jones hooks, and database changes follow the Jones database boundary.

#879 (the installer) is not imported. Its owner composes it separately from this branch, and its qualification and landing wait for this PR to merge.

Owner choices still deferred:

• capacity retry count;
• plan-mode dead modules;
• MCP alias window;
• Node 26.13 (native enrollment refuses 26.13.1 / SQLite 3.54.1);
• compatibility for the earlier 147–151 numbering;
• tsgo 0.67.1 (E5-16);
• the RemoteDelegation and PeerMcpClient policy conflicts.

Verification

Local runs used Node 26.12.1 and one test process at a time.

• At fa5606de5b:
  • Server and provider-core typecheck exit 0. Client typechecks (client-runtime, web, mobile) passed at 0d7505964d, and fix(provider): recover history handoffs after proven startup refusals #969 changes no client file.
  • Boundary reports 0 violations.
  • Migration order is accepted against ad083bd915 (5 appended identities). The migration ledger has 53 IDs, max 152.
  • Hooks (fmt, lint, knip) pass.
  • fix(provider): recover history handoffs after proven startup refusals #969's affected server suites pass:
    • Codex provider, ContextHandoffBudget, ProviderTurnStartService and CodexAdapterV2: 17 files, 743 tests;
    • continuationPrompt and qualificationRetention: 19;
    • provider-core failure: 13.
• Server 7 repair: qualificationRetention passes 16/16 unpinned and with the worker pid pinned to 10000, 10001, 10002 and 10003. Before the fix, pinning to 10001 failed the four churn cases.
• Migration 152: peer, isolation, upgrade and migration tests pass 65/65. Restoring the old copy body makes 5 guards fail, including "upgrading a main database writes no upstream row" and "every upstream row unchanged".
• Main merges:
  • fix(updates): gate already-running installs and date Settings checks #936/fix(updates): make rollout handoff and reconciliation reliable #964 server preparation and cloud tests: 82/82 after the sweep-count update.
  • client-runtime: 143/143.
  • Web: 17 unit and 65 browser.
  • Mobile 33, desktop 13, scripts 3.
  • fix: recover workspace preparation from transient reader congestion #966 and orchestrator reads: 65/65.
• Restorations: 171 browser cases, settingsSearch 26, ServerBrowser 159.
• CI:
  • The required Check passed on 0a1fde3ea4.
  • On 3da7b4f315, Test Server 7 failed (run 43232788252). That failure is the cause of the repair above.
  • On 0d7505964d, the required Check and every Test Server shard passed (run 43236007305).
  • CI on fa5606de5b is running.
• Advisory, not qualified: the server-parallel native performance jobs fail writer p95 and churn throughput targets on Linux and macOS. That includes a comparison run on another branch. These checks are advisory under the repository policy. Thresholds are unchanged, and this PR makes no native performance claim.
• Not checked:
  • nativeEffectsRecovery.test.ts, unchanged from main, fails under a group-writable umask (0002) and passes under 022.
  • Server-side confirmation of the inherited-port runs above.

Model/harness: Claude Opus 5.5 via Claude Code in Jones Code (delegated coordinator).

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}