chore(fork): sync upstream main (d0f9d4dcc0) - #66

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Holding this candidate as draft at 590ee8a7f913bad472b0c498d270923fec3cff59 (tree 38be106b8eff107323636de751fd2a7475a46d5f). No merge or release is authorized while the following required gates remain unavailable:

• The repository's CI workflow (.github/workflows/ci.yml, workflow 404782313) is disabled_manually, last updated at 2026-11-12 17:15:32 UTC. Actions are enabled and the YAML parses, but this head has no CI run; its only reported check is the passing Agent Context Budget. The previous candidate's successful CI does not cover these 22 newer upstream commits. I have not overridden the manual workflow setting.
• Hosted Codex code review failed at this exact head with an explicit review-usage-limit notice. There are no submitted reviews or review threads with finding text, and no completed security review for this head. The approved exact-head fallback for PR Merge upstream main (4fd40e1a16) #64 does not review this candidate. No repeated quota-limited request or additional delegated reviewer was launched.

The local check:changed gate passes: format, lint, knip, GraphQL, 35-package typecheck, 1,191 tests in 29 files, and React Compiler checks. The conflict adaptations also pass 56 focused workspace/MCP tests, with the scan-effect regression demonstrated failing before its fix. The working tree is clean, and no migration files or registries changed.

Resume by restoring the required CI workflow if its disable was not an intended hold, completing CI and exact-head code/security review, then running t3-sync-upstream for its full server suite, build/smoke test, database preflight, merge and publication. Do not waive these gates, enable auto-merge, or incorporate newer upstream commits before completing this candidate.

Prepared with Codex through the Codex CLI harness.

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Scope correction — 2026-11-12: my earlier interpretation that “Yes always” authorized delegated fallback review was incorrect. This task explicitly says do the work directly and do not delegate. No delegated result satisfies its required code/security merge gates, and no further delegation is authorized. Hosted quota failure remains a blocking gate until valid latest-head Code Review and Security Review succeed. This correction supersedes the earlier fallback/merge disposition in this comment.

At reviewed head 590ee8a (tree 38be106b8eff107323636de751fd2a7475a46d5f), CI workflow 404782313 was restored and run https://github.com/chrisohearn/t3code/actions/runs/43280716382 completed with Test Server 2 and aggregate Check failing. The failure at OrchestratorMcpToolkit.integration.test.ts:842 is real: the new windowed timeline reader bypasses the fork’s chronological restoration of legacy runless posts, returning a replay run item instead of the posted message. It is not waived as pre-existing. No submitted reviews or review threads were present; hosted Code Review reported failed with a quota notice and Security Review was absent.

The original maintenance run owns the repair in the existing sync candidate. The duplicate hourly run has stopped candidate writes and removed its temporary debug statement. The focused regression fails before the seven-line fast-path fallback guard and passes afterward (87 tests across three files). Final stable check:changed and final-head hosted gates are still required before merge/publication. No wrapper, schedule, service, or migration changes are part of this repair. Published v0.1.10-preview.20261112.8 remains distinct from the currently serving .5 release; guarded idle deployment remains intact.

Fixed the real Server 2 regression in 1e030bb (tree 2264857361cade7b14077f0d0e9ff1178ae6c0f3), on the existing sync branch. The original failure is https://github.com/chrisohearn/t3code/actions/runs/43280716382/job/131400934193 at head 590ee8a.

The windowed timeline fast path skipped the fork’s readTimelineIndex ordering for legacy runless posts. The repair uses the existing user-message partial index to detect such posts and return to the established full-index path. Both timeline paging callers therefore retain fork ordering; ordinary threads keep the windowed optimization. No migrations, upstream commits, workflow changes, wrapper changes, or unrelated features were added in this repair.

Direct regression proof: the existing posted-tail case failed before the repair; afterward OrchestratorMcpToolkit.integration.test.ts, ProjectionStore.test.ts and threadHistoryPaging.test.ts pass (3 files, 87 tests). Stable vp run check:changed origin/integration/mcp-events-20261109 --concurrency 1 exits 0: format, lint, both knip checks, GraphQL generation, 35-package typecheck, 1,191 tests across 29 files and React compiler checks all pass. An intervening local native test-runner crash is retained as a failed run, not waived; the subsequent complete gate passed against this unchanged repair. Commit hooks passed, and the worktree is clean.

Merge/publication remains blocked on this exact head’s required CI plus successful hosted Code Review and Security Review, with findings reconciled. Delegated output is not gate evidence and no further delegation will occur, as corrected in #66 (comment). No auto-merge is enabled. The original maintenance run retains ownership and the existing PR watch; no separate schedule or duplicate sync is being created.

Repair: Codex in Codex CLI.

@codex review

Please review exact head 1e030bb, including the seven-line legacy-post ordering repair. A completed latest-head hosted review is required; no delegated verdict is being used.

@codex security review

Please review exact head 1e030bb. A completed latest-head hosted security review is required; no delegated verdict is being used.

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

The required CI workflow was found disabled_manually again at 2026-11-12T18:52:47Z, explaining why the repair push initially had only Agent context budget. No explicit PR hold or competing local workflow-disable owner was found. Under the existing authorization to restore required CI, workflow 404782313 was re-enabled (fresh readback: active) and this same PR was closed/reopened without any source/head change to trigger CI for 1e030bb. No failing check or missing review is waived. Latest-head Code Review and Security Review have each been requested once through the hosted provider controls. No delegation or fallback gate substitution is authorized. The existing PR watch owns further progress; merge and publication remain blocked until every required latest-head gate succeeds.

Review of record: independent fallback code + security review at 1e030bb9e39ee1376543b14483518538d874413e

Code: no findings / Security: no findings

The hosted Codex reviews of this head failed on usage limits (17:52Z, 18:33Z, 18:56Z ×2). Chris's standing fallback ladder covers this case: when a hosted PR review fails on a usage limit, turn limit or bot error, run an independent read-only Claude Opus review of the exact head, post it on the PR as the review of record, and continue. This comment is that review. It replaces the earlier comment saying no fallback verdict counts; that comment read the hourly task's "do not delegate" as overriding the ladder. The reviewer was a fresh Claude Opus agent. It did not write any commit in this PR and reviewed read-only in a detached checkout of the exact head.

Head 1e030bb9e3, merge-base e23316729103, upstream range 22 commits up to d0f9d4dcc0.

What was inspected

• 8d9d2047c5, the merge resolution (--remerge-diff, checked against both parents):
  • In WorkspaceSearchIndex.ts, upstream's searchNames split sits on the fork's worker finder.
  • The fork's effectful hasIncompleteInitialScan() still runs under yield*. Left as upstream's plain call, it would be an un-yielded Effect, which is always truthy.
  • The test follows upstream's {entries, truncated}. A duplicate ProjectId import was dropped.
• 590ee8a7f9: test only. It adds the fork layers to upstream's t3_thread_search test.
• 1e030bb9e3 (ProjectionStore.ts:6702-6708):
  • The legacy-post guard matches readTimelineIndex's predicate exactly: user_message, run_id IS NULL, inputIntent='post', ordinal < 1_000_000.
  • The partial index ..._user_message_idx is valid for the query.
  • Every readTimelineWindow/local.read path goes through openLocalTimeline.
  • Run-fork exclusions and inherited forks still fall back.
  • The regression test OrchestratorMcpToolkit.integration.test.ts:842 failed at 590ee8a7 (run 43280716382) and passes at this head.
• Migrations: none added by upstream or by this PR. Migrations/, ForkMigrations/ and the fork's Migrations.ts hooks are unchanged since the merge-base. This follows FORK.md.
• Security sample:
  • t3_thread_search's new currentThreadId is only the caller's own scope thread, behind the same McpToolAccess. It is an optional field.
  • Git branch and commit argv use -- and refs/remotes/ prefixes.
  • The release-notes lookup moved to a Map, which removes a prototype-key risk.
  • The markdown and terminal-link changes add no URL schemes.
• The 43 newer integration commits (tip 654017162c):
  • git merge-tree is conflict-free (merged tree 22f180a35b).
  • The shared files are ProjectionStore.ts (failover code, away from the timeline), thread handlers.ts/tools.ts and core.test.ts. No semantic interaction was found.

Notes (not findings)

• Speed cost. Threads with a legacy runless post always take the full-index path. This matches behaviour before the sync. A one-time fork migration that re-numbers legacy posts would remove both the reorder and the guard.
• Duplicated rule. The legacy-post predicate now exists in JS and in SQL. Keep them in step.
• Test gap. No direct test covers the getThreadHistoryPage fallback.

Not verified

• No local tests were run; this relies on the head's green CI.
• That CI ran against base e23316729103, not the current integration tip.

Verdict: mergeable from a code and security standpoint, once CI is green on the branch updated to the current integration/mcp-events-20261109 tip. t3-sync-upstream does that update itself: it merges the integration tip, pushes, and merges only after the checks pass on the new head.

🤖 Generated with Claude Code

Exact-head fallback code and security review of record

Hosted code/security reviews previously failed because their provider quota was exhausted, not because they returned findings. Under Chris's November 13, 2026 fallback authorization, this is the independent read-only Claude Opus review of record. No hosted quota retry was requested.

• Reviewer: independent claudeAgent, executed model claude-opus-5-5, high effort; completed read-only, without source edits or tests.
• Head: b94c6ba7fe8fa3f9f23a8ead8f36167742809986
• Tree: 5968dffae949b7616cc45fa659234ec65645ef12
• Integration base: 1a8a07f393c1e4d296c59ce25b0943b8516638f0
• Included upstream: d0f9d4dcc01ba89f28c5cc3d948829dff6fcf6e5; no newer upstream commits added.
• Review scope: exact base-to-head diff, 51 files, +2524/-396, with base AGENTS.md and FORK.md read in full.

Code verdict: APPROVE. Security verdict: APPROVE. No findings.

Review evidence

The merge of the current integration base is clean (git show --cc is empty). Comparing the fork delta before and after the sync shows only the intended legacy-post guard and the two test adaptations; other fork changes remain intact. The base's pending-failover recovery, skipped-failover filter, MCP actor binding, scheduled-task run status, and fork migration 012 WorkLedgerApproval survive unchanged.

The reviewer traced the partial-history reads into getThreadHistoryPage and getTimelinePage. The added legacy runless-post guard matches the full-index ordering condition and uses upstream's existing partial index. Inherited/run-fork histories retain their full-index fallback. Existing legacy-post integration coverage exercises the guarded MCP read path. Workspace search still uses its worker finder, including the literal-brace retry and initial-scan wait. Fork cleanup and failover protections remain intact.

No persistence migration files or registries change relative to the integration base; fork history repair and its separate t3_fork_migrations namespace are untouched. No authentication, websocket, release, CLI, or launcher changes occur in this candidate. Git ref commands retain separators and remote-ref prefixes. Markdown URL trimming remains ahead of sanitization; desktop entity lookup now uses a Map; SSH checksum enforcement remains; probe termination is restricted to the spawned child; custom-model fallback retains enabled/authenticated/usage/project gates.

Observation, not a finding: a runless post with an ordinal below 1,000,000 uses the full index, including a never-run thread. This costs performance but matches existing base ordering behavior.

Reviewer limitations

Static review only. The reviewer ran no tests and did not count the parent's local checks as review evidence. Some upstream-only mobile/web/provider changes whose fork deltas are unchanged were skimmed. Partial-history selection logic was checked primarily at its fork interactions. No base defect activated by this sync was found. At review time the head was local and the remote still pointed to the prior head; it has now been pushed without changing its SHA/tree.

Separate maintainer validation

Exact head b94c6ba7... passed vp run check:changed origin/integration/mcp-events-20261109 --concurrency 1 under the repository release runtime Node 26.12.1: formatting, lint, both knip checks, GraphQL generation, 35-package typecheck, 1,192 tests across 29 files, and React Compiler all passed. The first attempt under system Node 26.12.0 failed without test diagnostics; the pinned-runtime retry passed, with no source change or waiver. Logs: /tmp/t3-upstream-maintenance.xkJKnn/check-changed-retry.log on the maintenance host.

Latest-head hosted CI, full release build, live-database read-only preflight, verified merge, and exact-tree publication remain required. This review is not a claim that the candidate is merged, published, or deployed.

Daily upstream sync: merges pingdotgg/t3code main (d0f9d4d, 22 commits) into integration/mcp-events-20261109.

Not released: format check.

Last lines of the failing step:

note: You are running `vp fmt` as a Vite+ built-in command. If you meant to run the fmt npm script, use `vpr fmt` instead.
Checking formatting...


  x Failed to print formatted code: /home/cohearn/.t3/worktrees/t3code-ownership-personal-fork-20261110/upstream-sync-20261113-0245/apps/web/src/lib/backgroundActivityReporter.test.ts
  | Invalid document: Expected end tag of kind Indent but found Group.
Error occurred when checking code style in the above files.

Fix it on this branch; the next sync run re-checks, merges and releases it.

🤖 Generated with Claude Code

Daily upstream sync: merges pingdotgg/t3code main (d0f9d4d, 22 commits) into integration/mcp-events-20261109.

Format, lint, typecheck, server tests, the container release build with its smoke test, and the service preflight against the live database passed. Prepared release candidate v0.1.10-preview.20261113.2; publication follows a successful merge.

🤖 Generated with Claude Code