From 4432fbef71817c279290f86549be660af25005f2 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 03:10:52 -0700
Subject: [PATCH 001/146] feat(antigravity): Claude and GPT models, thinking
 levels, and diff edits (#26876)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/AntigravityAdapterV2.test.ts     | 80 ++++++-------------
 .../Adapters/AntigravityAdapterV2.ts          | 16 +---
 .../src/provider/AntigravityInstallation.ts   |  1 -
 .../src/provider/AntigravityProvider.test.ts  | 44 ++++++++++
 .../src/provider/AntigravityProvider.ts       | 45 ++++++++++-
 .../src/provider/Drivers/AntigravityDriver.ts | 17 +++-
 .../acp/AntigravityAcpSupport.test.ts         | 36 ++++++++-
 .../src/provider/acp/AntigravityAcpSupport.ts | 50 ++++++++++--
 .../provider/acp/AntigravityClientFiles.ts    | 19 -----
 .../provider/acp/AntigravityProtocol.test.ts  |  7 +-
 .../src/provider/acp/AntigravityProtocol.ts   | 12 ++-
 .../server/src/provider/antigravityRelease.ts | 63 ++++++++-------
 apps/server/src/provider/model-manifest.json  |  8 +-
 .../provider/providerCompatibility.test.ts    | 18 +++++
 .../AntigravityTextGeneration.test.ts         |  1 +
 .../AntigravityTextGeneration.ts              |  1 +
 docs/user/providers-antigravity.md            | 12 ++-
 packages/provider-acp/src/server/adapter.ts   | 17 ++--
 18 files changed, 298 insertions(+), 149 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
index 4876465a960d3..f69e3696fc45c 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
@@ -127,7 +127,7 @@ const layerSession = Layer.mergeAll(
 );
 
 describe("AntigravityAdapterV2 client file system", () => {
-  it.effect("confines agent file requests to the workspace under full access", () =>
+  it.effect("serves confined reads and leaves edits to the agent's diff tools", () =>
     Effect.gen(function* () {
       const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
       const fileSystem = yield* FileSystem.FileSystem;
@@ -140,6 +140,8 @@ describe("AntigravityAdapterV2 client file system", () => {
       // effect-acp keeps the last handler registered per method; so does this.
       let readTextFile: Parameters<RuntimeService["handleReadTextFile"]>[0] | undefined;
       let writeTextFile: Parameters<RuntimeService["handleWriteTextFile"]>[0] | undefined;
+      const logs = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-antigravity-log-" });
+      const requestLog = path.join(logs, "requests.ndjson");
       const crypto = yield* Crypto.Crypto;
       const instanceId = ProviderInstanceId.make("antigravity-containment-test");
       const adapter = yield* makeAntigravityAdapterV2({
@@ -153,7 +155,7 @@ describe("AntigravityAdapterV2 client file system", () => {
               command: process.execPath,
               args: [mockAgentPath],
               cwd: input.cwd,
-              env: { T3_ACP_ANTIGRAVITY: "1" },
+              env: { T3_ACP_ANTIGRAVITY: "1", T3_ACP_REQUEST_LOG_PATH: requestLog },
             },
           }).pipe(
             Effect.provideService(Crypto.Crypto, crypto),
@@ -198,17 +200,31 @@ describe("AntigravityAdapterV2 client file system", () => {
         runtimePolicy,
       });
       yield* session.ensureThread({ threadId, modelSelection, runtimePolicy });
-      if (readTextFile === undefined || writeTextFile === undefined) {
-        return yield* Effect.die("Antigravity sessions must serve client file requests");
+      const initialize = (yield* fileSystem.readFileString(requestLog))
+        .trim()
+        .split("\n")
+        .map(
+          (line) =>
+            JSON.parse(line) as {
+              method?: string;
+              params?: { clientCapabilities?: { fs?: unknown }; clientInfo?: { name?: string } };
+            },
+        )
+        .find((request) => request.method === "initialize");
+      assert.deepEqual(initialize?.params?.clientCapabilities?.fs, {
+        readTextFile: true,
+        writeTextFile: false,
+      });
+      assert.equal(initialize?.params?.clientInfo?.name, "zed");
+      assert.isUndefined(writeTextFile);
+      if (readTextFile === undefined) {
+        return yield* Effect.die("Antigravity sessions must serve client file reads");
       }
       const context = (method: string) => ({ requestId: `test-${method}`, method });
 
       const insidePath = path.join(workspace, "src", "inside.ts");
-      yield* writeTextFile(
-        { sessionId: "mock-session-1", path: insidePath, content: "inside" },
-        context("fs/write_text_file"),
-      );
-      assert.equal(yield* fileSystem.readFileString(insidePath), "inside");
+      yield* fileSystem.makeDirectory(path.dirname(insidePath), { recursive: true });
+      yield* fileSystem.writeFileString(insidePath, "inside");
       const pasted = yield* readTextFile(
         { sessionId: "mock-session-1", path: attachment },
         context("fs/read_text_file"),
@@ -220,13 +236,6 @@ describe("AntigravityAdapterV2 client file system", () => {
         context("fs/read_text_file"),
       ).pipe(Effect.exit);
       assert.isTrue(Exit.isFailure(outsideRead));
-      const outsideWrite = yield* writeTextFile(
-        { sessionId: "mock-session-1", path: path.join(outside, "planted.txt"), content: "x" },
-        context("fs/write_text_file"),
-      ).pipe(Effect.exit);
-      assert.isTrue(Exit.isFailure(outsideWrite));
-      assert.isFalse(yield* fileSystem.exists(path.join(outside, "planted.txt")));
-
       const linkPath = path.join(workspace, "linked-secret.txt");
       yield* fileSystem.symlink(outsideFile, linkPath);
       const linkedRead = yield* readTextFile(
@@ -234,45 +243,6 @@ describe("AntigravityAdapterV2 client file system", () => {
         context("fs/read_text_file"),
       ).pipe(Effect.exit);
       assert.isTrue(Exit.isFailure(linkedRead), "a read through an escaping symlink is denied");
-      const linkedWrite = yield* writeTextFile(
-        { sessionId: "mock-session-1", path: linkPath, content: "overwritten" },
-        context("fs/write_text_file"),
-      ).pipe(Effect.exit);
-      assert.isTrue(Exit.isFailure(linkedWrite), "a write through an escaping symlink is denied");
-      assert.equal(yield* fileSystem.readFileString(outsideFile), "secret");
-      const plantedTarget = path.join(outside, "created-through-link.txt");
-      const danglingLink = path.join(workspace, "dangling.txt");
-      yield* fileSystem.symlink(plantedTarget, danglingLink);
-      const danglingWrite = yield* writeTextFile(
-        { sessionId: "mock-session-1", path: danglingLink, content: "planted" },
-        context("fs/write_text_file"),
-      ).pipe(Effect.exit);
-      assert.isTrue(Exit.isFailure(danglingWrite), "a write through a dangling symlink is denied");
-      assert.isFalse(yield* fileSystem.exists(plantedTarget));
-      yield* fileSystem.symlink(outside, path.join(workspace, "linked-dir"));
-      const linkedDirWrite = yield* writeTextFile(
-        {
-          sessionId: "mock-session-1",
-          path: path.join(workspace, "linked-dir", "new.txt"),
-          content: "planted",
-        },
-        context("fs/write_text_file"),
-      ).pipe(Effect.exit);
-      assert.isTrue(Exit.isFailure(linkedDirWrite), "a write under an escaping directory link");
-      assert.isFalse(yield* fileSystem.exists(path.join(outside, "new.txt")));
-      const nestedLinkedDirWrite = yield* writeTextFile(
-        {
-          sessionId: "mock-session-1",
-          path: path.join(workspace, "linked-dir", "a", "b", "file.txt"),
-          content: "planted",
-        },
-        context("fs/write_text_file"),
-      ).pipe(Effect.exit);
-      assert.isTrue(
-        Exit.isFailure(nestedLinkedDirWrite),
-        "a write to missing directories under an escaping directory link",
-      );
-      assert.isFalse(yield* fileSystem.exists(path.join(outside, "a")));
       const insideLink = path.join(workspace, "inside-link.ts");
       yield* fileSystem.symlink(insidePath, insideLink);
       const viaInsideLink = yield* readTextFile(
diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
index 2c41e007edf65..36c58a29ecaee 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
@@ -23,10 +23,7 @@ import {
   buildAntigravityPrompt,
   type AntigravityAcpRuntimeInput,
 } from "../../provider/acp/AntigravityAcpSupport.ts";
-import {
-  readAntigravityClientTextFile,
-  writeAntigravityClientTextFile,
-} from "../../provider/acp/AntigravityClientFiles.ts";
+import { readAntigravityClientTextFile } from "../../provider/acp/AntigravityClientFiles.ts";
 import {
   antigravityApprovalOptions,
   antigravitySubagentOutput,
@@ -82,7 +79,7 @@ export interface AntigravityAdapterV2Options {
   readonly continuationRequests?: Parameters<typeof makeAcpAdapterV2>[0]["continuationRequests"];
 }
 
-/** ACP 1.1.1 reports `start_subagent` tools without child session ids. */
+/** Native subagent tools report no child session ids. */
 const extractAntigravitySubagentUpdate: NonNullable<AcpAdapterV2Flavor["extractSubagentUpdate"]> = (
   toolCall,
 ) => {
@@ -126,7 +123,7 @@ export function makeAntigravityAcpAdapterFlavor(
           Scope.close(scope, Exit.void),
           options.makeRuntime({
             ...input,
-            clientFileSystem: true,
+            clientFileReads: true,
             additionalDirectories: [options.host.paths.attachmentsDir],
           }),
         )
@@ -191,13 +188,6 @@ export function makeAntigravityAcpAdapterFlavor(
           allowedRoots: antigravityClientFileRoots(cwd),
           request,
         }),
-      writeTextFile: (request, cwd) =>
-        writeAntigravityClientTextFile({
-          fileSystem: options.fileSystem,
-          path: options.path,
-          allowedRoots: antigravityClientFileRoots(cwd),
-          request,
-        }),
     },
     approvalOptions: antigravityApprovalOptions,
     extractPermissionQuestion: (request) => {
diff --git a/apps/server/src/provider/AntigravityInstallation.ts b/apps/server/src/provider/AntigravityInstallation.ts
index 3d590abda0bdb..902e6508ca25d 100644
--- a/apps/server/src/provider/AntigravityInstallation.ts
+++ b/apps/server/src/provider/AntigravityInstallation.ts
@@ -398,7 +398,6 @@ export const makeAntigravityInstallation = Effect.fn("AntigravityInstallation.ma
                   }),
                 )
               : spawner,
-          clientInfo: { name: "t3-code", version: "0.0.0" },
         });
         const initialized = yield* runtime.initialize();
         if (
diff --git a/apps/server/src/provider/AntigravityProvider.test.ts b/apps/server/src/provider/AntigravityProvider.test.ts
index ade033551f655..35f279f29ddcc 100644
--- a/apps/server/src/provider/AntigravityProvider.test.ts
+++ b/apps/server/src/provider/AntigravityProvider.test.ts
@@ -214,6 +214,50 @@ describe("Antigravity model catalog", () => {
       "gemini-pro-agent",
     );
   });
+
+  it("offers each model the thinking levels it reported when selected", () => {
+    const thinking = (currentValue: string) =>
+      ({
+        id: "thinking_level",
+        name: "Thinking Level",
+        category: "thought_level",
+        type: "select",
+        currentValue,
+        options: [
+          { value: "low", name: "Low" },
+          { value: "high", name: "High" },
+        ],
+      }) satisfies EffectAcpSchema.SessionConfigOption;
+    const models = buildAntigravityModelsFromSession(
+      {
+        configOptions: [
+          {
+            ...modelConfig,
+            currentValue: "gemini",
+            options: [
+              { value: "gemini", name: "Gemini" },
+              { value: "claude", name: "Claude" },
+              { value: "plain", name: "Plain" },
+              { value: "unseen", name: "Unseen" },
+            ],
+          },
+          thinking("high"),
+        ],
+      },
+      new Map([
+        ["claude", thinking("low")],
+        ["plain", null],
+      ]),
+    );
+    const thinkingOf = (slug: string) =>
+      models.find((model) => model.slug === slug)?.capabilities?.optionDescriptors?.[0];
+
+    expect(thinkingOf("gemini")).toMatchObject({ id: "thinking_level", currentValue: "high" });
+    expect(thinkingOf("claude")).toMatchObject({ id: "thinking_level", currentValue: "low" });
+    expect(thinkingOf("plain")).toBeUndefined();
+    expect(thinkingOf("unseen")).toMatchObject({ id: "thinking_level" });
+    expect(thinkingOf("unseen")).not.toHaveProperty("currentValue");
+  });
 });
 
 it.layer(layerTest)("Antigravity provider snapshots", (it) => {
diff --git a/apps/server/src/provider/AntigravityProvider.ts b/apps/server/src/provider/AntigravityProvider.ts
index c6809c3577132..988661a7ce614 100644
--- a/apps/server/src/provider/AntigravityProvider.ts
+++ b/apps/server/src/provider/AntigravityProvider.ts
@@ -20,6 +20,7 @@ import type * as EffectAcpErrors from "effect-acp/errors";
 import type * as EffectAcpSchema from "effect-acp/compat";
 
 import type * as AcpSessionRuntime from "@t3tools/provider-acp/server/AcpSessionRuntime";
+import { acpProviderOptionDescriptors } from "@t3tools/provider-acp/server/sessionConfig";
 import { makeManagedServerProvider } from "@t3tools/provider-core/server/managedProvider";
 import {
   makeManualOnlyProviderMaintenanceCapabilities,
@@ -32,6 +33,8 @@ import {
 } from "@t3tools/provider-core/server/snapshotProbe";
 import { resolveUsageLimitsAfterProbe } from "@t3tools/provider-core/server/usageLimits";
 
+import { antigravityThinkingConfig } from "./acp/AntigravityAcpSupport.ts";
+
 const EMPTY_MODEL_CAPABILITIES = createModelCapabilities({ optionDescriptors: [] });
 const MAX_WORKSPACE_SNAPSHOTS = 32;
 const HEALTH_CHECK_TIMEOUT = "90 seconds";
@@ -44,8 +47,24 @@ type SessionSetupResult = Pick<
   "configOptions" | "models"
 >;
 
+type ThinkingConfig = NonNullable<ReturnType<typeof antigravityThinkingConfig>>;
+
+/** Thinking options each model reported when selected; `null` means it has none. */
+export type AntigravityThinkingLevels = ReadonlyMap<string, ThinkingConfig | null>;
+
+function thinkingCapabilities(config: ThinkingConfig | null | undefined, observed: boolean) {
+  const descriptor = config
+    ? acpProviderOptionDescriptors({ configOptions: [config], modeState: undefined })[0]
+    : undefined;
+  if (descriptor?.type !== "select") return EMPTY_MODEL_CAPABILITIES;
+  // Another model's selected level is not this model's default.
+  const { currentValue: _currentValue, ...unobserved } = descriptor;
+  return createModelCapabilities({ optionDescriptors: [observed ? descriptor : unobserved] });
+}
+
 export function buildAntigravityModelsFromSession(
   setup: SessionSetupResult,
+  thinkingLevels: AntigravityThinkingLevels = new Map(),
 ): ReadonlyArray<ServerProviderModel> {
   const config = setup.configOptions?.find(
     (option) => option.id === "model" || option.category === "model",
@@ -61,10 +80,13 @@ export function buildAntigravityModelsFromSession(
             name: model.name,
           })) ?? [])
         : [];
+  const currentThinking = antigravityThinkingConfig(setup.configOptions);
   const seen = new Set<string>();
   return entries.flatMap((entry): ServerProviderModel[] => {
     if (!entry.value.trim() || seen.has(entry.value)) return [];
     seen.add(entry.value);
+    const observed =
+      entry.value === currentValue ? (currentThinking ?? null) : thinkingLevels.get(entry.value);
     return [
       {
         slug: entry.value,
@@ -73,7 +95,10 @@ export function buildAntigravityModelsFromSession(
         ...(entry.value === currentValue
           ? { isDefault: true, aliases: [ANTIGRAVITY_DEFAULT_MODEL] }
           : {}),
-        capabilities: EMPTY_MODEL_CAPABILITIES,
+        capabilities:
+          observed === undefined
+            ? thinkingCapabilities(currentThinking, false)
+            : thinkingCapabilities(observed, true),
       },
     ];
   });
@@ -162,6 +187,17 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
   });
   // Preserve disk-discovered skills when callbacks replace workspace commands; the registry will not rescan them.
   const discoveredSkills = new Map<string, ServerProvider["skills"]>();
+  const thinkingLevels = new Map<string, ThinkingConfig | null>();
+  const observeThinkingLevels = (
+    configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption> | null | undefined,
+  ) => {
+    const model = configOptions?.find(
+      (option) => option.id === "model" || option.category === "model",
+    );
+    if (model?.type === "select" && model.currentValue) {
+      thinkingLevels.set(model.currentValue, antigravityThinkingConfig(configOptions) ?? null);
+    }
+  };
   const getSnapshot = SubscriptionRef.get(metadata).pipe(
     Effect.flatMap((state) => options.stampIdentity(state.draft)),
   );
@@ -267,6 +303,7 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
     cwd?: string,
   ) {
     if (!settings.enabled) return;
+    observeThinkingLevels(started.sessionSetupResult.configOptions);
     const before = yield* SubscriptionRef.get(metadata);
     const supportsTextGeneration = yield* options.supportsTextGeneration;
     const usageLimits =
@@ -301,7 +338,7 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
             published: draft.usageLimits,
             probed: usageLimits ?? draft.usageLimits,
           }),
-          models: buildAntigravityModelsFromSession(started.sessionSetupResult),
+          models: buildAntigravityModelsFromSession(started.sessionSetupResult, thinkingLevels),
           supportsTextGeneration,
           ...(cwd
             ? {
@@ -324,7 +361,8 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
   const onConfigOptionsUpdated = Effect.fn("AntigravityProvider.onConfigOptionsUpdated")(function* (
     configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption>,
   ) {
-    const models = buildAntigravityModelsFromSession({ configOptions });
+    observeThinkingLevels(configOptions);
+    const models = buildAntigravityModelsFromSession({ configOptions }, thinkingLevels);
     yield* SubscriptionRef.update(metadata, (state) => {
       if (state.draft.auth.status !== "authenticated") return state;
       return { ...state, draft: { ...state.draft, models } };
@@ -391,6 +429,7 @@ export const makeAntigravityProvider = Effect.fn("makeAntigravityProvider")(func
         }) satisfies AntigravityProviderState,
     );
     discoveredSkills.clear();
+    thinkingLevels.clear();
   });
 
   const snapshotForCwd = Effect.fn("AntigravityProvider.snapshotForCwd")(function* (
diff --git a/apps/server/src/provider/Drivers/AntigravityDriver.ts b/apps/server/src/provider/Drivers/AntigravityDriver.ts
index fd5725c6cd798..f1f39e104b44c 100644
--- a/apps/server/src/provider/Drivers/AntigravityDriver.ts
+++ b/apps/server/src/provider/Drivers/AntigravityDriver.ts
@@ -38,6 +38,8 @@ import {
   type AntigravityAuthConfig,
 } from "../antigravityAuthSupport.ts";
 import {
+  antigravityModelOptions,
+  antigravityThinkingConfig,
   makeAntigravityAcpRuntime,
   type AntigravityAcpRuntimeInput,
 } from "../acp/AntigravityAcpSupport.ts";
@@ -294,7 +296,6 @@ export const AntigravityDriver: ProviderDriver<
       );
       const runtime = yield* makeRuntime({
         cwd,
-        clientInfo: { name: "t3-code-provider-setup", version: "0.0.0" },
         mcpServers: [],
         ...(input.onAuthorizationUrl ? { onAuthorizationUrl: input.onAuthorizationUrl } : {}),
       });
@@ -313,7 +314,10 @@ export const AntigravityDriver: ProviderDriver<
 
     const publishCatalog = Effect.fn("AntigravityDriver.publishCatalog")(function* (
       started: AcpSessionRuntime.AcpSessionRuntimeStartResult,
-      runtime: Pick<AcpSessionRuntime.AcpSessionRuntime["Service"], "getEvents" | "drainEvents">,
+      runtime: Pick<
+        AcpSessionRuntime.AcpSessionRuntime["Service"],
+        "getEvents" | "drainEvents" | "setModel"
+      >,
     ) {
       yield* provider.onSessionStarted(started);
       yield* Stream.runForEach(runtime.getEvents(), (event) => {
@@ -327,6 +331,14 @@ export const AntigravityDriver: ProviderDriver<
           ? provider.onAvailableCommands(event.availableCommands)
           : Effect.void;
       }).pipe(Effect.forkScoped);
+      // Thinking levels differ per model and are reported only for the selected one.
+      const configOptions = started.sessionSetupResult.configOptions ?? [];
+      const current = configOptions.find((option) => option.id === "model")?.currentValue;
+      if (antigravityThinkingConfig(configOptions) !== undefined && typeof current === "string") {
+        for (const model of [...antigravityModelOptions(configOptions), { value: current }]) {
+          yield* runtime.setModel(model.value).pipe(Effect.ignore);
+        }
+      }
       yield* runtime.drainEvents;
     }, Effect.scoped);
 
@@ -439,7 +451,6 @@ export const AntigravityDriver: ProviderDriver<
       makeRuntime: (cwd) =>
         makeRuntime({
           cwd,
-          clientInfo: { name: "t3-code-text", version: "0.0.0" },
           mcpServers: [],
         }),
     });
diff --git a/apps/server/src/provider/acp/AntigravityAcpSupport.test.ts b/apps/server/src/provider/acp/AntigravityAcpSupport.test.ts
index bd48ee767ee46..8e0eed1371c5b 100644
--- a/apps/server/src/provider/acp/AntigravityAcpSupport.test.ts
+++ b/apps/server/src/provider/acp/AntigravityAcpSupport.test.ts
@@ -38,8 +38,18 @@ function makeModelRuntime(
     if (failure) return yield* failure;
     selections.push(model);
   });
+  const setConfigOption = Effect.fn("AntigravityAcpSupportTest.setConfigOption")(function* (
+    configId: string,
+    value: string | boolean,
+    options?: { readonly allowUnlistedValue?: boolean },
+  ) {
+    selections.push(
+      `${configId}=${String(value)}${options?.allowUnlistedValue === true ? " (unlisted)" : ""}`,
+    );
+    return { configOptions };
+  });
   return {
-    runtime: { getConfigOptions: Effect.succeed(configOptions), setModel },
+    runtime: { getConfigOptions: Effect.succeed(configOptions), setModel, setConfigOption },
     selections,
   };
 }
@@ -137,6 +147,30 @@ describe("applyAntigravityAcpModelSelection", () => {
       expect(selections).toEqual(["gemini-saved"]);
     }),
   );
+
+  it.effect("passes a model ID saved on runtime 1.3 to the agent as its 1.4 family", () =>
+    Effect.gen(function* () {
+      // The cold-resume model has no thinking option, so the level is unknown locally.
+      const { runtime, selections } = makeModelRuntime([
+        {
+          ...modelConfig,
+          currentValue: "gpt-oss-120b-medium",
+          options: [
+            { value: "gemini-3.8-flash", name: "Gemini 3.8 Flash" },
+            { value: "gpt-oss-120b-medium", name: "GPT-OSS 120B (Medium)" },
+          ],
+        },
+      ]);
+      const model = yield* applyAntigravityAcpModelSelection({
+        runtime,
+        model: "gemini-3.8-flash-low",
+        mapError: (cause) => cause,
+      });
+
+      expect(model).toBe("gemini-3.8-flash");
+      expect(selections).toEqual(["model=gemini-3.8-flash-low (unlisted)"]);
+    }),
+  );
 });
 
 const imageAttachment = {
diff --git a/apps/server/src/provider/acp/AntigravityAcpSupport.ts b/apps/server/src/provider/acp/AntigravityAcpSupport.ts
index ac64c9da2a469..a57fc08f9b7af 100644
--- a/apps/server/src/provider/acp/AntigravityAcpSupport.ts
+++ b/apps/server/src/provider/acp/AntigravityAcpSupport.ts
@@ -31,6 +31,7 @@ export interface AntigravityAcpRuntimeInput extends Omit<
   | "authenticateEagerly"
   | "cancelBehavior"
   | "clientCapabilities"
+  | "clientInfo"
   | "onStderr"
   | "resumeMethod"
   | "transformSessionUpdate"
@@ -38,7 +39,7 @@ export interface AntigravityAcpRuntimeInput extends Omit<
 > {
   readonly childProcessSpawner: ChildProcessSpawner.ChildProcessSpawner["Service"];
   readonly onAuthorizationUrl?: (url: string) => Effect.Effect<void, EffectAcpErrors.AcpError>;
-  readonly clientFileSystem?: boolean;
+  readonly clientFileReads?: boolean;
   readonly authMethod?: AntigravityAuthMethod;
 }
 
@@ -56,11 +57,11 @@ export const makeAntigravityAcpRuntime = Effect.fn("makeAntigravityAcpRuntime")(
       authenticateEagerly: true,
       resumeMethod: "resume",
       cancelBehavior: "wait-for-prompt",
+      // The agent offers non-Gemini models only to allowlisted clients such as Zed.
+      clientInfo: { name: "zed", version: "0.0.0" },
       clientCapabilities: {
-        fs: {
-          readTextFile: input.clientFileSystem === true,
-          writeTextFile: input.clientFileSystem === true,
-        },
+        // Advertising writes swaps the agent's diff edits for whole-file client_edit_file.
+        fs: { readTextFile: input.clientFileReads === true, writeTextFile: false },
         terminal: false,
       },
       transformStdout: makeAntigravityStdoutTransform(
@@ -91,7 +92,7 @@ export function antigravityPermissionMode(runtimeMode: RuntimeMode): string {
   }
 }
 
-function antigravityModelOptions(
+export function antigravityModelOptions(
   configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption>,
 ) {
   const model = configOptions.find((option) => option.id === "model");
@@ -99,6 +100,28 @@ function antigravityModelOptions(
   return model.options.flatMap((entry) => ("value" in entry ? [entry] : entry.options));
 }
 
+/** Runtime 1.4 reports thinking as its own option; 1.3 encoded it in the model ID. */
+export function antigravityThinkingConfig(
+  configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption> | null | undefined,
+) {
+  const option = configOptions?.find((candidate) => candidate.category === "thought_level");
+  return option?.type === "select" ? option : undefined;
+}
+
+/**
+ * Runtime 1.4 lists `gemini-3.8-flash` where 1.3 listed `gemini-3.8-flash-high`. The agent
+ * still accepts the old IDs, so pass them through; the current model may have no thinking option.
+ */
+function legacyAntigravityFamily(
+  configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption>,
+  model: string,
+) {
+  return antigravityModelOptions(configOptions)
+    .map((option) => option.value)
+    .filter((family) => model.startsWith(`${family}-`))
+    .toSorted((left, right) => right.length - left.length)[0];
+}
+
 function resolveAntigravityModel(input: {
   readonly configOptions: ReadonlyArray<EffectAcpSchema.SessionConfigOption>;
   readonly model: string | null | undefined;
@@ -108,7 +131,9 @@ function resolveAntigravityModel(input: {
   const current = modelConfig?.type === "select" ? modelConfig.currentValue : undefined;
   if (input.model && input.model !== ANTIGRAVITY_DEFAULT_MODEL) return input.model;
   const options = antigravityModelOptions(input.configOptions);
-  return input.defaultModel && options.some((option) => option.value === input.defaultModel)
+  return input.defaultModel &&
+    (options.some((option) => option.value === input.defaultModel) ||
+      legacyAntigravityFamily(input.configOptions, input.defaultModel) !== undefined)
     ? input.defaultModel
     : current;
 }
@@ -118,7 +143,7 @@ export const applyAntigravityAcpModelSelection = Effect.fn("applyAntigravityAcpM
   function* <E>(input: {
     readonly runtime: Pick<
       AcpSessionRuntime.AcpSessionRuntime["Service"],
-      "getConfigOptions" | "setModel"
+      "getConfigOptions" | "setModel" | "setConfigOption"
     >;
     readonly model: string | null | undefined;
     readonly defaultModel?: string | undefined;
@@ -135,6 +160,15 @@ export const applyAntigravityAcpModelSelection = Effect.fn("applyAntigravityAcpM
     const explicit = Boolean(input.model) && input.model !== ANTIGRAVITY_DEFAULT_MODEL;
     if (resolved === undefined || (!explicit && resolved === current)) return current;
     const options = antigravityModelOptions(configOptions);
+    const legacyFamily = options.some((option) => option.value === resolved)
+      ? undefined
+      : legacyAntigravityFamily(configOptions, resolved);
+    if (legacyFamily !== undefined) {
+      yield* input.runtime
+        .setConfigOption("model", resolved, { allowUnlistedValue: true })
+        .pipe(Effect.mapError(input.mapError));
+      return legacyFamily;
+    }
     if (!options.some((option) => option.value === resolved)) {
       return yield* Effect.fail(
         input.mapError(
diff --git a/apps/server/src/provider/acp/AntigravityClientFiles.ts b/apps/server/src/provider/acp/AntigravityClientFiles.ts
index 4efbc28a80ce2..c6079234d916c 100644
--- a/apps/server/src/provider/acp/AntigravityClientFiles.ts
+++ b/apps/server/src/provider/acp/AntigravityClientFiles.ts
@@ -5,7 +5,6 @@ import type * as Path from "effect/Path";
 import * as EffectAcpErrors from "effect-acp/errors";
 import type * as EffectAcpSchema from "effect-acp/compat";
 
-/** The agent requests permission for every write; check only path containment here. */
 const CLIENT_FILE_MAX_BYTES = 8 * 1024 * 1024;
 
 function isInsideRoot(path: Path.Path, root: string, candidate: string): boolean {
@@ -98,21 +97,3 @@ export const readAntigravityClientTextFile = Effect.fn("AntigravityClientFiles.r
     return { content: lines.slice(start, end).join("\n") };
   },
 );
-
-export const writeAntigravityClientTextFile = Effect.fn("AntigravityClientFiles.writeTextFile")(
-  function* (input: {
-    readonly fileSystem: FileSystem.FileSystem;
-    readonly path: Path.Path;
-    readonly allowedRoots: ReadonlyArray<string>;
-    readonly request: EffectAcpSchema.WriteTextFileRequest;
-  }): Effect.fn.Return<EffectAcpSchema.WriteTextFileResponse, EffectAcpErrors.AcpError> {
-    const filePath = yield* resolveClientFilePath({ ...input, requestPath: input.request.path });
-    yield* input.fileSystem.makeDirectory(input.path.dirname(filePath), { recursive: true }).pipe(
-      Effect.andThen(input.fileSystem.writeFileString(filePath, input.request.content)),
-      Effect.mapError(() =>
-        EffectAcpErrors.AcpRequestError.internalError(`Could not write '${input.request.path}'.`),
-      ),
-    );
-    return {};
-  },
-);
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.test.ts b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
index 192c8b43ffb14..66c83e0c48249 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.test.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
@@ -24,7 +24,12 @@ const isSessionNotification = Schema.is(AcpWireSchema.SessionNotification);
 describe("native Antigravity subagent tools", () => {
   it("recognizes only native invocation titles and excludes MCP tools", () => {
     const toolCall = { toolCallId: "trajectory:4", kind: "other", data: {} };
-    for (const title of ["Running start_subagent", "Run start_subagent?"]) {
+    for (const title of [
+      "Running start_subagent",
+      "Run start_subagent?",
+      "Running invoke_subagent",
+      "Run invoke_subagent?",
+    ]) {
       expect(classifyAntigravitySubagentToolCall({ ...toolCall, title }, {})).toBe("subagent");
       expect(
         classifyAntigravitySubagentToolCall(
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.ts b/apps/server/src/provider/acp/AntigravityProtocol.ts
index 7e2f24a31d3b9..ac65db6373add 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.ts
@@ -324,14 +324,22 @@ export function normalizeAntigravityToolCall(toolCall: AcpToolCallState): AcpToo
   };
 }
 
-/** ACP 1.1.1 reports subagent calls as ordinary tools without child IDs or models. */
+const ANTIGRAVITY_SUBAGENT_TITLES = new Set([
+  "Running start_subagent",
+  "Run start_subagent?",
+  "Running invoke_subagent",
+  "Run invoke_subagent?",
+]);
+
+/** The ACP agent reports subagent calls as ordinary tools without child IDs or models. */
 export function classifyAntigravitySubagentToolCall(
   toolCall: AcpToolCallState,
   rawPayload?: unknown,
 ): "subagent" | "mcp" | undefined {
   if (
     (toolCall.kind !== undefined && toolCall.kind !== "other") ||
-    (toolCall.title !== "Running start_subagent" && toolCall.title !== "Run start_subagent?")
+    toolCall.title === undefined ||
+    !ANTIGRAVITY_SUBAGENT_TITLES.has(toolCall.title)
   )
     return undefined;
   const update = Predicate.isObject(rawPayload) ? rawPayload.update : undefined;
diff --git a/apps/server/src/provider/antigravityRelease.ts b/apps/server/src/provider/antigravityRelease.ts
index f00185865b05a..17173760d5e3d 100644
--- a/apps/server/src/provider/antigravityRelease.ts
+++ b/apps/server/src/provider/antigravityRelease.ts
@@ -1,4 +1,5 @@
-const ANTIGRAVITY_RELEASE_VERSION = "1.3.0";
+// 1.4.2 through 1.4.4 write skills/system/run-workflow/SKILL.md into every session workspace.
+const ANTIGRAVITY_RELEASE_VERSION = "1.4.1";
 
 export interface AntigravityReleaseAsset {
   readonly version: string;
@@ -20,66 +21,66 @@ const releaseAssets = new Map<string, AntigravityReleaseAsset>([
     "darwin-arm64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.3.0-darwin-arm64.zip",
-      sha256: "7cd97045f7b4fe81175a107cdf16f9c51484e3c78a5162cae415338bb6aa5b88",
-      archiveBytes: 111_456_962,
-      executable: { name: "agy_acp_server.par", bytes: 278_535_456 },
-      harness: { name: "localharness_external", bytes: 118_611_392 },
+      url: "https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.1-darwin-arm64.zip",
+      sha256: "f9bdd68291ae78c38d2141e63bc86b84e6cc7b9f60f71652c68435a7943deb17",
+      archiveBytes: 112_737_434,
+      executable: { name: "agy_acp_server.par", bytes: 280_996_576 },
+      harness: { name: "localharness_external", bytes: 120_246_928 },
     },
   ],
   [
     "darwin-x64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.3.0-darwin-x86_64.zip",
-      sha256: "bb23956b89984bf5d354af2c3725e6c57f0cc1b7228e77a0e91c9c2bc1d47646",
-      archiveBytes: 117_245_544,
-      executable: { name: "agy_acp_server.par", bytes: 282_840_688 },
-      harness: { name: "localharness_external", bytes: 124_175_392 },
+      url: "https://dl.google.com/agy-extensions/releases/macos/agy-acp-server-1.4.1-darwin-x86_64.zip",
+      sha256: "27e31f096874704f14167b07ef9e84cc77134615ee41d024f7b1c957add85307",
+      archiveBytes: 118_349_036,
+      executable: { name: "agy_acp_server.par", bytes: 285_186_624 },
+      harness: { name: "localharness_external", bytes: 124_910_048 },
     },
   ],
   [
     "linux-x64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.3.0-linux-x86_64.zip",
-      sha256: "9fb60956af0a9d76220a4db91ca9ac88e2a2372ad68f985ab5fceace6b825b96",
-      archiveBytes: 333_727_150,
-      executable: { name: "agy_acp_server.par", bytes: 926_533_965 },
-      harness: { name: "localharness_external", bytes: 130_388_040 },
+      url: "https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.1-linux-x86_64.zip",
+      sha256: "2e37012ceb2a5c7fc7309b6e6596234fb637ee3c62a5199f65d4cbe777871384",
+      archiveBytes: 336_170_339,
+      executable: { name: "agy_acp_server.par", bytes: 930_826_753 },
+      harness: { name: "localharness_external", bytes: 131_187_512 },
     },
   ],
   [
     "linux-arm64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.3.0-linux-arm64.zip",
-      sha256: "500b0bc0fb858e88f4df404d4cedf80bf9298c178291e39e383d6c50b111cbdf",
-      archiveBytes: 321_690_363,
-      executable: { name: "agy_acp_server.par", bytes: 930_848_992 },
-      harness: { name: "localharness_external", bytes: 123_224_968 },
+      url: "https://dl.google.com/agy-extensions/releases/linux/agy-acp-server-1.4.1-linux-arm64.zip",
+      sha256: "609336a1c97545487e3ddd55dbd153dc0f40f4e6534486cc1c5f4c0ebb85c2da",
+      archiveBytes: 321_922_507,
+      executable: { name: "agy_acp_server.par", bytes: 933_416_796 },
+      harness: { name: "localharness_external", bytes: 124_895_000 },
     },
   ],
   [
     "win32-x64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.3.0-windows-x86_64.zip",
-      sha256: "65215e0688681fa3116e048a9eab27ef53af1bbd6f3da3f1c52bd4911d8b17f9",
-      archiveBytes: 124_509_787,
-      executable: { name: "agy_acp_server.exe", bytes: 81_437_336 },
-      harness: { name: "localharness_external.exe", bytes: 145_548_952 },
+      url: "https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.1-windows-x86_64.zip",
+      sha256: "5f5b7d0328df17c128b2be338d4567b0d24e56ace8196e88794fec37d1372554",
+      archiveBytes: 129_599_308,
+      executable: { name: "agy_acp_server.exe", bytes: 86_098_784 },
+      harness: { name: "localharness_external.exe", bytes: 146_036_888 },
     },
   ],
   [
     "win32-arm64",
     {
       version: ANTIGRAVITY_RELEASE_VERSION,
-      url: "https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.3.0-windows-arm64.zip",
-      sha256: "4a0f469720e9beb9438a979f543fdbfad5022ebe0992c052c590bd78b3144ca3",
-      archiveBytes: 124_654_803,
-      executable: { name: "agy_acp_server.exe", bytes: 85_893_472 },
-      harness: { name: "localharness_external.exe", bytes: 135_640_216 },
+      url: "https://dl.google.com/agy-extensions/releases/windows/agy-acp-server-1.4.1-windows-arm64.zip",
+      sha256: "24c52bbc12aae20f55eb53d373669412d95a9c44fd59be4ea4e355918b91fbf7",
+      archiveBytes: 132_507_344,
+      executable: { name: "agy_acp_server.exe", bytes: 93_197_744 },
+      harness: { name: "localharness_external.exe", bytes: 136_970_904 },
     },
   ],
 ]);
diff --git a/apps/server/src/provider/model-manifest.json b/apps/server/src/provider/model-manifest.json
index b42932fcc6668..87ed61776ea9c 100644
--- a/apps/server/src/provider/model-manifest.json
+++ b/apps/server/src/provider/model-manifest.json
@@ -75,8 +75,12 @@
     {
       "driver": "antigravity",
       "t3CodeRange": ">=0.0.42",
-      "recommendedRange": "=1.1.1",
-      "ranges": [{ "range": "=1.1.1", "status": "supported" }]
+      "recommendedRange": "=1.4.1",
+      "ranges": [
+        { "range": "=1.4.1", "status": "supported" },
+        { "range": "=1.3.0", "status": "supported" },
+        { "range": "=1.1.1", "status": "supported" }
+      ]
     },
     {
       "driver": "pi",
diff --git a/apps/server/src/provider/providerCompatibility.test.ts b/apps/server/src/provider/providerCompatibility.test.ts
index e3d4f672016c0..12c541fbd776d 100644
--- a/apps/server/src/provider/providerCompatibility.test.ts
+++ b/apps/server/src/provider/providerCompatibility.test.ts
@@ -21,7 +21,12 @@ import {
   ProviderCompatibilityPolicy,
   resolveProviderCompatibility,
 } from "./providerCompatibility.ts";
+import { resolveAntigravityReleaseAsset } from "./antigravityRelease.ts";
+import bundledManifest from "./model-manifest.json" with { type: "json" };
 
+const decodeCompatibilityPolicies = Schema.decodeUnknownSync(
+  Schema.Array(ProviderCompatibilityPolicy),
+);
 const driver = ProviderDriverKind.make("codex");
 const policy: ProviderCompatibilityPolicy = {
   driver,
@@ -127,6 +132,19 @@ describe("provider compatibility", () => {
     }
   });
 
+  it("supports the managed Antigravity runtime in the bundled manifest", () => {
+    const policies = decodeCompatibilityPolicies(bundledManifest.compatibility);
+    const release = resolveAntigravityReleaseAsset("darwin", "arm64");
+    assert.strictEqual(
+      resolveProviderCompatibility(
+        policies,
+        ProviderDriverKind.make("antigravity"),
+        `agy_acp_server_${release?.version}`,
+      )?.status,
+      "supported",
+    );
+  });
+
   it("classifies boundaries and treats unlisted versions and release tags as unknown", () => {
     for (const [version, expected] of [
       ["0.9.9", "broken"],
diff --git a/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts b/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
index 395a24eeedc8d..3fcafcc151789 100644
--- a/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
+++ b/apps/server/src/textGeneration/AntigravityTextGeneration.test.ts
@@ -170,6 +170,7 @@ const makeFixture = Effect.fn("makeAntigravityTextGenerationFixture")(function*
           Effect.sync(() => {
             state.selectedModels.push(model);
           }),
+        setConfigOption: () => Effect.succeed({ configOptions: [] }),
         prompt: (request) =>
           Effect.gen(function* () {
             state.prompts.push(request);
diff --git a/apps/server/src/textGeneration/AntigravityTextGeneration.ts b/apps/server/src/textGeneration/AntigravityTextGeneration.ts
index 670c2eb28d513..921a2f118e34a 100644
--- a/apps/server/src/textGeneration/AntigravityTextGeneration.ts
+++ b/apps/server/src/textGeneration/AntigravityTextGeneration.ts
@@ -31,6 +31,7 @@ type AntigravityTextRuntime = Pick<
   | "getConfigOptions"
   | "getEvents"
   | "setModel"
+  | "setConfigOption"
   | "prompt"
   | "cancel"
   | "handleSessionUpdate"
diff --git a/docs/user/providers-antigravity.md b/docs/user/providers-antigravity.md
index 0b1cd2f2c6da1..76bbc8266a941 100644
--- a/docs/user/providers-antigravity.md
+++ b/docs/user/providers-antigravity.md
@@ -68,9 +68,15 @@ Leave the field blank to use the managed runtime, or a compatible executable on
 
 ## Models and threads
 
-The model list comes from your Antigravity account and can differ from other
-Antigravity apps. A resumed thread keeps its selected model. If access to that
-model ends, select another available model before continuing.
+The model list comes from your Antigravity account, including Claude and GPT models
+when your plan has them. Pick a thinking level in the composer's effort menu; it
+shows only the levels the selected model supports. A resumed thread keeps its
+selected model. If access to that model ends, select another available model
+before continuing.
+
+Antigravity creates empty `.gemini/skills` and `.agents/skills` folders in the
+workspace when a session starts. Git does not track empty folders, so they never
+appear in commits.
 
 Use Antigravity's native `/plan` command for planning. T3 Code's separate Plan mode
 is unavailable. Tool approvals follow [Permission modes](./permission-modes.md).
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index 1cdbd20f5508b..398eac2170e70 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -288,7 +288,7 @@ export interface AcpAdapterV2Flavor {
       request: EffectAcpSchema.ReadTextFileRequest,
       cwd: string | null,
     ) => Effect.Effect<EffectAcpSchema.ReadTextFileResponse, EffectAcpErrors.AcpError>;
-    readonly writeTextFile: (
+    readonly writeTextFile?: (
       request: EffectAcpSchema.WriteTextFileRequest,
       cwd: string | null,
     ) => Effect.Effect<EffectAcpSchema.WriteTextFileResponse, EffectAcpErrors.AcpError>;
@@ -1993,7 +1993,7 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
             clientCapabilities: {
               fs: {
                 readTextFile: flavor.clientFileSystem !== undefined,
-                writeTextFile: flavor.clientFileSystem !== undefined,
+                writeTextFile: flavor.clientFileSystem?.writeTextFile !== undefined,
               },
               terminal: clientTerminals !== undefined,
               elicitation: { form: {}, ...(flavor.onUrlElicitation ? { url: {} } : {}) },
@@ -5958,11 +5958,14 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                 Effect.flatMap(({ policy }) => clientFileSystem.readTextFile(request, policy.cwd)),
               ),
             );
-            yield* targetRuntime.handleWriteTextFile((request) =>
-              clientPolicyContext.pipe(
-                Effect.flatMap(({ policy }) => clientFileSystem.writeTextFile(request, policy.cwd)),
-              ),
-            );
+            const writeTextFile = clientFileSystem.writeTextFile;
+            if (writeTextFile !== undefined) {
+              yield* targetRuntime.handleWriteTextFile((request) =>
+                clientPolicyContext.pipe(
+                  Effect.flatMap(({ policy }) => writeTextFile(request, policy.cwd)),
+                ),
+              );
+            }
           }
           if (handlerOptions.mcp !== false) {
             yield* wireAcpRuntimeMcpHandlers(targetRuntime, runtimeMcpBridge);

From d7935f135f50f3798c1e247ebe8b88587dd62adf Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 03:28:56 -0700
Subject: [PATCH 002/146] feat(web): choose what the thread details card shows
 (#26904)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../settings/DesktopClientSettings.test.ts    |   1 +
 apps/web/src/components/ChatView.tsx          |  19 +-
 apps/web/src/components/GitActionsControl.tsx |  25 +-
 .../chat/OpenInPicker.browser.test.tsx        |  13 +
 .../components/chat/OpenInPickerShortcut.ts   |  40 ++-
 .../chat/ThreadAutomationsPanel.tsx           |  12 +-
 .../chat/ThreadDetailsCard.browser.test.tsx   |  26 +-
 .../src/components/chat/ThreadDetailsCard.tsx |  16 +-
 .../chat/ThreadDetailsItemsMenu.tsx           |  45 +++
 .../components/chat/ThreadDetailsPanel.tsx    | 262 ++++++++++++------
 .../components/chat/ThreadDetailsSection.tsx  |   7 +-
 .../components/chat/ThreadDetailsUsage.tsx    |   2 +-
 .../chat/threadDetailsItems.test.ts           |  35 +++
 .../src/components/chat/threadDetailsItems.ts |  60 ++++
 .../settings/AppearanceSettingsPanel.tsx      |   2 +
 .../components/settings/LabsSettingsPanel.tsx |  21 --
 .../settings/ThreadDetailsItemsRow.tsx        |  53 ++++
 .../src/components/settings/settingsSearch.ts |  14 +-
 docs/user/thread-sidebar.md                   |   5 +
 docs/user/usage.md                            |   2 +-
 packages/contracts/src/settings.ts            |   7 +
 21 files changed, 514 insertions(+), 153 deletions(-)
 create mode 100644 apps/web/src/components/chat/ThreadDetailsItemsMenu.tsx
 create mode 100644 apps/web/src/components/chat/threadDetailsItems.test.ts
 create mode 100644 apps/web/src/components/chat/threadDetailsItems.ts
 create mode 100644 apps/web/src/components/settings/ThreadDetailsItemsRow.tsx

diff --git a/apps/desktop/src/settings/DesktopClientSettings.test.ts b/apps/desktop/src/settings/DesktopClientSettings.test.ts
index c80498c14c1fb..ec5062f9105bf 100644
--- a/apps/desktop/src/settings/DesktopClientSettings.test.ts
+++ b/apps/desktop/src/settings/DesktopClientSettings.test.ts
@@ -65,6 +65,7 @@ const clientSettings: ClientSettings = {
   boringSidebarEnabled: false,
   boringSidebarMultilineRows: false,
   threadDetailsUsageEnabled: false,
+  threadDetailsItems: {},
   legacySidebarEnabled: false,
   sidebarWorkingShelfEnabled: false,
   loadBalancingEnabled: false,
diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index b9104836b62ee..de76f47844bfa 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -1228,9 +1228,6 @@ export default function ChatView(props: ChatViewProps) {
   const canChangeEnvironment =
     hasMultipleEnvironments && !envLocked && draftId !== null && !draftThread?.promotedTo;
 
-  const threadDetailsUsageEnabled = useClientSettings(
-    (settings) => settings.threadDetailsUsageEnabled,
-  );
   const loadBalancingSettings = useClientSettings((settings) => ({
     loadBalancingEnabled: settings.loadBalancingEnabled,
     loadBalancingWeights: settings.loadBalancingWeights,
@@ -3773,16 +3770,12 @@ export default function ChatView(props: ChatViewProps) {
               onAddProjectScript={saveProjectScriptStable}
               onUpdateProjectScript={updateProjectScriptStable}
               onDeleteProjectScript={deleteProjectScriptStable}
-              usage={
-                threadDetailsUsageEnabled
-                  ? {
-                      providerInstanceId: activeProviderInstanceId,
-                      providers: providerStatuses,
-                      sources: serverConfig?.usageLimitSources ?? EMPTY_USAGE_LIMIT_SOURCES,
-                      contextWindow: activeContextWindow,
-                    }
-                  : undefined
-              }
+              usage={{
+                providerInstanceId: activeProviderInstanceId,
+                providers: providerStatuses,
+                sources: serverConfig?.usageLimitSources ?? EMPTY_USAGE_LIMIT_SOURCES,
+                contextWindow: activeContextWindow,
+              }}
             />
 
             <PullRequestThreadDialogHost
diff --git a/apps/web/src/components/GitActionsControl.tsx b/apps/web/src/components/GitActionsControl.tsx
index 7c017223daf74..cae352e6d6b26 100644
--- a/apps/web/src/components/GitActionsControl.tsx
+++ b/apps/web/src/components/GitActionsControl.tsx
@@ -117,6 +117,8 @@ interface GitActionsControlProps {
   activeThreadRef: ScopedThreadRef | null;
   draftId?: DraftId;
   compact?: boolean;
+  showActions?: boolean;
+  showChanges?: boolean;
   onOpenChanges?: () => void;
 }
 
@@ -926,6 +928,8 @@ export default function GitActionsControl({
   activeThreadRef,
   draftId,
   compact = false,
+  showActions = true,
+  showChanges = true,
   onOpenChanges,
 }: GitActionsControlProps) {
   const panelAnchorRef = useRef<HTMLDivElement | null>(null);
@@ -1476,7 +1480,7 @@ export default function GitActionsControl({
 
   return (
     <>
-      {!isRepo ? (
+      {!showActions ? null : !isRepo ? (
         <ThreadDetailsControl
           size="xs"
           variant="ghost"
@@ -1618,7 +1622,7 @@ export default function GitActionsControl({
         </div>
       )}
 
-      {isRepo && !quietEmptyDraft ? (
+      {showChanges && isRepo && !quietEmptyDraft ? (
         <ThreadDetailsControl
           type="button"
           variant="ghost"
@@ -1826,13 +1830,16 @@ export default function GitActionsControl({
         </DialogPopup>
       </Dialog>
 
-      <PublishRepositoryDialog
-        open={isPublishDialogOpen}
-        onOpenChange={setIsPublishDialogOpen}
-        environmentId={activeEnvironmentId}
-        threadRef={activeThreadRef}
-        gitCwd={gitCwd}
-      />
+      {/* Its discovery query should stop when the Git actions row that opens it is hidden. */}
+      {showActions ? (
+        <PublishRepositoryDialog
+          open={isPublishDialogOpen}
+          onOpenChange={setIsPublishDialogOpen}
+          environmentId={activeEnvironmentId}
+          threadRef={activeThreadRef}
+          gitCwd={gitCwd}
+        />
+      ) : null}
 
       <Dialog
         open={pendingDefaultBranchAction !== null}
diff --git a/apps/web/src/components/chat/OpenInPicker.browser.test.tsx b/apps/web/src/components/chat/OpenInPicker.browser.test.tsx
index b34867b2668f3..720ce4d6c443d 100644
--- a/apps/web/src/components/chat/OpenInPicker.browser.test.tsx
+++ b/apps/web/src/components/chat/OpenInPicker.browser.test.tsx
@@ -189,6 +189,19 @@ describe("host editor access", () => {
   });
 });
 
+describe("remote editor links", () => {
+  it("opens the link from the fallback when the picker is not mounted", async () => {
+    await using fixture = await setup();
+    const { screen, pressOpenFavorite, FavoriteEditorFallback } = fixture;
+    state.remote = { mode: "remote-links", host: { kind: "ssh-alias", host: "sol" } };
+    await act(async () => screen.rerender(<FavoriteEditorFallback />));
+
+    expect((await pressOpenFavorite()).defaultPrevented).toBe(true);
+    expect(state.openUrl).toHaveBeenCalledWith(expect.stringContaining("ssh-remote+sol"));
+    expect(state.run).not.toHaveBeenCalled();
+  });
+});
+
 describe("open in editor announcement", () => {
   it("speaks only after the shortcut opened the editor, from the picker or the fallback", async () => {
     await using fixture = await setup();
diff --git a/apps/web/src/components/chat/OpenInPickerShortcut.ts b/apps/web/src/components/chat/OpenInPickerShortcut.ts
index 8c8249c67b1a0..833c3f3784987 100644
--- a/apps/web/src/components/chat/OpenInPickerShortcut.ts
+++ b/apps/web/src/components/chat/OpenInPickerShortcut.ts
@@ -1,11 +1,16 @@
-import type { EditorId, EnvironmentId, ResolvedKeybindingsConfig } from "@t3tools/contracts";
+import {
+  buildRemoteOpenUrl,
+  type EditorId,
+  type EnvironmentId,
+  type ResolvedKeybindingsConfig,
+} from "@t3tools/contracts";
 import { useEffect } from "react";
 
 import { usePreferredEditor } from "../../editorPreferences";
 import { editorLabelForPlatform } from "../../editorLabels";
 import { isOpenFavoriteEditorShortcut } from "../../keybindings";
 import { announce } from "../../lib/announce";
-import { useRemoteOpenState } from "../../remoteOpen";
+import { openRemoteEditorUrl, useRemoteCapableEditors, useRemoteOpenState } from "../../remoteOpen";
 import { registerCommands } from "../../shortcuts/dispatcher";
 import { shellEnvironment } from "../../state/shell";
 import { useAtomCommand } from "../../state/use-atom-command";
@@ -49,18 +54,39 @@ export function useOpenFavoriteEditorShortcut({
   openInCwd: string | null;
 }) {
   const openInEditorMutation = useAtomCommand(shellEnvironment.openInEditor, "open in editor");
-  const [preferredEditor] = usePreferredEditor(availableEditors);
   const remote = useRemoteOpenState(environmentId);
+  const remoteCapableEditors = useRemoteCapableEditors();
+  // Matches the picker: remote editors run on the viewing machine.
+  const [preferredEditor] = usePreferredEditor(
+    remote.mode === "local-exec" ? availableEditors : remoteCapableEditors,
+  );
 
-  // oxlint-disable-next-line t3code/no-unreasoned-state-sync -- subscribes a window keydown listener for the open-in-editor shortcut while enabled locally
+  // oxlint-disable-next-line t3code/no-unreasoned-state-sync -- subscribes a window keydown listener for the open-in-editor shortcut while enabled
   useEffect(() => {
-    if (!enabled || remote.mode !== "local-exec") return;
+    if (!enabled || remote.mode === "remote-unavailable") return;
     const handler = (event: globalThis.KeyboardEvent) => {
-      if (event.defaultPrevented || !isOpenFavoriteEditorShortcut(event, keybindings)) return;
+      if (
+        event.repeat ||
+        event.defaultPrevented ||
+        !isOpenFavoriteEditorShortcut(event, keybindings)
+      )
+        return;
       if (!openInCwd || !preferredEditor) return;
 
       event.preventDefault();
       const label = editorLabelForPlatform(preferredEditor, navigator.platform);
+      if (remote.mode === "remote-links") {
+        const url = buildRemoteOpenUrl({
+          editor: preferredEditor,
+          ...remote.host,
+          absolutePath: openInCwd,
+        });
+        if (url === undefined) return;
+        void openRemoteEditorUrl(url).then((opened) => {
+          if (opened) announce(`Opened in ${label}`);
+        });
+        return;
+      }
       void openInEditorMutation({
         environmentId,
         input: {
@@ -80,6 +106,6 @@ export function useOpenFavoriteEditorShortcut({
     openInCwd,
     openInEditorMutation,
     preferredEditor,
-    remote.mode,
+    remote,
   ]);
 }
diff --git a/apps/web/src/components/chat/ThreadAutomationsPanel.tsx b/apps/web/src/components/chat/ThreadAutomationsPanel.tsx
index 20ecde3272276..ca2497bd20ee8 100644
--- a/apps/web/src/components/chat/ThreadAutomationsPanel.tsx
+++ b/apps/web/src/components/chat/ThreadAutomationsPanel.tsx
@@ -153,12 +153,6 @@ export function ThreadAutomationsPanel(props: {
         </Tooltip>
       }
     >
-      {tasksQuery.error !== null ? (
-        <p className="px-2.5 py-1.5 text-2xs text-destructive">
-          Could not load automations: {tasksQuery.error}
-        </p>
-      ) : null}
-
       <ul className="m-0 list-none p-0">
         {boundTasks.map((task) => (
           <li
@@ -242,6 +236,12 @@ export function ThreadAutomationsPanel(props: {
           </li>
         ))}
       </ul>
+      {/* Kept last: the details card treats a section whose last child is empty as empty. */}
+      {tasksQuery.error !== null ? (
+        <p className="px-2.5 py-1.5 text-2xs text-destructive">
+          Could not load automations: {tasksQuery.error}
+        </p>
+      ) : null}
     </ThreadDetailsSection>
   );
 }
diff --git a/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx b/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
index 37110875ed0ea..a8728d7879dd4 100644
--- a/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsCard.browser.test.tsx
@@ -42,10 +42,13 @@ function Card({
   threadRef,
   inline,
   fixture,
+  rows = 1,
 }: {
   threadRef: ScopedThreadRef;
   inline: boolean;
   fixture: ReturnType<typeof setup>;
+  /** Rows of 100px shown at full density. Compact always takes 50px. */
+  rows?: number;
 }) {
   return (
     // The web root renders in StrictMode, which re-runs ref callbacks on every mount.
@@ -63,8 +66,17 @@ function Card({
           detailsCardPlacement: inline ? placement : null,
         }}
       >
-        <ThreadDetailsCard threadRef={threadRef} anchor={fixture.anchor} handle={fixture.handle}>
-          {() => <p>Details for {threadRef.threadId}</p>}
+        <ThreadDetailsCard
+          threadRef={threadRef}
+          anchor={fixture.anchor}
+          handle={fixture.handle}
+          contentKey={String(rows)}
+        >
+          {(density) => (
+            <p style={{ height: density === "full" ? rows * 100 : 50 }}>
+              Details for {threadRef.threadId}
+            </p>
+          )}
         </ThreadDetailsCard>
       </ChatCanvasContext>
     </StrictMode>
@@ -136,3 +148,13 @@ it("reopens after a normal close", async () => {
   await setOpen(true);
   await expect.element(page.getByText("Details for thread-b")).toBeVisible();
 });
+
+it("returns to full density when hidden items make the content fit", async () => {
+  using fixture = setup();
+  await using screen = await render(<Card threadRef={threadB} inline fixture={fixture} rows={6} />);
+  const card = page.getByRole("region", { name: "Thread details" });
+  await expect.element(card).toHaveAttribute("data-density", "compact");
+
+  await screen.rerender(<Card threadRef={threadB} inline fixture={fixture} rows={2} />);
+  await expect.element(card).toHaveAttribute("data-density", "full");
+});
diff --git a/apps/web/src/components/chat/ThreadDetailsCard.tsx b/apps/web/src/components/chat/ThreadDetailsCard.tsx
index 4add56b80eb08..a5df136f14615 100644
--- a/apps/web/src/components/chat/ThreadDetailsCard.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsCard.tsx
@@ -1,5 +1,11 @@
 import { workspaceAreaProps } from "../../lib/workspaceFocus";
-import { useLayoutEffect, useState, type ReactNode, type RefObject } from "react";
+import {
+  useLayoutEffect,
+  useState,
+  type MouseEventHandler,
+  type ReactNode,
+  type RefObject,
+} from "react";
 import type { ScopedThreadRef } from "@t3tools/contracts";
 import { ScrollArea } from "../ui/scroll-area";
 import { cn } from "../../lib/utils";
@@ -17,11 +23,16 @@ export function ThreadDetailsCard({
   threadRef,
   anchor,
   handle,
+  contentKey,
+  onContextMenu,
   children,
 }: {
   threadRef: ScopedThreadRef;
   anchor: RefObject<Element | null>;
   handle: ReturnType<typeof PopoverCreateHandle>;
+  /** Changes when the set of rendered items changes, so cached heights are measured again. */
+  contentKey: string;
+  onContextMenu?: MouseEventHandler<HTMLDivElement>;
   children: (density: "full" | "compact" | "essential") => ReactNode;
 }) {
   const detailsArea = workspaceAreaProps("details", 3, "Thread details");
@@ -36,7 +47,7 @@ export function ThreadDetailsCard({
   const popoverOpen = useRightPanelStore((state) =>
     selectThreadPanelOpen(state.threadPanelVisibilityByThreadKey, threadRef, "popover"),
   );
-  const measurementKey = `${threadRef.environmentId}:${threadRef.threadId}:${preferredPlacement?.width ?? "popup"}`;
+  const measurementKey = `${threadRef.environmentId}:${threadRef.threadId}:${preferredPlacement?.width ?? "popup"}:${contentKey}`;
   const [measurements, setMeasurements] = useState({
     key: measurementKey,
     heights: { full: 0, compact: 0 },
@@ -109,6 +120,7 @@ export function ThreadDetailsCard({
           "max-h-[min(calc(100dvh-6.5rem),calc(var(--available-height,100dvh)-1rem))]",
       )}
       style={placement ? { maxHeight: height } : undefined}
+      onContextMenu={onContextMenu}
       data-thread-details-card
     >
       <ScrollArea scrollFade className="min-h-0">
diff --git a/apps/web/src/components/chat/ThreadDetailsItemsMenu.tsx b/apps/web/src/components/chat/ThreadDetailsItemsMenu.tsx
new file mode 100644
index 0000000000000..d84c13809eaf6
--- /dev/null
+++ b/apps/web/src/components/chat/ThreadDetailsItemsMenu.tsx
@@ -0,0 +1,45 @@
+import {
+  getClientSettings,
+  updateClientSettings,
+  useClientSettings,
+} from "../../hooks/useSettings";
+import { MenuCheckboxItem, MenuGroup, MenuGroupLabel, MenuItem, MenuSeparator } from "../ui/menu";
+import {
+  isDefaultThreadDetailsVisibility,
+  resolveThreadDetailsVisibility,
+  RESET_THREAD_DETAILS_ITEMS,
+  setThreadDetailsItem,
+  THREAD_DETAILS_ITEMS,
+} from "./threadDetailsItems";
+
+/** Menu body that shows and hides thread details items. The card's context menu and Settings share it. */
+export function ThreadDetailsItemsMenuItems() {
+  const visibility = useClientSettings(resolveThreadDetailsVisibility);
+  return (
+    <>
+      <MenuGroup>
+        <MenuGroupLabel>Show in thread details</MenuGroupLabel>
+        {THREAD_DETAILS_ITEMS.map((item) => (
+          <MenuCheckboxItem
+            key={item.id}
+            checked={visibility[item.id]}
+            onCheckedChange={(checked) =>
+              updateClientSettings({
+                threadDetailsItems: setThreadDetailsItem(getClientSettings(), item, checked),
+              })
+            }
+          >
+            {item.label}
+          </MenuCheckboxItem>
+        ))}
+      </MenuGroup>
+      <MenuSeparator />
+      <MenuItem
+        disabled={isDefaultThreadDetailsVisibility(visibility)}
+        onClick={() => updateClientSettings(RESET_THREAD_DETAILS_ITEMS)}
+      >
+        Reset to default
+      </MenuItem>
+    </>
+  );
+}
diff --git a/apps/web/src/components/chat/ThreadDetailsPanel.tsx b/apps/web/src/components/chat/ThreadDetailsPanel.tsx
index 77a6d15763904..35a954db9d43e 100644
--- a/apps/web/src/components/chat/ThreadDetailsPanel.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsPanel.tsx
@@ -16,7 +16,7 @@ import ProjectScriptsControl, {
   type NewProjectScriptInput,
   type ProjectScriptActionResult,
 } from "../ProjectScriptsControl";
-import { memo, type ComponentProps } from "react";
+import { memo, useState, type ComponentProps } from "react";
 import { ThreadDetailsCard } from "./ThreadDetailsCard";
 import { OpenInPicker } from "./OpenInPicker";
 import { ThreadDetailsSection } from "./ThreadDetailsSection";
@@ -24,6 +24,17 @@ import { ThreadAutomationsPanel } from "./ThreadAutomationsPanel";
 import { ThreadRelationshipsPanel } from "./ThreadRelationshipsControl";
 import { ThreadServersPanel } from "./ThreadServersPanel";
 import { ThreadDetailsUsage, type ThreadDetailsUsageInput } from "./ThreadDetailsUsage";
+import { ThreadDetailsItemsMenuItems } from "./ThreadDetailsItemsMenu";
+import { resolveThreadDetailsVisibility, THREAD_DETAILS_ITEMS } from "./threadDetailsItems";
+import { useClientSettings } from "../../hooks/useSettings";
+import { cn } from "../../lib/utils";
+import { SlidersHorizontalIcon } from "lucide-react";
+import { ThreadDetailsControl } from "./ThreadDetailsControl";
+import {
+  THREAD_DETAILS_PANEL_ICON_CLASS,
+  THREAD_DETAILS_PANEL_LABEL_CLASS,
+} from "./threadDetailsPanelStyles";
+import { Menu, MenuPopup } from "../ui/menu";
 
 const GitActionsControl = memo(BaseGitActionsControl);
 
@@ -68,14 +79,15 @@ interface ThreadDetailsPanelProps extends Pick<
     input: NewProjectScriptInput,
   ) => Promise<ProjectScriptActionResult>;
   onDeleteProjectScript: (scriptId: string) => Promise<ProjectScriptActionResult>;
-  /** Set only while the Labs usage readout is on. */
-  usage?: ThreadDetailsUsageInput | undefined;
+  usage: ThreadDetailsUsageInput;
 }
 
 export function ThreadDetailsPanel(props: ThreadDetailsPanelProps) {
+  const visible = useClientSettings(resolveThreadDetailsVisibility);
+  const [menuPosition, setMenuPosition] = useState<{ x: number; y: number } | null>(null);
   const fileScripts = useT3ProjectFileScripts(
     props.environmentId,
-    props.activeProjectScripts ? props.gitCwd : null,
+    props.activeProjectScripts && visible.scripts ? props.gitCwd : null,
   );
   const activeThreadRef = { environmentId: props.environmentId, threadId: props.threadId };
   const branchToolbarProps = {
@@ -109,99 +121,181 @@ export function ThreadDetailsPanel(props: ThreadDetailsPanelProps) {
       threadRef={{ environmentId: props.environmentId, threadId: props.threadId }}
       anchor={props.anchor}
       handle={props.handle}
+      contentKey={THREAD_DETAILS_ITEMS.filter((item) => visible[item.id])
+        .map((item) => item.id)
+        .join(",")}
+      onContextMenu={(event) => {
+        // Popups the card opens bubble here through React; they, fields, links, and selected text
+        // keep their own menus.
+        const target = event.target;
+        const selection = window.getSelection();
+        if (
+          !(target instanceof Element) ||
+          !event.currentTarget.contains(target) ||
+          target.closest("input, textarea, [contenteditable], a[href]") ||
+          (selection &&
+            !selection.isCollapsed &&
+            (event.currentTarget.contains(selection.anchorNode) ||
+              event.currentTarget.contains(selection.focusNode)))
+        )
+          return;
+        event.preventDefault();
+        setMenuPosition({ x: event.clientX, y: event.clientY });
+      }}
     >
-      {(density) => (
-        <>
-          <ThreadDetailsSection
-            headingId="thread-details-workspace-heading"
-            title="Workspace"
-            separated={false}
-            showHeading={false}
-          >
-            <div className="flex flex-col">
-              {density === "full" ? (
-                <BranchToolbar
-                  layout="panel"
-                  panelSection="workspace"
-                  availableEnvironments={props.availableEnvironments}
-                  {...(props.onEnvironmentChange
-                    ? { onEnvironmentChange: props.onEnvironmentChange }
-                    : {})}
-                  autoEnvironmentLabel={props.autoEnvironmentLabel}
-                  onAutoEnvironment={props.onAutoEnvironment}
-                  {...branchToolbarProps}
-                />
+      {(density) => {
+        // Section flags follow the rows that will render, so no empty section steals the divider rule.
+        const show = {
+          environment: density === "full" && visible.environment,
+          openIn: density !== "essential" && visible.openIn && props.showOpenInPicker,
+          scripts: visible.scripts && props.activeProjectScripts !== undefined,
+          branch: props.gitCwd !== null && props.isGitRepo && visible.branch,
+          git:
+            props.gitCwd !== null &&
+            props.activeProjectName !== undefined &&
+            (visible.gitActions || (visible.changes && props.isGitRepo)),
+        };
+        return (
+          <>
+            <div className="group/details-items">
+              {show.environment || show.openIn || show.scripts ? (
+                <ThreadDetailsSection
+                  headingId="thread-details-workspace-heading"
+                  title="Workspace"
+                  separated={false}
+                  showHeading={false}
+                >
+                  <div className="flex flex-col">
+                    {show.environment ? (
+                      <BranchToolbar
+                        layout="panel"
+                        panelSection="workspace"
+                        availableEnvironments={props.availableEnvironments}
+                        {...(props.onEnvironmentChange
+                          ? { onEnvironmentChange: props.onEnvironmentChange }
+                          : {})}
+                        autoEnvironmentLabel={props.autoEnvironmentLabel}
+                        onAutoEnvironment={props.onAutoEnvironment}
+                        {...branchToolbarProps}
+                      />
+                    ) : null}
+
+                    {show.openIn ? (
+                      <OpenInPicker
+                        keybindings={props.keybindings}
+                        environmentId={props.environmentId}
+                        availableEditors={props.availableEditors}
+                        openInCwd={props.gitCwd}
+                        enableShortcut={props.openInShortcutEnabled}
+                        displayMode="panel"
+                      />
+                    ) : null}
+
+                    {show.scripts && props.activeProjectScripts ? (
+                      <ProjectScriptsControl
+                        environmentId={props.environmentId}
+                        displayMode="panel"
+                        scripts={props.activeProjectScripts}
+                        fileScripts={fileScripts}
+                        preferredScriptId={props.preferredScriptId}
+                        onRunScript={props.onRunProjectScript}
+                        onAddScript={props.onAddProjectScript}
+                        onUpdateScript={props.onUpdateProjectScript}
+                        onDeleteScript={props.onDeleteProjectScript}
+                      />
+                    ) : null}
+                  </div>
+                </ThreadDetailsSection>
+              ) : null}
+
+              {props.gitCwd && (show.branch || show.git) ? (
+                <ThreadDetailsSection
+                  headingId="thread-details-version-control-heading"
+                  title="Version Control"
+                  showHeading={false}
+                  separated={density === "full"}
+                >
+                  <div className="flex flex-col">
+                    {show.branch ? (
+                      <BranchToolbar layout="panel" panelSection="branch" {...branchToolbarProps} />
+                    ) : null}
+                    {show.git ? (
+                      <GitActionsControl
+                        compact={density !== "full"}
+                        showActions={visible.gitActions}
+                        showChanges={visible.changes}
+                        gitCwd={props.gitCwd}
+                        activeThreadRef={activeThreadRef}
+                        {...(props.draftId ? { draftId: props.draftId } : {})}
+                        {...(props.onOpenChanges ? { onOpenChanges: props.onOpenChanges } : {})}
+                      />
+                    ) : null}
+                  </div>
+                </ThreadDetailsSection>
+              ) : null}
+
+              {density === "full" && !props.draftId && visible.servers ? (
+                <ThreadServersPanel environmentId={props.environmentId} threadId={props.threadId} />
               ) : null}
 
-              {density !== "essential" && props.showOpenInPicker ? (
-                <OpenInPicker
-                  keybindings={props.keybindings}
+              {density === "full" && !props.draftId && visible.automations ? (
+                <ThreadAutomationsPanel
                   environmentId={props.environmentId}
-                  availableEditors={props.availableEditors}
-                  openInCwd={props.gitCwd}
-                  enableShortcut={props.openInShortcutEnabled}
-                  displayMode="panel"
+                  threadId={props.threadId}
                 />
               ) : null}
 
-              {props.activeProjectScripts ? (
-                <ProjectScriptsControl
+              {density === "full" && !props.draftId && visible.lineage ? (
+                <ThreadRelationshipsPanel
                   environmentId={props.environmentId}
-                  displayMode="panel"
-                  scripts={props.activeProjectScripts}
-                  fileScripts={fileScripts}
-                  preferredScriptId={props.preferredScriptId}
-                  onRunScript={props.onRunProjectScript}
-                  onAddScript={props.onAddProjectScript}
-                  onUpdateScript={props.onUpdateProjectScript}
-                  onDeleteScript={props.onDeleteProjectScript}
+                  threadId={props.threadId}
                 />
               ) : null}
-            </div>
-          </ThreadDetailsSection>
 
-          {props.gitCwd ? (
-            <ThreadDetailsSection
-              headingId="thread-details-version-control-heading"
-              title="Version Control"
-              showHeading={false}
-              separated={density === "full"}
-            >
-              <div className="flex flex-col">
-                {props.isGitRepo ? (
-                  <BranchToolbar layout="panel" panelSection="branch" {...branchToolbarProps} />
-                ) : null}
-                {props.activeProjectName ? (
-                  <GitActionsControl
-                    compact={density !== "full"}
-                    gitCwd={props.gitCwd}
-                    activeThreadRef={activeThreadRef}
-                    {...(props.draftId ? { draftId: props.draftId } : {})}
-                    {...(props.onOpenChanges ? { onOpenChanges: props.onOpenChanges } : {})}
-                  />
-                ) : null}
-              </div>
-            </ThreadDetailsSection>
-          ) : null}
-
-          {density === "full" && !props.draftId ? (
-            <ThreadServersPanel environmentId={props.environmentId} threadId={props.threadId} />
-          ) : null}
-
-          {density === "full" && !props.draftId ? (
-            <ThreadAutomationsPanel environmentId={props.environmentId} threadId={props.threadId} />
-          ) : null}
+              {visible.usage ? <ThreadDetailsUsage {...props.usage} /> : null}
 
-          {density === "full" && !props.draftId ? (
-            <ThreadRelationshipsPanel
-              environmentId={props.environmentId}
-              threadId={props.threadId}
-            />
-          ) : null}
+              {/* Shown only when no section above has content, so an emptied card can be refilled. */}
+              <div className="p-2 group-has-[>section>:last-child:not(:empty)]/details-items:hidden">
+                <ThreadDetailsControl
+                  size="xs"
+                  variant="ghost"
+                  part="row"
+                  panel
+                  onClick={(event) => {
+                    const rect = event.currentTarget.getBoundingClientRect();
+                    setMenuPosition({ x: rect.left, y: rect.bottom });
+                  }}
+                >
+                  <SlidersHorizontalIcon className={THREAD_DETAILS_PANEL_ICON_CLASS} aria-hidden />
+                  <span className={cn("ml-0.5", THREAD_DETAILS_PANEL_LABEL_CLASS)}>
+                    Choose what to show
+                  </span>
+                </ThreadDetailsControl>
+              </div>
+            </div>
 
-          {props.usage ? <ThreadDetailsUsage {...props.usage} /> : null}
-        </>
-      )}
+            <Menu
+              open={menuPosition !== null}
+              onOpenChange={(open) => !open && setMenuPosition(null)}
+            >
+              <MenuPopup
+                anchor={
+                  menuPosition
+                    ? {
+                        getBoundingClientRect: () =>
+                          new DOMRect(menuPosition.x, menuPosition.y, 0, 0),
+                      }
+                    : undefined
+                }
+                align="start"
+                side="bottom"
+              >
+                <ThreadDetailsItemsMenuItems />
+              </MenuPopup>
+            </Menu>
+          </>
+        );
+      }}
     </ThreadDetailsCard>
   );
 }
diff --git a/apps/web/src/components/chat/ThreadDetailsSection.tsx b/apps/web/src/components/chat/ThreadDetailsSection.tsx
index 00aacd5a7b152..de5ce6c63825d 100644
--- a/apps/web/src/components/chat/ThreadDetailsSection.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsSection.tsx
@@ -22,7 +22,12 @@ export function ThreadDetailsSection({
       {...props}
       aria-labelledby={showHeading ? headingId : undefined}
       aria-label={showHeading ? undefined : title}
-      className={cn("px-2 pt-2 pb-2.5", separated && "border-t border-border/65")}
+      // A row can still render nothing (a fresh draft quiets Git actions), so an empty section
+      // collapses, and a divider only follows a section that has content.
+      className={cn(
+        "px-2 pt-2 pb-2.5 has-[>div:last-child:empty]:hidden",
+        separated && "border-border/65 [section:not(:has(>div:last-child:empty))~&]:border-t",
+      )}
     >
       <div
         className={cn(
diff --git a/apps/web/src/components/chat/ThreadDetailsUsage.tsx b/apps/web/src/components/chat/ThreadDetailsUsage.tsx
index 6a9adadfc7200..e0f5c3afbe845 100644
--- a/apps/web/src/components/chat/ThreadDetailsUsage.tsx
+++ b/apps/web/src/components/chat/ThreadDetailsUsage.tsx
@@ -36,7 +36,7 @@ export interface ThreadDetailsUsageInput {
 }
 
 /**
- * Labs readout of the selected provider's limit windows and the thread's context window.
+ * The selected provider's limit windows and the thread's context window.
  * Every row reads as room left, so a longer bar always means more headroom.
  */
 export function ThreadDetailsUsage({
diff --git a/apps/web/src/components/chat/threadDetailsItems.test.ts b/apps/web/src/components/chat/threadDetailsItems.test.ts
new file mode 100644
index 0000000000000..0a0787061d287
--- /dev/null
+++ b/apps/web/src/components/chat/threadDetailsItems.test.ts
@@ -0,0 +1,35 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import {
+  resolveThreadDetailsVisibility,
+  setThreadDetailsItem,
+  THREAD_DETAILS_ITEMS,
+} from "./threadDetailsItems";
+
+const usage = THREAD_DETAILS_ITEMS.find((item) => item.id === "usage")!;
+const servers = THREAD_DETAILS_ITEMS.find((item) => item.id === "servers")!;
+
+describe("thread details items", () => {
+  it.each([
+    { legacy: false, items: {}, usage: false },
+    { legacy: true, items: {}, usage: true },
+    { legacy: true, items: { usage: false }, usage: false },
+    { legacy: false, items: { usage: true, retired: false }, usage: true },
+  ])("resolves Usage from overrides and the retired Labs flag: %o", (row) => {
+    const visibility = resolveThreadDetailsVisibility({
+      threadDetailsItems: row.items,
+      threadDetailsUsageEnabled: row.legacy,
+    });
+    expect(visibility.usage).toBe(row.usage);
+    expect(visibility.servers).toBe(true);
+  });
+
+  it("stores only choices that differ from the default", () => {
+    const legacyOn = { threadDetailsItems: {}, threadDetailsUsageEnabled: true };
+    expect(setThreadDetailsItem(legacyOn, usage, false)).toEqual({ usage: false });
+    expect(setThreadDetailsItem(legacyOn, usage, true)).toEqual({});
+
+    const hidden = { threadDetailsItems: { servers: false }, threadDetailsUsageEnabled: false };
+    expect(setThreadDetailsItem(hidden, servers, true)).toEqual({});
+  });
+});
diff --git a/apps/web/src/components/chat/threadDetailsItems.ts b/apps/web/src/components/chat/threadDetailsItems.ts
new file mode 100644
index 0000000000000..7502a4c0b1dce
--- /dev/null
+++ b/apps/web/src/components/chat/threadDetailsItems.ts
@@ -0,0 +1,60 @@
+import type { ClientSettings } from "@t3tools/contracts";
+
+// Ids are stored in client settings, so never rename one.
+export const THREAD_DETAILS_ITEMS = [
+  { id: "environment", label: "Environment and worktree", defaultVisible: true },
+  { id: "openIn", label: "Open in editor", defaultVisible: true },
+  { id: "scripts", label: "Project scripts", defaultVisible: true },
+  { id: "branch", label: "Branch and pull request", defaultVisible: true },
+  { id: "gitActions", label: "Git actions", defaultVisible: true },
+  { id: "changes", label: "Changes", defaultVisible: true },
+  { id: "servers", label: "Servers", defaultVisible: true },
+  { id: "automations", label: "Automations", defaultVisible: true },
+  { id: "lineage", label: "Lineage", defaultVisible: true },
+  { id: "usage", label: "Usage", defaultVisible: false },
+] as const;
+
+export type ThreadDetailsItemId = (typeof THREAD_DETAILS_ITEMS)[number]["id"];
+export type ThreadDetailsVisibility = Readonly<Record<ThreadDetailsItemId, boolean>>;
+
+type ThreadDetailsItem = (typeof THREAD_DETAILS_ITEMS)[number];
+type ThreadDetailsItemSettings = Pick<
+  ClientSettings,
+  "threadDetailsItems" | "threadDetailsUsageEnabled"
+>;
+
+// People who turned on the retired Labs toggle keep Usage until they change it here.
+function defaultVisible(item: ThreadDetailsItem, settings: ThreadDetailsItemSettings) {
+  return item.id === "usage" ? settings.threadDetailsUsageEnabled : item.defaultVisible;
+}
+
+export function resolveThreadDetailsVisibility(
+  settings: ThreadDetailsItemSettings,
+): ThreadDetailsVisibility {
+  return Object.fromEntries(
+    THREAD_DETAILS_ITEMS.map((item) => [
+      item.id,
+      settings.threadDetailsItems[item.id] ?? defaultVisible(item, settings),
+    ]),
+  ) as Record<ThreadDetailsItemId, boolean>;
+}
+
+/** Stores only choices that differ from the default, so a later default change reaches everyone else. */
+export function setThreadDetailsItem(
+  settings: ThreadDetailsItemSettings,
+  item: ThreadDetailsItem,
+  visible: boolean,
+): ClientSettings["threadDetailsItems"] {
+  const { [item.id]: _previous, ...rest } = settings.threadDetailsItems;
+  return visible === defaultVisible(item, settings) ? rest : { ...rest, [item.id]: visible };
+}
+
+export function isDefaultThreadDetailsVisibility(visibility: ThreadDetailsVisibility) {
+  return THREAD_DETAILS_ITEMS.every((item) => visibility[item.id] === item.defaultVisible);
+}
+
+/** Also clears the retired Labs flag, so Usage returns to off. */
+export const RESET_THREAD_DETAILS_ITEMS = {
+  threadDetailsItems: {},
+  threadDetailsUsageEnabled: false,
+} satisfies Partial<ClientSettings>;
diff --git a/apps/web/src/components/settings/AppearanceSettingsPanel.tsx b/apps/web/src/components/settings/AppearanceSettingsPanel.tsx
index f47ee3f52c793..1c5812a2bda0d 100644
--- a/apps/web/src/components/settings/AppearanceSettingsPanel.tsx
+++ b/apps/web/src/components/settings/AppearanceSettingsPanel.tsx
@@ -34,6 +34,7 @@ import { searchableSetting } from "./settingsSearch";
 import { AdvancedSettings } from "./AdvancedSettings";
 import { PanelAnimationsPreview } from "./PanelAnimationsPreview";
 import { TypographySection } from "./TypographySettings";
+import { ThreadDetailsItemsRow } from "./ThreadDetailsItemsRow";
 
 const ENVIRONMENT_IDENTIFICATION_LABELS: Record<EnvironmentIdentificationMode, string> = {
   artwork: "Artwork",
@@ -273,6 +274,7 @@ export function AppearanceSettingsPanel() {
             </div>
           }
         />
+        <ThreadDetailsItemsRow />
         <SettingsRow
           {...searchableSetting("effort-display")}
           description="Show reasoning effort in the composer as its name, such as High, or as bars."
diff --git a/apps/web/src/components/settings/LabsSettingsPanel.tsx b/apps/web/src/components/settings/LabsSettingsPanel.tsx
index 1f51e20c0f839..ce3f68eac49d0 100644
--- a/apps/web/src/components/settings/LabsSettingsPanel.tsx
+++ b/apps/web/src/components/settings/LabsSettingsPanel.tsx
@@ -18,7 +18,6 @@ export function LabsSettingsPanel() {
       <SettingsSection id="beta" title="Beta">
         <BoringSidebarRow />
         <BoringSidebarMultilineRow />
-        <ThreadDetailsUsageRow />
         {/* Clerk is only mounted when this build has T3 Connect. */}
         {hasCloudPublicConfig() ? <GuestLinksRowWithSignIn /> : <GuestLinksRow />}
         <LinkedEnvironmentsRow />
@@ -70,26 +69,6 @@ function BoringSidebarMultilineRow() {
   );
 }
 
-function ThreadDetailsUsageRow() {
-  const settings = useScopedSettings();
-  const updateSettings = useUpdateScopedSettings();
-  return (
-    <SettingsRow
-      {...searchableSetting("thread-details-usage")}
-      description="Show the current provider's usage limits and the thread's context window at the bottom of the thread details card."
-      control={
-        <Switch
-          checked={settings.threadDetailsUsageEnabled}
-          onCheckedChange={(checked) =>
-            updateSettings({ threadDetailsUsageEnabled: Boolean(checked) })
-          }
-          aria-label="Usage in thread details"
-        />
-      }
-    />
-  );
-}
-
 /** Signed out of T3 Connect, the row offers to sign in instead of its switch. */
 function GuestLinksRowWithSignIn() {
   const { isSignedIn } = useAuth();
diff --git a/apps/web/src/components/settings/ThreadDetailsItemsRow.tsx b/apps/web/src/components/settings/ThreadDetailsItemsRow.tsx
new file mode 100644
index 0000000000000..a142155d0357d
--- /dev/null
+++ b/apps/web/src/components/settings/ThreadDetailsItemsRow.tsx
@@ -0,0 +1,53 @@
+import { ChevronDownIcon } from "lucide-react";
+
+import { updateClientSettings, useClientSettings } from "../../hooks/useSettings";
+import { ThreadDetailsItemsMenuItems } from "../chat/ThreadDetailsItemsMenu";
+import {
+  isDefaultThreadDetailsVisibility,
+  resolveThreadDetailsVisibility,
+  RESET_THREAD_DETAILS_ITEMS,
+  THREAD_DETAILS_ITEMS,
+} from "../chat/threadDetailsItems";
+import { Button } from "../ui/button";
+import { Menu, MenuPopup, MenuTrigger } from "../ui/menu";
+import { SettingResetButton, SettingsRow } from "./settingsLayout";
+import { searchableSetting } from "./settingsSearch";
+
+export function ThreadDetailsItemsRow() {
+  const visibility = useClientSettings(resolveThreadDetailsVisibility);
+  const enabled = THREAD_DETAILS_ITEMS.filter((item) => visibility[item.id]).length;
+  return (
+    <SettingsRow
+      {...searchableSetting("thread-details-items")}
+      description="Choose what the thread details card shows. You can also right-click the card."
+      resetAction={
+        isDefaultThreadDetailsVisibility(visibility) ? null : (
+          <SettingResetButton
+            label="thread details"
+            onClick={() => updateClientSettings(RESET_THREAD_DETAILS_ITEMS)}
+          />
+        )
+      }
+      control={
+        <Menu>
+          <MenuTrigger
+            render={
+              <Button
+                variant="outline"
+                size="sm"
+                className="w-full justify-between sm:w-40"
+                aria-label={`Thread details: ${enabled} of ${THREAD_DETAILS_ITEMS.length} on`}
+              />
+            }
+          >
+            {enabled} of {THREAD_DETAILS_ITEMS.length} on
+            <ChevronDownIcon aria-hidden />
+          </MenuTrigger>
+          <MenuPopup align="end">
+            <ThreadDetailsItemsMenuItems />
+          </MenuPopup>
+        </Menu>
+      }
+    />
+  );
+}
diff --git a/apps/web/src/components/settings/settingsSearch.ts b/apps/web/src/components/settings/settingsSearch.ts
index 0d87e9bd32c83..1d5c13e72a061 100644
--- a/apps/web/src/components/settings/settingsSearch.ts
+++ b/apps/web/src/components/settings/settingsSearch.ts
@@ -315,6 +315,14 @@ export const SETTINGS_SEARCH_ITEMS = [
     to: "/settings/appearance",
     searchTerms: ["wide full width column layout messages composer monitor"],
   },
+  {
+    id: "thread-details-items",
+    title: "Thread details",
+    to: "/settings/appearance",
+    searchTerms: [
+      "customize show hide panel card environment editor scripts branch pull request git changes servers automations lineage usage limits 5 hour weekly quota tokens context window",
+    ],
+  },
   {
     id: "effort-display",
     title: "Effort display",
@@ -437,12 +445,6 @@ export const SETTINGS_SEARCH_ITEMS = [
     to: "/settings/labs",
     searchTerms: ["beta boring sidebar folder rows multiline branch pull request details"],
   },
-  {
-    id: "thread-details-usage",
-    title: "Usage in thread details",
-    to: "/settings/labs",
-    searchTerms: ["beta limits 5 hour weekly context window tokens quota rate limit"],
-  },
   {
     id: "guest-links",
     title: "Guest links",
diff --git a/docs/user/thread-sidebar.md b/docs/user/thread-sidebar.md
index dfc7b1245ef21..fb5e12b08372b 100644
--- a/docs/user/thread-sidebar.md
+++ b/docs/user/thread-sidebar.md
@@ -277,6 +277,11 @@ Select a server to open it in the browser panel. **Stop** ends the server's job
 and keeps the agent, the terminal, and T3 Code running. Stop needs terminal
 access to the environment and is not available on Windows.
 
+To choose what the thread details card shows, right-click the card or open
+**Settings → Appearance → Thread details**. Hidden rows keep their keyboard
+shortcuts, such as Open in editor and project scripts. **Reset to default** brings
+back the standard rows.
+
 ## Snooze until later
 
 To change the choices in the snooze menu, open **Settings → Threads → Snooze options**.
diff --git a/docs/user/usage.md b/docs/user/usage.md
index 8064380c5e717..155175351c550 100644
--- a/docs/user/usage.md
+++ b/docs/user/usage.md
@@ -116,7 +116,7 @@ current model's limits without leaving the conversation. The result opens above
 closes when you dismiss it or send your next message. It uses the same snapshot as **Usage → Limits**, so it does not run the agent or refresh
 anything. The command is offered only for providers that appear under **Usage → Limits**.
 
-To keep them in view, turn on **Settings → Labs → Usage in thread details** on web and desktop.
+To keep them in view on web and desktop, turn on **Usage** in **Settings → Appearance → Thread details**, or right-click the thread details card.
 The bottom of the thread details card then shows how much is left in each limit window of the
 current provider account and in the thread's context window. Some windows, such as a weekly Opus
 limit, count only one model. Hover a row to see when it resets, your pace, or
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index d789770f1616a..16eb51aa1769c 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -477,7 +477,13 @@ export const ClientSettingsSchema = Schema.Struct({
   boringSidebarMultilineRows: Schema.Boolean.pipe(
     Schema.withDecodingDefault(Effect.succeed(false)),
   ),
+  // Retired Labs toggle. Still read as the default for the Usage item in threadDetailsItems.
   threadDetailsUsageEnabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
+  // Sparse show/hide overrides for thread details card items. Missing ids use the client's
+  // default, so new items appear for everyone and unknown ids survive a downgrade.
+  threadDetailsItems: Schema.Record(Schema.String, Schema.Boolean).pipe(
+    Schema.withDecodingDefault(Effect.succeed({})),
+  ),
   // Opt-in for the removed legacy sidebar. Still read so those users land in
   // the boring sidebar; the boring sidebar toggle clears it.
   legacySidebarEnabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
@@ -1722,6 +1728,7 @@ export const ClientSettingsPatch = Schema.Struct({
   boringSidebarEnabled: Schema.optionalKey(Schema.Boolean),
   boringSidebarMultilineRows: Schema.optionalKey(Schema.Boolean),
   threadDetailsUsageEnabled: Schema.optionalKey(Schema.Boolean),
+  threadDetailsItems: Schema.optionalKey(Schema.Record(Schema.String, Schema.Boolean)),
   legacySidebarEnabled: Schema.optionalKey(Schema.Boolean),
   sidebarWorkingShelfEnabled: Schema.optionalKey(Schema.Boolean),
   sidebarProjectGroupingMode: Schema.optionalKey(SidebarProjectGroupingMode),

From f2943ee90ef76b1db3fc1c1cd3808252418f5850 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 03:54:18 -0700
Subject: [PATCH 003/146] feat(updates): switch your whole fleet between Stable
 and Nightly in one step (#26288)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/desktop/src/ipc/methods/updates.ts       |  18 +-
 apps/desktop/src/preload.ts                   |   7 +-
 .../src/settings/DesktopAppSettings.ts        |   4 +-
 .../src/updates/DesktopRemoteUpdates.test.ts  | 269 ++++++++++++++++++
 .../src/updates/DesktopRemoteUpdates.ts       |  94 +++++-
 .../src/updates/DesktopUpdates.test.ts        | 170 +++++++++++
 apps/desktop/src/updates/DesktopUpdates.ts    |  92 +++++-
 apps/desktop/src/updates/releaseNotes.ts      |   4 +-
 apps/desktop/src/updates/updateChannels.ts    |   7 -
 .../desktop/src/updates/updatesTestHarness.ts |  29 +-
 apps/server/src/cloud/selfUpdate.test.ts      |  33 +++
 apps/server/src/cloud/selfUpdate.ts           |  42 ++-
 .../server/src/cloud/servicePreflight.test.ts |  58 ++++
 apps/server/src/cloud/servicePreflight.ts     |  26 ++
 .../desktopUpdate/DesktopAppUpdate.test.ts    |  18 ++
 .../src/desktopUpdate/DesktopAppUpdate.ts     |  18 +-
 .../src/environment/ServerEnvironment.ts      |   5 +-
 .../server/src/persistence/Migrations.test.ts |  20 ++
 .../src/persistence/databaseMigrationHead.ts  |  49 ++++
 .../DesktopTelemetryReceiver.ts               |  11 +-
 .../ServerUpdateAction.browser.test.tsx       |  25 ++
 .../web/src/components/ServerUpdateAction.tsx |  53 +++-
 .../components/settings/SettingsPanels.tsx    | 104 ++++---
 .../settings/UpdateTrackSwitchDialog.tsx      | 178 ++++++++++++
 .../settings/updateTrackSwitch.logic.test.ts  |  76 +++++
 .../settings/updateTrackSwitch.logic.ts       |  50 ++++
 .../components/sidebar/SidebarUpdatePill.tsx  |   7 +-
 .../sidebar/UpdateEverythingDialog.tsx        |  32 ++-
 .../sidebar/updateEverything.logic.test.ts    | 167 ++++++++++-
 .../sidebar/updateEverything.logic.ts         | 216 +++++++++++++-
 .../components/sidebar/useUpdateEverything.ts |  54 ++--
 apps/web/src/state/npmRelease.ts              |  42 ++-
 docs/user/updating.md                         |  23 ++
 packages/client-runtime/src/state/server.ts   |  11 +
 packages/contracts/src/environment.ts         |   4 +
 packages/contracts/src/ipc.ts                 |   9 +-
 packages/contracts/src/resourceTelemetry.ts   |   5 +-
 packages/contracts/src/server.ts              |   5 +
 packages/shared/src/cliRelease.ts             |  42 +++
 scripts/build-npm-launcher.test.ts            |   3 +
 scripts/build-npm-launcher.ts                 |  23 +-
 41 files changed, 1959 insertions(+), 144 deletions(-)
 create mode 100644 apps/server/src/persistence/databaseMigrationHead.ts
 create mode 100644 apps/web/src/components/settings/UpdateTrackSwitchDialog.tsx
 create mode 100644 apps/web/src/components/settings/updateTrackSwitch.logic.test.ts
 create mode 100644 apps/web/src/components/settings/updateTrackSwitch.logic.ts

diff --git a/apps/desktop/src/ipc/methods/updates.ts b/apps/desktop/src/ipc/methods/updates.ts
index b2212609030d1..ca85ee8b0c417 100644
--- a/apps/desktop/src/ipc/methods/updates.ts
+++ b/apps/desktop/src/ipc/methods/updates.ts
@@ -23,11 +23,14 @@ export const getUpdateState = DesktopIpc.makeIpcMethod({
 
 export const setUpdateChannel = DesktopIpc.makeIpcMethod({
   channel: IpcChannels.UPDATE_SET_CHANNEL_CHANNEL,
-  payload: DesktopUpdateChannelSchema,
+  payload: Schema.Struct({
+    channel: DesktopUpdateChannelSchema,
+    minimumVersion: Schema.optional(Schema.String),
+  }),
   result: DesktopUpdateStateSchema,
-  handler: Effect.fn("desktop.ipc.updates.setChannel")(function* (channel) {
+  handler: Effect.fn("desktop.ipc.updates.setChannel")(function* ({ channel, minimumVersion }) {
     const updates = yield* DesktopUpdates.DesktopUpdates;
-    return yield* updates.setChannel(channel);
+    return yield* updates.setChannel(channel, { minimumVersion });
   }),
 });
 
@@ -43,11 +46,14 @@ export const downloadUpdate = DesktopIpc.makeIpcMethod({
 
 export const installUpdate = DesktopIpc.makeIpcMethod({
   channel: IpcChannels.UPDATE_INSTALL_CHANNEL,
-  payload: Schema.Void,
+  /** A version installs only that downloaded build, never one that replaced it. */
+  payload: Schema.UndefinedOr(Schema.String),
   result: DesktopUpdateActionResultSchema,
-  handler: Effect.fn("desktop.ipc.updates.install")(function* () {
+  handler: Effect.fn("desktop.ipc.updates.install")(function* (expectedVersion) {
     const updates = yield* DesktopUpdates.DesktopUpdates;
-    return yield* updates.install;
+    if (expectedVersion === undefined) return yield* updates.install;
+    const { accepted, completed, state } = yield* updates.installPrepared(expectedVersion);
+    return { accepted, completed, state };
   }),
 });
 
diff --git a/apps/desktop/src/preload.ts b/apps/desktop/src/preload.ts
index a3e1e711cb2d3..965b7db5d6d40 100644
--- a/apps/desktop/src/preload.ts
+++ b/apps/desktop/src/preload.ts
@@ -261,11 +261,12 @@ contextBridge.exposeInMainWorld("desktopBridge", {
     };
   },
   getUpdateState: () => ipcRenderer.invoke(IpcChannels.UPDATE_GET_STATE_CHANNEL),
-  setUpdateChannel: (channel) =>
-    ipcRenderer.invoke(IpcChannels.UPDATE_SET_CHANNEL_CHANNEL, channel),
+  setUpdateChannel: (channel, minimumVersion) =>
+    ipcRenderer.invoke(IpcChannels.UPDATE_SET_CHANNEL_CHANNEL, { channel, minimumVersion }),
   checkForUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_CHECK_CHANNEL),
   downloadUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_DOWNLOAD_CHANNEL),
-  installUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_INSTALL_CHANNEL),
+  installUpdate: (expectedVersion) =>
+    ipcRenderer.invoke(IpcChannels.UPDATE_INSTALL_CHANNEL, expectedVersion),
   cliCommand: {
     getState: () => ipcRenderer.invoke(IpcChannels.CLI_COMMAND_GET_STATE_CHANNEL),
     install: () => ipcRenderer.invoke(IpcChannels.CLI_COMMAND_INSTALL_CHANNEL),
diff --git a/apps/desktop/src/settings/DesktopAppSettings.ts b/apps/desktop/src/settings/DesktopAppSettings.ts
index 5767057b4a35d..a0624ced669ea 100644
--- a/apps/desktop/src/settings/DesktopAppSettings.ts
+++ b/apps/desktop/src/settings/DesktopAppSettings.ts
@@ -22,7 +22,7 @@ import {
   normalizeLinuxPasswordStorePreference,
   type LinuxPasswordStorePreference,
 } from "../linuxSecretStorage.ts";
-import { resolveDefaultDesktopUpdateChannel } from "../updates/updateChannels.ts";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
 import { isValidDistroName } from "../wsl/wslPathParsing.ts";
 
 export interface DesktopSettings {
@@ -180,7 +180,7 @@ export class DesktopAppSettings extends Context.Service<
 export function resolveDefaultDesktopSettings(appVersion: string): DesktopSettings {
   return {
     ...DEFAULT_DESKTOP_SETTINGS,
-    updateChannel: resolveDefaultDesktopUpdateChannel(appVersion),
+    updateChannel: desktopUpdateChannelOf(appVersion),
   };
 }
 
diff --git a/apps/desktop/src/updates/DesktopRemoteUpdates.test.ts b/apps/desktop/src/updates/DesktopRemoteUpdates.test.ts
index 253a015d8ec9e..1f5321148b77b 100644
--- a/apps/desktop/src/updates/DesktopRemoteUpdates.test.ts
+++ b/apps/desktop/src/updates/DesktopRemoteUpdates.test.ts
@@ -119,6 +119,239 @@ describe("DesktopRemoteUpdates", () => {
     );
   });
 
+  it.effect("switches to the requested track before preparing its release", () => {
+    // In-memory settings keep the channel write off real disk I/O.
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* Queue.offer(requests, {
+          ...request("req-switch"),
+          channel: "nightly",
+          targetVersion: "1.2.4-nightly.20261027.1",
+        });
+        yield* settle;
+        assert.equal((yield* updates.getState).channel, "nightly");
+
+        harness.emit("update-available", { version: "1.2.4-nightly.20261027.1" });
+        yield* settle;
+        harness.emit("update-downloaded", { version: "1.2.4-nightly.20261027.1" });
+        yield* settle;
+
+        const terminals = terminalReports(reports);
+        assert.deepEqual(
+          terminals.map((report) => [report.requestId, report.outcome]),
+          [["req-switch", "ready-to-install"]],
+        );
+        assert.equal(terminals[0]?.state.downloadedVersion, "1.2.4-nightly.20261027.1");
+      }),
+    );
+  });
+
+  it.effect(
+    "refuses a crossing whose feed has only an older build, and never offers it later",
+    () => {
+      const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+      return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+        Effect.gen(function* () {
+          const updates = yield* DesktopUpdates.DesktopUpdates;
+          const older = "1.2.4-nightly.20261020.1";
+          yield* Queue.offer(requests, {
+            ...request("req-older"),
+            channel: "nightly",
+            targetVersion: "1.2.4-nightly.20261027.1",
+          });
+          yield* settle;
+          // Answers the track change's check, then the request's own check.
+          harness.emit("update-available", { version: older });
+          yield* settle;
+          harness.emit("update-available", { version: older });
+          yield* settle;
+
+          assert.deepEqual(
+            terminalReports(reports).map((report) => [report.outcome, report.reason]),
+            [["failed", "The desktop app found no build of 1.2.4-nightly.20261027.1."]],
+          );
+          // The saved track is the user's intent; a retry picks it up from here.
+          assert.equal((yield* updates.getState).channel, "nightly");
+
+          // A plain update afterwards cannot reach the build the switch refused.
+          yield* Queue.offer(requests, request("req-plain"));
+          yield* settle;
+          harness.emit("update-available", { version: older });
+          yield* settle;
+          assert.isNull((yield* updates.getState).availableVersion);
+          assert.equal(harness.downloadCount(), 0);
+        }),
+      );
+    },
+  );
+
+  it.effect("only saves the track on a host already running the release", () => {
+    const harness = makeHarness({ savedChannel: "nightly" });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* Queue.offer(requests, {
+          ...request("req-track-only"),
+          channel: "latest",
+          targetVersion: "1.2.3",
+        });
+        yield* settle;
+        // Even with a newer build on the feed, the host only saves its track.
+        harness.emit("update-available", { version: "1.2.4" });
+        yield* settle;
+
+        assert.deepEqual(
+          terminalReports(reports).map((report) => report.outcome),
+          ["up-to-date"],
+        );
+        assert.equal((yield* updates.getState).channel, "latest");
+        assert.equal(harness.downloadCount(), 0);
+      }),
+    );
+  });
+
+  it.effect("drops a retained download below the switch's checked release", () => {
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        // Downloaded earlier on this Stable host, before the switch checked 1.2.5.
+        harness.emit("update-downloaded", { version: "1.2.4" });
+        yield* settle;
+        assert.equal((yield* updates.getState).downloadedVersion, "1.2.4");
+
+        yield* Queue.offer(requests, {
+          ...request("req-floor"),
+          channel: "latest",
+          targetVersion: "1.2.5",
+        });
+        yield* settle;
+        harness.emit("update-available", { version: "1.2.5" });
+        yield* settle;
+        harness.emit("update-downloaded", { version: "1.2.5" });
+        yield* settle;
+
+        assert.deepEqual(
+          terminalReports(reports).map((report) => [
+            report.outcome,
+            report.state.downloadedVersion,
+          ]),
+          [["ready-to-install", "1.2.5"]],
+        );
+      }),
+    );
+  });
+
+  it.effect("refuses to cross tracks remotely while WSL backends need their own checks", () => {
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void, wslBackend: true });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* Queue.offer(requests, {
+          ...request("req-wsl"),
+          channel: "nightly",
+          targetVersion: "1.2.4-nightly.20261027.1",
+        });
+        yield* settle;
+
+        assert.deepEqual(
+          terminalReports(reports).map((report) => report.outcome),
+          ["failed"],
+        );
+        assert.include(terminalReports(reports)[0]?.reason ?? "", "Switch it on that machine");
+        assert.equal((yield* updates.getState).channel, "latest");
+      }),
+    );
+  });
+
+  it.effect("fails a switch that leaves a same-track host below the checked release", () => {
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        yield* Queue.offer(requests, {
+          ...request("req-behind"),
+          channel: "latest",
+          targetVersion: "1.2.5",
+        });
+        yield* settle;
+        // The feed lags npm and has nothing newer than this host's 1.2.3.
+        harness.emit("update-not-available");
+        yield* settle;
+        harness.emit("update-not-available");
+        yield* settle;
+
+        assert.deepEqual(
+          terminalReports(reports).map((report) => [report.outcome, report.reason]),
+          [["failed", "The desktop app found no build of 1.2.5."]],
+        );
+      }),
+    );
+  });
+
+  it.effect("fails a crossing to an older-numbered Stable that the feed does not offer", () => {
+    const harness = makeHarness({
+      appVersion: "1.2.4-nightly.20261027.1",
+      beforeSetUpdateChannel: Effect.void,
+    });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        yield* Queue.offer(requests, {
+          ...request("req-to-stable"),
+          channel: "latest",
+          targetVersion: "1.2.3",
+        });
+        yield* settle;
+        harness.emit("update-not-available");
+        yield* settle;
+        harness.emit("update-not-available");
+        yield* settle;
+
+        // Still on Nightly, though the target is numbered below this build.
+        assert.deepEqual(
+          terminalReports(reports).map((report) => [report.outcome, report.reason]),
+          [["failed", "The desktop app found no build of 1.2.3."]],
+        );
+      }),
+    );
+  });
+
+  it.effect("accepts a newer build than the checked release on the requested track", () => {
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+    return runRemoteUpdatesTest(harness, ({ reports, requests }) =>
+      Effect.gen(function* () {
+        const newer = "1.2.4-nightly.20261028.2";
+        yield* Queue.offer(requests, {
+          ...request("req-newer"),
+          channel: "nightly",
+          targetVersion: "1.2.4-nightly.20261027.1",
+        });
+        yield* settle;
+        harness.emit("update-available", { version: newer });
+        yield* settle;
+        harness.emit("update-downloaded", { version: newer });
+        yield* settle;
+
+        assert.deepEqual(
+          terminalReports(reports).map((report) => [
+            report.outcome,
+            report.state.downloadedVersion,
+          ]),
+          [["ready-to-install", newer]],
+        );
+      }),
+    );
+  });
+
   it.effect("reports a failed outcome when quitAndInstall fails", () => {
     const harness = makeHarness({
       quitAndInstall: Effect.fail(
@@ -525,6 +758,42 @@ describe("DesktopRemoteUpdates", () => {
     );
   });
 
+  it.effect("cancels a track switch while its own feed check is still running", () => {
+    const releaseCheck = Deferred.makeUnsafe<void>();
+    const harness = makeHarness({
+      beforeSetUpdateChannel: Effect.void,
+      checkForUpdates: Deferred.await(releaseCheck),
+    });
+
+    return runRemoteUpdatesTest(harness, ({ requests, cancellations }) =>
+      Effect.gen(function* () {
+        yield* Queue.offer(requests, {
+          ...request("req-switch-cancel"),
+          channel: "nightly",
+          targetVersion: "1.2.4-nightly.20261027.1",
+        });
+        yield* settle;
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* Queue.offer(cancellations, {
+          version: 1,
+          type: "cancelDesktopUpdate",
+          requestId: "req-switch-cancel",
+        });
+        yield* settle;
+        // The next request starts without waiting for the cancelled switch's feed check.
+        yield* Queue.offer(requests, {
+          ...request("req-switch-back"),
+          channel: "latest",
+          targetVersion: "1.2.3",
+        });
+        yield* settle;
+
+        assert.equal((yield* updates.getState).channel, "latest");
+        yield* Deferred.succeed(releaseCheck, undefined);
+      }),
+    );
+  });
+
   it.effect("cancels an active preparation so the next request can run", () => {
     const releaseCheck = Deferred.makeUnsafe<void>();
     const harness = makeHarness({ checkForUpdates: Deferred.await(releaseCheck) });
diff --git a/apps/desktop/src/updates/DesktopRemoteUpdates.ts b/apps/desktop/src/updates/DesktopRemoteUpdates.ts
index cb606d8fbd253..560e2e78d4bb1 100644
--- a/apps/desktop/src/updates/DesktopRemoteUpdates.ts
+++ b/apps/desktop/src/updates/DesktopRemoteUpdates.ts
@@ -10,10 +10,13 @@ import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as Queue from "effect/Queue";
 import * as Ref from "effect/Ref";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
+import { compareSemverVersions } from "@t3tools/shared/semver";
 import type * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 
 import * as DesktopObservability from "../app/DesktopObservability.ts";
+import * as DesktopBackendPool from "../backend/DesktopBackendPool.ts";
 import * as DesktopTelemetryPublisher from "../telemetry/DesktopTelemetryPublisher.ts";
 import * as DesktopUpdates from "./DesktopUpdates.ts";
 import {
@@ -44,9 +47,13 @@ type CommitClaim =
 export const listen: Effect.Effect<
   void,
   never,
-  DesktopUpdates.DesktopUpdates | DesktopTelemetryPublisher.DesktopTelemetryPublisher | Scope.Scope
+  | DesktopUpdates.DesktopUpdates
+  | DesktopTelemetryPublisher.DesktopTelemetryPublisher
+  | DesktopBackendPool.DesktopBackendPool
+  | Scope.Scope
 > = Effect.gen(function* () {
   const updates = yield* DesktopUpdates.DesktopUpdates;
+  const backends = yield* DesktopBackendPool.DesktopBackendPool;
   const publisher = yield* DesktopTelemetryPublisher.DesktopTelemetryPublisher;
   const activeRequestIdRef = yield* Ref.make(Option.none<string>());
   const requestControlRef = yield* Ref.make<{
@@ -171,7 +178,59 @@ export const listen: Effect.Effect<
           return;
         }
         yield* Ref.set(activeRequestIdRef, Option.some(request.requestId));
-        yield* logInfo("remote update requested", { requestId: request.requestId });
+        yield* logInfo("remote update requested", {
+          requestId: request.requestId,
+          channel: request.channel,
+        });
+        // A switch saves its track first, so the step machine never sees the old track's offer.
+        // The saved track is the user's intent and stays even if this request fails: a track saved
+        // toward Stable never offers an older build outside a guarded switch.
+        if (request.channel !== undefined) {
+          // A reinstall restarts every backend, but the requesting server checked only its own
+          // database. A WSL backend keeps its own, so cross tracks only where all can be checked.
+          const current = yield* updates.getState;
+          if (
+            desktopUpdateChannelOf(current.currentVersion) !== request.channel &&
+            (yield* backends.list).length > 1
+          ) {
+            yield* publishReport(
+              current,
+              {
+                outcome: "failed",
+                reason:
+                  "This desktop app also runs WSL backends, whose databases a remote switch cannot check. Switch it on that machine.",
+              },
+              request.requestId,
+            );
+            return;
+          }
+          const switched = yield* Effect.raceFirst(
+            updates.setChannel(request.channel, { minimumVersion: request.targetVersion }).pipe(
+              Effect.as(true),
+              Effect.catch((error) =>
+                updates.getState.pipe(
+                  Effect.flatMap((state) =>
+                    publishReport(
+                      state,
+                      { outcome: "failed", reason: error.message },
+                      request.requestId,
+                    ),
+                  ),
+                  Effect.as(false),
+                ),
+              ),
+            ),
+            Deferred.await(cancellation).pipe(Effect.as(false)),
+          );
+          if (!switched) return;
+          // A host already running the target only needed its track saved; installing a newer
+          // build here would restart it without the dialog having said so.
+          const state = yield* updates.getState;
+          if (request.targetVersion === state.currentVersion) {
+            yield* publishReport(state, { outcome: "up-to-date" }, request.requestId);
+            return;
+          }
+        }
         const { latest, changes } = yield* updates.subscribe;
         const disabledReason = Option.getOrNull(yield* updates.disabledReason);
         let attempts: RemoteDesktopUpdateAttempts = { checks: 0, downloads: 0 };
@@ -184,6 +243,12 @@ export const listen: Effect.Effect<
             Effect.forkScoped,
           );
 
+        // A host leaving its build's track may need an older build, down to the checked release;
+        // the updater offers nothing below it.
+        const crossing = (state: DesktopUpdateState) =>
+          request.channel !== undefined &&
+          request.targetVersion !== undefined &&
+          desktopUpdateChannelOf(state.currentVersion) !== request.channel;
         const step = Effect.fn("DesktopRemoteUpdates.step")(function* (
           state: DesktopUpdateState,
         ): Effect.fn.Return<boolean, never, Scope.Scope> {
@@ -193,7 +258,7 @@ export const listen: Effect.Effect<
               return false;
             case "check":
               attempts = { ...attempts, checks: attempts.checks + 1 };
-              yield* updates.check("remote-update").pipe(
+              yield* updates.check("remote-update", { allowDowngrade: crossing(state) }).pipe(
                 Effect.flatMap((result) => {
                   if (result.checked) return Effect.void;
                   attempts = { ...attempts, checks: attempts.checks - 1 };
@@ -246,21 +311,34 @@ export const listen: Effect.Effect<
               yield* logInfo("remote update prepared", { requestId: request.requestId });
               return true;
             }
-            case "done":
+            case "done": {
+              // A switch that leaves the host on its old track, or below its checked release, did
+              // not reach it; a track-only host already at the release is done.
+              const done =
+                request.targetVersion !== undefined &&
+                next.outcome === "up-to-date" &&
+                (crossing(state) ||
+                  compareSemverVersions(state.currentVersion, request.targetVersion) < 0)
+                  ? {
+                      outcome: "failed" as const,
+                      reason: `The desktop app found no build of ${request.targetVersion}.`,
+                    }
+                  : next;
               yield* publishReport(
                 state,
                 {
-                  outcome: next.outcome,
-                  ...(next.reason === undefined ? {} : { reason: next.reason }),
+                  outcome: done.outcome,
+                  ...(done.reason === undefined ? {} : { reason: done.reason }),
                 },
                 request.requestId,
               );
               yield* logInfo("remote update finished", {
                 requestId: request.requestId,
-                outcome: next.outcome,
-                reason: next.reason ?? null,
+                outcome: done.outcome,
+                reason: done.reason ?? null,
               });
               return true;
+            }
           }
         });
 
diff --git a/apps/desktop/src/updates/DesktopUpdates.test.ts b/apps/desktop/src/updates/DesktopUpdates.test.ts
index d2f24143fc209..c6bcd46b8c206 100644
--- a/apps/desktop/src/updates/DesktopUpdates.test.ts
+++ b/apps/desktop/src/updates/DesktopUpdates.test.ts
@@ -2,6 +2,7 @@ import { assert, describe, it } from "@effect/vitest";
 import { DESKTOP_UPDATE_RESTART_MARKER_FILE } from "@t3tools/contracts";
 import * as Cause from "effect/Cause";
 import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
@@ -694,6 +695,65 @@ describe("DesktopUpdates", () => {
     ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
   });
 
+  it.effect("ignores a finished download from a track it no longer follows", () => {
+    const harness = makeHarness();
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        // A backed-out switch's download keeps reporting progress until it finishes.
+        harness.emit("download-progress", { percent: 40 });
+        yield* flushCallbacks;
+        harness.emit("update-downloaded", { version: "1.2.4-nightly.20261027.1" });
+        yield* flushCallbacks;
+
+        const state = yield* updates.getState;
+        assert.equal(state.downloadedVersion, null);
+        assert.notEqual(state.status, "downloading");
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("offers older releases only to checks that leave the running build's track", () => {
+    const harness = makeHarness({ beforeSetUpdateChannel: Effect.void });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        const before = harness.checkAllowedDowngrade.length;
+        yield* updates.setChannel("nightly");
+        yield* updates.setChannel("latest");
+        yield* updates.check("remote-update", { allowDowngrade: true });
+
+        // Back on its own Stable track the build never needs an older release.
+        assert.deepEqual(harness.checkAllowedDowngrade.slice(before), [true, false, true]);
+        assert.isFalse(harness.allowDowngrade());
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("re-checks a saved track that differs from the running build's track", () => {
+    const harness = makeHarness({
+      appVersion: "1.2.4-nightly.20261027.1",
+      beforeSetUpdateChannel: Effect.void,
+    });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        yield* updates.setChannel("latest");
+        const checks = harness.checkCount();
+
+        yield* updates.setChannel("latest");
+
+        assert.equal(harness.checkCount(), checks + 1);
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
   it.effect("does not persist an unchanged update channel as a user preference", () => {
     const harness = makeHarness();
 
@@ -713,6 +773,116 @@ describe("DesktopUpdates", () => {
     ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
   });
 
+  it.effect("offers nothing below a track switch's checked release", () => {
+    const harness = makeHarness({
+      appVersion: "1.2.4-nightly.20261027.1",
+      beforeSetUpdateChannel: Effect.void,
+    });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        yield* updates.setChannel("latest", { minimumVersion: "1.2.3" });
+
+        harness.emit("update-available", { version: "1.2.2" });
+        yield* flushCallbacks;
+        assert.isNull((yield* updates.getState).availableVersion);
+        harness.emit("update-downloaded", { version: "1.2.2" });
+        yield* flushCallbacks;
+        assert.isNull((yield* updates.getState).downloadedVersion);
+
+        harness.emit("update-available", { version: "1.2.3" });
+        yield* flushCallbacks;
+        assert.equal((yield* updates.getState).availableVersion, "1.2.3");
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("keeps a saved Stable track across a restart without offering an older release", () => {
+    // A Nightly build whose switch to Stable did not finish before the app quit.
+    const harness = makeHarness({ appVersion: "1.2.4-nightly.20261027.1", savedChannel: "latest" });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        yield* updates.check("startup");
+
+        assert.equal((yield* updates.getState).channel, "latest");
+        assert.deepEqual(harness.checkAllowedDowngrade, [false]);
+        // Semver ranks Stable 1.2.4 above this Nightly, but a Nightly built before the release's
+        // version bump can hold migrations 1.2.4 lacks. Crossing needs a guarded switch.
+        harness.emit("update-available", { version: "1.2.4" });
+        yield* flushCallbacks;
+        assert.isNull((yield* updates.getState).availableVersion);
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("keeps a saved Nightly track across a restart without crossing on its own", () => {
+    // A Stable build whose switch to Nightly was refused before the app quit; its floor is gone.
+    const harness = makeHarness({ savedChannel: "nightly" });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        yield* updates.check("startup");
+        harness.emit("update-available", { version: "1.2.4-nightly.20261027.1" });
+        yield* flushCallbacks;
+
+        assert.equal((yield* updates.getState).channel, "nightly");
+        assert.isNull((yield* updates.getState).availableVersion);
+        assert.deepEqual(harness.checkAllowedDowngrade, [false]);
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("never offers an older Nightly to a Nightly build's own checks", () => {
+    const harness = makeHarness({ appVersion: "1.2.4-nightly.20261027.1" });
+
+    return Effect.scoped(
+      Effect.gen(function* () {
+        const updates = yield* DesktopUpdates.DesktopUpdates;
+        yield* updates.configure;
+        yield* updates.check("poll");
+
+        assert.equal((yield* updates.getState).channel, "nightly");
+        assert.deepEqual(harness.checkAllowedDowngrade, [false]);
+      }),
+    ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+  });
+
+  it.effect("waits out a background check instead of refusing a track change", () =>
+    Effect.gen(function* () {
+      const checkStarted = yield* Deferred.make<void>();
+      const releaseCheck = yield* Deferred.make<void>();
+      const harness = makeHarness({
+        beforeSetUpdateChannel: Effect.void,
+        checkForUpdates: Deferred.succeed(checkStarted, undefined).pipe(
+          Effect.andThen(Deferred.await(releaseCheck)),
+        ),
+      });
+
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const updates = yield* DesktopUpdates.DesktopUpdates;
+          yield* updates.configure;
+          yield* updates.check("poll").pipe(Effect.forkScoped);
+          yield* Deferred.await(checkStarted);
+
+          const channelFiber = yield* updates.setChannel("nightly").pipe(Effect.forkScoped);
+          yield* Deferred.succeed(releaseCheck, undefined);
+          yield* TestClock.adjust(Duration.seconds(2));
+          const state = yield* Fiber.join(channelFiber);
+
+          assert.equal(state.channel, "nightly");
+        }),
+      ).pipe(Effect.provide(Layer.merge(TestClock.layer(), harness.layer)));
+    }),
+  );
+
   it.effect("rejects checks while an update channel change is being persisted", () =>
     Effect.gen(function* () {
       const channelChangeStarted = yield* Deferred.make<void>();
diff --git a/apps/desktop/src/updates/DesktopUpdates.ts b/apps/desktop/src/updates/DesktopUpdates.ts
index aeda73f2bfad3..4da742f453aa6 100644
--- a/apps/desktop/src/updates/DesktopUpdates.ts
+++ b/apps/desktop/src/updates/DesktopUpdates.ts
@@ -19,6 +19,7 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as PubSub from "effect/PubSub";
 import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Semaphore from "effect/Semaphore";
@@ -34,7 +35,8 @@ import * as ElectronWindow from "../electron/ElectronWindow.ts";
 import * as IpcChannels from "../ipc/channels.ts";
 import * as DesktopAppSettings from "../settings/DesktopAppSettings.ts";
 import { normalizeDesktopUpdateReleaseNotes } from "./releaseNotes.ts";
-import { resolveDefaultDesktopUpdateChannel } from "./updateChannels.ts";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
+import { compareSemverVersions } from "@t3tools/shared/semver";
 import {
   createInitialDesktopUpdateState,
   reduceDesktopUpdateStateOnCheckFailure,
@@ -49,6 +51,8 @@ import {
   resolveNotAppliedInstallVersion,
 } from "./updateMachine.ts";
 
+const CHANNEL_CHANGE_RETRY_DELAY = Duration.seconds(1);
+const CHANNEL_CHANGE_RETRIES = 30;
 const AUTO_UPDATE_STARTUP_DELAY = "15 seconds";
 const AUTO_UPDATE_POLL_INTERVAL = "4 minutes";
 const PREPARED_INSTALL_CHECK_WAIT = Duration.seconds(90);
@@ -179,10 +183,16 @@ export class DesktopUpdates extends Context.Service<
     readonly emitState: Effect.Effect<void>;
     readonly disabledReason: Effect.Effect<Option.Option<string>>;
     readonly configure: Effect.Effect<void, never, Scope.Scope>;
+    /** `minimumVersion` is a track switch's checked release; nothing older is offered after. */
     readonly setChannel: (
       channel: DesktopUpdateChannel,
+      options?: { readonly minimumVersion?: string | undefined },
     ) => Effect.Effect<DesktopUpdateState, DesktopUpdateSetChannelError>;
-    readonly check: (reason: string) => Effect.Effect<DesktopUpdateCheckResult>;
+    /** `allowDowngrade` is for a guarded track switch, which checked that older release. */
+    readonly check: (
+      reason: string,
+      options?: { readonly allowDowngrade?: boolean },
+    ) => Effect.Effect<DesktopUpdateCheckResult>;
     readonly download: Effect.Effect<DesktopUpdateActionResult>;
     readonly install: Effect.Effect<DesktopUpdateActionResult>;
     readonly installPrepared: (
@@ -351,6 +361,20 @@ export const make = Effect.gen(function* () {
   const updaterConfiguredRef = yield* Ref.make(false);
   const lastLoggedDownloadMilestoneRef = yield* Ref.make(-1);
   const notAppliedVersionRef = yield* Ref.make(Option.none<string>());
+  // The release a track switch's database check cleared. A build crosses to another track only
+  // through such a switch, and never below that release: version order alone cannot tell whether
+  // a Stable knows a Nightly's migrations.
+  const releaseFloorRef = yield* Ref.make(Option.none<string>());
+  const offerable = (version: string, state: DesktopUpdateState) =>
+    Ref.get(releaseFloorRef).pipe(
+      Effect.map(
+        (floor) =>
+          desktopUpdateChannelOf(version) === state.channel &&
+          (Option.isSome(floor)
+            ? compareSemverVersions(version, floor.value) >= 0
+            : desktopUpdateChannelOf(environment.appVersion) === state.channel),
+      ),
+    );
   const updateStateRef = yield* Ref.make<DesktopUpdateState>(
     createInitialDesktopUpdateState(
       environment.appVersion,
@@ -454,12 +478,13 @@ export const make = Effect.gen(function* () {
     const allowsPrerelease = channel === "nightly";
     yield* electronUpdater.setChannel(channel);
     yield* electronUpdater.setAllowPrerelease(allowsPrerelease);
-    yield* electronUpdater.setAllowDowngrade(allowsPrerelease);
+    // An older build can lack migrations this one ran. Only a guarded track switch's own check
+    // may offer one.
+    yield* electronUpdater.setAllowDowngrade(false);
     yield* electronUpdater.setFullChangelog(allowsPrerelease);
     yield* logUpdaterInfo("using update channel", {
       channel,
       allowPrerelease: allowsPrerelease,
-      allowDowngrade: allowsPrerelease,
       fullChangelog: allowsPrerelease,
     });
   });
@@ -467,6 +492,7 @@ export const make = Effect.gen(function* () {
   const checkForUpdates = Effect.fn("desktop.updates.checkForUpdates")(function* (
     reason: string,
     actionReservation: "acquire" | "held" = "acquire",
+    allowDowngrade = false,
   ) {
     yield* Effect.annotateCurrentSpan({ reason });
     if (yield* Ref.get(desktopState.quitting)) return false;
@@ -488,7 +514,11 @@ export const make = Effect.gen(function* () {
       yield* setState(reduceDesktopUpdateStateOnCheckStart(state, checkedAt));
       yield* logUpdaterInfo("checking for updates", { reason });
 
+      // The flag is shared updater state, so it flips only while this check holds the reservation.
+      const restoreDowngrade = yield* electronUpdater.allowDowngrade;
+      if (allowDowngrade) yield* electronUpdater.setAllowDowngrade(true);
       return yield* electronUpdater.checkForUpdates.pipe(
+        Effect.ensuring(electronUpdater.setAllowDowngrade(restoreDowngrade).pipe(Effect.ignore)),
         Effect.as(true),
         Effect.catchTags({
           ElectronUpdaterCheckForUpdatesError: Effect.fn(
@@ -849,8 +879,8 @@ export const make = Effect.gen(function* () {
       Effect.flatMap(
         Effect.fn("desktop.updates.applyUpdateAvailable")(function* (info) {
           const state = yield* Ref.get(updateStateRef);
-          if (resolveDefaultDesktopUpdateChannel(info.version) !== state.channel) {
-            yield* logUpdaterInfo("ignoring update that does not match selected channel", {
+          if (!(yield* offerable(info.version, state))) {
+            yield* logUpdaterInfo("ignoring update outside the selected channel or its floor", {
               version: info.version,
               channel: state.channel,
             });
@@ -986,6 +1016,20 @@ export const make = Effect.gen(function* () {
       Effect.flatMap(
         Effect.fn("desktop.updates.applyUpdateDownloaded")(function* (info) {
           const state = yield* Ref.get(updateStateRef);
+          // A download can finish after its track switch moved on; never offer that build.
+          if (!(yield* offerable(info.version, state))) {
+            yield* logUpdaterInfo("ignoring download outside the selected channel or its floor", {
+              version: info.version,
+              channel: state.channel,
+            });
+            // Its progress events left the updater "downloading", which would block every check.
+            if (state.status === "downloading") {
+              yield* setState(
+                reduceDesktopUpdateStateOnNoUpdate(state, yield* currentIsoTimestamp),
+              );
+            }
+            return;
+          }
           yield* setState(reduceDesktopUpdateStateOnDownloadComplete(state, info.version));
           yield* logUpdaterInfo("update downloaded", { version: info.version });
         }),
@@ -1092,9 +1136,17 @@ export const make = Effect.gen(function* () {
     }).pipe(Effect.withSpan("desktop.updates.configure")),
     setChannel: Effect.fn("desktop.updates.setChannel")(function* (
       nextChannel: DesktopUpdateChannel,
+      options?: { readonly minimumVersion?: string | undefined },
     ) {
       yield* Effect.annotateCurrentSpan({ channel: nextChannel });
-      const activeAction = yield* tryStartChannelChange;
+      // A background check holds the updater only briefly, so wait it out instead of refusing.
+      const activeAction = yield* tryStartChannelChange.pipe(
+        Effect.repeat({
+          while: (active) => Option.isSome(active) && active.value === "check",
+          schedule: Schedule.spaced(CHANNEL_CHANGE_RETRY_DELAY),
+          times: CHANNEL_CHANGE_RETRIES,
+        }),
+      );
       if (Option.isSome(activeAction)) {
         return yield* new DesktopUpdateActionInProgressError({
           action: activeAction.value === "install-recovery" ? "install" : activeAction.value,
@@ -1103,8 +1155,16 @@ export const make = Effect.gen(function* () {
       }
 
       return yield* Effect.gen(function* () {
+        yield* Ref.set(releaseFloorRef, Option.fromNullishOr(options?.minimumVersion));
         const state = yield* Ref.get(updateStateRef);
-        if (nextChannel === state.channel) {
+        const retained = state.downloadedVersion ?? state.availableVersion;
+        // A build from another track re-checks, so retrying a track switch finds an older release.
+        // So does a retained offer below the new floor, which must not install.
+        if (
+          nextChannel === state.channel &&
+          nextChannel === desktopUpdateChannelOf(environment.appVersion) &&
+          (retained === null || (yield* offerable(retained, state)))
+        ) {
           return state;
         }
 
@@ -1124,15 +1184,19 @@ export const make = Effect.gen(function* () {
         }
 
         yield* applyAutoUpdaterChannel(nextChannel);
-        const allowDowngrade = yield* electronUpdater.allowDowngrade;
-        yield* electronUpdater.setAllowDowngrade(true);
-        yield* checkForUpdates("channel-change", "held").pipe(
-          Effect.ensuring(electronUpdater.setAllowDowngrade(allowDowngrade).pipe(Effect.ignore)),
+        // Only leaving the running build's track can need an older release.
+        yield* checkForUpdates(
+          "channel-change",
+          "held",
+          nextChannel !== desktopUpdateChannelOf(environment.appVersion),
         );
         return yield* Ref.get(updateStateRef);
       }).pipe(Effect.ensuring(finishUpdateAction("channel")));
     }),
-    check: Effect.fn("desktop.updates.check")(function* (reason: string) {
+    check: Effect.fn("desktop.updates.check")(function* (
+      reason: string,
+      options?: { readonly allowDowngrade?: boolean },
+    ) {
       yield* Effect.annotateCurrentSpan({ reason });
       if (!(yield* Ref.get(updaterConfiguredRef))) {
         return {
@@ -1140,7 +1204,7 @@ export const make = Effect.gen(function* () {
           state: yield* Ref.get(updateStateRef),
         };
       }
-      const checked = yield* checkForUpdates(reason);
+      const checked = yield* checkForUpdates(reason, "acquire", options?.allowDowngrade === true);
       return {
         checked,
         state: yield* Ref.get(updateStateRef),
diff --git a/apps/desktop/src/updates/releaseNotes.ts b/apps/desktop/src/updates/releaseNotes.ts
index 69d710ff7b269..8698d8d499118 100644
--- a/apps/desktop/src/updates/releaseNotes.ts
+++ b/apps/desktop/src/updates/releaseNotes.ts
@@ -1,6 +1,6 @@
 import type { DesktopUpdateChannel, DesktopUpdateReleaseNote } from "@t3tools/contracts";
 
-import { resolveDefaultDesktopUpdateChannel } from "./updateChannels.ts";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
 
 interface ElectronReleaseNoteInfo {
   readonly version: string;
@@ -134,7 +134,7 @@ export function normalizeDesktopUpdateReleaseNotes(
       : Array.isArray(releaseNotes)
         ? releaseNotes.filter(isElectronReleaseNoteInfo)
         : []
-  ).filter((entry) => resolveDefaultDesktopUpdateChannel(entry.version) === channel);
+  ).filter((entry) => desktopUpdateChannelOf(entry.version) === channel);
 
   const normalizedNotes = rawNotes.flatMap((entry) => {
     const { items, totalItems } = extractReleaseNoteItems(entry.note);
diff --git a/apps/desktop/src/updates/updateChannels.ts b/apps/desktop/src/updates/updateChannels.ts
index d79a374a668a5..b07735ceb7a29 100644
--- a/apps/desktop/src/updates/updateChannels.ts
+++ b/apps/desktop/src/updates/updateChannels.ts
@@ -1,13 +1,6 @@
-import type { DesktopUpdateChannel } from "@t3tools/contracts";
-
-const NIGHTLY_VERSION_PATTERN = /^[^-+]+-nightly\.\d{8}\.\d+$/;
 // Preview builds share nightly branding but ship without an update feed.
 const PRERELEASE_VERSION_PATTERN = /^[^-+]+-(?:nightly|preview)\.\d{8}\.\d+$/;
 
 export function isNightlyDesktopVersion(version: string): boolean {
   return PRERELEASE_VERSION_PATTERN.test(version);
 }
-
-export function resolveDefaultDesktopUpdateChannel(appVersion: string): DesktopUpdateChannel {
-  return NIGHTLY_VERSION_PATTERN.test(appVersion) ? "nightly" : "latest";
-}
diff --git a/apps/desktop/src/updates/updatesTestHarness.ts b/apps/desktop/src/updates/updatesTestHarness.ts
index 1d8c21a42dfe5..d8d16b7dbfd62 100644
--- a/apps/desktop/src/updates/updatesTestHarness.ts
+++ b/apps/desktop/src/updates/updatesTestHarness.ts
@@ -35,6 +35,11 @@ export interface UpdatesHarnessOptions {
   readonly platform?: NodeJS.Platform;
   readonly packageType?: string | undefined;
   readonly installRecord?: string | undefined;
+  readonly appVersion?: string;
+  /** Starts from in-memory settings with this track saved, as after a restart. */
+  readonly savedChannel?: DesktopAppSettings.DesktopSettings["updateChannel"];
+  /** Adds a WSL backend beside the primary, as on a Windows host with WSL enabled. */
+  readonly wslBackend?: boolean;
 }
 
 export function makeHarness(options: UpdatesHarnessOptions = {}) {
@@ -42,6 +47,7 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
   let quitAndInstallCount = 0;
   let downloadCount = 0;
   let allowDowngrade = false;
+  const checkAllowedDowngrade: boolean[] = [];
   let fullChangelog = false;
   const feedUrls: ElectronUpdater.ElectronUpdaterFeedUrl[] = [];
   const listeners = new Map<string, Set<(...args: readonly unknown[]) => void>>();
@@ -86,6 +92,7 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
     setDisableDifferentialDownload: () => options.setDisableDifferentialDownload ?? Effect.void,
     checkForUpdates: Effect.sync(() => {
       checkCount += 1;
+      checkAllowedDowngrade.push(allowDowngrade);
     }).pipe(Effect.andThen(options.checkForUpdates ?? Effect.void)),
     downloadUpdate: Effect.sync(() => {
       downloadCount += 1;
@@ -149,7 +156,17 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
     waitForReady: () => Effect.succeed(true),
   };
   const layerBackend = DesktopBackendPool.layerTest(
-    options.backendInstances ?? [stubBackendInstance],
+    options.backendInstances ??
+      (options.wslBackend
+        ? [
+            stubBackendInstance,
+            {
+              ...stubBackendInstance,
+              id: DesktopBackendPool.BackendInstanceId("wsl:Ubuntu"),
+              label: Effect.succeed("Ubuntu"),
+            },
+          ]
+        : [stubBackendInstance]),
   );
 
   const layerEnvironment = DesktopEnvironment.layer({
@@ -157,7 +174,7 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
     homeDirectory: `/tmp/t3-desktop-updates-home-${process.pid}`,
     platform: options.platform ?? "darwin",
     processArch: "x64",
-    appVersion: "1.2.3",
+    appVersion: options.appVersion ?? "1.2.3",
     appPath: "/repo",
     isPackaged: true,
     resourcesPath: "/missing/resources",
@@ -178,10 +195,13 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
 
   let testSettings: DesktopAppSettings.DesktopSettings = {
     ...DesktopAppSettings.DEFAULT_DESKTOP_SETTINGS,
+    ...(options.savedChannel === undefined
+      ? {}
+      : { updateChannel: options.savedChannel, updateChannelConfiguredByUser: true }),
   };
   const setUpdateChannelError = options.setUpdateChannelError;
   const layerSettings =
-    setUpdateChannelError || options.beforeSetUpdateChannel
+    setUpdateChannelError || options.beforeSetUpdateChannel || options.savedChannel
       ? Layer.succeed(DesktopAppSettings.DesktopAppSettings, {
           get: Effect.sync(() => testSettings),
           load: Effect.sync(() => testSettings),
@@ -279,6 +299,9 @@ export function makeHarness(options: UpdatesHarnessOptions = {}) {
     downloadCount: () => downloadCount,
     feedUrls: (): ElectronUpdater.ElectronUpdaterFeedUrl[] => feedUrls,
     fullChangelog: () => fullChangelog,
+    /** Whether each feed check could offer an older release, and the flag now. */
+    checkAllowedDowngrade,
+    allowDowngrade: () => allowDowngrade,
     listenerCount: () =>
       Array.from(listeners.values()).reduce(
         (total, eventListeners) => total + eventListeners.size,
diff --git a/apps/server/src/cloud/selfUpdate.test.ts b/apps/server/src/cloud/selfUpdate.test.ts
index 84877d41a70c9..1e3157adfff59 100644
--- a/apps/server/src/cloud/selfUpdate.test.ts
+++ b/apps/server/src/cloud/selfUpdate.test.ts
@@ -313,3 +313,36 @@ it.layer(NodeServices.layer)("pruning runtimes on start", (it) => {
     }),
   );
 });
+
+it("a host crosses tracks only to a release that knows its whole database", () => {
+  const cross = (
+    serverVersion: string,
+    targetVersion: string,
+    targetDatabaseMigration: number | undefined,
+    databaseMigration = 72,
+  ) =>
+    ServerSelfUpdate.trackSwitchBlockReason({
+      serverVersion,
+      targetVersion,
+      targetDatabaseMigration,
+      databaseMigration: () => databaseMigration,
+    });
+  const nightly = "0.1.4-nightly.20261027.3796";
+
+  expect(cross(nightly, "0.1.4", 72)).toBeNull();
+  // Another client moved this host to a newer Nightly after the switch was planned.
+  expect(cross(nightly, "0.1.4", 72, 73)).toContain("does not support yet");
+  expect(cross(nightly, "0.1.4", undefined)).toContain("Cannot confirm");
+  // A Stable tag can carry a migration the latest Nightly lacks.
+  expect(cross("0.1.4", nightly, 72, 73)).toContain("does not support yet");
+  expect(cross("0.1.3", "0.1.4", undefined)).toBeNull();
+  // A database that exists but cannot be read proves nothing.
+  expect(
+    ServerSelfUpdate.trackSwitchBlockReason({
+      serverVersion: nightly,
+      targetVersion: "0.1.4",
+      targetDatabaseMigration: 72,
+      databaseMigration: () => undefined,
+    }),
+  ).toContain("Cannot confirm");
+});
diff --git a/apps/server/src/cloud/selfUpdate.ts b/apps/server/src/cloud/selfUpdate.ts
index ab6a69fc50a83..d72c5e9218df2 100644
--- a/apps/server/src/cloud/selfUpdate.ts
+++ b/apps/server/src/cloud/selfUpdate.ts
@@ -20,11 +20,12 @@ import * as Queue from "effect/Queue";
 import * as Stream from "effect/Stream";
 import { HttpClient } from "effect/http";
 
-import { CLI_RELEASE_BASE_URL_ENV } from "@t3tools/shared/cliRelease";
+import { CLI_RELEASE_BASE_URL_ENV, crossesReleaseTrack } from "@t3tools/shared/cliRelease";
 
 import packageJson from "../../package.json" with { type: "json" };
 import * as ServerConfig from "../config.ts";
 import * as DesktopAppUpdate from "../desktopUpdate/DesktopAppUpdate.ts";
+import { databaseMigrationHead } from "../persistence/databaseMigrationHead.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import {
   ensurePinnedRuntimeInstalled,
@@ -93,6 +94,26 @@ export const pruneRuntimesOnStart = Effect.fn("cloud.server_self_update.prune_on
   },
 );
 
+/** The client checks this when planning; the host checks again because its database may have
+ * moved on since (another client updated it). Stable and Nightly each build their own commits,
+ * so crossing tracks needs the target release to know every migration this database holds. */
+export function trackSwitchBlockReason(input: {
+  readonly serverVersion: string;
+  readonly targetVersion: string;
+  readonly targetDatabaseMigration: number | undefined;
+  /** Read only for a crossing; undefined when the database cannot be read. */
+  readonly databaseMigration: () => number | undefined;
+}): string | null {
+  if (!crossesReleaseTrack(input.serverVersion, input.targetVersion)) return null;
+  const databaseMigration = input.databaseMigration();
+  if (input.targetDatabaseMigration === undefined || databaseMigration === undefined) {
+    return `Cannot confirm this database works with t3@${input.targetVersion}. Switch tracks from Settings → About → Update track, which checks it first.`;
+  }
+  return input.targetDatabaseMigration < databaseMigration
+    ? `This database has changes t3@${input.targetVersion} does not support yet; it stays on this release.`
+    : null;
+}
+
 export const make = Effect.fn("cloud.server_self_update.make")(function* () {
   const serverConfig = yield* ServerConfig.ServerConfig;
   const desktopAppUpdate = yield* DesktopAppUpdate.DesktopAppUpdate;
@@ -119,12 +140,27 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
       ? new ServerSelfUpdateError({ reason })
       : new ServerSelfUpdateError({ reason, cause });
 
+  const crossesTrackUnsafely = (input: ServerSelfUpdateInput) =>
+    trackSwitchBlockReason({
+      serverVersion: packageJson.version,
+      targetVersion: input.targetVersion,
+      targetDatabaseMigration: input.targetDatabaseMigration,
+      databaseMigration: () => databaseMigrationHead(serverConfig.dbPath),
+    });
+
   const update: ServerSelfUpdate["Service"]["update"] = Effect.fn(
     "cloud.server_self_update.update",
   )(function* (input, reportProgress = () => Effect.void, onHandoffAccepted = () => Effect.void) {
     if (capability === "desktop-managed") {
+      const unsafeCrossing = input.channel === undefined ? null : crossesTrackUnsafely(input);
+      if (unsafeCrossing !== null) return yield* failWith(unsafeCrossing);
       if (desktopAppUpdate.available) {
-        return yield* desktopAppUpdate.run(reportProgress);
+        return yield* desktopAppUpdate.run(
+          reportProgress,
+          input.channel === undefined
+            ? undefined
+            : { channel: input.channel, targetVersion: input.targetVersion },
+        );
       }
       return yield* failWith(
         "This server is managed by the T3 Code desktop app on its machine; update the desktop app to update it.",
@@ -136,6 +172,8 @@ export const make = Effect.fn("cloud.server_self_update.make")(function* () {
       );
     }
 
+    const unsafeCrossing = crossesTrackUnsafely(input);
+    if (unsafeCrossing !== null) return yield* failWith(unsafeCrossing);
     const targetVersion = input.targetVersion.trim();
     if (!isExactServiceVersion(targetVersion)) {
       return yield* failWith(`'${targetVersion}' is not an exact t3 version.`);
diff --git a/apps/server/src/cloud/servicePreflight.test.ts b/apps/server/src/cloud/servicePreflight.test.ts
index 18a5323cd590c..efc37266be8b0 100644
--- a/apps/server/src/cloud/servicePreflight.test.ts
+++ b/apps/server/src/cloud/servicePreflight.test.ts
@@ -1,4 +1,16 @@
+import * as NodeSqlite from "node:sqlite";
+
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+import {
+  BUILD_MIGRATION_HEAD,
+  databaseMigrationHead,
+} from "../persistence/databaseMigrationHead.ts";
+import { migrationManifest } from "../persistence/Migrations.ts";
 
 import { runServicePreflight } from "./servicePreflight.ts";
 import { SERVICE_LAUNCHER_PROTOCOL } from "./serviceProtocol.ts";
@@ -20,3 +32,49 @@ it.each([1])("blocks legacy launcher protocol %i with exact recovery steps", (la
   expect(reason).toContain("t3 --version");
   expect(reason).toContain("which -a t3");
 });
+
+it.layer(NodeServices.layer)("service preflight database", (it) => {
+  it.effect("blocks a database that a newer build migrated", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const databasePath = path.join(
+        yield* fs.makeTempDirectoryScoped({ prefix: "t3-preflight-" }),
+        "state.sqlite",
+      );
+      const db = new NodeSqlite.DatabaseSync(databasePath);
+      db.exec("CREATE TABLE effect_sql_migrations (migration_id INTEGER PRIMARY KEY, name TEXT)");
+      const insert = db.prepare("INSERT INTO effect_sql_migrations VALUES (?, ?)");
+      for (const [id, name] of migrationManifest) insert.run(id, name);
+      const preflight = () =>
+        runServicePreflight({ databasePath, launcherProtocol: SERVICE_LAUNCHER_PROTOCOL });
+
+      expect(preflight().status).toBe("ready");
+      expect(databaseMigrationHead(databasePath)).toBe(BUILD_MIGRATION_HEAD);
+
+      const newerId = Math.max(...migrationManifest.map(([id]) => id)) + 1;
+      insert.run(newerId, "FromNightly");
+      db.close();
+      const result = preflight();
+      expect(result.status).toBe("blocked");
+      expect(result.status === "blocked" ? result.reason : "").toContain(`${newerId}_FromNightly`);
+      // Servers report this head, so clients see a database a newer build migrated.
+      expect(databaseMigrationHead(databasePath)).toBe(newerId);
+
+      // A database that exists but cannot be read has an unknown history, so it blocks.
+      const unreadable = path.join(path.dirname(databasePath), "unreadable.sqlite");
+      yield* fs.writeFileString(unreadable, "not a database");
+      expect(databaseMigrationHead(unreadable)).toBeUndefined();
+      expect(
+        runServicePreflight({
+          databasePath: unreadable,
+          launcherProtocol: SERVICE_LAUNCHER_PROTOCOL,
+        }).status,
+      ).toBe("blocked");
+      // A missing database is a fresh install.
+      expect(databaseMigrationHead(path.join(path.dirname(databasePath), "missing.sqlite"))).toBe(
+        BUILD_MIGRATION_HEAD,
+      );
+    }),
+  );
+});
diff --git a/apps/server/src/cloud/servicePreflight.ts b/apps/server/src/cloud/servicePreflight.ts
index 8865ce7b3d11f..9479f3f4a8194 100644
--- a/apps/server/src/cloud/servicePreflight.ts
+++ b/apps/server/src/cloud/servicePreflight.ts
@@ -1,4 +1,5 @@
 import packageJson from "../../package.json" with { type: "json" };
+import { BUILD_MIGRATION_HEAD, recordedMigrations } from "../persistence/databaseMigrationHead.ts";
 import { SERVICE_LAUNCHER_PROTOCOL } from "./serviceProtocol.ts";
 
 export type ServicePreflightResult =
@@ -34,9 +35,34 @@ export function runServicePreflight(input: {
     };
   }
 
+  const newer = newerRecordedMigrations(input.databasePath);
+  if (newer === null) {
+    return {
+      status: "blocked",
+      version,
+      reason: `Could not read this database to confirm t3@${version} supports it.`,
+    };
+  }
+  if (newer.length > 0) {
+    return {
+      status: "blocked",
+      version,
+      reason: `This database has migrations that t3@${version} does not know: ${newer.join(", ")}. A newer build wrote them, and running t3@${version} on this database is not safe. Stay on the newer release, or wait for a release that includes these migrations.`,
+    };
+  }
+
   return { status: "ready", version, launcherProtocol: SERVICE_LAUNCHER_PROTOCOL };
 }
 
+/** Migrations a newer build recorded, or null when the database exists but cannot be read.
+ * Startup already handles renamed ids this build knows. */
+function newerRecordedMigrations(databasePath: string): ReadonlyArray<string> | null {
+  const recorded = recordedMigrations(databasePath);
+  return recorded === null
+    ? null
+    : recorded.filter(({ id }) => id > BUILD_MIGRATION_HEAD).map(({ id, name }) => `${id}_${name}`);
+}
+
 export function decodeServicePreflightResult(value: unknown): ServicePreflightResult | undefined {
   if (typeof value !== "object" || value === null) {
     return undefined;
diff --git a/apps/server/src/desktopUpdate/DesktopAppUpdate.test.ts b/apps/server/src/desktopUpdate/DesktopAppUpdate.test.ts
index 86d445d1a52c4..f90bef39fcf03 100644
--- a/apps/server/src/desktopUpdate/DesktopAppUpdate.test.ts
+++ b/apps/server/src/desktopUpdate/DesktopAppUpdate.test.ts
@@ -132,6 +132,24 @@ it.layer(NodeServices.layer)("desktop app update", (it) => {
     }),
   );
 
+  it.effect("succeeds without an install when a track switch finds the host current", () =>
+    Effect.gen(function* () {
+      const { service } = yield* makeHarness({
+        reports: (requestId) => [
+          report(requestId, makeState({ status: "up-to-date", currentVersion: "1.2.3" }), {
+            outcome: "up-to-date",
+          }),
+        ],
+      });
+      const trackSwitch = { channel: "latest" as const, targetVersion: "1.2.3" };
+
+      expect(yield* service.run(() => Effect.void, trackSwitch)).toEqual({
+        targetVersion: "1.2.3",
+        method: "desktop-app",
+      });
+    }),
+  );
+
   it.effect("replays a retained commit failure for the preparation token", () =>
     Effect.gen(function* () {
       const { service } = yield* makeHarness({
diff --git a/apps/server/src/desktopUpdate/DesktopAppUpdate.ts b/apps/server/src/desktopUpdate/DesktopAppUpdate.ts
index d02c3108777dd..e901b04cfb5d7 100644
--- a/apps/server/src/desktopUpdate/DesktopAppUpdate.ts
+++ b/apps/server/src/desktopUpdate/DesktopAppUpdate.ts
@@ -44,6 +44,7 @@ export class DesktopAppUpdate extends Context.Service<
       reportProgress: (
         stage: ServerSelfUpdateProgressStage,
       ) => Effect.Effect<void, ServerSelfUpdateError>,
+      trackSwitch?: DesktopTelemetryReceiver.DesktopTrackSwitch,
     ) => Effect.Effect<ServerSelfUpdateResult, ServerSelfUpdateError>;
     /** Success stops the server; returns only on installation failure or timeout. */
     readonly commit: (
@@ -71,6 +72,7 @@ export const make = Effect.fn("desktopUpdate.desktopAppUpdate.make")(function* (
     reportProgress: (
       stage: ServerSelfUpdateProgressStage,
     ) => Effect.Effect<void, ServerSelfUpdateError>,
+    trackSwitch: boolean,
   ) {
     const lastStage = yield* Ref.make<ServerSelfUpdateProgressStage | null>(null);
     const emitStage = (
@@ -122,6 +124,11 @@ export const make = Effect.fn("desktopUpdate.desktopAppUpdate.make")(function* (
       return { targetVersion, method: "desktop-app" as const, desktopUpdateToken: requestId };
     }
     if (report.outcome === "up-to-date") {
+      // A switch's host already on the newest build of its track only saved the track.
+      if (trackSwitch) {
+        yield* Ref.set(inFlight, false);
+        return { targetVersion: report.state.currentVersion, method: "desktop-app" as const };
+      }
       return yield* failWith(
         `The T3 Code desktop app on this machine is already up to date on ${report.state.currentVersion}.`,
       );
@@ -132,7 +139,7 @@ export const make = Effect.fn("desktopUpdate.desktopAppUpdate.make")(function* (
   });
 
   const run: DesktopAppUpdate["Service"]["run"] = Effect.fn("desktopUpdate.desktopAppUpdate.run")(
-    function* (reportProgress) {
+    function* (reportProgress, trackSwitch) {
       if (!available) {
         return yield* failWith(
           "This server was not started by the T3 Code desktop app, so it cannot drive a desktop update.",
@@ -154,13 +161,18 @@ export const make = Effect.fn("desktopUpdate.desktopAppUpdate.make")(function* (
           // Subscribe before requesting to catch fast reports.
           const { changes } = yield* receiver.desktopUpdates;
           yield* receiver
-            .requestDesktopUpdate(requestId)
+            .requestDesktopUpdate(requestId, trackSwitch)
             .pipe(
               Effect.mapError((error) =>
                 failWith("Could not reach the T3 Code desktop app on this machine.", error),
               ),
             );
-          return yield* consumeReports(requestId, changes, reportProgress).pipe(
+          return yield* consumeReports(
+            requestId,
+            changes,
+            reportProgress,
+            trackSwitch !== undefined,
+          ).pipe(
             Effect.onInterrupt(() => receiver.cancelDesktopUpdate(requestId).pipe(Effect.ignore)),
           );
         }),
diff --git a/apps/server/src/environment/ServerEnvironment.ts b/apps/server/src/environment/ServerEnvironment.ts
index 90ae4519bed92..cef18fbe325c3 100644
--- a/apps/server/src/environment/ServerEnvironment.ts
+++ b/apps/server/src/environment/ServerEnvironment.ts
@@ -20,6 +20,7 @@ import { readAgentActivityPublishingActive } from "../cloud/config.ts";
 import { resolveServerSelfUpdateCapability } from "../cloud/selfUpdate.ts";
 import { resolveServiceLauncherMode } from "../cloud/serviceLauncherClient.ts";
 import * as ServerConfig from "../config.ts";
+import { databaseMigrationHead } from "../persistence/databaseMigrationHead.ts";
 import * as ProcessRunner from "../processRunner.ts";
 import { resolveServerEnvironmentLabel } from "./ServerEnvironmentLabel.ts";
 import { detectServerEnvironmentMachineKind } from "./ServerEnvironmentMachine.ts";
@@ -203,6 +204,7 @@ export const make = Effect.gen(function* () {
   const desktopAppUpdate =
     serverSelfUpdate === "desktop-managed" && serverConfig.desktopTelemetryControlFd !== undefined;
 
+  const databaseMigration = databaseMigrationHead(serverConfig.dbPath);
   const descriptor: ExecutionEnvironmentDescriptor = {
     environmentId,
     label,
@@ -213,6 +215,7 @@ export const make = Effect.gen(function* () {
     },
     serverVersion: packageJson.version,
     orchestrationProtocolVersion: ORCHESTRATION_PROTOCOL_VERSION,
+    ...(databaseMigration === undefined ? {} : { databaseMigration }),
     capabilities: {
       repositoryIdentity: true,
       connectionProbe: true,
@@ -266,7 +269,7 @@ export const make = Effect.gen(function* () {
       ...(serverSelfUpdate === "boot-service" || desktopAppUpdate
         ? { serverSelfUpdateProgress: true }
         : {}),
-      ...(desktopAppUpdate ? { desktopAppUpdate: true } : {}),
+      ...(desktopAppUpdate ? { desktopAppUpdate: true, desktopAppChannelSwitch: true } : {}),
       serverBrowser: true,
       peerLinks: true,
       mcpModeLimitHeader: true,
diff --git a/apps/server/src/persistence/Migrations.test.ts b/apps/server/src/persistence/Migrations.test.ts
index 67f238b7484f5..54e4a711aa8a1 100644
--- a/apps/server/src/persistence/Migrations.test.ts
+++ b/apps/server/src/persistence/Migrations.test.ts
@@ -1,7 +1,10 @@
 import { assert, describe, it } from "@effect/vitest";
 import * as NodeSqliteClient from "@t3tools/shared/nodeSqliteClient";
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as Effect from "effect/Effect";
 import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
 import * as SqlClient from "effect/sql/SqlClient";
 
 import { migrationManifest, runMigrations } from "./Migrations.ts";
@@ -123,3 +126,20 @@ describe("runMigrations", () => {
     }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: ":memory:" }))),
   );
 });
+
+// The npm launcher reads the highest migration id from these file names.
+it.effect("registers every migration file", () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const dir = path.join(import.meta.dirname, "Migrations");
+    const files = (yield* fs.readDirectory(dir)).flatMap((name) => {
+      const match = /^(\d+)_(\w+)\.ts$/.exec(name);
+      return match ? [[Number(match[1]), match[2]] as const] : [];
+    });
+    assert.deepStrictEqual(
+      files.toSorted(([a], [b]) => a - b),
+      migrationManifest,
+    );
+  }).pipe(Effect.provide(NodeServices.layer)),
+);
diff --git a/apps/server/src/persistence/databaseMigrationHead.ts b/apps/server/src/persistence/databaseMigrationHead.ts
new file mode 100644
index 0000000000000..046039a703410
--- /dev/null
+++ b/apps/server/src/persistence/databaseMigrationHead.ts
@@ -0,0 +1,49 @@
+// @effect-diagnostics nodeBuiltinImport:off - read synchronously by the preflight subprocess and at startup.
+import * as NodeFS from "node:fs";
+import * as NodeSqlite from "node:sqlite";
+
+import { migrationManifest } from "./Migrations.ts";
+
+export const BUILD_MIGRATION_HEAD = Math.max(...migrationManifest.map(([id]) => id));
+
+/** Migrations the database records, read-only. A missing or new database records none; one that
+ * exists but cannot be read is null, since its history is unknown. */
+export function recordedMigrations(
+  databasePath: string,
+): ReadonlyArray<{ readonly id: number; readonly name: string }> | null {
+  let db: NodeSqlite.DatabaseSync;
+  try {
+    db = new NodeSqlite.DatabaseSync(databasePath, { readOnly: true });
+  } catch {
+    return NodeFS.existsSync(databasePath) ? null : [];
+  }
+  try {
+    const hasTable = db
+      .prepare(
+        "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'effect_sql_migrations'",
+      )
+      .get();
+    if (hasTable === undefined) return [];
+    return db
+      .prepare("SELECT migration_id, name FROM effect_sql_migrations ORDER BY migration_id")
+      .all()
+      .map((row) => ({ id: Number(row.migration_id), name: String(row.name) }));
+  } catch {
+    return null;
+  } finally {
+    try {
+      db.close();
+    } catch {
+      // A read-only handle has nothing to flush; the result above already stands.
+    }
+  }
+}
+
+/** Highest migration the database holds once this build's startup migrations have run. A newer
+ * build may have recorded more than this build knows. Undefined when the database is unreadable. */
+export function databaseMigrationHead(databasePath: string): number | undefined {
+  const recorded = recordedMigrations(databasePath);
+  return recorded === null
+    ? undefined
+    : Math.max(BUILD_MIGRATION_HEAD, ...recorded.map(({ id }) => id));
+}
diff --git a/apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts b/apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts
index 770359b3e9307..70dc2e8d750ef 100644
--- a/apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts
+++ b/apps/server/src/resourceTelemetry/DesktopTelemetryReceiver.ts
@@ -8,6 +8,7 @@ import {
   type DesktopHostTelemetryMessage as DesktopHostTelemetryMessageValue,
   type DesktopHostTelemetrySnapshot,
   DesktopTelemetryControlMessage,
+  type DesktopUpdateChannel,
   type DesktopUpdateStatusReport,
   type ResourceTelemetrySourceStatus,
 } from "@t3tools/contracts";
@@ -149,6 +150,12 @@ export interface DesktopTelemetryReceiverHealth {
   readonly lastError: Option.Option<string>;
 }
 
+/** Moves the desktop app to `channel` and installs only `targetVersion`. */
+export interface DesktopTrackSwitch {
+  readonly channel: DesktopUpdateChannel;
+  readonly targetVersion: string;
+}
+
 export class DesktopTelemetryReceiver extends Context.Service<
   DesktopTelemetryReceiver,
   {
@@ -176,6 +183,7 @@ export class DesktopTelemetryReceiver extends Context.Service<
     ) => Effect.Effect<void, DesktopTelemetryControlError>;
     readonly requestDesktopUpdate: (
       requestId: string,
+      trackSwitch?: DesktopTrackSwitch,
     ) => Effect.Effect<void, DesktopTelemetryControlError>;
     readonly commitDesktopUpdate: (
       requestId: string,
@@ -633,11 +641,12 @@ export const make = Effect.fn("resourceTelemetry.desktopTelemetryReceiver.make")
     subscribeHealth: subscribeBeforeSnapshotWithoutMutex(healthChanges, Ref.get(health)),
     setDiagnosticsDemand,
     requestDesktopUpdate: Effect.fn("DesktopTelemetryReceiver.requestDesktopUpdate")(
-      function (requestId) {
+      function (requestId, trackSwitch) {
         return sendControlMessage({
           version: 1,
           type: "requestDesktopUpdate",
           requestId,
+          ...trackSwitch,
         });
       },
     ),
diff --git a/apps/web/src/components/ServerUpdateAction.browser.test.tsx b/apps/web/src/components/ServerUpdateAction.browser.test.tsx
index 5f793b3ca90e4..ed3a723652a56 100644
--- a/apps/web/src/components/ServerUpdateAction.browser.test.tsx
+++ b/apps/web/src/components/ServerUpdateAction.browser.test.tsx
@@ -14,6 +14,7 @@ const testState = vi.hoisted(() => ({
   toast: vi.fn(),
   clipboard: vi.fn(),
   sessionAtom: null as unknown,
+  serverVersions: new Map<string, string>(),
 }));
 
 vi.mock(import("~/hooks/useCopyToClipboard"), async (original) => ({
@@ -36,6 +37,16 @@ vi.mock(import("~/state/session"), async (original) => {
     },
   };
 });
+vi.mock(import("~/state/entities"), async (original) => ({
+  ...(await original()),
+  useServerConfigs: (() =>
+    new Map(
+      [...testState.serverVersions].map(([id, serverVersion]) => [
+        id,
+        { environment: { serverVersion } },
+      ]),
+    )) as never,
+}));
 vi.mock(import("~/state/use-atom-command"), async (original) => ({
   ...(await original()),
   useAtomCommand: (() => testState.updateServer) as never,
@@ -84,6 +95,7 @@ function setup(): Disposable {
   testState.updateServer.mockReset();
   testState.toast.mockReset();
   testState.clipboard.mockReset();
+  testState.serverVersions.clear();
   sessionAtom = Atom.make<SessionResult>(AsyncResult.success(currentSession));
   testState.sessionAtom = sessionAtom;
   resetConfirmDialogForTests();
@@ -212,4 +224,17 @@ describe("ServerUpdatesAction", () => {
     );
     expect(button(screen, "Update all")!.disabled).toBe(false);
   });
+
+  it("skips a machine whose update would cross Stable and Nightly", async () => {
+    using _state = setup();
+    testState.serverVersions.set("batch-a", "0.0.30-nightly.20261001.1");
+    testState.updateServer.mockResolvedValue(success());
+    await using screen = await mount();
+    await click(screen, "Update all");
+
+    expect(testState.updateServer).toHaveBeenCalledTimes(1);
+    expect(testState.toast).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "success", title: "Office updated" }),
+    );
+  });
 });
diff --git a/apps/web/src/components/ServerUpdateAction.tsx b/apps/web/src/components/ServerUpdateAction.tsx
index 3f7675cd96631..141f139aefd7b 100644
--- a/apps/web/src/components/ServerUpdateAction.tsx
+++ b/apps/web/src/components/ServerUpdateAction.tsx
@@ -7,6 +7,7 @@ import {
 import type { AsyncResult } from "effect/reactivity";
 import { environmentSession } from "~/state/session";
 import type {
+  DesktopUpdateChannel,
   EnvironmentId,
   ServerInstallation,
   ServerSelfUpdateCapability,
@@ -26,6 +27,8 @@ import { serverEnvironment, updateOutdatedServer } from "~/state/server";
 import { appAtomRegistry } from "~/rpc/atomRegistry";
 import { useAtomCommand } from "~/state/use-atom-command";
 import { manualServerUpdateCommand } from "~/versionSkew";
+import { useServerConfigs } from "~/state/entities";
+import { crossesReleaseTrack } from "@t3tools/shared/cliRelease";
 import { Button } from "./ui/button";
 import { toastManager } from "./ui/toast";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "./ui/tooltip";
@@ -41,6 +44,29 @@ export function serverUpdateStageLabel(stage: ServerUpdateStage): string {
   return UPDATE_STAGE_LABELS[stage];
 }
 
+const CROSS_TRACK_NOTE = "Switch tracks in About → Update track";
+
+/** Hosts refuse a Stable/Nightly crossing outside a track switch, which checks the database first. */
+function refusedCrossing(
+  target: {
+    readonly selfUpdate: ServerSelfUpdateCapability | null;
+    readonly targetVersion: string;
+    readonly channel?: DesktopUpdateChannel | undefined;
+  },
+  serverVersion: string | undefined,
+): boolean {
+  return (
+    target.channel === undefined &&
+    target.selfUpdate !== null &&
+    serverVersion !== undefined &&
+    crossesReleaseTrack(serverVersion, target.targetVersion)
+  );
+}
+
+function CrossTrackNote() {
+  return <span className="text-muted-foreground text-xs">{CROSS_TRACK_NOTE}</span>;
+}
+
 function updateFailureMessage(error: unknown): string {
   return error instanceof Error ? error.message : "Server update failed.";
 }
@@ -52,6 +78,12 @@ export interface ServerUpdateTarget {
   readonly installation?: ServerInstallation | undefined;
   readonly desktopAppUpdate?: boolean;
   readonly targetVersion: string;
+  /** Set only by a track switch; the host's desktop app moves to this track. */
+  readonly channel?: DesktopUpdateChannel;
+  /** A track switch's checked release migration; the host re-checks its own database. */
+  readonly targetDatabaseMigration?: number;
+  /** The host already runs its track's newest build and only saves the track. */
+  readonly trackOnly?: boolean;
 }
 
 type UpdateButtonProps = Pick<ComponentProps<typeof Button>, "variant" | "size" | "className"> & {
@@ -79,7 +111,13 @@ export function useServerUpdate() {
     pendingUpdateEnvironmentIds.add(environmentId);
     const result = await updateServer({
       environmentId,
-      input: { targetVersion },
+      input: {
+        targetVersion,
+        ...(target.channel === undefined ? {} : { channel: target.channel }),
+        ...(target.targetDatabaseMigration === undefined
+          ? {}
+          : { targetDatabaseMigration: target.targetDatabaseMigration }),
+      },
     });
     pendingUpdateEnvironmentIds.delete(environmentId);
     if (result._tag === "Failure") {
@@ -118,12 +156,14 @@ export function ServerUpdatesAction({
   readonly targets: ReadonlyArray<ServerUpdateTarget>;
 }) {
   const update = useServerUpdate();
+  const serverConfigs = useServerConfigs();
   const pending = useRef(false);
   const [isPending, setIsPending] = useState(false);
   const eligible = targets.filter(
     (target) =>
       target.selfUpdate !== null &&
-      (target.selfUpdate !== "desktop-managed" || target.desktopAppUpdate),
+      (target.selfUpdate !== "desktop-managed" || target.desktopAppUpdate) &&
+      !refusedCrossing(target, serverConfigs.get(target.environmentId)?.environment.serverVersion),
   );
   const handleUpdate = async () => {
     if (pending.current) return;
@@ -198,6 +238,7 @@ export function ServerUpdateAction({
   installation,
   desktopAppUpdate = false,
   targetVersion,
+  channel,
   label = "Update",
   variant = "outline",
   size = "xs",
@@ -205,6 +246,7 @@ export function ServerUpdateAction({
   appearance = "button",
 }: ServerUpdateTarget & UpdateButtonProps) {
   const isDesktopAppUpdate = selfUpdate === "desktop-managed";
+  const serverVersion = useServerConfigs().get(environmentId)?.environment.serverVersion;
   const sessionStateAtom = environmentSession.sessionStateAtom(environmentId);
   const canUpdate = canUpdateServer(useAtomValue(sessionStateAtom));
   const update = useServerUpdate();
@@ -264,6 +306,10 @@ export function ServerUpdateAction({
     );
   }
 
+  if (refusedCrossing({ selfUpdate, targetVersion, channel }, serverVersion)) {
+    return <CrossTrackNote />;
+  }
+
   const manualCommand =
     selfUpdate === null ? manualServerUpdateCommand(targetVersion, installation) : null;
   const actionLabel =
@@ -351,6 +397,9 @@ export function OutdatedServerUpdateAction({
       description: `Reconnected on t3@${result.value.targetVersion}.`,
     });
   };
+  if (fromVersion !== undefined && crossesReleaseTrack(fromVersion, targetVersion)) {
+    return <CrossTrackNote />;
+  }
   return (
     <Button size="xs" variant="outline" onClick={() => void handleUpdate()}>
       {label}
diff --git a/apps/web/src/components/settings/SettingsPanels.tsx b/apps/web/src/components/settings/SettingsPanels.tsx
index 0cb00b86ac352..c4e3d27a07fa7 100644
--- a/apps/web/src/components/settings/SettingsPanels.tsx
+++ b/apps/web/src/components/settings/SettingsPanels.tsx
@@ -1,3 +1,4 @@
+import { useAtomValue } from "@effect/atom-react";
 import { NotificationSettings } from "./NotificationSettings";
 import { PRIVACY_POLICY_URL } from "../../legalLinks";
 import { CheckIcon } from "lucide-react";
@@ -20,6 +21,7 @@ import {
   type QuitConfirmationMode,
   SidebarProjectSortOrder,
 } from "@t3tools/contracts/settings";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
 import { createModelSelection } from "@t3tools/shared/model";
 import * as Equal from "effect/Equal";
 import * as Schema from "effect/Schema";
@@ -64,7 +66,7 @@ import {
 import { providerInstanceEntriesFor } from "../../providerInstances";
 import { ensureLocalApi, readLocalApi } from "../../localApi";
 import { isMacPlatform } from "../../lib/utils";
-import { useEnvironmentProviders } from "../../state/environments";
+import { useEnvironmentProviders, useEnvironments } from "../../state/environments";
 import { EMPTY_SERVER_PROVIDERS } from "../../state/server";
 import { Button } from "../ui/button";
 import { DraftInput } from "../ui/draft-input";
@@ -95,6 +97,13 @@ import { BackgroundActivitySettingsRow } from "./BackgroundActivitySettings";
 import { AdvancedSettings } from "./AdvancedSettings";
 import { PullRequestLinksOpenInAppSetting } from "./IntegrationsSettings";
 import { StorageCleanupSections } from "./StorageSettings";
+import { UpdateTrackSwitchDialog } from "./UpdateTrackSwitchDialog";
+import { environmentIdsKey } from "~/state/environmentAtomList";
+import { environmentSessionStatesAtom } from "~/state/session";
+import { canUpdateServer } from "../ServerUpdateAction";
+import { useUpdateEverythingRun } from "../sidebar/updateEverythingRun";
+import { awaitsTrackSwitch, channelSwitchLabel } from "../sidebar/updateEverything.logic";
+import { isHostedByThisApp } from "../sidebar/useUpdateEverything";
 
 const RESPONSE_STREAMING_MODE_LABELS: Record<ResponseStreamingMode, string> = {
   turn: "Wait for the full response",
@@ -142,39 +151,38 @@ function AboutVersionTitle() {
 
 function AboutVersionSection() {
   const updateState = useDesktopUpdateState();
-  const [isChangingUpdateChannel, setIsChangingUpdateChannel] = useState(false);
+  const [switchChannel, setSwitchChannel] = useState<DesktopUpdateChannel | null>(null);
   const [isUpdateActionPending, setIsUpdateActionPending] = useState(false);
+  const { environments } = useEnvironments();
+  const sessionStates = useAtomValue(
+    environmentSessionStatesAtom(
+      environmentIdsKey(environments.map(({ environmentId }) => environmentId)),
+    ),
+  );
+  // A second run would replace the first run's progress and local download.
+  const updateRun = useUpdateEverythingRun();
 
   const hasDesktopBridge = typeof window !== "undefined" && Boolean(window.desktopBridge);
   const selectedUpdateChannel = updateState?.channel ?? "latest";
   const selectedHostedAppChannel = hasDesktopBridge ? null : HOSTED_APP_CHANNEL;
-
-  const handleUpdateChannelChange = (channel: DesktopUpdateChannel) => {
-    const bridge = window.desktopBridge;
-    if (
-      !bridge ||
-      typeof bridge.setUpdateChannel !== "function" ||
-      channel === selectedUpdateChannel
-    ) {
-      return;
-    }
-
-    setIsChangingUpdateChannel(true);
-    void bridge
-      .setUpdateChannel(channel)
-      .catch((error: unknown) => {
-        toastManager.add(
-          stackedThreadToast({
-            type: "error",
-            title: "Could not change update track",
-            description: error instanceof Error ? error.message : "Update track change failed.",
-          }),
-        );
-      })
-      .finally(() => {
-        setIsChangingUpdateChannel(false);
-      });
-  };
+  // A switch that failed part way leaves this app or a server on the other track.
+  // With its updater off, a switch cannot move this app, so it is not counted.
+  const appOffTrack =
+    updateState?.enabled !== false && desktopUpdateChannelOf(APP_VERSION) !== selectedUpdateChannel;
+  const unswitchedMachines =
+    (appOffTrack ? 1 : 0) +
+    environments.filter(
+      (environment, index) =>
+        environment.connection.phase === "connected" &&
+        canUpdateServer(sessionStates[index]!) &&
+        awaitsTrackSwitch(
+          {
+            serverConfig: environment.serverConfig,
+            hostedByThisApp: isHostedByThisApp(environment),
+          },
+          selectedUpdateChannel,
+        ),
+    ).length;
 
   const handleButtonClick = async () => {
     const bridge = window.desktopBridge;
@@ -272,7 +280,8 @@ function AboutVersionSection() {
   const statusLabel: Record<string, string> = {
     checking: "Checking…",
     downloading: "Downloading…",
-    "up-to-date": "Up to Date",
+    // Off its track, "up to date" only means no switch is pending; Review moves it.
+    ...(appOffTrack ? {} : { "up-to-date": "Up to Date" }),
   };
   const buttonLabel =
     actionLabel[action] ?? statusLabel[updateState?.status ?? ""] ?? "Check for Updates";
@@ -308,23 +317,43 @@ function AboutVersionSection() {
       {hasDesktopBridge ? (
         <SettingsRow
           {...searchableSetting("update-track")}
-          description="Use stable releases or nightly builds. Switch back anytime."
+          description={
+            unswitchedMachines > 0 ? (
+              <>
+                {unswitchedMachines === 1
+                  ? "1 machine still runs"
+                  : `${unswitchedMachines} machines still run`}{" "}
+                {channelSwitchLabel(selectedUpdateChannel === "nightly" ? "latest" : "nightly")}.{" "}
+                {/* The dialog moves what it can and says why it skips the rest. */}
+                <Button
+                  size="xs"
+                  variant="link"
+                  disabled={updateRun !== null}
+                  onClick={() => setSwitchChannel(selectedUpdateChannel)}
+                >
+                  Review
+                </Button>
+              </>
+            ) : (
+              "Switches this app and every connected machine whose database the target release supports."
+            )
+          }
           control={
             <Select
               value={selectedUpdateChannel}
               onValueChange={(value) => {
-                handleUpdateChannelChange(value as DesktopUpdateChannel);
+                if (value !== selectedUpdateChannel) {
+                  setSwitchChannel(value as DesktopUpdateChannel);
+                }
               }}
             >
               <SelectTrigger
                 size="sm"
                 className="w-full sm:w-40"
                 aria-label="Update track"
-                disabled={isChangingUpdateChannel}
+                disabled={switchChannel !== null || updateRun !== null}
               >
-                <SelectValue>
-                  {selectedUpdateChannel === "nightly" ? "Nightly" : "Stable"}
-                </SelectValue>
+                <SelectValue>{channelSwitchLabel(selectedUpdateChannel)}</SelectValue>
               </SelectTrigger>
               <SelectPopup align="end" alignItemWithTrigger={false}>
                 <SelectItem hideIndicator value="latest">
@@ -367,6 +396,9 @@ function AboutVersionSection() {
         />
       ) : null}
       {hasDesktopBridge ? <CliCommandSettingsRow /> : null}
+      {switchChannel === null ? null : (
+        <UpdateTrackSwitchDialog channel={switchChannel} onClose={() => setSwitchChannel(null)} />
+      )}
     </>
   );
 }
diff --git a/apps/web/src/components/settings/UpdateTrackSwitchDialog.tsx b/apps/web/src/components/settings/UpdateTrackSwitchDialog.tsx
new file mode 100644
index 0000000000000..f746cff28c270
--- /dev/null
+++ b/apps/web/src/components/settings/UpdateTrackSwitchDialog.tsx
@@ -0,0 +1,178 @@
+import { useAtomValue } from "@effect/atom-react";
+import { settlePromise, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
+import type { DesktopUpdateChannel } from "@t3tools/contracts";
+import { acceptsTrackSwitchRelease, desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
+import { isMacPlatform } from "@t3tools/shared/keybindings";
+import { useState } from "react";
+import { AsyncResult } from "effect/reactivity";
+
+import { APP_VERSION } from "~/branding";
+import { useDesktopUpdateState } from "~/state/desktopUpdate";
+import { useEnvironments } from "~/state/environments";
+import { npmReleaseAtom } from "~/state/npmRelease";
+import { downloadLocalUpdate, installLocalUpdate } from "../sidebar/SidebarUpdatePill";
+import { UpdateEverythingDialog } from "../sidebar/UpdateEverythingDialog";
+import {
+  channelSwitchLabel,
+  localSwitchBlockReason,
+  type ChannelSwitchRelease,
+} from "../sidebar/updateEverything.logic";
+import { isHostedByThisApp, useUpdateEverything } from "../sidebar/useUpdateEverything";
+import { prepareLocalTrackSwitch } from "./updateTrackSwitch.logic";
+import {
+  AlertDialog,
+  AlertDialogClose,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogPopup,
+  AlertDialogTitle,
+} from "../ui/alert-dialog";
+import { Button } from "../ui/button";
+import { stackedThreadToast, toastManager } from "../ui/toast";
+
+/** Moves this app and every connected machine to `channel`. */
+export function UpdateTrackSwitchDialog({
+  channel,
+  onClose,
+}: {
+  readonly channel: DesktopUpdateChannel;
+  readonly onClose: () => void;
+}) {
+  // npm dist-tags match the desktop channel names.
+  const release = useAtomValue(npmReleaseAtom(channel));
+  if (AsyncResult.isSuccess(release) && release.value !== null) {
+    return <SwitchPlan release={{ channel, ...release.value }} onClose={onClose} />;
+  }
+  const label = channelSwitchLabel(channel);
+  return (
+    <AlertDialog open onOpenChange={(open) => !open && onClose()}>
+      <AlertDialogPopup>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Switch to {label}</AlertDialogTitle>
+          <AlertDialogDescription>
+            {AsyncResult.isFailure(release) || AsyncResult.isSuccess(release)
+              ? `Could not find the latest ${label} release on npm. Try again later.`
+              : "Checking releases…"}
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
+        </AlertDialogFooter>
+      </AlertDialogPopup>
+    </AlertDialog>
+  );
+}
+
+function SwitchPlan({
+  release,
+  onClose,
+}: {
+  readonly release: ChannelSwitchRelease;
+  readonly onClose: () => void;
+}) {
+  const updateState = useDesktopUpdateState();
+  const { environments } = useEnvironments();
+  const crossesLocal = desktopUpdateChannelOf(APP_VERSION) !== release.channel;
+  // With its updater off (a .deb install, or no feed) this app stays put and only remotes move.
+  const updatesOff = updateState?.enabled === false;
+  // After a partial switch this app may already be on the track; then only remotes move.
+  const switchesLocal = crossesLocal && !updatesOff;
+  const [checking, setChecking] = useState(false);
+  const everything = useUpdateEverything(switchesLocal ? release.version : null, release);
+  const label = channelSwitchLabel(release.channel);
+  // This app's reinstall restarts every server it hosts, so each of their databases must allow it.
+  const localBlocked = localSwitchBlockReason(
+    APP_VERSION,
+    release,
+    environments.filter(isHostedByThisApp).map((environment) => ({
+      connected: environment.connection.phase === "connected",
+      databaseMigration: environment.serverConfig?.environment.databaseMigration,
+    })),
+    window.desktopBridge?.getLocalEnvironmentBootstraps().length ?? 0,
+  );
+
+  const run = async () => {
+    const bridge = window.desktopBridge;
+    if (!bridge) return;
+    // Stay open while the feed is checked; the run's own progress takes over after.
+    setChecking(true);
+    const fail = (description: string) =>
+      toastManager.add(
+        stackedThreadToast({ type: "error", title: `Could not switch to ${label}`, description }),
+      );
+    const prepared = await prepareLocalTrackSwitch(bridge, {
+      channel: release.channel,
+      version: release.version,
+      reinstall: switchesLocal,
+    });
+    onClose();
+    if (!prepared.ok) {
+      fail(prepared.message);
+      return;
+    }
+    const { local } = prepared;
+    const result = await settlePromise(() =>
+      everything.run(
+        local === null
+          ? {}
+          : {
+              ...(local.status === "available"
+                ? {
+                    downloadLocal: (reportError) =>
+                      downloadLocalUpdate(bridge, { notifyDownloaded: false, reportError }),
+                  }
+                : {}),
+              // Install only a build the database check covers, pinned so nothing replaces it.
+              installLocal: async (reportError) => {
+                const { downloadedVersion } = await bridge.getUpdateState();
+                if (
+                  downloadedVersion === null ||
+                  !acceptsTrackSwitchRelease(downloadedVersion, release.channel, release.version)
+                ) {
+                  reportError(
+                    "Could not install update",
+                    `This app downloaded ${downloadedVersion ?? "nothing"}, not ${release.version} or newer.`,
+                  );
+                  return false;
+                }
+                return installLocalUpdate(bridge, reportError, downloadedVersion);
+              },
+            },
+      ),
+    );
+    if (result._tag === "Failure") {
+      const error = squashAtomCommandFailure(result);
+      fail(error instanceof Error ? error.message : "An unexpected error occurred.");
+    }
+  };
+
+  return (
+    <UpdateEverythingDialog
+      open
+      onOpenChange={(open) => !open && !checking && onClose()}
+      title={`Switch to ${label}?`}
+      version={release.version}
+      providerCount={0}
+      rows={everything.rows}
+      notes={[
+        ...(everything.rows.length === 0 && !crossesLocal
+          ? [`Every connected machine is already on ${label}. This only saves the track.`]
+          : []),
+        ...(crossesLocal && updatesOff
+          ? ["This app's updates are off here, so reinstall it yourself to switch."]
+          : []),
+        ...(switchesLocal && isMacPlatform(navigator.platform)
+          ? ["If T3 Code does not reopen after it restarts, open it again."]
+          : []),
+      ]}
+      restarts={everything.restarts}
+      confirmLabel={checking ? "Checking…" : `Switch to ${label}`}
+      busy={checking}
+      disabledReason={
+        !switchesLocal || localBlocked === null ? null : `This app cannot switch: ${localBlocked}.`
+      }
+      onConfirm={() => void run()}
+    />
+  );
+}
diff --git a/apps/web/src/components/settings/updateTrackSwitch.logic.test.ts b/apps/web/src/components/settings/updateTrackSwitch.logic.test.ts
new file mode 100644
index 0000000000000..63c4422f28a64
--- /dev/null
+++ b/apps/web/src/components/settings/updateTrackSwitch.logic.test.ts
@@ -0,0 +1,76 @@
+import type { DesktopUpdateChannel, DesktopUpdateState } from "@t3tools/contracts";
+import { describe, expect, it } from "vite-plus/test";
+
+import { prepareLocalTrackSwitch } from "./updateTrackSwitch.logic";
+
+const STABLE = "0.1.3";
+
+/** Like the desktop app, saving a track re-checks the feed and reports what it offers. */
+function fakeBridge(offer: string | null | Error) {
+  const saved: DesktopUpdateChannel[] = [];
+  const base: DesktopUpdateState = {
+    enabled: true,
+    status: "up-to-date",
+    channel: "nightly",
+    currentVersion: "0.1.4-nightly.20261027.3796",
+    hostArch: "x64",
+    appArch: "x64",
+    runningUnderArm64Translation: false,
+    availableVersion: null,
+    downloadedVersion: null,
+    releaseNotes: [],
+    omittedReleaseCount: 0,
+    downloadPercent: null,
+    checkedAt: null,
+    message: null,
+    errorContext: null,
+    canRetry: false,
+  };
+  return {
+    saved,
+    bridge: {
+      setUpdateChannel: async (channel: DesktopUpdateChannel) => {
+        saved.push(channel);
+        if (offer instanceof Error) throw offer;
+        return {
+          ...base,
+          channel,
+          status: offer === null ? ("up-to-date" as const) : ("available" as const),
+          availableVersion: offer,
+        };
+      },
+    },
+  };
+}
+
+const prepare = (bridge: ReturnType<typeof fakeBridge>["bridge"], reinstall = true) =>
+  prepareLocalTrackSwitch(bridge, { channel: "latest", version: STABLE, reinstall });
+
+describe("prepareLocalTrackSwitch", () => {
+  it("installs the checked release or a newer one on the track, never an older one", async () => {
+    expect(await prepare(fakeBridge(STABLE).bridge)).toMatchObject({ ok: true });
+    // A newer Stable knows every migration the checked one does.
+    expect(await prepare(fakeBridge("0.1.4").bridge)).toMatchObject({ ok: true });
+
+    const stale = fakeBridge("0.1.2");
+    expect(await prepare(stale.bridge)).toEqual({
+      ok: false,
+      message: "This app found 0.1.2, which is older than 0.1.3. Try again in a few minutes.",
+    });
+    // The saved track is intent; "Switch them" retries without re-picking it.
+    expect(stale.saved).toEqual(["latest"]);
+  });
+
+  it("reports a track that could not be saved", async () => {
+    expect(await prepare(fakeBridge(new Error("feed check failed")).bridge)).toEqual({
+      ok: false,
+      message: "feed check failed",
+    });
+  });
+
+  it("only saves the track when this app is already on it", async () => {
+    const undo = fakeBridge(null);
+    expect(await prepare(undo.bridge, false)).toEqual({ ok: true, local: null });
+    expect(undo.saved).toEqual(["latest"]);
+  });
+});
diff --git a/apps/web/src/components/settings/updateTrackSwitch.logic.ts b/apps/web/src/components/settings/updateTrackSwitch.logic.ts
new file mode 100644
index 0000000000000..6e7e49898df0b
--- /dev/null
+++ b/apps/web/src/components/settings/updateTrackSwitch.logic.ts
@@ -0,0 +1,50 @@
+import type { DesktopBridge, DesktopUpdateChannel, DesktopUpdateState } from "@t3tools/contracts";
+import { acceptsTrackSwitchRelease } from "@t3tools/shared/cliRelease";
+
+type TrackSwitchBridge = Pick<DesktopBridge, "setUpdateChannel">;
+
+/** Saves the track, then, when this app must reinstall, finds a build the database check covers.
+ * The saved track is the user's intent and stays even when no such build is ready yet: a track
+ * saved toward Stable never offers an older build outside a guarded switch, and "Switch them"
+ * retries. Saving when nothing reinstalls lets picking the old track undo a partial switch. */
+export async function prepareLocalTrackSwitch(
+  bridge: TrackSwitchBridge,
+  input: {
+    readonly channel: DesktopUpdateChannel;
+    readonly version: string;
+    readonly reinstall: boolean;
+  },
+): Promise<
+  | { readonly ok: true; readonly local: DesktopUpdateState | null }
+  | { readonly ok: false; readonly message: string }
+> {
+  let local: DesktopUpdateState;
+  try {
+    // A build on another track re-checks the feed, older releases allowed down to the checked one.
+    local = await bridge.setUpdateChannel(
+      input.channel,
+      input.reinstall ? input.version : undefined,
+    );
+  } catch (error) {
+    return {
+      ok: false,
+      message: error instanceof Error ? error.message : "The update track did not change.",
+    };
+  }
+  if (!input.reinstall) return { ok: true, local: null };
+  const found = local.downloadedVersion ?? local.availableVersion;
+  if (
+    (local.status === "available" || local.status === "downloaded") &&
+    found !== null &&
+    acceptsTrackSwitchRelease(found, input.channel, input.version)
+  ) {
+    return { ok: true, local };
+  }
+  return {
+    ok: false,
+    message:
+      found !== null
+        ? `This app found ${found}, which is older than ${input.version}. Try again in a few minutes.`
+        : (local.message ?? `This app found no build of ${input.version} to install.`),
+  };
+}
diff --git a/apps/web/src/components/sidebar/SidebarUpdatePill.tsx b/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
index ecfeb4d664a3b..d9f45cf92f934 100644
--- a/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
+++ b/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
@@ -134,7 +134,7 @@ const toastUpdateError: ReportLocalUpdateError = (title, description) => {
   toastManager.add(stackedThreadToast({ type: "error", title, description }));
 };
 
-async function downloadLocalUpdate(
+export async function downloadLocalUpdate(
   bridge: DesktopBridge,
   {
     notifyDownloaded,
@@ -160,12 +160,13 @@ async function downloadLocalUpdate(
   }
 }
 
-async function installLocalUpdate(
+export async function installLocalUpdate(
   bridge: DesktopBridge,
   reportError: ReportLocalUpdateError = toastUpdateError,
+  expectedVersion?: string,
 ): Promise<boolean> {
   try {
-    const result = await bridge.installUpdate();
+    const result = await bridge.installUpdate(expectedVersion);
     if (!result.accepted) {
       showDesktopUpdateDownloadedToast(bridge, result.state);
       return false;
diff --git a/apps/web/src/components/sidebar/UpdateEverythingDialog.tsx b/apps/web/src/components/sidebar/UpdateEverythingDialog.tsx
index 8cd5c5ca777d5..9bf101b6fa4e7 100644
--- a/apps/web/src/components/sidebar/UpdateEverythingDialog.tsx
+++ b/apps/web/src/components/sidebar/UpdateEverythingDialog.tsx
@@ -47,6 +47,14 @@ interface UpdateEverythingDialogProps {
   readonly rows: ReadonlyArray<UpdateEverythingRow>;
   readonly restarts: ReadonlyArray<RestartingMachine>;
   readonly onConfirm: () => void;
+  /** Overrides the "Update N machines?" title, for an update-track switch. */
+  readonly title?: string;
+  readonly confirmLabel?: string;
+  readonly notes?: ReadonlyArray<string>;
+  /** Shown in place of running-thread counts; disables the confirm button. */
+  readonly disabledReason?: string | null;
+  /** The confirmed work is starting; it cannot be cancelled from here. */
+  readonly busy?: boolean;
 }
 
 type UpdateEverythingDialogContentProps = Omit<
@@ -89,6 +97,11 @@ function UpdateEverythingDialogContent({
   restarts,
   onConfirm,
   cancelRef,
+  title,
+  confirmLabel = "Update",
+  notes = [],
+  disabledReason = null,
+  busy = false,
 }: UpdateEverythingDialogContentProps) {
   const stopped = useAtomValue(
     runningThreadCountAtom(
@@ -116,7 +129,7 @@ function UpdateEverythingDialogContent({
     <>
       <AlertDialogHeader className="shrink-0">
         <AlertDialogTitle>
-          Update {updating.length} {updating.length === 1 ? "machine" : "machines"}?
+          {title ?? `Update ${updating.length} ${updating.length === 1 ? "machine" : "machines"}?`}
         </AlertDialogTitle>
         <AlertDialogDescription>
           {version !== null ? (
@@ -132,6 +145,11 @@ function UpdateEverythingDialogContent({
       </AlertDialogHeader>
       <ScrollArea scrollFade>
         <div className="flex flex-col gap-3 px-6 pb-4">
+          {notes.map((note) => (
+            <p key={note} className="text-muted-foreground text-sm">
+              {note}
+            </p>
+          ))}
           {/* Machine names truncate first. Provider lists wrap between names, never inside one. */}
           <div className="grid grid-cols-[minmax(4rem,max-content)_max-content_minmax(min-content,1fr)_max-content] gap-x-4 text-sm">
             <div className="col-span-full grid grid-cols-subgrid border-b pb-1.5 text-muted-foreground text-xs">
@@ -196,7 +214,11 @@ function UpdateEverythingDialogContent({
         </div>
       </ScrollArea>
       <AlertDialogFooter>
-        {running > 0 ? (
+        {disabledReason !== null ? (
+          <p className="self-center text-sm max-sm:order-1 max-sm:text-center sm:mr-auto">
+            {disabledReason}
+          </p>
+        ) : running > 0 ? (
           <p className="self-center text-muted-foreground text-sm max-sm:order-1 max-sm:text-center sm:mr-auto">
             {stopped === 0
               ? `${threads} will be interrupted and can resume after the restart.`
@@ -205,10 +227,12 @@ function UpdateEverythingDialogContent({
                 : `${threads} will be interrupted. ${continuing} can resume after the restart.`}
           </p>
         ) : null}
-        <AlertDialogClose ref={cancelRef} render={<Button variant="outline" />}>
+        <AlertDialogClose ref={cancelRef} render={<Button variant="outline" disabled={busy} />}>
           Cancel
         </AlertDialogClose>
-        <Button onClick={onConfirm}>Update</Button>
+        <Button disabled={disabledReason !== null || busy} onClick={onConfirm}>
+          {confirmLabel}
+        </Button>
       </AlertDialogFooter>
     </>
   );
diff --git a/apps/web/src/components/sidebar/updateEverything.logic.test.ts b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
index 3739308f7b1c7..4c09823d40538 100644
--- a/apps/web/src/components/sidebar/updateEverything.logic.test.ts
+++ b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
@@ -2,8 +2,11 @@ import { EnvironmentId, type ServerSelfUpdateCapability } from "@t3tools/contrac
 import { describe, expect, it } from "vite-plus/test";
 
 import {
+  collectChannelSwitchTargets,
   collectRestartingMachines,
+  localSwitchBlockReason,
   collectServerUpdateTargets,
+  describeUpdateCapsule,
   describeUpdateEverything,
   runUpdateEverything,
   type UpdateEverythingMachine,
@@ -27,7 +30,9 @@ function machine(
         capabilities: {
           repositoryIdentity: true,
           ...(selfUpdate ? { serverSelfUpdate: selfUpdate } : {}),
-          ...(selfUpdate === "desktop-managed" ? { desktopAppUpdate: true } : {}),
+          ...(selfUpdate === "desktop-managed"
+            ? { desktopAppUpdate: true, desktopAppChannelSwitch: true }
+            : {}),
         },
       },
       settings: { continueThreadsAfterServerUpdate: false },
@@ -81,6 +86,136 @@ describe("collectServerUpdateTargets", () => {
   });
 });
 
+describe("collectChannelSwitchTargets", () => {
+  const NIGHTLY = "0.1.4-nightly.20261027.3796";
+  const OLD_NIGHTLY = "0.1.3-nightly.20261001.3500";
+  const NEWER_NIGHTLY = "0.1.4-nightly.20261020.3700";
+  // What each server reports as its database's highest migration.
+  const host = (
+    base: UpdateEverythingMachine,
+    databaseMigration: number | undefined,
+    os: "linux" | "darwin" = "linux",
+  ): UpdateEverythingMachine => ({
+    ...base,
+    serverConfig: {
+      ...base.serverConfig!,
+      environment: {
+        ...base.serverConfig!.environment,
+        platform: { os, arch: "x64" },
+        ...(databaseMigration === undefined ? {} : { databaseMigration }),
+      },
+    },
+  });
+
+  it("moves nightly hosts to stable only when stable knows their database", () => {
+    const stable = { channel: "latest" as const, version: "0.1.3", databaseMigration: 69 };
+    const { targets, skipped } = collectChannelSwitchTargets(
+      [
+        host(machine("this-app", NIGHTLY, "desktop-managed", { hostedByThisApp: true }), 72),
+        host(machine("old-service", OLD_NIGHTLY, "boot-service"), 69),
+        // Service launchers refuse older versions, even when the database allows it.
+        host(machine("newer-service", NEWER_NIGHTLY, "boot-service"), 69),
+        host(machine("linux-desktop", OLD_NIGHTLY, "desktop-managed"), 69),
+        host(machine("new-service", NIGHTLY, "boot-service"), 72),
+        host(machine("old-server", "0.1.2-nightly.20260901.3000", "boot-service"), undefined),
+        host(machine("mac-desktop", OLD_NIGHTLY, "desktop-managed"), 69, "darwin"),
+        host(machine("preview", "0.1.3-preview.20261026.3702", "boot-service"), 69),
+        host(machine("stable", "0.1.3", "boot-service"), 69),
+        host(machine("stable-desktop", "0.1.2", "desktop-managed"), 68),
+        // Already current, but its saved track may still say Nightly.
+        host(machine("current-desktop", "0.1.3", "desktop-managed"), 69, "darwin"),
+      ],
+      stable,
+    );
+
+    expect(
+      targets.map((target) => [
+        target.serverLabel,
+        target.targetVersion,
+        target.channel,
+        target.trackOnly ?? false,
+      ]),
+    ).toEqual([
+      ["old-service", "0.1.3", undefined, false],
+      ["linux-desktop", "0.1.3", "latest", false],
+      ["stable-desktop", "0.1.3", "latest", false],
+      ["current-desktop", "0.1.3", "latest", true],
+    ]);
+    expect(targets.every((target) => target.targetDatabaseMigration === 69)).toBe(true);
+    expect(skipped.map((entry) => [entry.label, entry.reason])).toEqual([
+      ["newer-service", "run `t3 update --channel stable --allow-downgrade` there"],
+      [
+        "new-service",
+        "its database has changes 0.1.3 does not support yet; stay on Nightly until Stable has them",
+      ],
+      ["old-server", "its server predates database checks; update it on Nightly first"],
+      ["mac-desktop", "switch the Mac app on that Mac"],
+      ["preview", "runs a preview build"],
+    ]);
+  });
+
+  it("moves stable hosts to nightly only when nightly knows their database", () => {
+    const nightly = { channel: "nightly" as const, version: NIGHTLY, databaseMigration: 72 };
+    const { targets, skipped } = collectChannelSwitchTargets(
+      [
+        host(machine("service", "0.1.2", "boot-service"), 70),
+        // A Stable tag built a migration the latest Nightly does not have yet.
+        host(machine("ahead", "0.1.3", "boot-service"), 73),
+        machine("old-desktop", "0.1.2", "desktop-managed", {
+          serverConfig: {
+            ...machine("old-desktop", "0.1.2", "desktop-managed").serverConfig!,
+            environment: {
+              ...machine("old-desktop", "0.1.2", "desktop-managed").serverConfig!.environment,
+              capabilities: { repositoryIdentity: true, serverSelfUpdate: "desktop-managed" },
+            },
+          },
+        }),
+        machine("current", NIGHTLY, "boot-service"),
+      ],
+      nightly,
+    );
+
+    expect(targets.map((target) => [target.serverLabel, target.targetVersion])).toEqual([
+      ["service", NIGHTLY],
+    ]);
+    expect(skipped.map((entry) => [entry.label, entry.reason])).toEqual([
+      [
+        "ahead",
+        `its database has changes ${NIGHTLY} does not support yet; stay on Stable until Nightly has them`,
+      ],
+      ["old-desktop", "needs a newer desktop app"],
+    ]);
+  });
+});
+
+describe("localSwitchBlockReason", () => {
+  it("checks every server this app hosts, and only while connected", () => {
+    const stable = { channel: "latest" as const, version: "0.1.3", databaseMigration: 69 };
+    const nightly = "0.1.4-nightly.20261027.3796";
+
+    const windows = { connected: true, databaseMigration: 69 };
+    expect(localSwitchBlockReason(nightly, stable, [windows], 1)).toBeNull();
+    // A WSL server's newer migration blocks the reinstall that would restart it.
+    expect(
+      localSwitchBlockReason(
+        nightly,
+        stable,
+        [windows, { connected: true, databaseMigration: 72 }],
+        2,
+      ),
+    ).toContain("does not support yet");
+    // A WSL backend still starting has no client entry, so its database is unchecked.
+    expect(localSwitchBlockReason(nightly, stable, [windows], 2)).toBe(
+      "its server is not connected, so its database cannot be checked",
+    );
+    // A cached head from a disconnected server proves nothing.
+    expect(
+      localSwitchBlockReason(nightly, stable, [{ connected: false, databaseMigration: 69 }], 1),
+    ).toBe("its server is not connected, so its database cannot be checked");
+    expect(localSwitchBlockReason("0.1.3", stable, [], 1)).toBeNull();
+  });
+});
+
 describe("collectRestartingMachines", () => {
   it("lists updated servers, and this app's servers only when it installs", () => {
     const withContinuation = (
@@ -177,3 +312,33 @@ describe("describeUpdateEverything", () => {
     ]);
   });
 });
+
+describe("describeUpdateCapsule", () => {
+  it("sends failed track switches back through the planner instead of retrying their target", () => {
+    const failed = {
+      machine: {
+        environmentId: EnvironmentId.make("remote"),
+        label: "remote",
+        updatesProviders: false,
+        server: {
+          environmentId: EnvironmentId.make("remote"),
+          serverLabel: "remote",
+          selfUpdate: "boot-service" as const,
+          targetVersion: "0.1.3",
+        },
+        handedOffVersion: null,
+        startedAt: 0,
+        result: "failed" as const,
+        failure: "offline",
+        providerFailure: null,
+      },
+      status: "failed" as const,
+    };
+    const run = { localVersion: null, phase: "servers" as const, restartAt: null, machines: [] };
+
+    expect(describeUpdateCapsule(run, [failed], null, 0).action).toBe("retry");
+    expect(describeUpdateCapsule({ ...run, trackSwitch: true }, [failed], null, 0).action).toBe(
+      "dismiss",
+    );
+  });
+});
diff --git a/apps/web/src/components/sidebar/updateEverything.logic.ts b/apps/web/src/components/sidebar/updateEverything.logic.ts
index 469e5a0faf674..8d82b7b568e75 100644
--- a/apps/web/src/components/sidebar/updateEverything.logic.ts
+++ b/apps/web/src/components/sidebar/updateEverything.logic.ts
@@ -1,6 +1,12 @@
 import type { ServerUpdateState } from "@t3tools/client-runtime/state/server";
-import type { EnvironmentId, ServerConfig } from "@t3tools/contracts";
-import { cliReleaseChannelOf } from "@t3tools/shared/cliRelease";
+import type {
+  DesktopUpdateChannel,
+  EnvironmentId,
+  ServerConfig,
+  ServerSelfUpdateCapability,
+} from "@t3tools/contracts";
+import { cliReleaseChannelOf, desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
+import { compareSemverVersions } from "@t3tools/shared/semver";
 
 import {
   resolveServerSelfUpdateCapability,
@@ -76,16 +82,9 @@ export function collectServerUpdateTargets(
     }
     const skip = (reason: string) =>
       skipped.push({ environmentId: machine.environmentId, label: machine.label, reason });
-    if (config === null || !machine.connected) {
-      skip("not connected");
-      continue;
-    }
-    if (!machine.canMaintain) {
-      skip("no permission");
-      continue;
-    }
-    if (machine.updateState.status === "running") {
-      skip("already updating");
+    const unavailable = unavailableReason(machine);
+    if (config === null || unavailable !== null) {
+      skip(unavailable ?? "not connected");
       continue;
     }
     const selfUpdate = resolveServerSelfUpdateCapability(config);
@@ -118,6 +117,192 @@ export function collectServerUpdateTargets(
   return { targets, skipped };
 }
 
+function unavailableReason(machine: UpdateEverythingMachine): string | null {
+  if (machine.serverConfig === null || !machine.connected) return "not connected";
+  if (!machine.canMaintain) return "no permission";
+  if (machine.updateState.status === "running") return "already updating";
+  return null;
+}
+
+/** The latest release on the track a fleet switches to, as npm reports it. */
+export interface ChannelSwitchRelease {
+  readonly channel: DesktopUpdateChannel;
+  readonly version: string;
+  readonly databaseMigration: number | undefined;
+}
+
+export const channelSwitchLabel = (channel: DesktopUpdateChannel) =>
+  channel === "nightly" ? "Nightly" : "Stable";
+
+/** Stable and Nightly each build their own commits, so either can hold migrations the other lacks.
+ * Crossing tracks needs proof that the target release knows every migration the database holds. */
+const crossesTrack = (fromVersion: string, release: ChannelSwitchRelease) =>
+  desktopUpdateChannelOf(fromVersion) !== release.channel;
+
+function channelSwitchBlockReason(
+  fromVersion: string,
+  release: ChannelSwitchRelease,
+  currentMigration: number | undefined,
+): string | null {
+  if (!crossesTrack(fromVersion, release)) return null;
+  const from = channelSwitchLabel(desktopUpdateChannelOf(fromVersion));
+  // Servers and releases from before this check report no migration number.
+  if (currentMigration === undefined) {
+    return `its server predates database checks; update it on ${from} first`;
+  }
+  if (release.databaseMigration === undefined) {
+    return `${release.version} predates database checks; wait for a newer ${channelSwitchLabel(release.channel)} release`;
+  }
+  return currentMigration > release.databaseMigration
+    ? `its database has changes ${release.version} does not support yet; stay on ${from} until ${channelSwitchLabel(release.channel)} has them`
+    : null;
+}
+
+/** This app's reinstall restarts every server it hosts, so each of their databases must allow the
+ * switch. `backendCount` is the desktop's own inventory: a backend still starting has no client
+ * entry yet. A cached config can outlive its connection, so only a connected server's head counts. */
+export function localSwitchBlockReason(
+  appVersion: string,
+  release: ChannelSwitchRelease,
+  hosted: ReadonlyArray<{
+    readonly connected: boolean;
+    readonly databaseMigration: number | undefined;
+  }>,
+  backendCount: number,
+): string | null {
+  if (!crossesTrack(appVersion, release)) return null;
+  if (
+    hosted.length === 0 ||
+    hosted.length < backendCount ||
+    hosted.some((server) => !server.connected)
+  ) {
+    return "its server is not connected, so its database cannot be checked";
+  }
+  return (
+    hosted
+      .map((server) => channelSwitchBlockReason(appVersion, release, server.databaseMigration))
+      .find((reason) => reason !== null) ?? null
+  );
+}
+
+/** Servers move to the release; desktop-managed hosts reinstall their app on its track. A desktop
+ * host already current gets a track-only request, since its saved track may still differ. */
+export function collectChannelSwitchTargets(
+  machines: ReadonlyArray<UpdateEverythingMachine>,
+  release: ChannelSwitchRelease,
+): { readonly targets: ServerUpdateTarget[]; readonly skipped: SkippedMachine[] } {
+  const targets: ServerUpdateTarget[] = [];
+  const skipped: SkippedMachine[] = [];
+  for (const machine of machines) {
+    const config = machine.serverConfig;
+    if (machine.hostedByThisApp) continue;
+    const skip = (reason: string) =>
+      skipped.push({ environmentId: machine.environmentId, label: machine.label, reason });
+    const target = (
+      selfUpdate: ServerSelfUpdateCapability,
+      targetVersion: string,
+    ): ServerUpdateTarget => ({
+      environmentId: machine.environmentId,
+      serverLabel: machine.label,
+      selfUpdate,
+      installation: config?.environment.capabilities.serverInstallation,
+      desktopAppUpdate: config !== null && supportsDesktopAppUpdate(config),
+      targetVersion,
+      ...(selfUpdate === "desktop-managed" ? { channel: release.channel } : {}),
+      ...(release.databaseMigration === undefined
+        ? {}
+        : { targetDatabaseMigration: release.databaseMigration }),
+    });
+    const serverVersion = config?.environment.serverVersion;
+    const sameTrack = serverVersion !== undefined && isOnTrack(serverVersion, release.channel);
+    if (
+      config !== null &&
+      sameTrack &&
+      resolveVersionMismatch(serverVersion, release.version) === null
+    ) {
+      const move = trackSwitchMove(config, true);
+      if (
+        !("skip" in move) &&
+        move.selfUpdate === "desktop-managed" &&
+        unavailableReason(machine) === null
+      ) {
+        targets.push({ ...target(move.selfUpdate, serverVersion), trackOnly: true });
+      }
+      continue;
+    }
+    const unavailable = unavailableReason(machine);
+    if (config === null || serverVersion === undefined || unavailable !== null) {
+      skip(unavailable ?? "not connected");
+      continue;
+    }
+    const move = trackSwitchMove(config, sameTrack);
+    if ("skip" in move) {
+      skip(move.skip);
+      continue;
+    }
+    const blocked = channelSwitchBlockReason(
+      serverVersion,
+      release,
+      config.environment.databaseMigration,
+    );
+    if (blocked !== null) {
+      skip(blocked);
+      continue;
+    }
+    // Service launchers only accept newer versions, so leaving for an older release is manual.
+    if (
+      move.selfUpdate === "boot-service" &&
+      compareSemverVersions(release.version, serverVersion) <= 0
+    ) {
+      skip(
+        `run \`t3 update --channel ${release.channel === "nightly" ? "nightly" : "stable"} --allow-downgrade\` there`,
+      );
+      continue;
+    }
+    targets.push(target(move.selfUpdate, release.version));
+  }
+  return { targets, skipped };
+}
+
+/** A remote host on the other track that a switch can still move, for retrying a partial switch. */
+export function awaitsTrackSwitch(
+  machine: Pick<UpdateEverythingMachine, "serverConfig" | "hostedByThisApp">,
+  channel: DesktopUpdateChannel,
+): boolean {
+  const config = machine.serverConfig;
+  return (
+    !machine.hostedByThisApp &&
+    config !== null &&
+    !isOnTrack(config.environment.serverVersion, channel) &&
+    !("skip" in trackSwitchMove(config, false))
+  );
+}
+
+function isOnTrack(version: string, channel: DesktopUpdateChannel): boolean {
+  return cliReleaseChannelOf(version) !== "preview" && desktopUpdateChannelOf(version) === channel;
+}
+
+/** How a switch moves a host, or why it never can from here, whatever the release. */
+function trackSwitchMove(
+  config: NonNullable<UpdateEverythingMachine["serverConfig"]>,
+  sameTrack: boolean,
+): { readonly selfUpdate: ServerSelfUpdateCapability } | { readonly skip: string } {
+  if (cliReleaseChannelOf(config.environment.serverVersion) === "preview") {
+    return { skip: "runs a preview build" };
+  }
+  const selfUpdate = resolveServerSelfUpdateCapability(config);
+  if (selfUpdate === null) return { skip: "needs a manual update" };
+  if (selfUpdate !== "desktop-managed") return { selfUpdate };
+  if (config.environment.capabilities.desktopAppChannelSwitch !== true) {
+    return { skip: "needs a newer desktop app" };
+  }
+  // Squirrel.Mac renames the bundle for the new track and then cannot relaunch it.
+  if (!sameTrack && config.environment.platform.os === "darwin") {
+    return { skip: "switch the Mac app on that Mac" };
+  }
+  return { selfUpdate };
+}
+
 export interface UpdateEverythingSteps<Providers, Servers> {
   readonly downloadLocal?: () => Promise<boolean>;
   readonly updateProviders: () => Promise<Providers>;
@@ -163,6 +348,8 @@ export interface UpdateRunMachine {
 }
 
 export interface UpdateEverythingRun {
+  /** Track switches retry through their planner, which re-checks each database. */
+  readonly trackSwitch?: boolean;
   readonly localVersion: string | null;
   readonly phase: "providers" | "servers" | "countdown" | "installing";
   readonly restartAt: number | null;
@@ -265,7 +452,10 @@ export function describeUpdateCapsule(
     return {
       tone: "failed",
       label: failed.length === 1 ? `${failed[0]!.machine.label} failed` : `${failed.length} failed`,
-      action: failed.some(({ machine }) => machine.server !== null) ? "retry" : "dismiss",
+      action:
+        !run.trackSwitch && failed.some(({ machine }) => machine.server !== null)
+          ? "retry"
+          : "dismiss",
     };
   }
   return { tone: "default", label: `${done} of ${machines.length} updated`, action: null };
diff --git a/apps/web/src/components/sidebar/useUpdateEverything.ts b/apps/web/src/components/sidebar/useUpdateEverything.ts
index af38bbf5d4bc4..84e9697cd65b9 100644
--- a/apps/web/src/components/sidebar/useUpdateEverything.ts
+++ b/apps/web/src/components/sidebar/useUpdateEverything.ts
@@ -13,7 +13,9 @@ import { getProviderUpdateRunOutcome } from "../ProviderUpdateLaunchNotification
 import { useProviderUpdates } from "../ProviderUpdatesAction";
 import { canUpdateServer, type ServerUpdateOutcome, useServerUpdate } from "../ServerUpdateAction";
 import {
+  type ChannelSwitchRelease,
   closeFinishedUpdateRun,
+  collectChannelSwitchTargets,
   collectRestartingMachines,
   collectServerUpdateTargets,
   collectUpdateEverythingResult,
@@ -34,9 +36,24 @@ import {
 
 const UPDATE_RESTART_DELAY_MS = 5_000;
 
+/** Servers this desktop app runs; they update with it. */
+export function isHostedByThisApp(
+  environment: ReturnType<typeof useEnvironments>["environments"][number],
+) {
+  return (
+    isElectron &&
+    (environment.entry.target._tag === "PrimaryConnectionTarget" ||
+      isDesktopLocalConnectionTarget(environment.entry.target))
+  );
+}
+
 export type ReportLocalUpdateError = (title: string, description: string) => void;
 
-export function useUpdateEverything(localUpdateVersion: string | null) {
+/** `channelSwitch` makes the run move the fleet to that release's track instead of updating it. */
+export function useUpdateEverything(
+  localUpdateVersion: string | null,
+  channelSwitch?: ChannelSwitchRelease,
+) {
   const targetVersion = localUpdateVersion ?? APP_VERSION;
   const { environments } = useEnvironments();
   const environmentIds = environmentIdsKey(environments.map(({ environmentId }) => environmentId));
@@ -47,23 +64,23 @@ export function useUpdateEverything(localUpdateVersion: string | null) {
     label: environment.label,
     serverConfig: environment.serverConfig,
     connected: environment.connection.phase === "connected",
-    hostedByThisApp:
-      isElectron &&
-      (environment.entry.target._tag === "PrimaryConnectionTarget" ||
-        isDesktopLocalConnectionTarget(environment.entry.target)),
+    hostedByThisApp: isHostedByThisApp(environment),
     canMaintain: canUpdateServer(sessionStates[index]!),
     updateState: updateStates[index]!,
   }));
-  const { targets: behindServers, skipped: unreachable } = collectServerUpdateTargets(
-    machines,
-    targetVersion,
-  );
+  const { targets: behindServers, skipped: unreachable } = channelSwitch
+    ? collectChannelSwitchTargets(machines, channelSwitch)
+    : collectServerUpdateTargets(machines, targetVersion);
   // Desktop-managed servers use their app feed; only npm installs need to wait for publication.
-  const needsNpm = behindServers.some((server) => server.selfUpdate !== "desktop-managed");
+  // A track switch's target came from npm already.
+  const needsNpm =
+    channelSwitch === undefined &&
+    behindServers.some((server) => server.selfUpdate !== "desktop-managed");
   const published = useNpmReleasePublished(needsNpm ? targetVersion : null);
-  const servers = published
-    ? behindServers
-    : behindServers.filter((server) => server.selfUpdate === "desktop-managed");
+  const servers =
+    published || channelSwitch !== undefined
+      ? behindServers
+      : behindServers.filter((server) => server.selfUpdate === "desktop-managed");
   const skipped: ReadonlyArray<SkippedMachine> = [
     ...unreachable,
     ...behindServers
@@ -74,14 +91,18 @@ export function useUpdateEverything(localUpdateVersion: string | null) {
         reason: `t3@${targetVersion} is not on npm yet`,
       })),
   ];
-  const restarts = collectRestartingMachines(machines, servers, localUpdateVersion !== null);
-  const providers = useProviderUpdates();
+  // Track-only hosts save a setting and restart nothing, so they are neither listed nor counted.
+  const moving = servers.filter((server) => server.trackOnly !== true);
+  const restarts = collectRestartingMachines(machines, moving, localUpdateVersion !== null);
+  const providerUpdates = useProviderUpdates();
+  // A track switch moves app and servers only; provider updates stay a separate choice.
+  const providers = channelSwitch ? { machines: [], updateAll: async () => [] } : providerUpdates;
   const updateServer = useServerUpdate();
 
   const view = describeUpdateEverything({
     localVersion: localUpdateVersion,
     localMachines: machines.filter((machine) => machine.hostedByThisApp),
-    servers,
+    servers: moving,
     skipped,
     providerMachines: providers.machines.map((machine) => ({
       environmentId: machine.environmentId,
@@ -138,6 +159,7 @@ export function useUpdateEverything(localUpdateVersion: string | null) {
       }
       const localVersion = installLocal ? localUpdateVersion : null;
       setUpdateEverythingRun(() => ({
+        ...(channelSwitch ? { trackSwitch: true } : {}),
         localVersion,
         phase: "providers",
         restartAt: null,
diff --git a/apps/web/src/state/npmRelease.ts b/apps/web/src/state/npmRelease.ts
index 4436a42c29e4b..09db3b68c0691 100644
--- a/apps/web/src/state/npmRelease.ts
+++ b/apps/web/src/state/npmRelease.ts
@@ -1,31 +1,51 @@
 import { useAtomValue } from "@effect/atom-react";
+import { npmReleaseDatabaseMigration } from "@t3tools/shared/cliRelease";
 import * as Effect from "effect/Effect";
 import { FetchHttpClient, HttpClient, HttpClientResponse } from "effect/http";
 import { AsyncResult, Atom } from "effect/reactivity";
 
-export const npmReleasePublishedAtom = Atom.family((version: string) =>
+export interface NpmRelease {
+  readonly version: string;
+  /** Absent on releases published before npm manifests carried it. */
+  readonly databaseMigration: number | undefined;
+}
+
+/** `spec` is an exact version or a dist-tag such as `nightly`. Null when npm has no such release.
+ * Refreshes only while mounted; the published check below keeps its own versions alive. */
+export const npmReleaseAtom = Atom.family((spec: string) =>
   Atom.make(
     Effect.gen(function* () {
       const response = yield* HttpClient.get(
-        `https://registry.npmjs.org/t3/${encodeURIComponent(version)}`,
+        `https://registry.npmjs.org/t3/${encodeURIComponent(spec)}`,
       );
-      if (response.status === 404) return false;
+      if (response.status === 404) return null;
       const body = yield* HttpClientResponse.filterStatusOk(response).pipe(
         Effect.flatMap((ok) => ok.json),
       );
-      return typeof body === "object" && body !== null && "version" in body
-        ? body.version === version
-        : false;
+      if (
+        typeof body !== "object" ||
+        body === null ||
+        !("version" in body) ||
+        typeof body.version !== "string"
+      ) {
+        return null;
+      }
+      return {
+        version: body.version,
+        databaseMigration: npmReleaseDatabaseMigration(body),
+      } satisfies NpmRelease;
     }).pipe(
       // Tracing headers would make the browser send a CORS preflight, which npm rejects.
       Effect.provideService(HttpClient.TracerPropagationEnabled, false),
       Effect.provide(FetchHttpClient.layer),
     ),
-  ).pipe(
-    Atom.withRefresh("5 minutes"),
-    Atom.keepAlive,
-    Atom.withLabel(`npm-release-published:${version}`),
-  ),
+  ).pipe(Atom.withRefresh("5 minutes"), Atom.withLabel(`npm-release:${spec}`)),
+);
+
+export const npmReleasePublishedAtom = Atom.family((version: string) =>
+  Atom.make((get) =>
+    get.result(npmReleaseAtom(version)).pipe(Effect.map((release) => release?.version === version)),
+  ).pipe(Atom.keepAlive, Atom.withLabel(`npm-release-published:${version}`)),
 );
 
 const NO_VERSION_ATOM = Atom.make(AsyncResult.success(false)).pipe(
diff --git a/docs/user/updating.md b/docs/user/updating.md
index ad5d93b5759a2..006c4985d43cd 100644
--- a/docs/user/updating.md
+++ b/docs/user/updating.md
@@ -35,6 +35,29 @@ The confirmation counts the running threads that the restarts will interrupt,
 and how many can resume afterwards. See **Continue threads after restarts**
 below.
 
+## Switch between Stable and Nightly
+
+In the desktop app, change **Settings → About → Update track**. T3 Code shows each
+connected machine it will move and each one it skips, then moves them in one
+step. Remote servers install the latest release on the new track. Remote desktop
+apps reinstall on the new track. This app reinstalls last. Your threads,
+settings, and data stay.
+
+A background service cannot move to an older release remotely. When Stable is
+older than its Nightly, run `t3 update --channel stable --allow-downgrade` on
+that machine.
+
+A switch is blocked for a machine whose database already has changes the
+target release does not support, or when T3 Code cannot confirm that it does.
+The dialog says why: update a machine on its current track first when its
+release is too old to check, or wait until the target track includes the
+changes. A Mac running the desktop app must switch on that Mac.
+
+Each machine keeps the new track even if its switch did not finish, but it
+moves to that track only through a switch. **Update track** shows how many
+machines still run the other track. **Review** opens the same dialog with fresh
+checks.
+
 ## Before you update
 
 Server updates restart the connection and can interrupt active agents and
diff --git a/packages/client-runtime/src/state/server.ts b/packages/client-runtime/src/state/server.ts
index c8ce8b3878744..dadaf2dafb7a5 100644
--- a/packages/client-runtime/src/state/server.ts
+++ b/packages/client-runtime/src/state/server.ts
@@ -969,6 +969,17 @@ export function createServerEnvironmentAtoms<R, E>(
           }),
         );
 
+        // A track switch's desktop host already on its track's newest build only saved the
+        // track; nothing restarts.
+        if (
+          result.method === "desktop-app" &&
+          result.desktopUpdateToken === undefined &&
+          result.targetVersion === fromVersion
+        ) {
+          atomRegistry.set(stateAtom, IDLE_SERVER_UPDATE_STATE);
+          return result;
+        }
+
         yield* nudgeReconnectDuringUpdateRestart({
           stateChanges: environmentRegistry.stateChanges(target.environmentId),
           retryNow: environmentRegistry.retryNow(target.environmentId),
diff --git a/packages/contracts/src/environment.ts b/packages/contracts/src/environment.ts
index fbbffeddc924d..75a546bed875f 100644
--- a/packages/contracts/src/environment.ts
+++ b/packages/contracts/src/environment.ts
@@ -133,6 +133,8 @@ export const ExecutionEnvironmentCapabilities = Schema.Struct({
   ignoredFileListing: Schema.optionalKey(Schema.Boolean),
   environmentIcon: Schema.optionalKey(Schema.Boolean),
   desktopAppUpdate: Schema.optionalKey(Schema.Boolean),
+  /** The desktop app switches update tracks when a server update request names one. */
+  desktopAppChannelSwitch: Schema.optionalKey(Schema.Boolean),
   /** Subscribe to command output only when advertised; older servers never send it. */
   commandOutputStreaming: Schema.optionalKey(Schema.Boolean),
   /** Hosts headless Chromium tabs streamed over /api/preview-stream for clients without a local runtime. */
@@ -160,6 +162,8 @@ export const ExecutionEnvironmentDescriptor = Schema.Struct({
   platform: ExecutionEnvironmentPlatform,
   serverVersion: TrimmedNonEmptyString,
   orchestrationProtocolVersion: Schema.optionalKey(Schema.Int),
+  /** Highest migration this server's database holds; absent on older servers. */
+  databaseMigration: Schema.optionalKey(Schema.Int),
   capabilities: ExecutionEnvironmentCapabilities,
 });
 export type ExecutionEnvironmentDescriptor = typeof ExecutionEnvironmentDescriptor.Type;
diff --git a/packages/contracts/src/ipc.ts b/packages/contracts/src/ipc.ts
index 89fc70f2b725a..8d848a86b22cf 100644
--- a/packages/contracts/src/ipc.ts
+++ b/packages/contracts/src/ipc.ts
@@ -1096,10 +1096,15 @@ export interface DesktopBridge {
   onWindowFullscreenStateChange: (listener: (fullscreen: boolean) => void) => () => void;
   getWindowZoomFactor: () => number;
   getUpdateState: () => Promise<DesktopUpdateState>;
-  setUpdateChannel: (channel: DesktopUpdateChannel) => Promise<DesktopUpdateState>;
+  /** `minimumVersion` is a track switch's checked release; nothing older is offered after. */
+  setUpdateChannel: (
+    channel: DesktopUpdateChannel,
+    minimumVersion?: string,
+  ) => Promise<DesktopUpdateState>;
   checkForUpdate: () => Promise<DesktopUpdateCheckResult>;
   downloadUpdate: () => Promise<DesktopUpdateActionResult>;
-  installUpdate: () => Promise<DesktopUpdateActionResult>;
+  /** With a version, installs only that downloaded build. */
+  installUpdate: (expectedVersion?: string) => Promise<DesktopUpdateActionResult>;
   onUpdateState: (listener: (state: DesktopUpdateState) => void) => () => void;
   cliCommand: {
     getState: () => Promise<DesktopCliCommandState>;
diff --git a/packages/contracts/src/resourceTelemetry.ts b/packages/contracts/src/resourceTelemetry.ts
index bce626b0c3668..5a004f93a2a4c 100644
--- a/packages/contracts/src/resourceTelemetry.ts
+++ b/packages/contracts/src/resourceTelemetry.ts
@@ -2,7 +2,7 @@ import * as Schema from "effect/Schema";
 
 import { NonNegativeInt, PositiveInt, TrimmedNonEmptyString } from "./baseSchemas.ts";
 import { HostPowerSnapshot } from "./background.ts";
-import { DesktopUpdateStateSchema } from "./ipc.ts";
+import { DesktopUpdateChannelSchema, DesktopUpdateStateSchema } from "./ipc.ts";
 
 export const RESOURCE_MONITOR_PROTOCOL_VERSION = 3 as const;
 
@@ -323,6 +323,9 @@ export const DesktopTelemetryRequestDesktopUpdate = Schema.Struct({
   version: Schema.Literal(1),
   type: Schema.Literal("requestDesktopUpdate"),
   requestId: TrimmedNonEmptyString,
+  /** A track switch: move to this channel first, and install only `targetVersion`. */
+  channel: Schema.optionalKey(DesktopUpdateChannelSchema),
+  targetVersion: Schema.optionalKey(TrimmedNonEmptyString),
 });
 export type DesktopTelemetryRequestDesktopUpdate = typeof DesktopTelemetryRequestDesktopUpdate.Type;
 
diff --git a/packages/contracts/src/server.ts b/packages/contracts/src/server.ts
index 134d8160642fc..92dc88be173a8 100644
--- a/packages/contracts/src/server.ts
+++ b/packages/contracts/src/server.ts
@@ -28,6 +28,7 @@ import { RuntimeMode } from "./providerPolicy.ts";
 import { ProviderDriverKind, ProviderInstanceId } from "./providerInstance.ts";
 import { ServerProviderUsageLimits, UsageLimitSourceSnapshots } from "./providerUsageLimits.ts";
 import { ServerSettings } from "./settings.ts";
+import { DesktopUpdateChannelSchema } from "./ipc.ts";
 
 const KeybindingsMalformedConfigIssue = Schema.Struct({
   kind: Schema.Literal("keybindings.malformed-config"),
@@ -879,6 +880,10 @@ export class ServerProviderUpdateError extends Schema.TaggedError<ServerProvider
 export const ServerSelfUpdateInput = Schema.Struct({
   /** Exact npm version, never a dist-tag, so server and client agree on the request. */
   targetVersion: TrimmedNonEmptyString,
+  /** Desktop-managed hosts move their app to this update track first. Sent only for a track switch. */
+  channel: Schema.optionalKey(DesktopUpdateChannelSchema),
+  /** The target release's highest migration; the host refuses to leave Nightly without it. */
+  targetDatabaseMigration: Schema.optionalKey(Schema.Int),
 });
 export type ServerSelfUpdateInput = typeof ServerSelfUpdateInput.Type;
 
diff --git a/packages/shared/src/cliRelease.ts b/packages/shared/src/cliRelease.ts
index 94bd3cffa168c..66777cc044478 100644
--- a/packages/shared/src/cliRelease.ts
+++ b/packages/shared/src/cliRelease.ts
@@ -1,3 +1,8 @@
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+
+import { compareSemverVersions } from "./semver.ts";
+
 const CLI_RELEASE_REPOSITORY = "pingdotgg/t3code";
 export const CLI_RELEASES_PAGE_URL = `https://github.com/${CLI_RELEASE_REPOSITORY}/releases`;
 export const CLI_RELEASE_CHECKSUMS_FILE = "SHA256SUMS";
@@ -68,6 +73,32 @@ export function cliReleaseChannelOf(version: string): CliReleaseChannel {
   return channel === "nightly" || channel === "preview" ? channel : "stable";
 }
 
+/** Whether updating between these versions crosses Stable and Nightly. Preview builds cross nothing.
+ * Hosts refuse a crossing outside a track switch, which checks the database first. */
+export function crossesReleaseTrack(fromVersion: string, toVersion: string): boolean {
+  const from = cliReleaseChannelOf(fromVersion);
+  const to = cliReleaseChannelOf(toVersion);
+  return from !== to && from !== "preview" && to !== "preview";
+}
+
+/** The desktop update track a build belongs to. Preview builds have no feed and read as Stable. */
+export function desktopUpdateChannelOf(version: string): "latest" | "nightly" {
+  return cliReleaseChannelOf(version) === "nightly" ? "nightly" : "latest";
+}
+
+/** Whether a track switch may install `found` after its database check cleared `checked`: any build
+ * on the switch's track at least as new, since later releases only add migrations. */
+export function acceptsTrackSwitchRelease(
+  found: string,
+  channel: "latest" | "nightly",
+  checked: string,
+): boolean {
+  return (
+    cliReleaseChannelOf(found) === (channel === "nightly" ? "nightly" : "stable") &&
+    compareSemverVersions(found, checked) >= 0
+  );
+}
+
 /** Page until the channel matches; nightlies can push preview/stable releases past the first page. */
 export function cliReleaseIndexPageUrl(page: number): string {
   return `https://api.github.com/repos/${CLI_RELEASE_REPOSITORY}/releases?per_page=100&page=${page}`;
@@ -89,3 +120,14 @@ export function newestCliReleaseVersion(
   }
   return undefined;
 }
+
+const NpmReleaseMigrationManifest = Schema.Struct({
+  t3code: Schema.Struct({ databaseMigration: Schema.Int }),
+});
+const decodeNpmReleaseMigrationManifest = Schema.decodeUnknownOption(NpmReleaseMigrationManifest);
+
+/** Highest database migration a release's server knows, from its npm `t3` manifest. */
+export function npmReleaseDatabaseMigration(manifest: unknown): number | undefined {
+  return Option.getOrUndefined(decodeNpmReleaseMigrationManifest(manifest))?.t3code
+    .databaseMigration;
+}
diff --git a/scripts/build-npm-launcher.test.ts b/scripts/build-npm-launcher.test.ts
index 8dd98225cd073..749e27bd5454a 100644
--- a/scripts/build-npm-launcher.test.ts
+++ b/scripts/build-npm-launcher.test.ts
@@ -13,6 +13,8 @@ import * as NodeCrypto from "node:crypto";
 import * as NodeEvents from "node:events";
 import * as NodeHttp from "node:http";
 
+import { npmReleaseDatabaseMigration } from "@t3tools/shared/cliRelease";
+
 import { buildNpmLauncher } from "./build-npm-launcher.ts";
 
 const VERSION = "1.2.3";
@@ -118,6 +120,7 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
         assert.deepStrictEqual(manifest.bin, { t3: "./bin/t3.mjs" });
         assert.isUndefined(manifest.dependencies);
         assert.isUndefined(manifest.optionalDependencies);
+        assert.isAbove(npmReleaseDatabaseMigration(manifest) ?? 0, 0);
 
         const installed = path.join(root, "installed");
         yield* fs.makeDirectory(installed);
diff --git a/scripts/build-npm-launcher.ts b/scripts/build-npm-launcher.ts
index df1cc488814aa..bae124fb008a5 100644
--- a/scripts/build-npm-launcher.ts
+++ b/scripts/build-npm-launcher.ts
@@ -30,8 +30,8 @@ export class NpmLauncherCommandFailedError extends Schema.TaggedError<NpmLaunche
   }
 }
 
-/** engines requires import.meta.dirname and fetch. */
-export function npmLauncherPackageManifest(version: string) {
+/** engines requires import.meta.dirname and fetch. `t3code` is read back by npmReleaseDatabaseMigration. */
+export function npmLauncherPackageManifest(version: string, databaseMigration: number) {
   return {
     name: NPM_LAUNCHER_PACKAGE_NAME,
     version,
@@ -42,9 +42,24 @@ export function npmLauncherPackageManifest(version: string) {
     bin: { t3: "./bin/t3.mjs" },
     files: ["bin", "dist"],
     engines: { node: ">=20.11" },
+    t3code: { databaseMigration },
   };
 }
 
+/** Highest server migration id, from the `NNN_Name.ts` files the server registers. */
+const latestServerMigrationId = Effect.fn("latestServerMigrationId")(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dir = yield* path.fromFileUrl(
+    new URL("../apps/server/src/persistence/Migrations/", import.meta.url),
+  );
+  const ids = (yield* fs.readDirectory(dir)).flatMap((name) => {
+    const id = /^(\d+)_\w+\.ts$/.exec(name)?.[1];
+    return id === undefined ? [] : [Number(id)];
+  });
+  return Math.max(0, ...ids);
+});
+
 export const buildNpmLauncher = Effect.fn("buildNpmLauncher")(function* (input: {
   readonly version: string;
   readonly outputDir: string;
@@ -64,7 +79,9 @@ export const buildNpmLauncher = Effect.fn("buildNpmLauncher")(function* (input:
   yield* fs.makeDirectory(path.join(stageDir, "dist"));
   yield* fs.writeFileString(
     path.join(stageDir, "package.json"),
-    `${yield* encodePackageJson(npmLauncherPackageManifest(input.version))}\n`,
+    `${yield* encodePackageJson(
+      npmLauncherPackageManifest(input.version, yield* latestServerMigrationId()),
+    )}\n`,
   );
   yield* fs.copyFile(path.join(sourceDir, "t3.mjs"), path.join(stageDir, "bin/t3.mjs"));
   yield* fs.chmod(path.join(stageDir, "bin/t3.mjs"), 0o755);

From c1876b57c9258cc9a5b1a429d76e3f169bfcd9a5 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 04:06:13 -0700
Subject: [PATCH 004/146] fix(antigravity): file reads no longer show unrelated
 errors (#26910)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/AntigravityAdapterV2.test.ts     | 199 ++++++++++++++++++
 .../Adapters/AntigravityAdapterV2.ts          |  17 +-
 .../provider/acp/AntigravityProtocol.test.ts  |  79 +++++++
 .../src/provider/acp/AntigravityProtocol.ts   |  65 ++++++
 4 files changed, 359 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
index f69e3696fc45c..5cf359451ef29 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
@@ -707,3 +707,202 @@ describe("AntigravityAdapterV2 html_render pages", () => {
     }).pipe(Effect.provide(layerSession), Effect.scoped),
   );
 });
+
+describe("AntigravityAdapterV2 subagent reads", () => {
+  it.effect("completes a read T3 served when the agent later fails it with a step error", () =>
+    Effect.gen(function* () {
+      const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const crypto = yield* Crypto.Crypto;
+      const mockAgentPath = yield* path.fromFileUrl(
+        new URL("../../../scripts/acp-mock-agent.ts", import.meta.url),
+      );
+      const workspace = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-antigravity-reads-",
+      });
+      const outside = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-antigravity-reads-outside-",
+      });
+      const served = path.join(workspace, "served.ts");
+      yield* fileSystem.writeFileString(served, "export {};");
+      const denied = path.join(outside, "secret.txt");
+      yield* fileSystem.writeFileString(denied, "secret");
+      const unseen = path.join(workspace, "unseen.ts");
+      const retried = path.join(workspace, "retried.ts");
+      const stepError = 'Model produced invalid output. ("model output error")';
+      type RuntimeService = AcpSessionRuntime.AcpSessionRuntime["Service"];
+      let sessionUpdate: Parameters<RuntimeService["handleSessionUpdate"]>[0] | undefined;
+      let readTextFile: Parameters<RuntimeService["handleReadTextFile"]>[0] | undefined;
+      const instanceId = ProviderInstanceId.make("antigravity-subagent-reads-test");
+      const threadId = ThreadId.make("thread-antigravity-subagent-reads");
+      const adapter = yield* makeAntigravityAdapterV2({
+        instanceId,
+        selfInvocation: yield* resolveSelfInvocation(),
+        makeRuntime: (input) =>
+          makeAntigravityAcpRuntime({
+            ...input,
+            childProcessSpawner,
+            spawn: {
+              command: process.execPath,
+              args: [mockAgentPath],
+              cwd: input.cwd,
+              env: { T3_ACP_ANTIGRAVITY: "1" },
+            },
+          }).pipe(
+            Effect.provideService(Crypto.Crypto, crypto),
+            Effect.map((runtime): RuntimeService => ({
+              ...runtime,
+              handleSessionUpdate: (handler) =>
+                Effect.sync(() => {
+                  sessionUpdate = handler;
+                }).pipe(Effect.andThen(runtime.handleSessionUpdate(handler))),
+              handleReadTextFile: (handler) =>
+                Effect.sync(() => {
+                  readTextFile = handler;
+                }).pipe(Effect.andThen(runtime.handleReadTextFile(handler))),
+              // agy_acp_server announces a subagent's client_view_file on the parent session,
+              // never completes it, then fails every open call with the next step error.
+              prompt: () =>
+                Effect.gen(function* () {
+                  if (sessionUpdate === undefined || readTextFile === undefined) {
+                    return yield* Effect.die("the adapter must handle updates and reads");
+                  }
+                  const send = sessionUpdate;
+                  const handleRead = readTextFile;
+                  const update = (update: EffectAcpSchema.SessionUpdate) =>
+                    send(
+                      normalizeAntigravitySessionUpdate({ sessionId: "mock-session-1", update }),
+                    );
+                  // The agent's own view_file never reaches T3, so it must not take a served read.
+                  const reads = [
+                    ["call_native", served, "Running view_file"],
+                    ["call_served", served, "Running client_view_file"],
+                    ["call_missing", retried, "Running client_view_file"],
+                    ["call_retried", retried, "Running client_view_file"],
+                    ["call_denied", denied, "Running client_view_file"],
+                    ["call_unseen", unseen, "Running client_view_file"],
+                  ] as const;
+                  for (const [toolCallId, target, title] of reads) {
+                    yield* update({
+                      sessionUpdate: "tool_call",
+                      toolCallId,
+                      title,
+                      kind: "read",
+                      status: "in_progress",
+                      rawInput: { absolute_path: target },
+                      locations: [{ path: target }],
+                    });
+                  }
+                  const serve = (target: string) =>
+                    handleRead(
+                      { sessionId: "subagent-conversation", path: target },
+                      { requestId: `read-${target}`, method: "fs/read_text_file" },
+                    ).pipe(Effect.exit);
+                  yield* serve(served);
+                  yield* serve(retried);
+                  yield* fileSystem.writeFileString(retried, "export {};").pipe(Effect.orDie);
+                  yield* serve(retried);
+                  yield* serve(denied);
+                  for (const [toolCallId] of reads) {
+                    yield* update({
+                      sessionUpdate: "tool_call_update",
+                      toolCallId,
+                      status: "failed",
+                      rawOutput: stepError,
+                    });
+                  }
+                  return { stopReason: "end_turn" as const };
+                }),
+            })),
+          ),
+        withProcess: (_stop, task) => task,
+        // @effect-diagnostics-next-line effectSucceedWithVoid:off - This optional result requires undefined, not the wider void type.
+        defaultModel: Effect.succeed(undefined),
+      });
+      const runtimePolicy = ProviderAdapter.ProviderAdapterV2RuntimePolicy.make({
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        cwd: workspace,
+      });
+      const modelSelection = { instanceId, model: "gemini-test-low" } as const;
+      const session = yield* adapter.openSession({
+        threadId,
+        providerSessionId: ProviderSessionId.make("provider-session-antigravity-subagent-reads"),
+        modelSelection,
+        runtimePolicy,
+      });
+      const providerThread = yield* session.ensureThread({
+        threadId,
+        modelSelection,
+        runtimePolicy,
+      });
+      const now = yield* DateTime.now;
+      yield* session.startTurn({
+        appThread: {
+          createdBy: "user",
+          creationSource: "web",
+          id: threadId,
+          projectId: ProjectId.make("project-antigravity-subagent-reads"),
+          title: "Antigravity subagent reads",
+          providerInstanceId: instanceId,
+          modelSelection,
+          runtimeMode: "full-access",
+          interactionMode: "default",
+          branch: null,
+          worktreePath: workspace,
+          activeProviderThreadId: providerThread.id,
+          lineage: { parentThreadId: null, relationshipToParent: null, rootThreadId: threadId },
+          forkedFrom: null,
+          createdAt: now,
+          updatedAt: now,
+          archivedAt: null,
+          settledOverride: null,
+          settledAt: null,
+          lastVisitedAt: null,
+          deletedAt: null,
+        },
+        threadId,
+        runId: RunId.make("run-antigravity-subagent-reads"),
+        runOrdinal: 1,
+        providerTurnOrdinal: 1,
+        attemptId: RunAttemptId.make("attempt-antigravity-subagent-reads"),
+        rootNodeId: NodeId.make("node-antigravity-subagent-reads"),
+        providerThread,
+        message: {
+          createdBy: "user",
+          creationSource: "web",
+          messageId: MessageId.make("message-antigravity-subagent-reads"),
+          text: "review the codebase",
+          attachments: [],
+        },
+        modelSelection,
+        runtimePolicy,
+      });
+      const events = Array.from(
+        yield* session.events.pipe(
+          Stream.takeUntil((event) => event.type === "turn.terminal"),
+          Stream.runCollect,
+        ),
+      );
+      const read = (nativeId: string) => {
+        const event = events.findLast(
+          (event) =>
+            event.type === "turn_item.updated" &&
+            event.turnItem.nativeItemRef?.nativeId === nativeId,
+        );
+        return event?.type === "turn_item.updated" && event.turnItem.type === "dynamic_tool"
+          ? { status: event.turnItem.status, output: event.turnItem.output }
+          : undefined;
+      };
+
+      const failed = { status: "failed" as const, output: stepError };
+      assert.deepEqual(read("call_served"), { status: "completed", output: undefined });
+      assert.deepEqual(read("call_retried"), { status: "completed", output: undefined });
+      assert.deepEqual(read("call_native"), failed);
+      assert.deepEqual(read("call_missing"), failed);
+      assert.deepEqual(read("call_denied"), failed);
+      assert.deepEqual(read("call_unseen"), failed);
+    }).pipe(Effect.provide(layerSession), Effect.scoped),
+  );
+});
diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
index 36c58a29ecaee..fbdd5748adcfc 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
@@ -29,6 +29,7 @@ import {
   antigravitySubagentOutput,
   classifyAntigravitySubagentToolCall,
   extractAntigravityUserInputQuestion,
+  makeAntigravityReadRepair,
   makeAntigravityUserInputResponse,
   normalizeAntigravityToolCall,
 } from "../../provider/acp/AntigravityProtocol.ts";
@@ -128,8 +129,22 @@ export function makeAntigravityAcpAdapterFlavor(
           }),
         )
         .pipe(Effect.provideService(Scope.Scope, scope));
+      // Repair keeps state across updates, so each runtime must have one session-update handler.
+      const reads = makeAntigravityReadRepair();
       return {
         ...runtime,
+        handleReadTextFile: (handler) =>
+          runtime.handleReadTextFile((request, context) =>
+            handler(request, context).pipe(
+              Effect.onExit((exit) =>
+                Effect.sync(() => reads.attempted(request.path, Exit.isSuccess(exit))),
+              ),
+            ),
+          ),
+        prompt: (payload, promptOptions) =>
+          Effect.sync(reads.reset).pipe(Effect.andThen(runtime.prompt(payload, promptOptions))),
+        handleSessionUpdate: (handler) =>
+          runtime.handleSessionUpdate((notification) => handler(reads.repair(notification))),
         start: () =>
           runtime
             .start()
@@ -138,7 +153,7 @@ export function makeAntigravityAcpAdapterFlavor(
                 (started) => options.onSessionStarted?.(started, input.cwd) ?? Effect.void,
               ),
             ),
-      };
+      } satisfies typeof runtime;
     },
     Effect.provideService(Crypto.Crypto, options.crypto),
     Effect.mapError((cause): EffectAcpErrors.AcpError =>
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.test.ts b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
index 66c83e0c48249..0c7937a28ee45 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.test.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
@@ -13,6 +13,7 @@ import {
   normalizeAntigravitySessionUpdate,
   normalizeAntigravityToolCall,
   sanitizeAntigravityToolPayload,
+  makeAntigravityReadRepair,
 } from "./AntigravityProtocol.ts";
 import {
   mergeToolCallState,
@@ -413,3 +414,81 @@ describe("Antigravity tool results", () => {
     expect(serialized).not.toContain("inline-data-url");
   });
 });
+
+describe("Antigravity served reads", () => {
+  const flush = (reads: ReturnType<typeof makeAntigravityReadRepair>, toolCallId: string) =>
+    reads.repair({
+      sessionId: "session-1",
+      update: {
+        sessionUpdate: "tool_call_update",
+        toolCallId,
+        status: "failed",
+        rawOutput: "Tool execution failed",
+      },
+    }).update;
+
+  it("credits a read T3 served before the agent announced it", () => {
+    const reads = makeAntigravityReadRepair();
+    reads.attempted("/repo/a.ts", true);
+    reads.repair({
+      sessionId: "session-1",
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "call_late",
+        title: "Running client_view_file",
+        kind: "read",
+        status: "in_progress",
+        locations: [{ path: "/repo/a.ts" }],
+      },
+    });
+    expect(flush(reads, "call_late")).toEqual({
+      sessionUpdate: "tool_call_update",
+      toolCallId: "call_late",
+      status: "completed",
+    });
+  });
+
+  it("forgets an earlier turn's unannounced served read", () => {
+    const reads = makeAntigravityReadRepair();
+    reads.attempted("/repo/a.ts", true);
+    reads.reset();
+    reads.repair({
+      sessionId: "session-1",
+      update: {
+        sessionUpdate: "tool_call",
+        toolCallId: "call_refused",
+        title: "Running client_view_file",
+        kind: "read",
+        status: "in_progress",
+        locations: [{ path: "/repo/a.ts" }],
+      },
+    });
+    reads.attempted("/repo/a.ts", false);
+    expect(flush(reads, "call_refused")).toMatchObject({ status: "failed" });
+  });
+
+  it("drops an earlier turn's unanswered read so a new turn's served read gets the credit", () => {
+    const reads = makeAntigravityReadRepair();
+    const announce = (toolCallId: string) =>
+      reads.repair({
+        sessionId: "session-1",
+        update: {
+          sessionUpdate: "tool_call",
+          toolCallId,
+          title: "Running client_view_file",
+          kind: "read",
+          status: "in_progress",
+          locations: [{ path: "/repo/a.ts" }],
+        },
+      });
+    announce("call_abandoned");
+    reads.reset();
+    announce("call_current");
+    reads.attempted("/repo/a.ts", true);
+    expect(flush(reads, "call_current")).toEqual({
+      sessionUpdate: "tool_call_update",
+      toolCallId: "call_current",
+      status: "completed",
+    });
+  });
+});
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.ts b/apps/server/src/provider/acp/AntigravityProtocol.ts
index ac65db6373add..1eeb0cdac31dd 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.ts
@@ -216,6 +216,71 @@ export function sanitizeAntigravityToolPayload(payload: unknown): unknown {
 }
 const isJsonRecord = Schema.is(Schema.Record(Schema.String, Schema.Json));
 
+const ANTIGRAVITY_CLIENT_READ_TITLES = new Set([
+  "Running client_view_file",
+  "Run client_view_file?",
+]);
+
+function antigravityClientReadPath(update: {
+  readonly title?: string | null;
+  readonly locations?: ReadonlyArray<{ readonly path: string }> | null;
+  readonly rawInput?: unknown;
+}): string | undefined {
+  if (!update.title || !ANTIGRAVITY_CLIENT_READ_TITLES.has(update.title)) return undefined;
+  const target =
+    update.locations?.[0]?.path ??
+    (Predicate.isObject(update.rawInput) ? update.rawInput.absolute_path : undefined);
+  return typeof target === "string" && target ? target : undefined;
+}
+
+/**
+ * The agent never completes a subagent's `client_view_file` call, then fails every open call
+ * with the next unrelated step error. Report reads T3 served as completed instead.
+ */
+export function makeAntigravityReadRepair() {
+  type Outcome = "served" | "refused";
+  const openReads = new Map<string, { readonly path: string; outcome?: Outcome }>();
+  // The agent runs a client tool in a background task, so its request can precede the announcement.
+  const earlyOutcomes: Array<{ readonly path: string; readonly outcome: Outcome }> = [];
+  return {
+    /** Earlier turns' rows are already settled, and their unanswered reads must not take credit. */
+    reset: () => {
+      openReads.clear();
+      earlyOutcomes.length = 0;
+    },
+    /** Each `fs/read_text_file` request answers the oldest open read of its path, in order. */
+    attempted: (path: string, served: boolean) => {
+      const outcome = served ? "served" : "refused";
+      for (const read of openReads.values()) {
+        if (read.path !== path || read.outcome !== undefined) continue;
+        read.outcome = outcome;
+        return;
+      }
+      earlyOutcomes.push({ path, outcome });
+    },
+    repair: (
+      notification: EffectAcpSchema.SessionNotification,
+    ): EffectAcpSchema.SessionNotification => {
+      const update = notification.update;
+      if (update.sessionUpdate !== "tool_call" && update.sessionUpdate !== "tool_call_update") {
+        return notification;
+      }
+      const path = antigravityClientReadPath(update);
+      if (path !== undefined && !openReads.has(update.toolCallId)) {
+        const early = earlyOutcomes.findIndex((entry) => entry.path === path);
+        const outcome = early === -1 ? undefined : earlyOutcomes.splice(early, 1)[0]?.outcome;
+        openReads.set(update.toolCallId, outcome === undefined ? { path } : { path, outcome });
+      }
+      if (update.status !== "completed" && update.status !== "failed") return notification;
+      const read = openReads.get(update.toolCallId);
+      openReads.delete(update.toolCallId);
+      if (update.status === "completed" || read?.outcome !== "served") return notification;
+      const { rawOutput: _stepError, ...rest } = update;
+      return { ...notification, update: { ...rest, status: "completed" } };
+    },
+  };
+}
+
 export function normalizeAntigravitySessionUpdate(
   notification: EffectAcpSchema.SessionNotification,
 ): EffectAcpSchema.SessionNotification {

From b5fc7bedfe5c84d523273fc8269010e416e9cb6c Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 04:26:46 -0700
Subject: [PATCH 005/146] feat(release): release notes and the update popover
 open with a short note (#26893)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml                 |  30 +-
 apps/desktop/src/updates/DesktopUpdates.ts    |   2 +
 apps/desktop/src/updates/releaseNotes.test.ts |  61 +++
 apps/desktop/src/updates/releaseNotes.ts      |  51 ++-
 .../SidebarUpdatePill.browser.test.tsx        |   2 +-
 .../components/sidebar/SidebarUpdatePill.tsx  |   4 +-
 .../sidebar/SidebarUpdateReleaseNotes.tsx     |  64 ++-
 docs/operations/release.md                    |   1 +
 packages/contracts/src/ipc.ts                 |   9 +
 scripts/generate-release-notes.test.ts        |  65 +++
 scripts/generate-release-notes.ts             | 370 ++++++++++++++++++
 scripts/notify-discord-release.test.ts        |   9 +
 scripts/notify-discord-release.ts             |  14 +-
 13 files changed, 662 insertions(+), 20 deletions(-)
 create mode 100644 scripts/generate-release-notes.test.ts
 create mode 100644 scripts/generate-release-notes.ts

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e8f300242f054..e9c731cf6fa06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -762,11 +762,16 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: write
+      # Release notes read PR bodies and authors.
+      pull-requests: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
+          # Release notes need history back to the previous tag, not file contents.
+          fetch-depth: 0
+          filter: blob:none
           sparse-checkout: |
             /*
             !/.repos/
@@ -892,6 +897,27 @@ jobs:
             echo 'EOF'
           } >> "$GITHUB_OUTPUT"
 
+      # A short model summary over GitHub's full list. Without a notes file, the
+      # release falls back to GitHub's generated notes.
+      - name: Write release notes
+        if: needs.preflight.outputs.release_channel != 'preview' && needs.preflight.outputs.previous_tag != ''
+        continue-on-error: true
+        timeout-minutes: 5
+        env:
+          GH_TOKEN: ${{ github.token }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: |
+          node scripts/generate-release-notes.ts \
+            --repository "${{ github.repository }}" \
+            --tag "${{ needs.preflight.outputs.tag }}" \
+            --ref "${{ needs.preflight.outputs.ref }}" \
+            --previous-tag "${{ needs.preflight.outputs.previous_tag }}" \
+            --version "${{ needs.preflight.outputs.version }}" \
+            --output release-notes.md
+          if [[ -f release-notes.md ]]; then
+            cat release-notes.md >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       # A preview release gets a warning instead of generated notes. Generated
       # notes would list every commit since the previous preview, which is
       # unmerged branch history no one should read as a changelog, and would
@@ -917,8 +943,8 @@ jobs:
           tag_name: ${{ needs.preflight.outputs.tag }}
           target_commitish: ${{ needs.preflight.outputs.ref }}
           name: ${{ needs.preflight.outputs.release_name }}
-          generate_release_notes: ${{ needs.preflight.outputs.release_channel != 'preview' }}
-          body_path: ${{ needs.preflight.outputs.release_channel == 'preview' && 'release-notes.md' || '' }}
+          generate_release_notes: ${{ hashFiles('release-notes.md') == '' }}
+          body_path: ${{ hashFiles('release-notes.md') != '' && 'release-notes.md' || '' }}
           previous_tag: ${{ needs.preflight.outputs.previous_tag }}
           prerelease: ${{ needs.preflight.outputs.is_prerelease }}
           make_latest: ${{ needs.preflight.outputs.make_latest }}
diff --git a/apps/desktop/src/updates/DesktopUpdates.ts b/apps/desktop/src/updates/DesktopUpdates.ts
index 4da742f453aa6..3a0b41cd9e369 100644
--- a/apps/desktop/src/updates/DesktopUpdates.ts
+++ b/apps/desktop/src/updates/DesktopUpdates.ts
@@ -70,6 +70,7 @@ const UpdateInfo = Schema.Struct({
   version: Schema.String,
   // Malformed notes must not block update-state decoding; normalizeDesktopUpdateReleaseNotes validates separately.
   releaseNotes: Schema.optional(Schema.Unknown),
+  releaseDate: Schema.optional(Schema.String),
 });
 
 const DownloadProgressInfo = Schema.Struct({
@@ -895,6 +896,7 @@ export const make = Effect.gen(function* () {
             info.releaseNotes,
             info.version,
             state.channel,
+            info.releaseDate,
           );
           yield* setState(
             reduceDesktopUpdateStateOnUpdateAvailable(
diff --git a/apps/desktop/src/updates/releaseNotes.test.ts b/apps/desktop/src/updates/releaseNotes.test.ts
index 028e42fa6e3b7..d88838439dba7 100644
--- a/apps/desktop/src/updates/releaseNotes.test.ts
+++ b/apps/desktop/src/updates/releaseNotes.test.ts
@@ -28,6 +28,7 @@ describe("normalizeDesktopUpdateReleaseNotes", () => {
       releaseNotes: [
         {
           version: "0.0.36-nightly.20260828.1213",
+          releasedAt: "2026-08-28",
           items: [
             "fix(opencode): handle child approvals, stops, and model catalogs by @human in #8480",
             "fix(web): keep long task drawers usable on small screens by @human in #8313",
@@ -60,6 +61,37 @@ describe("normalizeDesktopUpdateReleaseNotes", () => {
     });
   });
 
+  it("reads a generated summary as a note and skips the folded full list", () => {
+    const fixes = Array.from({ length: 9 }, (_, index) => `- Fix ${index + 1} (#${index + 1})`);
+    const result = normalizeDesktopUpdateReleaseNotes(
+      [
+        "**v1.2.4** · 12 changes from 3 contributors",
+        "## Highlights",
+        "Link machines (beta).",
+        "## Fixes",
+        ...fixes,
+        "<details>",
+        "<summary>Full changelog</summary>",
+        "* fix: raw entry by @human in https://github.com/pingdotgg/t3code/pull/1",
+        "</details>",
+      ].join("\n"),
+      "1.2.4",
+      "latest",
+      "2026-10-29T10:00:00.000Z",
+    );
+
+    expect(result.releaseNotes).toEqual([
+      {
+        version: "1.2.4",
+        releasedAt: "2026-10-29T10:00:00.000Z",
+        stats: "12 changes from 3 contributors",
+        intro: "Link machines (beta).",
+        items: fixes.map((_, index) => `Fix ${index + 1}`),
+        totalItems: 10,
+      },
+    ]);
+  });
+
   it("does not count Markdown or HTML section headings as changes", () => {
     const changes = Array.from({ length: 8 }, (_, index) => `Change ${index + 1}`);
     const result = normalizeDesktopUpdateReleaseNotes(
@@ -80,6 +112,35 @@ describe("normalizeDesktopUpdateReleaseNotes", () => {
     ]);
   });
 
+  it("reads handwritten notes with their own <details> as a list", () => {
+    const result = normalizeDesktopUpdateReleaseNotes(
+      "- Older fix\n- Newer fix\n<details><summary>Logs</summary>\n- hidden\n</details>",
+      "1.2.3",
+      "latest",
+    );
+
+    expect(result.releaseNotes).toEqual([
+      { version: "1.2.3", items: ["hidden", "Logs", "Newer fix", "Older fix"], totalItems: 4 },
+    ]);
+  });
+
+  it("dates the offered release from the feed and older nightlies by their build day", () => {
+    const result = normalizeDesktopUpdateReleaseNotes(
+      [
+        { version: "0.0.41-nightly.20260914.1707", note: "- Nightly change 2" },
+        { version: "0.0.41-nightly.20260913.1700", note: "- Nightly change 1" },
+      ],
+      "0.0.41-nightly.20260914.1707",
+      "nightly",
+      "2026-09-14T18:30:00.000Z",
+    );
+
+    expect(result.releaseNotes.map(({ releasedAt }) => releasedAt)).toEqual([
+      "2026-09-14T18:30:00.000Z",
+      "2026-09-13",
+    ]);
+  });
+
   it("drops releases from other trains before grouping on nightly", () => {
     const releaseNotes = [
       { version: "0.0.41-preview.20260914.1683", note: "- Maintainer test build" },
diff --git a/apps/desktop/src/updates/releaseNotes.ts b/apps/desktop/src/updates/releaseNotes.ts
index 8698d8d499118..2704563cfc0b8 100644
--- a/apps/desktop/src/updates/releaseNotes.ts
+++ b/apps/desktop/src/updates/releaseNotes.ts
@@ -93,11 +93,46 @@ function isIgnoredReleaseNoteLine(line: string): boolean {
 interface ExtractedReleaseNoteItems {
   readonly items: ReadonlyArray<string>;
   readonly totalItems: number;
+  readonly intro?: string;
+  readonly stats?: string;
+}
+
+/**
+ * Reads a generated summary (`scripts/generate-release-notes.ts`): a `v1.2.3 · N changes…`
+ * header, a highlights paragraph, and fix bullets. PR numbers are left to the GitHub page.
+ */
+function extractReleaseNoteSummary(summary: string): ExtractedReleaseNoteItems {
+  let stats: string | undefined;
+  const intro: string[] = [];
+  const items: string[] = [];
+  for (const rawLine of stripMarkup(summary).split("\n")) {
+    const line = rawLine.trim().replace(/\s+/g, " ");
+    if (line === "" || /^#{1,6}\s+/.test(line)) continue;
+    if (stats === undefined && /^v\S+ · /.test(line)) {
+      stats = line.slice(line.indexOf(" · ") + 3);
+      continue;
+    }
+    const text = line
+      .replace(/^[-*]\s+/, "")
+      .replace(/\s*\((?:#\d+(?:,\s*)?)+\)\.?$/, "")
+      .trim();
+    if (/^[-*]\s+/.test(line)) items.push(text);
+    else intro.push(text);
+  }
+  return {
+    items,
+    totalItems: items.length + intro.length,
+    ...(intro.length > 0 ? { intro: intro.join(" ") } : {}),
+    ...(stats ? { stats } : {}),
+  };
 }
 
 function extractReleaseNoteItems(note: string | null | undefined): ExtractedReleaseNoteItems {
   if (!note) return { items: [], totalItems: 0 };
 
+  // Generated summaries fold GitHub's full list under this exact <details> block.
+  const summaryEnd = note.search(/<details>\s*<summary>\s*Full changelog\s*<\/summary>/i);
+  if (summaryEnd >= 0) return extractReleaseNoteSummary(note.slice(0, summaryEnd));
   const items: string[] = [];
   let totalItems = 0;
   for (const rawLine of stripMarkup(note).split("\n")) {
@@ -117,6 +152,15 @@ function extractReleaseNoteItems(note: string | null | undefined): ExtractedRele
   return { items: items.toReversed(), totalItems };
 }
 
+// The update feed dates only the offered version; prerelease versions carry their UTC build day.
+const PRERELEASE_BUILD_DAY = /-(?:nightly|preview)\.(\d{4})(\d{2})(\d{2})\.\d+$/;
+
+function resolveReleasedAt(version: string, offeredVersion: string, releaseDate?: string) {
+  if (version === offeredVersion && releaseDate) return releaseDate;
+  const day = PRERELEASE_BUILD_DAY.exec(version);
+  return day ? `${day[1]}-${day[2]}-${day[3]}` : undefined;
+}
+
 interface NormalizedDesktopUpdateReleaseNotes {
   readonly releaseNotes: ReadonlyArray<DesktopUpdateReleaseNote>;
   readonly omittedReleaseCount: number;
@@ -127,6 +171,7 @@ export function normalizeDesktopUpdateReleaseNotes(
   releaseNotes: unknown,
   fallbackVersion: string,
   channel: DesktopUpdateChannel,
+  releaseDate?: string,
 ): NormalizedDesktopUpdateReleaseNotes {
   const rawNotes = (
     typeof releaseNotes === "string"
@@ -137,13 +182,17 @@ export function normalizeDesktopUpdateReleaseNotes(
   ).filter((entry) => desktopUpdateChannelOf(entry.version) === channel);
 
   const normalizedNotes = rawNotes.flatMap((entry) => {
-    const { items, totalItems } = extractReleaseNoteItems(entry.note);
+    const { items, totalItems, intro, stats } = extractReleaseNoteItems(entry.note);
     if (totalItems === 0) return [];
+    const releasedAt = resolveReleasedAt(entry.version, fallbackVersion, releaseDate);
     return [
       {
         version: entry.version,
         items,
         totalItems,
+        ...(intro ? { intro } : {}),
+        ...(stats ? { stats } : {}),
+        ...(releasedAt ? { releasedAt } : {}),
       },
     ];
   });
diff --git a/apps/web/src/components/sidebar/SidebarUpdatePill.browser.test.tsx b/apps/web/src/components/sidebar/SidebarUpdatePill.browser.test.tsx
index 714d1564bac0a..18ebd70c6162c 100644
--- a/apps/web/src/components/sidebar/SidebarUpdatePill.browser.test.tsx
+++ b/apps/web/src/components/sidebar/SidebarUpdatePill.browser.test.tsx
@@ -81,7 +81,7 @@ function publish(update: DesktopUpdateState | null) {
   });
 }
 
-const releaseNotes = () => document.querySelector('[aria-label="Nightly update release notes"]');
+const releaseNotes = () => document.querySelector('[aria-label="Update release notes"]');
 
 describe("SidebarUpdatePill release notes", () => {
   it("closes when the release notes stop applying", async () => {
diff --git a/apps/web/src/components/sidebar/SidebarUpdatePill.tsx b/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
index d9f45cf92f934..7e0ee498cece5 100644
--- a/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
+++ b/apps/web/src/components/sidebar/SidebarUpdatePill.tsx
@@ -53,7 +53,7 @@ function shouldUseSidebarUpdateReleaseNotesPopover(
   showUpdateDetails: boolean,
   state: DesktopUpdateState | null,
 ): boolean {
-  return showUpdateDetails && state?.channel === "nightly" && state.releaseNotes.length > 0;
+  return showUpdateDetails && (state?.releaseNotes.length ?? 0) > 0;
 }
 
 function handleSidebarUpdateReleaseNotesPopoverOpenChange(
@@ -542,7 +542,7 @@ function SidebarUpdateControl() {
         {showReleaseNotesPopover && state ? (
           <PopoverPopup
             align="center"
-            aria-label="Nightly update release notes"
+            aria-label="Update release notes"
             initialFocus={false}
             onKeyDownCapture={(event) => {
               if (
diff --git a/apps/web/src/components/sidebar/SidebarUpdateReleaseNotes.tsx b/apps/web/src/components/sidebar/SidebarUpdateReleaseNotes.tsx
index b9f29741bfa63..974f81c8d76b3 100644
--- a/apps/web/src/components/sidebar/SidebarUpdateReleaseNotes.tsx
+++ b/apps/web/src/components/sidebar/SidebarUpdateReleaseNotes.tsx
@@ -5,8 +5,8 @@ import {
   getDesktopUpdateReleaseHistoryUrl,
   getDesktopUpdateReleaseUrl,
 } from "../desktopUpdate.logic";
+import { formatRelativeTimeLabel } from "../../timestampFormat";
 import { openDesktopUpdateReleaseNotes } from "../desktopUpdate.toast";
-import { Separator } from "../ui/separator";
 
 type DesktopUpdateShell = Pick<DesktopBridge, "openExternal">;
 
@@ -19,6 +19,18 @@ function keyReleaseNoteItems(items: ReadonlyArray<string>) {
   });
 }
 
+/** Feed times read "3h ago"; build days from a prerelease version read "today" or "2d ago". */
+function formatReleaseAge(releasedAt: string): string {
+  const day = /^(\d{4})-(\d{2})-(\d{2})$/.exec(releasedAt);
+  if (!day) return formatRelativeTimeLabel(releasedAt);
+  const now = new Date();
+  const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+  const days = Math.round(
+    (today - Date.UTC(Number(day[1]), Number(day[2]) - 1, Number(day[3]))) / 86_400_000,
+  );
+  return days <= 0 ? "today" : `${days}d ago`;
+}
+
 function ReleaseLink({
   children,
   releaseUrl,
@@ -30,7 +42,7 @@ function ReleaseLink({
 }) {
   return (
     <a
-      className="mt-2 inline-flex items-center gap-1 rounded-sm text-xs leading-5 text-muted-foreground underline decoration-dotted underline-offset-4 outline-none transition-colors hover:text-foreground focus-visible:text-foreground focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring"
+      className="mt-1 inline-flex items-center gap-1 rounded-sm text-xs leading-5 text-muted-foreground underline-offset-2 outline-none transition-colors hover:text-foreground hover:underline focus-visible:text-foreground focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring"
       href={releaseUrl}
       onClick={(event) => {
         event.preventDefault();
@@ -38,7 +50,7 @@ function ReleaseLink({
       }}
     >
       {children}
-      <ExternalLinkIcon aria-hidden className="size-3 shrink-0" strokeWidth={2.25} />
+      <ExternalLinkIcon aria-hidden className="size-3 shrink-0" strokeWidth={2} />
     </a>
   );
 }
@@ -52,12 +64,15 @@ export function SidebarUpdateReleaseNotes({
   readonly state: DesktopUpdateState;
   readonly tooltip: string;
 }) {
-  if (state.channel !== "nightly" || state.releaseNotes.length === 0) {
+  if (state.releaseNotes.length === 0) {
     return <>{tooltip}</>;
   }
+  const releasedAt = state.releaseNotes.find(
+    (releaseNote) => releaseNote.version === state.availableVersion,
+  )?.releasedAt;
 
   return (
-    <div className="flex max-h-[calc(var(--available-height)-0.5rem)] min-h-0 w-fit max-w-[min(24rem,calc(100vw-2rem))] flex-col text-left">
+    <div className="flex max-h-[calc(var(--available-height)-0.5rem)] min-h-0 w-fit max-w-[min(24rem,calc(100vw-2rem))] flex-col text-left text-pretty">
       <div className="shrink-0 px-1">
         {state.status === "available" ? (
           <div>
@@ -66,7 +81,9 @@ export function SidebarUpdateReleaseNotes({
             </div>
             {state.availableVersion ? (
               <div className="mt-0.5 text-xs leading-4 text-muted-foreground">
-                {state.availableVersion}
+                {releasedAt
+                  ? `${state.availableVersion} · ${formatReleaseAge(releasedAt)}`
+                  : state.availableVersion}
               </div>
             ) : null}
           </div>
@@ -74,18 +91,40 @@ export function SidebarUpdateReleaseNotes({
           <div className="text-sm leading-5 font-medium">{tooltip}</div>
         )}
       </div>
-      <div className="min-h-0 max-h-[min(28rem,calc(100vh-6rem))] overflow-y-auto px-1 pt-4 pb-1">
+      <div className="min-h-0 max-h-[min(28rem,calc(100vh-6rem))] overflow-y-auto px-1 pt-3 pb-1">
         {state.releaseNotes.map((releaseNote, index) => {
           const releaseUrl = getDesktopUpdateReleaseUrl(releaseNote.version);
           const omittedItemCount = Math.max(0, releaseNote.totalItems - releaseNote.items.length);
           const linkLabel =
-            omittedItemCount === 0
+            releaseNote.stats ??
+            (omittedItemCount === 0
               ? "View release on GitHub"
-              : `${omittedItemCount} more ${omittedItemCount === 1 ? "change" : "changes"} on GitHub`;
+              : `${omittedItemCount} more ${omittedItemCount === 1 ? "change" : "changes"} on GitHub`);
+
+          if (releaseNote.intro !== undefined) {
+            return (
+              <section className={index > 0 ? "mt-4" : undefined} key={releaseNote.version}>
+                {releaseNote.version !== state.availableVersion ? (
+                  <h3 className="mb-1 text-xs leading-4 font-medium text-muted-foreground">
+                    {releaseNote.releasedAt
+                      ? `${releaseNote.version} · ${formatReleaseAge(releaseNote.releasedAt)}`
+                      : releaseNote.version}
+                  </h3>
+                ) : null}
+                <p className="break-words text-xs leading-5 text-popover-foreground">
+                  {releaseNote.intro}
+                </p>
+                {releaseUrl ? (
+                  <ReleaseLink releaseUrl={releaseUrl} shell={shell}>
+                    {releaseNote.stats ?? "View release on GitHub"}
+                  </ReleaseLink>
+                ) : null}
+              </section>
+            );
+          }
 
           return (
-            <div key={releaseNote.version}>
-              {index > 0 && <Separator className="my-3" />}
+            <div className={index > 0 ? "mt-4" : undefined} key={releaseNote.version}>
               <section>
                 <h3 className="text-foreground text-xs leading-4 font-semibold">
                   {index === 0 ? "What's changed" : `Changes in ${releaseNote.version}`}
@@ -107,8 +146,7 @@ export function SidebarUpdateReleaseNotes({
           );
         })}
         {state.omittedReleaseCount > 0 ? (
-          <div>
-            <Separator className="my-3" />
+          <div className="mt-3">
             <ReleaseLink releaseUrl={getDesktopUpdateReleaseHistoryUrl()} shell={shell}>
               {`${state.omittedReleaseCount} older ${state.omittedReleaseCount === 1 ? "release" : "releases"} on GitHub`}
             </ReleaseLink>
diff --git a/docs/operations/release.md b/docs/operations/release.md
index 39f4f63ddd91b..89003a5e76126 100644
--- a/docs/operations/release.md
+++ b/docs/operations/release.md
@@ -42,6 +42,7 @@ the version.
   - Only plain stable `X.Y.Z` releases are marked as the repository's latest release.
   - Nightly runs are always GitHub prereleases and never marked latest.
   - Automatically generated release notes are pinned to the previous tag in the same channel, so stable compares to the previous stable tag and nightly compares to the previous nightly tag.
+  - The release job's **Write release notes** step (`scripts/generate-release-notes.ts`) builds the body: a computed header line, a short summary from `gpt-6.1-terra`, and GitHub's generated list folded under `<details>`. It needs the `OPENAI_API_KEY` secret. The summary leaves out commits whose scopes are all mobile; the header counts every commit. The desktop update popover, on every channel, shows the highlights paragraph and the header counts as a short note per release, with the offered release's age from the update feed's `releaseDate`. The nightly Discord post shows the part above `<details>`. If the step fails or there is nothing to summarize, it writes no file and the release uses GitHub's generated notes as before.
 - Includes Electron auto-update metadata (for example `latest*.yml`, `nightly*.yml`, and `*.blockmap`) in release assets.
 - Builds a self-contained CLI archive per platform (`t3-<version>-<platform>-<arch>.tar.gz`, `.zip` on Windows) in the same job as that target's desktop artifact and attaches them to the GitHub Release with a `SHA256SUMS` file, on every channel, for five targets: macOS arm64, Linux x64 and arm64, Windows x64 and arm64. Every archive is smoke-tested on hardware of its own architecture, and every one but the Windows archives is also built and signed there. There is no macOS x64 archive: Node single-executables are unsupported on x64 macOS (the SEA docs list macOS as arm64 only) and the binary segfaults on start; the x64 desktop app is Electron and unaffected.
   - The archive holds the server as a Node single-executable (`scripts/build-cli-archive.ts`), so unpacking it needs neither Node, npm, nor a compiler. It is the only form in which T3 Code manages a runtime: the desktop's SSH environments, the boot service, `t3 update`, and the install scripts all download and verify this archive against `SHA256SUMS`. The `t3` npm package exists for people who run `npx t3` or `npm install -g t3` themselves, and it downloads this same archive too; nothing in the product installs from npm. The `curl | sh` installers are `scripts/install.sh` and `scripts/install.ps1`; the marketing site copies them into its `public/` at build time (`apps/marketing/scripts/stage-install-scripts.mjs`) and serves them at `t3.codes/install.sh` and `/install.ps1`.
diff --git a/packages/contracts/src/ipc.ts b/packages/contracts/src/ipc.ts
index 8d848a86b22cf..f460619f11355 100644
--- a/packages/contracts/src/ipc.ts
+++ b/packages/contracts/src/ipc.ts
@@ -288,12 +288,21 @@ export interface DesktopUpdateReleaseNote {
   version: string;
   items: ReadonlyArray<string>;
   totalItems: number;
+  /** ISO time from the update feed for the offered version, else `YYYY-MM-DD` from a prerelease version. */
+  releasedAt?: string;
+  /** Generated summaries only: the highlights paragraph. `items` then holds the fixes. */
+  intro?: string;
+  /** Generated summaries only, for example "275 changes from 22 contributors". */
+  stats?: string;
 }
 
 export const DesktopUpdateReleaseNoteSchema = Schema.Struct({
   version: Schema.String,
   items: Schema.Array(Schema.String),
   totalItems: Schema.Number,
+  releasedAt: Schema.optionalKey(Schema.String),
+  intro: Schema.optionalKey(Schema.String),
+  stats: Schema.optionalKey(Schema.String),
 });
 
 export const DesktopUpdateStateSchema = Schema.Struct({
diff --git a/scripts/generate-release-notes.test.ts b/scripts/generate-release-notes.test.ts
new file mode 100644
index 0000000000000..0c55b082dcfb9
--- /dev/null
+++ b/scripts/generate-release-notes.test.ts
@@ -0,0 +1,65 @@
+import { assert, it } from "@effect/vitest";
+
+import * as Option from "effect/Option";
+
+import {
+  countContributors,
+  isReleaseNoteCommit,
+  summaryText,
+  type PullRequest,
+} from "./generate-release-notes.ts";
+
+const pullRequest = (author: PullRequest["author"]): PullRequest => ({
+  body: "",
+  additions: 1,
+  deletions: 1,
+  changedFiles: 1,
+  author,
+});
+
+it("counts each person once and leaves out bots", () => {
+  const commits = [
+    { subject: "fix(web): one (#1)", authorName: "Ada Lovelace" },
+    { subject: "fix(web): two (#2)", authorName: "Ada Lovelace" },
+    { subject: "chore: bump (#3)", authorName: "dependabot[bot]" },
+    { subject: "fix: direct push by a PR author", authorName: "Ada Lovelace" },
+    { subject: "fix: direct push by someone else", authorName: "Grace Hopper" },
+    { subject: "chore: direct push by a bot", authorName: "t3-code[bot]" },
+    { subject: "fix(web): four (#4)", authorName: "Linus T" },
+    { subject: "fix: direct push by a PR author with no profile name", authorName: "Linus T" },
+    { subject: "fix(web): five, whose PR did not resolve (#5)", authorName: "Ken T" },
+  ];
+  const pullRequests = new Map([
+    [1, pullRequest({ __typename: "User", login: "ada", name: "Ada Lovelace" })],
+    [2, pullRequest({ __typename: "User", login: "ada", name: "Ada Lovelace" })],
+    [3, pullRequest({ __typename: "Bot", login: "dependabot" })],
+    [4, pullRequest({ __typename: "User", login: "linus", name: null })],
+  ]);
+
+  assert.equal(countContributors(commits, pullRequests), 4);
+});
+
+it("leaves mobile-only scopes out and keeps shared ones", () => {
+  const subjects = {
+    "fix(mobile): a": false,
+    "feat(android): b": false,
+    "fix(ios)!: c": false,
+    "fix(web,mobile): d": true,
+    "feat(mobile,web): f": true,
+    "fix(server): e": true,
+  };
+  for (const [subject, kept] of Object.entries(subjects)) {
+    assert.equal(isReleaseNoteCommit({ subject, authorName: "" }), kept, subject);
+  }
+});
+
+it("uses model text only from a completed response", () => {
+  const output = [
+    { type: "message", content: [{ type: "output_text", text: " ## Highlights\nX " }] },
+  ];
+  assert.deepStrictEqual(
+    summaryText({ status: "completed", output }),
+    Option.some("## Highlights\nX"),
+  );
+  assert.deepStrictEqual(summaryText({ status: "incomplete", output }), Option.none());
+});
diff --git a/scripts/generate-release-notes.ts b/scripts/generate-release-notes.ts
new file mode 100644
index 0000000000000..909247dae1262
--- /dev/null
+++ b/scripts/generate-release-notes.ts
@@ -0,0 +1,370 @@
+#!/usr/bin/env node
+
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as Config from "effect/Config";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { Command, Flag } from "effect/cli";
+import { FetchHttpClient, HttpClient, HttpClientRequest, HttpClientResponse } from "effect/http";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+// Release notes cover web, desktop, and server. Mobile ships its own store notes.
+const MOBILE_SCOPES = new Set(["mobile", "android", "ios"]);
+const COMMIT_SCOPES = /^[a-z]+\(([^)]*)\)!?:/i;
+const PULL_REQUEST_NUMBER = /\(#(\d+)\)$/;
+const PULL_REQUEST_BODY_LIMIT = 300;
+const SUMMARY_MODEL = "gpt-6.1-terra";
+
+const SUMMARY_INSTRUCTIONS = `You write release notes for T3 Code, a GUI for coding agents (web and desktop apps backed by a server; providers like Codex, Claude, Cursor, OpenCode).
+
+These notes cover the web app, desktop app, and server only. The mobile app has its own release notes, so leave out anything only about mobile, iOS, or Android.
+
+You get the commit subjects merged since the last release, oldest first. Most end with a PR number like (#1234). Each commit shows lines added and removed and files changed, then a trimmed PR description on the next line starting with ">". Use the descriptions to understand what changed for users and why it matters. Line counts hint at size, but a small change can still matter most.
+
+Output Markdown in exactly this shape and nothing else:
+
+## Highlights
+Up to 4 short sentences. Name only the new features a user would care about most. If no new feature matters to users, write one sentence about the most important fix. Each feature gets a few words that make the benefit clear, not a description of how it works or where the button is.
+
+## Fixes
+- Up to 10 bullets, one fix each, under 10 words, ending with the PR number like (#123). Fewer is fine. Never pad.
+- Each bullet names what was broken and says it works now. A user who hit the bug should recognize it.
+- Only list fixes from fix commits. New abilities go in Highlights or nowhere. Say "again" only if the commit says it.
+
+How to write:
+- Pick only significant, user-facing changes. Leave out visual polish (focus rings, spacing, colors), layout tweaks, refactors, tests, CI, build, docs, deps, internal tooling, and performance or efficiency work a user would not feel.
+- Include Labs and beta features, with "(beta)" after the feature. Leave out work marked internal testing or dev-only.
+- Describe each feature as it is at the end of the range. If a beta feature became standard later in the range, it is not beta.
+- Say what the user gets, as short as possible. Cut details, conditions, and mechanics.
+- No defaults or rollout state ("on by default", "now available", "behind a flag").
+- For lists of file types or formats, use common extensions: "previews for .docx, .ttf, .sqlite, .zip and more".
+- No internal names, env vars, file paths, or code terms.
+- No em dashes. No hype words. Do not invent anything that is not in the input.
+
+Examples of the tone:
+- Bad: "Cmd+K now finds the right thread first, and it searches message text too." Good: "Much better Cmd+K search."
+- Bad: "You can share a thread with a guest who watches it live and sends messages that you approve." Good: "Share threads with guests, safely."
+- Bad: "Triage issues from the command palette." Good: "Fix and debug T3 Code itself with a new 'triage' command."
+- Bad: "Settings and Usage open as large modals over your thread." Good: leave it out.
+- Bad: "Cmd/Ctrl+W closes tabs safely (#25860)" Good: "Cmd/Ctrl+W no longer closes the whole window (#25860)"`;
+
+class EmptyReleaseRangeError extends Schema.TaggedError<EmptyReleaseRangeError>()(
+  "EmptyReleaseRangeError",
+  { range: Schema.String },
+) {}
+
+interface ReleaseCommit {
+  readonly subject: string;
+  readonly authorName: string;
+}
+
+const PullRequest = Schema.Struct({
+  body: Schema.String,
+  additions: Schema.Number,
+  deletions: Schema.Number,
+  changedFiles: Schema.Number,
+  author: Schema.NullOr(
+    Schema.Struct({
+      __typename: Schema.String,
+      login: Schema.String,
+      name: Schema.optional(Schema.NullOr(Schema.String)),
+    }),
+  ),
+});
+export type PullRequest = typeof PullRequest.Type;
+
+const PullRequestQueryResponse = Schema.Struct({
+  data: Schema.Struct({
+    repository: Schema.Record(Schema.String, Schema.NullOr(PullRequest)),
+  }),
+});
+
+const GeneratedNotes = Schema.Struct({ body: Schema.String });
+
+const SummaryResponse = Schema.Struct({
+  status: Schema.String,
+  output: Schema.Array(
+    Schema.Struct({
+      type: Schema.String,
+      content: Schema.optional(
+        Schema.Array(Schema.Struct({ type: Schema.String, text: Schema.optional(Schema.String) })),
+      ),
+    }),
+  ),
+  usage: Schema.optional(
+    Schema.Struct({ input_tokens: Schema.Number, output_tokens: Schema.Number }),
+  ),
+});
+
+const pullRequestNumber = (subject: string) => {
+  const match = PULL_REQUEST_NUMBER.exec(subject);
+  return match ? Number(match[1]) : undefined;
+};
+
+/** Drops a commit only when every scope is mobile, so `fix(web,mobile)` stays. */
+export function isReleaseNoteCommit(commit: ReleaseCommit): boolean {
+  const scopes = COMMIT_SCOPES.exec(commit.subject)?.[1]?.split(",");
+  return !scopes?.every((scope) => MOBILE_SCOPES.has(scope.trim().toLowerCase()));
+}
+
+/** Keeps the prose of a PR body: no images, tables, headings, HTML, or verification sections. */
+function trimPullRequestBody(body: string, limit = PULL_REQUEST_BODY_LIMIT): string {
+  const [prose = ""] = body.split(/\n#+\s*(?:Verification|Council|Test|Testing|Screenshots)\b/i);
+  const text = prose
+    .split("\n")
+    .filter((line) => line.trim() !== "" && !/^\s*[!|#<]/.test(line))
+    .join(" ")
+    .replace(/\s+/g, " ")
+    .trim();
+  return text.length > limit ? `${text.slice(0, limit)}...` : text;
+}
+
+function buildSummaryInput(
+  commits: ReadonlyArray<ReleaseCommit>,
+  pullRequests: ReadonlyMap<number, PullRequest>,
+): string {
+  return commits
+    .flatMap(({ subject }) => {
+      const number = pullRequestNumber(subject);
+      const pullRequest = number === undefined ? undefined : pullRequests.get(number);
+      if (!pullRequest) return [subject];
+      const line = `${subject} [+${pullRequest.additions} -${pullRequest.deletions}, ${pullRequest.changedFiles} files]`;
+      const body = trimPullRequestBody(pullRequest.body);
+      return body ? [line, `  > ${body}`] : [line];
+    })
+    .join("\n");
+}
+
+/** PR authors without bots, plus authors of direct pushes who have no PR in the range. */
+export function countContributors(
+  commits: ReadonlyArray<ReleaseCommit>,
+  pullRequests: ReadonlyMap<number, PullRequest>,
+): number {
+  const people = new Set<string>();
+  // A PR's squash commit carries its author's git name, which may differ from the profile name.
+  const prAuthorNames = new Set<string>();
+  const directAuthors: string[] = [];
+  for (const commit of commits) {
+    const number = pullRequestNumber(commit.subject);
+    const author = number === undefined ? undefined : pullRequests.get(number)?.author;
+    if (!author) {
+      directAuthors.push(commit.authorName);
+      continue;
+    }
+    if (author.__typename === "Bot" || author.login.endsWith("[bot]")) continue;
+    people.add(author.login);
+    prAuthorNames.add(commit.authorName);
+    if (author.name) prAuthorNames.add(author.name);
+  }
+  for (const name of directAuthors) {
+    if (!name.endsWith("[bot]") && !prAuthorNames.has(name)) people.add(name);
+  }
+  return people.size;
+}
+
+/** No date here: the app shows how long ago a release shipped, and GitHub shows the date. */
+function buildReleaseHeader(version: string, changes: number, contributors: number): string {
+  const plural = (count: number, word: string) => `${count} ${word}${count === 1 ? "" : "s"}`;
+  return `**v${version.replace(/^v/, "")}** · ${plural(changes, "change")} from ${plural(contributors, "contributor")}`;
+}
+
+/** The summary leads; GitHub's full list folds under it. Clients cut the body at `<details>`. */
+function assembleReleaseNotes(header: string, summary: string, fullChangelog: string): string {
+  return `${header}\n\n${summary.trim()}\n\n<details>\n<summary>Full changelog</summary>\n\n${fullChangelog.trim()}\n\n</details>\n`;
+}
+
+const run = Effect.fn("generateReleaseNotes.run")(function* (
+  command: string,
+  args: ReadonlyArray<string>,
+) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  return yield* spawner.string(ChildProcess.make(command, args));
+});
+
+const decodeJson = <S extends Schema.Top>(schema: S) =>
+  Schema.decodeUnknownEffect(Schema.fromJsonString(schema));
+
+const readCommits = Effect.fn("generateReleaseNotes.readCommits")(function* (
+  previousTag: string,
+  ref: string,
+) {
+  const log = yield* run("git", [
+    "log",
+    "--reverse",
+    "--format=%s%x1f%an",
+    `${previousTag}..${ref}`,
+  ]);
+  return log
+    .split("\n")
+    .filter((line) => line !== "")
+    .map((line): ReleaseCommit => {
+      const [subject = "", authorName = ""] = line.split("\x1f");
+      return { subject, authorName };
+    });
+});
+
+const readPullRequests = Effect.fn("generateReleaseNotes.readPullRequests")(function* (
+  repository: string,
+  numbers: ReadonlyArray<number>,
+) {
+  const [owner, name] = repository.split("/");
+  const pullRequests = new Map<number, PullRequest>();
+  for (let start = 0; start < numbers.length; start += 100) {
+    const fields = numbers
+      .slice(start, start + 100)
+      .map(
+        (number) =>
+          `pr${number}: pullRequest(number: ${number}) { body additions deletions changedFiles author { __typename login ... on User { name } } }`,
+      )
+      .join("\n");
+    const query = `query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { ${fields} } }`;
+    const response = yield* decodeJson(PullRequestQueryResponse)(
+      yield* run("gh", [
+        "api",
+        "graphql",
+        "-f",
+        `query=${query}`,
+        "-f",
+        `owner=${owner}`,
+        "-f",
+        `name=${name}`,
+      ]),
+    );
+    for (const [alias, pullRequest] of Object.entries(response.data.repository)) {
+      if (pullRequest) pullRequests.set(Number(alias.slice(2)), pullRequest);
+    }
+  }
+  return pullRequests;
+});
+
+const readFullChangelog = Effect.fn("generateReleaseNotes.readFullChangelog")(function* (options: {
+  readonly repository: string;
+  readonly tag: string;
+  readonly ref: string;
+  readonly previousTag: string;
+}) {
+  const response = yield* run("gh", [
+    "api",
+    `repos/${options.repository}/releases/generate-notes`,
+    "-f",
+    `tag_name=${options.tag}`,
+    "-f",
+    `target_commitish=${options.ref}`,
+    "-f",
+    `previous_tag_name=${options.previousTag}`,
+  ]);
+  return (yield* decodeJson(GeneratedNotes)(response)).body;
+});
+
+export function summaryText(response: typeof SummaryResponse.Type): Option.Option<string> {
+  // An incomplete response can carry partial text; publishing it would cut the notes short.
+  if (response.status !== "completed") return Option.none();
+  const text = response.output
+    .flatMap((item) => item.content ?? [])
+    .flatMap((part) => (part.type === "output_text" && part.text ? [part.text] : []))
+    .join("")
+    .trim();
+  return text === "" ? Option.none() : Option.some(text);
+}
+
+const summarize = Effect.fn("generateReleaseNotes.summarize")(function* (input: string) {
+  const apiKey = yield* Config.Redacted("OPENAI_API_KEY");
+  const httpClient = yield* HttpClient.HttpClient;
+  const response = yield* HttpClientRequest.post("https://api.openai.com/v1/responses").pipe(
+    HttpClientRequest.bearerToken(apiKey),
+    HttpClientRequest.bodyJson({
+      model: SUMMARY_MODEL,
+      reasoning: { effort: "low" },
+      instructions: SUMMARY_INSTRUCTIONS,
+      input: `Commits:\n${input}`,
+    }),
+    Effect.flatMap(httpClient.execute),
+    Effect.flatMap(HttpClientResponse.filterStatusOk),
+    Effect.flatMap((response) => response.json),
+    Effect.flatMap(Schema.decodeUnknownEffect(SummaryResponse)),
+    Effect.timeout("3 minutes"),
+  );
+  yield* Effect.logInfo("release summary generated").pipe(
+    Effect.annotateLogs({
+      model: SUMMARY_MODEL,
+      inputTokens: response.usage?.input_tokens,
+      outputTokens: response.usage?.output_tokens,
+    }),
+  );
+  return summaryText(response);
+});
+
+const command = Command.make(
+  "generate-release-notes",
+  {
+    repository: Flag.String("repository").pipe(Flag.withDescription("GitHub owner/name.")),
+    tag: Flag.String("tag").pipe(Flag.withDescription("Tag being released.")),
+    ref: Flag.String("ref").pipe(Flag.withDescription("Commit being released.")),
+    previousTag: Flag.String("previous-tag").pipe(Flag.withDescription("Previous release tag.")),
+    version: Flag.String("version").pipe(Flag.withDescription("Version shown in the header.")),
+    output: Flag.String("output").pipe(Flag.withDescription("File to write the notes to.")),
+  },
+  ({ repository, tag, ref, previousTag, version, output }) =>
+    Effect.gen(function* () {
+      // The header counts every commit in the range; the summary skips mobile-only work.
+      const allCommits = yield* readCommits(previousTag, ref);
+      // The spawner ignores exit codes, so a failed git log shows up as an empty range.
+      if (allCommits.length === 0) {
+        return yield* new EmptyReleaseRangeError({ range: `${previousTag}..${ref}` });
+      }
+      const commits = allCommits.filter(isReleaseNoteCommit);
+      const numbers = [
+        ...new Set(allCommits.flatMap(({ subject }) => pullRequestNumber(subject) ?? [])),
+      ];
+      const [pullRequests, fullChangelog] = yield* Effect.all(
+        [
+          readPullRequests(repository, numbers),
+          readFullChangelog({ repository, tag, ref, previousTag }),
+        ],
+        { concurrency: "unbounded" },
+      );
+      const header = buildReleaseHeader(
+        version,
+        allCommits.length,
+        countContributors(allCommits, pullRequests),
+      );
+      // With no summary, write nothing: the release falls back to GitHub's generated notes.
+      const summary =
+        commits.length === 0
+          ? Option.none<string>()
+          : yield* summarize(buildSummaryInput(commits, pullRequests));
+      if (Option.isNone(summary)) {
+        return yield* Effect.logWarning("no release summary, leaving GitHub's notes in place");
+      }
+      const fs = yield* FileSystem.FileSystem;
+      // Publish uses the file when it exists, so a partial write must never land at `output`.
+      yield* fs.writeFileString(
+        `${output}.tmp`,
+        assembleReleaseNotes(header, summary.value, fullChangelog),
+      );
+      yield* fs.rename(`${output}.tmp`, output);
+      yield* Effect.logInfo("release notes written").pipe(
+        Effect.annotateLogs({ output, commits: commits.length }),
+      );
+    }),
+).pipe(
+  Command.withDescription("Write release notes with a model summary over GitHub's full list."),
+);
+
+if (import.meta.main) {
+  Command.run(command, { version: "0.0.0" }).pipe(
+    Effect.provide(
+      Layer.mergeAll(
+        Logger.layer([Logger.consolePretty()]),
+        NodeServices.layer,
+        FetchHttpClient.layer,
+      ),
+    ),
+    NodeRuntime.runMain,
+  );
+}
diff --git a/scripts/notify-discord-release.test.ts b/scripts/notify-discord-release.test.ts
index 6e57ffb56a7ef..84a43869be6a7 100644
--- a/scripts/notify-discord-release.test.ts
+++ b/scripts/notify-discord-release.test.ts
@@ -132,6 +132,15 @@ it("preserves custom notes and links outside generated GitHub pull request entri
   );
 });
 
+it("posts a generated summary without its folded full list", () => {
+  const summary = "**v1.2.3** · 4 changes\n\n## Fixes\n- Stop works again (#1)";
+  const releaseNotes = `${summary}\n\n<details>\n<summary>Full changelog</summary>\n\n* fix: raw by @someone in https://github.com/pingdotgg/t3code/pull/1\n\n</details>\n`;
+  assert.equal(
+    payloadDescription(buildDiscordReleaseAnnouncement({ ...nightlyAnnouncement, releaseNotes })),
+    `${intro}\n\n**v1.2.3** · 4 changes\n\n## Fixes\n- Stop works again ([#1](https://github.com/pingdotgg/t3code/pull/1))\n\n[Full changelog](${nightlyAnnouncement.releaseUrl.href})`,
+  );
+});
+
 it("falls back when notes are missing, empty, or whitespace", () => {
   const fallback = buildDiscordReleaseAnnouncement(nightlyAnnouncement);
   assert.equal(payloadDescription(fallback), intro);
diff --git a/scripts/notify-discord-release.ts b/scripts/notify-discord-release.ts
index 0eb3bf348530a..29d94561c8fbc 100644
--- a/scripts/notify-discord-release.ts
+++ b/scripts/notify-discord-release.ts
@@ -135,6 +135,12 @@ const suppressMentions = (text: string) =>
 
 const escapeLinkLabel = (text: string) => text.replace(/[\\[\]]/g, "\\$&");
 
+/** GitHub links `(#123)` on the release page; Discord needs the link written out. */
+function linkPullRequestNumbers(notes: string, releaseUrl: URL) {
+  const repositoryUrl = releaseUrl.href.split("/releases/")[0];
+  return notes.replace(/#(\d+)\b/g, `[#$1](${repositoryUrl}/pull/$1)`);
+}
+
 function formatReleaseNotes(notes: string) {
   return notes
     .replace(
@@ -193,9 +199,15 @@ export const buildDiscordReleaseAnnouncement = (
     options.target === "prerelease"
       ? "A new T3 Code prerelease is available for nightly testers."
       : `[View full release notes on GitHub](${options.releaseUrl.href})`;
+  // Generated summaries fold the full list under <details>, which Discord cannot render.
+  const [summary = "", folded] = (options.releaseNotes ?? "").split(/^<details>/m);
   const notes =
     options.target === "prerelease"
-      ? suppressMentions(formatReleaseNotes(options.releaseNotes?.trim() ?? ""))
+      ? suppressMentions(
+          folded === undefined
+            ? formatReleaseNotes(summary.trim())
+            : `${linkPullRequestNumbers(summary.trim(), options.releaseUrl)}\n\n[Full changelog](${options.releaseUrl.href})`,
+        )
       : "";
   const description = notes ? `${intro}\n\n${notes}` : intro;
   // Separate embeds avoid URL deduplication; reserve title and footer space within Discord's 6000-character limit.

From 48247dd4ccb4d531789b845bdf03d3f996fd9174 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 04:27:01 -0700
Subject: [PATCH 006/146] fix(cli): t3 starts on a fresh Ubuntu server without
 libatomic (#26912)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release-desktop.yml | 12 +++--
 scripts/build-cli-archive.ts          | 74 +++++++++++++++++++++++++--
 scripts/smoke-cli-archive.ts          | 23 ++++++++-
 3 files changed, 100 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index ba40c4fb89cba..5a16a9b4c170f 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -390,6 +390,15 @@ jobs:
           mkdir -p "$target_dir"
           cp "native/resource-monitor/target/${{ inputs.rust_target }}/release/${binary_name}" "$target_dir/$binary_name"
 
+      - uses: ./.github/actions/setup-apt-mirrors
+        if: inputs.platform == 'linux'
+
+      # The Linux archive ships libatomic.so.1 and points t3's RUNPATH at it.
+      - name: Install patchelf
+        if: inputs.cli_archive && inputs.platform == 'linux'
+        shell: bash
+        run: command -v patchelf || { sudo apt-get update && sudo apt-get install -y patchelf; }
+
       - name: Build CLI archive
         if: inputs.cli_archive
         shell: bash
@@ -433,9 +442,6 @@ jobs:
           path: release-cli/*
           if-no-files-found: error
 
-      - uses: ./.github/actions/setup-apt-mirrors
-        if: inputs.platform == 'linux'
-
       - name: Install Linux desktop build libraries
         if: inputs.platform == 'linux'
         shell: bash
diff --git a/scripts/build-cli-archive.ts b/scripts/build-cli-archive.ts
index ee7c45ada5dd6..47b8cef8a9794 100644
--- a/scripts/build-cli-archive.ts
+++ b/scripts/build-cli-archive.ts
@@ -251,6 +251,67 @@ const stageWebClient = Effect.fn("stageWebClient")(function* (source: string, ta
   }
 });
 
+/** Node links libatomic.so.1, which Ubuntu server and container images lack, so t3 carries its own. */
+const bundleLinuxLibatomic = Effect.fn("bundleLinuxLibatomic")(function* (input: {
+  readonly contentDir: string;
+  readonly executablePath: string;
+}) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const ldd = yield* spawner.string(ChildProcess.make("ldd", [input.executablePath]));
+  const source = /libatomic\.so\.1 => (\/\S+)/.exec(ldd)?.[1];
+  if (source === undefined) {
+    return yield* new CliArchiveInputMissingError({
+      inputPath: "libatomic.so.1",
+      hint: `ldd did not resolve it for ${input.executablePath}. Install libatomic1 on the build host.`,
+    });
+  }
+  yield* fs.makeDirectory(path.join(input.contentDir, "lib"));
+  yield* fs.copyFile(source, path.join(input.contentDir, "lib/libatomic.so.1"));
+
+  // libatomic is GPL-3.0-or-later WITH GCC-exception-3.1, so its terms and source travel with it.
+  const owner = yield* spawner.string(
+    ChildProcess.make("dpkg-query", ["-S", yield* fs.realPath(source)]),
+  );
+  // Keep the arch qualifier so a second installed arch cannot add its own line.
+  const [, qualifiedPkg, pkg] = /^(([^:\s]+)(?::[^:\s]+)?): /.exec(owner) ?? [];
+  const versions = qualifiedPkg
+    ? yield* spawner.string(
+        ChildProcess.make("dpkg-query", [
+          "-W",
+          "-f=${Version} ${source:Package} ${source:Version}",
+          qualifiedPkg,
+        ]),
+      )
+    : "";
+  const [version, sourcePackage, sourceVersion] = versions.trim().split(" ");
+  if (!pkg || !version || !sourcePackage || !sourceVersion) {
+    return yield* new CliArchiveInputMissingError({
+      inputPath: `dpkg package for ${source}`,
+      hint: "The archive copies libatomic's license and source reference from its Ubuntu package.",
+    });
+  }
+  const header = [
+    `libatomic.so.1 is copied from the Ubuntu package ${pkg} ${version}.`,
+    `Source: https://launchpad.net/ubuntu/+source/${sourcePackage}/${sourceVersion}`,
+    "License: GPL-3.0-or-later WITH GCC-exception-3.1. The package copyright file and GPL-3 follow.",
+  ].join("\n");
+  const copyright = yield* fs.readFileString(`/usr/share/doc/${pkg}/copyright`);
+  const gpl3 = yield* fs.readFileString("/usr/share/common-licenses/GPL-3");
+  yield* fs.writeFileString(
+    path.join(input.contentDir, "lib/libatomic.so.1.LICENSE"),
+    `${header}\n\n${copyright}\n${gpl3}`,
+  );
+
+  // RUNPATH resolves through symlinks and is not inherited by child processes, unlike LD_LIBRARY_PATH.
+  yield* runCommand(
+    ChildProcess.make("patchelf", ["--set-rpath", "$ORIGIN/lib", input.executablePath]),
+    "patchelf --set-rpath",
+  );
+  yield* Effect.log(`[cli-archive] Bundled ${source} as lib/libatomic.so.1.`);
+});
+
 const MacSigningConfig = Config.all({
   identity: Config.String("T3CODE_CLI_MAC_SIGN_IDENTITY").pipe(Config.option),
   appleApiKey: Config.String("APPLE_API_KEY").pipe(Config.option),
@@ -444,11 +505,6 @@ const buildCliArchive = Effect.fn("buildCliArchive")(function* (input: {
     builtExecutable,
     `Run \`node apps/server/scripts/cli.ts build-exe${targetKey === hostKey ? "" : ` --target ${targetKey}`}\` first.`,
   );
-  // TEMPORARY one-time Node fix. Remove when fixed: https://github.com/nodejs/node/issues/67048
-  if (input.platform === "linux" && input.arch === "arm64") {
-    const bytes = yield* fs.readFile(builtExecutable);
-    yield* Effect.try(() => assertLinuxArm64PageCompatibility(bytes));
-  }
   yield* requireInput(path.join(webClient, "index.html"), "Run `vp run --filter t3 build` first.");
   yield* requireInput(
     resourceMonitorDir,
@@ -473,6 +529,14 @@ const buildCliArchive = Effect.fn("buildCliArchive")(function* (input: {
   });
 
   const executablePath = path.join(contentDir, executableName);
+  if (input.platform === "linux") {
+    yield* bundleLinuxLibatomic({ contentDir, executablePath });
+  }
+  // TEMPORARY one-time Node fix. Remove when fixed: https://github.com/nodejs/node/issues/67048
+  if (input.platform === "linux" && input.arch === "arm64") {
+    const bytes = yield* fs.readFile(executablePath);
+    yield* Effect.try(() => assertLinuxArm64PageCompatibility(bytes));
+  }
   if (input.platform === "mac") {
     yield* signMacArchiveContents({ repoRoot, contentDir, executablePath });
   } else if (input.platform === "win") {
diff --git a/scripts/smoke-cli-archive.ts b/scripts/smoke-cli-archive.ts
index c5344bdeb43fe..1318aa3c0c6dd 100644
--- a/scripts/smoke-cli-archive.ts
+++ b/scripts/smoke-cli-archive.ts
@@ -97,7 +97,12 @@ const smokeCliArchive = Effect.fn("smokeCliArchive")(function* (input: {
   }
   const contentDir = path.join(scratch, root);
   const executable = path.join(contentDir, platform === "win32" ? "t3.exe" : "t3");
-  for (const required of [executable, path.join(contentDir, "client/index.html")]) {
+  const bundledLibatomic = path.join(contentDir, "lib/libatomic.so.1");
+  for (const required of [
+    executable,
+    path.join(contentDir, "client/index.html"),
+    ...(platform === "linux" ? [bundledLibatomic, `${bundledLibatomic}.LICENSE`] : []),
+  ]) {
     if (!(yield* fs.exists(required))) {
       return yield* new CliArchiveSmokeError({
         step: "checking the archive layout",
@@ -106,6 +111,22 @@ const smokeCliArchive = Effect.fn("smokeCliArchive")(function* (input: {
     }
   }
 
+  // The runner has libatomic installed; fresh Ubuntu servers do not.
+  if (platform === "linux") {
+    const ldd = yield* spawner.string(ChildProcess.make("ldd", [executable]));
+    // Older glibc prints the path as given, newer prints it resolved; compare both resolved.
+    const loaded = /libatomic\.so\.1 => (\/.*) \(0x[0-9a-f]+\)/.exec(ldd)?.[1];
+    if (
+      loaded === undefined ||
+      (yield* fs.realPath(loaded)) !== (yield* fs.realPath(bundledLibatomic))
+    ) {
+      return yield* new CliArchiveSmokeError({
+        step: "checking that t3 loads the bundled libatomic",
+        detail: ldd,
+      });
+    }
+  }
+
   const version = yield* runExecutable(executable, ["--version"], contentDir);
   if (version.exitCode !== 0 || !version.stdout.includes(input.expectVersion)) {
     return yield* new CliArchiveSmokeError({

From e6ca17001d0f7d52d3ddde299936095561e9b6c8 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 04:28:22 -0700
Subject: [PATCH 007/146] fix(web): update everything no longer waits on npm
 for service hosts (#26917)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/release.yml                 | 13 ++++++++
 .../sidebar/updateEverything.logic.test.ts    | 17 +++++++++++
 .../sidebar/updateEverything.logic.ts         | 30 +++++++++++++++----
 .../components/sidebar/useUpdateEverything.ts | 23 +++++++-------
 docs/operations/release.md                    |  5 +++-
 docs/user/updating.md                         |  5 ++--
 6 files changed, 73 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e9c731cf6fa06..6d89b7c7abe7a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -947,6 +947,7 @@ jobs:
           body_path: ${{ hashFiles('release-notes.md') != '' && 'release-notes.md' || '' }}
           previous_tag: ${{ needs.preflight.outputs.previous_tag }}
           prerelease: ${{ needs.preflight.outputs.is_prerelease }}
+          draft: ${{ needs.preflight.outputs.is_prerelease }}
           make_latest: ${{ needs.preflight.outputs.make_latest }}
           files: ${{ steps.release_files.outputs.files }}
           fail_on_unmatched_files: true
@@ -962,11 +963,23 @@ jobs:
           generate_release_notes: ${{ needs.preflight.outputs.release_channel != 'preview' }}
           body_path: ${{ needs.preflight.outputs.release_channel == 'preview' && 'release-notes.md' || '' }}
           prerelease: ${{ needs.preflight.outputs.is_prerelease }}
+          draft: ${{ needs.preflight.outputs.is_prerelease }}
           make_latest: ${{ needs.preflight.outputs.make_latest }}
           files: ${{ steps.release_files.outputs.files }}
           fail_on_unmatched_files: true
           token: ${{ github.token }}
 
+      # The action keeps a stable release a draft until its assets finish uploading, but publishes a
+      # prerelease first. Desktop clients update connected servers from the CLI archives as soon as
+      # they see the release, so a prerelease also goes public only once every asset is attached.
+      - name: Publish prerelease
+        if: needs.preflight.outputs.is_prerelease == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
+        run: gh release edit "$RELEASE_TAG" --draft=false
+
   # The `t3` npm package is a launcher that downloads this version's CLI
   # archive from the GitHub Release, so it publishes only once that release
   # exists. Preview publishes too, under the `preview` dist-tag, which
diff --git a/apps/web/src/components/sidebar/updateEverything.logic.test.ts b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
index 4c09823d40538..df60c036e21ed 100644
--- a/apps/web/src/components/sidebar/updateEverything.logic.test.ts
+++ b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
@@ -69,6 +69,7 @@ describe("collectServerUpdateTargets", () => {
         machine("manual", "0.0.40", undefined),
       ],
       "0.0.50",
+      true,
     );
 
     expect(targets.map((target) => [target.serverLabel, target.targetVersion])).toEqual([
@@ -84,6 +85,22 @@ describe("collectServerUpdateTargets", () => {
       ["manual", "needs a manual update"],
     ]);
   });
+
+  it("waits for npm only for hosts that install from it or when the release may lack archives", () => {
+    const hosts = [
+      machine("archive-service", "0.1.4", "boot-service"),
+      machine("npm-service", "0.0.40", "boot-service"),
+      machine("legacy-respawn", "0.1.4", "respawn"),
+      machine("desktop", "0.1.4", "desktop-managed"),
+    ];
+    const waits = (releaseArchivesPublished: boolean) =>
+      collectServerUpdateTargets(hosts, "0.1.5", releaseArchivesPublished).waitForNpm.map(
+        (target) => target.serverLabel,
+      );
+
+    expect(waits(true)).toEqual(["npm-service", "legacy-respawn"]);
+    expect(waits(false)).toEqual(["archive-service", "npm-service", "legacy-respawn"]);
+  });
 });
 
 describe("collectChannelSwitchTargets", () => {
diff --git a/apps/web/src/components/sidebar/updateEverything.logic.ts b/apps/web/src/components/sidebar/updateEverything.logic.ts
index 8d82b7b568e75..de21c535f517c 100644
--- a/apps/web/src/components/sidebar/updateEverything.logic.ts
+++ b/apps/web/src/components/sidebar/updateEverything.logic.ts
@@ -63,14 +63,25 @@ export interface SkippedMachine {
   readonly reason: string;
 }
 
+/** Boot services before this build installed the server from npm, not from release archives. */
+const RELEASE_ARCHIVE_SELF_UPDATE_SINCE = "0.0.41-nightly.20260914.1700";
+
 /** Skip current and app-hosted servers; the latter update with the app and would relaunch mid-run.
- * Desktop-managed servers use their own feed. */
+ * Desktop-managed servers use their own feed. `waitForNpm` lists targets that need
+ * `t3@<targetVersion>` on npm first. `releaseArchivesPublished` means the version came from the
+ * desktop feed: its GitHub Release goes public with the CLI archives that boot services download. */
 export function collectServerUpdateTargets(
   machines: ReadonlyArray<UpdateEverythingMachine>,
   targetVersion: string,
-): { readonly targets: ServerUpdateTarget[]; readonly skipped: SkippedMachine[] } {
+  releaseArchivesPublished: boolean,
+): {
+  readonly targets: ServerUpdateTarget[];
+  readonly skipped: SkippedMachine[];
+  readonly waitForNpm: ServerUpdateTarget[];
+} {
   const targets: ServerUpdateTarget[] = [];
   const skipped: SkippedMachine[] = [];
+  const waitForNpm: ServerUpdateTarget[] = [];
   for (const machine of machines) {
     const config = machine.serverConfig;
     if (machine.hostedByThisApp) continue;
@@ -105,16 +116,25 @@ export function collectServerUpdateTargets(
       skip(`on the ${cliReleaseChannelOf(serverVersion)} channel`);
       continue;
     }
-    targets.push({
+    const target: ServerUpdateTarget = {
       environmentId: machine.environmentId,
       serverLabel: machine.label,
       selfUpdate,
       installation: config.environment.capabilities.serverInstallation,
       desktopAppUpdate,
       targetVersion,
-    });
+    };
+    targets.push(target);
+    if (
+      selfUpdate !== "desktop-managed" &&
+      (!releaseArchivesPublished ||
+        selfUpdate === "respawn" ||
+        compareSemverVersions(serverVersion, RELEASE_ARCHIVE_SELF_UPDATE_SINCE) < 0)
+    ) {
+      waitForNpm.push(target);
+    }
   }
-  return { targets, skipped };
+  return { targets, skipped, waitForNpm };
 }
 
 function unavailableReason(machine: UpdateEverythingMachine): string | null {
diff --git a/apps/web/src/components/sidebar/useUpdateEverything.ts b/apps/web/src/components/sidebar/useUpdateEverything.ts
index 84e9697cd65b9..d8ab3a5bce710 100644
--- a/apps/web/src/components/sidebar/useUpdateEverything.ts
+++ b/apps/web/src/components/sidebar/useUpdateEverything.ts
@@ -68,19 +68,18 @@ export function useUpdateEverything(
     canMaintain: canUpdateServer(sessionStates[index]!),
     updateState: updateStates[index]!,
   }));
-  const { targets: behindServers, skipped: unreachable } = channelSwitch
-    ? collectChannelSwitchTargets(machines, channelSwitch)
-    : collectServerUpdateTargets(machines, targetVersion);
-  // Desktop-managed servers use their app feed; only npm installs need to wait for publication.
   // A track switch's target came from npm already.
-  const needsNpm =
-    channelSwitch === undefined &&
-    behindServers.some((server) => server.selfUpdate !== "desktop-managed");
-  const published = useNpmReleasePublished(needsNpm ? targetVersion : null);
-  const servers =
-    published || channelSwitch !== undefined
-      ? behindServers
-      : behindServers.filter((server) => server.selfUpdate === "desktop-managed");
+  const {
+    targets: behindServers,
+    skipped: unreachable,
+    waitForNpm,
+  } = channelSwitch
+    ? { ...collectChannelSwitchTargets(machines, channelSwitch), waitForNpm: [] }
+    : collectServerUpdateTargets(machines, targetVersion, localUpdateVersion !== null);
+  const published = useNpmReleasePublished(waitForNpm.length > 0 ? targetVersion : null);
+  const servers = published
+    ? behindServers
+    : behindServers.filter((server) => !waitForNpm.includes(server));
   const skipped: ReadonlyArray<SkippedMachine> = [
     ...unreachable,
     ...behindServers
diff --git a/docs/operations/release.md b/docs/operations/release.md
index 89003a5e76126..15fb3a4e9645c 100644
--- a/docs/operations/release.md
+++ b/docs/operations/release.md
@@ -431,7 +431,10 @@ release archives, and then its npm launcher, available before users can receive
 
 The workflow enforces this ordering:
 
-1. `release` publishes the GitHub Release with the CLI archives and `SHA256SUMS`.
+1. `release` publishes the GitHub Release with the CLI archives and `SHA256SUMS`. Every channel
+   uploads to a draft and publishes only after all assets are attached, so a version in the
+   desktop update feed always has its archives. **Update everything** relies on this to update
+   background-service hosts before npm has the version.
 2. `publish_cli` publishes the `t3@<version>` launcher, which downloads from that release, on every
    channel.
 3. `deploy_web` depends on both before moving the hosted channel to the new client.
diff --git a/docs/user/updating.md b/docs/user/updating.md
index 006c4985d43cd..afb0395d14123 100644
--- a/docs/user/updating.md
+++ b/docs/user/updating.md
@@ -22,8 +22,9 @@ restart from the update button when you are ready. A server still restarting
 finishes on its own, and the button keeps showing it after the desktop app
 restarts.
 
-Server updates appear only after that version is published to npm. Remote
-desktop apps do not wait for npm. The confirmation lists each machine it skips
+Remote desktop apps never wait for npm. Background services do not wait either
+when the version comes from the desktop app's update. Other server updates
+appear only after that version is published to npm. The confirmation lists each machine it skips
 and why, such as a machine that is offline or needs a manual update. Use
 **Settings → Environments** for those.
 

From 3748c5c241a2740f2e0856e2c2a3f9d8ee7ff8e9 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 04:47:29 -0700
Subject: [PATCH 008/146] test(web): pin the npm wait floor for update
 everything (#26921)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../sidebar/updateEverything.logic.test.ts       | 16 +++++++++-------
 docs/operations/release.md                       |  7 ++++---
 docs/user/updating.md                            | 10 +++++-----
 3 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/apps/web/src/components/sidebar/updateEverything.logic.test.ts b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
index df60c036e21ed..62aef93572c4d 100644
--- a/apps/web/src/components/sidebar/updateEverything.logic.test.ts
+++ b/apps/web/src/components/sidebar/updateEverything.logic.test.ts
@@ -88,15 +88,17 @@ describe("collectServerUpdateTargets", () => {
 
   it("waits for npm only for hosts that install from it or when the release may lack archives", () => {
     const hosts = [
-      machine("archive-service", "0.1.4", "boot-service"),
-      machine("npm-service", "0.0.40", "boot-service"),
-      machine("legacy-respawn", "0.1.4", "respawn"),
-      machine("desktop", "0.1.4", "desktop-managed"),
+      machine("archive-service", "0.0.41-nightly.20260914.1700", "boot-service"),
+      machine("npm-service", "0.0.41-nightly.20260914.1699", "boot-service"),
+      machine("legacy-respawn", "0.1.4-nightly.20261027.3796", "respawn"),
+      machine("desktop", "0.1.4-nightly.20261027.3796", "desktop-managed"),
     ];
     const waits = (releaseArchivesPublished: boolean) =>
-      collectServerUpdateTargets(hosts, "0.1.5", releaseArchivesPublished).waitForNpm.map(
-        (target) => target.serverLabel,
-      );
+      collectServerUpdateTargets(
+        hosts,
+        "0.1.5-nightly.20261029.3873",
+        releaseArchivesPublished,
+      ).waitForNpm.map((target) => target.serverLabel);
 
     expect(waits(true)).toEqual(["npm-service", "legacy-respawn"]);
     expect(waits(false)).toEqual(["archive-service", "npm-service", "legacy-respawn"]);
diff --git a/docs/operations/release.md b/docs/operations/release.md
index 15fb3a4e9645c..18daadc5f2787 100644
--- a/docs/operations/release.md
+++ b/docs/operations/release.md
@@ -432,9 +432,10 @@ release archives, and then its npm launcher, available before users can receive
 The workflow enforces this ordering:
 
 1. `release` publishes the GitHub Release with the CLI archives and `SHA256SUMS`. Every channel
-   uploads to a draft and publishes only after all assets are attached, so a version in the
-   desktop update feed always has its archives. **Update everything** relies on this to update
-   background-service hosts before npm has the version.
+   uploads to a draft and publishes only after all assets are attached, so a new version in the
+   desktop update feed already has its archives. **Update everything** relies on this to update
+   background-service hosts before npm has the version. Rerunning `release` after publication
+   replaces assets in a public release, so service updates can fail until the upload finishes.
 2. `publish_cli` publishes the `t3@<version>` launcher, which downloads from that release, on every
    channel.
 3. `deploy_web` depends on both before moving the hosted channel to the new client.
diff --git a/docs/user/updating.md b/docs/user/updating.md
index afb0395d14123..cfe746c187338 100644
--- a/docs/user/updating.md
+++ b/docs/user/updating.md
@@ -22,11 +22,11 @@ restart from the update button when you are ready. A server still restarting
 finishes on its own, and the button keeps showing it after the desktop app
 restarts.
 
-Remote desktop apps never wait for npm. Background services do not wait either
-when the version comes from the desktop app's update. Other server updates
-appear only after that version is published to npm. The confirmation lists each machine it skips
-and why, such as a machine that is offline or needs a manual update. Use
-**Settings → Environments** for those.
+Remote desktop apps never wait for npm. When the desktop app offers the update,
+background services update right away too. Other servers, including older
+background services, update only after that version is published to npm. The
+confirmation lists each machine it skips and why, such as a machine that is
+offline or needs a manual update. Use **Settings → Environments** for those.
 
 If a desktop app restarts on its old version, T3 Code tells you the update did
 not apply. It does not install that version again on its own, even when another

From 7f5528154ebe50269c5a9b3be08e93958dcefda8 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 05:07:38 -0700
Subject: [PATCH 009/146] fix(antigravity): served reads stop spinning and
 duplicate model names are labeled (#26928)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/AntigravityAdapterV2.test.ts     | 10 ++++++
 .../Adapters/AntigravityAdapterV2.ts          | 31 ++++++++++++++++---
 .../src/provider/AntigravityProvider.test.ts  | 19 ++++++++++++
 .../src/provider/AntigravityProvider.ts       |  7 ++++-
 .../provider/acp/AntigravityProtocol.test.ts  |  3 +-
 .../src/provider/acp/AntigravityProtocol.ts   | 28 +++++++++++++----
 6 files changed, 85 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
index 5cf359451ef29..90226cc68bd2a 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
@@ -896,6 +896,16 @@ describe("AntigravityAdapterV2 subagent reads", () => {
           : undefined;
       };
 
+      const firstEvent = (nativeId: string, status: string) =>
+        events.findIndex(
+          (event) =>
+            event.type === "turn_item.updated" &&
+            event.turnItem.nativeItemRef?.nativeId === nativeId &&
+            event.turnItem.status === status,
+        );
+      // T3 completes a served read itself instead of leaving it running until the flush.
+      assert.isAbove(firstEvent("call_served", "completed"), -1);
+      assert.isBelow(firstEvent("call_served", "completed"), firstEvent("call_native", "failed"));
       const failed = { status: "failed" as const, output: stepError };
       assert.deepEqual(read("call_served"), { status: "completed", output: undefined });
       assert.deepEqual(read("call_retried"), { status: "completed", output: undefined });
diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
index fbdd5748adcfc..4d06da900f4a8 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
@@ -11,6 +11,7 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
 import * as Exit from "effect/Exit";
+import * as Semaphore from "effect/Semaphore";
 import * as Scope from "effect/Scope";
 import * as EffectAcpErrors from "effect-acp/errors";
 
@@ -131,20 +132,40 @@ export function makeAntigravityAcpAdapterFlavor(
         .pipe(Effect.provideService(Scope.Scope, scope));
       // Repair keeps state across updates, so each runtime must have one session-update handler.
       const reads = makeAntigravityReadRepair();
+      // Served reads are reported from the read handler, so they take turns with agent updates.
+      const updates = yield* Semaphore.make(1);
+      let projectUpdate: Parameters<typeof runtime.handleSessionUpdate>[0] | undefined;
       return {
         ...runtime,
         handleReadTextFile: (handler) =>
           runtime.handleReadTextFile((request, context) =>
             handler(request, context).pipe(
-              Effect.onExit((exit) =>
-                Effect.sync(() => reads.attempted(request.path, Exit.isSuccess(exit))),
-              ),
+              Effect.onExit((exit) => {
+                const served = reads.attempted(request.path, Exit.isSuccess(exit));
+                if (served === undefined || projectUpdate === undefined) return Effect.void;
+                return updates
+                  .withPermit(
+                    projectUpdate({
+                      sessionId: served.sessionId,
+                      update: {
+                        sessionUpdate: "tool_call_update",
+                        toolCallId: served.toolCallId,
+                        status: "completed",
+                      },
+                    }),
+                  )
+                  .pipe(Effect.ignore);
+              }),
             ),
           ),
         prompt: (payload, promptOptions) =>
           Effect.sync(reads.reset).pipe(Effect.andThen(runtime.prompt(payload, promptOptions))),
-        handleSessionUpdate: (handler) =>
-          runtime.handleSessionUpdate((notification) => handler(reads.repair(notification))),
+        handleSessionUpdate: (handler) => {
+          projectUpdate = handler;
+          return runtime.handleSessionUpdate((notification) =>
+            updates.withPermit(handler(reads.repair(notification))),
+          );
+        },
         start: () =>
           runtime
             .start()
diff --git a/apps/server/src/provider/AntigravityProvider.test.ts b/apps/server/src/provider/AntigravityProvider.test.ts
index 35f279f29ddcc..1f852ad8bcc87 100644
--- a/apps/server/src/provider/AntigravityProvider.test.ts
+++ b/apps/server/src/provider/AntigravityProvider.test.ts
@@ -215,6 +215,25 @@ describe("Antigravity model catalog", () => {
     );
   });
 
+  it("labels models that share a display name with their IDs", () => {
+    const models = buildAntigravityModelsFromSession({
+      configOptions: [
+        {
+          ...modelConfig,
+          currentValue: "gemini-3.8-flash",
+          options: [
+            { value: "gemini-3.8-flash", name: "Gemini 3.8 Flash" },
+            { value: "gemini-3.8-flash-preview", name: "Gemini 3.8 Flash" },
+          ],
+        },
+      ],
+    });
+    expect(models.map((model) => model.name)).toEqual([
+      "Gemini 3.8 Flash",
+      "Gemini 3.8 Flash (gemini-3.8-flash-preview)",
+    ]);
+  });
+
   it("offers each model the thinking levels it reported when selected", () => {
     const thinking = (currentValue: string) =>
       ({
diff --git a/apps/server/src/provider/AntigravityProvider.ts b/apps/server/src/provider/AntigravityProvider.ts
index 988661a7ce614..db7d22a45e0cd 100644
--- a/apps/server/src/provider/AntigravityProvider.ts
+++ b/apps/server/src/provider/AntigravityProvider.ts
@@ -82,15 +82,20 @@ export function buildAntigravityModelsFromSession(
         : [];
   const currentThinking = antigravityThinkingConfig(setup.configOptions);
   const seen = new Set<string>();
+  // The agent can list two IDs under one name; label the later ones so the picker tells them apart.
+  const names = new Set<string>();
   return entries.flatMap((entry): ServerProviderModel[] => {
     if (!entry.value.trim() || seen.has(entry.value)) return [];
     seen.add(entry.value);
+    const baseName = entry.name.trim() ? entry.name : entry.value;
+    const name = names.has(baseName) ? `${baseName} (${entry.value})` : baseName;
+    names.add(baseName);
     const observed =
       entry.value === currentValue ? (currentThinking ?? null) : thinkingLevels.get(entry.value);
     return [
       {
         slug: entry.value,
-        name: entry.name.trim() ? entry.name : entry.value,
+        name,
         isCustom: false,
         ...(entry.value === currentValue
           ? { isDefault: true, aliases: [ANTIGRAVITY_DEFAULT_MODEL] }
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.test.ts b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
index 0c7937a28ee45..909de58cb7557 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.test.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.test.ts
@@ -430,7 +430,7 @@ describe("Antigravity served reads", () => {
   it("credits a read T3 served before the agent announced it", () => {
     const reads = makeAntigravityReadRepair();
     reads.attempted("/repo/a.ts", true);
-    reads.repair({
+    const announced = reads.repair({
       sessionId: "session-1",
       update: {
         sessionUpdate: "tool_call",
@@ -441,6 +441,7 @@ describe("Antigravity served reads", () => {
         locations: [{ path: "/repo/a.ts" }],
       },
     });
+    expect(announced.update).toMatchObject({ status: "completed" });
     expect(flush(reads, "call_late")).toEqual({
       sessionUpdate: "tool_call_update",
       toolCallId: "call_late",
diff --git a/apps/server/src/provider/acp/AntigravityProtocol.ts b/apps/server/src/provider/acp/AntigravityProtocol.ts
index 1eeb0cdac31dd..a91d45164caaf 100644
--- a/apps/server/src/provider/acp/AntigravityProtocol.ts
+++ b/apps/server/src/provider/acp/AntigravityProtocol.ts
@@ -239,7 +239,10 @@ function antigravityClientReadPath(update: {
  */
 export function makeAntigravityReadRepair() {
   type Outcome = "served" | "refused";
-  const openReads = new Map<string, { readonly path: string; outcome?: Outcome }>();
+  const openReads = new Map<
+    string,
+    { readonly path: string; readonly sessionId: string; outcome?: Outcome }
+  >();
   // The agent runs a client tool in a background task, so its request can precede the announcement.
   const earlyOutcomes: Array<{ readonly path: string; readonly outcome: Outcome }> = [];
   return {
@@ -248,15 +251,19 @@ export function makeAntigravityReadRepair() {
       openReads.clear();
       earlyOutcomes.length = 0;
     },
-    /** Each `fs/read_text_file` request answers the oldest open read of its path, in order. */
+    /**
+     * Each `fs/read_text_file` request answers the oldest open read of its path, in order.
+     * Returns the call a served read completes, so T3 can report it without waiting.
+     */
     attempted: (path: string, served: boolean) => {
       const outcome = served ? "served" : "refused";
-      for (const read of openReads.values()) {
+      for (const [toolCallId, read] of openReads) {
         if (read.path !== path || read.outcome !== undefined) continue;
         read.outcome = outcome;
-        return;
+        return served ? { sessionId: read.sessionId, toolCallId } : undefined;
       }
       earlyOutcomes.push({ path, outcome });
+      return undefined;
     },
     repair: (
       notification: EffectAcpSchema.SessionNotification,
@@ -269,10 +276,19 @@ export function makeAntigravityReadRepair() {
       if (path !== undefined && !openReads.has(update.toolCallId)) {
         const early = earlyOutcomes.findIndex((entry) => entry.path === path);
         const outcome = early === -1 ? undefined : earlyOutcomes.splice(early, 1)[0]?.outcome;
-        openReads.set(update.toolCallId, outcome === undefined ? { path } : { path, outcome });
+        const sessionId = notification.sessionId;
+        openReads.set(
+          update.toolCallId,
+          outcome === undefined ? { path, sessionId } : { path, sessionId, outcome },
+        );
       }
-      if (update.status !== "completed" && update.status !== "failed") return notification;
       const read = openReads.get(update.toolCallId);
+      if (update.status === "pending" || update.status === "in_progress") {
+        return read?.outcome === "served"
+          ? { ...notification, update: { ...update, status: "completed" } }
+          : notification;
+      }
+      if (update.status !== "completed" && update.status !== "failed") return notification;
       openReads.delete(update.toolCallId);
       if (update.status === "completed" || read?.outcome !== "served") return notification;
       const { rawOutput: _stepError, ...rest } = update;

From 9acb76929e17aa27e961f51e0b8679d7c0431c8e Mon Sep 17 00:00:00 2001
From: shivam <91240327+shivamhwp@users.noreply.github.com>
Date: Thu, 29 Oct 2026 17:37:43 +0530
Subject: [PATCH 010/146] fix(server): queue Copilot follow-ups without killing
 background agents (#26715)

Co-authored-by: PR Batch Tester <agent@local.test>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/AcpRegistryAdapterV2.test.ts     | 36 ++++++++
 .../orchestration-v2/CommandPolicy.test.ts    | 47 ++++++++++
 .../src/orchestration-v2/CommandPolicy.ts     | 57 ++++++++----
 .../SteeringCompletion.integration.test.ts    | 87 ++++++++++++++++++-
 .../src/server/adapter.ts                     |  8 +-
 5 files changed, 213 insertions(+), 22 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts
index fab0020b7e03e..e086f8e2d1a7c 100644
--- a/apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AcpRegistryAdapterV2.test.ts
@@ -1007,6 +1007,42 @@ describe("AcpRegistryAdapterV2", () => {
     }).pipe(Effect.provide(layerTest), Effect.scoped),
   );
 
+  // regression: #26695 cancelling a Copilot prompt kills its background agents
+  it.effect("never steers Copilot by cancelling its prompt", () =>
+    Effect.gen(function* () {
+      const steering = Effect.fn("steering")(function* (config: Record<string, unknown>) {
+        const instanceId = ProviderInstanceId.make("acp-registry-steering");
+        const adapter = yield* makeAcpRegistryAdapterV2({
+          selfInvocation: yield* resolveSelfInvocation(),
+          instanceId,
+          settings: yield* decodeAcpRegistryAdapterSettings(config),
+          environment: {},
+        }).pipe(Effect.provide(layerInjectedRuntimeCatalog));
+        const { turns } = yield* adapter.getCapabilities();
+        return {
+          supportsInterrupt: turns.supportsInterrupt,
+          supportsActiveSteering: turns.supportsActiveSteering,
+          supportsSteeringByInterruptRestart: turns.supportsSteeringByInterruptRestart,
+        };
+      });
+      const copilot = {
+        supportsInterrupt: true,
+        supportsActiveSteering: false,
+        supportsSteeringByInterruptRestart: false,
+      };
+
+      assert.deepEqual(yield* steering({ agentId: "github-copilot-cli" }), copilot);
+      assert.deepEqual(
+        yield* steering({ source: "local", commandPath: "C:\\tools\\copilot.cmd" }),
+        copilot,
+      );
+      assert.deepEqual(yield* steering({ agentId: "gemini" }), {
+        ...copilot,
+        supportsSteeringByInterruptRestart: true,
+      });
+    }).pipe(Effect.provide(layerTest), Effect.scoped),
+  );
+
   it.effect("settles Claude's accepted foreground reply while retaining child output", () =>
     Effect.gen(function* () {
       const gate = makeProviderReplayGate(["accepted", "child-output", "wake"]);
diff --git a/apps/server/src/orchestration-v2/CommandPolicy.test.ts b/apps/server/src/orchestration-v2/CommandPolicy.test.ts
index 1bf294641a01c..cf982c9699f77 100644
--- a/apps/server/src/orchestration-v2/CommandPolicy.test.ts
+++ b/apps/server/src/orchestration-v2/CommandPolicy.test.ts
@@ -164,6 +164,53 @@ it.each([
   );
 });
 
+// regression: #26695 an interrupt-restart steer cancels Copilot's background agents
+it("queues a steer for a provider that cannot steer either way", () => {
+  const projection = dispatchProjection(
+    capabilities((current) => ({
+      ...current,
+      turns: {
+        ...current.turns,
+        supportsActiveSteering: false,
+        supportsSteeringByInterruptRestart: false,
+        supportsQueuedMessages: true,
+      },
+    })),
+  );
+  for (const deliveryIntent of ["auto", "steer"] as const) {
+    assert.deepEqual(
+      CommandPolicy.resolveMessageDispatchIntent(
+        projection,
+        { type: "start_immediately" },
+        deliveryIntent,
+      ),
+      { type: "queue_after_active" },
+    );
+  }
+  assert.deepEqual(
+    CommandPolicy.resolveMessageDispatchIntent(projection, {
+      type: "steer_active",
+      targetRunId: activeRunId,
+    }),
+    { type: "queue_after_active" },
+  );
+  assert.deepEqual(
+    CommandPolicy.resolveMessageDispatchIntent(
+      projection,
+      { type: "start_immediately" },
+      "restart",
+    ),
+    { type: "restart_active", targetRunId: activeRunId },
+  );
+  assert.deepEqual(
+    CommandPolicy.resolveMessageDispatchIntent(projection, {
+      type: "steer_active",
+      targetRunId: RunId.make("command-policy-missing-run"),
+    }),
+    { type: "steer_active", targetRunId: RunId.make("command-policy-missing-run") },
+  );
+});
+
 it.each(["/compact", " /LOGOUT "])("queues a steer sent while %s runs", (text) => {
   const projection = dispatchProjection(baseCapabilities);
   const maintenance = {
diff --git a/apps/server/src/orchestration-v2/CommandPolicy.ts b/apps/server/src/orchestration-v2/CommandPolicy.ts
index 302bb12f797cb..869851790177a 100644
--- a/apps/server/src/orchestration-v2/CommandPolicy.ts
+++ b/apps/server/src/orchestration-v2/CommandPolicy.ts
@@ -99,11 +99,47 @@ export function resolveMessageDispatchIntent(
   // Compaction and sign-out cannot accept steers; queue follow-ups.
   const target = projection.runs.find((run) => run.id === mode.targetRunId);
   const targetMessage = projection.messages.find((message) => message.id === target?.userMessageId);
-  return targetMessage !== undefined && isNativeMaintenanceCommand(targetMessage)
+  if (targetMessage !== undefined && isNativeMaintenanceCommand(targetMessage)) {
+    return { type: "queue_after_active" };
+  }
+  // A provider that can neither steer nor restart its turn takes the message after the turn.
+  const turns =
+    target === undefined || !isActiveRun(target)
+      ? undefined
+      : providerTurnCapabilities(projection, target);
+  return turns !== undefined &&
+    !turns.supportsActiveSteering &&
+    !(turns.supportsInterrupt && turns.supportsSteeringByInterruptRestart) &&
+    turns.supportsQueuedMessages
     ? { type: "queue_after_active" }
     : mode;
 }
 
+function isActiveRun(run: OrchestrationV2Run): boolean {
+  return (
+    run.status === "preparing" ||
+    run.status === "starting" ||
+    run.status === "running" ||
+    run.status === "waiting"
+  );
+}
+
+function providerTurnCapabilities(
+  projection: OrchestrationV2ThreadProjection,
+  run: OrchestrationV2Run,
+) {
+  const providerThread = projection.providerThreads.find(
+    (candidate) => candidate.id === run.providerThreadId,
+  );
+  const providerSession =
+    providerThread?.providerSessionId == null
+      ? undefined
+      : projection.providerSessions.find(
+          (candidate) => candidate.id === providerThread.providerSessionId,
+        );
+  return providerSession?.capabilities.turns;
+}
+
 function resolveDeliveryIntent(
   projection: OrchestrationV2ThreadProjection,
   requestedMode: MessageDispatchMode,
@@ -111,13 +147,7 @@ function resolveDeliveryIntent(
 ): MessageDispatchMode {
   if (deliveryIntent === undefined) return requestedMode;
 
-  const activeRun = projection.runs.findLast(
-    (run) =>
-      run.status === "preparing" ||
-      run.status === "starting" ||
-      run.status === "running" ||
-      run.status === "waiting",
-  );
+  const activeRun = projection.runs.findLast(isActiveRun);
   if (activeRun === undefined) return { type: "start_immediately" };
   if (deliveryIntent === "steer") {
     return { type: "steer_active", targetRunId: activeRun.id };
@@ -137,16 +167,7 @@ function resolveDeliveryIntent(
     return { type: "queue_after_active" };
   }
 
-  const providerThread = projection.providerThreads.find(
-    (candidate) => candidate.id === activeRun.providerThreadId,
-  );
-  const providerSession =
-    providerThread?.providerSessionId == null
-      ? undefined
-      : projection.providerSessions.find(
-          (candidate) => candidate.id === providerThread.providerSessionId,
-        );
-  const capabilities = providerSession?.capabilities.turns;
+  const capabilities = providerTurnCapabilities(projection, activeRun);
   if (capabilities?.supportsActiveSteering === true) {
     return { type: "steer_active", targetRunId: activeRun.id };
   }
diff --git a/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts b/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts
index d8ac4769e140f..1015e44694c81 100644
--- a/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts
+++ b/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts
@@ -447,16 +447,18 @@ const composerSelection = {
 const nextTurnSelectionHarness = Effect.fn("nextTurnSelectionHarness")(function* (
   name: string,
   canRestart = false,
+  canSteer = true,
 ) {
   const cwd = yield* checkpointWorkspace(name);
   const events = yield* Queue.unbounded<ProviderAdapter.ProviderAdapterV2Event>();
   const started: ProviderAdapter.ProviderAdapterV2TurnInput[] = [];
   const steered: string[] = [];
+  const interrupted: ProviderTurnId[] = [];
   const capabilities = {
     ...CodexProviderCapabilitiesV2,
     turns: {
       ...CodexProviderCapabilitiesV2.turns,
-      supportsActiveSteering: true,
+      supportsActiveSteering: canSteer,
       supportsSteeringByInterruptRestart: canRestart,
     },
   };
@@ -533,7 +535,10 @@ const nextTurnSelectionHarness = Effect.fn("nextTurnSelectionHarness")(function*
             Effect.sync(() => {
               steered.push(turn.message.text);
             }),
-          interruptTurn: () => Effect.void,
+          interruptTurn: ({ providerTurnId }) =>
+            Effect.sync(() => {
+              interrupted.push(providerTurnId);
+            }),
           respondToRuntimeRequest: () => Effect.void,
           readThreadSnapshot: () => Effect.die("unused"),
           rollbackThread: () => Effect.die("unused"),
@@ -588,7 +593,7 @@ const nextTurnSelectionHarness = Effect.fn("nextTurnSelectionHarness")(function*
     yield* Fiber.join(running);
     return threadId;
   });
-  return { cwd, events, started, steered, layer, startFirstTurn };
+  return { cwd, events, started, steered, interrupted, layer, startFirstTurn };
 });
 
 it.effect("sends a selected held message once and preserves the remaining queue order", () =>
@@ -938,6 +943,82 @@ it.effect("starts a steer that missed the turn on the saved next-turn selection"
   ),
 );
 
+// regression: #26695 cancelling a Copilot prompt to steer it kills its background agents
+it.effect("queues a steer until the turn ends when the provider cannot steer it", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const { events, started, steered, interrupted, layer, startFirstTurn } =
+        yield* nextTurnSelectionHarness("steering-unsupported", false, false);
+      yield* Effect.gen(function* () {
+        const orchestrator = yield* Orchestrator.OrchestratorV2;
+        const worker = yield* EffectWorker.OrchestrationEffectWorkerV2;
+        const threadId = yield* startFirstTurn;
+        const first = started[0]!;
+        const messageId = MessageId.make("message:steer");
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          commandId: CommandId.make("steer"),
+          threadId,
+          messageId,
+          text: "follow up",
+          attachments: [],
+          modelSelection: runSelection,
+          dispatchMode: { type: "start_immediately" },
+          deliveryIntent: "steer",
+          createdBy: "user",
+          creationSource: "web",
+        });
+        yield* worker.drain();
+
+        const held = yield* orchestrator.getThreadProjection(threadId);
+        assert.deepEqual(steered, []);
+        assert.deepEqual(interrupted, []);
+        assert.equal(started.length, 1);
+        assert.equal(held.runs.find((run) => run.id === first.runId)?.status, "running");
+        const queued = held.runs.find((run) => run.userMessageId === messageId);
+        assert.equal(queued?.status, "queued");
+
+        const settled = yield* orchestrator.streamDomainEvents.pipe(
+          Stream.filter(
+            (event) =>
+              event.type === "run.updated" &&
+              event.payload.id === first.runId &&
+              event.payload.status === "waiting",
+          ),
+          Stream.take(1),
+          Stream.runDrain,
+          Effect.forkScoped,
+        );
+        const turn = held.providerTurns[0]!;
+        yield* Queue.offer(events, {
+          type: "provider_turn.updated",
+          driver,
+          providerTurn: { ...turn, status: "completed", completedAt: yield* DateTime.now },
+        });
+        yield* Queue.offer(events, {
+          type: "turn.terminal",
+          driver,
+          providerThreadId: turn.providerThreadId,
+          providerTurnId: turn.id,
+          runOrdinal: first.runOrdinal,
+          status: "completed",
+          failure: null,
+          threadDisposition: "reusable",
+        });
+        yield* Fiber.join(settled);
+        yield* worker.drain();
+        yield* orchestrator.resumeQueuedRuns;
+        yield* worker.drain();
+
+        assert.deepEqual(interrupted, []);
+        assert.equal(started.length, 2);
+        assert.equal(started[1]?.runId, queued?.id);
+        assert.equal(started[1]?.message.text, "follow up");
+      }).pipe(Effect.provide(layer));
+    }),
+  ),
+);
+
 // Codex flushes held drafts after the final answer; reserve their pre-steer position before turn end.
 it.effect("keeps a held commentary draft before the steer when turn end flushes it", () =>
   Effect.scoped(
diff --git a/packages/provider-acp-registry/src/server/adapter.ts b/packages/provider-acp-registry/src/server/adapter.ts
index 26a5319c12583..71de22deb5d4d 100644
--- a/packages/provider-acp-registry/src/server/adapter.ts
+++ b/packages/provider-acp-registry/src/server/adapter.ts
@@ -210,7 +210,13 @@ export const makeAcpRegistryAdapterV2 = Effect.fn("makeAcpRegistryAdapterV2")(fu
   const copilotRouting = isCopilot ? makeCopilotSubagentRouting() : undefined;
   const flavor: AcpAdapterV2Flavor = {
     driver: ACP_REGISTRY_PROVIDER,
-    capabilities: AcpProviderCapabilitiesV2,
+    // Cancelling a Copilot prompt also kills the background agents it started.
+    capabilities: isCopilot
+      ? {
+          ...AcpProviderCapabilitiesV2,
+          turns: { ...AcpProviderCapabilitiesV2.turns, supportsSteeringByInterruptRestart: false },
+        }
+      : AcpProviderCapabilitiesV2,
     customModels: readCustomModelEntries(options.settings.customModels).map((entry) => entry.slug),
     promptFailure: (cause) => acpRegistryPromptFailure(registryAgentId, cause),
     ...(registryAgentId === "factory-droid"

From 4453f537ffb662f03a64ed63d62d9ecc8d86921c Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 05:08:11 -0700
Subject: [PATCH 011/146] fix(web): Antigravity effort no longer shows a
 speedometer in the composer (#26929)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../features/threads/threadAgentsPresentation.ts   |  5 ++---
 apps/web/src/components/chat/TraitsPicker.tsx      | 14 +++++++++++++-
 .../components/chat/composerProviderState.test.tsx |  9 +++++++++
 .../client-runtime/src/state/threadExecution.ts    |  1 +
 4 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/apps/mobile/src/features/threads/threadAgentsPresentation.ts b/apps/mobile/src/features/threads/threadAgentsPresentation.ts
index d8dde459792d1..7f560497da254 100644
--- a/apps/mobile/src/features/threads/threadAgentsPresentation.ts
+++ b/apps/mobile/src/features/threads/threadAgentsPresentation.ts
@@ -8,6 +8,7 @@ import {
   type RuntimeSubagent,
   type SubagentWorkflowGroup,
 } from "@t3tools/client-runtime/state/subagentRuntime";
+import { REASONING_EFFORT_OPTION_IDS } from "@t3tools/client-runtime/state/thread-execution";
 import type {
   EnvironmentId,
   OrchestrationV2Subagent,
@@ -166,8 +167,6 @@ export function nextWorkflowSelection(
   );
 }
 
-const EFFORT_OPTION_IDS = new Set(["reasoningEffort", "effort", "reasoning", "variant"]);
-
 function capitalize(value: string): string {
   return value.charAt(0).toUpperCase() + value.slice(1);
 }
@@ -185,7 +184,7 @@ export function workflowMemberMetadata(
   const effortChoice = provider?.models
     .find((candidate) => candidate.slug === slug)
     ?.capabilities?.optionDescriptors?.flatMap((descriptor) =>
-      descriptor.type === "select" && EFFORT_OPTION_IDS.has(descriptor.id)
+      descriptor.type === "select" && REASONING_EFFORT_OPTION_IDS.includes(descriptor.id)
         ? descriptor.options
         : [],
     )
diff --git a/apps/web/src/components/chat/TraitsPicker.tsx b/apps/web/src/components/chat/TraitsPicker.tsx
index f02780bed3af1..79a29d293dc49 100644
--- a/apps/web/src/components/chat/TraitsPicker.tsx
+++ b/apps/web/src/components/chat/TraitsPicker.tsx
@@ -616,9 +616,12 @@ export const TraitsPicker = memo(function TraitsPicker({
         )
       : null;
   // Workflow levels such as Ultracode always show their name; the setting names every level.
+  // Traits the bars cannot show, such as an agent mode, appear as words in the composer.
   const effortWord = effortGlyph
     ? (effortGlyph.special ?? (effortDisplay === "label" ? effortGlyph.label : null))
-    : null;
+    : isComposerOwned
+      ? triggerLabel
+      : null;
 
   return (
     <Menu
@@ -697,6 +700,15 @@ export const TraitsPicker = memo(function TraitsPicker({
                 </span>
               ) : null}
             </span>
+          ) : effortWord !== null ? (
+            <>
+              <span data-composer-control-label>{effortWord}</span>
+              <GaugeIcon
+                aria-hidden="true"
+                data-composer-control-compact-icon
+                className="invisible absolute size-3.5"
+              />
+            </>
           ) : isCodexStyle ? (
             <span
               className={cn(
diff --git a/apps/web/src/components/chat/composerProviderState.test.tsx b/apps/web/src/components/chat/composerProviderState.test.tsx
index 54b68286ee315..84c7c3d8cb869 100644
--- a/apps/web/src/components/chat/composerProviderState.test.tsx
+++ b/apps/web/src/components/chat/composerProviderState.test.tsx
@@ -315,6 +315,15 @@ describe("getComposerReasoningStep", () => {
     }
   });
 
+  it("steps Antigravity's thinking_level like other effort controls", () => {
+    expect(
+      step({
+        provider: ProviderDriverKind.make("antigravity"),
+        models: modelWith([selectDescriptor("thinking_level", LEVELS)]),
+      })?.modelOptions,
+    ).toStrictEqual(selections(["thinking_level", "high"]));
+  });
+
   it("adds and strips the Ultrathink prefix while the caret stays on the same character", () => {
     for (const { prompt, modelOptions, direction, expected } of [
       {
diff --git a/packages/client-runtime/src/state/threadExecution.ts b/packages/client-runtime/src/state/threadExecution.ts
index accf5c98df9a9..ba87930bebbd5 100644
--- a/packages/client-runtime/src/state/threadExecution.ts
+++ b/packages/client-runtime/src/state/threadExecution.ts
@@ -151,6 +151,7 @@ export const REASONING_EFFORT_OPTION_IDS: ReadonlyArray<string> = [
   "reasoning",
   "variant",
   "reasoning_effort",
+  "thinking_level",
 ];
 
 export function formatModelSelectionEffort(

From 6d450a4284852af137b2f3407fddd89eb76e7644 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 05:09:31 -0700
Subject: [PATCH 012/146] fix(release): Linux CLI archives build on runners
 without package docs (#26932)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 scripts/build-cli-archive.ts       |  12 +-
 scripts/licenses/libatomic.LICENSE | 753 +++++++++++++++++++++++++++++
 2 files changed, 760 insertions(+), 5 deletions(-)
 create mode 100644 scripts/licenses/libatomic.LICENSE

diff --git a/scripts/build-cli-archive.ts b/scripts/build-cli-archive.ts
index 47b8cef8a9794..3c74b6714ddeb 100644
--- a/scripts/build-cli-archive.ts
+++ b/scripts/build-cli-archive.ts
@@ -253,6 +253,7 @@ const stageWebClient = Effect.fn("stageWebClient")(function* (source: string, ta
 
 /** Node links libatomic.so.1, which Ubuntu server and container images lack, so t3 carries its own. */
 const bundleLinuxLibatomic = Effect.fn("bundleLinuxLibatomic")(function* (input: {
+  readonly repoRoot: string;
   readonly contentDir: string;
   readonly executablePath: string;
 }) {
@@ -295,13 +296,14 @@ const bundleLinuxLibatomic = Effect.fn("bundleLinuxLibatomic")(function* (input:
   const header = [
     `libatomic.so.1 is copied from the Ubuntu package ${pkg} ${version}.`,
     `Source: https://launchpad.net/ubuntu/+source/${sourcePackage}/${sourceVersion}`,
-    "License: GPL-3.0-or-later WITH GCC-exception-3.1. The package copyright file and GPL-3 follow.",
   ].join("\n");
-  const copyright = yield* fs.readFileString(`/usr/share/doc/${pkg}/copyright`);
-  const gpl3 = yield* fs.readFileString("/usr/share/common-licenses/GPL-3");
+  // Vendored because CI runner images strip /usr/share/doc.
+  const license = yield* fs.readFileString(
+    path.join(input.repoRoot, "scripts/licenses/libatomic.LICENSE"),
+  );
   yield* fs.writeFileString(
     path.join(input.contentDir, "lib/libatomic.so.1.LICENSE"),
-    `${header}\n\n${copyright}\n${gpl3}`,
+    `${header}\n\n${license}`,
   );
 
   // RUNPATH resolves through symlinks and is not inherited by child processes, unlike LD_LIBRARY_PATH.
@@ -530,7 +532,7 @@ const buildCliArchive = Effect.fn("buildCliArchive")(function* (input: {
 
   const executablePath = path.join(contentDir, executableName);
   if (input.platform === "linux") {
-    yield* bundleLinuxLibatomic({ contentDir, executablePath });
+    yield* bundleLinuxLibatomic({ repoRoot, contentDir, executablePath });
   }
   // TEMPORARY one-time Node fix. Remove when fixed: https://github.com/nodejs/node/issues/67048
   if (input.platform === "linux" && input.arch === "arm64") {
diff --git a/scripts/licenses/libatomic.LICENSE b/scripts/licenses/libatomic.LICENSE
new file mode 100644
index 0000000000000..bea77366d7f51
--- /dev/null
+++ b/scripts/licenses/libatomic.LICENSE
@@ -0,0 +1,753 @@
+libatomic is part of GCC. Copyright (C) Free Software Foundation, Inc.
+It is licensed under GPL-3.0-or-later WITH GCC-exception-3.1. Both texts follow.
+
+
+GCC RUNTIME LIBRARY EXCEPTION
+
+Version 3.1, 31 March 2009
+
+Copyright (C) 2009 Free Software Foundation, Inc. <http://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+This GCC Runtime Library Exception ("Exception") is an additional
+permission under section 7 of the GNU General Public License, version
+3 ("GPLv3"). It applies to a given file (the "Runtime Library") that
+bears a notice placed by the copyright holder of the file stating that
+the file is governed by GPLv3 along with this Exception.
+
+When you use GCC to compile a program, GCC may combine portions of
+certain GCC header files and runtime libraries with the compiled
+program. The purpose of this Exception is to allow compilation of
+non-GPL (including proprietary) programs to use, in this way, the
+header files and runtime libraries covered by this Exception.
+
+0. Definitions.
+
+A file is an "Independent Module" if it either requires the Runtime
+Library for execution after a Compilation Process, or makes use of an
+interface provided by the Runtime Library, but is not otherwise based
+on the Runtime Library.
+
+"GCC" means a version of the GNU Compiler Collection, with or without
+modifications, governed by version 3 (or a specified later version) of
+the GNU General Public License (GPL) with the option of using any
+subsequent versions published by the FSF.
+
+"GPL-compatible Software" is software whose conditions of propagation,
+modification and use would permit combination with GCC in accord with
+the license of GCC.
+
+"Target Code" refers to output from any compiler for a real or virtual
+target processor architecture, in executable form or suitable for
+input to an assembler, loader, linker and/or execution
+phase. Notwithstanding that, Target Code does not include data in any
+format that is used as a compiler intermediate representation, or used
+for producing a compiler intermediate representation.
+
+The "Compilation Process" transforms code entirely represented in
+non-intermediate languages designed for human-written code, and/or in
+Java Virtual Machine byte code, into Target Code. Thus, for example,
+use of source code generators and preprocessors need not be considered
+part of the Compilation Process, since the Compilation Process can be
+understood as starting with the output of the generators or
+preprocessors.
+
+A Compilation Process is "Eligible" if it is done using GCC, alone or
+with other GPL-compatible software, or if it is done without using any
+work based on GCC. For example, using non-GPL-compatible Software to
+optimize any GCC intermediate representations would not qualify as an
+Eligible Compilation Process.
+
+1. Grant of Additional Permission.
+
+You have permission to propagate a work of Target Code formed by
+combining the Runtime Library with Independent Modules, even if such
+propagation would otherwise violate the terms of GPLv3, provided that
+all Target Code was generated by Eligible Compilation Processes. You
+may then convey such a combination under terms of your choice,
+consistent with the licensing of the Independent Modules.
+
+2. No Weakening of GCC Copyleft.
+
+The availability of this Exception does not imply any general
+presumption that third-party software is unaffected by the copyleft
+requirements of the license of GCC.
+
+
+
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

From 88ab83e8bcf0f34bed9ecad5498689be3c99ced2 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 06:07:08 -0700
Subject: [PATCH 013/146] fix(web): reconnecting notice no longer shifts the
 new thread composer (#26958)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/ChatView.tsx          | 10 ++++-
 .../src/components/chat/ComposerBanner.tsx    | 20 +++++++---
 .../components/chat/ComposerBannerStack.tsx   | 37 ++++++++++++++-----
 .../src/components/chat/ComposerSurface.tsx   |  2 +-
 4 files changed, 50 insertions(+), 19 deletions(-)

diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index de76f47844bfa..665bb2fc5f5cf 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -306,7 +306,7 @@ import { useThreadLinkedPullRequest } from "./pullRequest/useThreadLinkedPullReq
 import { useProactivePanels } from "../hooks/useProactivePanels";
 import { useIncrementalTimelineEntries } from "../hooks/useIncrementalTimelineEntries";
 import { useRightPanelSurfaceClose } from "../hooks/useRightPanelSurfaceClose";
-import type { ComposerBannerStackItem } from "./chat/ComposerBannerStack";
+import { ComposerBannerStack, type ComposerBannerStackItem } from "./chat/ComposerBannerStack";
 import { modelFallbackBannerItem } from "./chat/ComposerUsageLimits";
 import { ComposerSurface } from "./chat/ComposerSurface";
 import { resolveThreadSyncPhase } from "../threadSync";
@@ -3516,7 +3516,7 @@ export default function ChatView(props: ChatViewProps) {
                                             : projectCloneSendBlockReason
                               }
                               isPreparingWorktree={isPreparingWorktree && !sendQueuesBehindSetup}
-                              bannerItems={composerBannerItems}
+                              bannerItems={isDraftHeroState ? [] : composerBannerItems}
                               resumeCompactionTokens={resumeCompactionTokens}
                               keepFullHistory={keepFullHistory}
                               onToggleKeepFullHistory={toggleKeepFullHistoryStable}
@@ -3682,6 +3682,12 @@ export default function ChatView(props: ChatViewProps) {
                           )}
                         </div>
                       </div>
+                      {isDraftHeroState && composerBannerItems.length > 0 ? (
+                        // Out of flow, like the headline, so a notice never moves the centered composer.
+                        <div className="absolute inset-x-0 top-full flex flex-col gap-1 pt-4">
+                          <ComposerBannerStack items={composerBannerItems} detached />
+                        </div>
+                      ) : null}
                     </ComposerSurface.Shell>
                     <div
                       aria-hidden
diff --git a/apps/web/src/components/chat/ComposerBanner.tsx b/apps/web/src/components/chat/ComposerBanner.tsx
index ef07497171ee2..0710f2534dada 100644
--- a/apps/web/src/components/chat/ComposerBanner.tsx
+++ b/apps/web/src/components/chat/ComposerBanner.tsx
@@ -33,27 +33,36 @@ const variantColors: Record<ComposerBannerVariant, string> = {
     "[--chat-composer-attached-outline:color-mix(in_srgb,var(--warning)_28%,transparent)] [--chat-composer-attached-tint:color-mix(in_srgb,var(--warning)_8%,transparent)]",
 };
 
+/**
+ * An attached surface tucks its bottom under the card below it. A detached one is a whole card
+ * of its own, for a notice that sits apart from the composer.
+ */
 function Surface({
   variant = "default",
+  detached = false,
   className,
   ...props
 }: ComponentProps<"div"> & {
   variant?: ComposerBannerVariant;
+  detached?: boolean;
 }) {
   return (
     <div
-      data-composer-banner-surface="attached"
+      data-composer-banner-surface={detached ? "detached" : "attached"}
       data-variant={variant}
       className={cn(
         surfaceColors,
         "relative isolate border-0 bg-transparent shadow-none [--chat-composer-attached-tint:transparent]",
         variantColors[variant],
-        // Bleed the mask 1px past the seam to cover Chromium's fractional-pixel backdrop loss.
-        "[--chat-composer-attachment-overlap:calc(1rem+1px)] before:rounded-t-2xl before:mask-t-from-transparent before:mask-t-from-4 before:mask-t-to-black before:mask-t-to-4",
+        detached
+          ? "[--chat-composer-attachment-overlap:0px] before:rounded-2xl"
+          : // Bleed the mask 1px past the seam to cover Chromium's fractional-pixel backdrop loss.
+            "[--chat-composer-attachment-overlap:calc(1rem+1px)] before:rounded-t-2xl before:mask-t-from-transparent before:mask-t-from-4 before:mask-t-to-black before:mask-t-to-4",
         "before:pointer-events-none before:absolute before:inset-0 before:-z-1 before:border before:border-(--chat-composer-attached-outline)",
         "before:bg-(--chat-composer-attached-surface)/(--glass-opacity) before:bg-linear-to-b before:from-(--chat-composer-attached-tint) before:to-(--chat-composer-attached-tint) before:backdrop-blur-(--glass-blur) before:backdrop-saturate-(--glass-saturation)",
         "before:shadow-composer dark:before:shadow-composer-dark",
-        "dark:supports-[(backdrop-filter:blur(1px))_or_(-webkit-backdrop-filter:blur(1px))]:before:bg-composer-seam-above",
+        !detached &&
+          "dark:supports-[(backdrop-filter:blur(1px))_or_(-webkit-backdrop-filter:blur(1px))]:before:bg-composer-seam-above",
         "not-supports-[((backdrop-filter:blur(1px))_or_(-webkit-backdrop-filter:blur(1px)))]:before:bg-(--chat-composer-attached-surface)",
         className,
       )}
@@ -108,9 +117,8 @@ function Root({
   variant = "default",
   width = "fill",
   ...props
-}: ComponentProps<"div"> & {
+}: ComponentProps<typeof Surface> & {
   density?: "default" | "comfortable" | "spacious";
-  variant?: ComposerBannerVariant;
   width?: "fill" | "content";
 }) {
   return (
diff --git a/apps/web/src/components/chat/ComposerBannerStack.tsx b/apps/web/src/components/chat/ComposerBannerStack.tsx
index 086826cde86db..755d20ba8c6ae 100644
--- a/apps/web/src/components/chat/ComposerBannerStack.tsx
+++ b/apps/web/src/components/chat/ComposerBannerStack.tsx
@@ -7,7 +7,7 @@ import { ComposerBanner, type ComposerBannerVariant } from "./ComposerBanner";
 import { observeResize } from "~/lib/observeResize";
 
 /**
- * Where a notice sits above the composer. The machine comes first, then what needs you; the
+ * Where a notice sits in the stack. The machine comes first, then what needs you; the
  * order is fixed so rows never trade places as notices come and go.
  */
 export type ComposerBannerGroup = "environment" | "attention";
@@ -27,23 +27,33 @@ export interface ComposerBannerStackItem {
 
 const GROUPS = ["environment", "attention"] as const;
 
+const FADE_IN =
+  "transition-opacity duration-150 ease-out starting:opacity-0 motion-reduce:transition-none";
+
 /**
  * Notices about sending from this composer, each its own attached card. Consecutive cards join
- * edge to edge, and the last joins the composer or the drawer below it.
+ * edge to edge, and the last joins the composer or the drawer below it. Detached cards stand
+ * apart instead, for layouts where the composer must not move when a notice appears.
  */
 export function ComposerBannerStack({
   items,
+  detached = false,
 }: {
   readonly items: ReadonlyArray<ComposerBannerStackItem>;
+  readonly detached?: boolean;
 }) {
-  return GROUPS.flatMap((group) =>
+  const ordered = GROUPS.flatMap((group) =>
     items.filter((item) => (item.group ?? "attention") === group),
-  ).map((item) => (
-    <ComposerBanner.Attachment
-      key={item.id}
-      data-composer-banner-stack="true"
-      className="transition-opacity duration-150 ease-out starting:opacity-0 motion-reduce:transition-none"
-    >
+  );
+  if (detached) {
+    return ordered.map((item) => (
+      <div key={item.id} data-composer-banner-stack="true" className={FADE_IN}>
+        <NoticeCard item={item} detached />
+      </div>
+    ));
+  }
+  return ordered.map((item) => (
+    <ComposerBanner.Attachment key={item.id} data-composer-banner-stack="true" className={FADE_IN}>
       <NoticeCard item={item} />
     </ComposerBanner.Attachment>
   ));
@@ -125,11 +135,18 @@ export function NoticeText({
   );
 }
 
-function NoticeCard({ item }: { readonly item: ComposerBannerStackItem }) {
+function NoticeCard({
+  item,
+  detached = false,
+}: {
+  readonly item: ComposerBannerStackItem;
+  readonly detached?: boolean;
+}) {
   return (
     <ComposerBanner.Root
       role={item.variant === "error" || item.variant === "warning" ? "alert" : undefined}
       variant={item.variant}
+      detached={detached}
       density="comfortable"
       data-chat-composer-collapsed-controls="true"
     >
diff --git a/apps/web/src/components/chat/ComposerSurface.tsx b/apps/web/src/components/chat/ComposerSurface.tsx
index 13614b8c9bd4c..213189064ee11 100644
--- a/apps/web/src/components/chat/ComposerSurface.tsx
+++ b/apps/web/src/components/chat/ComposerSurface.tsx
@@ -41,7 +41,7 @@ function Host({ className, ...props }: ComponentProps<"div">) {
         "relative z-10 w-full rounded-2xl shadow-composer after:z-1 dark:shadow-none",
         "group-data-context-row/composer-surface:before:pointer-events-none group-data-context-row/composer-surface:before:absolute group-data-context-row/composer-surface:before:inset-0 group-data-context-row/composer-surface:before:-z-1 group-data-context-row/composer-surface:before:rounded-2xl group-data-context-row/composer-surface:before:bg-(--chat-composer-glass-surface)/(--glass-opacity) group-data-context-row/composer-surface:before:backdrop-blur-(--glass-blur) group-data-context-row/composer-surface:before:backdrop-saturate-(--glass-saturation)",
         outlineClasses,
-        "group-has-data-[composer-banner-surface=attached]/composer-surface:shadow-none group-has-data-[composer-banner-surface=attached]/composer-surface:after:hidden",
+        "group-has-data-[composer-banner-surface=attached]/composer-surface:shadow-none group-has-data-[composer-banner-surface=attached]/composer-surface:before:hidden group-has-data-[composer-banner-surface=attached]/composer-surface:after:hidden",
         className,
       )}
       {...props}

From 20497e48907c2ddbbd9a2ab3c3ef74024f9e4a74 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 06:21:54 -0700
Subject: [PATCH 014/146] feat(marketing): homepage looks like the app (#26960)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/marketing/package.json                   |   1 +
 apps/marketing/public/fonts/dm-sans-OFL.txt   |  93 ---------
 .../public/fonts/jetbrains-mono-OFL.txt       |  93 ---------
 .../src/assets/fonts/dm-sans-latin-ext.woff2  | Bin 31292 -> 0 bytes
 .../src/assets/fonts/dm-sans-latin.woff2      | Bin 62724 -> 0 bytes
 .../fonts/jetbrains-mono-cyrillic-ext.woff2   | Bin 1640 -> 0 bytes
 .../fonts/jetbrains-mono-cyrillic.woff2       | Bin 8872 -> 0 bytes
 .../assets/fonts/jetbrains-mono-greek.woff2   | Bin 6836 -> 0 bytes
 .../fonts/jetbrains-mono-latin-ext.woff2      | Bin 11624 -> 0 bytes
 .../assets/fonts/jetbrains-mono-latin.woff2   | Bin 31432 -> 0 bytes
 .../fonts/jetbrains-mono-vietnamese.woff2     | Bin 5888 -> 0 bytes
 apps/marketing/src/layouts/Layout.astro       |  66 ++----
 apps/marketing/src/lib/site.ts                |   2 +-
 apps/marketing/src/pages/index.astro          | 155 +++++---------
 apps/marketing/src/styles/fonts.css           | 193 ------------------
 pnpm-lock.yaml                                |   3 +
 16 files changed, 80 insertions(+), 526 deletions(-)
 delete mode 100644 apps/marketing/public/fonts/dm-sans-OFL.txt
 delete mode 100644 apps/marketing/public/fonts/jetbrains-mono-OFL.txt
 delete mode 100644 apps/marketing/src/assets/fonts/dm-sans-latin-ext.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/dm-sans-latin.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic-ext.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-greek.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-latin-ext.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-latin.woff2
 delete mode 100644 apps/marketing/src/assets/fonts/jetbrains-mono-vietnamese.woff2
 delete mode 100644 apps/marketing/src/styles/fonts.css

diff --git a/apps/marketing/package.json b/apps/marketing/package.json
index 36dc282e89b47..e37dd8fb7a894 100644
--- a/apps/marketing/package.json
+++ b/apps/marketing/package.json
@@ -10,6 +10,7 @@
     "preview": "astro preview"
   },
   "dependencies": {
+    "@fontsource-variable/inter": "^5.3.0",
     "@t3tools/shared": "workspace:*",
     "astro": "^7.3.5",
     "sharp": "0.35.4"
diff --git a/apps/marketing/public/fonts/dm-sans-OFL.txt b/apps/marketing/public/fonts/dm-sans-OFL.txt
deleted file mode 100644
index a0eedfbf0df0e..0000000000000
--- a/apps/marketing/public/fonts/dm-sans-OFL.txt
+++ /dev/null
@@ -1,93 +0,0 @@
-Copyright 2014 The DM Sans Project Authors (https://github.com/googlefonts/dm-fonts)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-https://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded,
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/apps/marketing/public/fonts/jetbrains-mono-OFL.txt b/apps/marketing/public/fonts/jetbrains-mono-OFL.txt
deleted file mode 100644
index 821a3dac22aff..0000000000000
--- a/apps/marketing/public/fonts/jetbrains-mono-OFL.txt
+++ /dev/null
@@ -1,93 +0,0 @@
-Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-
-This license is copied below, and is also available with a FAQ at: https://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded,
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/apps/marketing/src/assets/fonts/dm-sans-latin-ext.woff2 b/apps/marketing/src/assets/fonts/dm-sans-latin-ext.woff2
deleted file mode 100644
index 6e84cba1949cd6d3c1147a716ff5c069ba0a9ca7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 31292
zcmV)6K*+y$Pew8T0RR910D3$C6#xJL0a`Qw0C~dz0RR9100000000000000000000
z0000Qk2@QxP#l4FKS)+VQjGyWO;$ltfj$OcKT}jeRDvQWNC1RPFM%Wx2nxq&yC(~S
zG5|1x^%em(0we>5U<4oqhja&xJq!n1&`@y#H)JCz_)X{7hSenaA)i(riO_9>Nwe}8
zUJ^y=s0~>5|Nmztl`%9edm0LYD#QO^P`3WuGy-c2$m>T695YdoXI_bZKdZNfYKMfb
z#q8t=+nbnCiSLP&3CRd#Bs3A<Iy#*_@X$<+fDjOs6|KJaWbC3}tUxscN$(&o^M_dc
z3}1SYVF`XpxWn#l7`RyUtlHurc47(vF(DlIGt*qihRLS*o^}&&xa4V5hi0&~Xf{DG
z4OcCp?9FEmcle?+2zJYYqxFhW7((Kt*9Yh{@(pL;yD7@dO=;hVf}@x|%Vq0y0zuR9
z?=iw%Xv;)?;4SG+b|dbR=~tgV%g+FJRHM%0_g6D_ezVueN+-BM2<4nFIU%p4zyAk*
zoB!uZ)WiU+Mnpuy22|jZl4WEqGXLiLZ?3~d`?8nqi(LMYn|&`3g{VLj4-g=TR>s;9
z>wNdqs+6ItN0ZZ@{BGvs)|MKvuGvE<iFhO^9f0;C;o_b~6X+s}Fo@@IuIBxpq-iQx
zi`%;ExpQL9nzQV|iW?_J{A$0f-$0<>c2>xca#5-1KRaO%5~uB~J|uSz(C9;o#=tUr
zEo*WP*p)p2`3i+7d{rGeej-J<{(rjqfA>C6RjN{}Vd#Dna*&yGC&5VF7i<m^FDEGg
zMxXK08*GqNN8i-?sm7TRS+)#`0(P8r4iUfZ9?)0759kx{4*(Z23z&7*v1K6HlBJ=h
zDtbPS^z9ENoV4RN9k-pJ9dEE;1qni@B2~Ej|8#Hv?UHoOp9rD>fQTT;UDEaI9>5@;
zS@}et0Gr%oUyzCqp@rAi9QcTITXPmH@DnB_kn^&)pU-LelsFjzX8|EoKt9~|*2A%@
zC<TNCPKPLV*hFIdk}Lzu_M@EoZ)R32SVJW{iCcD&4wwAiKEsvoL|WO23k3X$tZ$9a
z?t$G80DFu9Y8M1u!bRAtodc91XOia=1q>e-2L9vsYxnIgcqY*rHPQCWAYLMskfFLJ
zw{LGc5RgD-1PrUI*SF^Z9w;nb4b%==@cgIEF(2$^HZ;b+9q$lBF{Hh7cK%JZZ2u<+
z@na)MY9B}1vkmIfNV)*6Q~MRX#)TZ~`Tq|%2_TVp#0<#Q09a}PaKix9>OgXLO-Njt
z<Z|~ylC;_jF%CfK?TFOv4Mpi5btyXJRE1bMSFy~YyUwAy&hFfvyO3KymxW8Wy<hLL
zw*R$O+WGUQ4|t}7)BzR}Xl0)=(E|(D`?oU(JOLmFgzJJr66i$8=v17I)Msq0h!*j`
zUs^t$_vUCd>r&N7XSGfVWo&xd)6;bw1A>aH^7Px3H4ZVit=f{D;;aLYKM;~=ES{JN
z{FrR(C$&BrX2B1^_hl_VUcw?>rg5c;R4Gsor#XH9+nf46kXYU9Dyym}M8ODS1Xq|4
zMpd#aZQuLr3jHH)zUwEHOm9-ALG))#{dmr^ldfTZGq#2rV-%DiQR1LphXcY0R{r00
zEWnk(hQL7(5Fkh>5dNqTK@^BECPXwJf+-Kd5<+k_AcWcw+4>M769_3egn|}A#|U9&
zgK%&`c=#Ynlt7fJfT&UpQL71}MLR^NK8PVh5R**@GX-Ft6f9DLWje6h1lBu&t?uAM
zZ?MxJsKU>VLip8j7*;t2!zP<)w%bl42w)?a{OY7rF4#=Kib66h6U;w>xd-MZm_GpX
zLtwrD%oV^K2h1M8w81zC;}>8Q0b?RC3W4DVeF=Ik&@Tc#3+Qe@-Gtf+^#YJ|z@LDH
zNPrIzENm1S0}~HkoQltgxc@(6ZvmjETQ`epyu334nCE@Z_<G4Z0zHON_~;9GTc6PG
zI630-mIG7*7l1oU5CnI4i3{L@Mwt8yP-INL{SK)4{~Znx6h6R0dRFb?s@#_wmA2oV
z8n+Xj9UIP4l)7}Q;_KtjQJ8%$J*UdURmhK-=YyllC&!ml<4#oJAlO~t>m+;$67m?o
z6z^a>-@XR@mOHDlbsGxom>+7sx>Yx^c}Vm)w(r0cdzj>7|EZ6;jmdmq`S~#YRRUv&
zRrvW#c*(`Tl6NQN4>)a|8Ny{h^$iw&u%wq0<sK4qk3Bx>?%glH6#J4L)Xh*#va95p
zsw(v3#}M}X7|jeXKZJo<&ge3`@__~>Ii(%{@YxU=@ezDF4sIhS#UfvMuRMF4qrQ5F
z`j^w-_P|1?rqwlU^}SV5hkUbO?DZ7!xx-GqoVvFJz(LLjE;9A^AH>d`6ig>MYGr<k
ztR}f~xJqi?pWzUCZ(o^c`xW!mKFuW}E)k?80%TtwqJ4yJ4ly1&k)JCMMuDu&5A{W0
z(!&adZ?*rwIWg|0xS0#Ix=Amyd2)X1VfmfOQRU}zM<*TFdVsgOsjn*p?$?zQ`H>Zu
zb=XJdZ#*^jX%nmC*B^h(0JcGF&DUl5Lxfg4<Q}Rvu>CD>b~ZPL>VauUtfd`96pmse
z)<*}sSaa0NY4j8oXVKbuPh(f-<`_PpU%&Pxe{;8?u^CBg4!=&cyQJ;K*?SMMD&o|z
zQ%hMFA5Hc=fiw>*-fJ7f)G77Q;UUvE-W=3xqMOr`=dPurr|r1I8N?6IN_MX(ZzI_Z
zqguO0bN}9@A-iXvQ<_A=efhy;8m?*fJ!#K%!7-A9krbc8w`#Za(P<3;zy(O0feCon
z;P=})k$knoef1`m%H`Yiu($MoR6%z>qh7rF{(t)Cm$$>A?ow=wZhnS8BTi85bO_`^
z*FyYo^t-SxcKV@XsPl9&*}cNRR_9dj=8Vt%sDR7ZKTi?#aFPU<Xwfj<T(XH&m|&cH
zJp+ie2^suaor6}`hyL6VT2lGs>1MjWzWq36Ur*1-7vKO3;e)sR<7fQgtzrDMdGTb-
zXT&S8Q<vWKjW-B`0u+LE<EJ}q=Vv=te(L#6iTQLbm8@okRPMIXJ=7Ldi)l*|)=<V+
zxRAJ1h-Q>aJUov4`MSTAZ5Qk9K%Kg-yA`My0Pd`K)2F9w>SX#Y0VYK3YU)!!U$HZf
zECsaZjKPRlL=qgh>xRio&E`j8VWF8>6O)%sutQLHjzt`J9v;1O;n<n_-g$~~Tda+E
zrcX+T@)-D8HYqsxnfE671&PPaa}4)IO8|@EXScj);=GQ2aH}Uyw06pYSsTxX@xTr>
zD)C$Jl=lGKim%4MxYch=n03u=U`(b>bTFbl0b54vqa)WsIsx<@?<Mb^TfTAZ3f?eg
zjc%ZavkG?HYeP*z9iZct2<o1~ufQX)#Jj%Zn_73xc|a|P)A6ylx^F42nF&-O<uEZC
z$p9(&gUx~Fc2NmUEMFaLf}<P~sFgrVT$%~x6=Z6*)eD$Sk;LF9^*N12sFy>K%0Krc
zQ3^k27?E;mz^$9`dm}Er#ikUe=trEQ2VJ{UB_!jB<Rs=<BCNVqPB1=0BVqzxSI3~%
zh#Op1U-AMh7DQ;)aH7eqXB=dHg2W(}(Zm0`Ga-z@4<WpOYAcd%dlQra6we}IQVBZy
zyuP%^epMv_J0+}m2{9@LvDsvOPJ;Zhu+jsFO_L%DPx@3eNJJDT*`ZfC3AO<RD+~$c
zj2P9Ab~j@_5+#u?*_Fn+A^{QUdAA62&;iv%@VIyxLs#$7&B&72P%0)X9j0dwkIH#-
z#H5$?aoIecMP&98aPKGa$XKN9O%X~HMFi3;hOE&I5uXO72#!ugD4l1Hl-i;0(0VFd
zspF+Ws$uaWt)xz1O0%vxAo=!O-%j3#1VUzzz}w6M8Bd92Hc3n?qYWp`b<Kh_+5uA2
z|4m`1V}igKQ`qFj_oz&9Mj{(kFWosc*_^COmpH9NqvV95{&f^tPeTwm0L2J!NGS09
zQIP~uq=hl@vV4-fJVQ~)RMX&SX$y4q6%0+3Es^8eLyPYqqio06h}_Smz{7lGN|aD2
zQ$eXpHH}(LinM5F)~S!(kRe`^O~;riAetwoSfr#|rej&}WNE9rl@Gn`?DThp2e1NQ
z>V*1FZik4Fbhg<CkZ)hc&qpKy>9JO%Q~=s%Mlj$sJwMV3;W|k*!r%W6sk!Zxou>SM
zNc}H+TT%dja>+!pu<~UtTDs__d^2ur66#=4HiF_pcDtnowl`ZNH>3GsE9g8q?<lsX
z{VRRHuREUSjpBAyTpUX|m)dZ<>3dvcqu1?HNE&rv3H5G!ng8h-@B06KhI61vpQopN
z6pU}~nGp8OTfs$pR|UoV7;u#|CwX(8>O8c%h=````5NnW$5MjazvbM`k>ye>Y197e
zk$3ee=e}k<|7aSd*bf-SM9KY$E<N=!{d3-NpjFk@?|FxTie2Gd`h<8yH8W8kBTssc
zO4OugV%#VgA8*^-Lrc)3x$)Ta<#cs0-gQtTH~({zaN{^1(cC;8xBPi@ij<G)dTH1l
z*Po`^Tq|}xy<En@n0?wVvPfpUY|b>e+FfbdRl2*2s#gv6|Gfjw+?<xu1Fj5qPOI5a
zeTypdx##a`lhE}erHrY2#Ulf8Eborf?AAKD<(Wqe|C^l77Ejux`9_r@{97)Vf=biC
z`P0V3ord~@5+S`YX?0)n^nHWk{m?nn)csES_$uA+=c&D}I|(A<eQk*Htx+j%7RJ56
z7e6MI4nB^3G`e)EH0d&AM)v4@Vw6>cPg5s9);2xzN5;O4{MRa}sA*{F=ouK9Sy<UP
zIJtOu`IIPAuHq4C$lt3|uR)_GEn2myh|E;$`vO0angSt)8trrMU^LOt)$Q5#^oq#*
zFir~|jFoJjAp%GThiw@ILYD8t^t}*RkN_IN3>3&<Ujv_X@RH?&W(8}wCndcIX^w=i
zFcE-~3X44OWzoc#wDnmcLk566SrBywVa-{Ag|h<L)~6sdQ{+AqfsGJp89*F~T!(g%
z`?w}mIw5m*427aPX*7^c`4I>l{Fw}3frTIZ$j@&RBs<|9Qsjn6tmv7<frlUPpduIq
z1b~v!D7w~st_6EY5zDNCLp;YbB(gUYsAUrnygW93mIWH{Kpbl1h5{JNz%UXP)43BF
zF$V;M01$uy1A!b8%CbTGLJ1)j!6)iTJ&LN?${Yxj#tt@utb8r?l=f=9{JM!$w`KY`
zh+Jth%)NL8TT^ua2u8TLAm}k0TG}CkKjqH0s^(W($AYGzOg7V`idyEMv8h&8Si?`M
zjbs;A%yyLpLZLI20%khVNXJn*5}jzq{H6!-ARd8g>pTb%Q6O@?QUXGD3_DW#Dm_Fw
ze`3|ZT3Cl$RyLIVQw?chG)lKB)v3kMVJwVyqSxGloYJ|R8&|ZrTZ+A?R|8#M-2<-9
zw167zRa{G1o=AggT6xP?WxmKhxjeGEKva)Ys><e-wWz(Sjjb(GZ@E_v96ypFFVL+D
z1FWo)IzQwV`GGorFH(+xQ47IYNwPqE`Ucz!e}qfm08j_1yGT4fPQx$Zqvb7O5ga^+
z2Gm<_BguaWH&Ffz57U*8@s8T19(cI>KY(K8jc1=N;NTL(!aahZ-|SmI3;zurdHCN;
z5-0>;hnZCIgYUCH|42!{z4U9Ysf7Sv%+|p#|5`L~4M6|f=H>SMBmD2dRkQgbsJs#V
z_t=*ge|!7WW>YH9{Qud%_CC$rI<wlzPm1sNi90g-@TI?UALAB2?cR~&Oyv9VEAQJ}
zxOw>Y->-JV=IC`>ix=1aS%0}s-Rs;O=8ybUJcZKt?zsGN_^+2%A@)soZ24mMuRqnK
zJji<U`F{F^k`#xTGhZ6yKR~s5I=A-mqwtXWk=>lwPt6MNFtzHWsN0F9w|<rX>}dV9
zrp&6a(}(`w`Cx`j!>Riew(_7Ar7Moz=SHcoHfe@j=_|2%7d7gWrb@T4m4~gaR;BYF
z3KoAc``d3q{Os1lgN=`B>W|#Y|G0Ivo&0v<tA*_#`GX%Ydx9R;ruE^~Ug}EB&ziq5
z&b}{%D)N)Si!1MSA^q>BGyHjP?L)%c%2Ve%<NAAicGMp??SD+_D`a!3&)QiT{QD=d
zRIIJHva@enNNq>*pF{dNswn8wlJ6c>-WPN@z&1P^7eCx=Oyw!@dnb)&ee93Cm0SJs
zLqWO0_4Bvc%ELw!t~i*#D|c=-EZ20h#L5?L@X8Lxz1AW=^!YRn`!7@=F$ewu`0wGl
z&*qcYCN77Aa^q>+a!<Ww%eT{CN@;d9vg60oU)cM*nu!h@Te~leavun`pXF0#%)d<y
z-8^1<+uT$Me6jTQlY`V(nAvjRzdTHRnV6}EcxnIj^TlI~;H}~@Z~b#EoVdkLsWzq9
z-2?W%g}qger;<?Y6*3Q-+;9nW8=94Wyp&o0OjaidB>eI395?QK*ZlcHH_Ty*Z>V=C
z|AaUD13(sTt?LFruKCaYY<QV!_->zvockgO4yg*b3=Y(j<py-AUc3w^j0EL{R)QM9
z;YB(uGpRj4ka3p0{r|_O(G|)53gD%@3aYhBEq=;twb4rti2_xr8GE}15h5(uQs0e`
zkpJEH^8tx~B2#sZwP#hTQLh=6*kYGsE-H7-B?2HZ@IuoOLa-x@=#E&#cf=vPJs$Z`
zIvmD!_$X=hOI4@?N&@nHpIR&58k7ojM5uvNBh?*I8rKo6voZ<#*d|mxNx9LL->R81
z$oZT;vmy0QraF@C4zBqDTzmNGh@3B{Uzu@##BdzsT&(Oa3p@Ao7qdYWL^-38s?|^p
ze>v_<3Wr00bggW4Ap}WcBKgc<4mGjFmzqq;(yYkaij*Aj)U~=X5N&8X^{KtZ{=+uz
zy!#pVlzYab?NDN8X&{cIGMPeVGmk~Fr!@78jyDz73R=VK_TTNwd-7ZPgGHSx;P$G_
zS6;C@*-wD^7>w-OKjKSb7X{$#H2|Esdie-&`j1;%fPl)DjM@!8c_enk0cU;c7`Z2+
z#6bBk(`JYz$^WBiFc^kGa123W1PY^&8Ofh9sEkE7Ns#eqCSsT@*aTswi7-RB=_1XP
zV7@qW#h4@BJh4(Nz_bL*GHffPST5B{91q}n2+t$ZJ&f;BnVux{xC~Fo_Ox8j%JB@5
z=SjRs>;*DwNUf%|g~~<>>uGGJw1L_tdfS+N$iiVKm))FpAuvq7m&mPU^Z}i%3`SUO
zXEW-U!w?{nLJ{J{KUxux*a^%x5PRh2pc;$~meU&|UU7gRl|_9GENS-pq^dUnpZ5k~
zMRNq3c%qSjYn!8dI=wl%Ydjh5{~2_`5y0=jBgoShd5eA4^yr0=)vMf+)_tL%XWda`
z%N2O!l1wW40tZ1tRMp+FwF_H2T~3hKpr*ZZl3rtvfGT{2Pn+5dCIQk?EH!b}FKBwA
zAW3TKS~fwQc@4uhA}yv+44=<m@U>{^6w~4j%OAVq8LYR?H;`|;6ghL5-4W9-c=TCa
zDAaixYs8r=2K)h!!LhinXv+!>MeB0@7{i|E2~E^nkSfzOjG$#juX3y%2!@|r4Ic=W
zY{KN~72~p{W6LAn@JjcwTdS2gXd;jkJ>&A|AcsAdL+5##a;t2sVm+IM#&P>J-$#g3
z&ZRkMD`FF&A&%a?%(?@U6KNl_b!wF!4tuQ{i{QUC(vXDPKX-+F<9S}&|3)9H*BLD6
z1Yf(6+c=hu%(O5n+W?eEWh;|S6*GE7<3nxUjt&<*J=5(WY>t`y<T+v8)hmrby+&&4
z&NO9^DL9oNGGP)Dsp#6EB!9*Y*s8&{xpkh>jY7hVA|(9cJ?QRuZg4kM>gqWA8FbQl
zvJf{A8Zv1nI+ED_Dp9o?VVYeNA(NGU3X~NF(X;-@(1XTbkiyVD_i%8c?xy&yW8CHz
zcDNacn-NSdOjd_<0D3OYdbFN>@`~=+AB>($jo!7lh(`n3gVK_jI`?)c_Dk-ieDuKw
zGtoq^A+y^4UTHZ}k~umq6XJvt8*_zBEaJFWtIBocGkG&}bg!$|gSgn8x-3aPM&ZM5
zAbHz;oxn)XPH6N%I`G%CccPt~#xu5@G}X58$Q(Sr=Knry-a{?J;**zjzG;rlyp=a*
z20abBKJfY)WgjLxnE~-TGiY>D>{e>o?{;)cHfMsYqBh(j$(v^9)Y}cU*N(95%G1>|
z!Jck$_719SG?!Fd)Lu6(>m}92yzNs{IYF`<`n}fA&V^QbAq$x+vnbHz;XyrV|4Ov_
zHg9OY7YBTtt676G0dFxXSSchdG#gQJn&_s4mPR{ylK)|PLTI~fY?d88lrPbA0ZyXZ
zF#)1h>B@S%=>V>W9&O(Fbq3i%wV}*%X6s-;nXqWe+TPJ~yTL-HFS@B{6k9fXgeP(m
zSO=j~;`pW>KDjW|RTeSj?+H)|vXro(Wp2eY9LwD}Y`=@qC3GHHNX<t36>AmcVC^(p
zIVdMGzWz8U_~H+W7NQneYY=p-$`xx|4Qw{AIvmEF(Sw;r&veBUwB+O~;pVRz!dD>|
zGmF=(uv$NTiJ3%fC#mE6WFbuM<xGWvyo8tk=m~I>PUfLXwV0ESpMw`e$X3!ID?M!I
zip1Dr$GTApnP_ULl3sg1u-`F5fyI;OZ<hzG?@8S5vwYe5Ze1A88(EtEZGvShV+F3(
z@J;)-P&7Xjh1eyhccStCU_Od@>!Ce;P}|Gdk{~Zcp^H+r%xfHJZXSi;rmAmc2ffZ0
zC@nYIG>wY9X<jb`RB3GG`T!rj`peH+z%X`XaEo2PskK?Zaf@xROj%mfC(jsmx-%yC
zp*5vI7}WRZBeFIAeld(4RF?c%s3?3@q68mB-zL<0lX{htA_5|m7r~L;Qkt31F~o>v
z3AO6jD)H2c0<qa6rK80}t*0}?P(0tO8)<GgY@6?beoEy^uVq_vll6mjzWUzH?TqS*
zn{`^7p;M7R)#J&Z){1J{J7yBvKbFV!8t|PkPnzqB0@h3YX8pRCWA-r`mj}p{%amYP
z4;!AELNAZ+DR3m#$8k~vREZcnrnI(}&y$}hX~cvO{$G2e%3uv@%{ib#ffk8IH=!TT
z73k-)y9FS$pG%h;Qu%M5pJi%T$?urv!Uno2<;%U6k>;k6Tkb2b<V+(?&BCj?LaS+1
zh^BeH;2KelS`kM90{;U7hOxWWx@>_@lq)Q0$gwSmk6E8vx+Qm7<veqdA-_PQvCV}v
zilHMXze?_AGZmVYY@R%ZnUL(aOc#E}6=}4id6|w%z5=Zj<T&%((LY?Sn|C2e2_H3U
zLqCr*^3!x;VWzt-2X<m>8k!nx`MDO9R~ITvHdw9NF7Zd>o5=ymJi9QA&zcVDXCF)2
zdSOn55*1VyXTh%@Un&1qe$@v`il#eH*;{hTep->{FtIYT3@naAaoT>W<oTO3J$Z0_
z(`oM-7wmGCZuh`CkN48)^6hfiC5Qi3+QG7Y6|k?O^zK12-0}u~jrN+nk>93;r$%B*
zV-;~SGc{#Q>CB8!)WYSy8FJe4RPH39+9%|A3yeCf2UgwRXrig&C(kHLBoFgOH$+Ac
zJ~I4*P<YZCUX^l1`WiH&LqVqd&*E|{%9NDcSC3v#i<EAb2(2r4h<>Y!idChde3l~z
zth)FAuZ8IC=0X;l$Wa2DqG?kU4q0u5gW-#c#@k;OXm)NhW@n{qxNHw94Aqb9OibFb
zwA>kB9ISv?imFL19yXc9gH0-Rfm^VNVgFK(x4~nhh)B=~wS1PhpkNdb6Y`+2BV@nP
zLs6cLFY_wRVsVsT3aDhrX5+2Rs5;clTA3<<D^FFWa7>aYImfNyqz1kf=-~!Jh-z>$
zW73A|lvJ}g3gx&)<w)6&ZJ*{T4!@{9Qa2`u)LG%oJ0JWO@W}WkB_o|H4M~koEj3^+
zS^VX!>!FpU#_%ThmC^jvCmCw2gUOWhQ`2?TeDgx7o6ogpWu@EPf<l=~z_mpowRiEQ
zirk;Y;-7M}<atX2sc6ZKFxBUUz}h44*`M>iw1>hbPex|GJuS_rF0#oqs7Ay_lT&or
zY%o#nRCY%=gojhZ!(wJV5Y&eZ@LxuxQED&0O%LEvqY_YOf(?fO!!ILm|5gV9bRuu-
zm-a6~eL9A?fIco$Y}t9`$2V1vu|l&`kSB6*cpjz6u2LzKB9<&ES)D1^G-ca_Fl~*F
zV+uvvhUO31>;;4EsJ5sz@&@g;f}u7Cb-Fe!)r%_F9!*+0SD74-0!;<b-F}V1l>zO4
z*3e9MX3W$}n|bkorB4;7^7L}2=+hxi!k@Ew{N>77M^VPT9wvt?vnPohl?I~PrdZF<
z$chcE?tie|60;wl$yYm>K;z0H6XbckVs$ZjhIZy^^=cl^%+J>VhG_SC6~juT{CObT
zHHWo<!5NNh@V9r4z`#h^;5O*k=GbSQQ;)*1=;^=o(xNYa_vpwf*tyCjc>+vj{ETST
zbpM`Vsh}<@48p<#!XhTZ!)^oTEKV5`^E^v2pXhEdSK(BWy^2_7lDy_+Y|0A!H3{@p
znf6S$#RT^(9z9DSgf_y&83K9+PjI1u!nBf39&vV}Hd;}Ay37+Z)9zeSbZ$%ewV%fO
z8YBlqqC+iWU`<9{H7=#ga^2dHDfEeR1-|+$`@EW4=&dRCDYoZxZEAJCOg*7~zOyOS
z)vZ;_$~z~`2{Op0nx<+ZDx{*;Fq>PNqelyJ)rCf=tgW&BB8ibi@5_(L2Z4$4DTDqQ
zgMNd~xW0&k&*V>8F(12*4+5uhPj&E6*f$jtbF(~&)ytFAtF-P_AIsp<vI=5TBCIq9
z-{#gj=$ZK-k<T;tg16dWo@Sm!<^@`Y3>IqAzkZcO6*AZH`RkY&)FkrPP;cUVpP1is
z(yq=Q_^YSFATo*?78(;383>=f5}EUm5m=Kfs7PQ&CjY|-s$~ky8Bky7D+GL>UrKmo
zZ$2kYe!2hoo<54oH8|0%KnVjd1I3Aiun>Hrpg&h-UPXzEeO{LcJs-zd!xO^1>=9Mb
z#<)wgP*Nn7^>^-HwSZ|O?1hcrwme+%aHC(R{1G(v+vfi4L96!fD*Q}QS2U;#-9!WP
zm~^h_PWndZez|iu&y_kw(93Ps_j*t6&ly;<G>1Gp*L}UrF<BA;`A@beI|x6Eh?b3X
zckLTYFZ1@;5*6WvoV`co{zws5UG6UQtueHfMCX9ywk+E{^_)fdkIS5rMLBz4jNShw
z=I{9dD%lPKe<|lm14^eNSFKG@tzsST-$a=HZ7|rjYRqs$RJHq&4*+SXRbB2X^j#sy
zy>_6UUg{ma%p-EEQ)r}@`cW_QhT7*!&(8UT7Kaad!Kdgr<Pt5>0$0$cy4-4}?{Y-n
zt4KfWpuXElxyLGW)=Sf;|CUmHM{4a(cs=g*2FC92L4;gC$~|61-|AAIK`-;1EO7|~
z$8Ip=Ig8C}rE+_iJQQ+ueBSU}2le&VwH2Fi!05Twmc=B6apespO3>F^F}B!~2<|R#
z+<0XiJJsBoUt;<e=S4Bk#yuOpZdx`!-<GR*PV1iS9~9#@y#;s{mkWJv7v}}aur##W
z5H=H%umV@bIBc<X9;Ei$*xLsUu0755^+x1Y*YKFO!T%y;XT%^O@1EkPnw-_UTi34%
z*gD@n=dgDv9!qo9A6DC}?OE&`yVt)w1@t17CtBE*pfn0?5lyTXML6sgU2{NMy*(10
z>Wzv8xyh4wS6`h7eO(a!*O2V0mG{xTmOx)+RBp1e@>$HTInxB|H=~d<&Kb*O6Y_5>
z7HD>O_>p0~?`xOEe$SKEUD~HE^{15W0su&ZS~50QVz%R(t6x7;YHTa?fYM<>XS@nx
z_R*CLKut*JCxTj9V|7w_A&5%Hx22Z{X-Q0Z%tpr~_tv-=>qOMi?T%_M#3=1i0zS|E
zpfe%a>TB(v>LZZL@wWVvlaZ0&zwVU{Rd;<Ri;$;MK(Csticp@75CsZ28AHrrpN`Gc
z6`7Pkd=s9_b7ywl|66r3-q@3I>`a&_w#-0;xH2di9p#yrLq3gQSyJ^}W9N^8{%&k$
z-Z?!@01TvRhSA(4!SBP1i<^qfJNuJY%IS>m)lYD=^YtE91V5Adno#>>rg~3!er`Wf
zcTORxquvwVpW&zQo#lzh@41O@VK_nk1X$V#Dsu<v&5%?XZQ(EXp#tmzVyj;j_Ib1G
zz7DDLe@S?p83(B?QXqG<0_uGxMmtrfRMrHz?(36U1eJjV`3c@1wNahuR9!d~wua51
z>L88R1OwO6|65F^O@f~TnOlDlbndU^m`WoQMeD$;`U&12;po}R-WHXgIASh*TsYLf
zH39DzJx36T>+=&LLK3y(u9fc~a_@EZ=vYBAfgl$`;RD$|R}1g`r{bg}abbQhcbyxv
z2MhKLmxbGi_gj2{kWJV`_?J{jF47rt0(ma^1;y@PMco|`6wnuNJy09CGbkXaC+L@8
zS@2F;0PO(1k^U7!$=DM@3mFKx9$FoS3u_AdDm*8mD6%4QJc<{!CVDvfUQAKU!MFqQ
zjQFAW2MM}FUgAg+DXBZ@7v>t~+vMuxPgvQkO(~d^TWl43Zz?@?h$H5Vq><9v(|+LA
zaX(AXNMFbQP2duo6*99%vPn5xa&fs0xu1$wivE*)UvRiEtZ+)<1F2qmRK7+Pu9~X4
zr`BqAYx}i77v&di(~)&;x*zm!4Hu2A#&1mm(*`q`Ys{ZolCAaDFKpSi&5ktZMHkz(
z%=MT1A5W?0iZ`uza`F9=qLQPfk!7^9;j%~N#)>5se^vS_&s8N?&98b<{iw!RbF?<9
zc4nQhZcW|m`m*|04HXUJjl9N%jgJ~1HLYwWG}kqsYjL&iXbWh2++Nv!q(j#6d1qAT
zVCTUuVpnO`)ox*TL-&t8%AV2Qh~EC*{e6<YkNPqFh5h~gX9ws5T?6X|UJbSk{xBpS
z8XLCyXaQhJ0KO%FYnqp9nwM|s!vf$6z)}N$*Ord<Gi^A!B+~E@84$YF;M~;DMhkTs
z$lSFQlY0z49I#mVU1o@`A-I8L-%COMtx~}_h$xe^k=NwZ^oQx#4T?iJRT7ZcQ5qLL
z$%5#urp{MRtp<9SrRO0S)y9Capw=#{5?==uj0M${Sk&=<4K4_2Zq-1s_B22#6px>-
zO-$D`3xvEhECMh=@5A6Z!q*jsvTh3?6k$C>Bg#Kq`CsjAv^2E_Da!h@HqbAbhi0O&
zvHxoyunrx2-p5`73(NW+=HvS4slO3u^zd0!&HUKlC~HT^e^Z<s0pY}L5|QSCpwYtA
z#4H`(7nGDW8M2=kCRdRnq=)WP;~`NR<q=?%=!B)d+erEQl$)2Ob1oMf@<t31H-s6&
z3}Gq3duYZjXkiOl7yyfeJrCBM0#UcH4+TmXX1JXVe3}&;GguZVIYvPZQ=I`N?}31@
z1werWhyV|du)KP)u*(C5#KAb}M*d?3+wiy%_a#wRu9*}g4xLg{ySV^xaWu`E6vPrL
z`Huh`MoKa-Aee|!O-4Tsk#G!>K5eSzB--wK;6;}S-uA#`40I^_*(@4)%h%?E+HuH{
zi0%%fdi?62pHYi$U;js`<?!Iu|66(#9uoVHJ0p7ID<AnM^;yNPA%($Yns08i^>JJk
zHS#PZJSLp#tSX)ex&V|xC}FZmUYVa?5&Tv7BmrG0{SwCw!JE>&!{!W<ftgug=Ra-7
z<FmQzEAfhx#t<S%5*f_+g@Z~d|9kBL9Q$j4Kb0hrdVTs~qU^#pH6CCB%MSdM+wg(3
z7=IAx7M3MKnD?!wXeBALXxcPA=z^PQ*~F$*jn$V(!J@z!bYND<!LnGCwlslv<doXF
z^-<%Ls0|4(R7ynmKDWBw&gLqPK+QahsqprOCZNj?xk+S3T`3(|s2$iOMCCnwI#oQx
zx~i3v%@=_RZQG1F6cXP&H=?Ri;}tL7cZPm=P`d5{hwR?L`QRTs0-i)xZHby+nk{tU
zg%a|H%DNX_x4qgtbx;`O&}F6c(~7(Q^s*~X%USaC<=n$BQK85!Bi1oGpy|xp@HXqy
zTNaKFZ`!u7v1)}hBCV;BS5}v^_0&sD>eiE+46IXgZYpF3qI(bkg%Wpv4ni^Ear|VR
zOz!dT;lyeca#mN{*i%nsCNI<ox+zR%o!VH`vKe%xzmuzEir2;5(|gS_wMOPpM^H@J
z=Fh8$Hk|UTcFUx9nmlcz{|F~0Qp{GYtX?XdgMor|(nb7=2D0)cOlj*+7e=*>I%=#3
z<HwAFWVlX)3p5C8Efl9f0}*21?AO6_AWGCyLkO9n!VUle2Z8~UV@1G_=OJ;Dc3RW4
zslqg{(5Q?GO&b-OUQ_`mQGyE602$<A9Zl0qeRo~=y=iS;>gdOtm@Q)kVLqsU9O~?|
z!-%m2xDw>y6$T$D!CTBK-!F(lkm0InH9UAG#@znc14l`5nGaPTJPeNxrbm|Aq_xzz
zH-=^4ht;)2@)OlEZU5pLq#zKa*Diko-pELPVfU<kNlVl;QvF2SjC!u9?3svFq0e57
zO&@BbJ3%TtI6q(bF~zqvbto`BjYzqH<2np4#Dgft1#qcRl7q2<6`p|-5r%7!V1<G!
zfGJj2d|HzHCPievF)_O_FuTbxv%pm5x%+G~O|ogHXYSu7)|5A4Qvp&I=8zfSOh^YI
z1I#o?8#sfTTf$)Gxs)M_xR=)?KTs+&yT84l{h{&UU(i*~dXkC?=Btc-yjXv$FiA&9
ziafSenz8FfKh!5RKJB;;K~Zm02*x*7V#dzT>j5le{*-z5!PB7I`jhkv-tAoj^R3J-
z+MOpizRlDI$z2deUB7Sf->GPGc1GIjVZzDpd0OKXxmc-O^v3Zz)`VHSdtUl4e(b4<
z{bXI&XJ?B|GE@2Yu5p2*Av!{IAics-9K}%_#Ze4h&`;6Oi9D@s;;y3LY>2gz!D~4#
z7(Ytqhtec--2Q9-yYz^Ddi@&Y0#!G+-u$>H*Pam=G8vIWCQ1HuWz$oSI9QZmfa4l$
zQUf5EVTleFP_-yS;yBY>stU=GCu34E1nJ%6B~B5r81X73&IDSN7o&*)*VCawNfS}M
zr19qHn8__m{hZ#X2lWB>n4ZuF^te8t_vwASEcil3A!qCR;w$Rg&dQ||w%W>}nK$*@
z`J4`CO|RC8edI&T-Ze{9@C5o?bDauWw0an-CAqjOifBX#vSYiB^%XVFsUO12{i}oa
zET1`rl5)r!Z2JYrbjOF97hXBfoInL@b=@2qncW5IMJUTPS|_Fc5c+0IL-Tqb(5nyA
zoQ3r|<p9^92i)mcl$90LdxrGYzuc*GM#r<RauDbFt&J=HgZ+y0eJM_Q00OoRddP6U
z+nr1&KUO1%G2-LfjdN9=icnbViD<6tU@50j$-$l6%)bl^<hMtEBK4)~*Y@B7-Mn<4
z3}(ykUP_7cAlKY&i0!@(9AeT$ET5Qu0_WU2ztj=*(uqiQ{`bHBOIUp$MWazc$SZ2s
z(Roo6TghHgbE8&)mkLFeHOy2C-LIUiODbHH+2=x)2wIlbc?)^SMF1jp@Dm*eZZMkX
zTJJHhbeiW43L-dc!)Wm2`m)o<eGIz@qYG$b+tkid4>9Fj>#}5mVrDl!XcgX>rZL9-
zsLX)N9V<hDxxgSMDXF$FSz>OXv7JP%WZ|g~Ss+gm!Do})VO`Qkjz5gEy2YXxRGjwL
zp5GLQP0;K=sn#vzVHcKdgz@nOk-2)$^tyHFdsMbSo34%8BXM{jT2!Sn=dU$Os^w!=
z1jt}*%8jQQ2sn5t$!qfrC-zPjjy+2?E?dDi=XJ+JHymO>(D_QS!n*-#_EkAtsUFv8
zEJnw7o<^1POlc@kSskMcAu&Qq2-yexFgzSGM2HW36jDKm2|VYNP%P<8KHCJSMvphH
zBi-k{uyu5C-XKF)ek7+d65iL$01~KEWRwDA`K<5rTxa65)M0*#Wsb*jBkTdpGLhJ}
zc`AVq115(1w!?8%RgPPW5g(bS-sr{axZNxH^Jnba<xj=iW>kaTV+E_2B}j%`ob#6r
zcr_Kh`(efz-Lr7@*vp5t5w~m035tDJ&h0|^7x{M5-{s2kcjuJrPt^D6Z!G_*TBX!B
zyokLD)JVo$Ioy5wo$xj*!{gmUhgSZ=-Z(SWCu?eNH9r+jGTX9`V<3~)8+lh)?nO8l
zC~F{Nqb&%Q&6^ZIonK7)H7hv87~&R+s)AzaUy2hLDlF%cd<?(e8nYa>sOSSS0rCaO
zT=w03k!^zc7@eY&UDKakpm7~SxALb@wQTx9$cmc0(u|S#C=Y5^a{d>6%nqZ0tvdzd
zcVjqMz~N&$|4g|GcS5d7A{>vgP6dEKK@Up~O^1pMa=YUw#tRt`z{#sn5gZLmF7>_h
zSKmz0*F>S!joX+2lVLiT4x=mi)mFhjZaVFC$Lt6;L5wiFT4r|;#Y6vk_~H4xw)Z`T
zZQQXeJGVyU@9*Dy-_a+2`SdA#_x3WM|0iHlzXWR2n^r10=m=~F-9E$nimSdI?`3%6
zT3Jg9@3&v8eveOa^?gxRNli^o3e8E^ewP#uUdBV6Dv-*5NJE<S91Z=66%3Cjmpp-f
zESPx@+100zSv-xCm>i1drp2iG6uf#%ovS?rKif$kFN95L-}lMU;0W8y5$JJLO_3BE
zmBuac0oJ7sLME`p9sL9!zd`|y5eOrs<AV$@FrNA?ge>WXiJ`c`p}4~h2}8n=P~4CZ
z{9Zq$kaA91OJRg)4t_Olr7;5RIgIQevbF-Y!cIwc*Yj<ZdA!7nPf$;=KR6xMyoQ=#
zcw;CKj!i0X9X*xvvTx%iJ%Kq^c<sx_QY>p0{tn;Nl0s+%r_RT6Fc`dl?Z*8)nqU+=
zo-Vs;YwTlL7OEND)-(sFz2+)9r;8FEe${vXa#c%C0e_~C;b@&zzpGM-mW-qqL!ZXy
zxSf{b%AkINZ;9lE00INK|8_-)Bu4Pmt@TLQxHVf{xdRtMEDO<XHWpx3xNJ6Ge0mL=
z|Gv!qW|<GNB+$g&(Asmqx`;qaKc45_KgW@u7xD>8<A(lpmgwcFQy!Np4u2*2>g52@
zD_xocTKG2(y<MDC9Hx?+_Ys_Qdt=oRMylCJu3bHdG?XDMv;99(k~VM}-kiPnR~JSs
zEplsVilaO)m<f_;qY&3ox&!ftRVa*|Au4DsTqOk^f+q2ZZ@}^wVGa&pz?r}JZ}2vx
zUQJcoCS=<PdD|NNb>#xQv&pn+B+YguKs9AoM1ZG1oWnWDZ3%b!a(S&&lkFd;_(e1x
z)UJ_#=J*eEVa21|=}&|U@ZA7F={~Rn0YJ-F`Jh&yH=mU2BWL~K5o1hX!}cZXAdc|}
zr(q!+0>`Lvh>9iB?Nu$paUgkBO9M*pAf&>dfdjyRdT>m@q+kdfLrq5$CyHhDjufvE
z(-a@ZL2<?3DGuoshj3Acn^+eRt!@N_|H1lz?f$|c3n#@Cxcx)$9h~1gk?T(2ViYW%
z`BQgctHST`9T^lMB!$ovTC9Z2gO2hKdsPr34|I5i@({M!wdeUiZL%zs!Zkl^--I45
z+1IATIKET;p(%=B)VTF07k>9Lyj!-RxKWEu+5v<?l=6Dm8{c{tjKVkG!cANW;Y<_!
z<6s&W6`0}NR1Qw&EJrB7aJz=-V9f(agoycCPF$B&?CSM?2uP98Q+0w~R^144=C{@3
z@z5L?k6kcV@ZYdI;&d9v?~#52_~uWp3Wn)3m_1e4H@0@Ia#>4^Hjhw>HC<B)pmw;H
zhBi+CjGuo*vsVy-SHr8+qyPXAKh~8O&tL+!?vKH<Lg)^1)RCjY7zOzBX^BRj<0zrd
zm?8tmNvCEGrUp}iiLlVFj1N<W8m0!5ff(j8lZH`;f*3$Cz249mlg-f#x}UBoE3!zv
z3=6Nq+Qu{%=*(~{8J^pK8R?~{qN;65cCHK&JjR0$cA+20yg<gBXv%*(9@)OAdc9uY
zPfm~~p+6mG`B`VY;yz^EDhuCzc>}YJ`;*sRAZV#*rAy}{VP`Nf>4n+yYveb%<luZ5
z%TgPb^EYk4Hz{d~Xf@Lbp$XkXK}i6pNRzOFmZ-h2%~=5?ccckGcg8SxH!r5hXg7jM
zl+H9o#OtZ|sjCJEim#3<;8Y0doU2=_ejFIXHLXN0Z!GhHsi`I#L?{K)3EtCeh*^)t
zNzie;5Yh))tnh3|1+&Rk<ly$nHgbXE&~Z7S#yBmO?5^?qfeGF6{PL17=_Os7FTH={
zXZg*uGb+)32_0{q{M+d|O~fgxVj?Y-tWFnNqsdd9p*}JOMBYZxRJElTw!XZu({<fi
z-a_slswg`+;4vusV3rIZd8~(hD8Z$pEP;jLq&2)gm3FNb1-jgSvo&|LduYDO#^o*-
z6!rvs5drb(XBRCvwYp~T787oJ==e++ILz8?aIDHC#}}X(_tOiRCdL_=lvRB;RF~l|
zs)@>-m<HiFXo7@Rw_sdtV5dedO<RT{8xU2#l1J1`qcIXDvSe4mpzXwWKGwZS{kI9a
z5#Z<yz?ldA1CfDKC{UwG1;!c<cmy{P;VGaPV96oqVMu^+LI@Icr}=XT5^>TaRT|#O
z56~p{1Lm8dPs}$%p9}|(fUi;>jgWPcqe<3AeaJ(%j3Z~z_9Rm4N!+(8F5!}M1+k4F
zLN&9#Fo6xnJtRpRyhT^}zs1a!eYR3fr%#B#-kxrliz$AROvBC<i)>10&*4o=(qNPG
z4&T%vur%(y;}s+J2X~Lxte5-FlWT4Hc8X8$tbrO9x9oP0O?bE|Gfs2!{n{l48nYq2
z)iyDv1eJ`{D5(crcYsj_oC*>&yiPi`F+_N$|1P?JM9kGoE)y!%*O=(X4%z&aG5Ng8
z3TLI!43kLF>%D9fCC|Yo8UCLMh#mL=Ek4K`C7%b3V`RJr(=g?m{j-oxW9-6a>Iflo
zRJZ{Khws)s{D-?BO)UmOVAB6;xG63-b>*h9e4#PURF!MEsV+Cg<%U(h=qZ0%Cvcrb
zA$GB5-Kch*nwCIZRz^&i(wR@;W)FCl?b?oie?14aw$5tHG)%rG$+~XZ!tSCHkFvCN
zRjrD0my+?>dR~la$|>ihphzlDajA!k>3szn<Y4KHS|J-N5o)579E78~lPXJyRk49p
z9{^m3qShS{h%!6m6ph0rH<4yhSY~pUiK*5mHtQM|)a!oL(O~$#mFtc;*sL91>YblR
z@x0Sv<H=N`anme*vuSK@gwOVmHs=R|gJMAgOTznbe7%s*BEEx77o%3E5!eDcRM$7D
z{7u7lJI-q=es^uDniWk7t?{}AQ^57NtL|@W+bj9-C_COS@144~WR~LY@9V<ohVoup
z_y-3rw{fcuc?%lstE}zVCSHxpuEicMWs#-zXzZ?3!*RE}U$~T|>{i=zt*eahd0B<l
z9nN-GPYkKWL>cCo!sU+y=&9r*kGdNx;*u(h$%CbmB_1e?kR1!L4HVdWwHOD0EIMi+
zt2(yJXsnYLD=x*-a&SCH<-i5hW=p=4M`0dM!Fk((Ovll<E3Y<EjUGbHuCNMVt`D;@
zE=56)#@TQ7HO7#NI3_dMBf{$#<~1p#sQ1^S%}%dwa>@L~ny1^G78xTZ_<JcCg#@^{
z6t-vKY_gQ}C^SO=#Pwff8hd_JtoY(2Yg$Q_%G0Qr3LmL+9q?>sm3n`3xVAd+{tR$A
z#bXcwc@ewm2U|?8E|Vltp_ohzk)zstjK>Zoc-kT2RV-miXt9DLVuBLI>}yy=kLrYd
zD5r*u3M&M}KxnvfSd7t(N1(d-is9D8n?n;>*g{G(um|NGBA@>hqVE6${P$L50`$!R
zBBM#02yUfiY=xb|9vg9ko@dD5qX=4}HMnG3*K`dz+b7k3dSsv<7ux_Yh867DzW86G
zy4&SE7iW;%9qM+X3J$9b_+P?OyMS#<D6u*6yu<{ytvQtu+xn&HIdKk1lYnyAVY0H{
zG!*5((=OL4-eQ98exy*c-kVJW%%<Y&JN5edS*n;xVlQ85ZArelJi(R-)X>4$Z$ntt
zGV0lBBK8cMA^k!UW0?A3n4U|;;$>Lc9A|ggB=L$Ow^!Znw}l_J0$w{EVSV?*9yx5b
z#)8S68)IMYhWc~kdlI}UtR#>XC2al<?LTU_p2vCo^TCYca{-$&yy&UUwmtn`2~D3g
zG@Pm$59yX}>_Z`ZSS5xi0Xh_Y&#PvCI7#-1L*3{m=B62sWCg{UNOa~WZs$EMDDoRj
z<sp`?p!Uy2IejMm$?mm?|9}VmHTW`C+-yneN#uS7hk5Fy9}ml<G`{_>i~7K;au+7t
zhCB%sk6?o>yoUiuhLi|Tj+iOj*Wr+Ku^0($LU`^%{sCsFaPE_Y{#PnlDUkMNUIoPd
zl5@J^OL2k-Ke`(~7(;`i0sxEwV%ivPf@_MDg@_)<$_7p1qk?<DgqXER?`-LYYF4#c
z0Wb+4H3HgA2FqO_^GDs*>Qkr!{0@qc6_NH=cNPNvl~>hJci$xVjU#6Rjb#`1-plV+
zGI6TtU7U{ttuZ^#))MfCyh%={@9%;4XPXYh)qb^-%}#W{M*2V`v(yghR(cmCAZm=)
zMxY1-5#YpFC|MCym0q0-y0lECipX$F&1ATk#ah)nag!jM_4QLE9|9P+Axj2Bf#>Q0
zuk}QSiUDqIg)C`RHQM8a5J+^U`3?dA5`@9kA>*XQRCQ+`07e@r<G}Q{>cF1B=6_--
zY%RdtDc_4Z-%3f$3Sw-I&dFEr-4f9Xzubu{)Z%0xrdKD~Uh&(C#M$@>g9A6s)1(Fk
zgm>coTqDHz81}*VaK8FRg!<|$A-)V#7X(qAv*7pP8tpF~BWTSY&n8sS-on;JfrOrC
zak|bEv}LTK?e&i6!R)fo&w4;vM8|t!67Y58wAK$^sl+sLdTAZ4idXS}g#K?Wx_Q0t
zt3Lbx;2UYx`PaC$dta)#^{hV!KA^97(br3Szui~O5-3GQx0!>^@Qi?ns}W?~QXcgL
zBJBL;Sf1h1M1ax!vyo|58<n2#YfvSj1#ddKn(<xI4YWrXPIT4g`8tyiB!6_Ih?WZI
zd~Rgd+OWVPwaWhY+5Eo#XlCzL$rdWT2~Pq&Qa}%8@iYG`0~@&!CBioG>`M;ue{92}
z^$OlIZa|frKvToaet{=}h!6s#NJxeEZ~_Rx9u5(vPalCHB#dJ&kwwd8^vopGP(ux8
zsG*V?Y8Vk};0_B5O46-9bugQr(+vqXLmUqa9}CuqF@j9>7)=<ie$VWVV?=QZQWONF
zb!{8||18^ibM0FEivq7eqZz!St_u6V$cR(FQ}Q@eE3k^*u>e+;ASo94EFs{LZNMui
z2i+X=zzn2B=X38VPJya%<s4h*@xl}@BU;PK3=7ai&F*2%%j5(`tz1x5lvubBJf$!(
zoxbBd=RF~jfE;3tgn~P;wssz#%PSdxYc0yw3g}T)V@!+}Lcrmst3*&JA#sE`6v!~f
z2udc$MZ7>lCS95oCI#h`bKE--yERtvT?%rUZp*;!?iQc!CNE=W<?YA&Pwu5eLz4Zz
zwxKwS(*M1#p1XPV?PIyb<ENtNZCocGOuXY2(QfS08QebR9id7QD^}gn5#Ugx>T6<(
zY1xCuw@+YY;q26;X8m*q)O2bu>;7@mH4q*4cnw~ngr&hlRCq59e4Wtp=-Z58e`*Xz
zi8fg*&B&<m6CjMx1o?Pta^kxKz~xoN!ca&Yl*z{WJ$+uE*B9Ii`m8>y&*^jKIP^gV
zxmGDi2ye*hc&c_<t}6irI{L+nP3rhUa8sscp2ZH?Pqk1|ocH*z40Rom;{;h<rQx3V
z6OnS;*PCOivTkjerlmHtUEjA1&ysku?s>?MwYFoqA}O{X1~%#1=I%D+S1+8EZKrBR
zd2m#!j3z|LEE|i$QRmoNO=07C!&X9Awg_6cr<}N@N)4@Hx3!G|wrT{$(-eOf3$0@?
zpA3mmtCxiZ7vwFP#M1F(8#q#l6UaTUsg4^r8kx5&wZ3y^@`OtYTiDq?H!BUUDvItR
zy})SUH?vn3%*KA{Hux89NWOJ!ivRdr?A|3);{z9uT|7UnWOW*kY}PrRd_2pyiH9v$
zAbN74i0qR)-n%)!dCZ1my8P-we>E=fn=yo<uTt*qYPNms<;Tlnf8P)e(}uyec^Bfp
zo4bxqH{F$yRb-z(@chmgZ@#BUzn00^YNuM$=i%@FB$$Q^xuo(Y<|YLXYJx;)e4Wu$
zLpC=qsHgCL+E7hYMcA56<xV8TURD)IDQXETGy9>!+qO<HO6(|?05fV~P1aIEn*gH`
zCv-|G=gX2|AgIfdokmj*=Bi8v)M8xbPsFwQt(pagG{wS%*EZy+yH=}l0y;|<L-?jp
z#B;YIg^rqh#ZsFSgLK&$rzYs_S5<5CjG&`-gozj@P~7N{XIk2bZ079t-t$iJCOh{1
z$UCrPW4#Rt8J9o)at&F!aI(6Q=_ct+H|pXO#!W0xBIOR{wNIw%WjDut#^($eKr+cP
z$z%?XiEUs4t5F(=#-njl3{5E2y%&2qv+NJlyhBQ<hd#9eB8^;RDTCbi4Jq72IE{+^
z?}*EmLrD{8T0S5V4<n-FKICaI;41u!5+A36Jo*%bzPZY6396hYA7ms*U<D~8POI#l
z@|gyB4ZtDBcnGsda2`o?u}u0$`YHXme$stHKcpYkkLV}#1Ny!`>8f%m-*okvraKrD
zLmkvmTH^ypwn!H--?vuL-GnkLWHGjyPqxM=7hs319aq9*TQM_v>okvH>WZw)1*3>z
zF9jD-WJDVm3Kw<=mqBumx!RFY%1sf%L;W(F0rAicEhpt%4~2;+n!-!2InSHkH*A(=
z-d%a7BB6&cbJdP4Mn}HR`>hW=hPkYv>1v?lU`;rk*u2Ui1d}0&n#w4_xX*WGe9^gH
zMlU2D8YTujI_`Jd=Dh5;SlG8Xs9jiA2W*99_o&rYC>rO<>Jhu}IMy~_u@4@!n6r(`
zG;vTtM5oxOil_~>vMge5-Di!ZmoohFbc6}Wsg`MvCbQR;Z_elUHt|uuI&<;1qB?@R
z)-vVd_HKz&#e!hx<7(PAUm^a5qfgJ;G~CS4ou0dXd8Gl@lN{9B#~&6%`lL$7MklI1
zgJCO4<#Tvl5RzA3wqjyi+c4zx)rx4ETxc#mkKA=u)e%p;%52?pMou@&GcM7;mcP<t
z{wiaC8##FOJ2-f9a0pmjK=qWz&z9!ew{A!ue(i4Ga*1xU4UG;Mr44Vs$G-XuS774d
zW9zJaxJlGD&T1s(#av<x4o!-|V-rGdaw!9aViV(HnF^EA=+m~Fv_5h#9-K@TBBJp;
z&s`fi2aPxkl~mah3`b_ENjlB9-zuSHf{5Y3wV>Fbq{IP{uw9%%98(U<yd20#Tpj6`
zd0FrGT##OIYK{juAHByNVFESk@4_}sf?NwqE8(~u`+3b7nA}B;+lw)V5td{iXIt(L
zPi7s}!((r6N0}tnF(d2zjNj|t1cAtDq*<rhQ%w<s_Ggo7Gd{|uS+3K$EltTyS#0Py
zt!#E&3HzBy_GOP{*(Su|iA^;-##BWn>QJxKBsRQtZdzE;W1N~_M(MYU=XIeaZ6<W}
zvIJcQ5CZx$;kVji@UZSPyC}@ZsO5qMu+A@SUm%GEns;4{1CJ<8a!1A5EbA!MW-&+}
zOAaRs_rovSSD9)>8*4psDFtKtf5y7y<w|I(WdSNiihsh&>@MW)?bl27q6uEk`8>5H
zC6%g;S=E(uxhWQHi#1IUKtw{$+4vOX!d!<0Q_i*4rlT;DTa_u=(232Ln^GEc7ns5Z
zB28_{Gq0prMM*(PF~0&_@9dkRQl~EpEH+8uDQ93haj!%uM5zN$tPcvU$;lI_6tm=`
zoWTeBRtw>zhsL=vPyypTb6h9Gh$Gxgg9~(!Y~q#l(2TLjDF~Yr1ak)kTO-@5Tv3Or
zL<>};G8L%!;Zn#`z<L9r6N}ZXNL_KZgMUc8xKf#&YGt;APxn>Rbxn1-vWV0pws@rj
zx<sPH^Sa9U8CA0!(=bdMd5n0B;}~`hpYU_b-e5(|eQ091@+=!kgvPZT1Uc5U_*ot+
zHR(gx7e?_XlcaEi%-mBcCEH9T#TZj1(zUncv|4NN%23Ga$!6<P%3e;R?>96voNtT2
zX&8dCJxW5I4RT`FCwkC^A4;2ju2OJWlWe=UTAbmcnZ@O0t~dNMk8NXniisT=9CJ;+
z;+XfoAqNxo3g(n$%#UtJ+4JzXX>jAYJ-P<Vb<g8=#c(m<evZHmH-g%%pea?&SAil1
z1!2AD;2*MS7+XQpUzz5HdDP3<&D}ytLHHh0X_MzdLM`-%bPjYPb4N&>jTJoS)30Pr
z*l3g7iX@s$K5MDygj>SZjaYZLDmDc~v}&TP@JcG6ir0Vr6^N5SiqMTyw;E`KqHs7^
zWuC(`z!lKaS7Of*r<B#}>7&UC8mYZa8Fp&T&xXyjcK{;`|02zk!>|uIN>sFXm;!I7
z0ewk8&Bqk@{>6ew9FODioE|3KBBUaOv9E{0aq5je-UAe<isdAP!9kVWj__Kf$QZA1
zK^c8fQx!GURA_t7{S*qRsb)}v7fz@w#b6e<{%AI)p&+L9ecWG}DprZqUa?JK-akGP
zvD3Y%uj{rOif*}<Zu*_hY*X@bt%xXy+Trat$TG}Eh6Oa%gtU7&*S8d_A%sh<AlQ<`
zR&zy-LmII#A?24iyWH}Qcu@P5ie5>b;6BVVj{+zk@bnCiBm2%sMj9Wn^heMgwU)MC
zd{R+<-#9U?80`LblxTLHy}d<kXVw~ZR*-8l52)#x|CaJ!D_&6Hr|WDB>iau&(UJgH
zPIE+6Cyxq;hjgE3YIdCyX6gQpbm~A9t=9c_4hGLZDombIvYw`M)4b~s;A8im-96hd
zlGAliR*NJr@yNq~cF!77C&F^}BLo@MW~)cRLQeo{LcQ^INv2$i?XrtFSfol{Qp!Tl
zbU9MaBw}VI)WJszPxExo+161p1#`<Ng7P|$VG~~}ds3)wn@lNslqZr=5m?XxKzOVH
zsT|l`Z*??Fw^g9(pj^nOUpE~EA%tepHC;+6NwrkY+n7}H&9cjlizs|gDXDQwx!UTp
z)Z-QmBbzJ=nH7DFN`{9x2ilK8A0viYP*%y3gW=lrqob`kg2Idxpu4Y&BS+Vg_{dFU
z!za00FOIe3Y%8^C^Cg4cIM9YRkR7Ldt#k<u%}i&_qF$y(;r}CdcQed5eZ`+5Wi^aS
zH?w;Q)THSk^7Ki>wm0B`HUjxIwDy#$Pmfi=qK>NIYijW(j`1e6@F%>A>o~*>oILLK
zpY69Fr){0{Ot9@A$avXxN?$H^=JI?roI`}}zC1w>?moECc`t;QRPLAloX)&ruTkdC
zIyYxF&$DI*5p|!|<>|*G_h|=Vo7?WCnc0u=qK^^pI3bge=|m=?{NhlaXV9jy;NAKK
zbuWaD$H%WNWk9#V%lY&YO7`ZW$6=~-o(Z;nz4dOxDL!Qej%5m|9FB1U5w2WXJJsSQ
zZsi(M<N~Wi1q*n?SyyH%RSW2~u6BvN67YU%hP1ynWRZl``=4aA&L$brmf<G5V&8LQ
zqB-PvAr}79f$txHHqUZ=WC!HqxdVy*vc%F$fk-UnWS30VTgl3eYQ{#4E71+c*b>@U
z48G5e(b(A8VB8udlA^?MhpZ#Gluec#v1_+sGzGZQLq!p2yy4EyjdSqd%iQ&&+|6qJ
zW7B`4L<1^V#g$DM8kHi7Qo<cV_RZXYE>E<q+ntsvD_&Zg*-EEgJDyDb!p)tjuK3iE
zEe96zA$s{WB?m?vB$U*qhH^i#WN(MPqURiWy#%m-mm&$ox`xa>b0$Pc{SwiS`b?_>
zDPWcCuEo+PBSz|V^hXmWBo%TTJV={U*Y({-1yL(01{|SVGJy8NpxIl1%w|nl5yAJ#
zX><rO0!?9StO3~!o3EIxtGrq?1>oX%E!v`5zDO*c+PZR<V)d@u3498i%J6oxI$(@2
z0C}eKgfp;c$D};U`h9Rf0-1rCa+ia!us#N2>zXNQM~K7`!;X{pR>Lkqb;w#n;(gF$
zDad??Rq-NYa2^0jfF<E^65i?qJ#<#nV(&Wl4NS8{guy}K>peY@4A7%Q211cT)!X1P
z0{35lA_P8Zk#wwXGUE8<$hc+T+podW6!vc+ptm0#F5WG+6E_$+;}!~W#5sF)6<edh
z#@8_8)!Cw)8#i%;+qi@O;IL4@bqVUOV}#&Tx$@a6=9{%#dyLO<>#2nIRKsV|6;z0u
zunFhT$c9vRNaiK55Qp|XKO`M^?yOoM{FQ9SanUzxg}&?hw(3Njw5k>>mYeas++(Ij
zM1Vp`#+7wQeHL^>_xn)MS)3zCttoZ_%)41_iomWKfW}c8<*q3n`hL_x|0{*!5mG4E
z5v=Ae)D2I|Uw!#EL3edF2escY8&`MQa>cp>D7J5QL05VR;S~oL3-B9uh)&EWN^!wL
zO$GBzsnvrQmpxm+>!md7-&G8<{Pi_8$LMBv@MINEon?U&DF-t?lXbXz_9e^wuCHj<
z9=>LGs?$jU<aIkwthu@{k!&MkIhB#2#_tIcmYEj7Dw(KHD_ZH{(xFy14g%GtzMhzn
ztVW`X_%x)OjN)=4b<ljCjK;zPtP&v4=9o`&%RM}RtH55kA_SKJt+-NqmaWLW2#S!Y
z5Of@xIT9{lwa@>|6R%Ab=03Quw<?s=@<r^3LDBmVWQ(@hh@_KGAYqLwy$S-#s_I$e
zC=eMq1j=z|z+K*Lf@Tz2fYU<QnLcc_;j>kV^cyPO)oiWgwbLc2P7tk(QVFxwh^ZGJ
zdn5i4{wDrDd=Gyce+hpVe+Qq6KR?u>KzU`s@kq#VjdKmWR5O2<p+ziDPWX`;9C7_I
zE?AHAQ)YP{<)WG=R)XU)9vWOPUyPXAv68u^l#4l+4oXxd?XMjHx#0LwDnvq2JmYtY
zXuh*x-9uht4G(ocj&n>k_E5)8F2~vegEZahEP-b&ctDv`XqLLoWji&}%krc#=Gw~c
z5L>QlOnX9{Tu8JzOR9u}rZ^eZjp~~;huuC9s}dwxk~Mo0IX$JXG<C|e`^nmk4E9t1
z?EmdE-?JNQ?VhL+AI!N)ZaVjZqCbr8Nd)dyC^BrAP*nGYT`c7?ax7;(()8oIQEjbJ
z^GQbfa^`w?`y_jEW8ez=d?&VvIe&D==@lDxmT6Hp!?Rr<HM_;F=QsUSSj^x+>#O9b
z*VGl)XCiFJ0vX#=rO+mCzglCEUzL((yx}E{^Eof8is{2y`>rQJXE`C&La2|F<k5ym
zL{Fvt02eKuY3X3&@BC=_GG3m3yq$6j?<-dv2ku|t4Q%>!mv$8$K4G$Ab~X|w<Hboc
zu#9XpBi00p-I=VIsl`;}&DJ{Hcqv?UTT?CDh8%|;7@i*F{d2uT$&*??fvV0NZu@o1
zea{?Z|2_p#q!e<uh{W)HNu}u+p)G0Iy}rWVzOkLgQvZ16k2p5GI~UZFLvaxm8WSKp
z%X;G60dz=%3s}_pu^i~o*Z}1*V%GBctpKme+N=Vx%`s>#B{ps<U`|L-O+>6lgdWxl
zRI^C|D9qE29+e?;6cDZtrY8^QwF`zMsH`Yw<i#QxUQj4f3`|`X(<HGRt?Q<j5o%Q~
zV`x0x%($*6d}ggY_myb1bQKoYg-2M{JY373*LY>@%fY@!-(AUQz20|G)U7%OSmXZ6
z^;@Xhl~F?6xIc`ldziHs@=$ZwY8Q<HTBk#(!nU2OtV6K&m{Ww-S?r~vl*qGNItUJ1
zu{IZE@s3C4-BO{|Ns?nJi;J^2D|xhXqE>hJ6bt46J}*})$GB_@Hp!+bNz|>&(rT>m
zsbe9}zNaZtWkrQi34*iSi6{e!IXecajs!GExiB1bsf@6^=KZ#ZW8k$3=9NX)=Efgm
zqJE`xr4%@Jb~MjGV}+#jF_D&DqAAl-Oi#`mfD}2x=XXD}_#Yks++1VT|E+Z<uahW$
z$zN*&bR}})9Or4-bXxkQFG6DzNIA_<K{+PMYBdbxusFS~$`XK-P+ha;h_n%KFk&&~
z((0!B{wL_EUK80exo^PD413J5=RG;rnBhDbkX?9$3`B*SSi^-ID<GdtOeANHz3y|B
z!-s?nFNPB*Bn~7J*s&8IAUFU{MFDBq>uYqReI2-gHnpQIjZF<2b1`NMIZlUIW-UX2
zOA0X<htzvLRa47lj>g^Rgtd;u)2mI2;$xc*VEsy?TFw_r>3X^ND9{OSGuxM8z8qaQ
z=PT#>I!K5I31p&Hz(K$(<>U;9ut~ZrTxOmK?1i<Pm<~b&3V%A`w*9KSIrCSqSh5H_
zH012nGZ<3%o6`tRSL7NKtS~w6-Q+9Urd|ASlXc5@^d)~`pMlrN<!ey|{5I=!7v>K!
zh$gOlx_Ddo1Z29}&!qe1OP+R*m-toND9y5-T2*yJwKJ2Hc9`|7f(#5&J;<3$U6%?e
ztk<kD(HN+!(&b(>PYEoCrR%_Yk$XzR!0C$J5tF`96gzku)Qsi`!m4enlU^f6)U#(<
z2aN>dN5*-)o>O$QwjVIvLOCCYa`U52nl%`ihN<lLig@vbijPVgSGXO$Az%qxgQ|v8
zWjvEgr5x9A^38fFTL~-W#R&pF<D;Oz!pP0j)$x%{SV)-7#E@P>bl?H>@ywP;Tav*t
z9H1Vq7h28qoO=ik41jr|h-mt}amSeo^%vcqvXS*!10DR!S5XUk57~z5Rg=>yYWMij
zjTf5<VQ+t0ykMh)aFr$VrhXv6{%m_<Uw^jFvftIY^gZ0!eD~1Oy0FZWx^2@D5v@pH
ztgM$jjfghsvGO*FRbW>K>9`7Hfb<e=5*0d65GqW|;w5Ks<YM?}Dc)hOF5jy%t}>$W
z_(aee&vlt{=rRs)5TlaH;|xBLpqxv|IbV==dh_C=^`YqJ#XnYX22WkKlxE3^Ym?l+
z7ceig@;UY3Q`^Us4FR6l`-rL>m;LQ2NWE35i7W<|AJ*nr2Bhz2<!=LDJn_)yzQ8!x
z@)JaOuEWM~H7p^dftc8KR%+a^rxB|vppF3oCW=59qxA+IBWw%T@WM4#QVAs;sicx|
zNF^hrbHbyYtB+;fPSo2drk``8yO4U}+5sFNH%$%*23!zWrQW4H&&+X!0uCN4#UfBY
zX5m64R2_LDlAsbJcn!`o!=U!xxcoHw07zxJ>)ke&{Ct0HiQ)6=1Z4RlGmXU%&G<Ud
zzU!GHObMm}?W$=?;5Y{!MTNfb86Ut)50H+Gfa^+;g?4RUX{f1aLO9$@O6osLOor4c
z)ROLpg<28y$K2GZDbksaluQ}OcfiRs4~gJEc%<95N5{D11A1c^4OwDkFnuXA;LOPK
zMMT|USKv2_ZHxP2d@~Qa%@y<}jIOZ0Qdqw!)B7CCNYw}t=2Cj8Dq>D`ZU8`!)KF6s
zci5t+xIln14UjOIQl;oXls0h=(wez#;RC7lFm36^fuX4<Cq;?7@vDF6>W5&6RX-}F
z0Z^NP0K{^TJ`bNvN{JHE0o6R@A3}-xFI#ac&1|>;=mD0Oltu3<n$86ynl7fc0XJ}a
zstwQ%k$`7HG~k&K79lb;tmWlYutan=dbrBTgzyTdgvDgDHKGO*Om|8wy>gIH9<|Tx
zC65Y^?-`H!{mj1bsCdin&pg#K#*^Z4J)AtC&hQ-?cF#m0cEQkp)m8tcB*bMT#o{!x
z`=<B1Ou1S@5><<t?yBjU?h?RieP^Twr08Ai2fcX!8JD3E!W%B*JT8RrhVcZ)1W*;f
zR+v=nn)BOTJhf|zqGj5q6o4aE2ZScHQPfAPDa@jz!3r%44JeU5-qeSC;VWauOyOUI
z<<KQM_5UBqsRQ9}k;62(C^L&Q%GA?`fAYTHY=c@=eBHo6v7KvP8z*ttG76pQld_-=
zCp+M#X5nSFs_oaPycfpCJDAvc-T~r;DXl4~CdCfa$J{r1C4qPd94y!1-&}-uk`UG+
zY%btJ6P~IX^)}DCzOaT`h0jh=wfbo@zoEZ`@#Ye_>gvbEzPpkfb;r>;IoluInYZtJ
zmB&&H4UR2*3T3?lbLJpQw@@cEpfkkej5nIY_RUG3HnBc)?DBT_YyWf5eG3F^2=H@!
zOz?TVZi~GML#Q|Ksi@mvU?y6l<zti}j<CZa4)_TC(tXVDC5NSf3M_f~iUMv`Aq?%{
zW69_!`|1FalQN)oYBH2~5=#~l5st(AoV-R~c$ozUw+k{*CmPp~^!laTg8Y|l$RIDD
z!>itd#Op6;^w1q4=qUdw`2Q7Q5K%;I0Cj;yKK@!f#v6DYHt-OS@DQ)!bv)8^er*uk
z8%{-KFF8vbs4S?W#I203;qH^{x}ZRoR}1Tkq*<=z*tUgNxu&WlVQ2bVVOd&+>x1HE
zyp%;=RY0ejq5;bw70<PSLCfi!njkw{efQ2zrc}=F?FbeF;~jE06^HfO?4C1P(S^Yk
zU*6WS$W7})2)|)EdU)mFv15k<ZUvs|)b`rrU?EnHRZ%U;yTdX$v=^lc*e8h0dL+Qc
zsw^aq!ngwgnjqA50r*7K0GZeV$;=pss+-@l4b1bhr&bzR#2gA0d2hb7#%6#N*u-Jz
zQOH(0mkrsh3|BP8<xzXSh5UC*ZBx~QA}$Q7ei8_vAR%+h*nYB9@Tk@HL#rT1+M&|H
ze<#~c5LZXDWT(x2b1c?jxduBS^>KvTI1k5p49i1U<Oqfil7ymKf$~lWB(6c=053v?
z0tN#46gfiJhX!Fbnxlx0%ei?obgwS!l3Uh}F6uzX+S7>*^w;z0j`X>x6i?>#9CI}A
zjBmfgC8x)Ws#IHXpUk`-8SbHX60S7?g*Vlf0C0UPnF8WP0<J08BdceH-T)otG0<cC
zM~XR1#GAkRoto7gQ+0|qdW*nO(J!heC1sL$k;tnZdJ5*LCTi)GLWlN~>PbmdbCbn=
z64mUpf0n?;8-%r=dNNW*>a|ei0ZAV@c4d4s73nEmZ*9hUGV=JOBfUoIx`{@z)FY|O
zW}6FXjYOs-*cr7Ip(fkKs+ND*RFNzMHS`y6B`$PGyD=wA8C&w6kQn$Lw7bF=@DaWT
z-xCrcWPm<pM(=3NBgufd;z&x3Anu}l>C|`534e74d8x~u2<nXujGlOJ$8{~s)U@VB
zvev^dN!J;5E)+1^JgLG&QDi7LnfonrJP-<_IoFAAfvq__)I$HVLaS<)+r<*=BAO)|
z6HqPYp((vLoE0NMVQsru+@Pt?IhCi)_jhynT^`!2fl4j7JoiIY{8Z!N4Jv@-(YBQp
z2`(My3Bn~u1RwQ-%_g(B(K8uiXXS2gdiS2<y}q-4#%&aYdf>kzIkkOu`402_9|H(f
z<;za`tAtM$b$t<=Q1Bp+kz7*IHHgY&TjpP>Vho~2kG*&Mi_j=ep|K#KRwH|3d&;0A
zq1;$&^M$PJH-tt2&pe1CtlM*;pinT_zglzT22sTAszv#lA`qi5zMLT)dRMJBodaqC
z&;*E0d)glUwxGWCXlitjC!|hqZ6UhB_%|LRM(``UBiwLC+ZaNdMz3v%vuyy{U83P@
z){^|9$7o2MWW5Dj5@sKUa<Xd}$(h{80sFBqM?skC=j_LQ>Ix|dT(QnawcwZG!=r_#
zChXF6Aei??8*d&j5Izrs<JIWk0Lwx7$O~E=&YPNZd3DrRUmf+;527?(HkYqVGs7ZD
z8McTsJ!z9=)v8Dwvl^{$Z50El#Z1N$C|)56XQw%pByEoq7*<YjRhN)UkLPN_qF1Gm
zIrh4k;)X48XB*tTv9X)k+1+)JTud2<y)rjmw39!8yOpI--PnZiTh_G)9y)&DK%qK1
zU{4%0cP>s&`Oh)uEZ;@K_ym<0Zv<+g^TAUlv>lV`MFdzF);86fNH!lh6Opd66VTXf
zpoq{caniLDMw6i0)Z53f7H+j}4r-Xlo>olWww`SP_JCb0aafCNlI)@^gy`&%<h;dU
zid+yej#S8r>)hHt4P3j8K&f#^P}LQ>{Ez%O2u3m#*y6o#7Mca_XB$?T!LNND=6P{i
z0JKxNhcpmU;oATh-~=2t;K325fk!}WMtL*_z#zbvwSGsR(`WTr_pCmuPv{f+v_7Oy
zn>$FePZMB<@H0Xwyh_KdVmX;9o<7qXA+a>!v<-*r;bJJU&XK?ZI+fZFC2oUgzjZaa
zt-q-H?4X)Kd%tPsV%#-1PFoF4GYnlrR;-XkIq2*(<XSbE<vEUDsfJT9<yu|*t5kKk
z_D!oR7n>pMH!oL~7lq~8GPP?qtF39dT?*H3o19SJI~BPLRoFBLPXVIVSgO{NS3&2N
z68)oeFjCHJHPj$Vy+qb7qRwOD2U89rATRkKf|~6v#BtZ`$19M-{#(~;4=ebL?lX1K
z7WwYS_3E*9;+-Gu#pP~+F6B$*GGjmy)haUIDHYO~4f<>i7TUV)2A<B-s^g}}Wz2Fi
zsW>m!j^AmU?s{~{Q=vc5FXT9Rdl`NZ?-!@Av(1OorMPp>hNYtm>Ffl0ZRpVQpv%5m
zME6apm&%&O)y=MXW|55_jmF3ZxwnTq&h8%Q$ZWe@F}_nUsa4--5j!v<N%zbzUP%IE
zWnBlXeIp&QaqhkWcM$=KLfVSt?70x9-p3r6g1XPs!)FQ1AyiBzI8alhK4UVsQKSRg
zn15>4E>t)(BrO5G(vWsl<N5uR3xPRqnF)7(C^5HMG`DqJ^g-1sK!KTiMnz4l%^+d3
z6J&!C0Za%|@WIZ6EbdY#PZ7SzrB!(%>x!e9TFKID+urgXZk&v?X4S;x1Ns<Rms3uI
zD7Ta<9arV7XLTV$1<o+5VM1F1Yp*ip5DK$#8#3wtcP^^?>(1Clid7U=W}&xYi2H}8
z^hLDP&KMkO3mXw}tIhzf9rMso=vyHfJ-V#%DvB}b%ROSC^KwbSRI{SH&s}`hy$N#W
zN|WgkDI`C5Bupb}V3<i@^<jDnNsZ29`PdKpNKV_Nn%pQzD7gjKs9@=Em4G+YOJI;b
z?`gnUhnxKt66If3D7gyPyiGGQDx3fzfM8&d`PV*4gR-?XZK!eBjr@NJo9{05*W{3!
z7<dV$fsCCc49X}i$uAak!RV&N?Uk#VqDb?qX+d?RhXP=Efl0#<PACtFl6}+yYUYQ;
z?_dc^*FLU#DrrNQ=UJI$Sc<h+S+nlp$pw8F7d};^&IMR4*Mah|=i<V(@wsQtBB%OJ
z4nAF<#BSfiRB1oanTqC*9=g79+unNY+uO_01ucKeW^v4%4(Lh5stljAPbP79-@evf
zB^YT{@<o*||AnQlH4R_s_V3tVnT=HK6kNp5)$A_AW2jX4;vCep2!PdPRh3EYKdPF#
zhO?7^6mBMEpo?XWjk@DK3b9l3ZU&G{y6g=T9kprk^J6gg=aO$magR~;SX-P-8f`<Q
zY7U2rr;4{8xv6Pq4RM~t&%EK85ln)4+{3l+)3wpqHoF4w<|a7b3r3^`@Y|0_Xy=$}
zx3B{hI(|?7mjhr(U)oo}Z@&-LT0Ok4{8$@I966ypw6{TOKMD8RYUq%h=jLDh4qOo*
z7%|L}`Z<xRigrH%N5nTqOxOxrVXMXpc@-{;Mpg2b)bJV}-56!0xG^=qUeOF9+daf2
z$IWttEz!B*&GO^NB02RRSO|UL1yMq$^0H<&unk3!U>B=r5?Uc1lw9;WDo(at6hM^0
zeIN@&Og`qWbZ7y71QWA&T{aC<(}|_aE;VS&Cgl(4ejD!$SG?O(lTk~1+>WI{qw8<w
z<G@7o%RH+QyF#qu0lym9-Oe+!t3P+pNwpTAp=B=Y-HFml(y_34t-nZ;CsKhm@HMgA
zX0epQk$^oQF^Fv0vtF2w+Y-&IZ_<t1GTehf(sIaqPserSP}9W1rssY@0A!~oMy2hI
zVOHw{u1pvC)D<DZNeF4v;vy<=m#za;1BuDChf+;{ZgrmMm0C+clVs`(L)K)lvNX!8
z0~G`muK6GSlxaJ#OmWNgmXZ<$%;2~NyMUgOz5h%I-%vvmU??H#fc*VJnQW4z;unX{
z-&MZetx4F5`uo)!pP_%w?uq@{nLW}z=JMuT6x55P*t^7H1!J_}eLS2v?XAdIc^{r{
z*ai?bqvxGy`(V7FMgHy_A;rRCBqR<F6Q9d}vVw$2uF{({ubz6&Q%^nh)KgDAnzXP%
zF7DAF?1+-&IQpoIRbs!VvYZFZl5vXDE_@at#h{c1lg|q|fpOsC6v(oUGfi~pFDQMl
z+Gjc2J3A%HYC`%T#K|P6u{gO1@PAj7`23!X{o0(HG`#_DEA+2R(7!B3ZyPV7EPjVo
z+)JRpcKUiwIA3_aLa2h|f9R09P>>)(3KCbYR*BJoS{-UGQB^=b_w}5k{G?Hw#CH-x
zOL??ZM9;ITYHF<`aTkk6i?#$1T_~apMKlQQk!V>os5UC6f7<m}bizO<O_WF3yY}iW
z^U)ojvpwKZbp4{M#n@|FlLkE!uqN*1S7N#ZbO=3FN6(NS@h>jx)WoyEPq_gXA$SOH
z^CY~pK;sB4WY=N%9F#Hp9ay7uKu9HV9f)n5Lx6*WfuABN!U`B{TphJi`^O=X4euMn
zCa4b(C6%0{l1eJ6G%Uf81VZF~JlGeTa8NNhTF<>$#m#u$ZGxz~ECK7F!_ZSFliTXj
za`7f|ON7x2bSP6*o-iBkZ2Z0xjlrd<_>WKYXsK>JI)6(%y7Bo&a4PiUh9u`O7q|`-
z0;tS&JBo&d3x#gaKv2RXX+ZVhB&$dT|Fo#0jo>*q@o>^S(=xz+v~zOE<bkHKbz~x*
z5frB4q53?Ekw6?`odFql;Oq$};DMtPv_IOAy06Fb02r5#QGx0u)_oR^NO0{YXh3h-
z{^-YWbO<y)Vgn4An9ZhH;Re@*s|xtR2YlFpEM(z+)Oy{$S0A~9CxL}kJ^bhWfzBRv
zWLM57+<ny=<60Cw&W(rsG^%ZQO)sG*|NTTU@yPR0{LcP2f6Kq;sk|}z(<gDu!~VcZ
zC;hlhdnO3fcFu$RO_B%_4$!`cbb$sr!gVfdIP|<QnV;Z#Zg!6K>_U?R=bU%Cy|%)R
z&N*s$8eFBo+gQRgAYlQ=fS4L)8YJRV{TMqwPk>KHgjBc=ghGHqm_CHSP$s7G{s$@U
zUl&j5)BnFu{i46>$^V%z{0ly~*Np8jn@K2dco+u@PW4VwU5+TDl8PfdEevQp%{qt1
zZpB(t$E?JdK{^kYnTLy8*o1`F*^%lKNiXYRM&nbX4R?<%Zn!PNIhvQ(T!orMj;Gz)
z42=s88ScwFs}**u&_HuXn$+6|;{Nt7nI?o;P&ws!bOgXN*`h1`i_rf^4~!Y?Ji}x9
z!}S&V1zrQdY!xlH$X>*NL3#rvvt8`s7Z2+(dXqHc9B;!IXF^gaQ@v0fC7G0p0)Xzg
z#{aMO3H3SxSA^y`3F@hB+dS*Za-o@Q`NYsQ{I))1X@*0I#v<NUAk}Y7s>Tb3x65lw
zCUcQ*_j<Lv=1sFFhuzV&EK17oB=zO(ZYMT32SM)y1y1~D9hI9Q))s!a%ZGa5(ux&Z
z52pV}i~>;xO*4UJg<&eneY{#3b~lY9+{SHa<1$YE%FcAG%Cc?xelrAwfz-@4tIfwT
zx9RcY;qY<$%=&rr)-S_f(a5hX-lape!)rWjn{Jy_^F_kT<*$A1Q!m31jrm6Ipllk?
z|5X_hmVjFVKD8hS*n=h+(9qEIxKu`;5>Z(3(WXWiT|+-=hPpHgG7TQ2`GiXhQO4iM
z*QK;?AW&e62AyrX%tY$lkf_5<{c@AR;MQvOoOYhq#3pU~?}DfkW4k`YEivL;UNe8+
z?oK&wXKBmo&S3VeqxL(_@!Kj+Qy<>ix*d4Re21c*DizPUzQ39{BnhcT|FmUIj{RWQ
z^H^fyLH|bct<II@vH$^B2>6FX89?r;6vtF>z2kfS4lxe<OcVxL4lJV4<d6|U2Eg~j
z{kV)Th77SKyYOArpB7|BehL*lgu<vDr)QT!3V~9$O9MElxPJgD$ely=2`0wmBr^3Q
zna&khqhj*DNHy49m$j8VQWpk08fMdBq<32<GZrU!gb(Hid8($BWchSDj<I0y4{|q&
z?X|Tu)X|IAMo(#-u39lXHZd;=x|v@QOq<2Oap8fpjf&Y<@4HcCny;_-CRhiJ%BluM
z5q8YqN`n7s1NT1yc??e_r!KI0_(dm+FFEZV5tN+zT^;wIdYI!Le~{vcaZK7&2i7F}
zZ+Sh9xfiXnY+2H!q>e&jpDFg|ZD+$dFUUxwRX(`PLt3oyXAa51;Ac@AaiI{2`h=CX
zW*3Wg;mJ2G*0s*trE35cqlosJ$<!5C+^$kGll%PuI%BQq*Z5|&hyDA9fsDoy`XrK+
zt4>B9Les5HzB{co7L7*Rsc_6_Rc~J+FAR#0q-nk<EbrIwSuF%j5@C1{thiJcP4(#?
zcmug+yRl&Lrp{)fSlwad|3Hs|&%#UYOMVGU<h&Ph%rNY)f#!3AK1y$Z{7!X$oncWn
z3suF8VZ#EQx=o*lgU5dYOi(_l>W#iiXb7pv6Rxh+B$T<6%`x^><ke{nW+B#uohr1%
za#PuTX*j<a*1%P63D;`F-eNb7?-)I;T_~Pwu-P}m!C*i`$Cc%*z&-K28#`5yJ#fH_
zdVFm-#Y@xI7JWKgEw{Z1mN-du$_<%!zJFz%iS?cRT^(Elg>5FDq)Ry7t$QA=TQW%|
z78XGPeJDKJ=I_bkc+iJ|W~il8-edu9P@S8Z1{p<+xGpvG#iPG)j_k$a!=Qvc$fg6C
zHH^XKPZrlM9*PMEAzs42X{j15E_PtTYGTMuCYF28HZv$JjH%)HMkN$=Qcryd-mj@D
zQKkM2_ut|i&$X+p?GPb<^;e>D;D~ZgiIO?0lvy9#Ls)MF`8w`hUcDI2GiKu|h~$FB
zPKoO*9&{@Q5gtLlj(gAT@TZrlje7HO`i)PFTpWWZaTDjE`IwW|WWEd}T9@8nBdnEC
z2d3g6P1buWXIU#w#UUTCdpTeIyb%C4PY=2tP|_4Og#+1LjCjz5Cg4q+#aWz%EY9LA
z&f+Z2;LJSeJp5{>O{kvXx*p;49QdQC)T>bbZHZX?Hss<6H?C=L)fcl&=UGtaI^1L&
zJDnWKV9TkdvCa|;dxR(Jh$1q2h4!pk)8%fmyf3*u+3Ilk+)p3v2pwCFl+~ZZefxk1
z3}NuxB@ZCTm8kv!jKO5}HVg}J4GdP#fU^$H0&#T$?tuVd^+~w$4q&=Gx+!{Y__Nbm
z4*LcGb3H%(B)5R#o<;P&VN1`X{CT4ri-JV(VKIdey`3I60e{NmvVG|u<mCfFUzGo|
z24+LZbuWjvfq*TXT9(4J@GT%c%<sA4?X6peK*LKy2DsACQXc`MF}2DAxQaWEog;(e
zuFbQ~_a3c<=R<xGwHv!up}K5Yr6EKp8lMat>W_(>OGN0G8ir}w_S8hX(Zg9UL9@y`
zr(Ib(#lKgQ1c9b)-PV?OhzgP27_#`R<iM{F5fCOuD{vNP0Y8o=7`P8wpUYw{OTI`}
zjW5l1+tXZwo6P0JG3s@#Hq0IQXYEkKF@(^-d5t&60ZvV&B2NsC_;k=VBc+G!QdKa9
zpTer1VjmE=xn)dJJkbu}?NMucxsPQ6P4pQ994OxPI`L@19XyX0ST|joDwofbMun}2
zQ$2Ty3uoKdO6Hhtl;o>EuD3mG>b&`)?>91E|Cv9WK$KWB(}P(IvbJLwzwXV>pY<7e
z6*d~(k#cvNuc+uQZA>hm!#%tOGZ<f!x4lmeCIC;Gs#r4_sA*~wd)K#SC$$mqU;dR?
zHq95x+v8EY<<VB<61J)wT^m~cRv&v0XpseBuky+vJgr8i;5&Y;=K`Hc7Z$O}iI5#l
zSMUKL19?9Jz5t~4iA6h}$LljhG(d`j?T2gNfqLHW!Yq%i!TjcwcXOEB3U45Yl#dum
zTZ#_jXIY?Xje4VTal<|$2?3#((($6OsP-zR@9xx!rDCxF_;Oh9jYsM_pYg5CY=piS
z)IcQHXTGq3-xBh~>==?Jl=vsEIEoQ8S=a38^|~liiA!=VJ;y_@*Y5`qvM-^M)^O&r
zu}%I3WHuOu!tt(DR_$unl!JY1VE=eYZPYy57S{DgMXS{-(w{Lf`LWvYa!CJxXw*ls
z$Dn`5GF6zo+KmJAZs3=&6p|d!xRd`D&kKT5X+E{m-Qnyx;QEjXDWzQ~7$a<gG#3MO
zXG2RL@$__@{vMYYk0wSoBzLH^io?9p?N%I5r71am+>>?m_b&#Xc~^9@9j26aoxl#g
z@in~<Rc^NUpCgqz%ku}*`f!!HSgMe==e;F#lDi6MW=I7%<Nu~o&7Tj6RrE5c#Z5@f
zW~vR+Ju{uM-NJ!J8$Q8gsb%uvBqwU(?>*0{0eD**ZFJ(`aHrk=TB*?}^C?jveDx_V
z8pvsI@AdtlGjfVl#xH1})mKG9Sd#XK%kq0sG;6AtadKK8gS~gs&_!}C+%%A><N>Mv
zHTfS1KOW;TjB!UzH0mh}$rma&+Kz@+Ei~2SSWOibhk=Bdt@%49Ti%PtV`%n8ldqNj
z9?>!+iDwvIC2G>_mGkbtV!$+)u)D7-(>RdkEuWFFA=F<S`OV2_n5ssl+URr|`OD`Y
zjf#`y(kuCZ`P`mopz_9eo_d2MRB;7h!>^6h{WN4;&)F0s@W#vlr+0P4P&{N4>CoL>
z$by_xVN{N(<Wg#GTTC97`#eQ^=+ckbZ3PBv&3KG-&i5(Q6voDM7a5-Nl8@&9ROby*
zQCr*(Ho#f9);gqaSxZ^Xcb9&T{6TOQ_!ne(IM4N4i|3;$C$!*5<T%yu1>W_<!c%HU
z@>js+@)FjIB}qvc_-DA~?_$`u5WTF!PpDz!uDSa0Rz`n-dzj7gMVCc6z6n;9Pn7oz
z7lJS3@FTUJZ|w^?jgQ;vk;c}p^uc`#!DYXI`D_A0;FWH2GWg$GHR5jIbFbOrC&KkR
z_3kr{b@Y0Dczy3#{~}}CTAKE88P8vSse+=bal~bq3HwGS@U42Vo{m?xEZgJ#b!4+1
z4&!0hbqk?#VLN2vce^Q;r};eUCTuDP6DgQ}TRP@iMLKk>B5O^vbGR>U2y*N(H^|{U
zZHN84e68lE&ie;U=nWQ5yo5JULvV7Ud}sWWiRbuOnOw)JG@gWRFON6$eH!gszCN?6
zEF<`yo&$v)@`VEVI9;;zG-+HW<t%+}XiEpllfLxSACz$@dk#cjt0tPNCES@bVX&Fq
zMK}Bt`18_Y%a{I3wbh+a-`#P5WMxINclZxoPgG!?O8H78>9L|r1d{#8&gCV7IfWpt
z&YsJ{<qA1CcD7uHptE7B^QWc^3_Tn_h1SdJ)Ho^HlWl#*szeT|x?tkW=vT-4=g#1v
zodG$z8DUB>$JjLyBEsP+2s%Ygp`S6~x8Al<_5hb0orH&w$nXe8kBwkWPsZo!>IYKh
z<&Cy^fnc9d;BGFzPf*6)Tz;QmnJ!cc+zEs_RQ?|s{Uj2PQ}7PnfgRk!(|B4u6ezXR
z#vN5`CU-?p;%+8)MS#KGOl}{cLpL#0%%|Q1XbO!&WzT*Ckj7mc7C<6EHTdn{eEs&6
z@y(d)XL<f#<1c;H`q)=`e(?P^oD4t4{15<eVG;oVB2n_|X%+x|r2t;q3(OZIl&|fP
z;-Fit7yJH%vEmNvidyaK7~1zD-s(o^rkrn^=@p7E<huoM!Su2{Ankmef!Zf_?=`oK
z3?3Tvwsd>oxd_#9hFg59)-5_2Zg~;DvOBkDCem<gErH(A@v-DPUP_ExOh=7dV4=YY
zWAz=Dj1acKv+#p0%f82IRfv2r9OSM==XCJ30XLzbvv(1NiZ;7|)%Ty3Hg{!2>Qt?*
zQWtoQQmtzN#kb%fy#36fzUT71RlS8Zn0HpmDDLQ>BjFB;i?}<?4LNQ8fYiV_*rP@a
zUGG+I)GHV~q*uF?2}$asZK^C~T(Ss6`?vr%L3!<t7>mG2xUr{c(MXQ7jvHQg%4hjI
zRtd4WtrS7or!)<-K^f$xTbVSDNLgeiY*vu^&MhJ~@k*5!KkJo)%`eJF$Op=gL(w$>
z_gxaaCZ1LiL|UpMVKY}nA=+pa4Tpg$1{S?l2sWK5ELxjb5{)TN)TVe*s1gtos}kYI
z`Pn2mKyS++B&Jf9(o`%!X;#kU&ipx=9vyjbW1h+GJyr6~1EZC<Ucy{^Ws*s)9Ys(N
zs~*0NO9UcBkSUTBNV><rB$<wH>kWQ9FV)7O5to!W4L}EqnAzZRP?EIx=Gt}8shmh7
ziQ1Kp5(h<O=JQ-5bdU<E$Apxkm*MC&{He*H^js^^azjNllmid0-1Pc`cPMVFCPLB+
z{fvI)byV(GZD_X#6kad`C~9r#2GU<q!#kx~VIppHg$P^M^2q7H9nth@AhLVsfSFQh
z)rByx(Uty72F;HeRn2@7=Zq&<>C)_>(LAFP8WqJOgL5OtlAvE>g{haVJRxj~@?N@s
zOX$Dyj(}`C<0o1So)3;(|J%Xv<b@zMSLKH!j`+kc0SQv*uLMXWgHScWq~V{?$zTYo
zsh&{ONEpKz!AP8Q(_PBQvN;L4JbqaMIr*{`y5G;NRF1NWuv}F&b&-Z<A}z7DP7>Wt
z-|Lre&_i!2h>cC!`j9G3u$Y<@u}&sO6-w35Us3-(%w(nS2Q~+U;0#Dcl}xH?>Kfh4
zqN$~=lT}wwKZk*#QBLC?^ai<1&CuK!&gJn1d4(deq+%&yUWu$n@-T(6OKsmYV{2(;
zZDVU^@8Ia)aXmi>qc};kyeO->X}f+Hw?()`A(Hbudu@N)<Tv?eL#axB#r}TVo*zJ~
z`hK>#!tS4y{)RWRQ0cNr7D3C)MAJ+JX4mxPT9@8Lv*OjZm+7(V^}ITZC^x#LBXjoS
z*@0!la__a8E#ZtSkCzSGD$gV!8DU}0!jcQP2(tSJ_<9_V;Ud)1J;-j&ium81@WuRI
zFUzV_LV8J|whdmB#m!S^mksJQ-{P0{qZ!fA*ehvM-=ewmXme{b2sC%a&EHICqplsw
zZnSNGxM=@@wYK~r+rOQ)*>U@)P;7iT(R(d_(%p^j)eeQb=Ni2mMS5Yn?@Cil8zFEl
zp@H3efu{{zc!?|DOu}4^<(~8RAb3{_O2K^44}x&(3R8`+2XVADzLO16oIa$Hv?fCi
z5fvqYJd$5Sp*YH*Ok0W79b{CNWJ%6TNGx?(USg^1$hvN@DR0_-JgKu?pwuqzqP}O<
z=FVBn_F64^!;W<=>{i+CvwzdiG_%~QyYfA*`1HuoEH9t-Rzhhg$z3)JE@K!t+uCdI
zC5e*St4k8CKPqVV(!APU)9I{wUS+zCxJwa=3=uhRx7U7VY=L(@%<#_o$^Z9(a*F`~
Df1}!W

diff --git a/apps/marketing/src/assets/fonts/dm-sans-latin.woff2 b/apps/marketing/src/assets/fonts/dm-sans-latin.woff2
deleted file mode 100644
index c75f7bf1b4656e9c05822b6302fe6dc0f8fe0303..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 62724
zcmZ5{V~{93wr$(CZQHhO+qP}nw)?bgyHDG;ZM^T!+<8;)<xi?o6|E#|W$&H1%Zo7q
z00R7zo<RUm|H*))+W`QcqW)d>Kjr^#!b)Mo4h#aqiIL)$P!m*2#pjp(Ckx~QGvHTN
z5mX5xB9{ON1)&clL4<$`45T;_h7Q34U<mso0mueK0vy2sLI4`>0v^c$1Fk*J<rLZ~
z;uE}77oIswNQMkzp;))+O{rklRqz=0p*}&7UCr}9owLCSVBCf`{{H^%CeWD3+y-}j
z%0mc%0JO9&*cMnE6~drBw=6MyCm`YxqmaroPE(bNOeL0nHjcKMGtX&BbGM%kCdqpI
zsq1m1w&l6ygEcF;7LRB(2q56Wu~i?gtPJ>0{s!6k8zqCr2=cAk_r*)g7qC0nJ^7}b
z7+o(-+bmL;EmL!c&vij~I6PKAfCSYm&bgMuVnd`?EU<BZtnFowKd%sigk(aQbvj8q
z*zQQ0hcIiB@8n=S7Mv?ihVRHFM?`ievjn~$r;mQ0H~qk_WRx^0+9b98TN-XM4P-x@
zUH>wMwl8JV)u$ZKf1*l0$>h4n+Y7`Zvs)Xr-m{W((KXv=yCQluawdHj<R13t^eS>7
zLG3x1%()akCavNpxVl_EK{IVdJsF)=x6#s^;NvK%mz^7G4jeh!FzTufyK?AN<KfpB
z%0>i1=n_}djebHtkY0V1Z$Asl4GQGBR)jk(uz`{7l3eUMk0Y19>Q_S9_xF+n_w8!U
z5sBQk6@>xUfO|GUqcOKrAOx5vZ}(*TQ$#xe?#jfhm>Ia(SW#EZDMZ<tB-&ym%|_F}
z8HRB<61Sf$^l9Vi&s_k<swY7I&`X_Vy@;gkS$?0q`RsScx*NR%K!pHkOl!&VMI+)9
zqQGIE-^)IMm?rEXUjGqD0VLtR@Y=rT_SHF^W51jMxk+q3tN)MO1M_$gNkRw!<W!*Q
zpNODhV?tdHHmyx1>2$B!wLII})@-kp6;C%yT-+&Z&XHhutM3e<rDn>jvSDc3Hu2%z
z*H?gQ3UCNpch1!^fk<4Y3A0QS=|&Sk%~sMW0l)g0--p_yB?~N|2#(xR1}upr*hAiI
zIDpU3mTfyp)pQC!n3pE+2+bnZ?hduivYSLDiP#!_Jow$+Hg3Rg@C6e?<hl*JsX9=U
zd7-2_Jk;x=Nc^{7bK37FY=R7+d-`HOshb%aITO}`x;q%a04Die`;GM1&^zN0d{R~#
zhAA3Wk&-G60^yN}x;=ce^yOqg(=4o|3aXB}a<55C`Lc4lIpelAhD3tD!F{?bNp5&3
zJ3w}MR{h_7D!lkkozENEpEusyqc~2jB%7H~nm~tQfKkD~4=d`Hsf^EG=(5kRv^eJ>
zX*O~P94bN0H_iBoviTX%EFqS-1lo)RXL0B|in8DJVIpc*{rX~jIqA#HPDyP7;Zu2U
zUxADh&f^r)SXNaRRX3j7Rdb)(zRyL~YLgdRV<2D>1XSbWk?;CkpFcWQEdd)8-V(xB
zl@CCiFl>@bSbd;-`K7!5dg{JA&U8FUDyqES=CK&-9gij;ywEvjW>IOCg(N+{m-Rn=
zGZ7q)DO9`QKfjyPVLG&NUNh88k43SGVt04R@cpK`YNT*O@T!-%2@5-O4bI0!?%Vhh
z*K={A*Nt=MK_p24WW9`irah|LUAv3`MrUI)e;`>tlf2AcXDJDqh65mH9m}<=synab
zc#ws=vO5*#Rs$i90$tw~ET%lI&p~eqde6dJ^~_6B4R<bniyCo*sB$5>3<h@2oxDK|
zmAY233Sop#^~rTo_wkRKcN0_DFqH~`2KECtf`4D#$x6KaeEj2U)<8Z_!gfeCjf(&g
z*Ja3~V0gFgM7LiY_gSTrn~{Ng;{|i4RN|@0J*b!&3-~0n<(}U5y9~KBGP^ZF1b&)2
zeyRV&`mUm+6IJ5fyqy%1$jax)7<jyWGPQL6#1jqEG@54wEDew>BP%Ps&XTRw{dxJI
z5WLbk^*Q;?teE~%H83>`tf>MSXDWeENxTvXJVJp=>D;3L0AeLEO)IKkREkd?t*CTl
zT1-?e&=L*c)g_>$HT4Q(I=td4Z@tXv;oM|w>#c2Qi|x5~jNieL_vXC0zu4>ZS8f@(
zqXLM-`8%sRt}R%YzOA;VxiEa-iTW@`B}@e&(KvA19VdHU<suH{M(3%ca)b5x>|B;i
zTO3o>m{@OW>S^AI50y6OQA9rn2t_*g`^!q5{oxAEP=0I4IW{(q?ROZES|i22%Al1d
z!Rl)jApoScrAsc^o=T?~hmA?Sa{JqRu0H@(6CGKyl)bXqthERng{Ebr4Zuw8eF_|!
z=vV#SOVNlh?{{Sq9km@16*T(&#qaCK|Li>Qw?)?4MhXD|6cyd9uipKKyTF~Q{<d;h
z8VItM5q}?yFl3#3)&8@0hf{Uyn#Zj0F~N{Qb}<42k+@DJCPISw$@eQ16nIgUC63WF
znxgOtWX+rRR($0JPPFl%OR7|un&%-10k%Ulq=9!-;D^xp$GIIZca^mU8CpKYR6|mN
zD1^}8hcZCn3lIr_8(`KE@dE{;NEKT|ICMjyc^?r=!iac8%w}jEAstNS{cAYp@6q6y
z!~h1x;F`riyTwquW<bz*p#q{p3JHZOR!SiPl`5EOMd-z{aI97VFXaJPXOXs@u=}RM
zYQp?se1mO2e=Z_WJDo0ivd9o*`|CXFVbI9fJzF=@>+p;tt_oGf@2LKP`Wq4!j*9;w
z`y13w*avv-?LDmv4Mp4@sRxM_))D?abaQMm-fHlGxP$FSJpfpcknq^BTKe1=!mu@Q
z4|zE%A%l)V5APDMJ_$fDO5hIN-e`9cpu(Bm%p<rtBn&{Qzu>62{3HrIguqqS)XrE&
z5ddbC5-*=TK$r%gL+==<rXY+-h51wfuS)^2$(vX<{jc>FQ6EG7z}>SQ{&kG@k#{@T
z;cq<rB0!7(xp08}AvxDv6_D#Guu~V{9Y6r4J%)Mb+wX9X&N4814`g;-t5<JwPl>63
zp3BZUTz9Uh-pNA#Ylo=ud8C}yqaAwAK#cvjq&$Z~`$VPMS?lNZFc~$q{aZXI^_&ZC
z)^RhoZ*cP?4fTv=I#1YL+GQo@EgC#AKeTd&?6$kimS`SkR=a&-*O{EnxES&NUrpdk
zEqPoT_w!^i<|(9f?`2`W(W}&-f<tih=CXd~_BCpJ0ZKmEZ%^#^4VF=+jV>+AKIrw#
z>@BXFsZW*+rKd%+bPn?y>&9HnQ!RNdk=!U@v*YZ*Xv^9hwM|_%y7aQ8P$_pC9oiY4
zQzpN}sr8;<<ye?~5I_JpfIlzVYF&!2R%0@y<H-k*keY)RT?ZzS6(7VP%B@H$J2H$T
zT~|*-x;F@1rLX<(v@eiu@>j>4keqVUi*&vl0VjhweSK5s)o>RR0_(o;0R(LVTXrJ5
zA!L&&AZz!r?fV02x_Oq2#a*{Vpdzr{-=2M5ChO_2Lm49ex#pj>oIa}eiG$KpqIx-d
zV_h9Ra+TF7)?)jg$j<B!(fnoe)Jd`@Q9j9CQua}ke8p-rNnBeCSkiT8sdsOApYu)*
z`{29UBgDV@yiRRSeKJK1dmEp>etti7Tgx;tkI~bMoR4if{!+-suX&swu0I?0{wRc_
zB^l@wv%h(}aEVX)LiNId+XtI|;4$SlnYXlf_^NFx$ZWY1lrFrar&f*3a|gNCCZy%`
zG7bBKr|B=D&p)SOe|90{Z@~+Jri@|dFya5~YQ=Eto+90H&&F6E%Kq*p-IB?uqS(j5
z!k^2HYRAAT4{cgGWGH8cv}_B7b-oN{MP1+(y!`Snw}sE*V!b^KJm&FvY4m7o-r#-z
zwe0lKozv0dHa>LE$>brPwB#>a#@+5>#-pyg)lz<!BdDt)PF-^A%a+<yUtcq|bI;Es
zrOJkGIFKcJC#|K@|I~W1zkT_Q-#wzo&q;q{`kRioHbnd=U?bJ@@N1ayqwdvy*gzBQ
zQTO`PVqTtp`t|ErCaXO0a9YV<mS;1it^c{Wmb}Q~Jm!byZAGQ+bGwNznr}Cn5d&>~
zZSViReK%rBl#hdxL_VS5Oa2ry!w(BAfF6ya)Uo>gn(Rr0|0n1LaAh*iJj~sF1%1@7
zK=29g4m&RL@NG4-ci`OOvmt-BEd7bc@l?+1a}Rh%8Y1Aq{#W0BjA6%->mEHALyL0k
z<IP;x7wCPhx$oeN4HDEr&V$)}QvIPk%BvtBYoh+*^kNa-=3A4ho~#3~?sMM%6SK=e
zSMza8O-7ezv3n}#<8FMHsoV~4or#`D=lT2YatuvpQ^_=g5#T}J#qe<tsT67L_}br(
zE1a7@UMnMG5arI?VR)q3>oI0V!LHs(Dt5C)!*SazdBE(F%gZ1j{%69z9@gpOdkGAp
z-{W~Cn_C^O4$a~ifVm<t{efa8>6o3?eD~fn2$yMmb=;)U_7%8y(Fg~b65%riPJ@Q{
z^;Z4mAoovb-|r2+x-Nnq^NU7q-?lOXDAt4LE{_+NHb-^q>*Y=P`CeKie5`g+l|a@O
z?@SN3=zW><>ixd3KQK4I9v?KTc3oa*A#6u-8(m)d+^vOJvEp8C^y^i-=8`WurkD!t
z=lmWT0L+I<`ncB@u%Gy|P;G_lQGk_DN;BzTqNsCmO~VT8TRlh~`P)mL%UurJz_d2B
zIdTEup1+Ec%xpXR?zm|R%tRA8ALO8W6_5v8!1(SEX0RaYifP`Zk1f)lEi4ZRFfb`q
z|I92*5JcXeJpcr>>2KEceZZYT*nkg5pbO2$rOzlnJ@;Cb{EH<@c-A`mGUOnY?|E{z
za*`1=!klXPG4j6C&EclRuGm3)iOv#Lzw?99NP^?aXB?D}Oi&^fvETP%%prvvh^`Zg
zE$Zb-nvi?-V|!8z8Y@u+o_C`r2n~=v<`thQ>o&#x2b@q~g{X*{THVd+2uMHI3)6LH
zm0AeVcThvE{3nLZ)3$<QGZlKuK*gCFl_o{&JCf38BuG82YSxblhpSlqGXhHm|0F{B
z$sV{Z@%M)Eh_=dJ=%wcixtIn<pxJq00jP|@=$&tvB|pe%E9+&tf!5ln=N>hNaU29d
zRmbH4bDRyP=`uoFgaEk~cCZ5A#RuDMLSc=#2TKwTI6=@)s9s6bGRlD)tQKHHuKet9
zQ^@11ecGa%Ktl0bKwR2DXdRCR)xo)f=+?jWo6?Y}RR_rg_1}*PHlIoA_)}JN=+Wz)
zt$a<(XQuBT<lK;QFQ<1Q(zeyd#d%lp1bGBwaGZ$tyDaZoY|1@Xf#1YU#Tb(tjkKvH
z9Vm<d(NSTs(qT|;?b+(=S$!IkK;_C}i2IUMl7zyU1nJ$a0N?yG*a6hPe;PaI)7;s-
z7IAU-n}D>M@i}M^i_BFw)1^riJYuL^VQQWXf-+zH4;j&vUVu3yDEH_R-eS@M3Fkg+
zt3OQJxwF7r?C7QWjUHamw5GP6D7ak=HyZXY5kBt+HrVni#E^z>W-UhHtvm5Io{JAe
z+BTJgI*A8>%knSSHH+-@7i&=fGvKI@iXuJ7r&Li-B(y89Fs=VN5yp78)H2i#>o3YQ
zlws8o2Oi6q*x~gYZl9{u%I$~0ZZ4m+cJ8}dX{F=m_3T>X!W1*Y5qX^s7Vlygra6{I
zTQYYq5RxZ$$g~8-d~;LGiz#UqhqIq0zJ2_;ITucHXl+L)jvvy|E98lCB6Pqr9p2cI
z`w%*6i98sBwsZ7o;iEP>8mAwBiF#8-l~1KmPG$<Uqlo3=7eYu2hPSR`yOLPQXirl%
z51OU(kXs{HPGKagme4CBwS)79je=NxLBOV}d;B?gP7HdME%AQt6AKCZKW%|78%P>6
ziLYsQN4!1<BtIv|y89vy-q8e;-E}pulYS_g;!k3$Vw_CY5pG8f1M|@6>X(y*egaCb
zBRaE;FsSGcM_$9riNy~5&xse{Pa&+xif*}9LK&r;Giz9G?ajwOzNI?34mH?3^>R+A
zUN8Hevz-6@)apl#c}Y0A6-&82k9J9G4s1V4e9J8a+pS93@0NVJH+7OFoD*MJ`f!5r
z%!*z_YvFTycZKfI@N84I!ZC5F#A7D1y~%R9G&`C)bzwKC_sAuLXi4r$giq??B=)G4
zZQ62aYzT8zC*I#DNPW9K+TC>dHUTs4tXa>7)XhXdKK864d3!ZAagoVVaW4>$#jEKX
zhdmH(wM?C?AU>Q=moU`)`oKW^iD(Dma$*4m&5LSHft;ebLK#?=E%M})7#KtJ{6e8X
zt5V5?K&29?RHxS}Mq?DirX6saBGs~OA=$i2xcW1M630b014(YeaojAks*`@5w&}!s
zC%~7e0fNFH01S-u2Lb>m5W)|Hs2x!vLR4T7;s_A<VVDSj12JMxlwdd>fPlEb00ij`
z0z?Aj;S1FqMjlAiy*BvJECtFXJ3vAt5{{V%4298t*wAQDgVuT4&B&0SZV;B34iD;=
zP>HY`?cOJ5ZP0|od<ZSds3vBK?Eyo3Y^|f;PlK^4^ysSYML%-O#es*m0Mcg2Mvw?W
zvCb~PX{0@ll@ZGNifi$8E-9QsA%Y?ixpY>6Ot7-lu?loi#VyORWjs`m;<}MoEN96F
zeDz7!lF;&lZ-I(02`?=oyyS!qjd<_sk<6<uW*I7hrnJ4}m`)xl8c&aihq;`)0s$Y!
z3O<ZA`GgS!V!a~Q0LW>!LWhqsk-|8V5_Q#8f~q5Ey;v$oDWjNZghDK)isjse)zTEw
zwwbgBVbMN*!TkJ>OZ(p`dEZaO=!zXrA&vGB(Eu}Ze~>;7?B|)U-d8y<XRfT-gKm~}
zZ-n>{kC=HJA4ZH9`p@$D^?a@aRWki2S~_{9!i8ab<gVj&VEos)8^Bk|wvA)3z$D8E
z?lxI8U%H=S=QYVu{%HIL@oVuK>XpZ@8j^HvP{o+&*i-b1kKXRK(fr)+eT`cSV=jJQ
z?w9hl>{41~ZDnfb2ExB{A@{N3P|xeHowsIsg0P*LUQFxad^ul1X=t8y4LOSQlZR-l
zPG86Ld47{W!mr03P_G`#Y2e&jix(eN{maNn5avN71HegIs!`BpW2Cw>aqT;nmL;3`
zo+uynJh+MjQ%%hg3lk1SjAYVGL(DS|G|oJmLHjsUwdvN2f|E84(jB}nRnGm4u%#tE
zYx_BmV%Arhcl`0ryTpgQ_e&<j&YxM^GPKJ^jM0<AF;*;-JRV^$)Vxy!rOl%ggI2CK
zE66mSJ_tad0fE8-Cp1$&*;}WAC|~5Fl%1$5!}gfZi7YBPCiv4!8!jQ<?~WHPp7J09
zfChUAVqygFH~H2_N=k||J@oTFxee2G7ZxN{13%0-$lpC_!)do|iXgD~fI=b>i3Fl2
zPJjOhdC(V^=-PtG<|W7nkJhq4mSyPWy1p42HQ%sCZL2q#PRzXxC1dF=(stExSG_4b
zCtv<`5oEu(Fx61Uxq7t=L7)JD!2wdLxjJ<^+mI}TFB+~>q>9K_`gFl9Eo7NJ$%>It
z9(IvBS69xG8K<yr$zt@pR-W&KqlU+xLVeb)JxRnObJGi7R+tfmr2AY|gh%ukmhN$y
z7t-6<*YNE;z8|DbV-uNOVxmQA=LEZra7IzQf2hJ(6`Kgk6^7z-yRge87WK|M2~phI
z26TcSe_rplnd2h=c3N(*pDJ&{Ua0x{eNEY?>Zvn0qxt7J0bp=|lr*J~#A`}P<N{k7
z9FJ#SDx-X0(Yxj2;um0G@d1TIAP@^i$+*!w0g%&edE6Zg$p;V+4vIt|5&Ion7+e?#
z{R`{_(bk2;=%BE8079Z+i3B3*i$BFVc)(&Z84U&_alrq7)w*xgzufJg<EbQYfMAsJ
zR2j;NX<Fjh&id|}Hh+I@Q3Qv?0}v36NF)+%+4N{%OHqfV)YdO7rhbe*Sxx9z3o&(}
z8|$UHPAT`@B-47ckbSj}QQ3+_=UVGg-CPwF7v);@`M<ro>h{Oiq)PU?oqoB9*QAya
z|8giIW`FC8|F?NxqBe4o%c{SZ<dR2j>&>~rjt7IW;PiZ7AP`7IG9eU<2l3KTZ5<n4
zGVpC#Zwnl_H;6Cy->vTat`lBEQ}J>s_DSe1vo+8QtdgufHSE%zg$uI6XR#nIi#QXv
zd@yK^O%Ck23g$%Ty@5m58pv-wL^XGGm=pvmEH0R>C`N|$aoILmB9)R0+Q}BZg~y1L
zKA;3DNAj$wEfuo4dfS@(Q$Z^DROVtTJC5(oV(I77Ja<VN&!5sU$-A}fXB{_uoN&ec
zL8#aaZV2;4e(tCY1O$Z+d&8iy-Yu_mH^Ke>?53O+?TF-sB#RPJWLc8Qg}S(K7c%nS
zGyB!o9i$Hwjb9DxBT})(^p2^Yg9(#%_AK0^E%Vi{nG=dR4fTEO7xb+U$rFC{k5SO)
zMTg$!o$?OE_ON=Vw$rSZ-;LGs6#Tpbo@MTXz~Fz$lwJ#&4<Kv8F}9}+&(l?F1CSXZ
zBq%I0g8!UPq4EP<vnC%3^BMGha_<69!BVpsToDvN_F2D*03bnu%jwLwOD_EH7<q56
z6da#LTif(EtEsI#)oSky2s^<)BS=1da4=rHWFlicb$79A)lSae0%9fK-#DR(F#;M!
z1nWWn8$cmo*tI~t9M+LEqZ(Wbm<`WT*y#HFpun9&@9uvdb|~&DXtG;H-%<(zKmh=Q
z1LT~3Fxn0Xzxu~&WirKIDT@+hy(Zs&=2AyzPGhG<E4z#pW>>k_Lr}R8Yy+*eycQ(h
z#-I3m%mUh@gBK+vJ%p@r<-S4EoHYKRc=a9vvMZ##)@UyRg9ax6Xz>PtKqM3cLfNP`
zd!BkjCw!QIgm2pt_(Gr@06K9QV=bG-IwIrWV`xd$YEY`xwv5(|BE7&<s+}^_Z_^z&
zpv5S)GN!QHNvB?=cOI6fOXsunaXY``oJ`t-4+5*^1jGKOrE1z#dLcg>Zh~8g&D%C(
zn0gS%@GmZUXww|OBy_rHNinkcHf5YGLt4PlO;^6Mu5K>7X5u>HFeKtItK7j=w(92n
zG44mdFm5_;NpBP^FP1+7Wqu?__!mbU<&fs}#kn%zKeiBF;f#Ae)+WDS_Iu>`o)9Y;
za1mZBg4wg8(+xMPvkUAKvqoItp^FB~BWGvZO$fWI>?~x-7tVp~_7Jb7b5;ZWYgmnD
z_N_K31?=9nZ(2Y?5fF}iMU~Se2`J-r)CVt9sJ9a0GwV<N0f@+EG#b%vg8Pnp!=c#l
zdOmOJ^^n^&D_V+L*n`&WYeRaVH7FqeqNAxXic*B|myYjcKjlMO$xI|kP(4qr>cnx3
zQB7Vk)v3st1fI}&tLIy;X~zY}E(%o}QDfJfX|onxu1Xyx-dC>l)>&%0l4ymJOVx60
zmG0<ipx0*y0!uvEoGJNH?UQ+{k0=Qid_8&Jv&<V_{R>~cM9-;8>7|}trDjd<#T9GY
zc5WOQ7<B@ufA1&r!Xa>@Tljp?)_qhv4+b5`m{le!(VO1H`l-MlmS;;fE_&qmw5-Xw
z`5{Z!-JSU*QUBHKm^JeuQ|LUb3z035TRkKitNePDf8phX8ja;Nv2Lih)w3lK`B<Y@
z54RkcB)Sua(Y8RsIKpCSOm?!-Lm@BLH{`<hXLTuinh8_HPLgO_(QBM1$^}o&m^?pG
z=S5EbgQ3jou7MhI<Y{#-B5Udd$+}^WVe6)L*4yk~;$;*Y<Mu3~@7s`%zGNm3o4+4P
za{0Q98m}CaBykVPhpT|pTw&atuX|$Uxe%l(Jw_Gd8nvLSX|t(IFZEwqojLaMl&u8Y
zK2WW-3(!&tVxibruS@-p4EVdtp0NanswF@mk_n|?IFjP90FoXmrNykT)iBU+qzNHT
z=Z*Q4c#R&O=1H>239mCcE$BD%DU|+OYKXhFvUJft(kQN7Pic7ea40OuZM%j|*Dsjx
z(yAF)%gR*QtM|KIiPRc6=nHzMtWbniUz(`{FOz4K%{PqYpf;4P?tSF+IFq?|@lt5d
z;YyN~W$PIXhC?u+SBi88%{d+Ze+{6;O?>VLp<b`yECo<i^6^lr?(lQlMlD@TqbVSV
z!C*8T4O+g!W)A$%1pB(l?CNV(KlA(L1c^j4B>1Yzi;4)!I9_(^NATgoUX;&UKgSvi
z{JOS)-DexRkUk8^|2k+vC#p|NKD*`!u!S_;izK&!xA78k6Kj{aymD%ks=A6S-vd9J
zwrQR^Gsx+*-|vlt=K}}|g+wBdwxY!cx`URIsa}4U^*^0r7V+&(|FPm_)m|jK#4^K|
zAF*EiI|#OXo%Qhdy=~03LE0w!aIfp}tz>p@LBK{4-Cku9`#OF2Z~<{FnW^yf$9ZwL
zLQlEYn|?meBxhS<6RW1U^(GrJ=kFS_7j3!Tp^q=Za4z^%lm&ak-|JaCkl14d4#)k`
zV03&xAP~rZt?7LjZ}+d;AlugLSy;(vWpu=l*CwOp!qqHm1=RwWSBq^1g9~~&uw{mx
zVSfZ9Gg=MrXLVWnfAI5nr=4xa)%qXoAQX*;#kJ%;kqC{^&ca<$-L*+x51Kg;552sv
zwml$!5m+Cj&(AcqOicH_U0HfJT_~bq#V4;?*z(A<v@2_9nZH=d+C5z?>`5a!Ynye2
z2_qGIU33w(rNfssg2QGA7sy<KyCm*~863<X82)lRpZ3^SqcO^AGRfu2Ck3r;S2U?;
zst&H8sF^qULl^XV_>E+XAykppJZMhP-Ots&wZUM~PhlM|I(g-^Y33*?=#eOmm^5}u
zjb+DGD_($<C-Ws<n6<kmvP)L6=3CpPpL9g#saCm%w-8XhYE{X26p^uEEm8beB8udQ
z<QI+qjfp5XZ7|ONBKzZGi|~bR5EKGI4OBE7QNJ@c$rbKWI=7E4&N10w6y#`im=z<Z
zY~YnQT=Ge}MxfwKBYo`Vi03T0q0gS1Y$g;7v5CQ8j`TWBFv~8>dd(cb#i~-@#d7(W
zM<BR0&oKWa7x8Nka%WjABt@#>FU1G!KkUsA7r2t@&qrZ|1+X0v`)uOqvvu>%NPe=t
zW-ARA4D5C!jwfb^u<j+ZMQ|T^is6{yDC`l~u>Dc<QBB>3O{va@jm(avzxdg+A9hkl
zuOb?0t^XDqgl-X1pS=DSn*IRadv{l3y6ooyhWS{1^fUG2;diD}%(q|zQ>HjbL!K>A
znMR_U-<&e{V3KdehNNzntG!B2&W_g^ZuMbheh5c)sE+rnDi$qf;OS+uIje@zx*xcS
zWl=FD6vkC<YODT-O)+?BkB7Q-SKeF|2ijUbL!I0WoS1>I0D!>(Vtm`FxJ2m;Lkiq!
zgx73~9P#OgX?Vbj(ZMW6bQLu|mP6M+8l)L)t)09M>Sg`ne=AW=o!j^D1`ujXj!=-b
z$TsDJEs$khx*Rj`{$C2QVT8+RcQ_n~hWGDHLn#hWLkNLDCX|YKb3kiMb*h27uhPM<
zJOEG5f=k?KQA1zc%u60yl5#ez-A~&HssUToA*?E!#5Je!9LI#|U?PLl9J8wmLF%%y
zg!h$-S{XCB#{P)N38AHj4bwmmK2ugMfrnE9_MP0_XRLcKMjM8s7Q#FqY8hEC!RBe}
zT+_R7N5V~C-Q)3T(!5%co|#;VDV#1gCNLJP)NQjJSP}ZS!YCa(RPBpsGN{W6{F`Ru
zjXNkyJrcP5PL|ULp)eSX24g@kA>@}t{$mK>Z;#&0Lm~a!7~oq_<JDIhtKYZjTdUl-
zj;Fu0n3bAKAz<`y?~mMzNrgHtdCrS5(BrVvwUdw;&1gLuw>%Djzf{Vrn@{A@=`4f;
z73|`w;TTkm3mt>EFVA+hDfBggZEv>N!yxzTCTf=m|2mu>Z>QSNCJ_n*>hC8c5N|(9
zhfbsBgTq0QS>eBBawA)$HVXkN{9Z5^{|o)qw(=*3hOlG<H`Qq!$#eN@)mg;yc_V_E
zF%`sqnkyVqxH24HVmV{>Rejn8lSnZdmruUTJgFNr&<T=ASoE4r03yOrZuK&UYb*L=
z2wqPMuTgvV#aEDjCNDdkpkif9!Pe$_toqU()bEmI757DM%C4ihb;W)jKMg@+E<P}8
z^I98r#p(z*VZ3qSj{}jz8%VRVf-6Dwr@kJR;=r4~q%q|DHFhZQvm6LaR9oWtXAPdf
zQm!TlNk1UI#2?~mY(UYQr=&}IcIQKF*l-y3Cb_Y9*Dk+0>}8mVc#DceU)aRJ;2iU!
zoWh&RMiqz_=K~_*;&LfdQCrL-eD!@A*k~1mQ1D4IkG|$Xxud!FiqYv(+`5g)SD})P
zbC2tiV=-!^DdoT08s09LRc*?qE??w1+riW!Q7ZdGxfA&K<U`y#6n`?L7hje3se8w)
zK9PNjy?7jtn)tCaF-fUKx*CfVLf?DX_3$R059cU^4S`-gdrBep(k0MF%RP|%Nj!Y0
z+#jO7cF0=W7x7shIPO0szts~~Bd>1;?JH^IY;fN=muuu=`gbeMJdIoqKUKcLe`H%A
zkb}P@QrP6>H3pm{@W28Y{dDxyL)AoJau79>1y?kD_#({sCeaQNfMA^2zm2E43x4!{
zn;Q^t=!X}g&G(4sEe`v6%YHB<i^1Cn-()Yd)XHjA4Ny2Cl%d7yOpvPq64+y!j`<3>
zwM9i^Y$?og#!$63;8A46l_*O8AhnebQj8+)3$;V>4nN#5e#rXT-5$^}dSDDY$Y4vw
z8G1C5V}n52`H7X(mMdl8zlMvQ(dW)$KMCMFIkW$MJcO-;0pb2AY-Z@Tzd~Lb5&OAd
z3x3Ws_s+x3<qG}+ytQSloUJiG_mv$>z3q>fstml(A_y6-0U^elCcCXKP}$|P4w?KR
zS;{q~y=y^5)y6r^KA@{Q+cV_*o0EkWY9=hIoE@{RHQ{k+#~z_+287glFDtwxP}sk=
zQ`@ziguB_!nPmd9+|u<L*1MeSr8aky+0&qJr;~|=jDg*`p2V}MkYx<hRvB$!*A;Ih
zDZB90f75L<4N?sL?z8H4$v9&r311B<TH+|^nh}EDdNYI|fb_iRv41s4kq0vCHf2hN
zi<}(;1M-0!BEawZhN2g2eo$CprSKi1f6&qnUxk&jTlg&4DMzveyDGpj{q;WToB_cG
z1xtkBKX=4(h<^$wQD>j=x@bWj_MnEyKQ>Uo?s4KMH^3m}e-D*&mKEpZL@Lu@lF&Km
z2V97-MLP{PV$e0Ws^0$oeVqQBIiEGNa{2ruj@E7D@;LEj0FB+f@iM2=(aK-f1`7aS
z;5V&tPbLpv-Jmh03<LneKh}Kt6AJ!&@2~wnp)ah7U=Wbd$_mT^i~jQUG+6(O5nHYp
zFn422)%Rhpg-iOaf!?F3_jBvW$|Miv_g+229#Oc}um+FLyJom){{?{7v|=^%nEqq=
z+JXM-zQYBztx2A{^?iN(%F?#dXJT2M?A6lxta9G8+~;#^mS(Qm;`IIM?=vHe81krE
zgYDPjbW9ViuKo+v8#{HPwv$vs=R4i~R_E|rdY$UOf}hyijpw?N?Pc6e8oaDOuW9{t
zQ|{Q>`^SCvJ?bRC_nS&bclT={wri~TJi0pUuUX!G_@IL_Tl6;i&Q0)y!c-OiEzjr9
z8vR(C>?N-4tGJ|zDay5X*E_Mo=t2Bv?CLjauT2Qm5szp6&uaMG@sYXi%yx3V&q$p}
zshvyq=(o5r!mN(A1=xlEo9dPc654q<*lQ0TwYfOsN7K&BW@XBD#Kh-SoqD-nH$>GH
zuk019##w0cT{EtCaNW?&N@nXOo=3K64-1XQd5Z1x=ae>>dmkfpNi@d!_4V`E@?;eU
z;$QBakzOq`V~?3%=UXQPF<*jRBVxHDo{58wFV=&*UOZ=nX#OdDjGf)DQ}^I7$+=@?
zY)7iLMXHIT9aZjx<Qf^LXDt7N*I@iFwKH7>cUJZtEMC^+R4)~84RIg7Z-CCik)99H
za(EN1$e$r+^*-09K)&s*74n^%e_~wz4IO>hzCA{nds{xu&v$MT_FLtd?*qW;?kZ+_
zS0H-jtW~=dMS52)N}IcIX(y2_4{4a<KV^(>52viF#h*OD@7}wESjdK#`R1fM+fM!@
zN3#dz``t}LP6gyy3&P*_ePVb%S}&r`&zV=FRl{HQ+L_TAV7T@T<{J&GmfG?#sXyiF
z__5@>*9(g0{GIP&&+U~#3#Gpvcb3m@l=|lrt`AR#nv{GHOqYn>4?-8i$qq)mOe!0x
zo_|SlG~;2K9xVxTz?3i7<?fOy&l*ue9d?$R_M3=xzk;0dde8Sx@Bd2LPAH-2q~hT(
ze@QpL5niq|y`5{?KPsHNGCTj3T4MD8nbkX|J)xne`nBEhT+i{r8rh7l?W&JxJcIlE
z-R%3F-aP=t`jn05tYEiYY<(XL!Q)T8=ZGfns*7Ci!Hg}^y+ZvICvUyjCjZ;AJ^Ar7
zqmXu;T>a_`6u*pA_t<eU_j@PGvv2oVH(<DR;qT=3`E5&aV~st!T)W7OeWSYJ#T><-
zntnXP@rwWKGw!utlYSPP2Y*IIzl-mYZENBz*<!s8Z$f8Ui=3VZb40YQUwH|i*{1KI
zy6u1elgy`=eR^#&({N<E(eCR%_sSNvPWRlkF~EN2<9k3nXc788vy$rlOR^){Io@mV
zS-Si4)u8WkUh0N_$rQa3_a=f3BD_9|UjO?uSMSLHb^5>?_w}BV>qB-iBl{|zankF(
z&aJh1>rJw|>EzEb4^v)adTICbIJf5=9K7uMr;RMrTC6~}#7bcm-y1i~Mj3BNMx)B`
zVfK<*yhDd`^L-B6{QaT>+vVzuE?+*5Z|Hp?+iR8gRfHebjUZtJkrrdu#{SjRr=GJ1
z9SDhrUmpYp>}PN7ww?$CAOTGCK?5A%?YjvYgwFqt7IKi8vMlA)-md$La)W*M_2{sE
zVnJN~b2-^LaX@tJ!aMS&;t=ckf>xUExbI^Rz|IB_bFimpgWbRo5J2n0VNz(m2M6K(
zqA*yI7@dUf?r`^Yx7hT869o6Jl?VK;!0VSKk;aT+rnm+94&Vv-Z_g>%vlCX|EUVl5
zFD8MX>L<WF9)M1eIRJ(65CIw#0VE(xz?^4?foBHv+snXG=ssS-8LvK6Ax2JNR2;66
zDaBudnoPBgi+|i|UKhk50I8v%NK&h5!dlvRuC}08EvS<EdXYS%Eusl+trT=^sKsC!
zArcUku(lDCJ9<HM2`!}W9hs$X*3#<78%!+&wL1J4!^5>e0={$rF+1iMFOT84fIGK8
zOunPN@O3VqABCfyJm#y=^@Qbf;F+r<=+KiZv@K)eh-S+Zb}(eNA}3AxYj#J(5)oH2
z9+B561TLw8c@lK*jgaE)rs%u(y!=m1eq;Ji@E})vvIEM7b`~&*5a-qBZw0wlwLfeH
zjr9DVt@-UAk=ybB@k;ytdv8qER(Hh8=vmM%M0##dw*mk+QaA7PzubG^c}qOLzOUi<
z{EkfdI)_*QKrBEWlg__@1-?8!_VZ-f_xw?vT8Ak!cAnSWi*D<-$)9R#W*xL@TE~@R
zc^aoU!viDbLgNOFBqW|bffACMqN+0$jJAhlF1{mbpFPdYSb1omiO{H&Qq33>N|Ys2
z38fN|N~TmQRm$~(#c19-O{>n*wXQ?B?Axx}BQX0(Ze!gJoXG7LnW1PSBh=_N5)q(W
zIP7yekF{e0^MB?U8}2O>2&mF&X9*colG79up50HhF0it=#CS64=@(DlGmr^1LKFu>
zq>;$=f)FwvOr{hGR*B!OR4dhrB^%7r@Gc{Y;W&=|1S1f@#~~QqcjpY1iSXVsLVNPu
za~>!!p?3yBCBqA({4o+$?j}*FfvxbfcI+;10r_zimFygeN(Jggr`QH7T8U!f^~;cx
z2)t0Ba%5c!i`E~Zl<Ss$l!D(SB#yiZW-~5I>>`~`lJJhL*o>MNmoe0NVlxCyS6Qt^
z$n`CXPW$HyEL9n@N7xqq);h0qs1dQ{qY)5lHjFeCizaNn<r`1q#Jo;8X~g&2o#+(<
zslAxxBcdYoCMr^Ybc21eCCI79a3g@!_|+E#5vHIbuStIz$w%#gSt?FVQK}%4W|&9R
z$i&S~jAS#EtyjrGS2IR6YT=VpUW~AwRKWsdSSb(@B!MhqNN9STde~l<K~xosoi>@E
zdR96JbKQ40KPS9E4Z<xlKg;W{eC}dc+HNaFfTyRNzj6s93_>y3X!Wk!p&}DdMms`n
zD>BPeq;xd#0V@b0&XS>y9!|_cO^znp6?2HONnvw*blc!^gT>lOAemGGwyF}0RYj=4
z&z_o0bRV%1`oY$Z<b3W#E_Qh+Cr!#*4l~zkPKZ&n(`TT^?;3eyniDb>s6UNQ1XH-{
z^HX!{ubY$Tp2Onr$Pnv<QeUd28b6+>!1$WGwh-Y75(As)(z?+1ciTyBjSBKhk{iWR
zp~ka(#%wb*eSDAjX}Kg$PAd~%Q>n5HBewK<$t<h7djv8RqmD_CZu<S3PSZiL(9Ad{
zmdJFsl>Htn|4yPOgoURuTRS6zyU?JexHWQNR+WjF;z!^>e)`e28B8^P)okrxJ((|h
zF!0qsR@3{_n&QO9Z**teeHIks?!N6u(NEthgjTZp$(lm)<(Dvj2~vMgvyM@iy>QOV
z+@eFm_Ek%@8n>c=*<LX)om4wZ^MTa^<!BDuQqJ-y53)r2n+~`a+s(Dx4e69W6bBi`
zBcrQ+YXhpoLdSFL&opbYUbvjpr?m`wo5&I}_KM)g#sIOW+MpcF(y1=T`(Cs@U)J>f
zml92tXNQwN3fkPOia=&2{d`@o)R`NUsqWYzA*7fUvaxYIaE4c^V)DH?)P^et#&eYn
zT%R58Er;?|&X}v*`=DKpCl}Sx*>)T>^{cIarSoH$+)3oSp=81_kVGrxPd7diSGwHy
z=%Ovjv=7@@5Mra_SmL*QLwpQRf;)T6uTzSxcnlt1`V>W8=Bh8zYjZo4OO+pa2N|=G
z*WzQBOJwG%M_b(nr`t(u<&#c!jHd5uos`O*2&!MCUvtKc!q-yPj}g1kcx4`%v&dgN
zm`Vu$y2Y|x4ov0W0UR$-AC~wLZAM{v*u1&*_CTwhC)k4l;peu$rfS7YW*S=^n}euL
zEJ}&6_|k~iT>&E;l)!I3T<5#EE7?<n<X@XeVjzJcz9dTXY66y8bv0{n+|8G}4RS)t
zT=$An-f@rpe1W<0NEgh_GJnTIUNCv`_=Q74Efk+MvKr?3yc$Wh!=Ikj=f31-(&6{B
zwQ{pG@4+3f#)mPpJ8aMP0~%tTxxmR9B01$p)qeR6L;sS|Z_XZ!USX~iBJHl{iQXJv
zdsl8c=h5a!=LrRdfT=mxXS%C+SJhDvO(>o7r4<uiS5qk)uQSh;?`?@Ip8YiE*{K@m
zYVGWI-B(s_hV}MHtF)-Qa?O^o59mhiA8$seoQF^lN>3-*H94hn_|+KiY+kWR+F8!B
zrtfT=2vlO04CHQ%Omjxjm_}rfbdd2=&m<&>;}4sS0YSqzB0(9v_{N)ni~^Fm_tCW~
zc03;dX({zFJ6Su0BcC|OBRt0S0rXYJ6Uj|%+=rXw#Z>uP1Z^s-6ON`<K(7HChM|w*
zZ=eF!adL>ACF^v!VH_C}b`CM(+ym0_9exe$*~ZG9a|6{cLKlB`c~sNi5{LrrG{ydC
zj>Kus-_mWFXLaA{+s(`{{QOCC^T&G>;%or@`mty^iQ;zgf`K$Jd-x}$xLxmD&U7ca
z*k&VxhKX?mt4h|wLF&S{200WLc{5}KHbF*e{20xV!DGA^61v<Fqak%|I6fftF{x-2
z@XCCcr5bKEl01A}-}_u-ECws>hh70#5TBd<xRPVw`WQHFR;A{ir_RvGU^i{x&IEX!
zxt5slRFa*o$y5L0gE=?rO;UY%=HBFk&za?--Q+8*J)UZ0{&G&Vg~$1Bd)4&xj<W4m
zb*<f#<QB{4cZO)0zZ2h=+Op*PK&54`yLe~;&KAjOW5fww^73u3-{}u4-;JCCH9Dp%
zZrdHSA^L^*<oivdlVz|%hr*&W_`Z)g&CA2LQf=PkC{FceHYMqAJ8jRfnzK9GQQ$EM
zFz0TKpjUwBRRpWG$$ASU7HMbMjCA5$T~e#$+%Z_wx48U{6!Wma43x<tVjVGUW+R1F
z^?>UO<_cfVRgq;q#BjUy(>@mt{4KKS9K4Oi_ba)z8zZ}4v9edg=z%ZhN|byO{|t5N
zWD_kZ$hz~=V4!Ea&(iReCR3mbA1nsm)lpF>#elqeY6ElX!*lp$SzB^=Qk>bH5|PQP
zcpxt6HZ*z!Dd}RJl{6G)jA<D_(oxF)k99aMOqvsQIXMKD&K#TUFrRy8hQ9p(OYttY
zK@~7mTz$JZ1aY9@mE*&)8IkC&2(26=FAv37?BS;M@R3Z$b^md+l_5sm=T)P~!`P5Z
zqH3lfGZ%9to8Qp<qLQRkU#H9L(Y5yxjZAuS4xM_KvTTytq`&7;Qtureeuj@zv0s>%
zqp0YN@_1MH9Y|oOfAn=00n+17z!5m4*SFny{9#5^G<QwhF$PQ}LMx`*Wk38acZldf
zW3@YO^mjhcprhM886<ZR;<Y>7peTQ^E07zJ6Xz94o@(l)`@nGQM*_i}LWx6z-Fy1C
ztDd-xW!u73BjW0ED0s}_3FYA|Fz?K6my0L!sU3(D{rKf}v?n+pUrk>9x3b+A+C)0a
zUh3TY6$Oj~yMoUB!Zfy%BjP?$LL2#UjF86nA;}PSLf^!-I|I3INlwfyt2oT<?o|Kd
z{g$5pdvW*Wc`niSTODWP9<Kh@_s(DR=}XkNTwMJrz@^QD9J`^g-}h;yw?yVf*~+ve
z`EzOAn67fTcD`b8M(Py$4R0YhLzXXSE7WcbB3sVbXM%Q5Pi#?PiFskY@@QU0c}`jP
zJyU}%=Lw|3ZJGfgR!9sJRbm0!_<aVvZwzQl9RB47W?>WEePPoL%nRA0yA)jUIrLJc
z+Iv2YBcr%feSSnMFzcqc{s7j0gJIJIxc6<6F)G~Nks%JW#-t=KYUS$u>h5+M$NGAw
zp}C;rUTGB3fqsbQJ2Ar4fKiI}T8rQOTwKDm&HIJv4xy%=7W6R=EdJ#EN{E~9sa~n~
z6sC^ZMzMp)2-Z=HdZZ{6#9Yilj3;;JPeiD(UA`iRx&DVy@@9UM*{*o|O!mh)S-WG?
zdA<}K$8X^Em!rbSP7e;y<X$$s#;gP%VlC$Rl|?AI(L~A~?)h0t+i@&h6)rQJNHM~O
zVib#vVpz>?jG*7AM~SUZ>k@taF-(;<s?_Al>YE9+P^2B}u~wyT(ST|ETJ>|i!U6-b
z(m&t1ig!V{U8>sGOQf1Fh2qiKc+|w_*+LvvcvmW-{U0R#v$ZgpF$*-Z$?lGn&BK96
zECVHZ7(hzyFQu_QH<ORsGF9Gwr`}ic{|Ye{>#fh1LGvi7_KM=~R^m(W9yxc?szpKZ
zK#;(=r_U~gEJ1c)kj_sgI?-jb`;L!zRksc!i@;teNCg&BN}#hXrTV(+oM7jw&HVgX
zRD9Ab6(@AeOu6Wcf&2Q{qQBFAL+1rBSD1qJa34zC;~<0de7B0triU{;93Y1Ec!dI{
z$mhlDN&re%N?bqO8|)h^9%?aYX6xk#ViPaAjU|62Hb4RVqEFTrL#9Uy>IuE4$DU;&
zf&0@B0sS@P`)XxWgBZg)+ULs(J)X!W8huEzP^WPKu!?C`A99OQy{r-hU9XN>$f|UH
zt-2o&SW&H(#8}E<_1tbI*1x!G|9FC^TD?ljq3Qc@+M1T~tf%_b*iY2hI?=u)(N<7J
zM?>xZ16J7%h7R$RtPXrA)*WXr!n{I#W~puoN+^i>l>le)4V3viH^str)^x8JhXKwa
z9GJTEhBsYTNFD@gjddhe1<d~Z(OtHDZ30VLj#5;yd~wV`qRxf#MG;NYD==P=X3(no
z6Hu%E?I$m)PS)tV&x=<pCMFq*sG=zn-`!v7=V#2+J-@gKL4_d#Zh7(eA=85kVp$v9
ziVi}4whnkl3`}jN96Fln#2A7IO%I8{fFu2n3oKx)(}?n*;>YwV=cA>nJ_yd)A=Uu2
zxPi(**L5W)IE9m>hyn^as6?T#V0f?qRW`eTBy|<`SQboSf`Cimu}VO|{#Ha%y(9Z7
z1Q<_S1Y%gvnUbiEc$jF+R}`o=<lsd%GrRE~?QY&&K0ylUNS}0bT})}{z_01GO-xNv
z6<m)Xc`&qyNpXw!uqW#s;#WwK>c-G@spmIG)J0Zw7RIq7!dmUbO6?6V^b%#EK#UlA
zNs!H(mIPLW^SNHNKjSB7!bPoK5M~jb$Ofl-oP@6l(1}O`q*YwSN?L&^GI2H_SBSD0
z;TTd!i|~#Pf)2s00U)|1V1&lJp%L)C4qW4ulFvR08=mYMFC*5g-C{t;V8}C|H(#3W
zHw_RPbNr7t5eMLS`l$sVZ!pL<D-z}HTgPuut}E2|S-M0~26;d-nvU`}&1PXD*rKb|
zY!gn_uk#*wuHm==Oyn`*7B&e44Ew|NGLI7Mv!3SsMi+`J2l~|Co&mf^qd^GLM9KXq
zVvHRd!Q;sHo!8SoN>)YIc!CwPx5v+Bz)YNYgd8@%U-NK8+AE5kUA_ev#~&`<F0ij5
zBO1zexh%E!?w{?FU;<jk3i;lA$m7ZI%Rm9YqsI}?cY)v~3Aa7l(M#s%ZLe2C6pe`^
zOosBXUcQMOsuKL4P;P3#2e<d=CD)6GpI5i>>VBC~rydD8V#7o7>ftN?TXR)hd0UPU
zG@rI0>a>mE<xz!6-gFoPZ4@e5QN_ne{Fl{~J|68_f+3whw|M^6K5_&FTY!RigtxU~
z=+G-ulkzsZFLn(u>e`Sb0lRS1&6L>6T2WEarf`(6*ST{&nOzCb%hDo=Bc=(`6#V!{
zlGmg*!vyu@mrX02EBwNI#Oa?XXi(DzFd6U>My-2udrF|_^UT2gxMBUr$&bWcaY5VS
zL*ysH!P=+b>9GNyVn{vS0;_rROxQR4AYS?>&dzz+s(o%iHQ5m}4@L~FH_{9QQ+nRL
z-1S#)=?#hH1JLrTS@nQ)dM$M^8r*6RkO`cc!YgMzdpxNq>D>9{wHgRK@AngZof+#i
zYMjZex>-FKs_i92ePYxPoTN^uR3D~nW^vi!U<N>_C+eF1C>jVLN$j1REWtt2inZEQ
zch;^!SZyNZ#iUfli%{R%yAH?l*`b3o{OW2yUkE<<ACL+$8@&`<|A?F^%<@WI6p<pD
z<`1~cS|POIWT1u2I=+zWhZf33yl7#d77R{|eF_mh7mRq|_R)Opt(B(LnS#?;o-)->
zod5_c0CS0!id(y4S^XHHAh8}kjHr(F0SE%ayj*ClBNl3wa_pWDM5FW6`@?0PQb(3b
zGT$0SAMmCG3N++X3ni$~@UauUimr{kjVD5ylVqr1?li`L@sR9G|7#_5?d-~a=dal_
zaDfqm<v51S=j+E6M2KWN9z>N}5m9Cwnm6!8UMd{!=~l5{tDNc(<KQu2X=CGT%*q46
zs6(miiHBsoZHH?OIjYb>!tCuUk1VzfR-bOKp_kW(%-1aHj#Ox+rn%*)%tsu|g_{IJ
zZ$QEXD932Bgk)es!ej`@1n}lS5AYJ^W-cFrDZ#ar^b$>-3rt&a89<2|I2Iv_v`|$5
z78BU~%f3|jnoVRY^)+02G?TF(jxcajvJ>dcKW|fsWYD6cvX?%tL50G2;Vgk;^L*)o
z6%SjeR;DFpjTGGL?o@<E(TZDJicDmwZd-b{av$DGmTLQSB9wV5F;1Z!I<|hFVjlsV
zJ$RZeafXqPCE_TEQb+)~3pJ3q*T?C)lvR8tLZq(QsOujeo%Xx!eanQk{%~6jG*f8J
zd@+>k3{subBtw>()*-1`YM$$Ck>$0CR=8r2pnlbt`Oj;S5<Kr|0C5&<dH){(HbBY0
z)%m?lD?^^^>DUfHW+oFbn|Sf%uF++X)oZv=8@>RNXYTnvhNC#=H>8plGUG^&Wmqw@
z5qS0MnU7Y8=&ZNIkSK<He}jmzij@MN*%E1mV0#)e#cVEXY>|MPR#SaZ&(<X-mCJ>l
z_Eq=sugF05?+<N_E*6j+>(|_`V5jt>nT5>aUs%k`;Lz#HCAX^Bx0Y101IMnqWZ*v;
z#^zOF$;0M{O<8Ng^EYD)H?I!=^RVR+b8%m2!Dg`c;di_by_2@ccjmF<u63^1PtFZa
zP#RzOdMsdbpgkU-C4k5!=aB?|-C&vbniu@@#z1UP`)XU8_{KK+!*f55KBauVp+Vh$
z?5Xj&VAar?9QOHmZa5X)D0qpZg8<ot1)MJS{!w13wBiTshjLjd|M~rFI^e*JlvsFJ
zR<>`eK&_$=Og}JWH2kgm4);AQ6jNZ)rpTxK=~2E$O>dvRU5aYK=+kBJF=7D+&EEe!
zzf?b|AFv-Pq@}#k{cKmj3FzT>-@}*dmJ{G^yG6`z0e=r<t<>L)M{fr4Hl6j2+yrkP
zi%y#Llamqk@pO~GHJ(YNA0sbuj%PZ0l4Bn}&@{Gr)~yRR^bkFeGG9#SabRQ5#+48I
zfRA(LUG_6Bf58~DS(kx2K>=T|n&DcfYiiQ1bGcq};MVCT$Tp?>S<T+VDYtbl>x!_H
zpRWEyUG-{%Vcho7eH^SlDb0<rsc;JV>~V0fu{HW1Q>(%ACt9|LYIiMev5s|b7<DXa
z9|<*VYBsVKscM}n$f$L+<&^ieIxK{*-mj@hncRM<+JxDb&_!zrsG@Z_xBNnxV_`@b
zp;teIMq`6;YME*{oFX3BfXBpvZ1~4_8*@s40Fg>+aINhx9`}i89>LQo>;Oym{8!+X
z%OsAF$YSyfBveJP>}83jhgT)nKE7ic18Y`mlXfM~Pg|edy#G2}XrZ+tw%yK^=mUyj
zr-*puYD5+qRJeDkkscc;X?irPrd18a3`S+NRpa}$(s{{$2~=N2njmfMobw=IfHG-t
zM=;y_PBL;!(D8RKlo~YWOA!$QiZJY>Q=gR1(S$Dr?EU#lp)ludnmLy7{r&R~MU}BN
z;Xg{!HQ=!snQhVVu1u@<*%rxUwnl1qwPuvx)@Zudl+qeA4u_J%r87B~cyb-?3%E?m
zzr}MI^gQ}6z8sO=aOdJne2!q^A+KYwA>nvj35oc_-gu%RmC*#aT{lHl%9zolj7HTa
zV??cFD@#)mRZhZ^QX#2?2_i&%rvl<TM1UYl6o(X$@fG97R|$5iqCCY`1bZd(8Ir__
zBcS*J&0m^`7!`jZN`{tZugLZ#t+TpjDwfQd3!~%Jub2cP*DKZ4yG<g2=@koeZ<l$B
z$$DxOuLpFKI;bAD&K-0It~6c1+{{qTkk5U)$$vZL@no%3xkZvAuU6{uh?I~wq!G*h
zSolQ6R=@v^8$plv5wG_nP0`_Fe8I89Ma;vy1^nHI6US?OTWV_Flf-=fEnr%BF}|4P
zJRN?oSNNOl72C^Otgl#0H~mZJPYNR1M^TTMUHVuKCbDW`38js!*Fp7sw~(L_&L=d)
z$$|STsvveKv<Ux2V_ISYrq?asTNZ5p()@9aY1>=o65mO3^Eb$Y^uc=$lOK|R&Ltls
z!J}<C_dl?vzp9rfPxk!}_OGeJX9!$V<RE$C**(jVtg4lZ0nRkFksAD*+(?2H{MQeE
zUFrPe3i#s~co&}05AqxR^@YrZ&%?QWjjqPr$H?;}Xt`B-ygpc1dWJ?4*8b|U;~iK*
z*$-00YwHK+FAZKnjb8wv{Mw`L>yL)URiM8V#Q9HxEH~`7i4h^sYnT@Nm7ZA(R!234
ziY19(foga>sQi{Qq@+OPQmIAGP(vys1VX1;C3MA~0GQeRIGeM&n_2Y0;~e(m-4EJ@
z5T!tc3_}96y3?BOqN3qJ?*o7zSd@|Wmp)X@w);^o2c)T<ojdlsW=$oo-GDFkqMSTD
z6Om-1;i_zqPHo+~+cjs(T>A?$fS(B#CsDus+Wm(XWu#z!DoB1Og=_Wj4Y_;J2+qkv
z!F)3<gC)Mm+I;3qy}ovq<6v}cZqW-8wifVzy~;jzbMMurU!~1J%~RRFqf{&Hv*<86
zy|4G;q1PeNFV0iT-MgN?XTEyo$Qy_3fDPb-<8R(Ha&A9#P<iO}i~XzTqI3KE1f0~@
z7frIic+n+iZjQfs5C&{uKP0Hreo`F8KWsUhet+n%C%1$^bg92@E;=`J@zCqaW>Yby
z*)pCTFY{wd|LFyO|8Aw0qJe4bmi<#r>vgGNXrzBxSM-+X%jPOt1|V<2Ck6SR%ASk)
z1s5Iz`ZW6qfPC8?at3fjf22!}g0X(U(Q8IUXUxb$zK`7b20*J<d`6)-BbJ=de_H6o
z5hf@pUBE0VFD=OipL$DlR|>LQcu*soTf+NaK~9<r`Bb3Q7PEmFntIM0X5nlOv{Fy_
zo@P{5+{|#m49*;LwjQ}+K<ky2fA~E5=i*b7)eDr|&FbB3Ggq~sI_nf@{oAN+{4oW4
zj{L%C!pwuFRXGCiyC>-ezneaW|C`P`Hwp|u2f!{FWSj-Ug;B#+x=Ixk_)vCmMtB60
z$_A3$0!#uxSTSnYK&=$=tUoG%nda#f82(+9eDM^64H01Jz#6(m(OY0X1BCCRhFx%#
zLS+Y^WfTb51cVc#hAq@e&_o$9o+jV+>ILjmiCtQ{J*f8^c%cj|NoDCK7_w_2?JV^g
zKBw5H9d_xad#JbeN9heT)c0km>&H-cr$$czpbojcX)}<A(9(boX&#2XremLe*kzd0
zLs>)gsV~P8?9&Ci^wB+po@=)4y#|8-bwUX2ZBwL84jl`?f5%%Fwk`@RHWg190}BI-
z*kTRrZQ$PYP`SsY_eATLFOJ3UKy~`v6$g&v_nMk!={#l*ONtCD_JfRb7=rl>DN0v8
z_`7Ng)bliMdw;fn>O9H6XR?Cr_4^5(-%xV^00gT*=+d3MVs?<$`&%EFtAp2i(l5s0
zf5lH{2@#5;|24Eeu(^YUm~k8eH_CCMxnXhmvxiWT^cQ(ZZJw?(yF$LHRnppct`E`n
zq5$2cHL~IX1wC{~1h}#2F4&3hqN6o3$0|Oc7R&D-`(N<_E`f}lyoXPtb@k>67({?Q
z2#z)Vud`00Bf$CB^a1GKi5&7g_2~rM|MM?Z%vRC*`5XsXN(~C+FsYFhpDXC0do|ad
zTp>~L<ivn;yasK6etC@npgN{WmV^MKMSz-EPdh)jwsSCme8%Mjml&55T#{Ul3V<I|
z;44UCiE8k-TT=SA1aE!PF_7%r!5p4Uo;?5KXX&h;h7Wria2xJ)O^R_5Yx;jQXyX68
z$NQ=FQO_mPV|B6y>*6#%n>;7|(H7&9v)r-*XVSKh*B92WZ2s7G?>w`6{cdFM#y;7z
zF#8o*&<E9CtwihToAtYmwehK`whmhF#8){qvAu*S?JBFS2v>YqxuNn#RZZ0!><ael
zoQ>5HE{i+B%NDc=CWJcSPSGq;r|3U2pMnLADT`E>v~1m7y{!MlpfYSV_F3-QGVnZj
zF?`x?u<t@<AZ_SIEQkZV0Y6Uu+cC}2>YQ@5xIUug^svY5*;6wZ2#4~+XKT+#CH0#c
zHpV|sXcJo!Q^}Ub8I5;Re>9CW&uQ*#nUl7sUuZS8z0)zHV`t~}#rv1Ix=QYCy!VF{
zmsSc^_OAT&zKZ+0?t8Ddu(!4MNbk*6)T+I!rus~M2UoYP{(6mi&Cr^mesBN#1Hyr4
z1|~Vb?%fR!Jm7g?ve(ZIfA??S`_}jB&6@J>|KRcuhW+rskK8Z*)B4+=J^1;nem?#e
z7k{zkmtSpO`PGM8|N52s>%+gU{I&F(U;K9W?<#*^@0Fb8{%znt*00WAU48AX>;GK8
zczwWg=nL-vo1qU^&iw0H^pzV=+-Q39Lqt1q^VWY;S^x6WTkb^e{u^7%eg0togO~X6
z2fZ2QhrbG!9vyy^TXSA(l2%HG*0lB0>#xhZ*3<4I$KH0)_PpkuTQ)v+b$g?>`Niu8
zn~kkc+?efe-hSJz?!4>nqj%&N|ME@#@~W@vM+0X*dhgTLnS%;|IRNLBIj_tQ`2v&y
zRHXPXn|(abw~XG7(dsoIrW8OS5JQ%A<2ph#3x`<hd^gE<F}yh<&~=Vwm@-3`MXY{T
z;d6m}L=cElCsgwS?H<0&w#Ce0AjFIaIA<Aby=Z6jC0>}}@M%aya5)S0v&N`x;xew(
zo$7{HTR@R<rIylZTmNgM5Td9=1T|b65Rs77UQBd(ndd{OIH!~Y5QUezRBS*oLZ-5+
ziU6gVVIM`M4?OtaFdH?NNr0QIdd>lOsLI*19*WEU_hV3J&c2&?+bMXQh5Ew?oTwT7
zFN$IhDoTv0^qN4btdapDYfU3L2$4!BBBWpxiY;Uum?dW$4~fbuL`=r$Mq7wPh-!+r
zJFO6GE$)V_IXhv&i+)JIO?u~x3f`w%8+<tl4mb4F&{IQCyJ^~rO4^1HZ3wYlglNYa
zSZ52ORZiT35Cv2W;d&O~2bh9n2svX&7(h%Ls-}K0s=OgUECUe3g@J~Gg04UQ0*LK;
z-dKPEN}Sg?pUF;29aaA*tLOa-2oy@aWxPW>oR!)qLWlnC8-Uy$3nnGpA#e*}21pMa
zqcSc*Fi53{S$mGLh$lhrBG2&MYCG(|qA9`GY?_(`LDJ1&mJLy^kd$Aj%LrVs-IQed
z!0&FVWgBb%6ca(jzv#aCd*P&cZx@NMeBWFCOnpH~Phhntrh5L>wU*xwi!5Ds7@Q1)
z7;_(^C_>U0Kx+uebV=k(_YP)+`4Na24c0L7WZSO58c#~n-UZhQQ)8EI+D>OVc;R?&
zNqW{83mb`kqRdS7ufx(bedN(enBHwpD2k+%(1Mg?Rg!(;_Jy~iAdX8?5R@PVs4|CP
zlIgiq;6^Ou!)WnfgeXG{%`6j=^F`UE+dve&C!S@NfN91a3&(M%7y&Z@fEfJ9#7Z;)
ztP~&@;3JX1Hix`{htp;SZwwE53c3^Van9o@R$a|sFM7a7Mj-?<V{m{#B*gDg;99OB
zv?;*!nPzw&`+v((+HII~80{jRUia)JG0ZQ|`vY;F-0$bj`@Q*jLO(#0LcbL5K!CV{
zir4mSg*@ATMtg-D|Ie<Myf#}+IMNpNccoqK7H%RoBW7vnw@iS&<Zf~#KqlQmsU1`q
zLv{oc)<>%>jIP!}t&3zceU+HRu*NyOUxEZmLY>44e~T6XBq|t6pi06{u8}7_paN8I
zacWWwZ5-RsN?^&AFo)S`WWfKz9&n`(qnc39U2ivzO`>!#w=J?0KmXcM+RQJL>xe~y
z$f8bU5_-U?ywvyC1Fucat=+R8vlPQn_HnR9Jw8bQ2x*<W&67vVg_RgtbBTy(jrr04
zPpEJKS#r4T;Y{6?%#I-{Y1qwlpm|c3jpd3lC8>`jaIC+W|IPjKNOEpsBYPQhH5xo6
zGJ(G~V>j{Exyq4@|7Aq(Qh(nY_m6};k1}YZ*&e7vBuo;WsmqxkV%dpVt@wt49>;1*
zWkgJQ5J)jC_pnnEM$v<(n$Fze?RMv`0iD(B4Sa}YI`b`;QTB}pPpow`Y^jZu!e{3i
z%N<iR@5m#w0-%-~8-$8_b3#HjM+aZc$w~6S;^jK~S-aavkh*MKy(!Z(fkl=viDn0&
zQzJ)78=;3DI_xB_llTZd^w0xOyk`nsLxU17U+9XD;>}R^|27i*pTt2ZSs*KTmBdi!
zQS(G1VLqmmPVz}m!k3IlQWIATp()`*Q^JQPFiUjLJcnrLX#;lM7w+~q^k3;NI9y!0
zzK?-)8wpVi-az=m-z!u=Lk4ixj}&<Z=F;#v1_FGcKo-I{nej0C*kW8fIr#%Y#$nV?
zt>E89F;nhO?#nCDK>BOXDS)^%vc_TFj1OZ+j;?{awIMBqt@_gub>p#X-c|pM5|E-r
z)+TUG<H||ZJHR2sR=Kb?Ss~GDArS%g#|6(p(qm0j9%kDW2^C0~3&aNdCE^seBomrz
zB3_^fo$iRh*&BEyn%!CAG?Gevx_ssu)~EW_KVT%lJ}x|BLNQZYIQj5hB06qC1R-jw
z;>&L&RV%zvyeP>MVO47%DtGpr9gh!Bj{pdWUB~%D5m#sAk6L)wl*dNmrr1r)=UqLt
z@otl7?s_yxAr_BL+#Q40B-?x&qe$TIyEeluayCkT)o1G4c%z&8a9{BsJV#@a23gPT
zZZ9@*qlEwcTM3^+0@~2VwuG2MLPAU-At9z~i0P7ykYg7VEo>s%Lc*-EF_U!mL9mO}
zt5W!~M|6U3|B`#>?@l#e{cPx2%C4@t^mc`kzBv#sa~uMfSr&~hk{}R}L&H_rWC4&A
zUStaU=0}jvIUa?;1b_@yO%-5wxlc+#7EeNB0m8{BJ%t3gJW5ZImB;$G(gxgAIegt`
z%VrHEuk5ghK)DjekTG-!BNRI01jJ?Vsh!FhkPZnVN_1-Tf;=mxxX?_N1pmxdJb8w>
z<ivrD=Ifu$T9dx?>ax>_!@v-8<0f7a5+L7nRCF8oZ2(~SkTR`En7~<SUU%rKw`w}l
z&~#mk>ZH?-B1g_Y9Q1aqbfCI*wcrL+Tvha16K2?}T&eh7F`Ce*P}C3Dbc|;%Bbmzd
z1s{@(`@l<2p)x)#(9WHNFaSb~64@;Co!30oP{|IpI|0TR*_gH!vgB!>ZHw?47ayQB
zhv!{!C*%Rsj0-9J2b@$yXr?)yzk5Pa*(Ac8|Dx5y!MR?=o>Y^|b6Ey}h%}gZ*~0HJ
zqc5DV_2SWL<HCoN!}Plf|BT1ej6w3?)Ex>^Yf0CA^c6+!VyiN?=j;Xl&h0UK@k1NN
zn$!D2iJ2YQ2O$9GL*V!|&R=0TIpqa(s<(nhv(~(qpyO%m*Q(GUrAR9hB!$XDR|y<o
zf)&@k$c*Ciq3-cykW2j>bO!JlqJn>u8;|uyL{swMrcu*hoo4-his?!|AtnAn^Fo$t
z^hu<Iwa1H0N_~9iu6aRjp|(xn|JlR}l&V+(gx*3XXHK|KI;g3pXBu{DsA-y-263l>
zBI?rtZj|=^tfZM{IHPlx6S5-Hf70gJbOr3{{><Ay`Tu8oE<R@No;x8aI$IGyyXMKT
zV;DM-ZC@RNqwsSMMH%J(J)DtJk3PkXfLU8%lY>C~fCoH$Gn(+ret5Wxd@>n$+cz7g
zBfcGl@Lb1#fizHi?s;(MT!y=0ei6Rs2C-udpw}D&R_2<@;H%sp&{%K`Ei@nj$b4*r
z`Xj*Epe4?08hK@hh4ti}YFb|lkXZ{*Y6DXGMj9fk4k-wepz*H{KZ*pNoM$ZIktf#v
z?0ri9^5xt!^j2#MAfaB6^v=KX+iMsKpR!!Rdb)Jwc09i(q+X9qZn&k1^==LI(JA<O
zvu7WQh3t}|8FxUzlo@!-ymR6rksS7rw29f&XX`G@3nfSy4Qm7M466hZ06HI*UZ$fi
zv$>@_aV`?q=WACNKqPT}rVSF;Ap>2tRG0TET)@oV_7FcG7J~q3*a0^~3m50Y5cCwm
zFcj)wL9{;@t;w@<5_F#GwSIliM2ZD}5dEI_k>M`zNiOSAp1bPB>Qu4dS6TeA01I?I
zzAU*QvWN<JI4Yopz-2@C-<<y!0VE-fF>tk|>yONZnevcfB3mp-_6M^y2{$*8H7Y!Z
zUY`;Y#`c3$(SpA07p~Gwn4{iF`h8M?fikq?<Sz?02o}mvp0~^?A6n2YjKt_w4!Z%{
zDy9{p?*e`x6T0kPq4{OyG=3BU$`>QV(2}ko=707@uM8cl$O>AJf)u1M1*z$CA=i9J
zRgUH?pLtTWy=glD7)ICu<TExEZ1wlU0l-mYC&I?K?F$6nWIWd`U~3hQcl2F@Wgkcy
zE(s+GBnf0j`3rEVqiTQ#^nlUWPk;!S5Q&pc7DFzVPrFZ_h6oNgCje-OZmSix%Zy(f
zD%}vJ`f2GnfyzOfac2@6yRRnpv8y;sDp_Q)d(aIq1dYI2AN>CvL-+skS3LJS^fUC1
zt9i%Iip^h0&%I>k<J1$k_TZ&VbA0VIr(+_CIRuno6`TO2C<DhL5;BomWC29t02+Yi
zW#T%-O}{lLR6sve2R5$4!hihw0HWa{umCN>r~|@&c2y+|vEPJNLI6Xe%c@T5jXlEm
zsDbim9AB^u9cW18DTfTo5_t+`C`;rikU4D#Ue2aF6DdF-BrEYX+L@<mK8zylev}83
zD4jd9p#%u5PpzJ2lT2X^45s17Y@VLSgWwyM-T|ul<%goXH>JwpMn;~QJRZpc8L$u;
z|D^(esW_<EumMqVJU+lz5Ya{W9)biAAQWp9o~lO`!ba}`;Siv80sg+;<aUl=ScIV2
z__*oK#FJo(N|F@L)k}L?mX{BfWb9KB-!hO=ull<n6hal>fAN7(v-7q#*!Q`WpM2-j
zM@>3ABiK7}dFylK2qPU-<+E#W<R^FPsQsU8Pi~@deLrZ`54!@;-j1s#M5LRo5Ia)N
zyV&xo;;n%M3aw*z1X5+#wV;iENrTfJ0Tkoej-#TU(`;xCAt7CUxHh-0KE6u~Z*txT
z151Dx5`gdnM`v6(esd*b=JIf0%YJ|+3)EKPO~v4xKY}*v%uHdog#@o6lGn8A<?x5p
zs0@l38=nRT5nCbJLiV)0dpPO@%@mQ6pUNDwk-J`xjV6My5IP+GpjMw9OMcjpGKdH;
z5$+8S{(_DhZ-Xp1vSBa6PJVAb(v7aNP~uFPnF3PdcLJmPdY=sB1_6Q$M}R?5>kkdI
zxT(YrI9=n2EITP8HVK(h8JUb(ebLY;r7QzUSqUn0*h`@TAoGR`vJ~9g1Jd#2P+#$y
z)iHCs`owEc1u)E3S?x^&-0m9LZJJHj<fiYsFJL7hnIWAu-9DodSv8uERx%R!Y7<?5
ztTi$yw9j(yZtw3S`>xD(M@^?P)Z{n>V&T#`4BN_$C)^*WXz8=cajNy^SZ8%$rpbjo
zGYr0-2r6}`!5}*xith%;3xM#V4#7OZxN^}Z2cN+%%}+Tz^b2w`U;Zfc*DW~;kf5LV
z{S(c9(U)yw*S@|#jq6pWF0(AX%{y!sq|3UX%Q|VglH5}*(FE>&5rse2-EyslkmaqU
z<E9l>5QUa$u>A$i8z6_~)P3>;-epjKnO_53Vrjq<C6&=5x*l@7-1j7Eq?nr7CrJ&8
zig+$HP#q*<WFkaNezKjUIb@5%z(+5Prs-(J>?xkKq0ZkxHAj+E=>=aSA7UJ$@L=<4
zljSm-T-ToDi?@;Imf3L084gQxp2MLz-S`8mFKOJ%&ewkzLh?W2cObP%_AF{}MIlj)
zD5}Uc?4Nd=)OI(X<eYd(rk3n}6F7lo06a%S)t<h3M$J9<mEQiNz3~J2N;2ej`dL<U
zz7>T71}z2cGsA0JxuRmKQlBp(E)>fm7tPd^ds=!0)r-KH%@6m_-KSzPlaNbfO)3hW
z$?0?#zNGFqU&FuE)766vk3@|l$LY%*ZQ4;zSC6k!bC2++T)!lnzF?pbJ{Z<Yv-y<k
z5tH(1vjIYc5gA=apWh)-d`bT5=h-GZh>oW}TT?~ak7Ji3BA&Xa9)T>x0;yLj;GgH2
z;#Vb=ViF+XZAM;E>-`l=3QBVFf^Lxz5`uo3hQ}TsWP<V2ln6TXscHtnk|Zx!lH>&=
z5EY_1Dc-5iY0k-m=}xkv_Q~YRbMvBr!m>nX;WEvz3!W}fcce<;)g@@8+g{XE8Ig$c
z5nNyBvB|_Kix?{h&9+#&b%-+0;$c5RIGOhFgfbStOn?I3xRno(oq~gtLUU$sgF@z8
zC+A3n#cp$r&r>(!L#IG@dgHRYk?0g0EC_>*<U?v#1qP+O1fvX=!)OlE?3;y;OL~1(
zjxvif?kpQ3uhhqLP6SsbF^d(*YB5DNUV@gNsGLHRbKcxV2(VUds?Gh!HB(SSU2m&!
z7Eu>*JvA^0-Pe2F%{}sVTaE%#Z!;yii*P&FR(}atHIT1qLvY)+*#6<Aas-j5D$mA4
zdW9QAD20%Bb5od1mcl7#ekSZmMKkG4)Q^qDNg$ajk7M6RKr)@|A~KxOWWd3H1<kfA
zBmbhI#4r12frVg!T{U_-IZHMok~JE=;ozL057%M^R9j$^qw7rrVXh{K(+rO?;|z7p
zi1mTIH$syc_(PrZR*dKA5e2ylw89R6_}gP{wgocDxldgF!|_P%MDwf7xc6_5%H_8e
zZiREv{BHM7dCxpwJikM+y13*1Qu-kWdLnnX%Re7-fZyW6A$NZ!JLO7`*zFE6ihDM<
zJ^u5igEihJ|D(!o9oO-m#`F0?Y~S7~U@qPd>psX}B;B@5Sy^8Z3ndr!=8}}maSZkd
zXc-+0x*!SxC8z~1+$?;KkpLeF`?vf9vAD-G%iq1ggY!cUy_NF7&K-|PQj<*(^#V76
zw*+P4cuRrjxBSklmOc3IUYK0-pTTDit~K>54&6Su2JRJ)9J}tCM}!24gE3*Sk+?^J
zvgFx7NCQV9$Wdu3AW@A07i5T6K!4YFAx8`;a)N0hoVdS-5p7X<w+_AYN<%YR199sh
z+`UK<WqEtbUl5f{pTBp~`4|pK4hudOJ^?>rK93Y2;iDvn1#{pICsr^S6tQiSqTK-P
zr~~JHEqR5=j<dLQH5NqLIAi1Y*V{0(cD+_oi8&@hC?nr53seHb7ex`Iz?yP4d~C<%
znC6;m%_<a?Pk49Z;`+-HQi`E<B<+Z4g)jnTuhk%S9+=@kyeD;1F#>3f^;1JZp{@;T
zPKIT!MwYRW&+cpi(VRvWF7Q&#S0%NXz2fT+Vv^1B5OLiC)nkpSvO=eEe8Hl6Wqfl(
zajsF4da=-;C;$#Nt^oy)LVf||O)zrRdaD+Bh?p_`8s~jhr`c>|ERzZ~fnkNJ@?j0l
z3I|c_=Y^2ky73TGloopqxongp&B-^${+2AX8-=BSVwb^}YyL=sj0-i`ol}mF8Y?!b
zb)}4_$y}yXmDy1f@=A9Ry64h9#-Q>}A`F70A<&I(xSQ)uyCXz&WJIA#!Iw>ZDb!Gb
zXx!WOF3xefpVo{JJA(Y5Y?!B$dG*B$1SPRJ0KE#gs^JE8yvjKhE{jzU%YjFv{TAw7
zMI`Bu;^S(9JE>^o=PQ?Sy^5?T3!g(o&dAkvhLH+a$2EUx?dTkZJS|roUZ5x{IdanP
zuO~Z8T3>3b;_;>kL(R)fNp|?6h>3tePG--&9Wx%>S8`1U!FT<S)%wJbacqruUZvc{
zhWAB9iC5yjC5W;dA>ZF|yb#PdT>^cfDM;~OH1GQdTgtA^Y3T020K=vZYqF@saUgVj
z`tYAH!~)32Fy*frPfdn}uOEl*?AtsW_KVOcUBw@z=kXa8#v{=v;y$?GG8ZW3Zt7yF
zKklAbXVvYHk<=s^6*n3}P0Absb%y~ADVcsPY^@N&PDU=5IL&}|nt`ANG%-V5bO}7C
zI;843^$}IXL;<691Y-6O>wSGN0ew^yXVv;}4gI+xAwmYrQuoS@PGf!>#Y%OAyE?2f
zP%gz(^b4Y?v@I;p(Cf3KDQFb))<DnHtGfaucU5)Hx2{kNB><JJJ#vsxa-ezGZM|xv
zZZn^xW}om#!COX%Ci6f#`q+*)8YP{?0siiXFH<Mc0XlIT0+Q4D6rQWV!WT!Vc17wW
z+hEd#zVWMoG<XO=T`N9`(o;ydKuBn$z~b!x7H!No%mL*Rw`v@TWv4~N#yM1^NRfvO
zl93M;B|-U=AX(MyxN$Vfn=fm;T*z5)8)^Ej`EAdZWlE2|SuiWEH`J)b-giRXf5Z!f
z;;x%rW6k;qJ3RmNdbmq9_nZSSR}Mrd(nTh(0KtjUgg6q`lVrhjTgf2FT5v*|O2s*^
zal@3n7+xYJamRy~9|+e`4Y_dge9Mj?R3|=^_;!r138h30DD;2=Gn}t7C92khQe+CS
zCKT0ZLe}iF!RK&|>VU+RYXi5en5wsJC?}mt)3F>vC-NvQbIYj4`80&5Odjf@r8Fd`
zT(_4a6RhjWApY+|qbH;L_omY+@*(~w-2bL=SI-E(<dFYoc=^c4;HA>?^%u5W9#W42
zFM@mVLGEQof}d+<{^v?riJJz86ob+nAjdeZW!(`8v1Fpyit+r;VJc5UZ+P71`8Xc4
zG>wILz#Ba;e=d6D>;_bGe44N|^7&*ID@&-2{F2+3<@TgUkGLC-W)Up%e=}e&_;9c$
z##1%bR0R%!yF0|)5x5H<dj5v)8}wj+)AMmOdw{3preJ=9w#<^Wt=K8H=V|h(u@ngp
zZH6*jlVuh$hH~nCY-{Cyo3w2W(<Uj@FM@t{rd4(InyC8Eas5wZv-j~!g;e@hFS5mQ
z54JYkyo!F$I&Hq7YZlUSczpZ___jfed+Z`Ixoc)-W2X#_Ai}+J5zO2#wXSVQ0+AaA
zo+z6ByQ0x{>7C1DT+Q3TPM7*hLz}&&+)>AQFrD>Z#)eglz*K#^&!II*y0$V}ZLPHT
z>*Ls2XAE8kJJ`XFb@NpKC$NJZ44`u`Rrexp{n<0gpVHS9k{{4I_TkCUHyCiNv`EGA
zlB@bJ-OEo~qw_B6ISbU+%z9#@|8L8gFHW0=zbJG**Bj9JH7&FG9aV$-ts_U^Erm{T
z51&S-3@r&3aX^hgE+<_T!|;sz=`NTEMrCME`W1mBLdGIG{hO<~7)o+PE-LjEK_#wK
zY$+}L6KW%}=TdJt6pT@qfWdaF6zf$x^`Zqm6Ih^t6<e@!@*q5_w-RR%vIjXW*hq8Y
z8Yn$teDeStl%b4es6qr)h#&))Hf<2&!9*%_+>@3*zW6>#Tum!*wCRz`cuD-JQt4;P
zdtP22bjB`|>SIK?FFD`%1mnWYitoYo+m&)=B$70m&5>Z!hRmcAcUKvJ>uEW5Jdj45
z<`C3&Qc-$KtoQ8=;A`Qd;iKVW@MGX3;UnRr;G-n_1#ipkHubL&uq($5@0jNJYEDwd
zEKkTxxQUbP_(7t23))*V^x?OXZO}ki6Sj_@3ls;BVCriP#-gn2%Svf>H7-Uiy~ZLU
zybm!xw70`4rY5$@I?mWR-hgHI<(Il~CO3yWGI*5QNF-zuVu?K3*bt%Bd+*<q*LrLN
zL@JgEOm=6GwCS$(?KQMX+l(jyrTvFApUspDYec1U9!_b-I%ntj2KL}hQ$NbA>zd*D
zRBN_<b-mA@C|b>4y}UWtIt-=41u-l6;b+EhKNvX#|8eu-uhzy<QBFJg`R+#ZKI0Od
zaeOT!$%c`%1^CR<B#}>@^Wr^v)e<4}YDP#z8=H0eY%m<%7oa4U4`jzzY=XLIwD$4K
z8rRoYQJg-%KcWB49atsAbxuR4<xhia+?L9@_?j(?A-Sn&W(TfVmlJNBPx58k!}Zcc
z|LQn)VTus7<>4jOlEZ_U!HzQ5kxVtRwK!3#5)o4<q7{UIg;_dSBF$5EP7)-n1NG!d
zMYP^o+8V9=wDm-tqsz%o!NpXmlDTmSK9sqv5<;P-85Uv?Q_VHZIgE>jl%~bGxtTqs
zs918)V#7m?nsj^F7WY9%n^MG!0qJ$RGK3o~ep$^<Vu)OKw7G<S`@J5}KQqZ`X>Da3
zVxwSFjPafH8PQYA&Yz<%3@};weoG!;I0z^rw#Q&|cfR`iDxgiVM%_KQ9jer*#6Cz^
z#sR6qw0}r>IK}IwS+(kNf+r{$hgZQ!-tjAa5lF(kfVMvF3dFgtP)^b8r$;{8QH^DN
z#$33dpk9$&_h6(|(eNr|nKW(lzw*wNjr$5-gm^Tg%)Cbbr_<m30{+Tg-l0=G@dhZ(
z&A%Rs;4Y2dN){FAG)KSr1Q&dW>k$1r+eXnH0M-#V@GB~QEp*Plvp4@7A+oxBz0nFV
z{88#F{jdI|zw4jgANrI2s=w$T`h$Kx-%GCooGrDgOA2;xy)L`pjKx(oE0#~Ei0FKt
zlDiQ+L9yCZEOjVTwuG0{F{wgojc1ILesz|@oTZ9%aUA4ys~=eg$D->`3^_JZE|c<%
zC>>qxLqXH=zvcn+WpwxTbFNL06;-#Z4dtI)W!qkMZ0fV`+wHl+7b$hAF>-A3cVy+m
zzF#%SBi?azX|}|8N-xh8{lvPbbc!%8;^@3gu-|z+oepHD2dL=i?$DXN%67k9E8Bj*
zqWtKQRD(VGN39+E?f*4B%UPZOGbbm5&w9}9gOgC8#t1ej!`2!d5c1xvClSc5J`=9A
zXmf^JlRHj%UtW15EREV2#L86Q(W)E6e4F?<pS`xS8D`qBx#5q7x4jX9Awva`XEY}#
znd>&TIr_$|`~&VWkByG3(MvN9mc5DKC%KSZsaqE7;(a5b2shhPX^fjp6$-oVJg^)-
zH%<!SD$5Pkab)B62VS_JT4~7@`nrGXaJkMW<v!Vg*sGjvGMeW6$-Bw!Cn}FQ6MI6;
zahCT5N<Wrqn(&9@L}S6XEf6w~&kQO@iw3;L;GLW2K+}|2tercog4!m@%POK&TS`%{
z<P@GtL@lxjGs93xX}qMtlIxV=f!AlB>3_nraU`kf^<JkTaj6WbK`E4Lf+(XUj_CQ!
zf1Q~QBN3CuT{5x(%oz(wtk*H4P%xqJFz`Z2<!X2s`#2q+ZA5b7RvWHV00DSmY7}HV
z4$iGP^(ne~mF0O|wokV4aIm%C9;lR3j0%~H_k3(|ZalH*`I%DHMJ$>umE1Bmf026$
zipYH-$GW>iVRuPa!HJ=wUn!RxUx!v&Z3mAJLORZN77kbqCMEm8Q@adV8dlhc;#LM#
zGGt1ujuor;_EW(ar&2nqA7IQYGZ~5uaxyh`{W#X>A*z+(nUXKhT!E&go3}Kc*}VR8
zkaB^so(v7hJb(7tN(@WmG=%IfB+w6aEJ8J1CY83_bXKB&y|S;wx(h=(3o5it80}km
ztXsWYks@7~^|&cq$(PLZiLS2yOi3O~czaZ0d1yH+d%bxAr9JA3Fb;$45mS(iTC3p+
z3>MeL;}}Ck6pILeRbo!IRN*1Tw^q!ZvPe3)t(UCMmm677P$3n?9gx}N#VC8M%p)@x
z^;|-D;|U?gu#a*EbrIA$s~6r4v&w2X!WXJq+P;~^qQ3?>BNuc-tHcFkCp1APBq0eY
z;2aBhOmWWWDh$afa=9v-Mh%6kSVK}uh?2QrP0RmG!K^E68bU1?*I$e8i}>Efbv6>*
zN=g)@Y1q?|q_*3wK18JZt<!QT?Eu3%WW15j`Bre~d&*6Fls>($Q}IYQfM38Ep=KX~
zbL)Nn<)9K%E+zN>ta6;*_vlw^Nv1(D3_GRfkm$hL#>N)%xcmBbToEWj5iOX5>H!fN
zZXSzy?HE^+qiILq#O>4d(|-OfIzQ-}A$bmFD=;f)@rG#uhAN2eUGM~f0s|`8>moo0
zCT4aGLe!mLz%>6O^5;wWXN5Dhvk^6W91BIn){tjxB>4U>hgWwNjC(>vZxeAugmd1N
z^=-X*I0}p`g8XsLwO@6Vu4leT<O1BC8Rk$0cIy3&f`)JhiAdZCCCeGzwdaig|4%~X
z!td~_0K}r6fGjE$mF;rA?Kqho5JKNML^==_L@UNbT(^O2l=eTjmG-h`nwS_)YT|`6
zKDon9&nd;a^yyVo)jhjt6yQ)Hvr(DRB8uJqK%lhaxi?U#10lhY3o}QNunqQHKf)JG
zTRA);%&2HV92g5M3JA(8@`Z(h<f`n~>T%?s2Xm^rPTc0KDGzn_PgbJ-5&B0}ZKBJ|
zEVxvsQxi;HNB66alUr((%+Q*Y*pm_jhA4*uXogm3gmwr)6Crvvv=fL4f<s!$cf*yF
z<t?A{&a<fY<$0@lmDys-ImMXjLsVGql~IR2O=G}CUHSL`<Ju}Il?k4i9Am9Clk+^a
zv+i%aq3bnCA|2!$W+Dk<^n-juJ9?18KvI}E&*6X6fdE*hRCsQPtDV7HL-b_4aUCq%
zf$%q5N%Qq@+CInQd)C{|xN6Tj_0O49Ec!b!LN3eH9kin+;*z$tg{xVU8*I$Uu5&@Z
zY>S93x6|#;zw)+ye6gOm$1v73vkkMa9ZSO$IH9+k)OznR6}XLflZ8Di7F~7hvLKM>
zf|L~^tL7jhlfsS;43uH94ky|uAo^BeLHRLRTf$4<*TMkRs@2WiqUE62Bex-YF0u><
zpQnqr6xi3CBA?05eEg?gO6;|T-wIM4UyH|*iC76Y--w&^txBb#U{0OGAwRPNCawPA
z#E~aYW$HQi$cWAv2s9bxYJ5boS@KTrGj>eCb;iiETzO*g5wV5x){fPhjczsI;eSR6
zHF;k{^YPFf>z=h&TH1evATM%J&!Xo4-bV7_|N0Z`p!Y!=01KaFAm2B?`P%GdP=*Pd
zkrTQlWD?RGS_$=#f+(aQ1!<Rupkix~ojttqki&8cv-ImvW^2rrsg|Z?R;J%7hUO)S
z%^3x8<_r}&orH=9J@|Mx?r0NIKPu|?K}(g98t@dxwe7BUdgv7o0dGWxCO|t(qc^ev
zsQqYvm9zKTUiv!4%Q=$wiDGy;w#^rT%>P5mn-of>V^FtVe5Z&0_H|Y5SLG|cxrXsK
ze70f4rOmUdvs4sv>uGvBi!jp^*@qAfFr)c@)O9bdpEf&kHSiw{<q@3y6kkxs=^yQI
z9Af4mp3i;3-SRngd6OiC+Oc%AdFds}SYvHc)JXUIHLVFxU4O#6T1<4haf&XHZ<gvk
zfazlm?q?)Nt#3f5^w5{T%7%RfBtpMjc3D9o4VNilIN5V<Iahh%PBo=hN7^h>_RI^}
zyM6gp(p!s)ipW#}VO_Eq`}m3SoTGE~3o~A+hsC0VI9&js)~Em!3vF(FIc_nn0;n#c
z1fDK$RJn*K<5Z@cb7mLYqmW1?UoKPC)1-y4z)C)(c<sx_X{GIrblr{YdCA=Wfh87g
z3Rqx}=V+SLE9+vbkt@1#meo_FbF2bymu<>Q2BZC7woshswL0Czx26xTV^L^=rY$P(
zUe^|qw{<$SDT~f-rdS!>Ra7b!UgMx6uEZ*UNtncqumRS?dRPw|U_(xxSC9~CM4NG=
z)9tj1LBNZl?~pB5P&^D-VyQHzsY<#}YCsYuX;ay2Y&yGkKO;4#ty*;=$2tPLTngG>
zyJY<kdjh;vSDn-P+20?W8TMAG?YxxaIM*WC7CF_?Z#0zD0ZZ6PW%{A7@1gV08=)wx
ze4uJy@d6pTF>5s1aHmCw_X<c4mJ)C^HVqwd;_Zwkc28BTc;aO7qi<kY#V`@cZOEca
z-(?DJwc3dexY&$iu-~wlxHDA`*80>L9NEy1{p6lpE|XG-2VPGqqsXN$enwtoZub|n
zdrvmNyKduv!8)}7)5SLCd7}@iK_z4N797}?VOY8hIf5pO6gBucjUD(O?nY%*p#2S}
z#UtDiML|%iuRSD>6NnrG4UTV#vhC^g^0G0(q3uu{D%RRbZC;BUYgVaQ@mgc7uQHZH
zbm)0^TPs`(J^u$z`(i|y7+d+PorwJf^a^rb3g8Znb)Gof8sNi*MN^b=bQ0TAWP1I)
z0?k}NG~PR*AX_nSuH9F8hyW535dtDa?N`K_-E4%td7e$C2!<`1o&GFCQq^q5FeDq6
zOQ$KSp33JwDA-Vjj4>kGyM0IG5bZsTWyEp|06PXQGf4?r$vzFVBxCV5(K%x&rI$uz
zL<|MI4N0#(V+@s9UR;VSaaMwC$9?&BU&XxVLY&;kNZ`htzrs@c7-sNIm2H|?owzEi
zvP!A3xXKw~gEaxAyExKvjUHJaJtKsmZCTr>%^)C~KoqbW;O1G06Dz%`eI_y)HxM9J
z+a?(0YtEP<ssuaqCLtMX?XH@Q#%rNYPg||1kDuikFeW#&tO=wYgc!=_t17ZAZ~2Da
zDq1BXkvpzfwo<rTU>ixCP~gCp!<jADLU`<yB{@v_MqrB_=M@Tc3=LCPb$umYX_am8
zCg_76=*4b`LMJ334Jqiz@uO49X;`3&RM_>z*-Y7MkW~BmUa^lMiny{0w*5}3aTS^u
z-}ErcTB(Vek;d(6%UgAFE?D29d`YGlpI{@>HU^WF)xCpN>=CC_$*&AE5@Pk5s>w^y
zodP;c8&io4*u+O&4+icpju`S&WygfIljf?*+5@WYpuAkSFmh*PCpZ+YD0N~XgI#xa
z_SkT5e{k(_`f_ZeZ2U7#au5S2V@%A<k-(}7)&ojX`<pX`EY`Emjp-~`<c3bN*s9fR
zOilfpuzMrRF<zLR<6<X^XX^PBbZKztrllsXGF7Fb2Lwn(nrtag`$N5Xh!b^1KAI3>
zWv&hKrDPpSE{Y`2z9o{obV?Z3fKNuso#(PPJb7`ojov~Es<qrI?!qjafM*tI5Y;Fa
zc`9d9_>1MS7!kerqOR)j$TgsKVIB#6SUzGZz;vvYx-zX?sgk{cvqJ(%!dVkE3^-G8
zpA$tqSELEW*6WFroYGJQnQ@tOfI*xeX{OjROR%(q*~DehUR(W%z@mJ1qD9#ODo;DW
zqNWga8=~s<xVROiR_MVzEvTvCescKg<`i_?o?{LcZRi`{hFasD4lp+%<?<-@2YjHf
z+sudow6Cjt)C%541uD1j3hicdF@GFLEXmLyS|%gSc{#O`IDLw0Hg15J&bu3o1#Rlx
z$Zq_Ljb=J8p#t7uU=;=^gv_L0*ArJYli1>HTdH9U&omhKfP}c#$BSSW0@-5cyCN5Z
z^s@vq=;RXCUQ)SSD&lX1h|?6LFnpFx&D3QM)^gCInbGBz%E}$ZW^-)T5&4~U=agWa
zzpdER|IOf>5ZtqEM@AEvVn`qsoT7`UHG$~at_6)|UkvC%lTq0_E;AAeRgmp$$n~D`
zLQ^d$WCj1VohA<3wmWr8N#ay-+7Bbj7-@NU&4r5*NK5g93Iv0vSSp=}Uy)*-x50gI
z8{C6;!yWJ`xC`!top7jV+u$RzAa8=?7|kFOB|5jv4Wo<$&W^o~pW^zB8BzYwI2!fg
zR`;52V=3s89nu7^$;VyF>@CMkmU~yQU@RHJ-u62yDkw6sx1OkGU)*@`vXY6s^*y-J
zp#Gum(Pw8Y#&4_J5gNIseuPde({&e8B=a5uot~=Zqtk<~Lvr8Wyfx*rll&FmpO-Pl
zN+ljA+@Gh5Q3?v&Q7YyQkH_tP_|`PgDh=q1N*#^4Fr&xVEDTJ$3+&O;rg!^#bwj_k
zkFBSn){@=yoP~T|PUmW#P*s9lf)G@FVK0JT?S!4*n9*Bdc56LaPayl=(IZ7cY(9N@
z)D*dKkd(~s^*_5d@zKt*XoON^TnwEVYJKc>sXS!%-?o1cfo<*XH=XUXOB$?WFIY|t
z*@r*0MAA+cCQJYRo%)${kTg|3TMn;r;0`ZFTlB$T5VF*%m6^(Ib!qk@tXf_@4Lqt#
zJkzssw57@kQFPyO$QdF<22YTsOjA`q?nqQ*+(lE9GgG6H8&AsOu_iNAjCI3FJ&vJo
z9o>!4sh3uom71>SL7IlAjogkh;igq!cgy33M(i+)uYc!Df_!Pl=&$<}s+^-vV}cxR
zduPQGT)FSJ9~YG?f7!M^)p)1)4~6gTSt&IDxwfm?nznHA)@5a$Qk`lzMZDJi6~N0{
zIVWqJL<}?PA}7_4OwYT<V-E;(Q&$9u5D+d+;gLzPGiT*iJ`|ECX%SsfQ3Qop8^ZUB
zvR-or?EA^kO9b&0y)9ttB6LQ)p3ddII%yn?D6)=%)gt3UDIo8%p6`G*Zxrqu4u9HX
z!)bhoeR@$J(l7jQ>XFZ;xTm?_WVPA^OXkw<&*i+6>Ma(r_EP>%SbYyCX5$YvPcFk)
z6mf$a<Kt?$;wY!z;p`3C&d5`my<6p3;X%0M9C=}i)lVy?^{MBsd?#f;b0t^rS!761
z9G2F+z5PZa0<D)T7Z9E68tSDec2hQ0v>7^nwiaX%UzXmb1VcNF!Y+46n4wOm2L?L<
zffXUA>&=$S$isu*uU5t1w(C&T#%ZX9PbrgmqqT(`*r!RX+90u_q~zJomp8k#Z3&jj
z!*~N&=!^+AZ9nr+L%hi*`1P)sqRD0M#)~MjI`P`QDDL}9b1vpKm=C<T%8b2TUXR-_
zC^m*pHG+P5CORjP%%Pp5QE%20e@(>a+6LYCRu%gX|6*ed{#Gd<JP$Tt6;^Q#R$vuY
zU_nwAtlDgkV<l!f9=igE-YADyrQIgOG7P7Q45E(|zQd?|W;wNjSC-3)#POn|NizC(
z0eCU~mRc(D+ou>WC1i=vp(-RjS+fM>D$R-GhCqVuK*4JW7q;+vM4qi^$nQl%+0C=$
z_QnEtrT@`vd5IA`X!qV`iau4XQ(dlm4lJ+iTU!NP&MpV@3mXfbsO4)a!>9d_+=|}I
z21^zAor~6ADN$4-Yp5#pK$0m~76H3~!OA|Cz*mxXA&Ol0$wx-id~~hbjCH0y7VfXo
zSRaboK3E*tx-J$LEjU5-aQMJ|m8UyP5kFLHMW{JuSDZ{&Yti@aBP}*IA0p3O<}+wD
zCtN8zaVp)S+NFcWpvb%?Q@M)Qk^d?;@~G}wDf_~l+O}>!98rafhBl0F2ov+shNJCH
z0we?w3})`(Vy(ET_9T5d6Y5vBBxx8-UeV3sTrV|s=#h(OVllh~(P~sq3A>66|C!g%
z+EsCKxpfl0qq(Yao;R2rj}V-~A7*Ea_v2ysGcI3PDlB)6?YW>am}Bl-H+wCqE{QEN
zww`hAP|l#*$WzOd;47siXH1|1%4DUJC}AZWB-_$BvBgI9qp^rrk}4~S21R6I%lgTB
z%}OQK>BZ@Q5lBugyV^#O$n-sd$m&~B>dD>x!@5s?*TPtVBIIsfc9@i@4~=qqCLpFh
z@`{@9t^M`lh7Dvojzbz3(;_{la}bFy4v(K`X9_M*=(PTy>B=i&CSWkIb^&es8f+Xd
zU^A@tW#txiTne=JR2NAzZQ1<ITm&<M7LU__iWdC=#5M+C08V#Swor~$eT=|h0Su5t
zU5DTRsyP1NB8?~w=<SE<P3=!5rlE96L2L&L<6b*Su3twj#>XJ;faKliLZFnGP;>2Z
ztP)L7Z88H*v#1W2;bhlMrnWCUs4y`v5A=KH3mB!$z$VfKTEmQpb?qo-R%gO8wCEs7
zKy%Q3l1mr#2~kQm#P+mMUuHJM83<sUJ0C(khwx#kgA_!b62$h}fqq=nbmar;mM|F^
zT^5f*7vntXL1&vip7en*Gj+0y!Q%-Bg-W$vRH@Wns{kyegdpQ=#MqQh2!Y25wsA|7
z!h>$M9k3Ht&Mt!<4QW_rcf(ScnYV3<0ej^F%*6eiEOjWI_-8Ia%IDGhI3%wl*SrT4
z4|G7a4!^93E#Do*l`ylB6u?8A8^e+AHaiL!)ig1450LKT(3|N2_9U8MLShLfB+{Wo
z7b81VN*E!c-Dsk%scX!2OcaL5W;<aW!Sp&}>5~be9Ic`!$<c8CiE;F|qNl>q@Kw<t
zJ$n&Eq%^Ka1_hW!S%hk{9ndK=L$m&K+WM0q6PHmNi?f30n;oLeICsX8H6>>9xK?5;
z5MZz&i;QE>kfJ57OLT`ij!P7m=q^zlqBV*uaU4*c!R6|aV{D9R#nH1m5?SL(Qs70N
zgFs-MCvuf*1#PLz5#yx7kTNVwwaJiO-&fl{{d%{qeR&soID3Xhk9}8+?qa<F0fSFi
zhLtgX-Tlyqj(#ShW2zRasZ}eH=aQ7lGFnidb2>K_Da*kU2N~t$pd4fJYoyj_6Q~S2
z&J^Q-jE(?BK)S!!>>RUW#38#?dA#>8XKD~;O=a!)i#&GO)-_};kF^Gj7;k?Y#_vn4
z(GuHxu-e{%&9=MYCnfY$sIZZ<b_R8O239+TswHjb(7e=w4n7~=2G`&|yaxBe{csiT
zlB^2umm?ci*EEb<pT43Ps+RLI1BqFip}rGTFiSSqT*X<MQX+73)i(HGb!1b1#INd4
zm0_-pjj8ihwdoj1UOINIV6CJMs5$8rg;OWMbq(KwiJ^kAUwQAm$XHY4Ow^627!bvq
z1bZnzkY=TcnK~l=mS9eJZm8E&ix^%UTRe3${Kv&&zMRjW-d+Cs=_64u+wN8`Memav
zuZmY{06f;j;az(vdXJE}VA@+v&1|`v;R=4)+Bvg)o#x*2d-vLL!k3UcP~&!rJhZny
zUWcZI9D#}om#mx1WXmu$0d62#UW;TS)$vhh7rtyqP5zP>9QS`1`WUuYI&#q-I;4*o
zvP(79@9<hXhRl(brc(bAHHacYRaaUtj%1f!iG6pc$1PCMa3i#|KSE8rw;u|qrAVK&
zssmF?`+8oylBbzAdA=%?Ksx(&Ye9|}A;VJhK`)&sA-0_K(x<A*!=dc88|;fj2e$Fr
z!dem`D6lWG+Z&#b!l%+7675*9E6`x%okA|P<Yu~;zPa3be|HNo3A8U~#C}y2LXQ4g
znb}mun<_6+tJC}4n=G@AMJ=7_LiyQnb6$_BI&h$fw&PgaXi$6wQ<!cufwW^e(_xFs
z+x^}bcH>GH-%0$Ne(!hXs&{xLKlp<u-0=w)c)$g&aEAvo+}lp7hKZzwP32m0wLaEl
z2sKi)La{m5htgfK&X-rI<eYNa{wHS?*Ez+g1Ln5>R%p###(q`1G2y)eZmk}8pbW__
zjss8H5<}%T@9g*^QOviag7qz%^5XSc>$W|EF`3c)9^Iakb@`8Xyl&Fv^U+bT{${GY
zg!i|(NfMOXd-RZq0!}@{!2@xfC%ah)h7HsBphB<cf4w3x-AeqM=^>ExEWFkWx6SP#
zRg=<Vid8|ZZ6JrEC|7R~TRGuW)Oy8+S=Z?av%*R0juE|v1{MljI@h6zN3v_LbS5WL
z1KJe-L?YC2B}+?~<685_EygeUmjS4RmfWtAM`0)GPF+FaeJwxGo<iOpgVmlv*3LnD
zBj!J`fh2jf;F6@FxfY4j;WX^RMYt%bN;08@QIhj%qM?#OeWngEY>8xLWLaodT5WTt
z6zW~2HJh5(b5>7P%k;`v;&h!|XsRPiT6-acEzR1#n^&uK&fJ=8RY_ab(Vix+476oU
zlnlO%gchTqr?SJwKzNTlmWGJ`xYA8SHFDJ>TZKsV<<_8k8muNz)eDG_rLNgE-$YFw
z>8dD*{H#k(#E$GlB0fC6Mf49nwtgv0t>-go1vHoJyC;utuTEIVzy7HJL%ReZX}}P)
z2JHD1$*$R#Fgs~(FmP%e5q<Vd<%?6VcjZcOLe?uHwkef+A_G<R&Gz+HSIj7J=o*tl
zx9z};2@&X;Jo0O^MV!?jRqNYwIT2-*H#YMrkQf4evL);n-Hd|6x8AlfGauLvSv+4L
zc@Y5r1fbxPIC_jL{1ZZK#2Do}p6G5a#1oCyQ*gFoO^qzO#UzDTX$_8_0JyVg?50xt
zN7OvR>xi}RBO+M5R!B43@y#C$+hv|8T{T_linpTkI-^ZpF%6ln6zco5$}pmU#drHc
zfl{PwIPsRq`5Yqs+f5p{)TtF7%bC0+@w{X)Y>2bWmxdfk)EWc~L!TbjQXr$|LY@l)
znuCuV-eF8C$aH>c6VLPmuLGM;Y%TE5U;)mxsVuLh(=XYth?W(Zv=~~h$kvp>u}x8~
zH??yi=Cc@pN2S9AQeGEm1)Sl#W5vM{IS%{U(E5is;xP>?DPaW%IMO4LkE!`RqiZol
z9_zYBGGzLDud2$GU<<6<llwnR-I4IzdkO$90KW&gQ0d=TwF;cBpL1<0smMPQ^{*SA
z5G2gRYoSNRm;9Z(&#wU~Zy#-G9Oc|h$0X(RjBo#??@_O?Rx~!{DL4yX29Lr%J_?@&
zpATOEUkslNpI0*T4}fAPhUH;nSWZlefH#di<6|}Fq<u0gU<TwBMV2kS7h#3>w^^K@
z;&&)gG@Ba@eupNS>{w>j!4z|xTJ3H2A1^_M{hDLiR#f+7hCnl+{CX%QY*jAoA|nZ+
zqI{Ak<!ka!%~c_fn6{i0y+_->^AgVj?cDv^9j;GRzn{c~fy%DvG*{sC;Q-h>-G#7l
zA=Rk6UY^)jf2?@>Di{wd63FGR<M}R-I%`hevF@%6wbz;u)CaC0;*AyNi@%l46Z|XT
zclgRQ{{F-aj(iypJzwa(J(i<|HzOjE-(qbb!`JtSpL#S5opbl@{zZ=aSM^|4!`c2~
zvl2SJz92}&@*Iu+yacg~HvW9Z+OKF*sI@ga8s-t}Ao^v0aRHp|zvuiWrB4OGOqv&Y
zPx!!y1(9?2?rKzUIU^5SXaQu{_Zw%Ds1fS}&>;#D78KExQbX3ED&o`j4hvzA;FxtY
zs*D6yAe>!R*u7d?NI8ON>$>y$#%LMG>2hTW!ba4Z%V3}+r#cU97%RQR)0If&D%AoR
zwu$+AExLI2Ej`R`uH($%O4}>bn(TpJDr1l0gcF5q`FL$gzEhC)a}P*T=8KVQWr(<p
zYrjH`TgeHia`$U9xb<rOl%i%d!SEICrYS|HOhG<jPLDG3M6yTDr34`u84hN7SN4_&
zNx$`;0%A}#_ezGk2p%H+Egv{`a^-*}KdMb0NH~f(`A_jtUmzGDl8{Mc=5<~#0yhjL
z2uvTql19x}oZ>x34k<pGLRnpq3o5FQ!e8!cEU8@R*8)_9ajzu0q$6tqw<z!A?uogw
zo2i(<AWiL-OR$0y_%y@LNM=YTq30XJ0do|9c1S@C5)g(ihglTXLz`=)qdu8X&csg*
zlA0AK1%;;?De|!JuQBpHcsyo}``>iZk^2Qzc0~~?{fUfaH)D_2k-W(uXX4TNPcF-_
zaCzT}e(<rzo&Ev2=55B@6W2!o<vo}a!WokbQ=AODI?t05OdWM>`hkxzOmAoz-GM(3
z9;WVNxuU#*Zq^>#x^d%?pOOTc;DJ$sob$Nd>}M8Oa{RWwqb&i9tj9WY<heehLv|=D
zfkyr(dip1QDCn{@+pSSEmB!@!&0sJau4b?W0Gu&8PKVlL+R<++^c?#CTB$UF?i;LO
z=UBCDM}#8do*fTb@TQw0!g@{3v^<+P1@M`(jj~6)J`u1`e);VjR#|XkIP($TO@bbv
zVINi?Xgs5ggLTFTl?&;QA35QW2eB**Tj+niFps+sA3YOkwG>2@jMC=Q7`@<r938L5
zNX90WVfOr@(qSK1KQz2ngW@RnM`H5py<($sGX%{@NS>{2{|P#p+?0dQ^zTWcth4Vx
zXEK>8`|{h%I%QjyQqc9Lv|neGc{Ev6J<!=7ORcZ=QIaY<t3R!B{(>XHB~DmE!V(9}
z5kO*tp<_Ns+)HAEB{&@AG6-=uq0s;6)ZyJ!WCOK#9BUF9Tbk>h(=jtJ)4G{wtWUjz
z`{0~;kT2#Sh4$VXS<iUD2<!hWs0<68x@iX;*5C+nX8N7Ouy^7|Z%{OYxXxFDSxt5?
zml=1Q4iVAO2EKln@j|e~F8fXJ)cHmXc2KQD(3y95xq~u?pmWpQA)Q=bH8V6S?(NR{
zCI$3VN=eR?BO)i+!EQLUt=)S2UU-`ydosJ=LF*cixJ(u{c(%+3A|qEM?PMuX98a37
zd;)!tyrzZY&^eQj`wf||Tw7RVMPZ2K&83hn2E9SQ@T|J1CruYBb1j`i;rP1oic>Gu
zYcuqrHfx4fT(1%gl~t;Bx$_=C4z2{R9xE)Lwum`9I1g^<nU4*E4dc)NNeFkxv5~to
z!nU@HvzO*61F7Q4Kwta@;*(41qV~EKa_WpI7K;p{jOg`7zvC~d%lD!Jt(i?f8RM6+
zTp#*N6tgkLli?X0A0~E!%KuM_bm-j{B1`3DQqrbu=g1O@Nmiq?Z3bRppfMtc4VX?~
z*y8(24GlJRtNqT`d(9jj&~@o)yjTHz$s2lECDL0q6D{xc!Rc7($eU1lIFwi5OjlcB
z1DlEEj8WTfb?Z*b7~(9>yJMPCF3Sb%nz_VhJC*G1rF!bA-A%N=$vTAyjzwT66oWeu
zTjwkT{n`9ZwB69lgkZon>as~SkJ<k^Qm&U#ul4AuLcZWy9Oy7E8!3_5-@a^rb<VH~
z^o+GVWRF*;k}vh>UqdR3&=s{^n|}vVd?Y`PRJ>aB(4}s3%hOoi@%GM2=)^pYIbRCg
zOKd{)q>T%If5-fdKh6+K89cpAcDiBCCXSq#;S13T$JI`XV4gY-z0k;F`dn?Gn8=6M
zreP>$H$#tmpt&ttouXUh{JdOVs;~B@pe@^ZYTqB=eeSSBhJ+brSYd@3R#>Aig1?dL
z;I>Mg5!4#OGG<D#Q9=&l!LYnaEbi-38Q6R@()A9d4zuA!uFP}eg}ST=4NIn-xAZK1
z<Wq#p9GIlJo$<0wRixCOOV4cGxZ(Bhc)gNJhuvE6!MP9^G1nhYb0jP_HxfPllV|<m
zx*DgGH`3iT)B&!r(V&27{O4qzTlJ>iprJcEB&Ir6eUb{Qbx)qd^+-JiP)RzURDaei
z)1n|zs8DVKO=SlKve?_N9+*tBGJKxOI6NO0QR}x$%!PchGx-ypxdIsFb{BuWNGzFK
zh?^ALUvbz6i<VQtB2r+5nM$T|hI>D$P7jDxRf*7NO<#ZCd8F6E8Kz(}Y=TX=3C3U?
z#$h9@gN+M9Q(5;gEe;BL(z%jH?A1#%b3CnOyiBQ4;wf>z>a9y@B<32;q)P?XQ>$oi
z+SK>0<0Oj2*qDMj`|bOE=X~ORb7tBrIhRuK=+qL@kaXyHrg}N45QL~VWp_}K&9=Fe
zG66~;=QhqFrP*oSxYfSb<4!Byr_1^(?T$h3+@2sSq;@Sz{^F4E>_L$VM6Eu136FE=
zslD4uVmqVEp2M8SIjy6yGY5*NEDlpF0i3sdkdoK5i741Mf5=(rir0NVAu9$~5Q}Wn
z2s!NwQTHerpGJ6>@Y$p{l!;)GXf(?~81|%w`FSK{{am>rknQ<VU@HPOXNJ;tgNsRU
zc5mz?%?wh{j@B933_strre%7IS6uEnL}PZoZffKktxXZ;=TF<witKWyK|O#m*u!nr
zQNC?+Wmm?%;YCT3wQ63gxyYH%3nj$5tLu_q4(L|&O>rP)D+BzWlJwSv8=is@j!Pz(
zp;B8aF+Vrz=RA3$l3BQr7omWfdJe+k<SI7x=p-T`Dmxnv^?#equJL5>mlB_`_@Vja
zsKn_M5eeuOma+(r^T@$QA^_WZ8e3}Ih6-coW$0@FDS*XKITrz3mPLezQQ>(A5u!$d
zs=nP;(jjf+IZ2hlD)Cia*h)9$5p%NNJA702o`hv~p>+hXYKJDAvm*^5)pKff6#k8Y
zMKe+u*=%jvd7yXYF^+@XlWQw15OztE`wP=@S(8fxK&Qld>Fa7gOeChwsk`&kM$?Fv
zO}oJDbrxa>RR}WMldxSnK{Jy5rWL!Wwj8F+62yY;%0#4Ki5*u<7c>&m?eS>qM9gr<
z9C5<a<l0hh>Ko#Omu4jypH|5TBT1Nsos#7+cQ24MBw<X_l$4~BFtH{B?*f$-ctC2D
z!Hy_Byh}-^KK*xfVHh7Z4G9^eUO;HvKb~S4FE>qnIgvBGa*&XnP{2ZaSF7Yy<Jr*>
z3SmlCg;q-(p-<ebe3R3Sx?8MBut@VG!h*j#qvGa<RaDs7tCZh4yG1M#l>mfztvLZ0
za)?sasG{-rPZ0MIWss%)o6u6l=4qzPq9R*z+*mXA{iyX|Jk|+gg0-%(jp8{~3UF|_
zFeXa+$2xgWm}ajIoUocQ70wHc6t0=wy4p6G+D1-Mb&*eaJ;K9@qlSitkDV}ig8$5=
zaMxBvEaxucHWV%BD?zMDvb>l$>4tt;tH%wIX9<>$UW{od)IKZQdTZOxN{TV53B8!#
zwX}{<6e4h?f=YpvGk2O`2(2~f{~|`U!sx0M8q!O<LrXKMmb7n!2gL0~+|T{&-i{3;
z1<tm$#EpHcmI&;gZ)b!>VynHZk<`6$4uL6l6A9a~5IyJbWC0pYH*RrhC59p+j8Kg8
zyW7MSw2(D|i8nD$l)JieQJ||TXlp?7m@|1gB)#idcs&Ub*9WCmtj~rMXAV&LxZt2#
zzhnrEL2OjLQpHz#qTfH0_L<XrjZ7S~iX6q5vG4r;)|Iv%0!GtyPgHGUgoX9X%-FBU
zgVl8*-C+HF`+G18V513e80Dk_vT^SB1}cf1GDooku86XDP7+emW$_Tu<@U0sl`GXn
zt#7w`Wzv>Y5vjIzTUCxYMY5fw{qA<zsS!>#XT~#mCup=<#8}B;9%q`UD9?_wPbM@j
zMz1F2J8Ddsj#S4ekSlte2GgZp=y2KKGj`zOT*q<WbfGrSti+NT@ApFjhIA=rAk~!U
zG{yyONlucYxN10`jQGSbJJUup1q32Dl7iD$U+mORkq+XFUs>LuG0g5X#Az}qA2c|Y
zqjT9@I_FSq#p>;ygEi=&iWHE4gzz9b@+~zRzHq+8%FULf0l#uuh5kJHa;cFid(-So
zbgy5%Hfz3b-FW%4XUHjgW+WFt(7!YiI+2vJeD2LtQ#aexj`|V~j}RPpzxb`GmPXv3
zIwb2pd?&??tbk&dsoa|i7*HBP;R*=DfC$Z-YI6AD^p;sz*^G|@=EkNe&15yVrob!X
zaYzcJbO->aVA~K-;-;M>os8j#UxIim4pVEHYb4VIp0yPbnY}Sg7?s>oh-zn18h}Z0
z;muJa&FxMZmSOc9qo4t~z>Le<p~@C3W4UUO3nUv>0ZYm^ra?#dfJ;K^BuU{b^EAuX
z5xHW40xwoAWikm%Ns*6^qY=vKI0eK+%a9Y`>Z~1T9tq`+VN|TNbhPtkyxvuyMWk)`
zWcsUYetuqRExFgbyKS;PT#qFkYOS7PHpo^TvpitYi<HBpqMr&aG&5qqz^{b_!IHrb
za(WF0UCA$#Y*2}<Px*6?JXwKy$rYpNJqgN1!m1u5&y{t&nQw=d@XH_g;<l)Jm_$Uj
zaj$eu_~h|@W&L=!A7T=hv&A{q6FDuL4FXs6W4-c9lL901)rT9Tz*dd|$}7d>hF2C$
z!w2Wls-~L;0x0HrX{Lr^tQHLg8d)~DB-f*UxaRp!{j~BpfGoGYP-*`eyn$3jliBj0
z=m~xEL~O4V`g=Kz-^ZL%cKT4*8(aHCCH)O}(d<mU+_KhQDQ|Bj7FnK-5<X0}j)v1R
z!TTcJx<<O?bOe+w3jOY>l@?hL^?#*dvtZ+9G5C;IBZ%fBqwa7Ev8RB4>nq8Gb)q=~
z@xII6VNK1E7*>RPPmo+ytJM&?5~&gcN^_yEQ8XVB#W8FP5-NUY@UF&&^$|{V@mck7
zui~C@6D=J?OuWHSh`W(WGLs6>T5RH7Z8zb9RGTJERrGStsYAiM?}2eDCqdkWT51Jr
zFIg1Ip<xstMVbz$zul7Tb(nzx3~&Gg7{CAqlE7i`B+yq(`cc<SlA<K3)ULxRjMrpx
zgh$!)M#yoC_+eEoa_J(T#jrxKkd@%>0-PYoA&A@7mK3^)u?U?@eHTM;6cVYnj`$2p
z#e8xZpdT+5dnLR5p<jINIX;uwfHB4W^)mODCU@23G8*wnoqYc6CcC|2SyzEt9RRJ0
zLs1SvxYu5zpe=H^{|Xw4208tB#LK0^mC9V|(P`oBT!y6B3Xt8kEpA_i+n3{x<;(=-
zlOnOV@yHoiphIqdj@zH(+Pc3>83ZOYCYNd9!nS8}Lve1{;Uc3~JBwSaoKxP@o-0WC
zmUH)n;}_S%P{0y}P#Qj<777-r3-@4>n@=UqDnw(!ebeVhj|&prL8#;=MdV|0G{BKa
z<%Kd*Zc<Uke!(vIjAdYll<yqS^X{mSxH;SF)!jC5MrYb2!6x{*1QQfgoMd3VH_12l
z8@X$7(n=`^aO$VWmgB&0v-OYFp=tMG*W#TNiX6~u?yDdD&vE9)_*gI;3noD1J63)c
zTz1ESsp5K8n@j%vFX_g#E9i}Z(X2F*rwamroD5lCmSbI*XmXjtUF+r?hjcu)|M0bH
zmIw%E9C7w@112eok;aeJeZPkTw5n8)zd-`!vJ|B#u$QX^(J4Ys3&J2JlF5d2S?VXC
zv{wsFWO$t6fW&c$<`T`BHa!J?=}?0j)S#B84M_jyAu?5zl)oj#%^rgU!O-o?)%rMU
zSOj%clj(M!G4r#5N;ywLfZh&Fm8I0*4bI2|`HGEr^Ikvv!)EE;$hQOEDjs&b7oXP-
z&#<63J^tk>!)T&N4h+$<l(@S=-LOcrWeC|A5Lt5ExqwCMj43U_S%z<@CO1NX$!<3}
zr-Y6#Sh33t2L)3rLpfrKVgqQTzX&2|-65|%*=|8>Phhc~!D)L7R<~E-R+9D;rcwQf
zI{xq9`W{58gLWijZBx92VTD8{g4Vh)jCyE=3BZK5Js?k$r#mzP$~44#BxrJ^p+QLd
z*lqZY+$;eB>ooDR`)w6&Oj@QfXXk<uI*8&a*8_1G9guXX6z;@BH#dfzp-ZIkWck>K
zy03YqVUqZ!Z^1S9*1x1GjzLX;05lYc`jTHdjtG*_QYkNz>rjdoWI3&%Dp-n6v;kR7
zGeC+hDg|8ziv4%0g#nl3C7F_Br?{OVOv8+%DM?w7o0S&I97D=7u_O0Y!uVmSu_6^h
zh0_G4A12cI0hMbmy<wJdJezHW%`5&I19K~X(jh*CT}5<|5K1sZ@<NVCR;8YU8?z+l
zwC{Vn5<Vmt$ag{ed4gT#!cG}nnj&&UgnA`rwmI<rj@xaDxpd&}AAz*k?_ch$jG1Vh
zgHR|Z179|l?Rf{s$0IoPW_DsN3J^KWo6BrpAOTHOJ4?;+Ip?lN@DBw1eY;b;Z!2a0
z#cjh)#Q8UMXRko?f7kZsYJ>ZMUCGPD8k4tOl)kMf*=mGNz!jLOASF*aBji~G55y^b
z)_*1HTS=fZ6Q}|mGQTLQYl@b6Nf*|d$5C6W`xSEG75a3()_qDj5Q(hNKhJwG%*n*~
zUaT43TCNsLQ&gN+gb8+XsS{rxrYn_@Ys|5U(=fmY!6~*-1@eC{ARLOPxdb$ChM!VG
z$a(m+H|d&CLptAvWD2pfR1lpm1Sw2Hl4SxlUG|oBQD=2Ym*W`}Uq<hX5lr%^3Cr2n
zA%7#~Dw%>D$_R165=74=K`2RKZ4QD7vMR1ZcVon%&F+AD3vx2shkXsZLk7g8zEW#@
zyQK%owoY*h!s=*heuare2+28G$2CY3_8~U|eX<KT;gO0veFUnIl+BF^^x)Ct&8n;r
z^3l_KX*c+>j&^`>KmD*j@Rv0QngR1Z&;FPU!h#c;7Q#rHn>XkTi{I9|X6-1Shu|{8
zL9#NRl0gR@MlwPgkCOzCX-QPb=(4neZ>`8E1NotGx#XDHW!YZRNn|pvLr7I^&lg-x
zW6g2NP1tlc2RXLJ@xeJBYZjSY>V07y?(yT?Qwu?%QXj=(l}awm=gSSDSPZTH5XK8Q
zLW$*7)>%B%F~%`V;}GLItjYG?YFy^yq?^oUE!{|Xnw3lyA+9^}LR%1l-E>9qnLf$&
zgsv6oW-JEu<xIQ|&&?%_G~ot8zENwm+vQ@hQYjZk8VdPp**~}p)3BHT^Du?k*HGhr
z4+1NWf_yo>FiKKPD$`7~77Jpyh>kPSweQS;+&6<!J|l0>YqzVa)|p9X<6yL9&?f#H
zJGz8Nrpmi&!3{}rQPxp#42><wSKvGwp$b|cj4`N(TBw9Nh(mj}3U!^W^PFq)c5^2m
zDO9s)c~4n3V5IGHg8V|lUKwD8>^uEVBTD<OJ%&Ehs_Cv9v<{9vEYjAAS#T6$Q6rGa
z+b7_>hGxixASqEy>SB7=rr}Y*E1=1#M**Hwe6vZQZ-UJeQzwf48pB2eiBDgPqJH(J
zoJ0#ziiQwr*M<uGsb3z_lWX?EegYn6^`%{>4Ot>rl<&sfY)zC)#D%OPqGdeSS-dDy
z4jSMz{VYZ^gEH*<P+1&GBshtA8qy%r{gr-gDvA(2MSC8LtkGOVri5VW1qmZ?2N(eI
zpd1(u^hZ%3`CjMd%!XI5iDWRl7R>}5XBvJ_)Nq~*>-F_YdS$1~9^vgqW10c%mnUe5
z_+9~VEb1WaLfy2H@LB;Nm7x~j)?iHj88mv<-dPY4cbvE<iaPUr!mW}PA*WJZ&K(E6
zU?z$?q{sRi)`_5P!!0QG7Bf)aku1jP$*@a|7FrsnG>3C6I;YNHKDgwCgNNc{C`42_
zQ-)@8kwhlQ-7G=mBZ4UHCX>4XCVVpKszZ^Hh40RVNs5emdpxH`xm=_U;+NS}(wlIZ
zw|OMSHG9LQ23*&|Nd0Vkv-PS}n1XfS6BN5S_|q<YwuVPH4bm{^`u2iw(ve=;>1P6n
ze#Z&PXuEc353cRF5+G7A;#cX}v)et47YQ6ueHg{VoT4zU;%`TboP936P)hh?LN>=e
z6?!gkEWpVyxFYOO@@TL)(L5nBV9J5rb$3V<3)dGQ*62i2f|QuXw!h090D@kz0UFll
z^zww*NYha%NU0c5A7fz|PZ5v^L~<|=V5iCoiAuBnk|{+f><{aZZ&Y+1<1wU2h>f(V
zoh4I5Ya0PCr$X=ozqyrUQ>Z|6xC*eEhk21`w;xJeG9PM)=iIw6MZxHU7pDo;lOJw8
zpcyWwyz1KR5no&xgTL^PnOC|Nb7Q{l@on%H|D9F`x@Jh^5FzBL!Klly+Y4#16vsjY
zk=tv%hwe;S%JRDpoRp5OlPu_@j*S~5QUXw-76$vECRx&4OO6&!NeY5fhg}dLGK3_g
zQArzo4)Wd(E=DoK;N#GK2e1f_M6p;Vla63mJcHf*oWyvBywCD8WLB_ao;y|rB1;!p
zJ!Wv}ZFF9eF>sfpSU6E;j58j$RuQzPe2wvR>&-H<lXy)s74b;)%Y#+pyg<?%?z?yO
zx*&i|V&*Wd4<r`rO)n;I$z|=A*z!HTiFc?thAmt0UN0s>n2m7NZq+6yACN6ZA7mq&
zD^Kr@#tKc~!}`o)&3SET&x3b8KOe0qZF-aqDzVVB?FAf<>jvEG(i#qRq!Gj`Pns=(
zl2)dN%;z)pg$tiaI3*O5&mH%Yc~Gy~QM>PR%VSmn6dpn5JoY@}-U;U~BO{8FgQXGs
zLxmf<wRGG8;Xx}m@^h<?s5owP@+d!W0f){zAP1AU!;X2^jqz3BK6$`$%6fbQ#%#~1
zwSt2D`~q;EonL{}h?PX2l<1QZPg0Uee)p}F07xYEB$P<(NePl%qe^ZQZAoQ}7r3ED
zjftiW;_JwX7PBnk7CIzfW!rSTRqnM8z_>C8W=a$HZX+xscur6?8dfn*aZutowfeca
zDY#i#&c;@;iw75?PQw&KXe?=zxsL9}%m(AM<O7_aII*5t1U=wN*}e)<JFUTX-PF&N
zg9H&K3b^FGZguH3)90pj+d>co%C)wt>SMbNgS<(5cZOW8K}IVTQmIrv7l{-3e{9G{
zhCMWnn@mtqwnoIev*>~_)&16UkTFdjW;{;^y2^XbD!^I5hq4_i&+^&1==zC2W;qeK
zvoHErE7A1qZ#~TvJ6lzh&9>@!Kj-QY#+y9O5G7knh*TE6iq0qJ=r`fgX?E`%!<-MX
z7V>^4WK3=ElbwZ2=lj}j$aICpX=B7MTGGQ^4$5hp79={v-EIh2AbnK*{lupj@>jLY
z3+a*yMmc*~0nM%ibd^9?)WTFUO<{gH+wkAbmRm~Ek?49(-n1PVp)|+XK5%(60VHNO
z(vG;vA3Ims8CD6SNJnwL7EJfTP#psupYi0mEzJYM=puuqobEI5`VF{&Z|NKR+#<ci
z`fsBtcv7s-M-qfgVo0J1a<jD56bDHzWnzL<Q=eGPEEd^8GPk;qY<`m1$|z4nz+hxQ
zw_^v%%x)o{lKP0ab(j5T(cNL^@4GwB0AELrZwI%#nLf{UONM-u*>aeKU2x<INOZjs
zv`PctaTsJoTo~OI5}a|eTuKo-6D`GHJL`baB?n4*vpdnJ!=SreonSpfUZRm5)Gw3J
z0?$iA!x9>Xw8RT@UI6jKC6iCqAg~l5Ietuz{d90<%jdU1DEs00;D}4QO!JZ@YR*IL
zucb9#GEt3E9m5x1vy^JVK}#y}RLZN9u*kOC4Al)Sl0v>-c#{=4&v8{jh#JvCKDrcx
ziOmpJh8Ra)52YuFwm~e7yXmh6UK@59=YA8UOkOI|KU7o(H_j)r%Q*LiA--H4S~#2N
zwLc;BZZ%;u%JofV^WkqhA%mM+$s&=>7dsM{^|=$~lpn_v3=vTy!UK(qPFq$letG+3
zWrku#Vkvo%tFZ*xb6pwQItklMzE#Ta3WDK*vAfry%T;TI&<3t1lQEcMg@IDusYq)Q
zL1OK3g=rdz|NScq#IF}uHO`0n<%%_*I%1KDl42G;Er_RV^(sJ9bV*tAp1{RHzy!9d
z6q>Wc`RFK&r&y3<sebS&S0yE9`Y2M!2c}sZodqIOIEHNQH_K*>*ZKL{4CFc><p|>n
zYmb?5ouo&nELGzwT^Yj#(s_#VD8Z(p+9jqSCTI)OSmb78_DrUzNlwlQE2~Zu&L9e-
zk`@?t;7-^C>tGYCgMR4GvzTMyp0CPct9~kV)HxWAWrx9v%49LKI@Gf;h$nSr_9X#`
zI58LbrV<3%wk2-GP+KF*1!6A`@||fVv5zsed$-&6``)T7E_T8Q@J7F-gh8-pIDpzE
zlhgFV>os`rh(vk}855CD!z5}>$)g~kguJBQ05wYk;pueQUmBVvMxIvZ4Iju}SeXot
zW8MBSWirWJ)9u!Cmo!N&6k@kY-<rp>vFYAU7D+}>q}OUyGFz~Q*|8A6*bx+bUu-lu
z-IB7IX_w0K-m!#xH^x)njr(G^0Sr@C@*QKsP&YE8E|j8_o(-U@N)B4~8A^6LjDkNV
z4A<@)2tgclX`?7<iI7mJ3PDk!=_b0X&6$#*fr}cKWOkNMcB-0QHyj@ttyQaelc}Fr
zX*;mITVuvL2`2XYH*I@tIVB7+xQ^ijL~v>!Y3U6@ZS`KEHf;mm0#m!O>QdH`h&|6W
z>31%P;;LdM&O-lIm7NB8WR5N6Oi78`HRo-ip{ZEKB&5IaMtI;WUBdAkeB}2;Z7LLm
zY@2(YDvqi;<bVmW#dN5iS8CJu;7%uff8!k#MV=*cYC2TRLsT$Rv_<HE!8FrQ>l{mx
zzP}X$nev>9=+e*)MXrbIm(-T6M`dRC1Wn>lFYsba6!HrQ9hC};khl9*Fteb0ScxbM
zBcVEBYN%}<u42E=UD}O(#~={Z8<LE1RuSQX5k_<ko0*Dk-lnb;ZtFDuz2^uW@nr}7
zkjqa57iAPqS~4THAc7%33-A_j?x|kOT0IXnW$3c89?na`dFH;hC;ABR!O*`ZS=^q4
z)8Q8tL8>fpkZr=(*6d&jB%PuxPq&3v!j9yLE_tfY^)&CeJ6+g?UD(aF<Is29j79yW
znL27)H4@YB3{R0j(*<Tf7$mgrPGM@5;rs>y6RL|sljOP5Ano7B&_&@oR#{mQ<gzTN
zhcmErNhufE@b4P}kg_dFt%v~$x^=;kgn*&(g2C1ck_j&;_E<}RhO~<&Win**k1ll<
z0JbX13rN;ChC0+CNI`e2GeeEH!Bw1ZR@!4{^@CMeE#iiP4;ClWp^`55ciT5M+_KCj
zxjm0?eIw_-R5?gu15_>+r1i95ai%7+T6+f8J5KPwN5$IkfIjq{Cjmt<r^lNv8px;D
zXu~0m>O}MfRcQ~-h6>FV*;)VY>1lApkKbq_IQLcd3hg-YR?4xj8lR;K)Ug4W)C-!V
zkHmFNl}B(4uul!bH*PB%S4(}GyU&|1G>4mUclL|R{XMe{`NK!Z@Tuz*<q(3r>|r%P
zN1AJ<fTW1BEUWAy^moa4NwE-SNEP)X#@qpSGn_Z%$@qONBU9Z~Q#}JBQ<do)Mi*77
zR4EKDOl>Ijt_bP0O6bpg#7E~j8Q4A`Wl2Y5E~EPoFNWA)I)h`zL}khZU4sCOippdT
z!{k|YQIqVh(=f;MLJdL|-qi>hRhjPwLIA1Y#}<Uwv`r&+iAbe8CK4H%sPueQjYPU+
zhf|M$!N*?R6X2uaLHOuvd(dfNuA{R?qFaaNz_Z~ddV?q)sjN$$@|8I`TFTNYk+Urc
z(vWc=?|q@&Dk^>+Jz`tBCS{Cs7syDhq+(7f!El!>5P5EhO;RxOQVEDVsQC5>fH(TR
z##{1OXa?%O^1D%JE?0R{UgTO%Dabd}s0TG=sbzCRwtkF8dXWZkPP?xkhTA!n=|KvN
z5ePmVfHKms!cc|J3Yn(2SAKGJ{ZGxAnn>l-QIHCgB4N}iHl5L}B8VhS?>EvSC)TdL
zYyKe?SlE*deg7n2xICN4P3|??L{mVWEDTI0kHNjqi*2st#%wYp@)IJ0t}5tiTYYpU
z5LABCy{_2fD^$BqIu(q`#<s{*_%yRE$~0W3z0+Usf({FApRO0?43`W(kxIlea<kka
zSLDnzbn?>()0^{5CIs$L5tMqB@^pXIMOC#p${2K<-Vk-H%v$(BJ0GH99Qyq*y3|;M
zoM6lulaww2R-`#UhI&vXKH6M&-6n4PBr?D}JhnkDr8=n?QR=ImQ<u**2&z73DoJ=d
zI78lAcw7`DywHwMZ?ieayl@w<jNEIXE;YwSFS{GP63#i2CcSfqUz@CYZAGfNhRKNY
zuvL)hVydXGc6c`!nV=)2(fjw>c^_DPQNroM>;{#~x;|88^l?iSa?T*Hs%s>vo&~y_
zBNLs0e3KdE7@zSwx2>3`(~nNqCLwTl6N>vSKxnZS%ui#@#=hlCm3l`26=gLw&y>}a
zm6eq{_gtb^yhWl0H=nv9{FKVtr2PZq{maOfJKA-y?O>7_)C5a(nOnfQ8r6cfOWg@v
zq{Lm5|JRDx#*Zt>R~YLsAUj{aR-FyWCJsB0$;s8$+HidDSnllRe)5@6Va*#YIOmbi
zF@WM^v}fZX134@}@^!@+FQ?at<SAr04CnbD<B|Vkt{hi57-TAFd&_13;aJGNn&f-%
zjbr5ZDZI5Z+ZxAX(B5d{J23Xu0p#`Bb0C5XzimmNLEL)9oNqt+a#E*u5GoLL7cJ6L
zfQ@sID8sHhcOF5;TuLNL36b2NX79Rc@&1di?83wa+!-;yoh8I*#sCf*R6CtdgAXU3
zn2(6IDEZ*`k>aT9Mx%nvSxAg=QJ*u<QqH&$f@rJ-l^7afo$RiVvG@RgWipYli)9Nb
z9EU8X=%l2zU2vl*lk>F~DTPH;>qq(JDqM=3h$en{avG!ELVFI)@X7L=u>-A3-U~gO
ztv3WAp;qJaX+j4)9aJhCO@ViegboNj8Q>tmUYQoI!iV68KppC-cm<dvS>QjYs<`vn
z-2%FnoOGdJHToQtFI<TyR2R>fly5R-ggGK;gfL$gQ^!4@<BUdHDmJ&Sm1=M9+vqEj
z7#=mvo=O>t$70E>zXUYpi2rH5VQ2-pJvc;-P?aW0kt!7_cO+8YlxQXtF)ka$PR(~5
zEF}%{1aVbKBzU~#n^(MQ{YvDfgZa9-(Q0+<nzt{EP!5<66em+aNN8+_mIAD<3nD?&
zs@;-Nh%-l`G1V3S6;0pG0bUqrxh1=6D_MLM+ZyT3!rU`1`DydoPypKa8b#i;n7aCt
z3Cxk-hicjxZL)-%g>*(+&^hTA#7Q-oXH)*ciIK@$u$~K7mJz0#r{8g)J%fEAv;K6V
zekZjX09i|SA>Or11Ennd^$cW&`k;T*ZY(+0i1=;`(WR$Q=Zxt`TW@^i!8(-6>{|Zc
z;<Ze)+|z<BKWK?tPPS-t@n61;46D$Qn1TtMkZ6JkI?#a#I!ru=(=Hj6LZDiQfyVsU
z^|=m~x#B=N^1NRO=E^Ipckz`<dg}#>FY*S$IT6{ch`?=Y-Qbd(q>L1e<?vvNLAa;2
z(wJI-_w#lms!4&{h>Y?;V_u{Q-VG}O5hTxY%x8Iazd7vDI!tn-MUf>G)Ll4tHgp~4
zlPpbVFxI4TO9ionaEbsQ?twO~L(pz@4KsqprX%b>6rqGA33s?gJXCTNY3LBt){$Fx
z9IlO-7NLh!8Culg;w^q<Hh!1{=Tn^?2%ZpzZ-bNLjaw0hMCAkp6xxj!%Ub||bpi~~
zo%S=y+Cf+kicUrmb3$i6O!NUV?<<VsU`MG+<IU*MdIn2ez`wzl;5Xv`(+aDa`-d&E
zWxQn@g{m2#3t7m%FS4{eOT;3TQ-x+ym>m>f1yE>FL0~!j8@fc$JNO3re+CW2t0B>~
zF!)-h0wn9w5r)=54=tOXnLTySYrc$`AbBg8L-b9^9H#pSLd<AcM9CgOYdFonXe%-_
zb5}e=jZUK;O*uIL_j?({6L^B!^yli)kqipzl0cHI=E^pXKzD2yNNmM)6ru3b$f36-
z4vG^eq_*^_d<ROCKc7lxtVk#E<V)C$!e#r_z6*#s)|4)NqMW)x6fGpm@#cIKs;??9
zjbEJ;6mpTxJ0<hs&lX3OY7eg*)k5Z%4z&X=!hP*sO(nbFV_>&b?e!Hr2N3B65iZuJ
zREjn8T0jK(KE}q)?K*b+Y3C>m?w#JWjLQhyVcys)+#7g+Y~De?pK#(<ILSn^34_L?
zn>Dinw+Zx=G*Bm<dIvwb4<WTMznpsXBz6DB$O)#qn}!YyZ;d#m+mGV?Og&)zBaLTx
z9RTX!(@DHNna&j9B^yiTk>q-+6dBZa;UHEZ6B|6q4`f`Sb#-S_IPVzxZ;m`8sRvXM
z!X9DJE$v1%(~&J5$o@mk%pp_{ry}KeibUPbLg=n{SXodWqb}o)l>qGsJ;tV}MhNGo
zg;vawyu_G96%}zhMzu;vILSnN(uq6J%!8j+sFD1#`q&L^HKF=Ll!r_^IU9%eyOJ$c
zJ(BP$$&$kr$?eYFZg3JV&SzG1GB^bn*_unWP$7q8m<b^si28W2qthUYDKL{)TxtUY
zHY1|=Dgl1k)8&he;MySPRv2JhS2?Uf?Yjo^4MZn^K(1C5X$e{Vv11^WXv%p4=D_Xu
zJTt);qUxbf5`i;b$>N~YzOY2etxz#1B8$^6yKCz&<!r2C+ek>|f`9E=OKIE)#e(8&
zJQ7hGTv)4gQcOdRq6I=st6fXWHGYAL7GKEBjK*A9L43`#C@XDgW3gLgoJPD8rDkpk
z&D7}kymVf1r9IU(;e-Ht=FN+Rkf!LIrg$_fM6CaT<EO>VeK2jKp?A4}_^S7kE^L4q
zV?wdpi#9a6Rc*rr5=n>>;v%!LwuZh(CN(aQXtx|<h`q`TvKPG$wo`dCWsrNE5NsxL
zI+K03sDB3J3Z27q<?&xq%hsU*Rw;qXNsrJXX_hPiFywUlcM4_pcxcITX1&5Viwv?#
z5;aOXH!9gC+4_dygOPyd`RpZ3K5WH#NH0~MCd7UNV<pp$epcU9oguHF4)j!3n2gap
z)};9C2lX;VEE`bBEowhdI95cT$(LhD^Rv0Oh^FK*f(Pfj&k4eIcRFylq%OEXnaFcU
zs+&mFytOnTcUl0g-HW1Lulsxs?z8!%n3o8q6InR*O9MxaT(Fh6inSW0z0}ML;0VKU
z>Louy#qmh{I=kUfJ0(MgiClD1UsXLmlcWJn7$$BOr$eUd66|APIcE&-v0`dmjDotk
zHfTL|%0oHH4@9{l9@wych^^>biNxJB%~wK05~%a!4UvjaDz`1OcBZ6!!(Lw}ay1(Y
zpAzdjB@7}VC+&*(1~T5swi7gW_-$nIHF9|oITS{5-Ug-E?gVKn-4)VO&X{c}{t$*Z
zk~0g*_7bo26+NU3VeI9!g8!)UL9FTZ=rMc22*#uFt|fzLu=6&Z8Ebf7pm$J+)p12T
zG5d^GH7XL{5$5W(F0u<!8|+&H0~VlXkMuh~C1tS&-Ks?biXIZpR>1hg<P@Aj^QB~1
z1E5TXq{B=hcNDiDC+7`hI5BN%+a$D@!l&iERpCD!ANEk8ebq+lw}Pw)Z}+B~5u)2d
zQi#(qh}|?stUnORPsOSIct|V^^b2d<i}b__Jdl8xvq7Rn70ia&k_vGZA<Tk#^O;Xd
z4|8W{*U?jTO(!`6PY*@rlY2FE3^TCOhRE7=q#)zehvEy;Ksd{VH!8z$i}CZyzLC6j
zigUv+_wB6Po8Ry>RWjT(e^N?$P>P9IDDPuiEC>|Y#;K-$gZO7`h8fpQyHk(2?WrsA
zeI6U&?AmZY#O`(IK$=Ev|L3!|QhYHpL9mb{9V}o4Dr(<}O*%mKymM7kzL700IFwxd
ze}`OZaW~<zTEWvN_N`{{zws!Jjcg-0^R2@y@oni|#Y(HcrBa`l4-biMcbxkgBR5`s
z?|JMqg?V`JMHS{r-O{jXcJuzZ(lqL70ftE``<DGOb;?SmZ@?(<LV`}{5~0r}<hlSw
zPy|J=2#R8PJ{%dT@1+da)Z50rsFGq77RleP^@?1#pN^fBzOdm6rr?@QD(GS%Lvu3a
zI@H0A>~~8|o5fDHP0B{d69fNxR+AqqXhbw$If+B8sJyD4mE}p_kr|vARBj`dB`QUk
zROTXbvSL@KD@LUaQ>uJj?;$#mC1{(mXAARwX_=Ca$i|wiL`?U_lGh9)^-S4y(ha!{
zZDS3^#cP}IE^-6fED34S#-=_xs~%r#PF99^4zn&b)dDU^XhqpN8Kyc;<Cirxi4Wtv
z(Bu}h9&SOY>SN3NPyQ(8<hm3(YrT|V|2(li{ibmr<ukW!?nd8lXCgf3+K>TCoE#2V
ziYt5t`<Y8=K0Sg{Fr|Nd@<6b!?DxY^CvGU#b!;l8f0BhPe#Aa}%3@z1;^jEHlB@i=
z3$lh!;h)=Ce>GmoZCNM#$&HpeP_dd7qh_X0j+U8$eLMcPedG3&dry3fyEoGBzhx6X
zE#X!Lc{>`aeq1{|b@Nsq%P4T4wEE+ppE`UK-amG?|FQ<KS#i5VnMyc)l=D}1V3^)b
zvG^Xs6bf-L=~*PZlO$ZFPb>}yez&cts@CQk#oQH7!-OrE4L>q#ip!7d1BL;;*lk4>
zMag1}LZYRL$Yc_Jkrr9%nLZHbzdrPXq^E~gru>Rz#@m59taEX9I7rQdLP~A|^iyIq
z3Uh#vgJ4-($dwQ+SF;eTpYQ^P7<^FMI}1^{pK`(N@WTG#yHJQ|Vg#jfgj!(^naW`f
zXgSg}edE+AIl%RpK|)}fW+T!>C_@y(?22{C6r<qEk2~!jRiNOC@3@jFP!Q;-d9da(
zjG%4Aq#ntediobZjn)}*>JMevf^2L9c+}0|rZ4#G+6<_+30QKGxYo*)&mo+K@g?G+
zL_Flgdm%9&@z`t%aTEz2gUw_kbGRq_UE^c+_GIGKZa)ax`2+WtymJ)4|36TQmmLp8
zJEk*4)IPNtlhL{NNx4?2XUp^xw`X!_CWB_O=rEbOd#Of_{6_k=%4F$lMeIIDx8Jh*
z>vDMVtv8v=1~Q?D*tawBL~hpr8X#Ci2d>&IKd7GVKu|vD(dou9<2ME~{l;LXkhwah
z0+i^X4CHhrGUi<csLFH@J9b;q@&Dafe53c*pMn4V-=MRQtO#I%^z!uoHPA>n-DYea
zDXk4vBS-Nz@@Xv%VFg!ax(E`mG@nYOe0Jzf@>@Y)aBX0Uzx0c}gO~Ww@I2XU!8HUh
zQuTZ%sk#AMl7Mg~P|7GH34}4YF#1BwnAT`yc<mEbdG1rez?LVz9r(2%S}D#of|Hr9
zR+?L=M@yMc?ZzNs|FyMu;LEFP@zou%;ARm!0|Azu*VE|{7I;J1U3wG~6C)c9u!Au~
z;b$<2aR_}Voyrc>tiz1YB|qy`z^v8?+Ee8K7%^nxvIM;#M9?Xtm{X{|DAzC&a4WRX
z79yizV~SGf$Gga;N`|Qg+#7F`8i9slt+Xc)j#D@$KdLj!2$peqW)f{gR-^fpg<XQB
zv%eKab#`qcBxMr&Dqb))JkM*p?YPL+cS<1zx)NQJz?NE2%DQ+=hk*%$8VM?E3T|_`
zOj;V2S=Ep41moG@4nzyXb2}2)d1}N~=AhE#dGh}f)5?VD^@jUtddF0D2MsqP+$o0~
ztlC=hv}tF+A24&@C1se?kCZeUhr*vvJ{AaozXS`N3sj!b7$ZWD)^nUvwKB~xVR>F4
ziP<G$5^5rUR-l!2saSy;IjX}`IhS16D2wgbi|f!wVP*{Kw`7S>f@FO9qrlPHgP~Ab
z<Y3`W_{90%QgcFBfhqV<_&Df;!=d~lpiz@e>Sc&VHx$Rx^U{m$WhnBBRgeRjkqfxw
zA^K2(Xet#AOgdXzW9CDVccPVpzgWM-lDSMfSPRY{3F}eYev8LcEj@T8K$Od2ru6+l
zN48&O7+@1VsC;1zeru(@bN6pxLW)V<0!K}@5C$?#6E4lLAZya++$e{jkZaA4nV<#I
zm^2(>$*M%u3J{A=E^;}iWaD1W7tsCR*l+lj@pyKu6oQoQOsVntCdz>w<u8Y+q8OHG
zN;CGwTE*nAfu<q3oM&0$3@$Ya2m98TX^qqd?U9n`+J8Oo?R2}{nz>1ic4l23k83jM
zW!%;pyExdzY(BLHbJTX+I=mYF=$@|~qnyQy)YUHTEik1@TJK}uY3<T=5A*LZNkZ0c
z7#6j-v8!=`CD(>ZyVEMbML(H?D(2q1Pikjvi}K9Dbz7HA{Tn>LN<?+XR1u)Lmc?fu
z<C+$oh@Y~cPoBh@54K13Lf4sZ;F+}XljIf<T}pBG6Hxn>!%CgGQp<?nlB3*&T!lSq
z{C-{1Fp88+s#q0Mi6seUyJ(~#BCmw?DHl5;%8GY^Papx71J_-F{5AOH@m(0Fw*^=-
zbTUdP@GkOqZX{Os)NRuYDT*(@S^wV^>GL$sN^tfyJ3EmwZslsLlkSc%Yxr^9DZ>@`
z1n6vhn|dP8z*Bq3jkbs+8G6X<%k}o5;O{dxhnx?r?zw{?Qn*^{06gmVM{&6Tf3aR&
z+M{rp^vC!P`DyQ@PLB>YkG&-5>RT`8<t0N96Bg7NW=s@wO!nUP198k)sUZX+DNTN6
zw^@GRnrVnKHA2zM9c7Vybc|K21JdJZi;N6f61ts~6HhZfBJZ#rABOpMW-?utfgqJT
zQxC?j1Ld=SmY3yF(@fJ!7VD&rmXv<JhN95Y`pU>wWcRh#jZ%GM9<E74kfnyyG1KK(
z`+5;y8Y9W<_-e4H#OEdmx9?3^mFZy@-F#|)Oq6XexB9N%c~L1nl;Yy`gFMcq`EAB2
zbN=ll|C<$dVQ;m$Je`G92nSfWepbFbFjNTzepE9wW<r!G9p<7vsBT>$e}=2N*T=cd
zF1)$DM5gd(AMJCX?N!9j$@M*rsuSm9V&oY8hl8~4B<b<|mi#n5aEcTfN*N~Zs<uhf
z1>J(ukQ=Xxs2bC1xGZ}VfPS7&B~JsSRzxIB6+f9RVxmziBjujiWWAmWv4SQrlv08P
zMnnhd1LM>F!1t<-oSuw&31SvPOpm#H@SrNd9aEoMv<R-0kO=p#%)o@dC{V2uaRQoC
zES!%8K@kd2zyf3>+#zHRQ>by6Ed^=CBV{l5_@$u4=3fh5=dF1{*b^GvN)(z25&YLh
zR|j<bB_|#WHGfGz|JnWjzw}t8`}!NNexBdPc8`7u0h=>q%vNRx2od;&+IO^4PhOK?
zX2?T+Q}CNg77;1+S86~0k{7Oi>S;??c3f^X2h$Fo8vMLJkDj<V?WnI(A6|iPJNSQl
zhda7LKkdX(v~3gvEIcAcaiLga=2q!W5lT?Pl7yYkM~n?#OEHSG@%`4WTTySKJ>vJx
zO*wGlAW=eFD~((dUz~yORw4Ls+z?H8PmRJ)LUno?B@}0A8zl$rxCKR;9k{UQ>?=nT
zNf&D0==^J{OjMGwjdq|9g;^E>B@_ywG#@h+CtyxJ*54)tE`(+6`hIgo^q>bk;tijD
z43c#hPR2|9wGKLZFVH=~Ap4CNU6F}UiAVkq7P3$1eqoUPp7_`~n2evA3R+Oe9-@26
zhAY$SM1@c_hr6#vq&&}ss>QGn^U6(Y0FTv%d^Xv0_Y;L-3R+0LElxXXyI*>H@RzgL
z5~e)zYfTy>Q6({bE|U~hB2J+RMQD0ngHdR7yA7j}#TgA#HXq%6KD@BM6rekfum<cv
zwhgf7-klFRv_bp+7W~qpGKN+U-EyCJWDeTnJ4W=c)<A`|w>ShHN=yTh0uG9g3JA>=
zWkMjj{Rb&RlxfeV)&YH}K?54tfgCg-w~^r*8dYX*+*vCj$T~ZK%WA#u8nUGt3-9(U
zIRA3s%BUE|lD>CCJY@{Fez4DrkL{S33}Z>ZbU6bE43AxnKmrO(T|+2MYZkQvsBdn;
zgMkucq2#;*c0%<+QcbW+c}Z+SOHhD4H;xU!UZqnKa@5_2f#Z!03cEti&_TR)!0(88
z0%{t8BoyZoQFp|RMAID8$i0#b0e0eQnC2i3$y+nvc#s1qUx}X9hHZEnIbJ=TBXc+w
zQ_*<ijYB>MN_7_Jy)D>aXf@qo<F#>_q|dNUN&gx;He~tJAslY58tf=}kMDl`nSb=x
zKEVi&@7@av3dT|&x!%cwr$FJ<ZkuhtEw>iD!#+lzOkUf?lh?+y-YHLk^YE0-FOY}T
z7c6Q`Jxu`$P<Y=F8dL;X<hk&ymTkn;o<OUnal>|U&rTS&!%nmC2cBw!MS8^`Aqo)^
z<2(;1?ce&CD>LAxrTZ%DLhu@2<$b>o+#8m@*7uWtRL@+%F4nDXs|5WDrWrVFYImk6
z0rACwy(n^Gw?_e*_#ji!@Jak$x7#-!IvwI17sP#T3;eP7@2&TQ;8z{0Sv7T9c0`X`
zoQ1Uf1gpP!4l1mv#Tv9GDkt*NZ`Bl{LUXT>IA&_c87O^->CaB6!1&dI1f-;TB->3K
zx>p*!&|l=9>P!{^RtvAaiB1Sc`AADjBzlg5l@(-$?~k~-)T+GFw$m9{hVGxB)NxR}
zs^nG$vZ;MX_kodt{{G$|?GWyelm!>y0$zaQa8@!c*n!@xa=ok9O>pLzRuSAS`UHgS
zPK03*^;VAv;<N%lj0Cf2aZzT@&@Ij%T-%5z8T7tmRz5^h7|_A0ut5k}Az0ZhjDVp}
z{|FG`R0NVVF%^-GDJL{dT*??qg;q^c=vx}TURngbY-nHJJDTDx>Z2$SdNlKpTu$;y
zbn+M03DfjhhF`eL5wyR~PsUNKT*OB)zc#&Sz|R^A!cY(>Qku+0{Sro(#`%f0zBlVf
z%G(Fd;?uzU6d^#Ahds>03_9Bf=A8sUEs-`a-rTdvzN*4d*=G7jaM&0rnkJ2u-AE`3
zf3E#l;}{Ykf)Kqj-et5Ds^2xnWdn^G_FjY-l>XCpO6)G}Yahz{C5bBHn5YeLXy~S?
zy1H&ywrzNkmr=CSo(}0G3Sv>gYRC~%ihYEX)a1mJc>Mh(nnbKrf}`=uj6e_~7^z;S
z<UB!tzB}wTtic614yPn#eS^NMNzRV&m>Aqd*;X3$ab87GRs%4(wDNx;L)*6K3}?s^
z(vz`$B(?G?K_UhRCn}j_52}JB*77z?kqLQE*w+C*Z(r)E3Z=)NQUuD@PZHb7+?q`c
zj?@P@T3&3w7LA1#P{&j)rzGAzLT00#CQgYrJ6R(=Nq(LHr1qj0b8@-6B-CkkG(}Ym
zV~pPGUs$G4aIU7gn|YU+ev<sb`{DQVQd_jjPV8GTgSo&`Bpp2OLWlvpjLUX>y|k@Y
zG()x8UaJmut!a)SZtdLElHN?t&;tIky1DU_>h^j|iKOM8j#V;D(x&!~ZZmI;pwQR;
zPvzHaHN%nCuN<9JWx33W8dJ%PC@Rd2E6wSxnRQ3slxE_CPfUx1P2jO~6Y9w^7|9{)
z=L~z3#OB^PM1YZ4q~j=f-I8y=2Hyrh1;2>D0yiX&aJV6PgiBuk8hHJ%YnB7X=#C)7
zQT1$yLQF?qdnlX9FfVZRnZz>6n-oCr)zg(|wb0sV^%V6jQ!h7hqkLrLXSR!8<*?RD
zQI{Kqtd`yVz5UMmbTb|zQ&XfC4YkN!h*tM!Rf)w=6n73!gzmx_8SoWi+LEbjF861K
ze<!S*ITDUXyf&%$fVcVNLA7no0+MR>EcW@tlZ$uBlK7I+>u{+yJ)94-EQIKn8->cz
z`v+9o`JOG<U1rhOkRNZl>d1ZjB}h|<#a%D08Bu+sUW<y=`Km8rec0+TVvOQyb1y*E
zHT<rcB*nu;v;cX|2#m>(_ukYWOnW6&W*KXq=PLl%J;?u<mFy^|QVrX))f=HfiJJW!
zwAvM!Nhd@+Ug2^*epP$4tXTSl?1r{YY$Ar#9)xoKx5ad`t97Tn=p83$JD*I(8&spe
z9+DNTlm`Z`uRA<>IN4kPOcGS(Ebe1@8uV_Kiy1D$FBR_KGw*PWH0<YXpW)9=D>3zN
zLteZSD;zyt>;0YkxzqlZHSy#!mS5FBW5%R}qc&5cu}pEgSFCrIoDFdENT}kJts5DZ
zu1HfA$!>h?chB0jm7J>ziYGy_+Mb$iR-18CW<KAnW$I}mulHt=EH4FPHXy(%yA@t-
z=!t446kD>Z2p~%L%rkZDVNF#!we>;#k|N7LPf~JPwG^>b)rGk0)zy9fl*GTbQ_<lp
z8^0GD;`&~))3=$_T?AArk;(h!z^ay=>keTBI1kM|WiL+$-4yMb8+yTMse7jQ5!@K(
z^f{=R5vBT;2|NlE+!(^~(&R)3;^h2J*ubUR*gjd2KDsw9nUW`|A*4M0{o`W6nKu*y
zIj_3_2l2G9gZleyMUwyM_i{2J&5xoM0zu#7-1|0%Ga<P)dcLg<esdk7VJdPpp))g#
zHDJ0|YgkMvv!k$OhQ76VQSJ5Mw8uwU>I_2*u_7b1+DxMk_9|l*>9u)&4&u#_X-b~U
z-gY^zw<tu!HtQx`id3aVTvxqg7CDK<yr}nja2oltmO6vEbqD<B&jz6Zn&cHPi{u=M
z9?2!#m4pvGNc6yyWS=$XbOP~d2RPM*?xx!XV?#P76qy7Df0x#KGmJrPkbHEJY<~H~
zu$~{sLJFTG*THsDE7?{NRW90<HeLHOdeW{*3q64)MK^NR*1BX}>l^ENq)KeJ;g}+v
zyeXDhX}EREg6%8|<CaLNQJY^GJurJl&Q2aY7`C-G>h5arr=7(w@#BtlU{G^nA(DLB
z4~2(D0YdXt>)EqeIVx5N=0f7EW5$kI599b&?;bhUkleZJz|@1ANAMZCdL%ndbuc$~
zUn~XG3`lhZg+AxC#j%+WVN$rQ>*Bh2<r=xK(oIy=)9X~vv*Dm`h`z(8cU&w{xc|Ct
z>V!sp8cBq~3@!!9RSBC;?98!TCPU-}xXl$8R^d>#XBDSr7?~R9>LWUoV1U{ir$;}2
zj-wB|GrV*)Pn8qPRTCX&F^Nql>Utu|^{6>dkdt_nqSEu4>T67q_6bX8|KWM<y!*MZ
zOVh5-(OXRHNV79*x8>j<gDW<M3#Bnr2`@Mf7p%_}>du~JSYEL5;aw!xa-GJ!zOZF1
zG&#JOKB$VqrZ70LBQ47W+v*m=l9T_;0(WCCW3yG^Zl!gE0(v0%HWLV;Ruq6RmxK!0
zw{U(y%qp6*Zg2krqg)olgXOp>Z{w&ed*$VS2RdE=LEYE6H}cFgU$*VWFX<Q6KD?sC
zV27;@_EkIri_W8Mw{-@hFJl82B?0v5K-G&E*tR0#_=8h3joKQ3qqsYfRp_;vUIja6
zRnKJ<ug3LIiqGtn@at&7JkRP<iBcorDz&I_QSU>wDvq}EWp(+l-ivs+Dti36+@z-}
zIQb*3_i)$cV0@>hq-j(xBg&9qQm>tdTyinFPm6Y(OcEE#f-IN$=CcVnYPy+nYBU{F
z;G{gZeS6-q|7(XaTvpFVyd&GrZE|V`V(yfBex=c(FG;CMpf5IV64ir!4hfp-ptCB$
z6ePK*k=s}aTtEXYJAg}_O;BcycpJD7*tsE}ZC#2}DuMP+kGm2#iD9Han<Mg!7ub`<
zQtMwC^O;<J{dR<{Qg&T^5ZDSs>=2sS5S63C@gcwK*EkNzhJu!uaH}FsZWv5dNQ;9e
zbAsiNJDUrx{oPC?0MsEH3IBaSD~xy!3Br+aYSjE~aUP_1Y=9R~`<`U`Oc{LtWx%$a
z#{>VgMpxy;q?Rt|g6alp*=hgp+L6xa__wP&oxL9Tu0UUNuwv-}DZSpktOVH|Fy-?3
z2JRSN1q~fED3eo1AE&x(ms+LoLJxBD`E=Y0e-XY>!X3gl&f++ML0{>VHdBo;6)hVy
zZ*epmo@qA+Usr)QO@t~HuSl_^FCj~d_j!otsVOc==bdQ43lx^ew+E9+?Yt&S5Yt^y
zDwSQ))%q;_^K8S5hk6KYT+*x9kut)XrFy(mVz}JLrI1B#zJ)Lvlwge<oF~%eQ#WLf
z6uAvm#Z=fHG+N<KXI{z{B|q@gpXK|*iZv#Z6f<k%Y$#vV;h9V%G^+}^)C3{kjS!`X
zR3<_;l}d{!(S=MmT-27FB_i%y&&_7G0wgQk2M0h~_B4)RA--?PTdwarvXe}ZTw>FW
z8(-jllx?*dNnF;pC9+Tu%x>5B+DZm@wD2uZ+*C4K9UoEP;yInqB;yg(W@=4FwSIf)
zQ#sfPI+v`npOje(H7E|;baQ6@8={W--G|z_7MHl*$T;qZC(5Z4^qzl)%R^D6y~`hK
zdTwe_u`b{qydDl<m8ZlTD<sJianA`nm7`ffQB=LjBUU!Ta|Tu2sF2T)dSO2;U1b2S
zT<M$JXJkHu2e(6%JW!Cy=1XH|3N-P8gn?tQJH|2ooeY^tSLbQqBZ*n9TIez)G|F7~
z+YyPN3-HS?oGOLylVB6UnU}dxyg&#CvYC>qrd;hOpVH+oPlhtPh;%N(MxOwY_d5(P
z(0>I18EO~r$SNhKIFHf~G8~iHs&^sTbdsurAH!EX!WVcvpDIlOR<pXA$A|s`Q<xg+
zh~f5pOfY4i-8a`j&#AT%K#EB_rn$!W4+aFp@#zA`mXe23TpI+UX5z?JayUnamv7wW
zw_=mTwP>vui5#1!C{AWV0mE&hTOmJV4miNq3HI5+nn5?GxWh`F;r?1{lM$|*Ad;O@
z>qc-+(r^nqKqlupMTse6gQ1Y!6E7!zS4mMI_AL=BP?gGvqNO@9aR|6!G;I5({#kfY
zoiTh4U@w1cCh>bmzw1(9LQF9PML%Z%{VQkhw_LkhA^Dd3?teCNdaaauPTR`uuQI}N
zMthmN#+D3@UH7SNFF3hy$t+wpO_ePb8xt~-0=yCsuXKT*Bx7SyPGn}!QSLlo{?B$0
z8<FhxT^Q6K#1tnRq34>hE+Xl;ZAW3M+t%mWcEMyV#4-H23f2hQlBWqj8!AxQh6->J
z$!DzMEQ!(pr%rOxN&@nfTu0y`<Wxu>QFbakID^tp85wr99%GwF?-ply0JGj#T{li~
z+vp{1=3yU{DnmOvpK&ZauD+zMat2I3qSMsctxQ%F*$`K+ke8(m^E)t+0-I6ff%~Dk
zKjPN;Fd`uSnFx4Rv|8c3JcPrNk&3XU^r?re3S3ajoK!ZNvA)ct<6h#dYHty(9)~WW
zFJ2oPtskn{7ng0ST!S*hmM`j{14FoNe>{p8G2pHQ3{nQX*A05p-7%&#`TpjSn(s(`
zBOp7Qg)uym1-H<u3(-Yn_}kVnH)aw>oXg<F?Tpq=v#j0?1GKXBG(SVszzZiD)`rJo
zd*1Wxvv>V$)W;`YzV@#^b|Y_;`(fSa{L63G4lKK=-txJL?IKU@p3XYsLI`}WZ3WPj
z@{79-Z??ej+E;TiBIF(8fwUy`Z%XRk<Zd|ws{r2}PD)Oz<LTw^1zPXWN0B&hDi^XI
z6xl+00}@h&MQ@t7BugPuI3-WS4m?9i*OKd2Dm85_UKrnRu?##MG{!_27lG|m-75uO
z?2I%*Vkc4*xBYB3#r3y_((#adDKD0duJYBmryZqiw&fr}03!Z1(0U6BgItQZYF%nW
z1b+q4Xk}19a=uEVecbr4b`v)+XXKV<$?f$kHaWR%A79@GY#z@QiWjsorFO4l@kHH(
z&O9K`nwgXOV-q$wr^NUrK}r&ENzl2VN!%{+y2R-czeB?s)E^KOmI5Jl;=R+Y%T~Fw
z72MOiPpcmYQSN;E7^jeROg1PKFm?Nv>DH6?GlMn_7Y_(YE6iIcD1O5ar0G_i_cJG5
zX0x4hIq!37&|4_<hVSW0)2&IbH{rOT3V&ibohtPf3XB=ko^I88Et(RyQ>tUHS*Rx@
zd6{lqdo5ZJuclb(UNtOtTLJ3c8`0MkD&cDu*!qx{=~l)!qN}Ob%6Cn{Os{sn8@;Np
zpz(BT>D%pB!8{bqC&MinXCz+D6d;L5P%x7~Ab_{`47;E(?s*jxeO0TuBhsihmFFlt
zZS};g15YBPTO!x}T&ikmV&$p?OO)JArk2UCHU)USuwoRlOU|};@hIdI`w~Ur^j@@2
zO#L9*)55C60hQKQp0MYC30RKQt7OGwY<($GEi0Zai*1KdQNJ?+Hw}msUwiKhA0Mvm
z>0n0@A77!@_ZoT8A)apNr|lY4X#r2ceic7<O_4f#y#8Wv1No!YZ_<oO!$qFvlDtfR
zPtP?!?0+<PF+9h!=W6V(XnsiK+tYe`(r@tAU)jW;w-dJLh^Ajp1f|g@R`mJv%T_SF
zr43_vDi#Fw8zs}&{x`Bqf4BP)^E;l+%jv%i&q%D(aO|C;PqA;<_pYyab{R=PJlqPs
zqv`L;Kr8Z@XNwHoMgT-cQLaB3Dcio;6;Qb>W3lew9zs%0WP}APh0CQ6t%Zh_ffonq
zrfJ1=KK32AsEeepaX568fgoev1V}xpD7Ts}J2Z7G1;AamYx>)y?d>-og3a4&Q0K(;
z-fwAy0)<2?(Nc5U#?wR$27CAsksd`>-x?cxS8=Ul#Tp)qT~M6?eESpSt09$wO)^qR
zQj&lr?XaW^=DL6+4NIV;Bm+yDU?^Nu58n$=LrOllhP}b%c=@u1HA07eaBW+$>l;z?
zP!Bd~<4^iVjGu`2C^7TR>&<-g$<S!nF^t|Pts%hK?Y{YBsF9`x>usXu_Y$uFZfuS@
z7>&OTINOf^J?87_&<{3MbJj>Y^aHZ55BCq61m~m1O5kKvjF(#*RvR7S!L@BgJ8+L=
zRP&kR7LNBys`{{MH>&4hzCuPrHz7j>2f78~TkGl06D&sh3$I<;R9l+(Sqs?N6*t(k
zuMWk+h5`Jc^(|FAF)mlvagV=xjw`LniR|5!4itLl`Q8`!uhA0??%7vIBWD6Y?Y@~c
z%BFu2;+^}Z4zT!CoVbX2kL^<-LdQ2NmmA}1s<+@%NK^@$K$$zp{VPDPufX64zw;76
zWSLK~`IWN!2;iaF&G_6@>?UTfo!?{}?Z6$-gSSX-*D-DnZShPW!7B76SznWNT4``i
zIL>}%+mr3&6F{~f!lX&>gw^G%*<nuaRVfxhDI7?H0?O+%O$aA7t?)I;aZL#+Iq$iW
z=NjXun9*%cU~|zFO&b#w8-|X9mlquH@^Th?G82~;@($_-X!>!-QH8?1GThn3y8L!H
zdGS79I*r8VbI6bwKhYHOd9GY1oZ`%8URmB<_ku@~5(!&A7mbHPF!xfL>s#?dH*}<9
zG7WNh+pje0ce6GpJGDoiLTwkngsYp|{2gs*k{CZLn@cAxB+zv?xh;o{oVxFMZssbW
zCH$~7HD?DWrUfU^!U_ipu?Q7n_2Pr010S1an^DhDN^!*$@x0SZ1YVAMkqDFep0gxJ
zj{x&-($+;&J803YSY+qr+N$8n7%`$PNr??MS`_bz*eOCDa9qn;2v@|}B$o^oI#$et
zOH6EgVF8XxMx7fqSdkPQRwNalPXHfN$~q7wu_)$#r}x?Rz)XU@B|r@#p+6^5q6m}c
zj%kQ<fSD<eQiBW?^`KmoPOj&&^QA0gRg$Hxgk8rXa5&W!t?~@K0IkS_oj>ZeGfs57
zoBMMQW&d<1*X+n!FSok*mkmeHbw8K!^V#RBhJNuY0{rpYO$_fn5-8^w6U*OJ)aYM7
zco3c^KRsW+v)%rti=;>cz|fjFR%Iqupk}V>DH~jLm2IGgQjilU7zo%k0-7ipwEf%3
z_HBRJlF^9XESTzbwh>~4KP}-T6w^|kJ&@mM{9;#6q@5*lWyTEX90a+{tGcZ)`}i&h
z@sVJO%^HQlqFX6V7gB#Lwh|{-rLv;@kkn}1eY<z9>qYh}L93|5W9u(=4l>=rNilAS
zX~pEVJk)Y!3!34uMWHyF)tID#0}ln2Ka`*dB`8Ar>S+_87oyEajhz;wvSDYh$R|YP
zkq&+l%o{5QDmLF^F1?r-oCZBZ7$riY>>E^uIG@tdq`VV;Pw7Zv&Bv5Zc_MR99|CRq
zl>UHY>@T|;U>#c{znIL1?M4Dwf3k70p&WmH9XFBv3PFZSA`1_Uj(~ipeVLfA!fd^{
zccz&3GSfg3*P$`Xh4O^H(ixi1f><jp6A2~jzRC4hZ@8rDG9zrBKE=vBgb73ky!9a`
zP2tSLqy6#x<AN36h&Sf=4qkxD$-FpWyE(tN`-$b;>ubibA^IzK+oXM{6F~m;tZzT6
zB{$=%|AnC=sjlqFbtFd>i0U>dRguPQ+;W1X@bjTwmI?H_HAX`gRZb`UI!Pn3!UMR0
zAL1Q6ksL&L`;GAs*Bo>s%9a88tf?d91E6;SvGNS4yZu}H65GzKc5-3UybR46fT)}d
z)KLj1V~&}s*2_Uf>G0InCDW!|KDa#gqYnVH`u+!_qA|k+Vm|83{CfikQ$2dW@Yqg=
zc{CSiOm1{?=M7IL3K{TEkP2$aU-X^h4zZ2kbjmwsNk1Auo$BL9!vFl~!VPzn!zb##
zapCc?`mC?TeSNSpsbALjU7Z@%mL`!1Mf1|BRuDn*Ln>+sbaY(Wr>AZIh&iq&x5&W%
zq<8VU^DJg{;^TGMj0=5j!4NSsX>Ee~fb4@62{`?ucTCj#Eg;pLEov@?TCMQl;i2|!
zyQ6F(h5do&sEw1(Cc7>RJDa7M6DdUTA$A34lXY<kG`e+PeBZv?Im94fzlrMzop~gE
zVmczl9QFrgr%}g~0g2uYnws16+H&1drShRo;+p2Z#=uZvVZ-hW%URXr((M3)!nt14
zh+>g|Fyua1m^&NdF804GLpQh{wdFK~Z{FYhnz8dpa5dM*@tz;MQ=s4&rOgZ=zzR7(
zlajYhhO+4#tP?xx!_sME0D(4l&n=)JOA#CX7I!vli@^{8s#AGKq<Em+2<rU0p=m}j
z-$iIi$$+Jwc?|H(?{0r1^adiFhkw-{n#~Wq_O;+@p-<yH^3=S{mT3gzDiJZwE!ovw
zdKj#tUyf*;L;&*z*i>SzMTirpvrq8^h01ItI35=SS2xUP=4we}whh8V7KE+~U@ady
zL!Eppii5xX*0GHH?5kI@M4kF3cxnH0YY-z4NllHsX(({fG@40R(iPVYXQq%OCzzU<
zLvRd?ZHu|x1OX7@(=$-s1CqlLB!UGr=aY&fBb_f)z$H<P$w2JG7hD&%+uime*^4+L
zeJ$5xI>|Ua>@)|S0z`QJ3$;wKrgSnT#|x59AQyAj_WjuJ{tqGDT2@1d3B5kSlL1We
zF07YYiVLpLVxAMFKHAvu`{veboSXWzEFYcGT_Np<*=&?bJ)+5{fI5hnnI@mqi9^z8
zMDk%6=-#l0S;-TDR#b;U!Tv%Dkd%{b7#*PZCfBk5S|!cH$+;I&>nDKaUw3~K0C@wQ
za4YBHPv`_SO|(F-q^e}bT4e>b6zp2l!+k6m%DMt|7?6WmAX}lc^??FtZ!N=t|Ltow
z>=^B*gtxEGpZJs4cKzD_^Ny$Lu}_WR02tzVLx?*OfZ;<JhpRKYgCK%vBNS`O6CQ_z
zuo>&jq|a9Cc)Q}8XlvyPENFOzu1u~aNa~Cb<FaI*+`M%3sbum2e$%01<6{2xGveI1
z&d)zqX*O>K?{%nMXzMq|oo2pZGG+ngY${y(@(p1?ma1sO6F<d*=)_}TZq;rqD8N+|
z$`y$8P?w0zN((b#a0k^-lkmKd$WvH_H9RUY1@jVLfyC6s0S&p9Ez_%NrLY(DtaL5A
zPRnt;cZofZ0Yg`NG8}WRu(CN*tDZzz##+i9xQ^G6WG~ePri-pO<inY!%jYB8Jv)Wl
zSBd-gWw1?J|93IQQVF4n^6rqI(Lj0wLv@uN?2LHSni@avA^%~iU~ln>9?a<B<}%6g
zIQ}-DIC-m`r^}urh-d{#Tu-S};QJT~q^sBp;SPnClL#LNP{^@iZn)dy3%-k{<lt$W
zbP^(YAt<6UCQb@-f|@X4x{guwHf^>1s?hx2-r-sw#+X5bjS-hmoj<1J@shm#HSR-Y
z^O=PZ>(1m%1_36g6a)z22IR$9tkZelx76cn?1nn;*-Sl?Mz+X=jU+!`_g|HJS(Fq>
z;yG4Sb(Lpn25j7iR0LxeJY6oAVpYFC8_~LyD|K!n2&9$DP7=!<oHM_oWtg;NDLRT#
z$Xc6HWSPt#PX0Dmk<*!Mv&y@3ChbqLw9l0!v#q<eHeZI0rcm1IzvPdW-mEq@#YDQu
zE1hArBO_apH>bTDw)B=z64YKip6!fQ6otK%jXyTTgwWYboG#b*?kSbh_9b%O!rxBs
zXHZGI)K5_vR}cKZyLk(!#1HX1{0QG!YyW#L<2DTU*mL+UzNn4g*wn3-@K5bd{s6D~
zK)Km0rwy{M8ewx*9nFGO$vQj>s-71|kk2o&t#kZ&XIKA233Zz`7Zfq(dMg!+rJ61e
zcFJ^zWQbTvzi6}<nPoc_Krt-*wGIBc316sAyI_ifR@kFLH0X?&0b|R=8NRZbhm&m1
zn6#6~-Mlx{>M<Cuzxu9}Tg<UagPGe-Oq(u!;>Pa%6Z>k5V9F2D5V|gdHS`qh!1f^7
zqfvQ|DPKLOMxxQ_>1TlgMll|E^;&#YwvWO}f8+VrCMP%Lvm_0?z~0k8v-G76D0!0}
zrX2D){DLHo&*8wUMfC9#8+T|nty-3qQ&=fsw+DqF;)S=@=f&~&_Ke)fM<-wtum9A!
zb1no$A^q`wdhxZN`Ck8(2kxZc6yEaUZNAy+F~j(e3^;tx6rR9%qfE82kzowRX2cx3
zNrTNt*7uxGdnN5!y*E^YGkE?6MNi}*&*qrsSLX)PY`*ff>yusgvX6(+vh>y=E$0gx
z_L%-t&a!g;yuXj1IN^HDaTIFxd?Q$1Ms{*KAKD|rsgZHA3k#oVj!Zc#7mrSKg$^Q~
z%%d6`&t9y{jpEbEc@@8t!aMN1fBF+H=3O!Jl=<Po8U59h_n^CnHngGLwDFS+ZgpWu
zBlHw!{VBp{Dy`$O<sF`$ek?jdv0XR~(-;0?`A1u9%J1OC@Q0CDqt1X#c6|J`@BSEi
zN9pn>O}|l+x7t0L1w&mXvNAGCcn|soy!+~3k-qv?Z*u-Yy!Y*l`QMDe6%N|Czo@zT
zhYslXEajzs;MJ}FoxTlv9lKzAA$GGM)eza+6m>Z~lcJe~f<83GKiFay=<|QhR{Hl%
zO)T~2onf`o?<`&3WAXQHNI3r*apgqene*o%PM;6G^?BJk)k-<V-gj+K$ll}p%CC^N
z4Z9!nBC5Tx|GFDB+Wn{^OOE*3<keZDo^xQXe@U*I1#S3>8p}UFZ=B6mf9YF1cw@*n
zTWyZPXk?0H#^b%JMnmhx-0rN+q$n!I^wt%l<W*vF5~e|rlZ{lk-zff`LTu>N-(UUk
z0h{ge?pN+P-bb(y^OyRwmP-3hz1)?>9VeFfJm!BN{^So1cjTA0R>u74e{%}w9=?Av
z{$gV*$HIG`yx<S!v6Y3Zj&ZLa=u^B!UPxl~^cxEo=H{Crv7XJMBUzZ$4aDxQCZ_Vj
zaMZB$E>_?&W91UWkYf4dP@z#$9_+fa?)qeb=hW!vD^P!xG5mhxBeO1@xpLogPkek5
z(VGj;e&MYdDI2FBn0hWwk>6$FFNMYb*f<&joN#{lz29ojGydG|e?RnO)3->WdbtWS
zfIlG<Z=4b2e?fL7Y-8sl-@;8CT?NadJ1+_1AViJPJ~i&B|Kd@GkIB+zxvKYuTRG03
z@CO61cI-fn&P}B!ScT%PMJ~37H8D&+_(TJ{gzoB{a5J^3Czh$niM!RxV=@dxjqVqu
z+O6$*kI+<&#(cS*ZkHdb8h&qZ6A_tXUS*?))>aI3`{J%(gvmfkgwjZ1vUr1=Ey0w6
z$TdmXalO-MmzZ61JbIsT;X`UmyQ{)bJf7W~fw;zU;|D~?tn!{LnM!a}cDlmclwIc|
z$|5P-)=sj#mpRC=jk?~M@jSb&?@ZO%oLHbMN)m?Gwz{Sdj1h_38#0C9sB9=>d(rfc
zrkr#3jI?y^W;Y7J=UH;^a_6vgAJFxkULCc3X_=c-N4@%ESr%{JW7M@PHq5klQ%QSg
ziJ5uty8kW?<!FXZioMlxh$rn04~c64>Xa9YRg}f?4LdV-UDG<LC=0}|6CM_clZA92
z(@O2-yo$S0E(0mx*Maz&Xv=`mO9py@uIRYblTbyHEvz;Ey7y6M3=Lf#im$@2T<Zg?
zlEuT7-^V5Dyo@}!)%|=71SKhRc1`v~#BmwgF2c0su(4Itb=wo$tcn(CoyNsoey8JR
z{-ax6XAkoQ>5@{BiEiBP8?s}^5p1yV<0QMghuyaza>aV-cIt)C-cPw)eUzoiS!}#$
z$wJ|dtG9gzz1VPz)60MP?(<pKriN!L`{FBSwbP$J`+hxqqjkF|xb1Y1?bk0JV(3VV
zS4t`+gJo9!rE`7furStyeWGs+)Hoj$wM<e!(NwW|=G2Ayk7d#r9KtFDo0U$|!P+*C
zWcRkWZ-w8dw`b_v3j@dOH9^ncef74>_Uo4QbolZwn~OSVssV1SaXVyx)ztN-q>2wE
z6mYiCSX4G)yChd5x+#xlYTo#K6HO=x#cGJ@Jvc%Z%Jg3x8Aj%O;AgNsNKa-kD<zS8
zKOor6#!@0_OQeDnNz+0);$Ppn6t%8~a#;1QFTc(0h?(L}R8@#(T6v*0v%AjN4NXHi
zta_IV`+mi#%<FLWWrCU)3K)Y9RIoEX`VtAA2}-S_*_W8Dm0D%Kk=+>@>%Q46X%Gg>
zSy!;u?`S^3%V66PX3E#8Ql-7gPqGUGr=JJVyG|EIvpdpwG+k)YMTi~v;|l|Inw%^v
z=v1JMuU37n6cX2>MyOWb8S265!3>1--GOY!PB6<_LaotAbudVhOt6wfIuaP4hCWhV
zRWa?$>_DxTPfr`m8!C^FbgI?*%!z;0RdpJ*l=Uyc(HTfVoV*Gg)SD>CC6IcA0@Pi<
z0xd*GQFDDir0UU5q^@^?8F6IR55w6G!E9Z-#Re|&;XxsXjRqhzxcOv4FQb6Ofv0At
zp#&wQRN39yh|omR7*4!9PSyqIywUy;feW>CT1`8b*2`kR5Sg8lrvU?4$BBS4u}48O
z#;GhF&s~x(0h3}9R$39I5EBEOcn0>kuesB3qf;w6ZhmDlY73Iyj?=5v8nFIS9dto{
z*u9ld*DfoXoVWi-4Mw);wp@CYRw0?|cHqrG2S#%OyZ|r@6fg!eu!5_AjacITIpe^B
zObKnK@Fiv@`oV~9(2Y)U7Xe~)W-0c3O3>NTg>(W>;`rT}%h7ZkFn3I?CJW0lmeE+-
zD(CXKTo$N<Ql&lF<*Pm-w%iX16a1X>P*txqG1|aqfnncuHPeKoCDZ5lIEy|;2_$o=
zBT)iLmO$IlAhXcH;L8De1US#dR;SMWOd?Mcy+qCR<PwwOWJWmjjRznGol;H;ZaOB|
zY}O{um?+oJ4dVk59FHnalLgeX-WIA&IS3E#mR2^~nWYq3`>l2PP7a}2c)T+gal2aW
zd+8SmI?wBH<qpSfmFd0Ev|=<ZO`W{5cZ@$i*qhlvxB-R9e7K=0?LzE(^LxFZAjPtb
zkc|c1;X$;>^H_}+AH`^8-pBmr0i1Uy2*BG8^HEF=PNdmQ5cjwKR6v4^S22P)m(Z!d
z11!sJ^h!p!&M`%8{c`!2G@5!%4`#9P^lDRTeuXKS3J(-){%}26d_!a=C+G6pl<lMA
z(HRYGY8(y%_^L*Rp)Sd2|9l9nLrkhKxHdvgW;+6BjG|;zk!l`^iDP_jt~U_1qDbXr
zo*$cV^;V>5u`}WWS%0^~&+rpb(o4nTjb!N?_6s|mnYzB8Eum-kMTZJ2jdO<~RFVK|
zW)L-+ia+)4^r~vln9jo9DlRsY3mn2PYKoiBLn*Gc=90(5Lpt9XJRhx&S)#^-dHBpd
z6ZBIJgsj)ez}v0L){oB`0@?hzfE$6*NwuG>0nrX)9!(0qmqytGGTAKiygvNpKX90s
zkIH<GV@dceczi2D$C+m%zp^WaT1J<_!A-xHdfGYjinJ|zVVaf$8WP~x+ba*`;X2xG
z>Su%44JJOHGnpq?HoiXlcSI%^g@Uji-63jI6-PwA1ArLBRL7rA5^l%Gv3)na&Xi7)
z5|)Xautz04-s1XG!XD$<5c^W2eDa7pEGtj%-}rZgUfR<`pt8f3cFU2LgDw6X)wkFN
znzA_PQzs0XkAk|RKpD!63Qz_}pyDC{MW<;$pawuk38(?cpaj$av`_+S0J5M2R6ju|
z6U}R}fs0i^Oq@3wfKEpGBpo5(9KyyZ1=N&ysMlizi`yeTOv@l?8{|q+Hsm1=D{L@u
zs-`Xskij-cqhyIn@CjT+;EQn<ULppC5@uivrzDOb0~tWRC_#|rG|}@%1J5rxg1vkM
zE#za7mD1|^08i0G<QNL0cVIY?kd=e(BR}kxv$^N^C`4}6TOvlLZp&(Bt=#jY<Onb)
z0Jm4@ScQ|cXs?^AC5wO|EWrkDzy!1*1w<CqLm*8`qnzJ1j60?ID5Y12zVCGuW%5zo
zQa%X*OBsZ_wqV3Sf}`uz=sy96BYg}EP72;Y*@}T1I!s;^N0d@x(9qTYhTiRB^~X30
z#P+!?y;A8bjYEAu0gCevZzM8*@^K6nyv#-0re#5yl)fsH%aR;Aj%Mx3uDu6a_+7^f
zuXh3%%G<z9X+)=b9AQ-hQ3_0_-mo#a3K5``7?B<x-b{e=E;bo}pA^JOxu)bvK@{bh
zk|zaoDA+OJUV^qyJ3@>uqo)Ug0RVw!>+SNx50!7e<eb|#LmUBsJ+H#0%7uTqKn`2~
z|Eq0t5`aPg00P$j+(9kpV1mxv5nA7ksRWm^+AZk)%*~Tl;}!RP9AIqrQ-29o<_1=Q
zON>d=Uy|b|A!cy3%oxMM-;~v3(L6H8KK3ts%dg{*zJc&zZScB58DVl{g!RsLvagy{
z2MM61cA_~Sq1}3B#ffe|xMWnzr_IeXUt1TG*G`5P;m|c`8>Nl7Hu5FN{qafNLk_~=
zT0<SW_oDylC-1S-GRbhsaI@qCiV)uuA|0mxh|g(AECeKucpjLc+@V1qdPs&bsa+tI
zS7J{-@!a6LO0i(&Vs%i6Sr^Z0uHlkn$U1~W!i?+Y*D#l+Su`%FOS!k0Wa|a^Xn)sf
z$H{<umBdc8_2lItR(gy2F4`lR*p!|RV2(%Ez#4XbjO*?UouXSfm$?YTy0XccHFJ$D
z=93@ro4KBT7#$L|nB{KeCe5{HUAj4RnC4X?IvnE`(b>x{al=RLpVEDaKd;MitUF{W
zrYdg7K;B2z_cqDK^A%D37FoSa>tjEv-^kxwJ2N3oEi)+-qOx!cnUmgf{!dXG*fmB!
z528~Z72#EU5bwdeTOWxtsI!a_a|O$~$VX3kBFxu*^O^UU7{*nL5iw2|AJ$f$vWV^m
zM`bvy3sOTgE{Fq&Oji<>Kpv(n^p>JxyQrG*bC&aZbx3{#66Z1qL0AWhYqo;MG|NHf
z9wQhG!>kE7yQhv^X!$if@SKDXmV*c&^kGE6vG^ejKcnbgJ{>WrdJ*zq)FF=Q5lFyE
zMn05SBw>t-3vz!JDtC{Ia#@_pEm4flL<s`UuT|gx-m-m!ileDH;b0qrl3VAYGv8xw
zbBBfKfoFstq$Q|OqMf_O-g+*_en|R6d~6R$RGV$wibb9SHf4(SR?qct-yaU=E6s#N
z+6gI<O9BQR-9Jdj(aEjLxKE#RE;vXmo$H4U@gxbTWZyc<nu=NmIdP2M)3HA3(sNRF
zFkbZFNK)8`SRW8HnSgRtNlMMs7EsLC88f=_JAq3MU%=(qmsNBgRz6q8biBDFj1`c{
zd)CdIL9|Kv6lV6l1iG<XHDVj9@NPNhsq3tX>Ge~dy<+ojXZ)#x%;Z3_LPcI8XHJS>
zpTy+xeJ3E#Ia|Q3->d(BK!&Fh_~NbUSFz)g96RLNX*LsCk7DKobB}h}Ro7T3DjD%x
zH{5iKjf!e!r2F_EL*|d}D0I&pyX-d7gB-O!dDhy0^+1t_+;nu0)Ja|!EB<_0jgr1}
zxz&OMt0ebTh^kx+R15uFR~LJvPJ_nGM7@a2`n+15%wE3io5X6?s!fYE+U*hNr+5hx
zO_3y7htbC9lp>Wvn(vNEciI^%tfcYTxoV$0>wnz45}89TdE`?-5eg}a<Nmwox3G}%
z%rTc($TuHEro;0YH0v1puyZEiV^B9k@n!q?<KoGX#oMg&F4*sYgAUnZtCLQl<AeeW
ziLfS{Xqu^}8z<9e<DI|^MZC<yq>%jb+Z6f&DQ}T&J-@JELWw1oT4uQwR$3)nj@5GI
z$ycCIkzyrEl_^&tq*9e?HEPwV*Pv08W-VHw#vjzLuc;}iXxhvlq>E&3isa<jd|)Er
zVZUKJYa2u}5i=Ia$xbxsL)3_BKV8Y8C3F4(5=m@2ejAA-pn1r*kxf9CD(Ec*y`seq
zpnNQ8rCXRCG>Wj<5jkWm^aH>7oV3W}UpwO7;}J!JG5rf9lF&5&&cCSS6*Lvn^C8Y1
zcHHY(zsysyh%-wiwENXj2l*A{Xu*mYsYb(!F!^)l#2keUh?@JImK<~IrYkdiC5+n;
zh;H_lHSP+=NU7rh!=!w5HDUt=ZR%zwIXdF_>+a5$eo4AT2Pd3QvBr+k<W1xprwtZw
rR<Hwf#I1?^8Fe>%FVt14D}tE2z;QPlg#$U}t!BIexuYokH)Y38oWrUv

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic-ext.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic-ext.woff2
deleted file mode 100644
index 289de93149abef2225658543048409ac53b344fa..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1640
zcmV-u2ABDFPew8T0RR9100w9P6951J01V^+00spB0RR9100000000000000000000
z0000Q92*`SC<b6ZQ&d4zfgmRy0CX=*5eN!|WP|_<AOJ9fIsrBUBm+7GAO(j;2Z0m}
z2OAa(QIt&5cobhH#Bp6LB%{Ha8tp4cLcKZU_v{It=jpUR_YDG8a<Zh-{eaLeovu1Z
zYi(XNB=!9!n8=>koM^-nRWgwfAza*p?1mEMoI?FyNLn_TR#0?uLQ%l<eJ!GZllSg_
zt<^uMM4AqG2@nz~lTPgKo@>R_BCm^P)wm4}1+QGD5wccRbp}f8S`ImB`P}jB+MWmk
zxB&n`Fc1U*1Oc2RlZ^E0vwaLvbN~wg0yxPf7v<w^e$jMOfi!^k>AD&x*I|IVLX86$
zi1wB#5D5SZ985WtjVCZ*0eFw-`?U+*KS8@7#p%es|NaV<tNsA#7zlzL1w>;4*{HR1
zInxJx0rLiYK7@IW&Fhei8x28;9{>R~K#4BbfqDy20Akb9K^=jXZedI>y&7i~tBQu4
z0{K9WKqb`66!|YB00_o=JODpYRpsO?55PPC1!zDt8UjS4GYt@l9}R_vbb@|)UzGl=
zzTdJyM?ItO<4;Wvc+WyBXzkic);F;O1~yz@06z-Zk#)YA`8ojNJC{cg9W41SG2o^)
zx0vsgk9fr9Z$-R$BMUwNs7S?)ZvuV<*&q)z)NzG8MpH!yu<gSQXqw&O^En)m4o8&k
zbr~LghR2w-(CwP)n(Q3o95vB3<^jjvq;!`y!8QK&id#D;y2h#LS6H;|@4E6(+w{|z
zD__LPwwvIR?RH)v+;}+=LC(vw5HQ9%TBamc1EiKrUUCu}$GS#sjNlg6wkhbYF0Tnz
z_s9R3Tv6QAX5Cm!<=elnf9v;&W$*vJ*d*wAt?oZ7VsvtHuI^@i$e*80zOLxCAL8OV
zUc0(zGF3BzBFBuS>f^>zgO8f0IV_MVlSyF6q@`!z<3xeho~`3ftP0HZXljx)z%d7=
z5I=SB+c{|Rl$wE?QPrftPoRn!G-@NQo7GR{1=@PHoj#S-MroQFt4q@T;!7XoOj;{B
ze_Jx3V##ZBS4meimzVJLES!Jk^d+A}ewfp5?B2p!-KxNs*EdMK3;ekVVB$#?L0)Vo
zI=sjMH2{^Ma<x|wWHqi)e=ru6%)cK&fNFdI)B+GoGMUuT!YqO>9-r@@=lLK22zIj4
z!N2#fjD$b;#bu}df5uX}HCL$J)!9jX|9tfN`>%iePly59I6HR|ka=})N5`S!@L81M
zaQ+;fni|^1$?fK_e#OX)e#2fk+0G4XZ-?HVZE43krkG>+Q)A<tgb$J!jXegL!#K)I
zhqh}@?}^hp;!dCNx=pI8@}l<bi^{9An-Bf|wVwa?Lm|@p476r;9nA9%c43b#gJK=B
zqnbo$>=DQu#$NLD<qX~K2!}81h`-o%#$nSaE>3csktLIgozC!{pQagm!l9dTuyuC+
zo2sycOzFPZnUR(j3OVarTAS)+ep736-K7%j6||23Gm=6iNqCkv6H!W2YMXIpUv$^u
z1oQlPT=8^+0IF8+^Q8Pe)z^I5u4(%KfBx{u9RPp+@!bisEUHF(1u#(n2z;8=YMf6{
zcl8_y6ZP8ZrRqt5e;F=&P7wgW=K|m-4gq{*qmhP|o>e+JiUW;BcK~mxbOMEBrK7?t
zXHcVA-awsVxdsgqWfhtf%78>KwGy34z%6#v@yZ!AaB~4o?3_Xyk#wMoYMwzim25%}
zr3^tY^~9nNH_pH5#|eypWDgV@Ob;ZyCz~kKBHaU?!mtA=kX61*Z!XhwBP>FaXLeU|
zEQ8TvA$S&<2O}t3P>CEzcUCcKogU80^H>}c@QTzb!<e$K;Yv?*JeA4NV<n!X$5J|0
zpP^Q5pRnz7<)5PTR3C*D1u7|}k_svcRY7J`Xvw8bCA$c_<Q%Q3j_=)k2~v6VHxith
zEeDo#M$te!aeB)zI?5MNPf2V+)>~VV?ms8_yt{2K-p^ur>{d4ulJ)l*VE^X%nkc5+
zT7v+>J^O%cJ{Lu^XrhZDrr6NLE)H>u%M8xYsZArRm+*t?U~d%CyPi+__bK0C%$+XF
m4~5s|!E)7eM0)y6%cMWdBKUI_CTX`-mDe_9|HbM#{b~TxIQ=#N

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-cyrillic.woff2
deleted file mode 100644
index de39acbc40690eba8a6e4beb11ed8aa26656b07f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 8872
zcmV;ZB3IpaPew8T0RR9103xUW6951J07iHK03tmA0RR9100000000000000000000
z0000Qfi)X~U>t#324Fu^R6$gMASWIGf=n+=5eN#pXs!bbf(igItU3WU0we>31Oy-j
zheij92Mh-ryFEn*a@aV40WR<6NQAjk9f2symLgI8e>_mf@M(vrZNftlN=5B%wbJBd
zm7tUwRGGHUDV37l%23cFxG7@gh_$ge7#7ECjhi@#$11`LmafK(Da=JBKw!Xbb8NJQ
z*>2*4Uh!hf`Tncx<akt+pRf6z_}n8j_DL=jG1m6(G4<&tiS!Av^g|_yB{H2<@DPb6
zS$%lg=0C#Pru!c^SK4?YA#&t6IPMNODdC7Z;f_?Xdf6_@Us-OyQhu+$zia+=nx7;~
zUucOf=}WOfsQ7$X#EEh5e65wA>)h9A>o5Vs0s6pc;(%;tXq`h|S`}JekI%_GY;M+2
zo7NBlr9-S{98J#k|0}TaeDCYLU9Acsc!C5141_^=-gfVgXct%)Sl|&PK(qRT-@e_w
z+q*aZ`9~Hd-UNZf0ck>M`Tfs*&OG=qH(3Hwt4cy8Tm)l&PFE$il)o)YK;e;{+-m&y
z?WfDjYRjH-3nTKwvIvK<oJX;1DZDGxiHs@NB?1UwXC3rC%mFsv-<vbr|5!1Ci;Lsp
z2sdVCoheGE&~%}7|98I@_<VF)7D-;<II}0+cu^QH(#;56UPYW@s{Dl<?y}?%LzzMq
zbKAKr?bhb$$A<ZVAFNR@G+R~I4#rAbY6lB#wMvw27|)GFNJV}H$x_poH3sbpeGFaC
zyp2TrdZe9*82PpAOs$e{4W~;KU+@_rgix~EK5xx!OcOiSP;ORnVTd%}_xcb#1Y+kV
zE=zM+4yz6U4pk)%^%}^EH1`1sSwK!f)e<>i3IQ`~z`+q{=MH%J0$~vvL*&3J1d>v8
z5KLgi7~O=(V=J-E12Q*(ICxP4D4YTg!$zg2Kny}KZugrj0Lnt|V*{WJJ^+qpYA+a|
z_?)a5zeH7rIBMW=q{A1{;MOXCy(=jO)iX)ykiE83zmW|<wp)Z6HawNoU;#1fWfb*C
zL88=FYW0f(Fpo#!Zeb<x3iHB>aHG)n%#$JL&4tG*RRf})i4syJ23jec7&8m2kuxQd
zGaMP)<v3<XjK)qbfTTX`<VZ)qZ`h=AVUw-ByKyUWw^vqklEnd@`sg15Wg!F5E)P%$
zg}AaZWQEy$r3J&=EyQ7BWE#VVm}U$F0YDhzxKII#3l==NR|*2Jin*d3^#$az<CVPv
zCgg9z_ao;J3IN`CZwFxLOr}x5!MY8ICW`LE^eCRU!3zNUlome%|NH?U@N?#$aJGIh
z2e^WH0E!gAaXX6(AZ=XAaOXd}$2b7+DJ(x{@p#<=FjAEkxr}gS0^kCGNZ^}(Z-c`q
z5@+a6B`uSTC>joC<0yv1O}`GkK~1Syqu7FM%z}Mf0W6ZF{4~+{4=Qcki1$1X4(0he
z)CyL6_|Q`Q^>EjEPCN{WN*Zpk-e!9oGwZ`I75~9mJtR7bEHq+^y=Hu9F_}5h*`JU9
ztNaGw$4D(qJb;T?9Hb0Vw3FT;TV3k%T;Ec5HSk&gNkf^Cnknh6QmIO{I`xDaL7IrD
zsA*~FtY%<@AhfY@aB^u!@$w4@3JFWg=#<r^TdzJnhE15{GsSJ_aGG4d0plW4a%y>S
z03^jErw21Em;>mLx*}uPh2VtMBrY@9l98L^aAn-v+2tzF;Fi<2gZhE(2~)LQS#5{N
zP1uo@8iShD!37ENDJX5H1udg#Q<evsSj(z$Q1TPEwrZ=MyF?^QwD*_v2_eyLMi5gJ
zkEmP6W21Gg-dV4YIjp$D9q!QG`eLnbSQ#0h(vq8fEz2ifYrRrytM;r~rgSkyy4v(M
zXNzk^M@(NXlc}k|(@W!ndRyI4>v(IH);^@xYF)M3rH*=!6G3ref)!ipvqP^2$#EQ`
z=y`*6%~{u;zvkc+PDmhLir_KoxdFytQ9xP-e~$5cc*RebMu9m)BFy@q$<aU78UEjh
zH#Fu!j~tL2kW29aWw0(el#qI2uu#x2qD6sWg<TQ@I+G&?qq>qe4IoyQB8ny1)Ufc&
zVE?{(G*r|x?6T2Fl6&w($eDMz0saJ9;#QC%kkJK1l(v~od{B+kJ3(w1Hu^){HE;V;
z@m$tQ6ZoaK`?h~D%vX(|>Fc@S>GS+tu>^27+Gd7COK-BU^foL>aBLgU@-UzAEQH65
z?Da|D;<f!HoMeB0v^iyaI&i_LoXaba&oy;qqNr6s9V3u$5$3X|4a0;q-yqM6PoYTS
zOfCA?2+A%{^c!<E0<g!WnG(&<P$U;js={}ZoJRNhZc#p>%MqSLT(Z?J{a}jAjwd#`
z+YT8}Go~5yef1gp`2T3?8j!F<A*@7yzz0qrLxVsUU2SMK@1r;f)e^9nwY$9%5GiWu
zJJoJ-gU6@E%`kOEvQWMga%ULW?Yn36n@0~h!!<gWL9=q9K<AxTlm$PcXuo~lEA&lV
zePf<sG+E7huZB6pj)lRYKsb4;wuu_2;IoXGU}MmlIvK)=WQ>Rm^)Z7+=z?jw*bWO%
zo^n&Qawg6dG~d#gQ>@a;DjJ(Y-r#t?93UY~69El97i3{HfQCZNZ(3;3A55K<8Vv0&
zUX_n9l;okAvosYanKJWfAukk>;*oR}?NJK7G0t#7V`h#-%wrKGFmAOevf1c+!Wqmb
zVqKddd?stuhh78tHHdl@sN_@7%vSS_w0PU~!61b4KuB0Tr8|AughrH4`h2LZ(<e`S
zN;wq<M+i$QL^n4)>`N{4lfkHrYpkLcOEM(Fq&pPCyW|X^mgKiovXmQWnI2R1KTU>Y
zs1C_69)y&00(HQ<_lLkmW!lZ1NDgG6K4=WcU9qYagC)7en#Ld&x;IT-+8uq62n=#}
zw?`b!8^>Ml1p_=9E(?P(83Jj`A~FTS6A;IUrCIC>$V=0RItKjVJ2DhmJdFyp@EzAw
zEuTrvv6Nxqj7#{pziIL$*QzsVqJIOWk;xEW%16xE7{!oi3=S3UJm`|#!Es*8bDZT-
zWaB<F;!5m16~ZzP^wKVRioQ9WocGqL&~<IQUN>Pne`7wbkRqo4C3-1<pPF0q<XngR
zxli9Xc<H0sFa93}D=X70{vU|v-^>i9qj0m`)kG~m6p*z95med1wwiZP>rFO7Z?HK`
z>)jK2!l+i`M*Sp^mk<esioqR(D!xpHAXr!#$7vKJ5QM-{CrSi-`-o5)Q!*?JGWi>Q
z&Ql_<i0AZyc%IhH>*(`%)I0@pzT=wXzMT;tl-6^T<DImbv|*U>%n#q=D=F@r8V9jP
z?&`klbg2iKr`LAf=KYB08o2Tk&adyOZpHpP)HXknkCaFY21~{k^k~QX*oi)}q_b$G
zU|3NCBqao+fO9FraYntz=uW)Es=z4(B~S-C<Pg2-is6G;{%cEGrC|wNlbHWiEr+EW
z4kM(^h>~r{VIVKDb;`BTQd;XUnN6foD{aA_OjSE7s9rmw3bCztVzdWDXbomS^q3Zw
z$?@0IHMR;*zr&!7W)$H6Jq_QyZ*~t5y*>PLSNG6|n<3f(Z65hB{c`f{$*%S1H$zTm
z<K_()z~3cdI^t?ihl96kl`rcQxQL*O$x(lp?N0{QMskb4GsLVK67!m1_pLI8q~%O=
zh$)3SG()K4sYk$$X1QTni0O2Ql|U~+t!6}rt!|*X;m3R+DZvv;6=RygRPiN=-`jC4
z8B%XwJBv~EONK7Cj8RQQBaT^7BW}g33P8~J!q(e;{P!O7fxrX)EvSVsK6K896(uK!
zvp`Zrut0z#z$(J%NAVJ?0{0*|jvc{<9HJ+#m}d-hJdmezf+Z%O&Eik>vDcZT9h5?6
z_S?}VOE~MVo%($>X2xc)AYZM;t>_H;z6C3bbiVq<PCAB5#cI8<;lc;@g;c5AMmpjY
z19@2c)pYc~W=MG!s^4_8ePN`Oa@t&pPzu1$uY7nxPv31lC$vo`dirn6J-qO_6+Pn*
z^t@)%eY1Ar0dU^~)cddUGMoH~r%k4(sY!pbYz{E_8K2>kHDpUbIASZvDeoH8N*dD`
zR&)&*$lvDk?A}=cHh5qEeq6q9PIkjG^Tolk!h0t6lXKMc&T0Kee;Z%sv%pm|4i;UX
zT$5zF%wmhnBIz_Ulc_Be@xh=h<O<1#f}pO%(j_;9^>n~vG+Nwkdc;GTX<yW6cWQMu
z18THebTq2%$iSA|IyMT6-EIj+C)?5zLQMKZpBB*h@Z~}-#j`E{bZ9C=jgOjdTlU!y
zPz3~1$PL({kEinV?w1PpaCT7ZLx9O&x%)@Cup2yMfAWLM)Yi;%|5R6ha@|NKRX7JY
zeWbBN3CB$HxPs|Wp=5wWJ5&k=pEtoVT8WbW!@oCDuSw>cPqJ$u&&lR_$!iz{u37Os
zS*T<Nh7*6%e<CD_w0>}8n9hSU#q_Q`z4xQN^j_yDfZ)spX2xf1Gh;LUJov7dz9;WJ
zFm`}Uc<wF#2>iEx!*w~sA6L9?17JFy^aznsYgio9B&?D+?A?#pYz9O649I@4YxlJ8
zoHWPXq}!W$mt+8*4@jFky0Z~wq$?8>xtrB{Rj_)Gx>?5L19@Pf1S{Vx<S(n18f@VJ
zIYov8w&{bL_^*KudygsZF$kX!P7!4Q>O3VqDs>thL4Vs++h&!H>GaX`DTe{Nym1P;
z3^HIZ$10RTW&>rM1-OkyQF90^U;Cx+%S|YDi|@H8jlm29gQgOkeZ|LMqRFhsRk{hZ
zRt-f8CJx7+@^CYwP{s)du4I-s91QFm@L-;){{yEt+!jdq47AAjx>$GB(;Be7q&=FA
zT;cKf^M1s$D;mkTDLNY&iO^Y3yX1ssL~}wieldaWxCt+J<{Tz<JgLIJ$kUp!z3QnQ
zJNY}c7822$+W_yak5qr6TA};M=#Rb<G6W8H$Wb6ENe+!<{@T9nz`ALA+UsX%yzJct
z?YKFd7)()S1shl59=*|uQ}~e3FH<bUvke&NyHMO^UEOZMiphW#aio3prS8jG?NF1w
z^)mO2xJW4cLox%lLi>D*_oAiA1)rdH)xJ3y5T=2vprUKe!#;SE)5u3(?|GCr3*0qH
zAedY+xG>Cqul~XHgEIAfXs~#)l1~4r`OEc}Ci5q_xG+3mznkrTvqi4xZxppF*SIHI
z{uZvl4_CvYqfz#%evb!6{6eW&uK4dLpX8fx)ZQEH01On8R>^G*pT0l3cn{EmPd@-j
zh(66+bE@mnf+uQn*Zji%3U&qrEy6YsD^QL@^n1_q&vHWby*32`T+rIKckZcfZ7n-w
zetRtx4$3$=ZZ9vvPwLo|rjomZdzc6U2BObiI7>tH_ZPn3C9bqb^WKH`!2cgMJoBE}
z4*~D(gNgoL=2(27hkcOR6?@{xnERC{9&G>XQax@q9y8+Bod{;t<HF1cxP10!tWcN*
zLz#}->D!eSy-|Gg^<^~Vi8e%k@X-f}u<;rLr^Zj&PK}-NLs1#z&5z|t@T|ooA88um
zsiq+M<n{5Mn3w8}$FB2UuNsia22|IB=?|u<b0?>gH=6WLRZamM3Y?ThJ7dC|I8kYv
zOnp;p>rLvFM7e50z!DU!_>{*>ublP04Xk2ot+{pF3P9U>@rXMT#0z7Pe|FETeb(rs
z9?@7k%lDMO?Jx@W2}P;N7}w2Y*x@gqaY477Rr3P%g2>Q)wL-)A*pQxU_*1*2B9b*M
zul+;FQtYyB=G~)r#)5S4R_Co$j??KxO#WmxqM@Y-ifMG16|1N9U`vVBA9wj9Kl>s7
z*AZvCFGf0|vG#MWXxwgvZj_&s-v~7xo1Tkfz%c#pca|XL?dgbr3(>Ey+45Rf<<ZBE
z!iS`iL*UN`{Egq$-ld2E)96s$_mgolK{|M|^JXenF2tRr)z4-l%P4mO)p>U8#lT|o
zMfTWI_3HBSN6C9>_$Bh9$=G_AG>VoieRQuxl#`#6=S0oX>5)Wtmf;nD39MzMLBU@Y
zUU2#Ds=BJ``l_n>>c0B#nGGbn>%6_>tE=-(+zZ~_%k4`J>;sZbwy+0pYx-Z*ytt_i
z=VE~s4=6OuDLpJ!Ia9$4jU%FZX+V?(K&)bkj{}d0kU>CJU{ls|Ce{VfC>^YxlpvZ0
zlb?$qsWSzI8dE{g1c4b)UC5ca5p*V%gj<ACkXbz|+&AU*W6U;X$5F6_2aOI%QV;Vy
zjCq0i!LX_T4LWHANH9VGEKm`g<Gp5pa9nUhL$UFJR^#q7z`1gzif-u;lP$s%(ZdvE
z9&t#40h(Eb3`7x-@Y|r%`U7InL_jIPm5LMl_1!x%ZwB1kVq*n@2--u7`LQX8po!WP
zGI<ucwC+Wys32rjf)rP2#AR%44#(p<f)tCOg=N5qepP95RVamz&PBv#m<4`HjB1NH
zb%aO}aiJKc1riN%x>}VGmabXiFXa?~3Z4juqW@ozp;A4kK^yINr3bytc?sa;37_=Y
zay+Mh{;Z*h1p9a`a~u-$%}OFxaUhlS!W7dX+2m1333WBrRBIh|*S3Z>U16)8PI|x_
zeZY(p#(q~)SdleYmzJ(9<*G*ATNhic@9sX>R2$mU_3rk#Pmx6vL);0ZCwoIiA9sRD
zq>@$!`D8He)DJwwP}4P==87rLW=<<y{o-p|&kpTn8{Jj)#$M4?UGsI`*d4p;@BUYS
zD5jwSy)vftxF7yuZ;Z45P;D?G6@G7@(tu(7{okwiUVS7>Ou#2`;zWY(&ITLsyh|7&
z7(Y%FAp((qhG?ZRn@%IfTmf_Y3XiMi{u|X|ZJ!qZk1!?SvYDO^wR&9N8sC~jH%@U@
z8m1ybIE~1`vUgqGc<!8W*~t!{>FVi$Ne3p#w4Y+3H9-1F0#_(Q>_Xl=QGh76gf9Ga
za}y5q``&-w^1hHW`~U3xv)`diz}e_7&uP|H5(?jc3%>n6LeqIw0fi*9#{)a9zBS0L
zD^E|>R;bi9P1BW?L^=eLFpBv=J!9;T4bE2z<E&oB=LyD2LM2XV&jjGeiegz_k{CG3
zlVsX&_FNwLp4Xjrz`!5zfL%mNU1<os`_BL3`tkyyi>s@%qd(Q*mevldAqz-OY+*+N
z8%i(&YL?feQd<s$#R*1{BMV^VhlC>iMBO@q$%?DdjG?KOua1agpMZKcE>|5T?l(6d
z9%8Zi-_c~?tX_S3D~=xJf!QK;O>2<X_a9=nbeD=It~SjW-~0W3lF}iTPF|+qS)x=9
zO@`8V1#Y6$&e_`=bs86S2w{Y@<GUPsdDqRyQ&VlOn@6TWutOHdC&Mno|JVN~qShM$
zd{_3r5*Y%9+5B?3>HLiIvH}90;X$?153RNjw^t991WW(&?DY8b^j(di`!nGtV99|@
zNSSqvA`b?agP_j%TlN9Z*Cj-1jmCesDl2a^=Q}MV$#P}i+$dHgHdO|C)RecKHcX=H
z%Ro|Rp5>KZR>w#2ze+IC98;@<taUeX0!kgjEDVRo3TX*UiuTm#N|vE}+CfgtP1tin
zwnHHnt&<y1PwN_aQi=(UP3VkN8m`fPR*H)<Ls10%sSw?uum;G^<bJ-5nxa#YZ3zS-
zY|?W>F6(N40os6rQYX+Vye+s2VElP#f`=boBG(TO1t=4|v)e!xv&sh~#lp4(dQZU+
z7`bgo`>Hzoq#d(?(1x2bH9Y!$Igv8`RDJb~NtQX4(J^6~d&%M{5y%tbiTcIdwAnP6
z)|>W-bm@+bT-2QeN_Y)|UiSN-^>a#*`aX1P2qrBCPxI$<|KZ|xRd4PUfkh}l;NnB2
zlcw#7=pVzMb;=?ng9@@*N+DgVinhX#<$VlKBe$ZdKTUAgfi}lu%?8dSZBW%P^+oui
z7DJ2U*xLBhVO9SF%70x?f<Fjw`-B9Vl!8#{$Bwj$){$c+;nKf8ySThKJ9aHFr*_HE
z`devp8KEclrhBxz%nP)kb?mXs&M-S|eI2cGfv@YkaTF2gF_(LkiiE_7PN;}y^YLLX
zN@wL7F6%ids3GITC13<;21Wq5DLrbTgO5Q#Z!&PE_ue$rm#{oRuPmq2Aej2?HpZVE
z{c(8wkB5HlJRY{Xx-vgATVmGNJzej&r(YEZc-HPr;>PZ;TixbsRT#1gyx8a?i(t)u
zSnSk99^2_*J2VskVbi*Exr?x|6Gh)G1T-~Vj$wsaaD`j3>B{Vt7^rnG3G&dC7|oAs
z_=Z&G4Vu!}!%VHPK)aF<jgFI!-kxi1B#Q)>xK)r~4&%kTs&-ATDfAr2dOu2p(k-6)
zSj=xRaDD6j`Tm}jYUrhfF^5s%g{?sR-S}VS%ei?|l|om;9meM+{PCgPP#@}p+eMq7
z-u;&!zG57DD><oIpOLyK%N)sDX+Q({vD>YfwaqY~<?vA1obP)R+kK87UbbvE&^`OT
zv>DfNHrrC`7Tok6Nld6b4a>?NuAbWn=d6s^#-IOor}zicZBC;%-4)$e?gxPf8qX>e
z8p3KIUJ3n6c91oo$?$1Q$`OIQ!b-s^E0~S*oz8#P7Wf!AHb#EFCW4eoB%Zaq({8Z2
z>&!qV(8Loo49CXe@797^->ZTK;7a0ZoBr?Oq|X1l%St*Tj?t0{T>X)qb?2<(a%JxF
zJ^Mj!hdj^9h|(2FfMvZbg*7zPFbD_w!gH2j4{|l{;N~6h!0-2hDy*Wg)HA^-w{4Zc
z1l`+OE--^&E9B|M+=j4h#tE6QHFQ!h=WyrPV;Gke0dbyp3rJ|-V*I7<(;_`qk&oR0
z56yGFB4`>DUE?%S{(52;%cf?t^h)5WN}@MM6zxP6u4lU#O0V1u7kHbr4S`imgy9ya
zF+!SihS=#NaJI8_Cqq7n%h6pY@YjF&09gnUw99$Bj?RR`r}MJYfN_*#8#?dJpxgUc
zOSaFzA7`=OQa<Q3vx%bY#v0gAT|`LD&47lyvPlMNE@Kh5CY5=Uq14+mp@y;D*!uhN
z4bl<H3el<*L0MQw_241;5yL(b#-C3Y#qyZXrlzL5jx(qHsiNS45B?Q!;%&NX=$V4J
zHGJ#GlieDyK~6F%MaSv7rYx3>1*)KcH`HKAx)U6i7a5=^lH~ac6|y#>*?s{sUUb*?
z6uR@ZF3kf53fuQ&(}RN+>?Ap<_9pGYTnQ(cK!b;MgEXGk>-bv+X7B6JKJxOOW8l_4
zMi?5PYy0{8Na&TRVw&j`kM<4LGTSIcl~6dO7Y-N6iQ0h&tj<)V+O}sP+yVyMJYx}S
zcO|fqLZ%!;3Pwa&-@lRE1QjMmHNVU$0qhq=B;>}2(52^8R9FnRJ8Gvizg#Cog*m$+
zBN^8-<sN3pv8&c~0#lCPcu-UV5Go0l!yP1t5*4DPQR10LCXwWxg!?>(uxPniHo+Wk
z_y^v1XFs>HGX|HYS=6<Vp4)q0Q5+ma@y*HlT-!6dqEHQYwJ2(9TTYiVoJG0q*Gl*e
z6&6zX83dtRjvTrAXzsfl(<)}iayeqk9fj-_`M4?7$FeISW{Bdm5K;(8m~Kf2ebbxM
z*@Prdt$ef`hKV<N_)@xMp=S+5gA_07f`G}<)b(ZL1}p!z8(+bPbn=-(MSCtV4&>{1
z$2X4<C)METREHnkkp2yqWq882OWN%XxrHGwnMJ{DUR2~R@YVc6qP4%9lK;0v3b!+2
z1cz1>$#R<(;iy1q)NfvMP8h|gdzD(y%%J{@3Sn85vAkp8?%lh?&e!jivO9G5`_xYV
zPVg_^p;*94@&(~60OI`@AA%SEU+@8NJGzDEu0j$*gb{?P6`|g>>0I($bk=Oiy+#J2
zIj~ny9I&ug2)#j0fu-}|rUXk%fsmhP05cV~s+w^Y>Oy?6j$*xVa*T(cv)S%AM55{J
z@A?LjESvZZNTCTv$8?pu4;=@bzrW`@&4k}jR0qp_ob<{42r+2sJf#b!g?-cg4s_7^
z5R8Q77=<T&GBqJVTn3;CgU6PDSn3v$H!1TYT?~~vz(u6aBuR6Oix&(;F<ZpD^G|JC
zb+UtILvz-MAgEGM`!l99D8bbXO@5ngy<8JxUw$C7?Vh=pXXREMU4<Dg@HRakn=xM`
zQlH}_9E!GCRZQuHwpJ|TkU<!_y#tKVb*SnH>j-CjVoszaCOo}g52hog#pym7cY2`p
z(+hU=uG<UMOf5u2n#wVQ=(f`gGnf%!vYnG!L`a_QNv2Pkk6`IHbaU73bS`8VhS?Cr
ztJeVne>{3A9H}TH)9g1XOui&FS=4a!w-l7^rW&MI+<T5*DAN8K_d~(Ek8iO?NTA<H
zoJ>u+z$!A*ze-XTtE5#&L51FNgBfkJ9yTvBEXY)%R6tyk8kAuAb8A3dxh3J}Ez8p}
zEZZI$Ik759D~|sgZMLJmxsxxDXyVYzvzd!J{ICcx{>|ETKP6+hyHslWu7VVl?W}lO
z7n~&V8HEc)ttd)a6tlLFN4v)zD@rqZMYOSzin56jD!j^15E@{Th&8n38Xn&8FD}rM
z;y0(q21AL50P!9IRTzR85aW>&o__4`jBk8@oB%ZfK%M)CZ|^6;v2b%Ag-Ojs*+WoV
z8_}?z1H+I8&A|sN<LMcL;|#(0-~lPPBJIe&Y<ML#WH(9E#Bn@uK)wDQFJo+p;vs1f
zfKQJ0BmR1s9fp%%b4XCf`qm2dwnU795`YoRe1RU&G|<}&Lw^cJr3d!v&hu~q+~M24
zp4@Dr;dd}T4*(}eHi{k{4<5h&hwawG07SqAAi3V||8{U~{Zsz|hxlEr2<Wth#YK`y
z<jBOhCc;Kb1pgI;j;W6}jA{>{6_c@udgzH+(k^#lLPeBMpdpHr5p1<E>;Lx$INc^=
z6X;xP0R}oCI1AHTS6z(};4n#|6<lH9<$U}n-T>ZncgjTyvQ1+L5r8s4M+R2BYJdf2
zd5`ItoPB;A0PA#k81QEZ^GsS>s(E;D!ejv0E?E-cP+9y4mooJuJPdg}!bh3|kpfm`
zEK-O#j%~`&WXX;o0CAG4h@uXK>U92zh@hBXA~hgzDxv_DyCW)qt&eD+g*&1HoeFB;
zT`(CF3jmB5)Guj(-Pqi}PfnUcHZKuIB>VCKquLFsdXR0)SWUH%vn*lo<Bo;Q*+_D;
z?XvOO$Qjqq2OsT<w68d-5sw<Vbs@}h9~xm}D;(uRM(N3wnWl~AN;;MWT8z>@qk}ct
zwR$x@NG@js`=Oznj+l@u)q=Gos)&OqG}WH(M(y$viuC6e0kL<dL${>nlpV5WMe7^l
zmbHd#tw0IcVYtpxMrPX6z|!J8ZoH3`-yY!|xv0PMU2^5@xYUuQNA{@X7Drd!;<jd7
zV(32$Y(K@?)&a_#5Dzqhh(4GHE&X9i8d^wSPO|w>d~CmvcTD;3!xtr4Q8nE#E!(+R
zP`+eo#j@oqR<5e7s;;T6t8WlCLQSG(u|z6sk+&*frAn>Q>Q?I!gAp}ha0D|8D^eR9
zI|nD1c5WUNFCV{vppdYLC|ZY@I0h>r8T6Buk=3b7x11im34bHmiEPpMpKB#{+E@^V
z5DkMTS)^Kwh(%S%7TaiJy}3<55XIfXlZ0~Cz^2F<)h>n=*J*7`x`A<_<E{ron}Hx2
zrcV|LO_tT60kXw5+E{OH3lKzc*B3|?ITKBhGpbz-E3VVpm~;c<LdRVX4thbsXTFyk
q#tHjl2>S28<TpN+{k!(7{<S~c@jvcAWshDD*4<(6M?V4v00017vIQmp

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-greek.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-greek.woff2
deleted file mode 100644
index a53d52d6d02cb4a799de8891ab08cbe1fed95cdf..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 6836
zcmV;l8cXGOPew8T0RR9102;Ia6951J05%{102)jH0RR9100000000000000000000
z0000Qd>bAdfm#M&KT}jeRDmET9sq%2FH8{#3afmh6AOW605G6j0X7081A{~aAO(j;
z2Zuon2OEMf72}vyz{UX#ScyK#|6dZcF~YERp!F-Ui%8=IVk#Jl5R`@Irh5`J-gy4q
zcl;^^!kIapMG23p*|S8NGVC#|XtK<5bM7*gKMUf2x=1qmqE9~W_bW$8GW+wit==EP
zX!KThjU){+X9&S!97S=65n~ktFmk)xtMc}$Tdvx@YzA-c{vrtVf9CA}=Xz&e5_4zY
z`RbR^SP~|*$ww5bl-R_UvReSqtwSEZIqP5Hp@4`Y78I~#CarI4?Q+{=5VP&L|MXA)
z^zXf8GQAsvL{p3r3)&$HE;f5dNff^n*n?%96l;K~w@e3fC#B%(T>Ont1Qr0~=+t&r
zj@eQ6N??I(ji~I@sw5?4_|Y;r{RnKTku~q9lwf#uG5{D@o0RNd`afN1JAY?&5L^Yd
z!Q1EPJzc^@cXs8jPNk7%Ef^`Mm3N<4r(@9CXM$s02%(dC9h3vaMM=~FmFZHnDT*qU
zRhAkutKBLq@e!cob(_rn)4CQOmhmvwP-0Ani$7;AKmd>pP#Xgt1T3$_#>khc=4;jQ
z0s>w{#7orkjT(6wHLqnbY&RZ(ok!s25p?hf$P*&y(FZ|*M-T#(0my{1XM!BAwr)rV
zHUK~>1pt6KGA`Kin_iLG805k(OhDB&0kFZr$pqvYDx;MFSil7m@nX4}aofBynUNuG
z_PjHn1FVWMl!501u$>qQ06;o8C<@mAJWj>1wIU%viyjNa@fgxiCytHz(aLcEu*35M
zK&vT1VNk?2i~(doKK}uD%UYfQ@F?W4-r2$E8eshkXH$Sy{~Z8KfRX^JZ~#%Bg8@L%
z=IUSzBcrnj0Dd5-8s%+nR5zOjWwNP?7|I7AYXB)WTB*h!1S|t6ja7xdmus!r<U(A`
z-=^sl2mM-&9>;zSFOR~y0LWR9^QafVD)|ae8Svjxqy<l5;IjakJ{w-<VpQEdHsr|P
zkGl*WLx?rU+Ri%cs1>JN=T^_{#l6`S0AUvPZtl2~u5i8EJfH1M!P!Uqbn&7=b5H{R
zUYorG|L(VmLl+AO@~R?D6~JI3{ZYkDkr^bXproeZqoorN6w<}7TdzJnXnF_$@?n73
zvCQzG6_TmEgMa|Bn*@}FII5_P*@zpGPLzYvz%I(2bfjuz#HJ1SeDe(8tQ@2T0nn{z
zN}gr`mLhc+?E%xO+7z)^Dlc$mB3OhYZARBwJvP_wi!g?qh0|gIK+zK-X|5@XjVYRE
zEyoaF(cCchG9iZXNffV&qMv8HF@dd%B2PB~mgRYh+HnMmMM0S!iir3lQYao+Oht^W
z3jX+<bo_M8FNB%ce5B7O`Y5U-BrvG>mJvgd4`+Ndx7yRB#x1qDRC<dxoQGYC)FLYQ
zdx9S@+m@wjHES|sR-(wGhm0JVdRk6_LJQ1^ii{o>s;#6{-nYVUB2v<on}_kv4D8gJ
zlAXB~SJA`~CF2A7&mg!HU86hQ%*mjuR+UunH*IxnBWnN*drEuQY%Z8-?l)ByO1gCP
zQoc2#5RneD4d;_hv4UQz-?=G&YuV?-)!vG~<k4jXIV6cdMmz@kHTjuZdIZpf`d7=%
z!+K|_F+t2w*5xd+aGHqC6c(k1G-$*NJbL*_Eq_hc)pt`Qh~`3rKUOJj(U!}wD`#_C
zN(#9c^u$eEqid|4zuWT3iy|2o8pOrLW_sx~rZNxD^SN>)h$uS(mEPSD#e1r=yYqD)
z1f#<ura994lY&39%>-HTTLW27zbYIN6&memC1oLrT#yeGj=c+EB^XQQcS1wL34b|V
zr@8jfXZ{#6`}THpV|rnQ<Y5XBv}P54>zenO^zWJ{{!ag)bD<;S`_C70UxK@Bplqe#
z3941XpodC6`uJAefR7WJSwyT7|AfCUP`!42actRj&nQsVA%1>n(IrhWO$Q2(o`-c9
zz3ci%Yckcc71yE-=Ywr|62;Ziv4*|fV6Ay|G|6h6eJ0lDx9q&+ctI$QA!x2g=$hs%
zFpj`F)2_A+neLK@EkWjyJu+&YjC*!^)E5*CN80htQ(W_q(DJ@vsdR4|DWcskdJt6#
zc|#&xbTb3gJN9`b5!8PYcM1e)xZO#W2J7np-=UGCy2>fX+tp5FiqmzV3T|vFA3+iE
z?XCHAv$5WXR#{OkNvXWBCY$LbXQdCX0>f54Rj1n8GsUO+s$7716E-GQrGQhXCb5hy
z59s8T$&kFkXie1{8bI;T+R}q-0qJ8OTq5wCd$k{@qOYt>KJfn`lze3<G1#XNd)kC#
z-b#04lh0^T1{j%rAGy`)CJZKbi*;+qyn!&Q)wtQP07J<usn$<Log!8%^^RUzx2~h_
zn<Ljrh*IZh&Y|{a4g~ejg?{3cZs5-F!^<Prbw(*@OU}2RzNJED`+uc*eLm^WXyC*%
zW;4gMa}&(`gezln+B9cMo&j`n@xw$3+l`TR7xr$`A0&!d<@gsueFhPhE5djSp$Ii5
zQ6mZAt+*n*0!|t&gr&t&G#Cw5Eh8F&$<vNOm4+d3O@IBmJ5DxiJ85*e%@$X)@g$@U
zoubyMXAgnswW+5^MicMs6wob#ozw3OJ{@^&VPxx9THMxF{?2V*L#p7tXG1IX_r6|S
z{OP^N>O*1W0`Sr9MhCT8mFuFQK8;}HsxW>gp$eT%qDB(J&%#yV6>zT+$8BfYiUy;B
z&@y%cBpJ+9A`+&<7OO+6vpFpHIFXqI{BRFHxHNTHnaozUGCvhKmxEaHI?8(x!pV!1
z^ue!fEL7q$2b7ASbsd+711gKF+hqx|4dUxoMUYl%?^f5zKltQ}_3Ps2nI(budGUJv
zi#7p71oUU&)lWz6<vdUsUHz45#l#=J<?o*;pq*-7-xEteRFnHjc+pEeOojV|*6<>3
z$@eS+Ea!P1j*El$0Cg{Q&q3S^+|*VIw3NBjypj5Xls01pKLkpCje{Bzu<JQ(qQARe
z{5-?|y!&(FM4>v~^`Ib6a;B*|hq{DNGXpBSBciHf5+&+7JF%O4CizB8BzNn}EiSjw
zn2VNjz5OMNVlaM(x4dz_skx`w9}WZ??uf?MBP*jTJjtA5m<h_^bz6&gQCdJpc|{hl
zhu^L<J1ys03aL(SvfIwJea;|o$MY6tFs!iI7>SB9na#fVE6%XntPU|MeBYhiEheYS
zU~u5(h7O6&;#3<_S}l$n;Q#v0$N9m9iG^#oR|Cjn_m0d?1l0fgJHh#`RT1%P^(BWF
z6{kP#nQh(l@mpO|TTQPTHw<sq+wCKI{cyn9P-A~fBz~*b-q28Me@iTStHusat~4<2
z^H^-Slg&Qsf4Q{5-c@H*kQ3fZn7%z?Ma8bpjdlMt&37y*+eQ3Ixm5bdD06At1NOUW
z3h_oydvI={vxA^k>1%J|*}Y<-q+GgLdZ@*z=Qy+W&{=!D>cfFS27&@QT3Cm-yPRE-
zVZVSbGg@pKoy}<r--&bCk~s3pJ(+SrtWuKYKdjx8(~$$KvSz-}Db+tq)f}nmsX9P`
z;_WiegZ<pKYG&y2(-jq`AKx_u!8?-lkkN!|b!OZ+L=T0dlfkAxm0mVl9?HwS8t|8!
z9U+{zV(GE;EDww}56LwFE3NZ5%w~^Cr}ea&`>4L=Hk--RW^4BI`gHyCTVqhnZlf7*
z!_9Bg?~vYtHbx_Etu5(>&>baKMIa=z;Q^VPww<y{0v&Rlo%C3WiqO`}=KhEVrXT$S
zEEXs9zO+K9Lj7{W#x$zCjkMaX(-{fEvSKByMyB&Mn4y_*=zZo~xi<GDIm5FT?olvh
z=Sjv0G0i@yOoMn8=e};RtGT1qX}^<tje5dvHEp8+yW`IO@rh8dD`>`@rjI7bps(e@
zkh<yqJK29538(o%NlH=&<RU@4)A*75BV%cp6>|91MDB!pGfYlj$Maq7u{CD@-}NsD
zvnndGgfF;D5%ubGnKdff^?b)IXwq0+X0ExI&O7Fz*|zABNbCr---w&dzC+N{P%d@X
ze(=^z<z>;l58f^qsJ{r#@`W!61TP8sFTj<nUd`@Z8gSio<q3WD1=XqRtE5asK9am3
z>cWHN>GF!2^75LBCj3wJTEWJz{O!gZyQFVrc|X3p*NZm`QzCJm@FiRt;f=leH|S%%
zb~S8Wh5Qq>?<RY9cP=1)5ljFO0B~XQ&{Z*Vg%M`sBFw@0n2XbJI?lkEI18VFvvCg2
z!yDXOa0(>@X^^P6A<4=8lNt-DyD^$e!#9_OBbJB6N!hKS%ICtww6fmkLa~7haRKn;
z)l4oxstpq;uIajCcnb68iywQA(_nQAEJ`JANlW6Iw3&Abh>@UNj0*z@gUF#===Y0}
zf$!gYFtt<6u70Z{0YCvT0lwQzqofe<AO^)S1nJ<jSdeP;4~kZyAF2gG25pcHH2i;j
ze}5mqJ{K;azo8%iZA~?LPi-}(UR%?zCWA2$VOg1~y2q?^b5HaS{9xURo$nqDSrY(Y
zLP{yWza5bpB8|03;F2KP*FT4`CP4T1Mw%?uZKIGT0WKJE8P;AX=~2xwRt}2@(&m<y
z4B5XH^@DA*S$+*sXa~Apo$&fpe|Aj<u6pDJI1jeXq25~t5CEVl|2JIw0{pwHutAv`
zt!Pn;4#N%b7<`2Q%0?1sg&k-P9qZDr>#kPA7IfeMA>>6W8becP0evEj49lWym%Z`}
z`KA0yel35If5`?qgDxQ(hj1LH@g!cr58@~A^V*`MPU_kEe|(GbP>)gH*cQ9O{$l^K
z%hVCoB2#36yd0*(`C)_HCR;S1X*xrHfFK4iiWp|GjGg!%zrmmJPi)aP-Sr5bh)3~c
z_8<G4XT|fHcY4&Pe7FDPKl^W{00dqzmI5G9zL%Eo?naMk+m4IC2y@1=Tr2`X$Z!1h
z^{=0K0}l8c*4L}(RWBBW6fi_kJBW)A1yOVd`jUz^nM`O}nDjNbfS2TI+uLqdxHR2p
z^obYi#mPyTclUy=y<4a#(oPeIR2!+V<Nofi*_FWdJOF$xJL#>&R(g$6I+wC7mWyRs
zmC52IaA`3^N)h;W7FS3Qu7s9_%WkuIBeSOIgmf+zb1-<coRZH6y<Rx#wOU7+j7@2+
zdUz-t`9YA^o;GO21vx~F>c9W4-ne$vajss!e);6TQQ%l<&@|<?)0kgE)5<KzpSopx
z{N?^cY)`oHkIU^I4$t+iY2Av&T9q#FN=ioZf_fp{0KQaA-bjHktmE{vQr~H@3;|0^
zs^(Z1F=RQcx)dZd<?=oc08&HpGJK`xP?ET2Ceyrox0z)c2gN*)q@(+1tWdzEuwZLq
z(-t&*!adQ3RzD69t>mjSw3h<IPWPIak#6*R!x12O%82CA@$kxnk36{Yuuf3NxyzR>
zT)K3Y6=ZhkH_ggyy9*Fu*z1y}&7p?$?OC;$ewjRTBNr|N5!|Bl*DmuyiL<;3E<Bo9
zFNl*nEYmndE+iup@&fyQ+6KZ{Y{BS{M%d%+bcP6_VW;i&;L+luy6ae%Fl2SS>Y_Yo
zq89|AT>{Doept_=cvQeh?D6Xmk}GC(Qqb8?=hjG$2dIKIMo`v<y}Xh!GM;$W{AkXb
zz5^lN#Yn!<Hkn)FO)#w&L>;k|LP~E#AC`idYV~k`msJPVj3|b}u@go@qS$P@zECZn
z>x0e1=iP)pBL~cIz5ZyOjQTx}!P)lY?c0TFj|*oejgtxYooZn>WTbYKWu;QSt>jb5
zJlhadg+g_@fG>S6N7a)u&xF=HjqZp+iXB^7xp)!ZNywl2%iYa)UgzayM0ou^8dKF`
z5v2HSQd3dPNT0kr&@4ZB=;TIjlyAL-{F%Ss@zOv1<=11M9Ih?w?>}p{`6y6}d_ny?
zbg*TF*XEnzZ;|^dd2Dn-_Y)^J!{tXGd(3LOs_<waQLR??cB!UFW3%a7=rP%RR1!ra
zDIzSVTVlwix?56LjwNV)f*x-Vi2z+-34{m|Tt9zAL9BbBum`-+R7ywFvYLtl*6`zx
zw}(16Y?~VJt*L#1eY*tu#%rK#tQt56i0n{qQfh7+-_nr4p7ij7mV<z{EO2y%SCg$#
z?Blx_3-h?UB2ZOlkb9ED3vFZNvI)IZ${qdMyrU>tzqV;ByR`z-HP^4j_8Un(Y^#%n
zz54e7KLM+&D(e)_ndMD~O|BYr2OCq9fpWb|!buV0p{OQAJVQQ(oKi^>xh`rp&!^Ub
zJa0s)Hu_n%=d@eB!C(l1Yh*JJqU`Vp2}1X<aJ|K>8h76F@Dz(%8Un6sFgO|()5)Z<
zC_VhdlaD=&fybVF{Gsm^`k*Nh2g580^xz;2G5#1KjGJcRZa!b!sS7VP6PZ+uJusu4
z{q21=nvAnFMbi|(cflnk5)4rQGgHe`$f-MsDSXwNM4hV1wt?%m%5r<ophF2_VXN91
zkYEf_wy*OYR&MonP<>=)rJ%>iMNEjF>9+?6<~mNfY~4l8_F)T(sG1)6BFDQ@nifcG
zc&>cXvPwJo(|`JJG7K+-)imA+IXdvmG5P+zdpBZ3%WyFg3y$)en|k$%weQej?f9};
zYr?Nn&j6m_z)T=qDyiy&_tvDAhzrUKwIQD=V=TGe&O*o5>B_w`rm*c$I5jT~y9s+A
z8wh&~-*d6l@^aEKFNl&HL(8$)-X0A|_xh>c{<frSTaAo`Sk_3!sgq~Vmc_}12QZnZ
z*306{MKdYq+kMv^0Wx7kq6}>O<^JXGw;vg-w#vm~5&{n!+el4`v?rQ|kZ``RkrB?U
zm_R11v&8Nci7$YQXVJPt_$oMCDjggh>>zT_?s1ZI>(+i7OGb*@9#5N5pFYzTk1fnE
zH0t$AyIL|PkRk|C7>u&2y>r5rjpJx1-DMMt&T(H)edeA+&tQqBTX`RV#E8^IA8gD&
zz4X2<DN0<D^b#Xo0vEx#>6MiQyk?CB#-qa;S5Ra*mPpL14-eK&_;nZv(8@-XR(p^o
zgVQFxILpMZ*B!9B8YFuER;cj2ld`z@LC5um73J<{{J`^k+(2e-cFwNV_T83csMl%t
zv%!I5+glgJDYgbSj5$P<F}!UZr?`eJ3qqAkXVOO*<Sv{_32_uOT5P3aJKW*M#_xYl
z{q1abU1CVKP8h2sQ?X)hNd8s@8`7<7e8WVIZA+4-3)PB7Qfch$Sv`bPF_uK=k%Aa}
z6e#0rgn|$SE4D53_@sseAs_|HkprC~fW&5XE|K;YW=Sc36_G8z->2qC8ii}MKwwza
z!{;a?GbFkad10ZFgD%?+Cg?j`__A%T?bys<Q4Gt1ANOh~kfw)?a;Da3AR#vEp&=TL
zx`sYxxr62qT)kR2aQ!LM;&%^9Ke%w~7D3Gej?F6V_0qW^V;=FDtx{xe2(O&xiDBb9
zY~{7s&@t<K7pLSBhsOdcLK<Hq(rPl3mL*CBj=8NU)vMZ#*2ECEb!z#+nV4YMg|ioK
z-U}KeyfwBn<8=V@ffX1d6*x&b#wJDLVBlRIm&>wjY(DBUnWiG>*{td6lt);R&MnL|
z5A04k)Ugjta|Gl%<Uq%GKc${`l2exxS)j=)`8bHw)8cR+hZ3Q~ox>p+a!niv;HELH
z_M>dT^T1Xca6Z)BPA8Du>Y)J?gn!<(;Ot7BLz(XP0T%-!U`3k_tyCout+oaP09hB^
zL@4h>WimG>B;xS|o2Q=p0GNhqIk@X`CePFonDsRPc<=SAFEpQi^3|VfxNYNL-F*OD
zzyJUM0eth2gZT%lM*NEb1bJU#{6Ocr3JBRlCPX1<w?S=x6KFvMwYG0$(`^ugFlfRN
zTsu~UA=}p+_PYryT-juMIP8+sg2on^pg@^tP8}=YR%?$cK-3O`Hm$&9yWH50X4|jE
zPzEg!;De1gtidT~jSj7jDeBT;Uo(()5EItmD*O5ow-$y`;wlLMY#aaX0Nyl?iuWdb
zqJ4D;0H(>XK!qLVXNCa=0EO0p1&Eyi01skSRS`kiutf}V(eEM)Ou1iVLqm>>9N3gu
zkqeTv9FYr}6deNrWTSM(#-&Q+KsNj<av>dl71My{Q!xuvZWgmaVXK$}O*+I}(Ai+*
zfy?}N=7UTCpu|mzi1C;eF(GPDi(#_}(;}i`X0(foiQDuxa#|czryk)-#FtNpq3Lv5
zc<qLR7d59&gB4K5NVtUw5z|C9a|}B48qr06)NCOKX~GNxDXG0d(*s_@?3QmbV@!w<
z?-(N^x6;d{jo$dAj2^|9wm8~XMWHDh@-P8TebsCpRU29w#>fa`T1bp-n7m`do`(~b
zObet^W-{$n=~iKQ3e-K)bZv}{u|W(UHzzdt4^{BVi$wQFL_yx1fg2kP?<q+gomwgH
z4lzuAV%tIi#Ew6}!*gOdPNZIgwPoL?xXYqtWMW3~>kCVg6;;y>)3P1cQ-G&Xkuz*i
zti(o}lqyrMLZvFzYSgO3Cm<vuCQ+|Jqb5=^atcZ+Y8u+Oh>o6tk%^gwl?{$y=iubh
z%*~@ktF|bRNArYFN3ilEb)s~|aov1+^z!Rl__^Az<#TT=R^>`F>Doh~@|8H}S45iR
zS6?ncn{!>uH=Pyzp_QHgJudr3=z9)3Z@KQ;c*OJhU~3*n$=X&Pp=wIhKB!}mzq$AO
z@SoO($i`Idw5$8I#NGLF-}y=~StGV*o!p~c`M92?pg#wi_S-mBYYYLkWXdIlWL?mj
zu<rz2b@Oe%NtlZ^WBZ?0+WyD|O|;_<yNgCHJTZ_MVf1Gf3Ve8)ScYLdn~36ZJVCLx
zK-f`i&|>pAH3v`ItP@{BX08Cta&wS?L2`F#obn<WWfzY2d{(TX$Astj+FmaJ&B}M0
z74276pvw4}R7CK(hPh$Nq1~ZnBHw=Bw6r7Ng<7XMY7v(q`#!RuRjH(Uf0-^@`LBEL
i(naq3wEugrT9<9d8jJQwHPqVKmcin`)OumZ00013s3J@N

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-latin-ext.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-latin-ext.woff2
deleted file mode 100644
index 82f96681c0762d98ec703df7836829d0ab44a785..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 11624
zcmV-uEtk@FPew8T0RR9104-<$6951J0CXGx04)Ci0RR9100000000000000000000
z0000Qf=e5UE*yhC24Fu^R6$gMASWIGg*q=x5eN$4WX?GYgbV;M#YzD-0we>75(FRx
zheijHRSX9klV=yu+c!eotx8J>VEK+hVB?^G4WAoDt(v6t+5i7%Bo#R-DU!Cs-nb9t
zOfFScwz{iToK6j#O;zI(Doak1Pn~zsm@b{-%$d^s>;2AXW^j>qxS|Oi?ZLB$wQVlJ
z8EPNXt6+%*!4NA@Ad+uWLLXE@4>C+IB|lPdL6%Jxj2=0-<KCh`f;hcJjk~Hak8|xX
zsQGt5N9)1=EaQv&7fP`X@M3-2tS7ETH*)(5kI>jBx&8xx>Yw{wTr8=WDg~6vS*Dao
z<=LIoSskoyAMF6Q|Ep^Lj}MR_D2lR=E=^WSsoQ?TnwdpT`mkiq%a*m)xprP@@|~dq
zk^)IUeT=c++e7?;H-?s|gp8*`jtnJ;m%#r{kd2YEPk;`ots+SZP!U-I+xYrw1YOIL
zSOMRVbJZ9U?q)W4A;+S<`s=S6W%rBbivGV1DHtOx&JYv_6wm=2U5?y^d3t0{=B4>^
z^BW+6WSE(#L4w;C_w$;(J2c%r??2wx%xE3jMuj<t&485xyptW1*7v`k>%BK%&dDnR
z2-5)W?gwmUs(})lwFLqNs9AACFxlg$z|%j2h@k7<2=KNlKC^*&_J`IV$~^&xJ%pQf
zGpPzxp`wT-;gU-lN)sdvekH+XRE#-$Q(m;&s~RtE%cgcO`^o~%1(~E^{QLr8YF;S)
z>CGoKra@uLS(c%x(u9L}l&S8(C|v19I21uXFOet^(qbJ#NdDebv;7aiN>GL}c;^6(
z51w^~Dz^YgIfl;Fx#(Q|{U5-`CUUU^#3caAph)SK;)P|p0WV?!K>|Qn15=k$SY=91
zbcneRA(XCSC_1;Tr%%&+T-1f(|Nr-EdD!S1Oe2X>4}N3BFK*E^PKERq>C-f_I+-LI
zJtab+1VTYYbcO7=g)MM8_pN{b9j4~t5VyBGFQS`;R^&0~=Z8^Bh(j)Ro|kPoIh7im
zCwO5uVi1@<KJ{A=mX7BCL0vFh5gsC<h4djtbQmB;%n?gc#F`9o;D9)BLR@$tUVIRL
z!APi3BwPd%B@RiFiYN?3R5Folg-EedM6D93R*lqZKw1n%Mi`4sG978thRik}S!fB;
zZWXe|8f2Xf$R^v6ojQ=c4kJgMKu$T2Tyz=f(uMWd6Rg+XV!ihs>#G&=U5)evfkgmw
z1kfY|5WM+Jd~P7p-3K9%lLG-nY<XdpohJ8(_Kx$$YG~sC(CY+1kqJVeOXzZXf<*Au
ztm{31$*M%tqO5fbTVS-lm8JUxATPVU150>W1seAD)Z0X$-h=8>eYUNhT~}ND0^tV+
zo5xlbSvU%qpS~*%OWPlc!oC36Pc4N11Xar8rTSpAX<>`<RbWAt_SqV)W4jAQ&e={g
z0CTEpziGBa*@%>aB(UKOAi4l_M31>B6D|~GT)X_r(_1pJle{FdzGpql=%5F8{i+S@
z3Wzj%l0n3S0rZ;Wa5|2|m*LUp^?>brvN$@IA$QctTUyB_ewQkX0dBjjyQT0Tj_n69
zUAcMUNhi-OL$=)m@DQPi1VfCmz!E8TIN*vKp7;?&1TiF&MnC$aBAY_glv6_ktqf)u
zqZ!XM+OFr*2IRO@QhIaNBv}-jkOP9MsG7GF+TrRZ&Rs53U_yqh6)-?s*S2-(Yj1Mz
zechr?>^TIAOu167fO8U_V^*CdOBqqV1XU(;)>9T8&u+P_s)fmX%#NDEO6Wo1Sx*9s
zZ@%WY>{a!NQI?gNd^|Qzs%<(5C&oyz#qMFhNX&?^h%E{c00MBa0P+LUK>!XS^yi|)
z5{F^x^L?=^t{v$tvhElLL*Myf0RdhDg7DEm3muFw!4j#gBEDoe;VzFz0&ju{BZh>b
z!X39xmpr_#GBJF^K3U)ys<goc=A0^kB*mlkc!hkJ0ih<a0!CUS@*g8{34r6Y+V|K$
z|84{9-?*HBF1$4Xm>xR;q__wXU;uh}09(xA+p<OipgxdaNqs=d^e5-Sj3yRgLJR;9
zfCVtYp*FzW0$>23TviI0FMw@(Rm$npnRO;6eA)Cxrw5>5G-+BdG9VU%dyh9@pJKYh
z9<bXhhn&64I-X;Z@^LcOQD^^lbLr6{6=8)FaW8!{GBYzfE3+e4qh^#@dOgrvf73na
zVbA%Wytdy<EQb}cHpk=LcK4@rBHf(XmN}9+meuWzK==qiBkBK&S7dvxM2VJZ{%EAv
zB=W!-u$im?Mn(IyhX*^;alFzYnj`PI(Hl*F&+7hS=G@-9^aj0t_u{Yo7o83Q{Cx;?
zT?GEW{{M~J6Q2-wj{X5dz}xe;DJc{`BfIUj-$9tnG)$LVl@ZpWSUdhZk;ZXVV5#v`
z5~-!Bo|Xn0>h#e_tckuMbhOYjn1P{mwK6rDv60M;Wo8Vi2`r5#GnK8$tW9EP3L6fl
zb23vK7qhvU%heq2=J7C}mxX*R;cc-+d@U7ZC4cP#tq^XV2ph<)7iE)JTgBKS+GZ(s
zOSVgrod!Crp92*38sHG6{rWp7-7(ot$x-a0QkRvuWV-;%^|cR2ITND<TgAu-0@XsT
z5oeoJ9SWTDzkhXkE7J)oM`buJ&l$N+%Xe0x^9UfuAbL1N;|;YDLC4F{Ae5#1sgSsI
zl;n$uH^v63nD|yYmB>K)Z%Dv94=@D)4uD28&^`=!%K_&A0Kj5W6YF|JC$qXDRx#AY
zHX#Tq*t09O2E-;<({h!tAT6U}rjohsMOnRvesC;9E9R<(xhhNDqM|~*b#=QTSb|x{
zuu4q~V@;05p-C8&u(K<s>~$@Lp4n8G5n*Y4G{LaKhsRSH1St~<D2ECmIEXk&B}Gdl
zNQ^w8WVRezm8yXS8H$k@5sAe-2c0wzYag*LrIBD#CagnGdi9qA1&9ddC{Fd>c%)jF
z>PVs#(-5t~T5F0Sc9F-j8nrOVF<2dyZAuVwQD!Pd5E{tbB(`T0EWcP8IJ(B^Gwwj?
zvBMT31UaL-cc+}cJ+HU9tMz&>C%xMu)kac|rCQlB0-+;I_mrBlaRA%fXV?G#?0)|W
z>K~eqSk;%^zq0!Lp*s?-T1P|??fF}cT#Y15FWr<Uj;!)%YWotlx>ikbQDpipTD0lF
zhSkxrGIIOXqSA#Lfx}wLB`ADPWP6Q6CzhN^iVQ;QM2?YI`(@xHboJI%SZnB@ePz5A
zD!XsJ)F6e3%s60jkfIsmL@PDbBPHkOI*NRhgIlP*TG>p&X8pEhT-9gUug~sNJRVmW
z*B%aXz^i1dK$xMh<pnAsx7wB{QM3XzGy@LZo5Moge?kE!*C)hW_u#_k{uzY0q)wN4
zG$qh4cN+i&plh5@c4U}Wqs1D6lY(NZ{1*vhQn!m=N>DA@ZmSWU$TH{Bfk)%|k0#2e
z*kxa4W!vtVZMLo~yCIjB-<sJudnUgQ1=?5JZ%#SC^!l`dcE<Dy^UyPMCKk2y)X0dD
zuu+jlM)CFRo&_!^iUq~gYOXa8Q*T&v*Wt;wC<9?U6H41Af_n7vg~4mtkKCr5R7Xl_
z?$=l*onD%_9Dj|vlI9eq#rzP=V!p}D>Aow=D!Y(><d_adnjuy0V+A9n1I0=tops)q
zxi<qbrmd-gzanX7-hFOoo=JX%C~f0Z&Un=I$F@nWgcY$lR^Me7M)k7NLsiH|jj?pe
z@TQh92!q;eNB!v-5ihGXkZ5PZHqyCFX@w$2_qCg&$@%jpr&1jbwL_9Ib;bP=#QeK)
zW^PJ$O%0NJ0>CzbS0YR$(9|KFg{nE~7MoDD!=(8nU!1JWb~bY~Qta6a+e?n1iYlo{
zo**N~(yZPCykB#8<;qQWt!JGL(43E}BN&=+2c|-(+F?;y;Xx*Zl5<QW@f?-Crd(;_
zT#N*?7gNRzim7`$&hk0Py~4ha#x0-tI$@67aafLNSGv7Oxgd2H>6Mk!udSY$$6s23
z?CPp1=T}Ti!nhrtk|V)2j0TA6nGJTj053_z_iX*_aC_ZYhntT)69o?M__^uzjXvk`
z1PX~dHEyCmC|pXQMgoH@HcizP*Ng58Bx=zEROqv8ugSd(ylj{oHX3OBOoxR5i6tOC
zp=$ueX>Bnu1oDI+ir=2nKqy%ObC2U^Q^U)L|MWHopFXX<__ThrJACpaDw4+x<vEjK
z2ajB8OXbvpM3kc=hMky!>!@CYIvYbo0i8_fhZi)J?jf7pP>4e4JJLOd4u@t-OqPxs
zDgD+!U4S-tGY<Ps1&Fm*-&-Z(TD}KuLi?oywKtRJp)P+B0C_I2<l%er>z?mu9`cKa
za;_^j=%j{O<Km^Aif2Db|GzS*A9x*kYtP}gCfpzT=i?Bewcr2$UVlJyv;D0555F#2
zq`6xY`#{{#^hn>}ZQ~HC_UW7-J&U%t3d-9*IZt^W*sI)lX}bMIU;RTC?Z90anKYPH
zB(P>BX<*re(WD>@8I~kj1VzY}xHUV78IzhYf~?|waa%0*6xYGo)7Zsm+Mi*CF}4H6
z`#uBKrHb|9W4`q7!lvS-O7WxazTGR5WN<(H)+?XhRf!BZ#0{Pye|If9YjzO_d=-$9
zeL0G+B&^faM#LX9@5g54Gp+OFqsdNyvFVqqdpgmvMA+}zu?2H3H^cY`lDqu|d7Yry
zy#vIHIB@zRd%>;h{d>1wHJ+70u81cIGN^j0sQXi)^Zt!9F7Ez!-e_g~az*Fak*4jR
zdBYX^)SV69?^YtqJ3hbj_hMv~tMhf}+v$xwLwZFfh9GbjMyduQ=RTvNk}C{NL<1~E
zNFpH%1sJm=LB|+B@W9DKP<45GxhP6~M+^@;vYfnE3b(fO_*gN^=QrcY-dOgD4NKLt
zlXELd4|SP-Y|!7&xDHLNf5#aweiV^!wkWjV$)c(Qba}zjWIg6sdz6bHIo^IOa2LjJ
z8M4JnGHe3P(JrU0e-Pc9)(W-K)EH?FCx%fnHwmKH%1|W1*o*^1=(&ugyVgG=P`216
z1Gs$AKeqPr5{cT_t~xxY<pPcEXxLhEyvi@ctc_vban(qFtlIVC)KMYhpu#YgWWs_t
z*+KE6PKxKL0pBGb9O*Ad#6~y^BNUTSrJqb33qx3vaB>hMgQ6H&E^aU=tUw!8#l#5E
z!K1@}AD)5;9{fM~U-^}M{y0?W#eL#e`s>>7!YuxC*Lv^MX$N-}mQ2m3Dsd%6@J@>4
zsrppu$vJTILS(d#ogcY4Lpdk#DF%apwV;zFNQ#B6WH*^Ts0zFl_G_wvJ*DQ3J{{Mj
zIGc37u@bG;d%MQoB!}Kw2-Ve!mJJ#Lsb_VdSMu<Dc3a>6m+K5a+CRN7`|T$s7=Yaa
zBk~2=rz#+WzlBjI>hWeGp{s4)j|X_7ZWgbN%>^QfnN)CZG+XvAB#XDYm~q<ZyK=y@
zZ}1azx8MAq*2BpeYkshT_wGhvSiHzkP<Fcnq5pRqvo=kLc6+EU$EB?t>D+a8(VmcS
z>U&u`ueNo3{89WKq-!|xb-%4P@U$MJ%eq@CwUnmq_GOck^q#gBO5bhy(gsUliM1%{
znG?Cq%Ln03#%?Eh7Vd{J!D?q59eDYm(V4)%b{%-#ZuO8SIyG@kJRZ~o-D9x2dfBiG
zaS^L4tJ_5_UZa(zE~Jn(8f-DfD*+pXZem8=oKR;1BmT^ucbsUyTj#Yqd59tSb_c~V
znAx)StCl0$p)YAN7nT^aQcCFR?N*pn*n-fA)BH<O#@guZQWvX33=f@%N19b=l<#ip
zUcSKaIHa0P<$NYZB_jby0*D^nEVQKm38Gr#$2Zf-Lnq98G_BTu$dt!|$Ps8hV>@0O
zJtsvN8x&?~gGip{?@~KNy@eO<mT%}S?shFJtSk*l<GE03R^6_qW<s2wr%J;NF+#wh
z@y<>=&BH8=e7gg3OqL;m`IkdSwyG0(U3?(5Il73qk&v<48J<x=NPgt-P4ddy2b2H>
zencdaK0m%c)~c^YE4Q`DTFp2J-V!(rMzhY_K9l8Z@^>w428kkGFnPg8TlcRzWU0R3
zm+~uGhDUW>{Lr@tlvQ+lxb+4ZWCnuibKa+(Q(TY1iQfgpkwF3ILOMw?125zioDD>j
z=*$cYS$<@qSA^3bA+#{e(~((CXsDk=h&hcxNMd6gEue56SyzyZuej5PCcIfr&XLEi
zJxNO}&qXX9Z$EU!SLKwaomq}YLCg{Z5s7iUw_srJ)WjWA*H;yc4GI=N#f~_ag27Rg
z8*s_ldA-4$KANp*W?~-fiENox+HeDcBZNbPf5aR40m}BWBpgTmy%wUg<BPiq8j6xs
zw@XkYRqs!XosVPxIm%3*%B&B$d~AcNL?OC8$#5FH-V>Y|<quc&OZ2kfxOl{KqjY1(
zq0S&sHtG|3?i~4?bMQIu$d9;iYDosc@5Bk>;&*f-Hx+ANYUZ4YsqNHjQSNlz#e4_v
z73MC?r&O#$dc<aDMqqt2soXq>J@KfzwBLKlkok<5SYJl3{l(l|`gsDzi3pNHOtIQN
zt<DUFMs$+(C|yB$`Qf^dqrz0}8uL37aFl04mm%`x{uaw!qB9R}+AY2I3|n+aAbCF>
ze!sLUkScwE3~budFQ1AXdw3b7^!Q`dZ&2ruK}qot4qYi;DP@<Hh$P)2Hdt}L&%Q<N
zm;lZ~*(E#s=VY?y?CqYxuBj)4i{a_ibeDfD=5l38io5%~^^QXpw8D@S+$xsL3Yq3Q
z!SQHVxSJ&?w?Oan?Ic*I#e$r~F0jEfWJc-X+DHF7+P+kJ<%N!Ojuy0j;x4iOow!w*
zwY=lwbfJ9VqpZR`c9C>Z>tBmgUCORruQaO9ktl}TNqC>lGg>B~(-JRs&mI-}OnP=s
z+fj~4&Oxk40qom8loZwv6)mstyp`6IcI)AXyRM<9s`&=#hR^Ub{FI$w+$89`M-5lG
zB0=|9I4~OGd{cbG51HoDPpaiF^bP2+w72mcSLr5o8glncb3I2skEEdPC2jw6wpWxu
z#{y{wD!Omdr5_$#hBepyeup1sMZ$q-xR9jREV>noCuyuS+IEemU0cR~FHZvJp!kOF
zaf^jbGX-#KoVt*jEr6IKZ~gK9(E8VJgTr>h-2<v_0nJAqUkDTmnQ^b*3zm;N^=}?|
z6*!M{NBn5C>;GkrW%hBX$pC%1Rs>BZAF)Q6!6sm4w#?LYS$1WBy5q$82UC}cj0l#E
zv$(0HCzViE|Cx<+RRd`FT$}dQL8HF{&bM(N?EC2#VI3Io5o`2krJL6qnEY;Tvfj{O
zJ&wFr+p^nE0mi!xa@f#0<zXc^9k=e+6;L^+cfG6?)$0WEj9y`{Jk4+D4Z-Ph?_PPn
z&M7<D;=h+Rv>B3%f>ZJGK)Frp^S3nZCL)rC4z!!CwejCQ{0$=m0YEef8)rJR1$0hC
zDr{VAnl<x?&RB~H9YSJ@h0b-2DArue)f_sP*(qe)#9Hk3k7g;n(lw3Pp%`YbhRf7h
zKsB-P9woniQjILxPQm-&;q_?S6BlL<m@?2U-6V?lQXI1%PN)0h!~MC3UFeJ{r*$5t
zJQvKClSF@Nul}WHbP&J8{GwmO_ZOpCl|#Rlye~LpYXiBx&YxT4!u-ZJ%FN4beZd>5
z!jqQl8tE`EvdnXI)2uJ`g?96X;pR!BdHGLY=yQFS>R!shRidGBsaXF!m9t`a;`Ll9
zsPql5nHHYcGh^~2aAkN_Fr!bxJX80v3NZXB{rS#<=_j4&GB$ink!>n^k?o1dviPOY
zr@V<*M<aV}G=!oTRozTwnShOnCw(w43iNsS_$_-!H`o)ugg(_b`ij@1N1Sw+=d>$4
ze!<D&=XUwtTTvfrk@MCa=u~Gd;X)tG3r-!neYv=nqLLIo<a6-FuecorMd#0P^D9lr
z?Y(~vZvPcO#Mj?Wy++^ahd*WaiXOgwJIV(F7y;k~Oi%Z!rE{<lr@Gfol_n3pJILAs
z#3Dq`<90MThk^m=VV+Q;?0NJ@RAcT}?o;l4?`OCI%y*rY=wT<Nz|@|k26*knAYi(f
zA@H9GyyQ&}<y7Gch+{hcJT~cbA5$M|+7;yjD<$5xl0Y{36o0t=eGkcqb5g{0b&le?
zdv{`d1m^81HGxgnD9}!Cs!nGo)Z5_ZEZxa~=atFs&Fvt9vw;MDUt%L1K@tHS<GF=N
z7Ukd(7BMeTrScoqfUCvG0*HzJze~hj76+Azj4yShDTw%MYVF)aS3Aj9I*%)8DpTdP
zb3x+Qh=4hSvZ#+T&}E>@S*aj;sC*xY;>0o=3ipp!tpTP6KI6m-M<4?P6@VPhxZ$s!
zh_Nb30gq&nFS%${6OANQmrx(}PiM6Ps<tQtg(ooMOQ@PD-$)|fJ|P}Nm_}w39f^l)
z{$FKUMtd$hWKPC-*OD!mmo8?Sm+6G|VtCWVKKb^4ZD88M1puZ405D+2ngcfjRBN<Q
zyEQi1;gTEP>j@5tNF0L%CO5^YNL^YoJYzFEYqBW^ax7<(jghIEjE=TC>1&8lCa5si
zCWkuOiEi+!wT4*{D{eyT+S0jQ+!bBdd*you5U#=%-pIrRkTBrkfFe}rT&ES9GM=gI
z&*2<PfEXEu%-Q3FEB?y@YeXD!%-KvvHZJ2ewR3n@BM%;XnsF$sa)<4hZ7jO<K9_>t
z_6d^5CMzrJTPIAPd*a_7n$fryvZ~BwD<^p>QAH|Ot(rAV?b<4<<q>4z;VZw|n{xQE
zC*R{5*Yia?+QX4nx!%*=_tal^O@k<fx(Q5p3R0HpG-gPqhl&_IUXrx4%D*Y37Ug5u
zc<J3g8O4u!^G`o`r+3$-N$uC{7Ph(*%2cV-to^Q<uh5C^M?A*kHhvQ`*;70fQ#UO$
zb5_pA**S;i?34%2bUP87i#^41u`D*lz8oL|Hf@0TZSQ>Q;b8BQMHlfI=*iR=duKlW
z0)0yVz5njScV`674%jnj{K*bt3s#ScIr5-l_FmiC+gDy;Ni%J~(kx1vL~p-?BFT|7
zdbMmiMNY$7MW76UXe2|L-H*&E`$_(~VzB=8&uGz|?W0?u^EvqO=#Cpm-ltbdVu&Gz
zVdEqYL$uGHbDJ{>zXiaaRNNoeCK*zmQJ7Rj0%aVVsRg-MoT)aH+<$0{R1n(M{SqG4
z*CkJiaMCXw!$K@(Iz}Q3ULjE6bmz~;++gT670T;Kgn@<vsp+J6y!yqAx%+)5NO@)B
zhdX}2zJfiHA$e}=F9leQz_AQ6>h1z6J&k+I_?5~A|3m*yW03$InO0$=Ac=T3PA=;h
z=?M#+|4u=($?e<OL$udR=f6Ao-T5(0(x^<3HO%-Br@qcirWspTLG%sj3Q|*!K|lIF
zc>kU&Xuk>U*)2?7(A(GwB@HY0|E413PZ^FgeYh25D`?$&zmz86qVXabDvd)S#E?DP
zCBsw^^<p6Y%k%ikr=9cEal7p>-vVYBvYi3CB%jZ2{jlBPzW2+oN|@srcLFR!gm@6v
z6U_JVvukvUFMt6hZxt9rP@HINATx5ipuRy9pHYT9-r?dRWv{@?8GNyu5pqQWgsFA2
z(BzNZ-<U9pf8Z23e|0i@`pJ<0`Qtlpy*&*%>>h72N*D-9N@%h2Wy*4C@V2{RF7lNX
z>|NILhd>Bf#+ZP+3P;wD$7^vv$i&t)G6PFun+=0W4i{NETZqjQYZ3=mK>NM}jZ~Cd
zAra-YL%<D7Ro9b)5a`+SmE{5b0~Y@Nh$0J~=dpM2NTH+l1-(Z5Tu@LMP0aPNfaY2+
zw`@tK=JAA<_4I{n*U{KizqmQ4bh1`<0#008fUSghms*x7Ks>+&i;5Gkpkvi!*`T2e
zo*l?vnG@f?gYGN_#<{Q%elxA~EFB60;OJlL{o;<{5(jQMRu<JvQ7;BUH0Gg8IQY&y
z8oN?czwBs^XCOf6G_vO;CX4JIE|ofL)6q%08%nDQ$J5p^V2Qa<__{dK=dlvxJRb2W
zD~v7shyn5t0&^PTO)EIVbZ$iqPxJ7DYTdX=KuFuQ_2TThwsKoPg_D{u$_W%}y&*)_
zGMg2l&cawV>LNsQR;%kC!%juYY`4p0Rt=Jm5V?GK({H10>|OskE!iA!Za5ccMi9HU
zkxVi_OZps{ZI=NJ;tG0Cy1U`SY#8#@h+lQ}jh2Y1yL@CTqf!K=YdX9-(3q`Kk|18E
zC}-UpD$UqUeB=L>%XPz;b9C}|T{(A{QEw!v4B^w^*zv1fqvZX#0~@v)_Yqz-GGKyN
z{_=gVJ;;2Vg<@ems!F0Wc@g}3@5B@t#)g@<e$>IOa<~lFg4BRLXLXWcwkS`*@<X*$
z_6{!B6*7V{BFke~x-ZQMwk!Z_W9BhOYtz|bHn^=~jKS%VxxTqg5%P5;&X$R&KL$kD
zUR+u~oc6to+HVD-BA1W$j;cX*w6`~T`3*mmzkKj@NACRj-DlI|1LU6&kP_ls>katu
zGxcZIb;A@EY42TpR?MEXC$J#h{zoSW5q?85-!;K8QRMMg!MiVj&W|(pV+^sSHC@<W
zY={x!?mv?=rwW1r{0n~(!u#eAEtvdg&##SDPzHe=G@GJo=K*y=M~dot#aPkvCK&o2
zVPL?UrlV=H=l;+qY($F0s1!`F0#uUK7~#e2v%>fwCj;BlY<d`QhDag>Luh2NnHmWw
zUQ)11^LVeAO7K!qj8U;82d6v%;q0ckva|_fSQjNG=raDAti{%o5^{%*Z)pcXuP<db
z4IfWRV?3wjq9Ti93St7ju*OL}oy9B{K`sPm`5>$;HB3ekQOe5?`nK(BdobdLVzL8j
zn9xG?d(M5S!Xv#Q$9HvAignlF1N(b%l8bl1!0xPBf66*qK#paj*81OqWYJ7*su%OP
zSY{2*F|DfNEUoRPK{v5;g`O7?;r2ZKZAhys2>D(+34D2b{C3+vd2&HS!U{B21}gX0
z{QF_ma1@bzAtR&|NTg1Z<r)&jQ?}xZr20TSN|7;lPYgN9C>k0sN4gNllZ~MVy+;l-
zD2J2xiSl~W40KLLX9htKXhLIp$euHV5ERjz=XWuc@J|tsNB_cQBIK+5UcB4YX0cFO
z5uqkjK2WvRxiSWXC(BrPrZBKiHLSJzSl5U(BZ)WiklnJ8<w$5QiYZxhW`RI0Ej{@Q
z{8PjS+1EIK{XN!qiu!_Uk+;7z-sFzp>n=ITJkR@%7SNNL-OzD=F_vyO*RL{eF`?}m
zOr`}QGm6ZxjiiEP6P9%KBilu<baZzVs7=oP>cweP86jCxe8Dj(H~1n7Iy5i+iNLmr
zBa;9r($U=^mExMUF=gKf5GyZ72XlBqoJ4n<I{ma=RG7^$`J%{e-$Bh;Rg??9GjJTw
zwM->W8C~RKhVTR}Cr4st9`60mmOjb9PiJw8q<)$sgUK~E$IZo`ehUnW6A%@y(dDd}
z0y&d4;mm1ow$$2BZ^uSDb0W7(`z3Z(7wLHKPt7XP<Uf~ot5!lhpICAr&kC@m`}B-U
zsl7Ll4^!{?-3H{_ztfoD1rjJ$oH<`sF8J}Eclyf5z`t<v;kML%V-E~uH<MVbmgX3^
zTwG*4c~p8Un;X}febz1Vxf8oqxp?EYU1c<~FFtV^SD6E<m#Qer>8Cn;N>dGE+ou!k
z9d@H0Ew@S8F3KD|8YivZr{8len`6Xy!=+)N7hkJrk|EB@Jom9gPMQx=GbE&@Jljl&
z@AzfJ6~}!~DOtN6i?hzHWQzKGEr+S4QmG`l(rI18osIDSJ_Wk>^obJ&EL$>w`5os~
zaaDauv)naq4~7AYO}aUg*-ZyiEHfeYa7QA8at1#pkJYKmpzlG)(_n!~h^O*8FCv*M
z&K0$Ty`2XMDsaj}slM;6cuy;trso%OMBn=HGW2}m6hm|6*BFzsxWiBy!2{>o{ARb>
zVhLX_&aNOZF>t+GJaVciZ+#~lg(gG<SeP^JF4HadVBdS9VYmTzrD9syw~X=3GOk$;
zhlqF390mvRhy=K<nh3!Qhd5wr+hYtZF&-1`3(i0Zt`0jDsd>8G+kOtRk<W!-Y3Y*u
z`N%L#%MA%rtPC@}kSSL~jdHoPf^6!dH!}@v2r)dvjk!2uZ17f^vKRZYyb2y5L(7W{
z^g5`|hFkxf(+cWCYP>&H*diD<Yy!k_B-@}N^j%JyjqIWDnu{3-&Q6sNZp8&uE}P3N
zuzZN1SP%kQA-dovI2X`~PQI+uj=PXNwCADWW?=&)-jAmfQ@<YI=+_HA_4C*78e{ID
z=GNkhvKn~%-L9F07|?$wC<96;xLBJX_sWW6D>#^zUfMQw84Eh;_)wI9ZS2(n_FLQ|
zbsgdiCE?f1ChdBj`#+VNlEwgz5|?`)q&0Gl^Xa5?POS%xi)rY6|KWF?Qrr%u7PvoO
z@C_MVSgm>od{v$<g();?@579}y}h@q7t<NyDvVVZZr>1Q{~GLmnZEaZ@cF$7+q*km
zl+I<)zh@74-!f$dz;1nV5G@TV_c~sg9VedrGC9zPXqq{=!zFT<%|>crtXzYB7lO?Y
zw#Z~Mv2%U4oCcz=0v4g>-Y03cj{8fpi==)jH$5I+4();4CNh$;<H+1cSe$zXEcGFj
zv*6wcgKKkXg&;6K;dJ9(_zmo?p-q2$HEfkqE0uC0szNruRAjx{M9blB7fXNGvrG4U
z23qss?{thG^$gmom#gJuDl7?m%*lR2Yx<1QeDD(4EYwqm5yu1)EK+p<p#3b3nqO;~
zu%KFvuW`GJISzx9Mi%3pv9@5)fy@xx8rMo(e6R0cwVPBsvk6ll!ibn*R$kb0l$@Pn
z@FJpwK+eUD_7;;V^p4dOg_!nX3htXTg=tV}fmshS{Hs6G!RelFz;Y0U&xM2cQw2&=
zo`FaF#sawo*Eg2p@b6=poe3^nBV~MzUo2;A^91kCPGYbc>nTk_g-1xI<R8bG@n&bz
zRLje;Z8>3JyM#a+vYDz`@T`q$L*wFz5(dR%I$n1DRALErfDy4Nu_0_Rfbgi>(wd#p
zsu~$D<SUGqlrcIjNq~_OALi%|U(x|>Non(rpq)N^jj0RUrpRY)@$rrpWOyYZ*^p#O
z|H%4MY$uPuWApN1n^^0vlo-*&-0_#<dAn3UTmQV}-de45f92D1n6v(e&hW(m$d{J9
zDxKC>`Y@bAePGzzg~1A2?b~4vGWQ_kT}XKlV+=V<1yQ%*X)0+cgu7q|jMRQsBJmAE
z!H_DPNEW5T2s<+6xQ}LsF|ZtHeN$6~uMACXx>(vQAvH}b*DD$u2-5w^Rc34~nZ6Iq
z&=XBCUI#UyU=HZKUI7IK?5F|rT-!5JiprsVj2V@T#i*#G&=dOp2f#@!5isXIyo*D#
zgvPUV%d@N-Aa2v<ShlA^<*xecaZ?aQFr6nd?l9vcvb(Hb>nn`yf$q;epA7xRN{Q{1
z0`rNz@B?<^AD11)>u|yXnk<NClE>%(3C55RQ65TJV_&~Y$#$v*y`Iinh<No8d^-Su
z_|sJO{LAM%+^bcYpsN4?@KxpGH`N>7DOv6ZKgwQUVbP%p2B-kvAWj>q1#c&vJwl`5
zOr{zZ_Kp}iZF^BJ4(mIzsiRR))b*;FEVuzK4mo8j7@)d6+>t2P5iQ;kH^c$AXImHC
zUc<U{L<>bnmF*aSZU&p((JEpBahfc)VU=1g0jX$OWxZlytp#0^s$0yb+PSvbhS2Wt
z%VJVF<ZM{=RFDG8g!-Tjhnn3F01I#h1;j!}?KGEZ*AE!3@D%pKZ8XPAw-=!Wra=cc
zjk~EnHHk+R=0MAo)2OPU>3lj|Sp3QnP&N{Aq~c_YH;%yobiKl&EFply8PYCD%rZDZ
zhIV`lvO?luki#Wr1i4J2G05W-iAQMj3%$o7Kr;jihmIo1g{D729t6Gw`OwiF)PRp|
zK}~oW7Sw{9)Sxy37>IqqiGDZ5hyY48s^qJdpi#a`YK0ONYZR$oKDBBMQq-tcV>{MW
zj8={Py^(4T?SP`$wzT|4k)l`;wI)^8pcG3Jv9dcwy@O2INMVquK9DQZ*y4m=t3eQV
zp%^MuPdyMDQ_;<P)hbo2nYb@Yxl0o(*{$-<hyy!f{gPWfB<01;&&`wP@GfZ`MOr#Q
z3{K_9`8Hv<Yg^AKM)|R|2CEMYbyfBdy;A)LP+Wz}y$bckaJgcILvs<D0!%_jtQtE6
zJ6B5G+uNkzE*HjiDtCrv-TfVK#Asf!-t%|?$p7b4HUL`}B1kN8h>N!1LFO+<Xjs{^
zb`ELB^?W(;ZAgeDa#e*|O>1VvU{<$k*fkw4Po^L9%<=_tb@B>|O3FRtRKKdG-k{OX
z{dU*V)@j()(>G`|G_uQXd+fEZ-TNJI5Gv$wheV+SBB{`mJ);y&rO_F!kXmd#pfolI
zTRfM?7YIcqiu;-F(*ht=5=Ocw7sCmXDpfP3S&kQaT;C|k<cgG~O0Chhve<x5Z)o7y
z)Ba3mOM_OM-I3~4QdUt_Q!nEJ06}Ga5GV|eDEsfZIcQ80r(&0IctYz$Qe$Kal}2YU
zS!@oM#}^1iVu@5H*VNMPzq;zwp{u8FU}$7)Vrph?apL4D3MVhF_G<yl818uh&0Jsm
z2DJA3*3Liz*YDGs<ZmKK{O>7DgH-!7L4Nc_Khcsm3ONo*?#KcSR{B7XA-qlo0wE_*
zrh&yES+$tbf@2RKh4_*N8j4(OXffqkniO|ch0vqmv0HkLOVgSv(Eusv9^jmE#SJHk
zt6uF7nPGakc_NmJu=HfrVO6bezcxF=V(s~Q*M--nVErs3=5*6K$I|!kE~@)hTG^l|
zcq(k<0n6gvqrqs7na%9$>KBJv$uF8w%$Iiv@VJA>fD4pB7I>L_B?w+kC6cD7?y%_U
zdQ^?=uTaA?{`TT8EQ#S6SSci%__dNl$Plh`C8Slh7^ySV<*u}HBIojjc^zJcm7Yqe
zt;kb{)m$B3_o0mS3V}9y`yBLYU0rzR>A9Zk-F=+nbGG+jRXO{NpD+^t|Mc=TO-8Sq
z9Bf%$C-;&xbMi?f_+=bJ+qXH}QoYok)xAcpk?V7Yxq6O>V}-#P{nW?pOHZ=5a=BQ<
z#nFlYa6=?;z=0b);CaHIxsT_G{ykR)A6Ia+;s^iSpQh%SJX#<zs(CvTcWK5gma;Ol
z^;_i_FYuY!cP={@@z|nBk1x#OiIvoPw>`1ie@~{Y!y>0RJ00)nm@L2l^Qa=>l2hHE
zGP9K&!{2V*=TEjNVT{@FQ?1X}+LTN(C{ac~z{qdhj9<B}%Yhi%GMu(-b#WDe5gDOw
m?{bja*lz9$L||#P{*E<Hca+rmHbx(0!!qf4^xqxsz#9O|I!ZzS

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-latin.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-latin.woff2
deleted file mode 100644
index 4d09cda4a4c3f4c08ae253dd8a9c5133a89b31b7..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 31432
zcmV)AK*YayPew8T0RR910D8y(6951J0W!b<0D4*g0RR9100000000000000000000
z0000QfjAq78XSR|at2^OQ&d4zfgmRy0EHqiOc4kQf!sKOtS$?N7634ToL&Jo0we>B
z8U!E(heijZ3=9WbP!@4Q(d&)~x|7`bT&-&Hs*sy!%I%P-;oo1;Y=qU7#TGc(|No!1
zbc}(6-Unc&W>x(<LCxHhNcX}*-$<`+`{o&?u|(3vM$x*-LJU$I)0E@1q#y+;NaF$n
zwTs%sJ$e-zg5rP~kLndva~@l1wC7Go#mM4;Zp8LPSXd!K>v|6ijW{&ED~YM3;NqM5
zD<4T=wzMtYPh95^;}_`JX3AL0=NBm|MNs~INH-XEao=Y_!%kt?!D?ulQ*qD)i|;=0
zMyAsL)zobjez|7GMeZu8at$|Jo3^}sqW#2F7lDn-7+EK2-y_J)W;gi_;R_)kVhkb1
z@EBtRjEDgvMvOGZh?u5`h<qZSh?F7%Qp89RKfYSzD<bvqqZ~e^mLf%qNRe_DsUk&0
zjv}Q<DMA8I|7(5Tss{~J-JiP`7>4a~06@o%&8UDS7oz}`%!%COc>2GbR=-fClBJSu
z$%zAY6Al2JX6Z=RIUM)hBUiG^w<B<7UU~>KKuLGI!99r^Op>gURXk6BZ=U=9c!Uy=
z(kU7ZShUpfU<4|*4i;_&W3j4#ci)e0^#z!WFkf7+C^}$IN-at)+PhLr)>vf-kRUJe
zNJ3G!+YeIc%#aM)S>=F-{(CK_-vEs{rBDja+e4WX+tW#o>^Lo?1ppNQS_FPR@#}TI
zziSz0_DII?^dF%DESi_(f^0po^f1JZ)L5<D0tLDH40Qmz<|lyv|HPW>BNal$OQ+^H
zlbOHRZR(~&+NBbGYi`?s4bhza4?Q?Y>p*FdKuAcC05RLFWRs1P$tFP-k|2Q+AXtS8
z{41qSdsV0yv^}9>Q1dgRe)QgbPRyv{?pp>yapXY|Lk20<|Ns2uPHPkWedDd0E21dS
zEXBYR??=1$Wlh@c_(6B04mE~F(@J7qo%VKH1In>wkS)s~$8lOtO8+iLFnyS4nEx`=
z)xn=eeEXk)pmbEg98u<-t1n&b%wj3wLZE5Wv_so|#^=|VJ4ud&MB(n8Fr)zGmj{YS
zo&M+hGqrtV0g^b%Rg=>Dnq|mKIy5{Sx_w`UI0-@5M5)^e@OHmxB_=0k-L+R#*ZNRy
z*3dfbZrCjqD#nS}>v6y5rMdIR^ZsI9Q7olsLNYVSL?$LcyF|d>n`)K*hX$#psM`Xh
zHQ-wCEHrZlvl}GN`25W8?hkbLZ-8htK&lB+5&%-GCM4Z7KuQ8QGgpM;03f+ba-7C_
zj`s~v1{@2y9iFi+8*|=f>ngt>obbZS!mHf7AV@C>uP#W>|1z~qyZ>}+-=NuY=Xiy^
zl{MkT4)Q+rLG~Ndvj8!J<tMty#d)6fq3kTqaS0iaD-Su#O#-=8Nv0@}-?vn0@5qcu
zexcxUGpn(0cXdi@egBNhsXU&9nTHT309F_PD*-SB1pfcM`QG`mR4zW_csr8<NhrYZ
zLl6c-NHO@grb+d#YOe=|VIKu4%6PQ)PiZ`e^#cF4)6FJ{^)UC}fFcbv+Ld$g{aHj_
z6+f5XhZ51oh-jm&wa4|F?E9B<hOPkm-fM@8v`Z>hf`nn3h7f`*LAJl2@9+0jeG`z<
zF8ibnC0L4riq7og{kOwd>-#~onxnVvHn%xtN=itAh)4*?IPUrX|I5v&BK`sv#n$HG
z#1r)D071aYm)!F(HV{<$=?I5YMC5ek=Tz9_R8lzu1v=G&ojN+FUbr(_j5AiE^N>T%
z!&2qH+liQUAlaV=1c^jZI1ivWXDUi_WT31gfdH^~G9cGOz)U5%bQT~wKrS47;&k{V
z@XTMO1?ES4ljDF15dgT%_@9PhpaOvg5hSl)7tR|e1J-9Sh;FP196bU6ego_ICy%#^
zpTYiQKZ@mRkrXVJ30N({{PNXjRd$Rhd7fcUDf&zV5df|+5r5|;aPZ}Zi~xG7;WfR0
z@q6&GqcP&S;`lj%TGXtYx(cB0j^_n{;0sx$0g@<y%kIHqL4*@ekf#%vEB(-SHvnnL
z(<Cbd3{hT3gykXbYIu3pwql)#k5-5ogjVqe9RMpT5rOy9f%_HlnI|*@3@Gw_Sj8<)
z0~m|8Q=q39Dzlu)6fzqaU&f!=%&3{|jE>PWVaz^86(ZB4FaZde5Dc0XA!{R40Q^A?
zvUY!Ae*g*7s}k^GcZ~q-F#?-_M-ry&?^~|)Sak5>Bz+2pehg(^zOH;iXqwyn@5vRO
z`f9o0IQzMk3l<$}^XG;DDPV};>{y%t?VkMR-q>W2&+R*y0A3#x|MwTq0+M;NFBV)C
zfomlO%mIkgv4nRL01VH+^+JLM6HC@?*s`;jBOboxL|nO(SYxeqeE8W!X{&A2cGzhb
zoe-hIM2L34K?x2yELFM;nX=_L!64shXPj58%te<}t5v7oRoC3qq}d(c`9Yg@4|VF&
z?WsQfe)rNVe;6@p+=RbO`^TJx0CI?oXo!KB$P!s2HsT<Av;=Vx5Al%z36TqOLt-RB
zQsjZWkPLYvA0$V9NP+y35(OX?3Pft8L0S}qf{_mCQ3wh}VW@yDTZ`?8?NeKyt-}^<
zv&r3IZMGf}=5Gy9er)Nrq+6;jGtIx7QF9h`hiazkD2M4|Q?IGr6lAiH-EJH<J~H|n
z<?I*PM&2Y3lSzhu4GRp_#LvX1L|?LVh($y_{wMymxM95&UyLW>Ph+##T5KsCj>+g`
zODK)XQGx!Pey{#n<a6&{?{I|P6S^Dgs$>OqO6`ZTHkr4!@JC#8O>+uvSmPS5`iy$J
zdXj2X*_*g3Tt%}irBV5<N1n1-F`@W$P2U=g0!Ib%=jGdFf6Knz<EztU&5iXvBAJzb
zD9M+$OCGIikys>!;v3=y{j=gc@m%t7@fLLp!@_<g3{ykFkUa3*S?=V%sLy$f_bfN8
zEFa~Ax~XpX6Yo@=4|pV8muuwfpmshh#@qfjuT5#KRuG$+ro1U^vKuSm(|X2M*j&pN
z%+`5z%1D}F^T@Hw_#0`K9@5=9M5`{B>R0zIm0ktPG5Jh}Nv$j-R8!Xl%VMjL#f{}M
zN@F=$=9g)ukjpIY74?OtP!t}HJ$ZAk%w+?Quf>v4(IwJF+%UzBeEiN~p3Y;g6|gxr
zYCV`Kjs(3=8#t<uz3ZAja*xzIWOl+X+>C3@VveJ21G?DDLK0gJy9%C%xsW|=W;1J(
zZX_^Zecvuv&!DmVFK2DudSfk)sPSOe+G()V@_JjoncK=Nxfa*0XfxLoP+~s#?s})2
zhndrvldsHI7}LUR=Bl|2mpx;C*YCpZ!{9G!Jc~}nA`$)BYFUAFG3~`{n@O}_8ksuY
zWu4hVDwA^Ws5*Qod~(ld9uZ^}X|4t<futb;@y`q(%zD;$T<Ail6TAo_f&(6W?emw=
zLBmD|LF5zyrH;WcA#*ZVf0SWo0D=2CgwE}%LY8hH6v!hOK04bYSP<@OH=vIJDUQ2f
zA7lZ;e572MD|N{R$dDLPZ!ZNifqA{&hq85CIr?0=I-xxCHV5Djw1P+Q{R>mR4p@x_
z^d4aFpalSVq6O#6Z(+M&n`?)#ptkGsUpxUNq9k+(C8NVA#mk<EBnc+MgkT$V_tX6j
zV9-Vx*l)9fw-w@G$Uqy~mVi=#lE?PmFf6WV5Q<9NZUo*;9;ZT({c)z)^TbSL`W*Nn
zCuMz!D#va=65PBwVlvDOZXuk!=@W}6zhF<_Jboww@Pe3_NuCAiZ_lRzY;IvdsOI&e
z3AcUa^7Nlbgi!IqXEA-#yovC_9nVeldO4qd(jJhGZ0C4Bn9z6i034osY8nvcQ@F(m
zn42gKFMkid3S@nqoaB$2HDd1WMvn9<=5c<+Ft1`xm%DSR(a!0ScgJjY`Mtnf1zrf%
z>Mq@DUKWM@rTXd1P~~!|BsJOsJ^E6fjeRl585QKN(dk9Ziu~1C`=XM_)e+Zdd2-y<
zzVeyjQ6=A9OF@daGadc2CUkC|Poss?KqK=!rfr)uZ$zy_-8gnl1+KP6kDfVXX<rU-
z4%1k7-CjS-)>o%gm}fCn%C(u)Hm#Q)cWp#$|KVRzfkRO|QF4#OJi%n(G+f*~>14tJ
zzZmhAnH{*<N=ypeD3cyx(&a~S_K}K_kv=tAogOz*WoDlre#u7jio)W74zn5NK{+;#
zV-u0b6UzT~5sSB<vXlvTsP5tr-NSgs$JuwA2V_`$OCqxL>e0Rd<BAdSp`(BzI=NVE
z%HYLdH#I1dni|t?JtXR4^HKgUqZB+5fSm1%NEY2JcA6b@-c4?IaMhuw11{|H)F43M
z2}y_QrBUcfm<J?H1uh;9Pz>&JE?rHrvb!z@W&+oX3r<AlGCkTUVaWlC!R3y_Xh6yL
ztTqEUP1wh^%``?1a~EqIuo&#xr%B0v>QGz<4LEC{PKt{T$25he15NHzqoi69iC*Xl
zlc-7p;i7T|m;+@v%ccf}$XlXmKsqr~u8rCNIob?~bqp{E@^WNF74jBOU@8zxaKg1s
zOO)gAg;?i+bHMgKR*2P9AP)fMJHw|!at|}!SeOE6*vD|uzeFTV)srx4L|>!e5AYr^
z?(}sMNSoK?MgSe6^Bs|)S&r7}u+{<I19}`}5<!AJ#2ErK2<TngOv~jkl~~(=?*XBG
zU>5cefQOOIIn_cS+-=6IdIJFde%9k&MD3%o(!W0`yYHSO)0(V5r7<dnNa0c@rQi^s
z%$pPuSCX+r<jMprG)?{Z#V8=wl!9L}z=(#B;jW5k#FcS>m19QikDk6tzDmyf&$x1B
z24$evA&b&uzs?Oa#YW}%Vc2d|jto7i(I)H4(25eo4HBvpuD2*witoMAt`t}NxNEc)
za<m_)kPTbIgtS$#*T+h(RiFhfH)5~V`2rf`az!)Vr<nnJWo+pYicEWXRQR~AeYq6(
z)~GgV>_cDX_Eh9?+12mKj7OicxhHg)u0tI$<|H!rLAtU>McU12o2K0GKa)X{P=RDn
zLp<$F?!RyACG{@U;?m8$dtbw)-5g&k?{G}7dNJ)&#wp<465Zdz0Z<Q4a#4Y+>C!pg
zP4=R0wkf)LfHhq3?)&Tx&e@(6ABS_}WaXmKjCaqB#Rb^+{;rLPG)?G9*h@t>omk$0
zMobO;jfW_S3@+xB8(tAom~nywHozE6N&D+L=Rpk}szSfiderfm)`brXI7{lU>n1KK
zT$sW7yqg%L<iZe)A7_m!&phU_<1i8FjIYe6){Q*{I$$+6!+rN`JX=&M3a-tK8AUbL
zI$&c=g-zYQyEq0Bkv2v8H`p0Q1+L|t052gn$Erj&VW~hlrjfh})BqJS^_cM+naQ!z
z&o%-?q*Z{<@rI=idrk9)fxBpXWj#oRf~oMl?$kiR$7(Zv-E0`zlG(Zj5vk49IbNSt
zmxV`hhxPObLHv1KHXf#J^g^T@ht9U4Ax~*tVQcM`IK!6hv<@#?VOXv?nqfG(nb)J&
z)TYq7Vx2Y(u!Ys5evnYT31JLGpm$bCNJd#R-VTywws5{+U!=={x+XeZrGK9A1QR@!
zyyQgiM=@tlX);3$&;~BGdb-UzXkqRjFaV)$VA=-3x!D=zh}fe5iv}^;eMtgWKF&2b
zv`yzkORb;jaL#ZBasPZimv%3%(ZuM8?<csoM{@~UT@xIxk)wiDfeaU$aMa2jE~G{-
zR)z70(@lfJQF3I=tjKiO&<fHyuAjM6fKqgiCF40&0*34ADmubO>gz&t1U>(%I%83X
zdVCzWM$iM}kW}DmJ9V`V^q`e`?cyRpm$6dq06M_>Ds--^sWg{$NeAq-nL~%L#SE&p
zZd6ow#dIwtxj&dpbFSdH4iuplDWdZo#r~LW#`{LI4>iCRU!lmP9#P?gz8M|ySwcmq
zqQ2LuBHG2O4&L9XY}%34`7mC^*&U@5@3>eswNfd?Gt_~@_XZH5dnStI3Pqp<rGf&A
zt+5r1m*XZtcX1}4AtH4KonzUqE(_UG1)~r;ExVDeKLZoDmMxu}o=oq7QI-V>M;pZr
zFrwq|6rR?#eM6?gS^90z&%jMHt5V#U&DaZe+ubAAPZveY2O9CYh`X0m&7PQiNK`JV
zx;E8TS6K=3bG(>xczU!DpsMpxd>9WX9CtMVn1%@-62p#*FsiEPE_nx?Z##_+R*mB_
z^#C4pBjOy^5Iy)8ix@a+uj}c-tSo{Yj<$sxFpI8U+QG%HOQuUyiL_nnn7hh*5L|_e
z45k9jU>Gf>qEOR&8F~}2-uAr`igYlmre-U)NV+<3c60y<T8_9hDinXKh%Gl$OGGg>
z)->arNi&6JK%CEFMW*JF&ard#_wqzEc)^1^Qy%!j^k5SG_{Lzh0q-!t=>Z1V>nE}3
zrc$&ok^iP2CaTwnd+;avOf-&h69J=;hLMPDr23<F9+!cFFqjn)fr`adk^Ya~AqQRz
z(3td8Gd|#(w+JlQLq;ZGq>hW<S#ERg@Jr;cW`Ne7RrKHu{CQYO+(ZDBpRrs=JwSn2
zi$r9Qp(_^h{%sK9Sg=+w#yf--7#FV<`(@xI!x#+$BaCnZI?8940G{5tQQ7y@`5p|R
zy9$*ZHxVdjL?t95mm_+d3T>UDZ-8?s8=RR`gYjbBH7{TWQ5wW_rnYI*bj92Q_Srk2
zcPy?NN~NRc=>=TBr`hHOO8zEIFcEdAS>w>uhAmN7sJd#OSB!(1FIl_*ez|yr01d$D
zebH>5qo`%LBKL|Sc8vZgkpZk;QxFj>u8Q;<+L<gg4A3)ahs=24WBvyrVh<Ua1cz#i
z6$u-#FUWu()(Xq<a~~fAmgW8+Nn7T<5};qvMtI(8dcm(VT+v{USFn@(kFtJ%J}hP{
z;=KT%C%wYna?CHVWF}j{PMt|HQ`Z>v2opv;+U{egiS^V{yv9OZ<CH5sL6h#4y?KH<
zQxr8LLzQryoTbt>R9EDv{4t3LUNTb>$5M;Oitbs2eXN*gn3nXw7=<Ykk<El2&7|GB
z&AkGj%gr99kv)^%=)uph2AGPT6!zee*pv>(?JNLO6qr<=T)PrHG!aw;sV3C%QO2&?
z@j2LQ@fBkGl%hkEm4l;U^pn(6Vmu8rKS59PWMwL2(nC}Pp+a?72E--!7bJ9p!%6f2
zb*{&u<^i-paG+|7HceNtkLZf6W#hSYHMBoFVLIqX)DF-Rhi0gCv!>QmkA_SuG@TLD
zRgsVZP_wLz?jflWD10=kZvwm2nwVdZA!ZDPs$;kkiY48LNryViN+<~Qy_g7xr|_JR
zTy)E=1f!O4-X#Js4O6nl#K{H3s$DkTRNJf-Tkwe;W$+RYn*?bI&r}qE?m-VA&2dE<
z-4)%@j4vY0U8H)p6dFaQG=K^pTgcyvIsE)(6m%{VQu^(r1@;Zyh7JU&H;`_NmL(i#
zX>KFwdK1Zp08?^LPr@W2n|S5YqsqtP>jO!qBU1V=RJ$iU^Is(TO=4kFP={Kz2gJJd
z)>S-tVXeW3%XuSVvbZYJw@{iK&oMxaqI}Hwc*NX7+`}F+GR60)FzZ5N)Q#uf6FJ>@
zfBEP=zWxeu`ma$ef&YUw_;9J%Ic92r8X&bknm7MJG{)@lK_Kd9xFYwWN9@$vMZt%5
zWr?WF<vRKX)u7Ln<{LyQl6$01-$v+4E`STGZvL_Ia7k2gMWy>B$X-!ak|<oG#j=v{
zBZVV#iO#~oy4}#;TwWC04~^zB?5Ye^iO6<Q^KdpShwMrIx}a0MRxDv`TMWv+X&fbe
zjeSKhA2&#;M)qZg@dMY?U|@)`7b`OLb2`UHbcgr$gSZ?27YezOg;Db+^bQhzJI}Vy
zo~p2qmHV5x7l2ChR|1#s%S{D(1H*NH+YW4W>LeA>Pq|C1B6zZDhmDpBv$|YE25!~K
zJzoM;j=jmgw=!R$2WHQ5%ESK7Bw(@~m%W`qbl~FISe8er7^MAH_FDqTF2jD-P94aG
zNnc{m?ETgQY~t}lIbge=k*!J=yS^gIT>~mSTSZt}q1Kwhyra-v%Z$|?T6!SCr<3$0
zL=A);+;7`=Fey|iay6ox4o^_YX726i?Qy>;0dAMbuy{l!+^BOLrMlb7G<ON;F-N56
z<4l}M7a+Py99zUvk%&79*kE%35p{+Yh)Ab1Iu9(-_wujN=>V7werXrjaAD-rI~t&K
z5dQwO&YZ<*5fetV+Ro*I7hUnor*S4DPE`)&Q6cy<k5Wt_PKAQPI~tWp+i=!s+){NF
zDegYMs1XeP#yb1wQkO?(@SHwP<~dXV9snBZcmjPP+#}(b>S?|JR|@r7>`?;_b-qOf
zzVI+|Q2C2710*}xiz`Ns>giO;?x`MkR79tQ)rIj#+2&M<=I8ZC%|s+Lrpzal995J7
zcS-el3)CptSSnB+m{-pFG(abX@y+<G)#L%CO4h*rhhGD1bj0K$MpYc@9A^e~9F@SJ
zcg2!?f?fa+mz`{aK)IkbKn$1pHJ@*{3iqFJ2QVc#q6+V24sHN@8Oi8%;ilaVylE}P
z4HvM;rJZyf)WN5B%yGaZN$b|gY!Wu`@<;&uv>H91=FMAvzkYElnw+h4?W#;yEe?_$
zs;4ZFJda9D77o;caue;5MWh3H$Hh>`YO#&bNt$bebgH&6{^bE^xVVR3yG9o*x@0i#
zaA6T010L{UjyZ;Tjf6>w$n*1hbQp$n9<}<gdN2=miGw;CFV)?I4s#T9>1I5ew$`EM
zUo$%AYu5N#YA-EOe>CpEWuVzOc=t1AeJrku^cm1-p0zSSX@Yvq_*sMb6tgn+kdbMY
zM}=8k<F(_kwmI@lBZ20KxsI61F-h5!iFV?yk%)%U%n?&?e$E8U9=$L`Xk^ZxY=xfK
znz)9z3xzMFbM0sy*V4^CF&Db9mXZPQAUyv)n;ef7|9qJ3>%ergAT4*Z;pk(SdDFYb
z0yb^RyYVZNS>1R*;?seKrJAlt%!tlRb~=opBy3tBi*?BuCCbKpGd}4viO3Xep|q-Y
z(@3cBF6H{7!{=PU{3xY-`THoz!SJdrZZB1R$3@!LPqY;6xwzif3D1fYFB_U>eBx^2
zke1C74kA*Tr*oW;wTQ)kKaJ{GBUQOIGR0#3h3}?KEK;F#L)0y(_((Zt@0mHJ>T1{8
zQbf+$WEko|J77buD=cDkl+7?PrL|lcn-OPg(4#y3o1stZr2JuN{Z42lq)4n8bH_q}
zqGWBX8Q+14g!xE2&Lq@6ZnW#9pS7RHUgx;&(4zYiZN5Z-H$!L!X03r0Xdl)>&?fU_
zRiyp0rX)N~LbMVJpRGwGc&en?hbAYt5=NvZL2o6rj$HI!=A|2cYuNyR#{J&NBUXU+
zqPvO6bUvT<N>^^i`&6?R_0)bC$#5c4J*X$)(3=`3Rx_Xxbw$7IORHj!;-hSJ&RFaj
zTbS`~%<fU)`(>H?sG&7V^Z8|-+b##yUJz`ocs$t^=@YcIxn?pzdTGy^@ztF97}W@S
z$jDUnQejqy{pt=o{~Lu=QGzLX5nv@~E94#kcB5<sXMX{D8hkuY2kiS7-2_4%yA^xI
zVPWWNqSqLfUf!q>J#BmAf^B`ycbNE)0aQeXf`VWMkHiG6l!Nb%a@j2-T&%#%Y6mc(
zJnNKLXcfoHl+~)Z>ts-aZ3vH(?$)zguP9NyxN}iDzC#mEup(H|b~F`e0!8OD+L`0V
zz&#)x(TYmL>NUxs&zeuSkA%-`huARi9jU9-+|-8%^=#Ctd%<e$QtN*K07bfJf+|oT
z8px{G0DUC&xEZfX6No}SQz>fu#$D%FdFq&#^jPncsFcVX9n`dwQBt8!^U^m}9lv!q
zSlaNbLw*06#vP}xk89Ql-(CSh&ck8VERBiN^n-`8!IF}CG;ETVpF<LX-<Rv)WP{lt
zUA?%N$VKdg96<r78j!P{&}oZQWzBeI%ob!5!Q&xCrfh&3ciQjoBbtmfqxBp346^)p
zAXlbL@<+u434LP3kpE^myJs_6259rF9GV%AkMTz)y$5$f)V>?8K19GCOLg&!>WiNl
zK8m)b^2-UY=z9gVj}$0%@M4#?(ncx$&G@vzY=o!s6l$3wlbfN!E1idR+yK9g3$C5T
zHDnKbQ4C~vlS~ifQgoQvaOE4Y0nWf4vNmo~sW7X{pACV9U=1~RjA7ZyG(hW7XuJ~|
zZ#Xt{Kcx-`HF-?#D0@01i-y4IgWsfbv*(~K4h6}O_jx2nwxVU%bykCnaO&J;p!f{8
zQX{sqxGItt^4J_37$8r{gU$F@W;_sc*+WLAm`sIP9sYLI!Rg?as=zhd9KAF^Qe?wE
z3e0Lm786FaI!9z@{_W7mRIo+|@~jbVvbieKDr8AHlrunL$wJKdU@$8YQrJUArVvhr
zS=}lZHB0_BG9b9R0OW>r!utv1hCn^z2Z{<mE51_^8u(G~@2RWFKU-rs?a+%}6wk;V
z#Y)|MqYQCE1j2_nZzx=}%BC8Z(#y6Znr@oEqxoa?8hO^Nu{^aWE!M<V%<QIh#d9n9
z+nNTaUagw<X`E!Vbd6VNu!e+XQlWhcA6g+vegalxgr!TJuo015gfe5I7u;?>EdCEC
zW+&7I5+HHdawNF}a^6g+6snh6;|!f<L}x47Lo!Ppx_wBQlC)bCK1Olq@#c~!eWMIL
z??ggQh}mAa#tE8mT9}9ljL^^xj9JxOVFK%@7yP!$ti0i*0xd&iHmVhfyBX$c&dZ!x
z3K?OBkH{pwRG9TWtV;UQ$>8>@Z1*u7csiMvQdAVtk}~Aj9OD2<;yG$zV}$6LFrtTT
z6)#x)a}IAJkB#-^1}AckPxc7dJFA!4zdEY#y12Q?;=50MDb}jZX$x`Si@aX7991D&
zmKxJSJ<MQJ+`pnS@c&S$a#p$s>X9;5Cvg$PhUa+<h7GxXp48&nQdM@IupRqe=bTd6
zVjXwN!_FNDehns3>IjEOHnwGP;UIJ;nZ$w%9(7yG!U`h|k?GS#u!{$%fUq12vVx9#
zB*qF%GNWJE*Mm14yg|k9rB%wH>iNE@Y|4o1=SZNV;9kPs%1@Jv#yn|L>1L`MS8W1W
zT&oJKIHe==nYw@dy)fp68@Ou>r|hXJiS_fPmpXc_90CSxNG#9cqav9>>L5WZRz+e|
zm+Eau<T4~Jno0W1co7*ogvE}GOafGdA-ng3HHK}u{6JT5(*>eJ7@0c=5GDRafxFbg
zkil8@@DZ8Fq{bJ^{0$^G{_8za67l`XdCv(KD`{$LbLHjGs<CE-5_J(ksKm;8HK@wd
zlTil+mYRJ-c5`|8$21^nFe-!u;MFJ4Zk_)<dIcnr17Lv0m)B;3NQhBV`JV+$1HgS|
z|2>5A?gfN@<jMu~?Qa3VM{qv?TqIClRex*pzvIK7L`Eee0Qi?hl*s&>qiD&wa%iV5
zH14thDBu?C1P&r9?7-gx?go?)xacXq#Vw6TQT*JVkB)$*qv%&~h-sqe74`x$(MdlO
zfIV8U9u$M~$~nlz_YkftVRaI<fd3&x`f&wjth81J6T)Z}+JWyyd-TVE5rIgc5uCUz
zu07Y0%i{{TtGP0+;^69j-m)|M&mFMh*%(cx0cLQC$yA(Pq3H&KBTzrjn#<ujye<iM
zE&Zcnf06<K6S7AF<9`3CtkNQTQNTF!c@_W|Tpx@Xd^vbzP%#+r^3RtkFAu+X`(haV
z4FbRifX)yAKwt4iLFX<f`b_7+zc0OW#!V&Ohm7cO%U8-3oAZTg`AQWy9RMQ}d>I-b
z=q$nvb69M!*>bRiqoufbL|nOXx02Wz9z1!GsZ^#aM7W$pSZ5;ze@fc~`iR;tyXkyP
zFGPeW(PG3pD9Ito4oh_@)=&`)lg|3vKc>xwg%~ISnZc(TLV%huQ3|p^2y&fB5+b2R
za3M$Fb7`(IIO&x0$Y6+2Awhu#18Wv6Sy_z3jy)#J2sq&rayD-{sZ}IaTg$}(8+cpK
zmk&8Vo2YCNV5=Y+J7{h8i7<PF3b)sSeG<iqmmo!?BUad-{pcWE^&fTWed7uQfCUVK
zg$TW`P$8bazSs%~<U<!K5J~8U!4i>sX&6<A5~ZQ~tK|PyBN|$Lu!Qx4!a0Cr3$S7o
zfV2mI@D;Gk#s7ba(!N~~ud-9f*BHu_oZinp<ZC;czGcV>igQR~1Aee<&a&V26Nb<R
zd?#7S*UnZ#Phg3n#FIpJKrVPAs}o+*<imt2w(~^a`j;I7Cy89#w;}U&?oOoqm>ZhG
zu3gl+<i1G0MHo4!g^6F6wQy{Iq0=#=ahyRLX%yK#GmHQmAcuTF(Ta*CZDwA)5mPt?
zu3?o-%=$No5%%M6LpG~q8)R!Y^Cmm6W4Ftk#H^*HNV=(F)eai$2_@MZf?M-<Y<peL
z>%DHv<jRKjP9+?6Dj>He=+Rn29y@b)c9xTDB&tg)DOs^!Z1PUWc2T{hA1l@r%HZ0t
zU|B^r7Fv~GGnl??&WDFYXg4-k1qy+^r_Dng^Y>DHg+(v&CB;jfV^UvbE9F)`YB6E2
z8r8%-^z@?gdVc7)+-()>xQc0fMl^1Hr`aXCJisH6mJNtB>qaI%bf?^PS9<6@-kOwZ
zLh_cjn9t`^wOzl%&6YZWGI@OUBbJ|8@x}#FsS{W5of9$oDiz7#hDw-dW41<32-5IH
zO!_J>B2LD@DSjKcAbKX87!@q+aCKB>42&7moTq->XBz!+yT18jd>?)p#B|PxfxtNq
zXq4?|f`17K!j*lGuj3LH#E1%DF3n7T)M3dZA&}%iE+4%oM^Hd-g5~&`&HqjBDmI%P
z7nIIe803c8{EeJ+`KiNJ&es{)2-=;pWSnP3Mtb%YTfB4ias-5@asmM-wjsS3b)w4-
z*dsrcMIr2xqTGbI<VtO2VGx%6%fUfj9La%E5cWv&pnFk-e8^$Fys$6@@SD;CZdl~G
zSB{>z{EXMy+uW~$#Y5{$>+D3~w6-w4IF}DEPLNLusXmpKB1u;yBSFVzSBP2L(j^|u
zFNXB7v0Di{w1stW!$N+sL2^!GafKkQuvtOZGBler0OOt~S4U!bia>=bM*xBbX5mzg
zm?nS_1VyT26Af!J{0!!o0|n%P@Q$hOBAOQ`ezq6`%r6#Mn2<v-qDPcVOFP}lyev+s
zVWv+Ea`OmU&=a#5vz3-Fx|v#?VQ>nL(V7!zRT-dh4!qB0k2XBgS*1n@IPD)1m5?_Y
zR9Lol*(`CBY+>2K_#$L=6(DKmWr@eket<R*>Xwn#qKYZ!x~!0~aVw>iA-S?#a|<e=
z9WC~%kQ6`)ucWww;30J3tRNO5vzSW?OgRxobf405^Y{XMnMe5q3?nZruLIJK4r`9a
z(DN9@*5C_EO8@Z~#10$!3<^|l=nHT$bu`+Z8g!#PIKrTrL`@`tzC_bZqa<5-`CcR`
zd<2HuRJVTdV%b9s>QfOp4U9DD<v@r;c~o#j8a*cDRgR=4O9Cn<iEZhyh+V)d@1#6r
zRT_Y+$;Za@c{LSyRVcb5@qO5^*+hJbi_BZgmAKHGR;zY7q=_Pk6)Z%jp~+%U8JqIO
z>)dSRb@tm%6v!bk!mc7n8UY^f8cZH!Q-ji~YXdR#GR?3>MO%unpC0*IW3F&SSj>7)
zK`ll>ONn;h)b4<T+=_oEDuF%gcKTYpU?(igE5%@ud1*~Krq6J`GGGVjDx779*oQ$V
zrR}1$VQlMY#j(zEFd5DgPR=)^_W)G(L}}B0lL~ZG!R6+W@wp@GJ2YHl2XxzFewC%x
zbvdh^nKkK^&@FUKLa~L}2DT5MQg~hdlwmPJc?=M5KO~@**j~jg!JN)6uVaNYM$_mL
z&Kh4ncXn4v5OCW8^VHYTcM1mZH{T9P=Ozo_JlW?`uN>#|os{iQ94gwj&U|Iqm{9CO
zsQ<p`v0%%M|5$kZZJ!??KVQReuG%_AITS>%+qB~W8DgYj3bcOHB}x?^@K@{<hOmi~
zec0$X*q`dN?3dB{UT72(&`}2W6>1K>?4PX;4*Huckt%j+<d!rssjOWTr6_-H8B|t=
z+*>FH@YjP{mFe~+5+!h$X)Nizs)C)Xq$Qq{?AX#`kgp2b%uLMznzVQbxh<`--H32;
zo=iH&-?MMZVGwU?0YPB-HYn8Y`$sl*R-dq2u0_`tWA)W^kKQ`v#u0<M%qX{clpk2F
zR#*0$rcHzLh}X(Yt)8oYk;7jT*>ys7lCWasAbVV$pcBS89V*Hpnf@NtO#CZL^HLC3
z{X3f>w$dS^y<F96Yi%%>7EN+5ceQ@}2y<@|)R_ml3B((XdD2N#y-Bv`pOhHVsSD+U
zQRwx>k;1yPP>N4->5vu;NPaisaD{Y8g#mn*mxaLSWn-bVyFBu;HPFf>X^M@Fb;BSC
zAqjY-!76e&CcuMTLem#Jg4vjpA;f5>%oPX4W6mnqsCigj=LT0C2YXv*hngb{FPrKd
z3-$R<ZA~Tl97HSlIwqSvE>~_T+R2HA;Uhslu8idH@K&JaVkn{5E_vh@z1UB!U`##P
z+wwaK6(oQXnmTyA$S;$5`FhL_BTK{~b)=z2OE$_B<n=ACoKF^&)v+v=6_*skAimd2
zRj91?CpnGQEWP+cOwOvR8HTUxEM38fJ?dcoctstfDr7))SxQJXITeE`PD@7#`Jb&^
zB4>|r)_DxkKa(yh4{z{96PKjYX3{I+VH;#d`6{!NGpe!NcqRwoYnHPrKQJ1?ne-)U
zj=8vnHXg|`;W@1YyC{m_BB7{^IEAogogLy^(V`(2h$x(%bww~`jH-N;<)aouUa>&C
zEPiP1AS@xfzd~{I{B};D@nc&Q&PYXEql40zo}d$RLMp^k8=KV;Y70Bv$c1;9nq21k
z9j=s6tk8aLP&iHBSTOMxb7jBz0XtgME<5#5>MPA|ef>mwA9kmju+Vil9rc<Ely0AK
zc0YyX=BbIF%o4g?mh+PNl4Q_h`*Wy|(1%YW0`Y$Xr6OC5^R-bE$TIQ=gt7Crz8*ax
z10V@}1W6aH1>xJn1xmg3<wk@=DQ_ah%%!!(wpWu!YZ`#IcLf~Lb(ROajmhq^X1BIG
zm7X(st5vJ6ZYBI>RateS9*XE8Q~OFl4MKAW23iS@*dDQ?r8(<yfI*gO?09*8Sev9}
zb}N_>pee1XHGNLb*M&j1;3kYaW~7G>(R$$JvnfT#f-~4~W~%=*ViJE{NFk+J>3=I;
z4$0io7#Wa|4<pt$-A#pZ`3-`?=&vtiJ`470=<cW(59nbiG><|o1O>g_@Z0BT={Z~O
zg$W}*)Ed@jEJD|{Yn{D_m`A49c+C|fe~;tf)1tQHFTP%bvkuOxXZE%n&aUT<4ie#s
z?(L5xUA>&W{pto+^9_`4Bj#GN3f)b3*)kL&J|bPILS|VouY)+EP^>6F+$daJlN@UV
zn?Wq(A=si}2^{YV@72=upv`5m7CGURj@e^|QeuXjqNELhp-pfLP1Z9E^=EfAgP>ep
zLNRcVo7Wk)n`g!LjbEdq_Jd{Tmsii)mnRMRi#jeJ*c&$zP}Ab_?G;qW^&dTw*NRgs
z<qb>7Rj8bc3!uax6o-%}2Pv}`xu&9GujFdDSf2gm@c?y%LsZ-25jxE4*K>B5S=LTd
z+WGTL(+l{D1sdzEb>igp0qbe)h}-##spP?{Q~X9@lP}oXk5^0o9E^Ijpx3J{5Oyg(
z%u5q?1eSzV%RQxFLUIZRr@3lM=EKMbXsXyMGmdhDIv|?QrvZ1hHl_f6^Gu=E^z<Kc
z%!4m9w$2R>1&w{pnj?IU0%krfo3j&5S*V4gB2<5^i1(`+0wdK=32bi6L&*~H0Xocw
zDE5>1n{Jk}#3(wIM=ZM$?~z;*m1O08hcqImzYkCq`T(S>efz5uik0;d$5^Z-6w(6;
zjzA0*XpGDR>WPLo6l$Q_b;K3&Xj+Wc$D4Cn)z*(vbn|S!JvdQR9cWcn`Y0bm(G*s$
zBs*GaR+m$izZN+bQu2}DBh)DeX-!viUv0?$&iMx~c(VO44Qpo5KDXx^>9fTz@6lTV
zhi*8JT%B-Z$eCx_R7Z3#a<mv56UztrP|*-5>WNm$C4mFNA_x=iHkpKDAW@XHCxIwh
zc(>P@$S>C7VV=-YBV94Y(XfQJy9K}CaY_TD9E3_xz3E1L*1xZ)4nPiR^s+P1(-#gN
z%&RlBa`IqmZCE_Kjdv7gXLn6HO5F$~CR%yLOBBCA3~_?ONW{2&0*ix6K}uuV9<2hQ
z)TM;`(Aoc`kQI<-vg`5j{{MdDI)z9%@~ZNd`{~{pTMRsY%U4QzzLiHI`t+bRKifP5
zq&i?^Tvyp%%jV~&uSS_`TLL}Uy*VtjrJN_fVJ?syymp0t<r7hQOs#^ft_42jk!z-7
z+Jl@5jrZC9KJ8VB<LBr}H_%HKN*8J|YTv-Gue>*+s&>oLx@^AIXy7Rl>EUFW+XnV%
z-|odwx)LsN&im)1qQ$<Ynod$FW57TsXQC>p2qX#&BYxmpQnjAn0T_5(^3`*Fv|Rn-
z%75LvZ+!IG{~f+T@BQ-X`}tL~)>tcV{ytdvnq5$hn~*OpO@DSxfb`Ap_tNJ+-AC^O
z=jf?#ev$pg8k=X@)xbaYZYZIqOqy$TWWyPoy#<9n9V#miipf>56SEk!h{c9=7A?{m
z^a=%`*LHxFEJLV79w2N6xxZ3kFa)JCKf$25L8mhis2w##yf9D(mj&{Fa08=nsQi<j
zpEfI6$_;27TjzUHxP(|4ccZv<#n@GIokCqj@<??x*D+VSY7923fk*h;zXs6ut#j=!
z7iIr`89sKHwtt+nJ?AOA2JCr!f-e3Ap|!?(0Ex)q?ezD@$T0iI7_YCrbg#wKUqgtd
z`;>k3>N{&-b_gF?SjUi*1;_PAIeG3R&5El_T?q7J%-W_wb@fQ#+R}ML?l27wjWKyP
z8mPt=ZT;qCx)`6>Z2o#te<>}W)IwW8Z}42$6kOCqvFa%8q_$Nopc`BKqLmYE!H~bZ
zWNh*8t+r3i<DGW{A<GaVkrM8d`UBi2hH57^n6e0{Lk*}6^)a0md&fuv%TqsLYxU%7
zWS?W%$`WrX$nt61by;5i28($gl<;C8jlS{uPI~9WX_^H|+|mzNF45nzcG=%~OKVUu
z_Kk6$Tp2VF%1Zk^XWWwCwM9o+^eAQ4Z2`;}Q?$!aDN&Rm<qMl?c8x^u(h|5zZNN0U
zz;nY5r~0CAP{}a4qOzbH6hV%Y#wt0rV!%mFjb*`&kN(n8Ry~eV79HXi6xSysKtJ{|
zas2<H`!Sm%OeE~Y8hRBAm21|jNlL3DP3pBk#Ii()RAti`Pa8&JlwOrzNL;B-w<W<w
zt4>}V6cd&68$d9l#1WkqS4j&*#M?DXElIA34N;YaB;d)XuhC<4$2uTn)g5T9if7^x
ztx1pQOh`NvU)|6GCN974|Llj`vx1e%nWeXvzAL}?K8SeUFZM{Cjpj~guPEY^seXMb
zzsNdmT5jNMbt>(9zimA~$*!0(#k5Xf;Deme#P)entq+$A7@J^u`@@>{s$V)HJHJ>i
zu-o~|yS@ZZ+Q%LKLg9rwb8J6u-YE1xer*=`7)ybXKEPNCJT&;g`rB9PaMqOgj;Lg>
zc&#FG3``t#$Ws!GRC$+{hG%^5tv4wt+>J?#UM!FZ3qOS+7OJ%42ufQhn=StjURoyG
zhglp*w&pM=nsc7TS2%pOEgy!Ro#`Am+lRRv1V4EtCz{h6&316Q_+d*%d^*C;JQuaj
zE^uUKAOc`#8Mj-o#P~2X##BUgvJz3+N_uJ{!NEXHq}8b*NW32>NR0|Nq5UXs0xMaD
zFo_~S^cxiZYKb8@zjjiIE(=$ybtVJ412vI4HLl??lS&TNg6`e~u_mYR*L~4}4vz!|
zgEbM4(QQQ&6QepSm@y_gJ`r<U_)axO5cWN462F&$h-HjascT76UL8<k?9qQ4r)#E1
zaOR*LcBstN_1Cu<VOZ>Jy)NH~Q=0lZjmd>OTtq$>|3v5$B|@!%3yTPq$pctFF86~H
zdxjscDpovxj2iXwUqeisF&SnX_ylf3^@NFF$AE!-1N1<UaN8_{^kBwR_MVUESNp)g
zFnuzwHiwF;v6_y2WFmc4&4C4hs)&ztnULwTqRX^4#^=t;ssR&5s2avSuY&&1s4<+7
zMK~#wr>eHJovGKMxKfRq@Br9J-(GQqj=p!B2HIgyH)=HK&wftJW2=s|)q*`^OmV}3
zkLNYVT+Rp|__gsj&>=SSvrVG!Zqo@Ex0rL127UsUA^xE|DbHO(qR-`J7xMGuYA1fs
zbBO!0!{SeQHI_rXPaPaaxQ9W7fT@D~y#X@m5^LC_h+(TO$V%kuHe!Qg7U9wn1ilsb
zF`d=`Fpdq}&NY^wZ#<Ep$eyF$zQg1~3`Tvw(MbeR9qrdAErMGta$B+WZ=2Ic=HzY%
z(f6F(9MXL4Z2cdG1V~1TOXJ&Tx2SV+SI&$E=X2SP3`FpEHq5CQjfx9TfYZpF?I0*0
z7MA;@Ek;juQ*aQ=FNYE}=@F&m;y*OF;9wuqsE7dLP6>jBK4V_@9gvG?<#3*Ex7FyW
z+#IZGqR*c-`iG#}P=p?Ayr48ZI}I;$FpiSCCVwWAOrS=shQ~jp>|@m$?hL!Gg2>NP
zXtQ`<_E{G}vmzyB^TU9^6}0YW$|iCJvd;v(XP&oCDK&#zEso0KYM@U-WfcJ_jtBGP
zG$PG&76}c7A1!)?KPV>*v>Gu{TCI`L=NILvQIkUZ<bsMIv`L`eTx2(qd+0rTm^~lR
z1LOvzp9UgUFtN2Nzywgts8Zub^xaC;{8sSpJilT|+d!HaPuskxtvqQCmX+|KauvUN
z=FAm*WK}T&+ls$H)T<oj{2J{t-Hwcm4!eFCkleCwn%odO)bP4$`Rg$Uhr;Kk+_Z~X
zINb1-#p~O&lwojs7~X&Lsn9V`<uweu20J`e)87Y%kuAxmw=kL|CK@Eaq9SaVlb4>N
z$dsC1m#q1J(T``M3qrE9yCk(awJERKu#?lWhcl)WEZQRi!YlHxR;oo`Nnb}im&n*q
z2{>IKWZk?ZVq>nB8ytwm(W!b%@JBhi?-!%A#UOR~woHoxI{Fp;gL9$7OP8%ZNCSPv
zhu?0H1@iR<lNPs_F(!)estn0UL*+o_Zct*0%{hG0Ndqp+5T^Ys7`@S`M@h3*?!VVa
z)Xt2Y%%OXjTUVxp4!2dxF{Qso4t5XNHgb+t=UmVE@eFeq<g&^V%UMpHZ9;{iBx*)K
zev)MGyvY!^EvIuQ{fsY)YznLtgf-WgtJ+$DD~pQKYQmH%Jv@F+5PHWh5fbcNq(mjE
zr6^6fPD{CPr<bCfUi@uQa65WUViR-i)zbNHx_nO-DoS(&<#%LN7LJI>T=5qk9$$)u
zg=9}<fh)@#FqAE-54rRdst^{K4hIWe0&^LrmblA>7^av^YRp_p=ai1ylW)vZQW&_5
zpVgI)t23E3_4BkQ@>bQG=bh@W%+HFl?RZb#l44gS6%5zo;Op%rgNuV3k_5YXyxjt7
z67i7}H#!{zFV}2)CNPG>;`K(C9XIiI@p<cbyv4k9vZC}n{-bL_bDF_vMsb%N=tA#f
z;qL<--eKhBB(bIJ!Gt6j^-8sV1Em>n=2pli5B4QRq^aAbi@sH|hVE0F5MM&0bo~5T
z)$FuGsFI%8PMw5ZCrqoa%$#3_jJ85lkN>jH+N3pUL`bqTBi)(&Iy82=2BLeV4?Sb(
zconG;iA<Wsn~E%3$P)bQy!>r};O*tkZ^GdNF6D}DB@pi7KjQHoISXFHuCF;)??qwg
zbZ)jLb5|zk2q#gwsV?}6mGoUQm3%d6&hf|G<J%I?`9c<$@?#kmH!OaR6h5}MOlkCV
z_Bdz9r-0vwyAoI9_;k~S&SOhbQ!#cT8%<4<u)&?TMx?ln(&=mz(dFx+>g4L6K_g<k
ziuN!vTEg9WhRk(RRRGr%mUv|=!c3uVLZ`JE=IO3LnJxTPPLgs3Y0zaD3<|k{1dV>P
zMB%(8mp>LP`*rf|t_(J<aq6|*-yAP_YQdafX>iVhQ#AR{`q!x7JSHpU<X<z@H*)@I
zrSlR-Yo{Xx?pU{5<R<WBy}Hx4iuY=mZ}TMix3uD=@YlGQI>77Gfi03GI~LS+;P~c8
z+ov60aQD64H&SiczdBN$<eTt&WnHcjr?e|TPk{E0GJLvUBkgjIxMW>^?}V=+X;s9s
zzj~x^-`n7RWSv(awDDMnvI0aiY$gI(Rux(^W?ca+5T&Ff*-zn{9C!@o?~J&^D@jz^
z2(*!O+=a22T``~qs2*p{>cE?wJfUrI@K)sNZ*b4lJrG=oyqSMH26{6g4(X#Oy0BXw
zEQMfQjeXn>GO<yVKnLRYj0E3GeSpi)@!me)%YOLowI3QDfA{uJ^oI&!3(3hhz7Ky1
z(Loqg)L}QS?&t5``3dx8ztZrRJ%Og<Q$}@rnaQIzZz@D>>i6|m^-t~t`I+zl+^H&H
zPN}Of2w=lkb?LjU4WA3%2%@ik&nwLg;6Tj}Z}kx)FnT)<!9$%4nYmabZ#`TuUt$FD
z+=TNSJQun6^#l5GJHeNv@tS2*2i9?4HNFfVyf$%7eUMfN1OMttKf#}rTPR8V*&?WU
zEb`}NzM(dY;qJ>wY0B%}kS8+o1b9B;LpVN8YLm9N6Rd0G*F7K3$ECX)ImR3V#>la5
zm_0RHeKOG#XtwnWmxHF1>skI<c_DUW5gXsI8^qPVlW6n*b`m9u9XV6mveM!dCCu>$
zp&e~pWidD5(Ei72g>*0B+64trMszUo?;8FcJ;a^wDwh#2&|P%5|IR-*j+y}~lK8yR
z4xg_(Fb(>)o?uvC2!}|Y35_{xpqG^NE~TC?>imt$^m;3`cPY7B$1>`L6~F(+1bW}f
zTDwq}1JC~eo1t{`kCkg>A7++V8*gRFzY#3^jdh!n%cfQAK~{H_cCm)PeaBTL3pO=t
zYsAb06n9<~x6U_Euop;AyYBOC;e#XHckOGrN?bUj@}I2_rIh1%K>YIB=83r8NtlSi
zi>vL>zIA_Ap4HczsCjwGV!RE;wwTizw}AEH)8vuar$l>@*)GSqIGZQr?^&jRE7YlZ
z^nuEd)X^|lSFJC5oKk7Eb|<H^myZ|Kij*-Tic+rO(@DnyKW(s4ZnZWlwAG}((C<-g
z3o$39gxP8!ifkszWyX-Fc|RrkcA+|U=Y6(MTB?MdsD(}#d_hKNGA{L$h)%k>!Y_4l
z7I;#p#-OKW#^vYBzX+PnGDU@g^9SKpfM#YKF!|?*RY7xE&e~Fg9N@YMo8kGt{8@&-
z_gbSTB{eExSUUXZ-0?ZPb}+I&^Xh?6bSn<s#mX}08;;22ZjLx4%PKrS*gqacw0Ff2
z<iK}-fZcHY*0=#dJ?)KpSXK$t-pU_!Gf;;P9#_6H8kU70LlZ;CA24hBb0)WCO`bb6
z8Z!cR4Z&6@1?M+%Ab}>xefxtG(2s|2T@}kvR@uSg8oSyKY<p1z<#msne9uj^1{M38
z(=(bQUhn_t9lx{oxpV*U`MxjN74fHI6CTf7wC0OHGBV=6&}zX3{=rm%AoU=he@2Ld
z5S{_?y*>WehNvi?PIA2X=@<NN2L-F=d16;0J#=hMB-qY~CciS<>2Yg7*Eg2L_1uds
z7klaUJgl=$I~OCAV$=nI*;N6JI&#G$Ic~xo(m;-VwO^>eP+i=__>71OF`2QP=ZNP*
zFy&xIvtE_aeN59H-fs!mL+yz<$wKt@6SY7iql5Vd1Ai;Yyi<Y_LZ{OHsmMUz{2{?l
zEaY0Uy4vBJVs$+P>!#TU?JxW62|09(za8VrD;L+{_1mQ{2H3NPw?WJsxf?fZ-pq4&
zlw^xr1T_NtX8Y)<GMJmNXp;lHyWk0U{0D!UK#S{wFfL#CG4a^ZfTAvagtNtuE>S=}
zLFvqtmam~6{FOLoSt{jQ3{qxYl1=LUo(K2dTG0XDx&vIEGpoF(R=HcE=C|dpy?4Al
z3hW*pW5N+Nj$#@d2{EC{aAQz}&m~>aQA@*TOnx3r|NmnfGDAdcs~IC!{`Yj$NEir`
zpwlsoyE1T&|NT3J1Goei08`3%Po2E~l?(gA+}}CBg)i=-kD4Z@xhBN{5i9Awte89%
zk(jDgu4(^N1&U!`7iC;g>Sgfm#U`&KqSZzmC(Noeo?yS2Fcvu$JB&qycz^ai4$VZ;
zI6E!bN~UIhy*Jd*?x*b0xhtyVEuzNUoKDeVQ73rKqV*-tE``!k82&1CbCx*Y3<XN9
zH@Cp9VAxB}W~BCbQ<AN@N57>q0<EtssHj1Ut(5^6_uE}(-}v;4%%eHq!o={`z9_!~
zI_oQZ@LA?r_$)}<r7RVwja|XzkMbNf*Rrz;lgs0c(>%dijny5BO)dLBg{{6gknU=7
zvG6@jJ=y89UIC}@{oPj7boWlZ*5X29Z@fDxD~d4H)9GK|T+8E)2&~iZKU&2VJf8%F
z5l6cYYqa!Ru*P<s!`b!=wKbC<WrY%-re7oRmWdEVao_{VSIEM>Y9lINA@{mkO~xD|
z6{Mts)D>!^fK)=hE*a(RH?0@jsW<HWzp}EImXrnBm0ya*UwU|KxTZ|`z<&51^8oE_
z%8)c#8m?SZ4>N0>>)GrEC#SZkUiCj~j(m!zCud2Wj59B1bjRYXoP_^@@a9I1iy*Y0
zG`a)EJsG9B33<YV+?=O`qNhNOwNTJ%&?X|o)%1y*ox094kskzBH7%q)`t=oP%LaB^
z5*D`Tw<5BC67|CW={c6349*{&AMxHV_8eDEei*`ic3N9ubo^J`j@2<%xak=bGp{*2
zBfISWdbm?G3x2X|HlGYzPqWkwC=WmF3VaM9*h?~<hv1<O;5W_-WS;0%V0DR38MnU9
zPZ$w6-=3A`mr4V)yZuCT5yuG6bp47R$7Q?%+dHUXgalrjeTM&(Cec08Z6Ug;{>n6e
z__pnJ6<21#L9{%e$`ja?l7Xqbfvq%g2p$@sz>|6mulc88^)=uS|7XoZ4+7aX<aPYT
zGXQ`B!89|q=kI$ff3eRYor=)@2aKRU_usZ|R@~3h*T(K!X%9zpNn2I?*bL;H;C=pa
z->K30zx@P%`mOY3UOYil<#2YvOjx)4M}#>)m`J?Bz*n-2{e1fkeUFwEgr)rFGoru?
z#*U=ev#yzt0QhA9|EO{QTN2P{_v*LK<+t|*?s6MemvR8C;IK4NF%!VGkLE(=hCJBt
zuptcdQlaIE#jxMm2aAi_`PpsU@ah`KM_u1KABJY1MPGHox?ju~8QKr;)LqiRh;`~1
zg!i2YY@PiJw=~~~!7wns$4lvaTXPzN^02VW2T!yn?qj}sA?CACO6BXAuj)&y#zT8=
zFfYm!yqPiQvE?!0)dQj>4JI32d~gtq8AM$`GBeM(S0{dkKfgB7w<kb~srY;h!uYFl
z#6$PQle75TYCNQ6aH(vm{NmR@HSUyR3UGiuP>Jx~;$m`H+mn{m4v&J@C)SZSCi0Tc
z&Bc}AQQEnRA$WKqbMUo^@aO!ID#`=dK7Zu}eoqm^$Ysx3FMbUsU?$uQuS2HQE+~H*
zwpi%%V===o<y^UEqwsn6;<=0G{iLir9q5=>(-flH7_w|$>y=p*b=$Xv{NRYUZz^__
zaV_OUlR{tPl^MG5ZQE;gS7y(%X(9EN7P|Qi&OPWvq3`fvZ{C$zk*=l8Qb73h+-$L<
zQobYX*G%@5Ic-0lsYtAfeZiXKZm^l|FWzK-4H0o{`o<ESv)zrT?v_>|t9Y)t21d@5
z%Zg?FxV#Pdi{r<|Hu4+V8xvtz|N4aNhUq;B>!P?8Vbur9ZT_7J&0bZK1^dcsJWbpu
zpLASeyYDAZ;_mC3s*hUwQCk;p0RcuQgohq{?KI#y1(2dsVqb>0>-4Z66R#A1Mq0-E
zHF1wGBfX;=;6(%+^M9*&J{Ns{*-5K8u38T=2g0kvU+~|k0eS$?f#0$Qks=^`^Id4*
z+~NMT**T<Xlt`Aud9PWH&fQJmd*%W+m-eI1+57d!XQXH^`Hy*PkCIX?2K9?*;0^T)
zu&^Onj=#;Q-L&>^jSp;kKXqg|JFoR<|A%Gs_FIn?b2B@3?T?XdIuq_}Wd09zDI!a8
z8GY9;a9&ZfTN|q<@7;Dj{NW#9_&HayPYD*0MuXs^58o#zmty~nc|g+7B+IM15p_w$
zAJr_oDP^~n2x#wDYxCPjY&+*TkL2Q)$_E1cELvUkG-<EiK5pCcgD#=5_7@2+@9=W?
z*6YRZZ2D<1j-Lyuy6kuzpVj>Ij{2SSK+WUa^!2)?)QnmV;zRNUxQSPow_&}oDTPy#
z9uuz~<!s6V3zhEFfk-X+N~@@(uvBfe=F9kB1@#TlcMavEgyh5L+l5wPv9y@9284u@
zRwH0sH@M3^`{_c##U1a)(<sAEz}F}r(1ERe+Dc|NYjb=#sl7>wDfd@NLYaj{*YX9?
z=`HtW)1UrMAiQS>1U}<)J#d%%owK$0VRihRGa}oAg1Ed2y_g`mhzN{jzuzXm{rnyB
zT6|^KtA6e7X(!=liw3tHPfB{bdf7PdT@r$pjn(e8>`Zn#m(Av;$I5?V0|?h<y4gi%
zX3|aFK)ABKHx%gwcUOjctD3{%E?T+1*VEfu<9527z$K_8P??NCm3P_RRFIYymAW{p
zIS2p}*QI;+ESNP7Sfvx`1+#L3&gnn?aYTVr`|P+Kpm+KmvqUZ=!h+A8xH0p=<sRm#
zJAZg{fk5)Ggz&-mZF!X)oYsh<v%O<qqUh7=wzIOtMVPanG`TafHxu(TaQUwW)3!WO
zbWp#_=w!j;yz_LbU1uktXeT!<j`wHg7Cr(90J5Yx#+DBJjH&kNkR1hO$lTH-_8E(*
z_0yT%mXdwPu%s<*GuI~b&XGqRdE`+{F~t;TFKFE(%IRs*B<{D!Hx@(E0VyrY(V~I-
zYvho&TZH)%<<{8t8g7`!*2urMV3wU(?}Z@|(lHPr7wAAfcrFfh4Det+9P7#r9X@s>
zkguZ}?$5i>lLK^V2uG-Xpf6Z3H_9hC^8SS=i_{M|5tgg${&3z67yDqj)}0HUO#V5x
zZ4!3uS77U@0h3=xTZ|~Z-E9#}9h}2LMUH=ul|};v-P!#}!8xMs<c<(6Q5dYDOluDC
zbgm?xPGikb1j%HIl>VU26s(K0)eQ-llFtWEn=q#b&UA-m<(b<x=X%VS$Uo~WxWj*$
zIJZ3y6}PEYPI?70fseq||Mgi}Dp2YiKX}wGvI)=)Py&A+%x*g(xc79k0zG-vz;B(g
zZhMMYFAR^Ej0`Y;6Ro-n6zSq9;OS)QJp!hMUpK9r=R~uBJ52E60Z!3{|B7l)f&H*2
z?AT9~I}JnHN%&x*m}n-3Il#m+@k}c7DU-&0#vElb(6O)chK;``LpD11?x%iV81;_;
z5VxuM!1rI|NQI#OUVVV^*$3hhFu`4J7mxsagwQnAx)Fwk_8=V6d`<+4o*(^%&<%i2
z{%>~&*BK0jC{iTSvB+3}6WQ$q@MXrgmL+P@(57%OU?+<Sg-}659N?2Xp$Jim93`qs
z9U#3gwS6{!twm#ykwYy@hG;z6v%;|qnC#y|M8{D5V@HQ+8>O<~xGeI+L!C;3uWP7|
zK(Uc@tJxH&$S=KL1gi1-S(of%eEJMp2^Tx3fyI!}y$SCyW;M=@{(D}1A)vAQevAu?
z=O2dQCC628OIAc0Z$VCXxWp5V7*&UAmC}q4{(#o~k_QCc1-8lI6Z)?1-%Lm`BjAO9
z(^;H83x6X5YxH5YcFbF&3#3KxTYpZf@ef!_SmWLfyIVWSEyr-AQAFhVU+kDa$hQz~
zaZlR3v*`<ecrWzbe!$UkQqN6;rt-P+Yze*L-~%qf5qPy!V+lnyRzQ9+sMCxORQ|P!
zw>++Elwt2^vkE=;4VoGe%5xLFA8-kdz$<fOF{;Kxci3hnuHgujzW)q`f8w~`05Clj
z{I@2sIp7g;CnY1dTeey+&4q)OBR8}ftwkHqHgpJO>x_!^m8x|`Kj^7m$b@6O82jSQ
zcpKh<cjK%$5l!(V#%)WG67~}k2`7Ep7yP9webdkVZ!(E2q7yNYs3q!%p~MJcEHR1L
zl5dJml9QrIm+E0XsbA}Py{Zqxjl7v0NY<10kz>e-<W%x8a_%S_SH}<I&x1lSqev+-
zik#w4QBjg9X_W7dH_f81r|zPj>hJn#|G)q0e|ljOXe^p1Z6_^?7Dr2_9iI)ebN;*N
zbQk(|dKmrGy0PxBh0}4-%0+>T;ujrRRDX7!)0@m-GF%ycj6}w%UArIe_j~@L((-#9
zJ=2<~#H!u~J4AFyRy0PndhI%`M&MXVi_;&rmE<0Xg<EHCf9KzS&hEOfO*?95?W*0e
znb{0li3RMqU9H>tY`}(W=R6-RwG>#oSxPOVqWGvKYKs<PRh$;zj{i>N$+4s_-IOMz
zrRlHf^K?9&&n#_hZA3O=n{_rDfB*K1$}VNkpc$00wNMA6VLZ%+weTivhy8FIS=id!
zy4Y?(NALcD-GXK?!de`U^Kmn7!=1PfzrdqJXm^@A+3%$XX%20qt+a#o(RU1(?P9@V
z1>4Qa*)7(^Cb*4*kAsqHc^uE<4g6>Rn$HQlCEO)~C9)+t5h{|!7vh|_EbfX<@w=E1
z@AGAjiFs%KDxWPZmr9qW7VX7s$>DA)cbD;Hc3E0pFMldum2b+~idnIi>8cx&$MfRp
zWw!jETH>TrKdOE;q~<hDTk`Gre7*-iNbk|f`ndi|SL-YKn*LVb)j#N;^ke;6|Eb>_
zFqY0v&Kr%&gqnDB*nDQP%n9>_IcG{u>CLx@1priV+U6i3-5vCwwp@^n*kUk7o^H%F
z1eDs}|Mk<`U%uerfbeIiwG|`L7QY4vZxKqzsMc?1*Z5#&^OiOnlkm&j+GE^z-+}y(
zIy4ICUtZ=(Bj`bVZWUvS@Y3x}t&2&OM1;74xi;9Muh;0>D|wU(JLQuOsUV3yQz63^
zCm$3|WJta;S|Do&#w3jCXQKIpVYZ@u5tAFYkECY5KQwuRGgqb(ldy!{awH#A1+52)
zHp6lZgmChL54iLj5#0~~C_@H|Z9nv(<(v*vdCS?j76*N~PosU}rZC!3b$n&8mr&C@
zm7&M%Mv+{f8565g&`oUMp5BJgLXcNjI}e=188B%SEm_UWK^(8KL_Y&}2}b|!D_jAP
zPOFYCCrx9S7DMbPXHAu0!|bW=o4^M9Jh$-#=aF@U(M6mNnBz2N#C~z^e~^wg&Ku`B
zLYaWnjvlMBk=-O7I$T$6VS*o(8#`-jYdcHi2n#neeo+`8Qizf8z|Y{*2kL`_dd&l}
zVa|Si&_<XZ6sdh62&8~C>$&XC%*68BK)@mgYp^$zo$UFq3mx#;C@#(_=#ZM=1g@bs
zvyqubFmc-r9}+g;sTv_!Q|J}NJF-BP8HQ#z?~5m|EsME(8`L*ISAt`&u3@I5?eCsm
zUGj1ITfJUA`Wq$U=RgW!;SqG#MqMMDS<gS`SC~C>xw5sn$6xy6$?dyM{m{l;06T3u
z9AW8(GE8lC1yDN@HFWz$Fs?8##4dxDE41Sd93LMF1vX!Y5$Z=K;12)2CmiHeoVB`c
z0Th&4TjMYSYhjEK#r*^!M^=f|y)dQpp4k?ijP1zKveTPjm#d~CcRZD$*Ws57n~!l^
z)Q6LF%K=Xkg&3`f`Zc8d{WpvtT)P=A&OmK?E5H9=C+z7-i9`_P4~0`w(5g7JQ`*HP
zzX`<woHLFC((%;nhgg*>cOc*&!IF+khw0o`BiL4F%uoh}C8lLq%Qu7u(OP~$xar?r
z9)u4q!_Y{aO^z8eqf6T=MCu3!RzK^n)S?7QPkWcT2ti`*P!xOUMdX1g{LecQInXL&
z-extox__7%YxYH;$W>HwS>ZOY+j9C^GL;l*W6-Q4f$8LAv_wuSmb`!4M#9@jnB?{(
z8rY)t6I4jK*4tTWw%l(vpc9s!+y-E$w3nVWP%$kMOIL%)LZd`Jj!pWW>I}a%`eFsk
z;}~W+qs>8^yYp@(YY$G42({k9O(6ye1n#CNg1y;ZA@`e{;C?GuFHlyA<ELJ=7h(Ks
z+G-4p%3f=v4ILQ8(}i`8AOs8J9<$bW&fA>|M{hk8^+<1VjE*h#X6w&AFtz>e7yU|m
z|5up>>4A4p(SB4E6c&{J{caBb92V9QM$YomG7(R7=U<ucF4hFiV?V4`N|nl4G2kuf
z`j9^MNE6Il`DLDv^JwDv3rnU|b{W>1NV}*W5khFU>BoO9UY#5s`VxHn)Ex?pv{$q+
z*@@CaiRAoGoaKG@o^QPnZE$RNHzxi{xY2}j`^)+GQiz4?n!`pzB0*0ZMMm_r_eh53
z1uEnk6VV-_c3Z~9)NR=Jdt|(h-Zlo<R0ebuT<{!nz1Gv9C2mzYvkm01%)agn$Z?kT
zu_FO7IJ}%mmTMvEaZDMbxM!&}2w{XQQ%c_Jsm7&abVMIY5xE}XAQG6Yu0(I7Jir#y
zXaU9X<S=qa-OZB_4baxfkJr0=q>e2IXb(KtA~Jz7rr8{p9Hh@BYPx+c+fXdmXJr$7
zM*2poBFMH<>#yQ<$sOh6&<)GyzV%2UBWX%=AvR0In-o$9!wFD==MdhE-s8rmQ^hb)
zrxwRJDYk;L_yDGKJYxL^iAuIP2-Rd!Tnz(m6J*3UsLQp%@dGfmr`$_*3Z_kn+)9G_
zqZoFO+}?$K#(XAQL9{FhZOI7IIv8zR(d?h@nw6%d(Iw&zG&ITGMuPm#GaI^)(yzO4
zxjHg9z+y5xq9h$HeL^m*$JjOG;|mljg^*1&q6>In>)=Rc&Jv@K+$JJKyiGD*7nTgt
zSHjX;y3Kh`9GNPcb}kfjUA)wScc@ASi2160acD8+x)5AUIU&*P0PH=Fh67Gj^VE_d
zfAils&Fww)DXEvj8!vt84fJWVF8{v^*|Um}f>q3UNtto0ifg>?S<ZO*2rzU^PQh!m
z^$_tmHHSgiOs9}B4vyJ%bpKQ!G=hVzOz{hFrR{B+jpySDi9+U4>5HSsV6Ya9<yCVk
z5;5$a0$(A50AwA3?G-c(<0IyE=1q@%2Oa|=)bX8Yld#kj8N4J6#W^$&+)ak!$%jDA
zw+~rx=@v28_*$8VzFeGhe+Q8xw&^_E94-55aEi^!v7`hj?U}b;eRnqMXQt-F#|Kci
zHlb;ZiY?1^EHhYAnhx|J0@`(j3mT%nYotMIF;>xWJKB^N_?86(Cn94#gv~fICBY6Z
z=i8>L8?=A+M&MX6y$756up`zi2u`{k8U9-D@<1IofF7va7b|ip1pdsDbB9zfrsI{m
zTcN8Ar(%8Dz<WF6HdZ$Oc^Dm%XVkm|8RB_$PzDRwTpJ7vIJ%G!490Xiz<5$Xp^W=3
z9Hv(z+F8}2%gyS9Hgtg9J(`vfQ?-wvD^Y3mWh|g%udjDFRrZ%mqeyZ#uyxIts!D;_
z5FTYe-H_xtgTuiwrY5iM&7>?JVnKSqf+S8=|8vV>yFO`}=T$;f>Kgp+f3Q`AXiT<F
zG0VFW9<^?G$PhA_Y87I>q=}+jljUCMDe#ErORXWa8Y+ngLDB>Q)}xM`sT7KKE$XH1
zP!vskRbTe2HlE~VAsol)jn@SSjB&ltDn{eJ)9VjlkM-=J?(ogLNsEymklRhk!S~r_
zk{vx6ttoa;X#;KrKE$26TA9sOZrVVIP^sq`WY#sd6PZxDr-hCL3nRg@rb5$2=PEPR
zC`sf&{5g#iPwc2tEfX(KS}Z-B?x%&=dOVGBHxGPZt{>b9Od1s+2kk68JpxnOJn!<=
zMS~dEyprncpzU^T@gyMR)N+))p(i<{a1+>vqLLt@-?8+A;+**!Pcx%^Lc1;#jW^J0
zj|J3j7c>Dc3J!Ml*%e$AaE~p_#(Hkz&z{xGR6-yc6{h|kVE~IaVNM>;(YjIo-o>IH
zb)K+qUdZ~jtB^nWD$^aUiwc}3UuSyazu)_%zv3sDtQm!d^aoxHb#p`f%~Blvmw`op
z0;dRJ&u5O!c4m+D5c%RCSNTi6S^`INbf}=+2eLK|X0pFgIW)hWUuO_$@14-<+U1+B
z4{3O8=TAc6%+KJP2OK5M47XM>I8FFaCp|=pBbDH3$#4i{^kfy@Gf&giwageB8t;_Y
zOd*UZDqMtm^{Dd407;V}gOClm5+N32stT#I5wl#%5^14W=su+BS&NQ3KX9E;3~8RS
zQW(PGVA}U05plHpOqsF=!;?)o1OKR%Spt>qA!d-cr6`6qD}p&ZJJW`2d9K(~@;T~o
z6aC&XPY=VXxdX)qK0O}?F#xdE)NL5SwWc(rH(^=sXfy%l_iatg=PZk1^k4y|eDefS
zx7&wbq_T28ts{K~8|w~CSAA_iGU|zGPK!m{;6K6Sygx#FQbBM{l~4S5g4_*GO#b&8
z|FX`iZ(DPlTrfE_V4rRF1VWnI2nDSBWEk93AE|?;=Up=&8w_V|_ee1{;m_`TkM?NU
zNw@WtAW3PGL}=@+X`h6IR2_FDuzP<s^C(T=gELkkF!?IX%*LC3r(HOV?@1G4_uU!|
znnHK)t#3D=kCE^Det(lWy2NN*Z%4Hqi$QB+18^Jt=EEeYkE&$rjH=mV(zg#!PFV8c
zCV(UZAI(ZEZUbH4MdYSt*z!?=;WA)y%dL9v2|W)IgIr47^tc_RO)chEsUtj(N-{2l
zs(hD;MnENIOi*xtBC~~gOQxOR(p#Hx!P{V>X+51}o}*~vj_QeGRy!FRQ+?f`I&MeL
z)P28U(O=d{pgf0LGB(jbd7NHmHzP!<g5kI)0gv~L8;Aj{F?9x=H%i92i43hrJ=$JL
zTX$F0WtNp3S8k|CipGcHd%Us+)M@96Z>te{hVxi*m<RoyYsP(lq*iYj>`k@r#EiL3
zm*UXM%Q8ChGe@Hi34l794#%RG*<lhsG0hM0)bNO`++4NMGaU#|iNmL-)hvjTb8Rt#
z7S_4wXl7Y=*{It^q>?$KW=TS-G~_OG`6|Xp)LLrRHbK~&PGAbWM>2R<^_60T;jS48
zI*mhQ)-ADKYA<lMREUfz+h+|3K%6ki1LgQeaYgCjra00tHAFCkKLj3WOS>iErg3)m
zG0UJkiPr#<muV5CaRRbTLU%qE_z{^q!k7Sy<0$i5v=peHrD(6b2p3p@p|(jF^|S#g
zAXpv8R^Gssf>WO@L3{w3^`YtIDa}O*S>>wMt+5AqP{4_5G?cTK44p7XNiW|l(2+6G
zPX#-ZQzI>Mt@d1%oXF5V<Ps>QQkbUKyY~?RF1hBGs;-6sm%A>NaJHnd8S30%p}$#c
zCPOIeflD+6a#JBcuWBnU{0vN&9I0GVGL6~s4Y|l29=bE*MbA4vS8&F%X&4GjzD{0=
z8j#6aj67YPv00_Mt!QQ@9*aKH(Si$cx8A#MZ?QruJcA#U#&Fyg5Z=T~;Ud`^?|2Rm
z^H4;kJ9I)fG`SY@9hl7|SFj;HflCGL7bR}S^(M^NycbU*>xi@o8pz2+4iVu<{_YV$
z8zL7%5v82h2+U@q^wwb|chKnQi5Yd#<Wt@!zOfeDQqba$R+CdggEo0Gzu59+%H5^b
znA4xr9zz&aChM3UIdtdVmPSd<7E<C!l=5a?)ybLM5h)W*k~(|+Oqnrpg<$j3-&*GN
z>CI(}=h)eJASk^NuPF5oZpFJSph5>ivsJ>7oX;h43}qiqGK1Gh4L}mlIK^9)6->d=
zs!X_@LV=3Or~RPr20&UsQm!G(_I3~@kl%%}wiYE)#N<JH@+PK&SYi#5?Khq}z@BhB
zd5S?Ny_2n?Bbfa}c*|;oA^!Zy3CnpkyZ`)6jIq&30ML$1Ktj|Zg(p*>1~xaR!K?)9
zqDU~ZF?AG>v(TyaJZKD7+dvy$?x5{4%`U}x(TwtDgk&?DIgZK!+L0K@a1Rm%xk*YO
z>eoW_jcrE!ESBcV2c`sJnZ0E_lQ}9v*3U|j-xsgF)by>7m!OU9jL|73w`i%k-_-_m
zuSXn&ORs^DMVd5_1;wS{na_D}<U`WmBsVx91REA3x-i_)4MlrJAxTn)?PMrY5HWti
z0-3^t>hES&>f?v`DDq>lxF_@d*go?pc;EZz-iepl=`<VrP|*I^W8mSVAH0(<Z!six
z4XhY}*?9hK`0eaDP1j(;GL`-jp3+R+DEd7Bhx#TPh6h#oZ?ie)x#hlpCx3)C2^h`q
zP`Z`G_7x_Q1`O@E!<Y%o0gLEq?=UZfr3dKV%L(B(AKkro_iyvw?RyXEMqia-js<ZP
zGQvv+Nx<NE^;ioOWk0A}>jTzASH9`|<c}vf*m01wIk5ls?epi(e!xQRLh-lrV*Y$a
z<J~)Vzy0Q6_VL#qkDask$$NMfXq#nVZ%O~^j}PXL9lDF1kX}a#>#bQ^Z1}sju>4oa
zs^pUo*sQ#SiT^I|bUl*1LIjG8rN93?IPlkY{F`f3H&zX=AVirH13p6!HRcK#<F1BP
zzZ9>#J`xE=ttWNYa6@&%JP1~2gc?~M)E+2?$>oW2X~HBk$2uZ`$cDs`03#TxlOmza
z>y@l&$i3})Y9yX6!KK%hoyCEg2kB%(J^FEul9!Psc;@rHx=QBNY8!#ZJQ0-3{!yhR
zDNto|dm@Wek+zwg$TP2fzW=s*d@A{Wtp${;2@XbQjvpkSg2)DWzP9q5(#iwqa{@t|
znA$@qvM4D%tzL9W<<mHvm1by6HIy<BG6|zpSNNOo0?RHx7L(kIxMonn@~%6sT;v}J
zUu5>)%^?a1RsQm^c!$+P8WIH)qlIzh+`N6$WXX^LJah}vi9?JX5|gpn$o~5Sd>s#p
zeIJ|3zL+Rl^y>x39b69>_K#S&Q)20KV|BU)d9DVs!cew9zCqPmDh|8_LgWY5o8gws
z!X#&PwtL5wHY*A1cT~BGlpC_1l$lv0aa^Tv1{zE_;2Ed*iA%F%&6%h`yd=P;#PrXR
z681C+UJo@BAR9K%JiZWyYHZ`B!LE4SYaQ70O`LjSN3WHA<qpd+@P0j0lNC{`JoP$E
zbbN<NH<*CD)q~A`Cmf>jVo%w=^8yF16cc<5Mo-VKI*p5#713-c!zRh|mTi<fI5j3c
zV5rHvN6mJ{wyN43{~#t1n>bkffUV)h>U0Xu@F-1A+q+6KOyEMz5*s@<_F_dbbc1Nb
z4Cx%wRjLN}?HHI!iQvSlG$PtMeJYSly%J!T+l)xdXyFs88Sh{P_a9r>mTCHJm(ol7
zuk~~R9M<r$4yYxtnyo-wo|zdLJnX7et!U|xsBSD*f?~BG<|oAd{<LCC>MA5$F1j8k
z)NM3?uvm+_Dl_X1dWFT5XZf7@@XssJ89KdNHUd%(V0;&gD=?Gj9F_wVR{f|{;bBhS
zGoH?CHLVeA^2m6-j9^}mB+B>T3b~t?=0ih5h7v8jYHzkQzQu={8?`Q4d$J>>_(8!+
z)CL*^AqcvQ6Cm;dYHOC5%OxP65DKEQt5m#d`8(830mug;2chrbamP|dQBv~iW*a>D
zd4E1Bf#Bpy`eFc2y)`OXnnashBj^NhJ(YLj%f1vJRjW0a)S8Gv&Hfq{uNef+@X*fd
zNsQT<1EGg4;UWEENu@?qxeN!}*GlS0v)Q(|K>V~<ktM$5F_pD_D`g|8E@bAK!37Sh
zBVX13&pMRJ_fCbr+~IA2aTfR0Ct=zrJL1ajM((WyD`Yp{d?x@-0v?#IY2k8^zS27>
z&Hzaz6mF8+c`H9v6-%v^nKP`Ci?cg!he!4V$ZkNFfY^b-?mkyuZ7jqS%AMi^(+!x4
zACmW9CEG&@&Kvk$k)c#sJHKFNt+@mcVPz_7Jw%KV6Rdjv0x`rG!MyO(bfYptIs7{s
zWAwpkh7@-s9aKxMN~)|LQ3|gGqjZ3DcdpUs2xgpCgyaH95RxG}dnFngg%qhCgda0W
zI%38wHj)WpCX=Lq8i%|8;QPOih4G+<8Y6^+l-;@6m7g`m(k;7;U0kfsXR?-Tq8^%x
zG+CDSzua!?S$)4P01##@jAS86G|6^NBs~THNR!;qQmCyVs!E_@y{6$I+-xR>_7M@%
zeBp<2{0szhPgX$KI1viJXb_)JI}5b6O-P_H5w@ES)(XDYgSD0bQ*C@(b{9uh#1&`F
zDjq34xYqKkXrJk35H{orgy1Ue%4<qHC8Sz*XkA5bO1r%tHw?i&^1-F{;m?n#CIVQ2
zpCRSD;zj0aKJr)Nt6OSU=x++08$&3xq!lpBx5{{B=*Nw@bbm~nADAN9egbX`)DK6b
zfIL#Kj`FPntU-giI^EkOD}*?HhN8>1dgkk~LbK1F)lfsp@y)^tENx&%;-^YS>ekA}
z^nBV51t-8zm6iG6bTcg`XFx`gH}|f~sl++9>$i&{ywx4EZy(Zq;Dq3uT`6#F;o<tI
zeS|DR;GQQKt3c4j20F|QgF+0XvDR-@w2k|)0mze^#Eweh(y8MG(PtcF%sRa~_&x~+
z#T&ETS{ce)@UKB(T|n6x)`(B}I?v)OQ+$HW5u=b7dVW@4b1tMO8FN*LSS4cG6%%!9
zi1dZdY9VH+*h$D)Lz(pfYK|_AcIsSU)iHFPj1`DN=oDDyq_t*B*DZp*^BJT{D2DG)
zr4fxJMEw<Jh5Dco_!x-N(f}{yoN>}Ch{H#HFCH%j42=e=W+-dMY1B!<jnFM>o3XAC
zyyyTm%@6`puoWyE)!^}-5)v%UY=)BF1--W=!0iDFPI&PxPX-h8TP2Y}OL0I{LbI%d
z3L5vC_r_Qd1xZmnk}i%yT4Cv_?$eF=C9{7+19n&Id+XA=&%BAM{-Wdk)zaOmN#jCP
zmeRhGLvM-*E8+t+DH8hwIP*~Bd4YBBOsm4BFz3=R&agOcF7gS=t;<o9_oQVgSwC5^
zJF!(Qdq|dLKq1>2no}gcqbEU~G~wpcD9$}HgrYe0v<AGf=7%2sY+h@4n$Bj>r7c{D
zRTp7b+s$yNyzTdT&N`;k*$kR%CXp9SQD_5?e*@}z&1HmQ>sxHK7~0A*j1W-~+GHd5
zMBty~p^$m`X%u7M04ygmrBap<Z&>~|3@L!wT_Tmc-)e*BU^FXHCjC+>RYzn>h?E5A
z25wmZV_F%5NSa6i0DYtatdfaiOw_cXls}WNbdsl{YJ6KQbU2SH>pY=I(+DGx=%Q=H
zreN2||3CWeFSq)Z<W;{!{@20&4AoynpI}M~5hxPO#dO-GxNj1u!fiA!+wa};fsc2p
zK)=uJkAHkF^!4=OGWQPl-1g$RwLiaQ`Y|+I9_`LZ*BH{QI}%_Fo1(lL?=CKCUV~JV
zaIq&h!E<Kr%*jCf3qe0OS5#W&Lq}@zF<6k!iQ#k3Fhz-w&-c({zt)q_q7FEeXv>R*
zIMi^pqdC6(G7dFXCVl?-sj`0|07^wMZB2H&BKO<0-CdA6C(p7^_|B;62M1CL+Lec)
zVP~W&6I2QR;!3N)bIY$a*lVK|ZqD}?-{d-P1f3h;oXTQ&r87b;`m6DBkX3BVSz+VP
zv)&{=-N~33A+k0plOrU2c59@r)5YHy^vvf*eI*Nq`?Clk?wLJU(bF#L-^jjriqOQw
zmWm)$^~c#U)7k+~&k2Gp^j{#Ywl@+|{Y}2ZBNK)tWCPB&>{oY>J_KP^-IPT^knuz8
z097qEVF*x$h5@jeI%X^HuhmbN<&(la{p6VQ&3o^?d%Y?iVig>xSE4-uv<n~qZt~Ub
zH@+BfWUgev`aI7HWp9D~7`VBO0|6Mk2mju?i)fFw+C5q7wgjthaOf?Y$b--Q@gIO`
z($wB9+B@R_C0*7d>h|cIwKB^2D}R+r193(^64pF(cpsYve)s94(nUC+t{KX&uu^5i
zugHpMt~m&A6(7>K!VV1IN?ajN6TnrOrRv&BYL_<_DNc0IR1~HJrX=$3Yb|2jga|@D
zXsqKgyh*Y)*G_;q79HCJaYJI>!2>r|z$1+}q7$7B1HwTY)s*ox4R%63RUZ`TrfmA(
zN}FIOlUDvbdBAT640}qA0Jx^ud!PP;!qn#DB=FHh(yne#XisNPkzR+lDcHYVM1lDL
zUERHV=R~~5xQ))>yWe0HKfll<7OZk~eE6RJ=G`;?>OQ&j2Vq3|-&9dmka9%|Pga4e
zIY;M|2D|FjzqU08A-Mm<%3W_h@IC?e;pcCE^x;SEJpIA?9%Yl$42jWd+C~TztobE&
z4gOK6NlAC`V)gaC-m!1!#WT>NsFDQo>49ob-vIX;=bbn9+ZcED|M>uu`+0<bfUN(N
zEO|fryi1vY1h4JPpO?jpvX@xR^L^SznriwMb*ikMqKG#FmQp5~R7Kid=KHQqz6D8L
zr7ZIKLSThrjn9*`s~W0ZHZdn9I#P&4=zI?bEImNVe>mwGd|t+M@08DCpX&IVH1-ll
z4ADQ{@XSYuALiX+Sm-Ln)c5i=0DFV+tcy-p?PC>ehK_>hp~C@t@hE00QEK4uR4uN_
zI9@}CTv-=df8<YgvTbz-iBmD{|A1N<Aj@zVDU<!7xlLI8C(M`xWBWDM^@^bE5ct}P
z0U?Bvmdjg*mkl+_HSE_bF};kPv@ojC1l>JgjUYf?D|$%J6;MEgM@3~FOd@wS2_B`h
z8xm2u6D;=Vd8vF`nE+_GQ7-2W8g=~r57VFTiWjipZ}|4<kwZOzN<QC{g?esLk{j$2
z!ZT`@Uk<;Smjc`i94sxXr@shOkBRW0dIZ|LAmsCGKxAt#3jI8fz<Q~#k^T|6?Qm?M
z%6^>Y@WECYC^yWYZ%h|@VR|JTTH@EBWsDsxac@p0#uCn-k|a20v2U6IX>F28b}uXP
z!lKm#*;*eAY9fij%f07o-X~>A&j$h6inDo5|NY^gWqG*TQ4(Es<~7SC$Kx)Soz6<L
zfpoW`eP<o#=Tnp0wGY7gjNTze&2k*fG(R`mY<FL3BCTmWFJ7|4&PifA5lcOrfvlT^
zk7tr6%$^$`>u0|aCoj_z5jw;`>o^GO4#MJ{X1x}b-~YQ(s@T)Z!>KiK#<{|z`3~!r
z->9;N81sa$tkao;RSD)qzGxQ!Mg2}_y9vfjGb`2ga9fq7$%a@G(_eCH7d6K>uyI~M
zoH1_pPOn|kTg%+%Nk|wbj6Lvld*<jJIMI|rfj4_k{q=OE*Pl4w^Bg)(na~yMHi_@g
zryh^`W=y#MqL{>fIiaWbL4bhCeYyxEF8<}WUrr0?I<H7Nh)RQe0e|=WcqhB0?!b?*
z@{^yM=U;B;!1XhEOXZ*b$G7?a|H(WySEl9MJkvvC5xP4|JVuE|<RD``csFKK0u3Bh
z^tI-g@LT&OQx{doYkK1eydQuQ%`;7n1#V|cNw2({r}_d*rg&fbL5{6l-gsafo#{-D
zPK>u`41o)C&<b9g8tS!pL2>*5BJ7s0J5fblUxhFrt%=Twi%z#2cye{$e!gh%mU?jc
zq2q3JEF(7SH0epZ7A{^H+AfCW0+m`I41%vM#wNM&{H7NXpl1z3sbU`*4k}=%iisL3
z?g_}*8_z_gVccENk|5Gjd&-MkXFDy&sav&=2pB?HKcP)e=XeDD)*H`sXXh4AoZ<1#
zATq(r+{t#?EGQwFZ-#syg~+uX*8$Su<jp8rsJ1pqYHzUs^H)^kM0h?}73MZvMADRC
zqPKt(T8&RlPv6qBj+Y3Twm^igU7;6+XAWvO&U6%nN*5HP*P{X5H+x0HUM&U&gcrd7
z+9VMB;}ceADnZFq=ic9W!qB=u=FKbj1o_zy=lY}-od>Q-5|9Ot*9$&qh&i*z&jN>e
z<NWLnQ<aYana`D3#J1)z=Ck5G_2VqzsukjRoWU&RDVj0Gnr@9{pVOqd8tK+tsg8n5
z2vt*+V`KM*x#P-Opj5*RLKI*yMUm&)R%T~jjW(dfyC$EoHNYrZrT3cIyG#<+ogkH%
zC}854WN3s+L*`d&OT!SjH|B<tn&4RzC2(0M-#mZy-sfF>3u@Hy#u7uX?#BdU5~zYM
zs;zALwCLIv2qcGp1VcjWlCRe;%Az-@oa6+s;Be=TZJFJRY_6e~0b;(;i(o7RT+i)Q
z#|9ED*7B|&;=DOJAxOR3IwD0$v1ciaA~0EdoUN(E;NCba$gWdv;;GPPqd%v^@U#+x
zR7h7%HQ+`Y)Z(!wO<dXuDDs_zPnwj63~24Qx8D8elOO*3fB)d{q*QCPT8(<6sjb$V
zT^TD1R*9w=wx1cTj4uX3$69b5x=_8~wd2^kyDE~PYpvVviek6HS1%h^wMwOYe*FJm
z?<4Szb9Y@zbldiGD+R@4wHkG<+w4@+jHPXXYboOQ+9#Ke@VeZSULblM(qe3o#L9SV
z?fmrY?7Ze47xxn*;hdW1SvVw*n5Y>!`-*kL7RzZATEo+q!XBLM^C}fhnPrHGpW2sp
zurK)pc_#wqKE*A(5!`o6-H`mR79?DOh@=q1h|F-?-4&I^^_O$UPMiQdO-L$hU0(RH
zO$H_eZ_*hztnSfj<7Y-x@5It^(i&cOknE^Q!t=aY!3&0YKI$9D`iKhwV7*kCgkg<Q
z1JL4fp#{QPeUCI83Sk(y3}v1`)t3U83V%k-2|MbaXs_ZXBOiNl*&H1+BEAoQy&O+G
zBY%A-0Dt}P*X9OK5A%<!f@qL<%Ungc`sdeV>K7AY2)XN2L%I}W6bL>m6^UCB1cm<d
zL6p6qtmxYjMd0aUktYWafG6UEGrzfK#xw6jM;HYFcz&n0?CsFUx~JxAO<kOqJ^+vb
z1^@sE!2gjbF5!bu=*Gf<?rhJ{o6Mf6^H(H_BcF_e(L-+vXODtoKZ=Ij&T<HqbZ82e
z(<)&+I;jQa!1EzNBD*tk0z0?$l~c;sJAr@GPP|WoW1k52;E3Ny|1d^Qtq<+8AinCh
zkIffPoO;Q#RdihAw$vfYu|GSd;8@L<6e}-Qj)FbE>Fbqxy!8s4P~86O#<JI~+yy2(
zrTTb%C}$p1)a5e>$lHdU+PX6Gy26jnDMdEpkrobEtw--(_{Fbz7E9P@cm2(m6yRe|
zi%wfYNfvthrRZTQzT7g`5{<Gzl|69JIxCjBz+T(s{IdEe7ue=!dwb3^-Fb_Jhq}Lg
zM#_%uZ|9tISSJq~z6PiR9F+zalvuMBCv@^HE77mQ%YL^fUi-HPOwkoLc^<P(ZovF?
zQGI$7uKa7M$3N!fFFm?T`@>ap`5&(TsqYwT<5s4r{rQJRiSO1jnE52*)~&MVN%SPF
zB7|P*U`hA>CwCaJXK$l&VyDqcTt~{!U?eGeujTmo$=TRz)1*|dH>cKnyJ2H^>ED;+
z!fzREl0~Z1G;7Ov1K{Z7HBIz#gvN2cdX5fyhNCpm%aQP<v4^AprxefpGzpbz{`AJ2
z3~gw|8PwxOerfy>zyMeqLjZXi0Ng9wCkTf^1jCdW2zciXL|jt<3Hu~NMwEcg#3QT$
z0WgGGi0Kw0JvHVb1C?ngU}cC!Ak_c^B+@YhcY!d$3%femoHn{_@%iKj(1>@?UU9Za
zwpXlZ`vll8nV%$kMT>LDHu2)b#~N-nNqr$aWWR^AAXfO9$&AFOyubBmhkG)jK_f?&
z9J^1E<WOAmlEN;0r6NU1R<1k~93r!lyGQm(5`D<YLw2A2(PAyfKgf~4F6T%5seBc7
zBL{7Al9}icE(!N3uc{*FL)_`Pa3`LS*NwBv&pPw`pmald<J1#;`YaZP_o|4cpG$kd
z{xUrGt0moX%;%0b5WkQ2gs;N_-dj4d)mbR)6Op1#j~x~^`+eEkZKV&ru8eP7@sfB3
zO#7vE#??<mD**T&2E$Ln{Kq~G3ON%9x7=Go`*nEaXDf)faMkItE>ENv{{B@WNOb!}
zq^Hif=DOAXB$aD;w_d-B(q}E%<6dw7x1NIi2R<)GoP#QC;xFE2W0Vra5ffzwepcmw
zlBGDpTZe56Q5xdiwo9e)sn4X(KUV3e8+MqWwNsFjb_tdtQ<h_L6W<tj$0u?dm)24l
zvqZ!HFBWqM36T*6?wR)93`^!L;piJgs_|6$(Ftadv9cjlM1w^z2ocJMoJHtx(=C45
zJkaP{P5$eOdM&>9{lpYogc!&SF_Ag4h~gy8Ai{()F7l$Rq|&CgP3t<}4~yk$y*V4F
z3l}e4zH;^2^&2-43`j<%2>h8@%5hb!Eq$&(wwN`z1V^Rtma1wH>`|#Wb294<tM$q!
zhJXg)D(K5VZZr=spJF9Sm0^^t;1>{7sY<mPA+_qvQ!lLH>*qVP3=iq}g8C0wrc>8<
z)c<<`7#x8_p)pt-o<Jm#DO4Jr!DO*HTpnK_6p1BLSro`dziT^Qjw+NYwMMJc8;mBi
z#cH!VRy2uVuGc!>uZ>JN`u=>%t|t9P%csZXMtwHiI@or!5fMWrR1nMYtBdcy4bcOK
zneFcC8uxb79)db#{iS}_w{Qbo#dbQSp#Cs882D&6V&1_a5gvxQ+9haF%MxIif5Kmc
z{r<8)igbTJ4)ivW>q<gAFDU-*P%nq8o${7RQnv)zsAJ-7n>&w6wG-LQLJ3&FK^+Jm
zwhV9;A+AR{Yp8>QM#G2{Wx>fr>ZHpI?Kwdh+b}I<9U|yK2ZvNLMP=^Cn)wirSlpBg
zJ?@ioX1<5@HXQk5b)a@Y*VOSgL8MTVh7A%j5(>sz$i_*rmb%y4_nSiNG^4ZXlGzBu
zxRwNHEk^Iq%jzUQ1f@yrJn!fr<x*+aIxcU?e3W6d5&#mgDyJCVial40Ysb^MZDUUx
zw&hwTBE~SFMzdE!GuPcu=$iOENn|BkJS0;Os(g{shOnfbu*pK&8*xpwS=|d`U!caO
zVxubEHM!>-iL1}c_1l}<+mr&+^5Lac%f|J27Fzy1b78ZZ=G$vgdvKD`$4AI0rQ^NW
zUpjkE`r~Q1<`+tJre*z+Z9GcTh_8bm7u5X~fhrZD(STO<z;0ASsksFf#rXm0wm2Qc
z8K5pO?ete5>*N+~3_uJ%D^gr@CfDXip>}M{w@3~kWC+|NwYdy}rq^>-SWJOe?bb;Y
ziGkPKNFSu?<CH0CzK?_n(x!t$;xbw{MutZWvOo}r#sS+(kj;2VIIJ*=JBAm-?gm~!
zNGOosQw*SCimy9Wxj-jtSt9ZRoKtc5J(Tl@<=r60+OOTlu`^JXP&E-E#0awiQy^41
zAd*&j@kecG%FWkDUon=-Q}SDMWB@=;Oi(4DdL`*t1<=g_Va;o)q|N|BD+87E^;B++
zVqphfVI83Ab8IJ<f_`_}H&7V|K>CQP2vljH5+2N7;A&WMZzL2w+5zZ(M7R7#6{n{O
z#Gg2m_0_4i$&Rh`aPMh<twS>o@_w~no*f+BY=4#a0l=5TrDx304-D6ZQe>7&SxLrA
zE<O9~BdM(Tz_;X$v}4IHnAIhNRaprFz=NU0ff2JN3Xu>y%TZtdmJRCoLU{O+hlSe#
n2(9rG{s=Adns=eIFL+JUL&fp`E2sX)l3(vv|4&*@ZUg`T;X1QK

diff --git a/apps/marketing/src/assets/fonts/jetbrains-mono-vietnamese.woff2 b/apps/marketing/src/assets/fonts/jetbrains-mono-vietnamese.woff2
deleted file mode 100644
index e38f5538f84e920b822eeb9a3dd3ea1e20bc1797..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5888
zcmV+b7ysyYPew8T0RR9102crN6951J06*ja02Y`40RR9100000000000000000000
z0000QffyTx92|lc24Fu^R6$gMASWIGg9I;35eN#fK&NsGf;a#$p(X(~0we>3C<Gt{
zheijCP7DVd6gd^+m{q{W0T{@)%gFx!l0fBf9Zw5B0bAn`U8%UUEv~&5r?zu<o?Un3
zPJAP8j+-Tn!BCV2VU8PaSq(+^)4J$4YH9(|lm)RI+8`hxe_>FH*nES2w}%$lk{PQV
zA<3){&u{b3eeY2@)`%bu0~EnVCOovkLYa(B6dMbyJ#~eXCHvX!FMo7M5#44F^}#|5
z#1qQX^mzLJ1KQk~_eJ-t(TeX0GK?VPima=3bM;gD5CfnrO@|i$r_TB_!zhe|1O^9z
zkqH|^=<Z$7+!Yl<;CEGZ)zu+&+r@Y|B-viUT3`l&2=VXt&E-tsVE!hD^n8s#ArF9r
z+)`{}TXuj>)8d>vjYz4aWy!{$QR_GUial^b^X{bpP{2h-i|p@hrtN?G_Z`@leH+wu
zp`Fo%p#LXhX}6gaWhz&DU%UGSUL6^vL+L_yMuE@3(h<oH5y@r+WpkN|x=arY6=2h(
zOwpxHmvm|ROuDFu)5#7De-$z0i*LF;JI8<>VOLfXFLhm^sIG8=+xwe+vFic>4YekI
z7Ya%QLA8xu*(^;-XIAnQE2SKYQ@!HlS2}D{g8G#~6H46lA?M7Yv0%5dPf|JT*xm%d
z21N?y(I&vR-%mk605>-f0AggaqpH7r9gvTG&rCoL1^~`h{LhSo5CDP2$b1?Sf>4iE
z9f}G^ilI5X7vg9RD3Bl91t-DRXm?GQs879*^4^TrLiM7@wVu-RgAh1#H-a8oF2GiT
zCguQQ002n@G_lm=0u(|r6q;02X<#8Nr7LZDt*nU#E2Vdf0Tm>~eNjz8x<^w`CEY+b
z(`;&^#neL^X%h`a_mKk#HxLAWZn!9c4^RtkaOBjw{7r<&sg;g4%9hH&M@<}Hsiwdj
zITS3R;u&HTs68&6Z|Y3CMFFbs$9Noan*jg?fCeAKe3eg*A1faK1uZdX5M&~_5<md(
zKm#B+9f2AFz<>gU1Cnqo&rcu(g%N^FWl3_z5l0;p#cEKaj|=pfpAo@Abvyxq0CV%Q
z<@@ZHu!y08P7V*Cjx`v-+peC3W6vE>fC$YI_0R&Ku))R)z{6zv-{jx_%kbSwmQRq2
z{(S_>)Rh2wJdot70Zlrq%S3TMhi3?Y&)4M>#p;H2aI?^o>QyPC474p^PKKNuQ1{0U
z69KIU`JT7N(8~{1QbC_-it@;>0eKXIhD;?1n_7TG**@OGc^CjFtvLnQa=YP{ajv|Y
z25A+B#1ENCj{yVOXV1FWBhf@9N7N;59-$dpL>oW;(${?;WTuExwqX~$X`pFZ_@Ea*
z$Ec3o>#QdH-$GY+w-E+>@E|~@O|*3MGGqcU=+FOt02)q84bp5=Y=TKQt6_5z<fx-S
zJrO)4s3t`X8ET19g~3*QxCr1T1dE4C>$TdT%|?D|UK&l-YPL>`HGH%JHtUe7%NAkj
zf($}3>|nH$-ga4f<mi>Fk6FKL5qSpX8&V+3Zd9Q$MaJ2TC^M;4T)8O@(+B`13IrMq
z#Cr}onZuR&=^!AC8%HFB2jsg(O89%ru|!4$q+g>%4g#`D0RT7;08$cQCoo*V`y^nV
z3}|ftfCjbNl!TlTbFe}bEooR(VklUxjyAfe5g~eW#SAErvIlC=2CS5!Y4J$ZQleDS
zweF-{G*&^*wTdDiLM1n6Ik)0<TUOXDTd_sCYgKzB+>#ZJPJ~NgD;~EM@v{5G#lz(=
zY{!~8_F}Iv#!y<)=%e*aL)Vb*V`YarHUj)5>I#0Og@D=gNF*ajiW*{M1j80~NG#CQ
zr@!D7{x?>uD)(XiHo-k3sF^`mj|^z;X(+@ttdU3L=nBl_fs8PF=sviav;5Kybd2U}
zwH^cPed0q|V#E_AEV--N&1iTi@fMZrtqA3!#ZnT)16>CJp9NQ1$PENVap$;e_<{af
zi#uSL!j55c7$GwOyY7AGQOC|E4A*-KwEN~5<-1(D<^MFz_Gk)D!e*Y>g*4cq<evN9
zU)kFbEOa$XS8N~MLUY_kqsh>eR%7oI<7z>0zud41jNjiyp@K+W<PQvAU+n}tLGO6<
zy!unMBwU|Xc2CRR=(vmO7Mi+^hK^NSkEjMcRG&IM^{vM9f?91f2JV(5!_3n=;b}r=
zWTf4zbRAT|+f~eV?AvHewDYMme{m@`Gkm?&qnN=GwHlM4S!r95XqRjEYH?Q~mA$ag
zVW86zZNL3~7e9$w*L=NAWy-AeGkUT<6qgo1)j5~7b`-;A9a_13rORfiaIKmh7T6zn
zd;b2ncUT{JuTI0t?k@dsH4)HiZFc{oX!dUKKGD4LK;2+*S)|HXRn|MMq^`H6&(ql8
zF|zGu_Mv~}a=-WE?6z#$>qpdoM#&leLuGoHMV_$D9%dUo_Ac>ydJbKzm$irIVOuLI
zJ(Z1>T2<k284d4vIB9{^C^M8^Z>xE!U{8{l*(@3yjYrfWwbN0v)mc&FoFjTiVz~9}
zcp-NZ9=LRk4X!5Md3t!V`R-TOumAY&6U<$kCvgJ*6z#sCuc@yyaBXSflVvtG+Y=Jj
zPPcb<k4HKdf>Fiy&Yd+SweB{Tz4_`qn>qheK;-Wp4-a&Q$J?u08Y(p!vgh5<N+_z<
zxLWGBG?i_wsSH)Nj%DS}DtE}8h444;$P2TG?I|n@yUuhMb&X!Omu;6jvaOh9tG5>Y
zy6Fk4XIis7TUd8Z*#_AfHjRgX|FHwt`kCc>{MIh;blVEpQ$3n`J=UR%J&i32&%?G<
zu&n!3cUx8A@E8pdNWIKvsK{sHk~__M=q+C6Tv7LAJQ5CtD_zy4W$x<A`FbMLacqBT
zXw{A#yv&+*<LQpyWZZIF>+8>%{rlT{9(1`LY~|V`^0xuoJUPk13uAv<Y`whowU;I<
zM+Z8);~uXi-ML573~9QIw6qM}*!iEX5#}R?HgESE4E{&B4cW=5RR4GiuN9-I$V3Xe
zlE+f*sZ?KEQ%e)f`|CSf*t)FM>>Nc_9gF+N<WXJ6c{3^*)H+s|r^?1)`H!CmLFxjp
z+Y6G^y(-h_TiK}TbEBR&4fArev$XLx+jiBcPs>$OBdf|SPb-+tEzeN>*p~7vuQyuD
zD&b@GWrWhGfAKYC$Ir{QTF=hV3XLBc^L}4fouf8=FfVT~z1Fd_F2zkP_Hc_!3x+vv
zcvD&I=AKW<@UE=X$(l`i*^vc9xFA{IIWL=Dnrp60XB|s6yerc^bAFZle?@`SWV>?p
zo?&09(-m3coIidJ`ngnM>S(ItSZbi9skI4@G_B(}ds0`wA6NeI>;$orD(ueE{7$1}
z=D1;g)mdEkiDd(+=~t4nlE0Q5=6c4tBF^otan|YsdYhpst97ofn1!lPy5uXRkn7`m
z!W<Nz#J?C43dIf1$fl>)%XTmPQ5-f@zz*1<$)>YKsq_n8y+I{Y$OWvxB+b#E@aP39
z`H!;lIe&}7QgWCZ9On|;7Lv`^!*Tsn++|DN(@j<J|2ZfX9!Egmrj_mDZ1a7q&g%Np
z&W_QTlbRk+)UR!zxxTd?lnDd?A4y$jKLmiBMkq>B4k0jTQOus+`3$gUvS)RFkj<XW
zo`dHmP)!ppKmux9>p^u|KF*SrRh=|ujI+U>)0=at>`~ugAKjF)2xB{{=3xol>r}`(
z(+IFSRwwH$F+>Dvs!VENh6QX(Zwb}1N%|cvCQR$MW}1Ktot6))FJ<XtE2vx!Av#)O
zTNDc(Tf&ymij=)PG^PNU4h++IF_3Z`hCP8jk(@+u687-e?8)pYC*f33eF@X0QB-2&
zMhg&N8?mt!R5n5PLA!>*^9oBb;3P>cw@ZpHomwQwotC&0U^}t1C8_}JuH3D$W>{d@
z!dr>dLHmA}2P{BXI-IgwhcOmg=?+_XO{>cxVIVeBfJGPAg2~1(cK>j#>ra>e_rqRP
z?FIW*sPWqGR<t`?^6zqMc3VcDhbTN`>q_k>>E}Q{2)Qe14RH8{Ax#WpEw_PN5|xl2
zx`I5gZF$-)3GO8!2;eRUw`lSsG>Q7u`j+8SQ#}p-Tx$TA4|z*MoBz8)K4{B@ZQq@c
zza9o~*}8?Q!DCDb6n6!ApuqqxYoM&90xWdR)q$5v7oX6{B`r79z*9{yT(ebRYs(Yh
zkU)NE3}Ar6O+yc9(5-=;X<Axfo~RrKEa$%NNFv07e57G#?NoKzCR`mNWJ%{9O|*RH
z;8b<No^Ew3tR=OI6s18!O#|`Sro!_7dQuPo1Oy<yoCg4D4gjp9l_6WcA`Wh~eEfpK
z`i(m3Y!|xRwQhE&`#tJuZ+hQnzDZ@hG)6hBiaCv$GH0KpV=i^I8@=oe@A}x6zV~ZI
zl!98@%{A0le}nDrKu0@Su6w)Gqdlo-^t?XRpZZ7t8%>L71-*8gXP9-Rt6a^-Hnq9!
zTXM&C^3L4TdvVKK*@ydl{~yDMncTBo*}1OfeCNM`8@s8Szx_X-k~iH`_r|?{pWjc9
z;$=MZbHA21^kR>D2i|G#wztRdFMUNPX;aXJJ;Dz{OxPowE&L~Z6g+WAydVa}VR1?P
z?F1l@AeRP+IR9siuZzQL%xT`o=n=&(Dzmeo>l07@dgQMsCTtpzlUXWt%Z-owegixZ
zrsbh)mulEEpFKD`8ym@PVA1SIY%JDy-TiUHHq9C1HtjS#U8R<M1beL0y)RFEHjfN7
z2ozz2sms>cn>inP6PezowPU-)$j{4}b&Qljcf5jEI}$`D(oHVlJ?#yfEq9JZ+!jdj
z(LLi5)TRpSpr*47+ZLrV<2)$D1KwaVg`GQ7+p@Wr_=lb2EVa|l4&0B}T&XCk0&?JN
zWg?*T9tY)dn%2u@#qHn0`cOX7oKa%d3_$fgon%``)GR?y?ZVBG(k-OPMF}{3+LWTC
zmt0OH)CSoO?jZZkUz?e6w=`RTsm$KTP18<5-4bqG$fz?HS}pbB9l6%b7(p1JXI>NZ
zD;^_)2|^>4m6iU`--#+@v)?!gClb@2W|WEH?3TP3OR^j+e*8G))C+RpgGbj7HJdmR
zp?@*}v2=Dx?BIHMowG1Q;><Tc|890_YIJnaUSX%dG9`s8eNDGx8s{a82nuf%P*Agg
zm7<yed-kLlpMA!~r#Tzj<5}SCv2eL5hguZ}4wV*?V+Jt~u8~@~JQOA~_Ei)%vzoUT
zDG?d>yM>Xi&+BzIyq*V7FeXCCU;gqpSmYtWK3kF4U>a%+d9G(J)Av1veQ+m<HwsZ|
zkAu-2q|#Zxnf4%%qKudXUYUg+=($GS9_#h~@+3ciF}7)&l1O?xcBCYK?v?yi=X@!(
zBVl;lz^11IkPRnqz)~6u<pNM4cW}2+bH|^vLQ&)`kYw!|s!foDKZ3Hc-SCcKWCXIm
zc{Bn9A$$z;HVuj_WV507zu(FA{mX@FwYswqmW9Ob-3b8@(6US{AQ>+1Vnz59BDUoY
z%+EIbZGJY}X!iObvYFHdI{__A`0>$^q9c#`$I*?>ZHs~X6E+>gP8ayexx8QdZ<wm}
z!zB&dLqgD{?F|r31lLlyd-fPKa9)>tHXqPrNj98ERS<5rNFf1<C1aKON|$z(RT7Di
z)z{=#{_FNDz7&&afJnCqWM(QeY9DrYoz5gdTfMM2ml|2^DRvS3qK6pUFA9J#Mj@Q1
z+=;P@Ap`*^Bhbrr8pxAgx7#a9E)U)WOb9NL_`zg5>3P*<$8llF^LSS;7#K3jh6l#U
zj3h`{9!A%J+&GGRSDJvg;wkXFJ}aXPjcU;L8zAykLfwEDlf9YUK#~G??q>5K90u>T
z!)Ip@!GF}nxPLQPcga{<SptGFA_yU=C@<je06Jq*XVs&$y;|$Q-M1#lM*`0?47uNQ
z99<9fdg-LSs8hzGrfEhQqhM~>VA|B9Ha~^2bgFnNP^-7-7_=QnQsaTB7R@X^8Xg)=
zj9j|6%8WH;G8Pq)Ziiw`$C3LKq3ybcA%_U+_W%`UbKi|lr-!heMzy0s0F<f;%|fLV
zf>tZ&6=K~k=QNsTg_)e%8M$0sY87PQ{(v$4$S!AYbff{Q{YzF&?~xnEITm(=@<Sm;
zM@{#<+?ow_Yje4EBJ)}oVQ7QI=1?W#`y~#X>Pb*7G4ppL5}FoPm^z9gV|sE^!RD>o
z$d>wzDQ%A<n=?VI<tK(3OaK4hXw(}@eCAwkNU?!hKrMw(s>a2w4i-6A!Io}g)GP3~
z7P1S@O#zy}&{#0<&^_w|%Pk3KjBz4fguqtnwFd4`f%58drNTBXu6@~Wu73AC#{9*E
z%(<=)3=)B&9$+fOJ2(%TtsaJMK=eaOwx#qqm*XXgfu5zdfqG?G%G~d9k>8sIg~%$J
z%Oa&>pXX5;-d$DqyOQ7&CPE_5EdsWMh6X}19r{5)2RBYxlc7Zje5qQgVyObpcis6p
zo(H(t>ueHt$a%BP;Go*-i)nGtZd-sgY(4<q7h3!G(AI8+vmp_(2mtW)&9CRSTmI!$
z4OoA3e<J^8Z2|b8000E|_qzxx81a9<0%s6{rfGhH31Oh@&mbPzerM6q5gZkv;TcB<
z3!&dj;AT{WhF8ks{z8DgK69sKoa2?})ou5CYu^E*i8Tj2Y~r;O0O!fWpbY~8z(=EM
zjjtDrF(Lr>kG@t3w8N+r<m7jihO>KB29{1#dDzs9%13UE`^Zs}<^Tkc5~0P&ai}~<
z@vq8<5WlJdsC}$TP~=8c3cEe34EdT>Im)c_D1hQ0r!ryyelg=BCN!84F(#@{qX9EK
zrbI+dnARj_LW~-pr^cL_aL^-G)DQhtdlG|92HZ6fHEWy<{yQ^d)|iMXg`!Omh0ge>
zA;V^#HRl*N&B0ot!9G)gVBE~2<eT=4$xAb4$`Gp-wS2mgt7+P1z*LAvoAm7Rn=`Yq
z@k{l!GreGxtMES0Yr8~GbXp&A=_)aC^QLBoYxNa82lYA*Fwh3g!B$hlv=IaPxYexL
z8Rm1xN!@49cJ+{GFgUCC>+8#FPu2*%wWfPa4hqfqu5Q@@1pgD92gvkH6rl-2c!W;`
zL`XzLOe91~WJFFB$WBQ`Z4HgJ)>$7*8*H>G_BPW>qmxe0AcIk+EljdfR<<0u%q;Tc
zvnq%)8@ob9sjgUwQf10HRB+m=l8YOQpgxZ()oRqLQ?DU!*2v2je@&XTXw}BAU59{e
zIt6V{u#g>g>JrwiM?`OS)~DZq!O&#Lu&5EE#*91QgqXNVQ>M+BwF_s?yal`MvDZHP
zB`i8%Nzy@w9CpM}$D|w|_Pn;gZ8rOk7))qwRv;jeS&l)60u>sB#YkG6*M0dJLk^Ri
z00I)3*{nh%JDW4jRod{6myPmC9)Jo7GILYtnukTpy}xb&+4utkofUi*w8%~)76GOe
z;`t*1jUk{hH4SX%`6ElW|KHqZ-xBTVR2unPU_^<C6uAlXC{d$DG`Vt|<RlQ0%G_o(
zTG`v2J)KUYIY2~>6gf)tW5-1dEmHIt5s{BA7qh4l(V`zGrnBSlbRMNkV6^}Srd2!d
z?``kaQc$*17L3F%;61H~<omfd{1&klqS#1+cTv_1_kLck?yO_#{(e5+=js`w^Dp*Y
z+TQAYeS8yE9V6k6iqbY(f}gU|F|G*thmDJYRSA_eov~wq)kuM`$O5ZVX)o>C7}IwP
WADn8I>W@j`6r5^GWB*o5H{S_n@f*(o

diff --git a/apps/marketing/src/layouts/Layout.astro b/apps/marketing/src/layouts/Layout.astro
index 6b4bf819e2d12..d1aea12f09bc9 100644
--- a/apps/marketing/src/layouts/Layout.astro
+++ b/apps/marketing/src/layouts/Layout.astro
@@ -2,8 +2,7 @@
 import { getImage, Image } from "astro:assets";
 import appIcon from "../assets/icon.webp";
 import socialCard from "../assets/social-card.webp";
-import dmSansLatinUrl from "../assets/fonts/dm-sans-latin.woff2?url";
-import "../styles/fonts.css";
+import "@fontsource-variable/inter";
 import {
   ANDROID_PLAY_STORE_URL,
   GITHUB_REPOSITORY_URL,
@@ -58,13 +57,6 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
     <meta name="twitter:description" content={description} />
     <meta name="twitter:image" content={socialImageUrl} />
     <meta name="twitter:image:alt" content={socialImageAlt} />
-    <link
-      rel="preload"
-      href={dmSansLatinUrl}
-      as="font"
-      type="font/woff2"
-      crossorigin="anonymous"
-    />
     <link rel="icon" href="/favicon.ico" sizes="48x48" />
     <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32" />
     <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16" />
@@ -153,22 +145,21 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
 
 <style is:global>
   :root {
-    --bg: #09090b;
-    --bg-elev: #0c0c0e;
-    --bg-card: #111113;
-    --fg: #fafafa;
-    --fg-muted: #a1a1aa;
-    --fg-dim: #71717a;
-    --fg-faint: #52525b;
+    --bg: #000;
+    --bg-elev: #0a0a0a;
+    --bg-card: #0d0d0d;
+    --fg: #f5f5f5;
+    --fg-muted: #a3a3a3;
+    --fg-dim: #737373;
+    --fg-faint: #525252;
     --border: rgba(255, 255, 255, 0.08);
     --border-strong: rgba(255, 255, 255, 0.14);
-    --accent-h: 250;
+    --accent-h: 264;
     --accent: oklch(0.68 0.17 var(--accent-h));
-    --accent-dim: oklch(0.68 0.17 var(--accent-h) / 0.15);
     --ok: oklch(0.72 0.16 150);
     --warn: oklch(0.76 0.15 75);
-    --font-sans: "DM Sans", -apple-system, BlinkMacSystemFont, system-ui, sans-serif;
-    --font-mono: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, Monaco, monospace;
+    --font-sans: -apple-system, BlinkMacSystemFont, "Inter Variable", "Segoe UI", system-ui, sans-serif;
+    --font-mono: ui-monospace, "SF Mono", "SFMono-Regular", Menlo, Consolas, "Liberation Mono", monospace;
     --radius: 12px;
     --radius-sm: 8px;
     --radius-lg: 16px;
@@ -189,7 +180,6 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
     background: var(--bg);
     color: var(--fg);
     font-family: var(--font-sans);
-    font-feature-settings: "ss01", "ss02";
     -webkit-font-smoothing: antialiased;
     -moz-osx-font-smoothing: grayscale;
     min-height: 100vh;
@@ -197,17 +187,6 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
     line-height: 1.5;
   }
 
-  body::after {
-    content: "";
-    position: fixed;
-    inset: 0;
-    pointer-events: none;
-    opacity: 0.035;
-    background-image: url("data:image/svg+xml,%3Csvg viewBox='0 0 256 256' xmlns='http://www.w3.org/2000/svg'%3E%3Cfilter id='n'%3E%3CfeTurbulence type='fractalNoise' baseFrequency='0.9' numOctaves='4' stitchTiles='stitch'/%3E%3C/filter%3E%3Crect width='100%25' height='100%25' filter='url(%23n)'/%3E%3C/svg%3E");
-    background-repeat: repeat;
-    background-size: 256px 256px;
-    z-index: 9999;
-  }
 
   a {
     color: inherit;
@@ -238,8 +217,8 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
   }
 
   .display {
-    font-weight: 500;
-    letter-spacing: -0.035em;
+    font-weight: 600;
+    letter-spacing: -0.03em;
     line-height: 1.05;
   }
 
@@ -265,14 +244,14 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
   }
 
   .btn-primary {
-    background: var(--fg);
-    color: #09090b;
+    background: oklch(0.571 0.21 264);
+    color: #fff;
     font-weight: 600;
   }
 
   .btn-primary:hover {
     transform: translateY(-1px);
-    background: #fff;
+    background: oklch(0.62 0.2 264);
   }
 
   .btn-primary:active {
@@ -301,7 +280,7 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
     position: relative;
     border: 1px solid var(--border);
     border-radius: var(--radius);
-    background: linear-gradient(180deg, rgba(255, 255, 255, 0.015), rgba(255, 255, 255, 0));
+    background: var(--bg-card);
     overflow: hidden;
   }
 
@@ -419,21 +398,16 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
     align-items: center;
     gap: 7px;
     height: 36px;
-    padding: 0 14px;
-    border: 1px solid var(--border);
-    border-radius: 999px;
-    background: rgba(255, 255, 255, 0.02);
+    padding: 0 10px;
     color: var(--fg-muted);
     font-size: 13px;
     letter-spacing: -0.01em;
     white-space: nowrap;
-    transition: color 0.18s ease, border-color 0.18s ease, background 0.18s ease;
+    transition: color 0.18s ease;
   }
 
   .nav-stars:hover {
     color: var(--fg);
-    border-color: var(--border-strong);
-    background: rgba(255, 255, 255, 0.04);
   }
 
   .nav-stars strong {
@@ -492,7 +466,7 @@ const canonicalUrl = new URL(Astro.url.pathname, Astro.site);
 
   .footer-links a {
     font-size: 13px;
-    color: var(--fg-dim);
+    color: var(--fg-muted);
     transition: color 0.2s ease;
   }
 
diff --git a/apps/marketing/src/lib/site.ts b/apps/marketing/src/lib/site.ts
index 99cc56191659c..5cd1337d141f4 100644
--- a/apps/marketing/src/lib/site.ts
+++ b/apps/marketing/src/lib/site.ts
@@ -7,6 +7,6 @@ export const ANDROID_PLAY_STORE_URL =
   "https://play.google.com/store/apps/details?id=com.t3tools.t3code";
 
 export const MARKETING_STATS = {
-  githubStars: "24k+",
+  githubStars: "31k+",
   users: "500,000",
 } as const;
diff --git a/apps/marketing/src/pages/index.astro b/apps/marketing/src/pages/index.astro
index 883afb9752468..d3f12d8541946 100644
--- a/apps/marketing/src/pages/index.astro
+++ b/apps/marketing/src/pages/index.astro
@@ -89,11 +89,6 @@ const mobileEndorsementRows = [
         <div class="hero-preview">
           <figure class="hero-screenshot-frame">
             <picture>
-              <!-- Match the hidden mobile layout without requesting a screenshot. -->
-              <source
-                media="(max-width: 820px)"
-                srcset="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"
-              />
               <img
                 src={desktopScreenshot.src}
                 srcset={`${screenshot.srcSet.attribute}, ${desktopScreenshot.src} ${desktopScreenshot.width}w`}
@@ -285,7 +280,7 @@ const mobileEndorsementRows = [
           </div>
           <div class="pr-foot">
             <span class="btn btn-ghost" style="font-size:12px;padding:6px 10px">View diff</span>
-            <span class="btn btn-primary" style="font-size:12px;padding:6px 12px">
+            <span class="btn btn-ghost" style="font-size:12px;padding:6px 12px">
               <svg width="12" height="12" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M12 .5C5.65.5.5 5.65.5 12a11.5 11.5 0 007.86 10.93c.58.1.79-.25.79-.56v-2c-3.2.69-3.88-1.37-3.88-1.37-.52-1.33-1.27-1.69-1.27-1.69-1.04-.71.08-.7.08-.7 1.15.08 1.76 1.18 1.76 1.18 1.02 1.76 2.68 1.25 3.33.96.1-.75.4-1.25.72-1.54-2.55-.29-5.24-1.27-5.24-5.67 0-1.25.45-2.28 1.18-3.08-.12-.29-.51-1.45.11-3.02 0 0 .96-.31 3.15 1.18a10.96 10.96 0 015.74 0c2.19-1.49 3.15-1.18 3.15-1.18.62 1.57.23 2.73.11 3.02.74.8 1.18 1.83 1.18 3.08 0 4.41-2.7 5.38-5.27 5.66.41.36.78 1.06.78 2.13v3.16c0 .31.21.67.8.56A11.5 11.5 0 0023.5 12C23.5 5.65 18.35.5 12 .5z"/></svg>
               Open pull request
             </span>
@@ -327,7 +322,6 @@ const mobileEndorsementRows = [
   <section id="open" class="sec-open">
     <div class="container">
       <div class="section-head open-head">
-        <div class="eyebrow">Open source</div>
         <h2>If you don't like something, fork it.</h2>
       </div>
 
@@ -406,7 +400,7 @@ const mobileEndorsementRows = [
 
           <span id="cta-download-label">Download for macOS</span>
         </a>
-        <a class="btn btn-ghost btn-lg" href="/download">Windows · Linux · other</a>
+        <a class="btn btn-ghost btn-lg" href="/download">Other platforms</a>
       </div>
     </div>
   </section>
@@ -489,12 +483,12 @@ const mobileEndorsementRows = [
 <style>
   section {
     position: relative;
-    padding: 96px 0;
+    padding: 80px 0;
     border-top: 1px solid var(--border);
   }
 
   .section-head {
-    margin-bottom: 56px;
+    margin-bottom: 40px;
     max-width: 720px;
   }
 
@@ -505,8 +499,8 @@ const mobileEndorsementRows = [
 
   .section-head h2 {
     font-size: clamp(32px, 4vw, 48px);
-    font-weight: 500;
-    letter-spacing: -0.035em;
+    font-weight: 600;
+    letter-spacing: -0.03em;
     line-height: 1.05;
     margin-bottom: 18px;
   }
@@ -550,8 +544,8 @@ const mobileEndorsementRows = [
     inset: 0;
     pointer-events: none;
     background-image:
-      linear-gradient(to right, rgba(255, 255, 255, 0.035) 1px, transparent 1px),
-      linear-gradient(to bottom, rgba(255, 255, 255, 0.035) 1px, transparent 1px);
+      linear-gradient(to right, rgba(255, 255, 255, 0.018) 1px, transparent 1px),
+      linear-gradient(to bottom, rgba(255, 255, 255, 0.018) 1px, transparent 1px);
     background-size: 48px 48px;
     mask-image: radial-gradient(ellipse 80% 60% at 50% 40%, black 40%, transparent 100%);
     -webkit-mask-image: radial-gradient(ellipse 80% 60% at 50% 40%, black 40%, transparent 100%);
@@ -574,10 +568,11 @@ const mobileEndorsementRows = [
   .hero-sub {
     color: var(--fg-muted);
     font-size: clamp(16px, 1.4vw, 19px);
-    max-width: 640px;
+    max-width: 720px;
     margin: 0 auto 36px;
     letter-spacing: -0.005em;
     line-height: 1.55;
+    text-wrap: balance;
   }
 
   .hero-actions {
@@ -622,7 +617,7 @@ const mobileEndorsementRows = [
     display: inline-flex;
     align-items: center;
     gap: 6px;
-    color: var(--fg-dim);
+    color: var(--fg-muted);
     font-size: 13px;
     letter-spacing: -0.005em;
   }
@@ -630,7 +625,7 @@ const mobileEndorsementRows = [
   .hero-mobile-line a {
     color: var(--fg-muted);
     text-decoration: underline;
-    text-decoration-color: rgba(161, 161, 170, 0.4);
+    text-decoration-color: rgba(163, 163, 163, 0.4);
     text-underline-offset: 3px;
     transition: color 0.18s ease, text-decoration-color 0.18s ease;
   }
@@ -679,15 +674,10 @@ const mobileEndorsementRows = [
     width: 100%;
     height: 100%;
     border-radius: 25%;
-    background: radial-gradient(circle at 30% 25%, var(--tint, rgba(255, 255, 255, 0.08)), rgba(20, 20, 24, 0.92) 65%);
+    background: var(--bg-card);
     border: 1px solid var(--border);
-    box-shadow:
-      0 20px 48px -16px rgba(0, 0, 0, 0.65),
-      0 2px 0 0 rgba(255, 255, 255, 0.04) inset;
-    animation:
-      mark-in 1s cubic-bezier(0.2, 0.7, 0.2, 1) var(--d) both,
-      mark-drift var(--dur) ease-in-out calc(var(--d) + 1s) infinite;
-    animation-play-state: running, var(--home-motion-state, paused);
+    box-shadow: 0 12px 32px -16px rgba(0, 0, 0, 0.65);
+    animation: mark-in 1s cubic-bezier(0.2, 0.7, 0.2, 1) var(--d) both;
   }
 
   .hero-float-card img {
@@ -701,17 +691,13 @@ const mobileEndorsementRows = [
     from { opacity: 0; transform: translate(var(--fx), var(--fy)) rotate(calc(var(--rot) + 24deg)) scale(0.6); }
     to { opacity: 1; transform: translate(0, 0) rotate(var(--rot)) scale(1); }
   }
-  @keyframes mark-drift {
-    0%, 100% { transform: translate(0, 0) rotate(var(--rot)); }
-    50% { transform: translate(var(--dx), var(--dy)) rotate(calc(var(--rot) + var(--wob))); }
-  }
 
-  .hf-opencode    { --x: max(-300px, -19vw); --y: 20px; --s: 64px; --rot: 6deg; --depth: 0.6; --d: 620ms; --dur: 8.5s; --dx: 2px; --dy: -8px; --wob: 3deg; --fx: -40px; --fy: -80px; }
-  .hf-antigravity { --x: min(300px, 19vw); --y: 20px; --s: 64px; --rot: -5deg; --depth: 0.6; --d: 580ms; --dur: 9.8s; --dx: -2px; --dy: -9px; --wob: -3deg; --fx: 40px; --fy: -80px; }
-  .hf-claude   { --x: max(-560px, -38vw); --y: 128px; --s: 96px; --rot: -8deg; --depth: 1.2; --d: 380ms; --dur: 10.5s; --dx: 4px; --dy: -12px; --wob: -2deg; --fx: -160px; --fy: -40px; --tint: rgba(217, 119, 87, 0.22); }
-  .hf-codex    { --x: min(560px, 38vw); --y: 128px; --s: 96px; --rot: 7deg; --depth: 1.2; --d: 460ms; --dur: 9.2s; --dx: -4px; --dy: -10px; --wob: 2deg; --fx: 160px; --fy: -40px; }
-  .hf-grok     { --x: max(-440px, -30vw); --y: 440px; --s: 80px; --rot: 4deg; --depth: 0.9; --d: 540ms; --dur: 11.5s; --dx: 3px; --dy: -9px; --wob: -3deg; --fx: -120px; --fy: 80px; }
-  .hf-cursor   { --x: min(440px, 30vw); --y: 440px; --s: 80px; --rot: -5deg; --depth: 0.9; --d: 700ms; --dur: 7.8s; --dx: -3px; --dy: -11px; --wob: 3deg; --fx: 120px; --fy: 80px; }
+  .hf-opencode    { --x: max(-300px, -19vw); --y: 20px; --s: 64px; --rot: 6deg; --depth: 0.6; --d: 620ms; --fx: -40px; --fy: -80px; }
+  .hf-antigravity { --x: min(300px, 19vw); --y: 20px; --s: 64px; --rot: -5deg; --depth: 0.6; --d: 580ms; --fx: 40px; --fy: -80px; }
+  .hf-claude   { --x: max(-560px, -38vw); --y: 128px; --s: 96px; --rot: -8deg; --depth: 1.2; --d: 380ms; --fx: -160px; --fy: -40px; }
+  .hf-codex    { --x: min(560px, 38vw); --y: 128px; --s: 96px; --rot: 7deg; --depth: 1.2; --d: 460ms; --fx: 160px; --fy: -40px; }
+  .hf-grok     { --x: max(-440px, -30vw); --y: 440px; --s: 80px; --rot: 4deg; --depth: 0.9; --d: 540ms; --fx: -120px; --fy: 80px; }
+  .hf-cursor   { --x: min(440px, 30vw); --y: 440px; --s: 80px; --rot: -5deg; --depth: 0.9; --d: 700ms; --fx: 120px; --fy: 80px; }
 
   @media (prefers-reduced-motion: reduce) {
     .hero-float-card { animation: none; transform: rotate(var(--rot)); }
@@ -726,15 +712,16 @@ const mobileEndorsementRows = [
   @media (max-width: 820px) {
     .hero {
       padding-top: 132px;
+      padding-bottom: 32px;
     }
 
     .hero-title {
-      font-size: clamp(40px, 11vw, 56px);
+      font-size: clamp(32px, 9.2vw, 56px);
       margin-top: 14px;
     }
 
     .hero-actions {
-      margin-bottom: 96px;
+      margin-bottom: 40px;
     }
 
     /* Four above the headline, two beside the CTA. Keeps the copy clear. */
@@ -754,21 +741,16 @@ const mobileEndorsementRows = [
   .hero-preview {
     max-width: 1180px;
     margin: 0 auto;
-    transform: perspective(2000px) rotateX(2deg);
-    transition: transform 0.6s ease;
-  }
-
-  .hero-preview:hover {
-    transform: perspective(2000px) rotateX(0deg);
   }
 
   .hero-screenshot-frame {
     position: relative;
     overflow: hidden;
     aspect-ratio: 2880 / 1800;
-    border-radius: 14px;
-    background: #0a0a0c;
-    box-shadow: 0 28px 64px -28px rgba(0, 0, 0, 0.75);
+    border-radius: 12px;
+    background: #000;
+    /* The screenshot is true black like the page, so this edge defines the window. */
+    box-shadow: 0 0 0 1px var(--border-strong);
   }
 
   .hero-screenshot-frame picture {
@@ -785,8 +767,6 @@ const mobileEndorsementRows = [
     object-position: center top;
   }
 
-  .sec-harness { background: #09090b; }
-
   .harness-grid {
     display: grid;
     grid-template-columns: repeat(6, 1fr);
@@ -800,7 +780,6 @@ const mobileEndorsementRows = [
     padding: 22px 20px;
     display: flex; align-items: center; gap: 14px;
     border-right: 1px solid var(--border);
-    background: linear-gradient(180deg, rgba(255, 255, 255, 0.015), transparent);
     transition: background 0.2s ease;
   }
   .harness:last-child { border-right: 0; }
@@ -820,13 +799,14 @@ const mobileEndorsementRows = [
   }
   .harness-tag {
     font-family: var(--font-mono);
-    font-size: 11px; color: var(--fg-dim);
+    font-size: 11px; color: var(--fg-muted);
+    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
   }
 
   .harness-footer {
     display: flex; gap: 24px; flex-wrap: wrap;
     margin-top: 28px; padding-top: 24px;
-    border-top: 1px dashed var(--border);
+    border-top: 1px solid var(--border);
     font-size: 13px; color: var(--fg-muted);
   }
   .harness-footer-item {
@@ -841,13 +821,13 @@ const mobileEndorsementRows = [
 
   .endorsements-head {
     max-width: 720px;
-    margin-bottom: 56px;
+    margin-bottom: 40px;
   }
 
   .endorsements-head h2 {
     font-size: clamp(32px, 4vw, 48px);
-    font-weight: 500;
-    letter-spacing: -0.035em;
+    font-weight: 600;
+    letter-spacing: -0.03em;
     line-height: 1.05;
     margin-bottom: 18px;
   }
@@ -946,7 +926,7 @@ const mobileEndorsementRows = [
     gap: 10px;
     border: 1px solid var(--border);
     border-radius: 10px;
-    background: rgba(255, 255, 255, 0.012);
+    background: var(--bg-elev);
     transition:
       border-color 0.18s ease,
       background 0.18s ease;
@@ -1017,16 +997,11 @@ const mobileEndorsementRows = [
   }
   .pr-head svg { color: var(--ok); }
   .pr-title { font-weight: 500; font-size: 15px; flex: 1; }
-  .pr-status {
-    font-family: var(--font-mono); font-size: 10px;
-    color: var(--ok); padding: 2px 8px;
-    border: 1px solid var(--ok); border-radius: 999px;
-    letter-spacing: 0.08em; text-transform: uppercase;
-  }
+  .pr-status { font-size: 12px; font-weight: 500; color: var(--ok); }
   .pr-meta {
     display: flex; gap: 14px;
     font-family: var(--font-mono); font-size: 11px;
-    color: var(--fg-dim); margin-bottom: 14px; flex-wrap: wrap;
+    color: var(--fg-muted); margin-bottom: 14px; flex-wrap: wrap;
   }
   .pr-meta span { display: inline-flex; align-items: center; gap: 5px; }
   .pr-files {
@@ -1034,13 +1009,14 @@ const mobileEndorsementRows = [
     overflow: hidden; margin-bottom: 16px;
   }
   .pr-files > div {
-    display: flex; justify-content: space-between;
+    display: flex; justify-content: space-between; gap: 12px;
     padding: 8px 12px; font-family: var(--font-mono);
     font-size: 11px; border-top: 1px solid var(--border);
     color: var(--fg-muted);
   }
   .pr-files > div:first-child { border-top: 0; }
-  .pr-files span { color: var(--fg-dim); }
+  .pr-files code { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .pr-files span { flex: none; color: var(--fg-dim); }
   .pr-foot { display: flex; justify-content: flex-end; gap: 8px; }
 
   .pr-trail {
@@ -1054,18 +1030,17 @@ const mobileEndorsementRows = [
   }
   .pr-trail-line {
     width: 1px; height: 28px;
-    background: linear-gradient(180deg, var(--border-strong), var(--accent));
+    background: var(--border-strong);
   }
 
   .pr-button-shell { display: flex; justify-content: center; }
   .pr-button {
     display: inline-flex; align-items: center; gap: 10px;
     padding: 12px 20px;
-    background: var(--fg); color: #09090b;
+    background: var(--fg); color: #000;
     font-weight: 600; font-size: 13px;
     line-height: normal;
     border-radius: 10px;
-    box-shadow: 0 8px 24px -8px rgba(255, 255, 255, 0.2);
   }
   .pr-button-kbd {
     font-family: var(--font-mono); font-size: 10px;
@@ -1075,7 +1050,7 @@ const mobileEndorsementRows = [
 
   .open-head {
     text-align: center;
-    margin: 0 auto 56px;
+    margin: 0 auto 40px;
   }
 
   .open-grid {
@@ -1088,11 +1063,10 @@ const mobileEndorsementRows = [
   .open-term-head {
     display: flex; align-items: center; gap: 6px;
     padding: 10px 14px; border-bottom: 1px solid var(--border);
-    background: rgba(255, 255, 255, 0.02);
   }
   .open-term-head span {
     width: 10px; height: 10px; border-radius: 999px;
-    background: #2a2a30; display: block;
+    background: #262626; display: block;
   }
   .open-term-title {
     margin-left: 10px;
@@ -1138,9 +1112,6 @@ const mobileEndorsementRows = [
     flex-direction: column;
     justify-content: center;
     gap: 32px;
-    background:
-      radial-gradient(110% 75% at 100% 0%, var(--accent-dim), transparent 60%),
-      linear-gradient(180deg, rgba(255, 255, 255, 0.02), transparent);
   }
 
   .open-pitch-list {
@@ -1166,15 +1137,8 @@ const mobileEndorsementRows = [
 
   .open-pitch-mark {
     flex: none;
-    display: grid;
-    place-items: center;
-    width: 22px;
-    height: 22px;
-    margin-top: 1px;
-    border-radius: 7px;
-    color: var(--accent);
-    background: var(--accent-dim);
-    border: 1px solid color-mix(in srgb, var(--accent) 28%, transparent);
+    margin-top: 5px;
+    color: var(--ok);
   }
 
   .open-pitch-footer {
@@ -1187,7 +1151,7 @@ const mobileEndorsementRows = [
     display: flex;
     align-items: center;
     gap: 8px;
-    color: var(--fg-dim);
+    color: var(--fg-muted);
     font-family: var(--font-mono);
     font-size: 11px;
   }
@@ -1215,19 +1179,10 @@ const mobileEndorsementRows = [
 
   .sec-cta {
     text-align: center;
-    padding: 120px 0;
+    padding: 96px 0;
     position: relative;
     overflow: hidden;
   }
-  .sec-cta::before {
-    content: "";
-    position: absolute;
-    inset: auto 0 -50% 0;
-    height: 60%;
-    background: radial-gradient(ellipse at center, var(--accent-dim) 0%, transparent 60%);
-    pointer-events: none;
-    opacity: 0.6;
-  }
   .cta-inner { position: relative; }
   .cta-title {
     font-size: clamp(40px, 6vw, 72px);
@@ -1250,10 +1205,7 @@ const mobileEndorsementRows = [
     .hero-preview {
       width: min(860px, calc(100vw - 24px));
       margin-left: 50%;
-      transform: translateX(-50%) perspective(1600px) rotateX(1.5deg);
-    }
-    .hero-preview:hover {
-      transform: translateX(-50%) perspective(1600px) rotateX(0deg);
+      transform: translateX(-50%);
     }
     .harness-grid { grid-template-columns: 1fr 1fr; }
     .harness { border-right: 0; border-bottom: 1px solid var(--border); }
@@ -1264,10 +1216,9 @@ const mobileEndorsementRows = [
   }
 
   @media (max-width: 820px) {
-    section { padding: 64px 0; }
-    .sec-cta { padding: 96px 0; }
+    section { padding: 56px 0; }
+    .sec-cta { padding: 80px 0; }
     .container { padding-left: 20px; padding-right: 20px; }
-    .hero-preview { display: none; }
     .endorsements-head {
       margin-bottom: 40px;
     }
@@ -1294,5 +1245,9 @@ const mobileEndorsementRows = [
     .endorsement-card p {
       font-size: 13px;
     }
+    .open-term-body {
+      padding: 16px;
+      font-size: 11px;
+    }
   }
 </style>
diff --git a/apps/marketing/src/styles/fonts.css b/apps/marketing/src/styles/fonts.css
deleted file mode 100644
index 2f3933d61239c..0000000000000
--- a/apps/marketing/src/styles/fonts.css
+++ /dev/null
@@ -1,193 +0,0 @@
-/*! DM Sans v17 and JetBrains Mono v24. Licenses: /fonts/dm-sans-OFL.txt and /fonts/jetbrains-mono-OFL.txt. */
-/* Keep subset bytes out of the stylesheet so unused glyph ranges do not add transfer size. */
-/* latin-ext */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin-ext.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* latin-ext */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin-ext.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* latin-ext */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin-ext.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "DM Sans";
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: url(../assets/fonts/dm-sans-latin.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-cyrillic-ext.woff2?no-inline) format("woff2");
-  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-cyrillic.woff2?no-inline) format("woff2");
-  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-greek.woff2?no-inline) format("woff2");
-  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-vietnamese.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301,
-    U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-latin-ext.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-latin.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-/* cyrillic-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-cyrillic-ext.woff2?no-inline) format("woff2");
-  unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
-}
-/* cyrillic */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-cyrillic.woff2?no-inline) format("woff2");
-  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-/* greek */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-greek.woff2?no-inline) format("woff2");
-  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
-}
-/* vietnamese */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-vietnamese.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301,
-    U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
-}
-/* latin-ext */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-latin-ext.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-/* latin */
-@font-face {
-  font-family: "JetBrains Mono";
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: url(../assets/fonts/jetbrains-mono-latin.woff2?no-inline) format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 087858aeabb82..4bff27f291a17 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -499,6 +499,9 @@ importers:
 
   apps/marketing:
     dependencies:
+      '@fontsource-variable/inter':
+        specifier: ^5.3.0
+        version: 5.3.0
       '@t3tools/shared':
         specifier: workspace:*
         version: link:../../packages/shared

From 37fbefd147197fab9d88f9c120560c3f21b52cfc Mon Sep 17 00:00:00 2001
From: Theo Browne <me@theo.li>
Date: Thu, 29 Oct 2026 06:52:00 -0700
Subject: [PATCH 015/146] chore(release): prepare v0.1.5

---
 apps/desktop/package.json       | 2 +-
 apps/server/package.json        | 2 +-
 apps/web/package.json           | 2 +-
 packages/contracts/package.json | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 7f768c1b44d75..886ccf3cd798f 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@t3tools/desktop",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "main": "dist-electron/boot.cjs",
diff --git a/apps/server/package.json b/apps/server/package.json
index bd81fd993c43e..9ee890670abbf 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "t3",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "license": "MIT",
   "repository": {
     "type": "git",
diff --git a/apps/web/package.json b/apps/web/package.json
index c35aadeef5d3f..2ee8fe51a06a3 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@t3tools/web",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
index cff21c52a6e32..2a032000896fb 100644
--- a/packages/contracts/package.json
+++ b/packages/contracts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@t3tools/contracts",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "files": [
     "dist"

From 960d5761c13f68a2f10635bcd26489a5fa404ec1 Mon Sep 17 00:00:00 2001
From: "t3-code-bot[bot]" <269035359+t3-code-bot[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 16:01:14 +0000
Subject: [PATCH 016/146] fix(cli): restore Windows desktop launcher console
 input (#24870)

Co-authored-by: Nathan Shan <nathanielcrush51@gmail.com>
Co-authored-by: t3-code[bot] <269035359+t3-code[bot]@users.noreply.github.com>
Co-authored-by: Utkarsh Patil <73941998+UtkarshUsername@users.noreply.github.com>
---
 apps/server/src/cli/consoleStdin.test.ts | 127 +++++++++++++++++++++++
 apps/server/src/cli/consoleStdin.ts      |  31 ++++--
 2 files changed, 148 insertions(+), 10 deletions(-)
 create mode 100644 apps/server/src/cli/consoleStdin.test.ts

diff --git a/apps/server/src/cli/consoleStdin.test.ts b/apps/server/src/cli/consoleStdin.test.ts
new file mode 100644
index 0000000000000..c799d3c2a5e10
--- /dev/null
+++ b/apps/server/src/cli/consoleStdin.test.ts
@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vite-plus/test";
+
+const io = vi.hoisted(() => ({
+  platform: vi.fn(() => "win32"),
+  stat: vi.fn(() => ({ isCharacterDevice: (): boolean => true })),
+  open: vi.fn(() => 42),
+  close: vi.fn(),
+  isatty: vi.fn((fd: number) => fd !== 0),
+}));
+
+vi.mock("node:fs", () => ({ fstatSync: io.stat, openSync: io.open, closeSync: io.close }));
+vi.mock("node:tty", async () => {
+  const { EventEmitter } = await import("node:events");
+  return {
+    isatty: io.isatty,
+    ReadStream: class extends EventEmitter {
+      readonly isTTY = true;
+      readonly _readableState = { reading: true };
+      _handle: { reading: boolean; readStop: () => void } | undefined = {
+        reading: true,
+        readStop: vi.fn(),
+      };
+    },
+  };
+});
+vi.mock("@t3tools/shared/HostProcess", () => ({ Platform: { defaultValue: io.platform } }));
+
+const originalStdin = Object.getOwnPropertyDescriptor(process, "stdin")!;
+
+beforeEach(() => {
+  vi.resetModules();
+  vi.resetAllMocks();
+  vi.stubEnv("T3CODE_DESKTOP_CLI_LAUNCHER", "1");
+});
+
+afterEach(() => {
+  Object.defineProperty(process, "stdin", originalStdin);
+  vi.unstubAllEnvs();
+});
+
+describe("attachConsoleStdin", () => {
+  it("reopens the console when Node replaces missing Windows stdin with NUL", async () => {
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+
+    expect(attachConsoleStdin()).toBe(42);
+    expect(process.stdin.isTTY).toBe(true);
+    expect(interactiveStdin()).toBe(42);
+    expect(process.env.T3CODE_DESKTOP_CLI_LAUNCHER).toBeUndefined();
+  });
+
+  it("releases console reads when the picker pauses stdin before launching an agent", async () => {
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+    attachConsoleStdin();
+    const stdin = process.stdin as unknown as {
+      emit(event: string): boolean;
+      _readableState: { reading: boolean };
+      _handle: { reading: boolean; readStop: () => void };
+    };
+    stdin.emit("pause");
+    expect(stdin._readableState.reading).toBe(false);
+    expect(stdin._handle.reading).toBe(false);
+    expect(stdin._handle.readStop).toHaveBeenCalledOnce();
+    expect(interactiveStdin()).toBe(42);
+  });
+
+  it("can pause after the reopened stream's handle has been closed", async () => {
+    const { attachConsoleStdin } = await import("./consoleStdin.ts");
+    attachConsoleStdin();
+    const stdin = process.stdin as unknown as {
+      emit(event: string): boolean;
+      _handle: undefined;
+    };
+    stdin._handle = undefined;
+    expect(() => stdin.emit("pause")).not.toThrow();
+  });
+
+  it("still reopens a closed stdin", async () => {
+    io.stat.mockImplementation(() => {
+      throw new Error("EBADF");
+    });
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+    expect(attachConsoleStdin()).toBe(42);
+    expect(interactiveStdin()).toBe(42);
+  });
+
+  it.each(["pipe", "file"])("preserves redirected %s input", async () => {
+    io.stat.mockReturnValue({ isCharacterDevice: () => false });
+    const stdin = process.stdin;
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+    expect(attachConsoleStdin()).toBeUndefined();
+    expect(process.stdin).toBe(stdin);
+    expect(interactiveStdin()).toBe("inherit");
+    expect(io.open).not.toHaveBeenCalled();
+  });
+
+  it.each(["console input", "redirected output", "unmarked process", "non-Windows"])(
+    "leaves %s alone",
+    async (scenario) => {
+      if (scenario === "console input") io.isatty.mockReturnValue(true);
+      if (scenario === "redirected output") io.isatty.mockReturnValue(false);
+      if (scenario === "unmarked process") delete process.env.T3CODE_DESKTOP_CLI_LAUNCHER;
+      if (scenario === "non-Windows") io.platform.mockReturnValue("darwin");
+      const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+      expect(attachConsoleStdin()).toBeUndefined();
+      expect(interactiveStdin()).toBe("inherit");
+      expect(io.open).not.toHaveBeenCalled();
+      expect(process.env.T3CODE_DESKTOP_CLI_LAUNCHER).toBeUndefined();
+    },
+  );
+
+  it("keeps inherited input when CONIN$ cannot be opened", async () => {
+    io.open.mockImplementation(() => {
+      throw new Error("ENOENT");
+    });
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+    expect(attachConsoleStdin()).toBeUndefined();
+    expect(interactiveStdin()).toBe("inherit");
+  });
+
+  it("closes a reopened descriptor that is not a console", async () => {
+    io.isatty.mockImplementation((fd) => fd === 1);
+    const { attachConsoleStdin, interactiveStdin } = await import("./consoleStdin.ts");
+    expect(attachConsoleStdin()).toBeUndefined();
+    expect(interactiveStdin()).toBe("inherit");
+    expect(io.close).toHaveBeenCalledWith(42);
+  });
+});
diff --git a/apps/server/src/cli/consoleStdin.ts b/apps/server/src/cli/consoleStdin.ts
index 91232cb310871..18ee7bed6d5a1 100644
--- a/apps/server/src/cli/consoleStdin.ts
+++ b/apps/server/src/cli/consoleStdin.ts
@@ -5,31 +5,30 @@ import * as NodeTty from "node:tty";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 
 /**
- * Electron's Windows executable is a GUI program, so `t3.cmd` under
- * `ELECTRON_RUN_AS_NODE` gets the console for stdout and stderr but no stdin.
- * Piped or redirected input and runs whose output is not a console are left alone.
+ * Electron's Windows launcher has no stdin; Node substitutes a non-console NUL device.
+ * Preserve pipes, files, console input, and runs without console output.
+ * Explicit `< NUL` is indistinguishable from missing launcher stdin and also reattaches.
  */
 function needsConsoleStdin(input: {
   readonly platform: NodeJS.Platform;
   readonly env: NodeJS.ProcessEnv;
-  readonly stdinOpen: boolean;
+  readonly stdinMissing: boolean;
   readonly stdoutIsConsole: boolean;
 }): boolean {
   return (
     input.platform === "win32" &&
     // Set only by the launcher (DesktopCliShim), never for the desktop backend.
     input.env.T3CODE_DESKTOP_CLI_LAUNCHER === "1" &&
-    !input.stdinOpen &&
+    input.stdinMissing &&
     input.stdoutIsConsole
   );
 }
 
-const isOpen = (fd: number) => {
+const isMissingInput = (fd: number) => {
   try {
-    NodeFS.fstatSync(fd);
-    return true;
+    return NodeFS.fstatSync(fd).isCharacterDevice() && !NodeTty.isatty(fd);
   } catch {
-    return false;
+    return true;
   }
 };
 
@@ -38,7 +37,7 @@ export function attachConsoleStdin(): number | undefined {
   const needed = needsConsoleStdin({
     platform: HostProcess.Platform.defaultValue(),
     env: process.env,
-    stdinOpen: isOpen(0),
+    stdinMissing: isMissingInput(0),
     stdoutIsConsole: NodeTty.isatty(1),
   });
   // The launcher marker must not propagate to child shells or t3 processes.
@@ -55,6 +54,18 @@ export function attachConsoleStdin(): number | undefined {
     return undefined;
   }
   const stdin = new NodeTty.ReadStream(fd);
+  // Like Node's built-in stdin, release pending console reads before a child takes over.
+  stdin.on("pause", () => {
+    const internal = stdin as unknown as {
+      _handle?: { reading: boolean; readStop(): void };
+      _readableState: { reading: boolean };
+    };
+    const handle = internal._handle;
+    if (!handle) return;
+    internal._readableState.reading = false;
+    handle.reading = false;
+    handle.readStop();
+  });
   Object.defineProperty(process, "stdin", { value: stdin, configurable: true, enumerable: true });
   consoleStdinFd = fd;
   return fd;

From 7a4f5b6188fed54ddc866723e39446a198b5835c Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Thu, 29 Oct 2026 13:15:27 -0400
Subject: [PATCH 017/146] feat(settings): add and list 1Password secret
 providers behind T3CODE_FEATURE_SECRETS (#25709)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/auth/RpcAuthorization.test.ts |   8 +-
 apps/web/src/components/Icons.tsx             |   9 +
 .../SecretProviderDialog.logic.test.ts        |  51 ++++
 .../settings/SecretProviderDialog.logic.ts    | 117 ++++++++++
 .../settings/SecretProviderDialog.tsx         | 155 ++++++++++++
 .../components/settings/SecretsSettings.tsx   | 220 ++++++++++++++++++
 .../settings/SettingsSidebarNav.tsx           |   2 +
 .../settings/settingsSearch.test.ts           |  11 +
 .../src/components/settings/settingsSearch.ts |  31 ++-
 apps/web/src/env.ts                           |   4 +
 apps/web/src/routeTree.gen.ts                 |  21 ++
 .../web/src/routes/_chat.settings.secrets.tsx |  11 +
 apps/web/src/routes/_chat.settings.tsx        |   2 +-
 apps/web/src/vite-env.d.ts                    |   1 +
 apps/web/vite.config.ts                       |   2 +
 packages/contracts/src/settings.test.ts       |  50 ++++
 packages/contracts/src/settings.ts            |  63 ++++-
 packages/shared/src/serverSettings.test.ts    |  25 ++
 packages/shared/src/serverSettings.ts         |   4 +
 19 files changed, 782 insertions(+), 5 deletions(-)
 create mode 100644 apps/web/src/components/settings/SecretProviderDialog.logic.test.ts
 create mode 100644 apps/web/src/components/settings/SecretProviderDialog.logic.ts
 create mode 100644 apps/web/src/components/settings/SecretProviderDialog.tsx
 create mode 100644 apps/web/src/components/settings/SecretsSettings.tsx
 create mode 100644 apps/web/src/routes/_chat.settings.secrets.tsx

diff --git a/apps/server/src/auth/RpcAuthorization.test.ts b/apps/server/src/auth/RpcAuthorization.test.ts
index 0a9f97cc39140..24c22280175cc 100644
--- a/apps/server/src/auth/RpcAuthorization.test.ts
+++ b/apps/server/src/auth/RpcAuthorization.test.ts
@@ -6,6 +6,7 @@ import {
   AuthSettingsWriteScope,
   DEFAULT_SERVER_SETTINGS,
   ProviderInstanceId,
+  SecretProviderId,
   ThreadId,
   AuthOrchestrationOperateScope,
   AuthOrchestrationReadScope,
@@ -173,7 +174,7 @@ describe("settings mutation authorization", () => {
     }).pipe(Effect.scoped),
   );
 
-  it.effect("does not let a settings grant create or remove providers", () =>
+  it.effect("does not let a settings grant create or remove providers or secret providers", () =>
     Effect.gen(function* () {
       let handled = false;
       const client = yield* RpcTest.makeClient(group).pipe(
@@ -195,6 +196,11 @@ describe("settings mutation authorization", () => {
           providerInstanceMutation,
         }).pipe(Effect.flip),
       ).toMatchObject({ requiredPermission: AuthProvidersManageScope });
+      expect(
+        yield* client[WS_METHODS.serverUpdateSettings]({
+          patch: { secretProviders: { [SecretProviderId.make("personal")]: null } },
+        }).pipe(Effect.flip),
+      ).toMatchObject({ requiredPermission: AuthProvidersManageScope });
       expect(handled).toBe(false);
     }).pipe(Effect.scoped),
   );
diff --git a/apps/web/src/components/Icons.tsx b/apps/web/src/components/Icons.tsx
index 551312e23f1dc..fd1a9f461d7d3 100644
--- a/apps/web/src/components/Icons.tsx
+++ b/apps/web/src/components/Icons.tsx
@@ -505,3 +505,12 @@ export const MacAccessibilityIcon: Icon = (props) => {
     </svg>
   );
 };
+
+export const OnePasswordIcon: Icon = (props) => (
+  <svg {...props} viewBox="0 0 24 24" fill="none">
+    <path
+      d="M12 0c6.627 0 12 5.373 12 12 0 6.628-5.373 12-12 12S0 18.628 0 12C0 5.373 5.373 0 12 0m-.893 4.86c-.485 0-.727.001-.913.095a.87.87 0 0 0-.378.379c-.094.185-.095.428-.095.912v2.747c0 .12 0 .182.016.238q.02.075.065.138a1 1 0 0 0 .175.162l.695.564c.113.092.17.139.19.194a.22.22 0 0 1 0 .15c-.02.056-.077.102-.19.194l-.695.564a1 1 0 0 0-.175.162.4.4 0 0 0-.065.138 1 1 0 0 0-.016.238v6.019c0 .485 0 .728.095.913a.87.87 0 0 0 .378.378c.186.094.428.094.913.094h1.786c.485 0 .727 0 .913-.094a.87.87 0 0 0 .378-.378c.095-.185.095-.428.095-.913v-2.747c0-.12 0-.182-.016-.238a.4.4 0 0 0-.065-.138 1 1 0 0 0-.175-.162l-.695-.564c-.113-.092-.17-.138-.191-.193a.22.22 0 0 1 0-.152c.02-.055.078-.1.19-.193l.696-.564a1 1 0 0 0 .175-.162.4.4 0 0 0 .065-.138 1 1 0 0 0 .016-.238V6.246c0-.484 0-.727-.095-.912a.87.87 0 0 0-.378-.379c-.186-.094-.428-.094-.913-.094Z"
+      fill="currentColor"
+    />
+  </svg>
+);
diff --git a/apps/web/src/components/settings/SecretProviderDialog.logic.test.ts b/apps/web/src/components/settings/SecretProviderDialog.logic.test.ts
new file mode 100644
index 0000000000000..a23ea149d480f
--- /dev/null
+++ b/apps/web/src/components/settings/SecretProviderDialog.logic.test.ts
@@ -0,0 +1,51 @@
+import { SecretProviderId } from "@t3tools/contracts";
+import * as Result from "effect/Result";
+import { describe, expect, it } from "vite-plus/test";
+
+import { secretProviderFromDraft } from "./SecretProviderDialog.logic";
+
+describe("secretProviderFromDraft", () => {
+  it("adds a provider keyed by its name and reports every field that blocks it", () => {
+    expect(
+      secretProviderFromDraft({ name: "  1Password!  ", account: "my.1password.com" }, new Set(), {
+        mode: "add",
+      }),
+    ).toEqual(
+      Result.succeed({
+        id: "1password",
+        config: {
+          kind: "one_password",
+          label: "1Password!",
+          config: { account: "my.1password.com" },
+        },
+      }),
+    );
+
+    const blocked = secretProviderFromDraft(
+      { name: "1Password", account: "--help" },
+      new Set(["1password"]),
+      { mode: "add" },
+    );
+    expect(Result.isFailure(blocked) && Object.keys(blocked.failure).toSorted()).toEqual([
+      "account",
+      "name",
+    ]);
+  });
+
+  it("keeps the id when an edit renames the provider", () => {
+    const id = SecretProviderId.make("personal");
+    const result = secretProviderFromDraft(
+      { name: "Personal (team)", account: "team.1password.com" },
+      new Set(["personal"]),
+      { mode: "edit", id },
+    );
+    expect(Result.isSuccess(result) && result.success).toEqual({
+      id,
+      config: {
+        kind: "one_password",
+        label: "Personal (team)",
+        config: { account: "team.1password.com" },
+      },
+    });
+  });
+});
diff --git a/apps/web/src/components/settings/SecretProviderDialog.logic.ts b/apps/web/src/components/settings/SecretProviderDialog.logic.ts
new file mode 100644
index 0000000000000..11139d9c7aa67
--- /dev/null
+++ b/apps/web/src/components/settings/SecretProviderDialog.logic.ts
@@ -0,0 +1,117 @@
+import {
+  OnePasswordSecretProviderConfig,
+  SecretProviderId,
+  SecretProviderKind,
+  SecretProviderLabel,
+  type OnePasswordAccount,
+  type SecretProviderConfig,
+} from "@t3tools/contracts";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+
+const decodeSecretProviderId = Schema.decodeOption(SecretProviderId);
+const decodeOnePasswordConfig = Schema.decodeUnknownOption(OnePasswordSecretProviderConfig);
+
+export type ClassifiedSecretProvider =
+  | { readonly kind: "one_password"; readonly account: OnePasswordAccount }
+  | { readonly kind: "unsupported" };
+
+/** Unknown kinds and configs that no longer decode are shown read-only; removal stays available. */
+export function classifySecretProvider(provider: SecretProviderConfig): ClassifiedSecretProvider {
+  if (provider.kind !== "one_password") return { kind: "unsupported" };
+  const decoded = decodeOnePasswordConfig(provider.config);
+  return decoded._tag === "Some"
+    ? { kind: "one_password", account: decoded.value.account }
+    : { kind: "unsupported" };
+}
+
+/** Stable and readable in settings.json, so re-adding a provider under the same name restores its variables. */
+function secretProviderIdFromName(name: string): SecretProviderId | null {
+  const slug = name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-|-$/g, "")
+    .slice(0, 64)
+    .replace(/-$/, "");
+  return Option.getOrNull(decodeSecretProviderId(slug));
+}
+
+export interface SecretProviderDraft {
+  readonly name: string;
+  readonly account: string;
+}
+
+export function draftFromSecretProvider(provider: SecretProviderConfig): SecretProviderDraft {
+  const classified = classifySecretProvider(provider);
+  return {
+    name: provider.label,
+    account: classified.kind === "one_password" ? classified.account : "",
+  };
+}
+
+export type SecretProviderTarget =
+  | { readonly mode: "add" }
+  | { readonly mode: "edit"; readonly id: SecretProviderId };
+
+export type SecretProviderDraftIssues = {
+  readonly [Field in keyof SecretProviderDraft]?: string;
+};
+
+function decodeField<S extends Schema.ConstraintDecoder<unknown>>(
+  schema: S,
+  value: string,
+  emptyMessage: string,
+): Result.Result<S["Type"], string> {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) return Result.fail(emptyMessage);
+  return Result.mapError(Schema.decodeResult(schema)(trimmed), (error) => error.message);
+}
+
+/** The settings entry a draft adds or replaces, or every field that blocks it, one message each. */
+export function secretProviderFromDraft(
+  draft: SecretProviderDraft,
+  existingIds: ReadonlySet<string>,
+  target: SecretProviderTarget,
+): Result.Result<
+  { readonly id: SecretProviderId; readonly config: SecretProviderConfig },
+  SecretProviderDraftIssues
+> {
+  const label = decodeField(SecretProviderLabel, draft.name, "Enter a name.");
+  const account = decodeField(
+    OnePasswordSecretProviderConfig.fields.account,
+    draft.account,
+    "Enter the 1Password account.",
+  );
+
+  let id: SecretProviderId | null = null;
+  let nameIssue: string | undefined;
+  if (Result.isFailure(label)) {
+    nameIssue = label.failure;
+  } else {
+    id = target.mode === "edit" ? target.id : secretProviderIdFromName(label.success);
+    if (id === null) nameIssue = "The name needs at least one letter or digit.";
+    else if (target.mode === "add" && existingIds.has(id))
+      nameIssue = "A secret provider with this name exists.";
+  }
+
+  if (
+    id === null ||
+    nameIssue !== undefined ||
+    Result.isFailure(label) ||
+    Result.isFailure(account)
+  ) {
+    return Result.fail({
+      ...(nameIssue === undefined ? {} : { name: nameIssue }),
+      ...(Result.isFailure(account) ? { account: account.failure } : {}),
+    });
+  }
+  return Result.succeed({
+    id,
+    config: {
+      kind: SecretProviderKind.make("one_password"),
+      label: label.success,
+      config: { account: account.success },
+    },
+  });
+}
diff --git a/apps/web/src/components/settings/SecretProviderDialog.tsx b/apps/web/src/components/settings/SecretProviderDialog.tsx
new file mode 100644
index 0000000000000..9370fcc68b3ee
--- /dev/null
+++ b/apps/web/src/components/settings/SecretProviderDialog.tsx
@@ -0,0 +1,155 @@
+import type { EnvironmentId, SecretProviderConfig, SecretProviderId } from "@t3tools/contracts";
+import * as Result from "effect/Result";
+import { useState } from "react";
+
+import { useUpdateEnvironmentSettings } from "../../hooks/useSettings";
+import { Button } from "../ui/button";
+import {
+  Dialog,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogPanel,
+  DialogPopup,
+  DialogTitle,
+} from "../ui/dialog";
+import { Input } from "../ui/input";
+import { Label } from "../ui/label";
+import {
+  draftFromSecretProvider,
+  secretProviderFromDraft,
+  type SecretProviderDraft,
+} from "./SecretProviderDialog.logic";
+
+/** Mounted per open, so each open starts from a fresh draft. */
+export function SecretProviderDialog({
+  onClose,
+  environmentId,
+  environmentLabel,
+  existingIds,
+  existing,
+}: {
+  readonly onClose: () => void;
+  readonly environmentId: EnvironmentId;
+  readonly environmentLabel: string;
+  readonly existingIds: ReadonlySet<string>;
+  readonly existing?: { readonly id: SecretProviderId; readonly config: SecretProviderConfig };
+}) {
+  const updateSettings = useUpdateEnvironmentSettings(environmentId);
+  const [draft, setDraft] = useState<SecretProviderDraft>(
+    existing ? draftFromSecretProvider(existing.config) : { name: "", account: "" },
+  );
+  const [submitted, setSubmitted] = useState(false);
+  const result = secretProviderFromDraft(
+    draft,
+    existingIds,
+    existing ? { mode: "edit", id: existing.id } : { mode: "add" },
+  );
+  const issues = Result.isFailure(result) ? result.failure : {};
+  const nameError = submitted ? issues.name : undefined;
+  const accountError = submitted ? issues.account : undefined;
+
+  const update = (patch: Partial<SecretProviderDraft>) => setDraft({ ...draft, ...patch });
+  const save = () => {
+    setSubmitted(true);
+    if (Result.isFailure(result)) return;
+    updateSettings({ secretProviders: { [result.success.id]: result.success.config } });
+    onClose();
+  };
+
+  return (
+    <Dialog
+      open
+      onOpenChange={(next) => {
+        if (!next) onClose();
+      }}
+    >
+      <DialogPopup className="max-w-md">
+        <DialogHeader>
+          <DialogTitle>
+            {existing ? `Edit ${existing.config.label}` : "Add a 1Password provider"}
+          </DialogTitle>
+          <DialogDescription>
+            Provider variables on {environmentLabel} can read values from it by name. Values are
+            read with the op CLI on that server when a provider starts.
+          </DialogDescription>
+        </DialogHeader>
+        <DialogPanel>
+          <form
+            id="secret-provider-form"
+            className="grid gap-4"
+            onSubmit={(event) => {
+              event.preventDefault();
+              save();
+            }}
+          >
+            <div className="grid gap-1.5">
+              <Label htmlFor="secret-provider-name">Name</Label>
+              <Input
+                id="secret-provider-name"
+                placeholder="Personal"
+                value={draft.name}
+                onChange={(event) => update({ name: event.target.value })}
+                maxLength={64}
+                aria-invalid={nameError !== undefined}
+                aria-describedby={
+                  nameError !== undefined ? "secret-provider-name-error" : undefined
+                }
+                autoFocus
+              />
+              {nameError !== undefined ? (
+                <p
+                  id="secret-provider-name-error"
+                  role="alert"
+                  className="text-xs text-destructive"
+                >
+                  {nameError}
+                </p>
+              ) : null}
+            </div>
+            <div className="grid gap-1.5">
+              <Label htmlFor="secret-provider-account">Account</Label>
+              <Input
+                id="secret-provider-account"
+                placeholder="my.1password.com"
+                value={draft.account}
+                onChange={(event) => update({ account: event.target.value })}
+                maxLength={253}
+                spellCheck={false}
+                aria-invalid={accountError !== undefined}
+                aria-describedby={
+                  accountError !== undefined ? "secret-provider-account-error" : undefined
+                }
+              />
+              {accountError !== undefined ? (
+                <p
+                  id="secret-provider-account-error"
+                  role="alert"
+                  className="text-xs text-destructive"
+                >
+                  {accountError}
+                </p>
+              ) : null}
+              <p className="text-xs text-muted-foreground">
+                The account shorthand, sign-in address without https://, or ID that op account list
+                shows.
+              </p>
+            </div>
+          </form>
+        </DialogPanel>
+        <DialogFooter variant="bare">
+          <Button variant="outline" onClick={onClose}>
+            Cancel
+          </Button>
+          <Button
+            type="submit"
+            form="secret-provider-form"
+            disabled={submitted && Result.isFailure(result)}
+          >
+            {existing ? "Save changes" : "Add provider"}
+          </Button>
+        </DialogFooter>
+      </DialogPopup>
+    </Dialog>
+  );
+}
diff --git a/apps/web/src/components/settings/SecretsSettings.tsx b/apps/web/src/components/settings/SecretsSettings.tsx
new file mode 100644
index 0000000000000..e9efe2d85f6ed
--- /dev/null
+++ b/apps/web/src/components/settings/SecretsSettings.tsx
@@ -0,0 +1,220 @@
+import type { SecretProviderConfig, SecretProviderId } from "@t3tools/contracts";
+import { PlusIcon } from "lucide-react";
+import { useState } from "react";
+
+import { useEnvironmentSettings, useUpdateEnvironmentSettings } from "../../hooks/useSettings";
+import type { EnvironmentPresentation } from "../../state/environments";
+import { useEnvironmentSessionState } from "../../state/session";
+import { OnePasswordIcon, type Icon } from "../Icons";
+import {
+  AlertDialog,
+  AlertDialogClose,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogPopup,
+  AlertDialogTitle,
+} from "../ui/alert-dialog";
+import { Button } from "../ui/button";
+import { SecretProviderDialog } from "./SecretProviderDialog";
+import { classifySecretProvider } from "./SecretProviderDialog.logic";
+import {
+  classifyProviderEnvironmentAccess,
+  resolveRemoteOperateAccess,
+} from "./ProviderSettingsPanel.logic";
+import { useSettingsScope } from "./SettingsScopeContext";
+import { RedactedSensitiveText } from "./RedactedSensitiveText";
+import { searchableSetting } from "./settingsSearch";
+import { SettingsPageContainer, SettingsRow, SettingsSection } from "./settingsLayout";
+
+const SECRET_PROVIDER_KINDS: Readonly<
+  Record<string, { readonly name: string; readonly icon: Icon }>
+> = {
+  one_password: { name: "1Password", icon: OnePasswordIcon },
+};
+
+export function SecretsSettingsPanel() {
+  const { scope, environment } = useSettingsScope();
+  return (
+    <SettingsPageContainer>
+      {environment?.connection.phase === "connected" ? (
+        <EnvironmentSecretProviders
+          key={environment.environmentId}
+          environment={environment}
+          projectScoped={scope.kind === "project" || scope.kind === "checkout"}
+        />
+      ) : (
+        <SettingsSection {...searchableSetting("secret-providers")}>
+          <p className="px-4 py-3 text-sm text-muted-foreground">
+            Connect an environment to manage the secret providers its provider variables read from.
+          </p>
+        </SettingsSection>
+      )}
+    </SettingsPageContainer>
+  );
+}
+
+function EnvironmentSecretProviders({
+  environment,
+  projectScoped,
+}: {
+  readonly environment: EnvironmentPresentation;
+  readonly projectScoped: boolean;
+}) {
+  const environmentId = environment.environmentId;
+  const sessionState = useEnvironmentSessionState(environmentId);
+  // The server requires the same grant for secret providers as for provider settings.
+  const access = classifyProviderEnvironmentAccess({
+    connectionPhase: environment.connection.phase,
+    hasServerConfig: environment.serverConfig !== null,
+    operateAccess: resolveRemoteOperateAccess({
+      session: sessionState.data,
+      isPending: sessionState.isPending,
+      hasError: sessionState.hasError,
+    }),
+  });
+  const readOnly = access.kind !== "editable" || projectScoped;
+  const providers = useEnvironmentSettings(environmentId, (settings) => settings.secretProviders);
+  const updateSettings = useUpdateEnvironmentSettings(environmentId);
+  const [dialog, setDialog] = useState<
+    null | { readonly mode: "add" } | { readonly mode: "edit"; readonly id: SecretProviderId }
+  >(null);
+  const entries = Object.entries(providers) as Array<[SecretProviderId, SecretProviderConfig]>;
+  const editingConfig = dialog?.mode === "edit" ? providers[dialog.id] : undefined;
+  const editing =
+    dialog?.mode === "edit" && editingConfig !== undefined
+      ? { id: dialog.id, config: editingConfig }
+      : undefined;
+  return (
+    <>
+      <SettingsSection
+        {...searchableSetting("secret-providers")}
+        headerAction={
+          !readOnly ? (
+            <Button size="xs" variant="outline" onClick={() => setDialog({ mode: "add" })}>
+              <PlusIcon className="size-3" aria-hidden />
+              Add provider
+            </Button>
+          ) : null
+        }
+      >
+        {projectScoped ? (
+          <p className="px-4 pt-3 text-xs text-muted-foreground">
+            Environment-wide setting. Select an environment to change it.
+          </p>
+        ) : null}
+        {entries.length === 0 ? (
+          <SettingsRow
+            title="No secret providers configured."
+            description="Add a 1Password account, then pick it as the source of a provider variable."
+          />
+        ) : (
+          entries.map(([id, config]) => {
+            const classified = classifySecretProvider(config);
+            const kind =
+              classified.kind === "unsupported"
+                ? undefined
+                : SECRET_PROVIDER_KINDS[classified.kind];
+            return (
+              <SettingsRow
+                key={id}
+                title={
+                  <span className="flex min-w-0 items-center gap-2">
+                    {kind ? (
+                      <kind.icon className="size-4.5 shrink-0 text-foreground/80" aria-hidden />
+                    ) : null}
+                    <span className="min-w-0 wrap-anywhere">{config.label}</span>
+                  </span>
+                }
+                description={
+                  classified.kind === "one_password" && kind ? (
+                    <span className="flex min-w-0 items-center gap-1">
+                      <span className="shrink-0">{kind.name} ·</span>
+                      <RedactedSensitiveText
+                        value={classified.account}
+                        ariaLabel="Toggle account visibility"
+                        revealTooltip="Click to reveal account"
+                        hideTooltip="Click to hide account"
+                        className="max-w-full truncate"
+                      />
+                    </span>
+                  ) : (
+                    `Unsupported provider (${config.kind})`
+                  )
+                }
+                control={
+                  !readOnly ? (
+                    <div className="flex items-center gap-1">
+                      {kind ? (
+                        <Button
+                          size="xs"
+                          variant="ghost"
+                          onClick={() => setDialog({ mode: "edit", id })}
+                        >
+                          Edit
+                        </Button>
+                      ) : null}
+                      <RemoveSecretProviderButton
+                        label={config.label}
+                        onConfirm={() => updateSettings({ secretProviders: { [id]: null } })}
+                      />
+                    </div>
+                  ) : null
+                }
+              />
+            );
+          })
+        )}
+      </SettingsSection>
+      {dialog !== null && !readOnly && (dialog.mode === "add" || editing !== undefined) ? (
+        <SecretProviderDialog
+          onClose={() => setDialog(null)}
+          environmentId={environmentId}
+          environmentLabel={environment.label}
+          existingIds={new Set(Object.keys(providers))}
+          {...(editing === undefined ? {} : { existing: editing })}
+        />
+      ) : null}
+    </>
+  );
+}
+
+function RemoveSecretProviderButton({
+  label,
+  onConfirm,
+}: {
+  readonly label: string;
+  readonly onConfirm: () => void;
+}) {
+  const [open, setOpen] = useState(false);
+  return (
+    <>
+      <Button size="xs" variant="ghost" onClick={() => setOpen(true)}>
+        Remove
+      </Button>
+      <AlertDialog open={open} onOpenChange={setOpen}>
+        <AlertDialogPopup>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Remove {label}?</AlertDialogTitle>
+            <AlertDialogDescription>
+              Provider variables that read from {label} stop resolving until a provider with the
+              same name is added again. The secrets themselves are untouched.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogClose render={<Button variant="outline" />}>Cancel</AlertDialogClose>
+            <Button
+              variant="destructive"
+              onClick={() => {
+                setOpen(false);
+                onConfirm();
+              }}
+            >
+              Remove provider
+            </Button>
+          </AlertDialogFooter>
+        </AlertDialogPopup>
+      </AlertDialog>
+    </>
+  );
+}
diff --git a/apps/web/src/components/settings/SettingsSidebarNav.tsx b/apps/web/src/components/settings/SettingsSidebarNav.tsx
index b58f56a162324..ee061be1ebf78 100644
--- a/apps/web/src/components/settings/SettingsSidebarNav.tsx
+++ b/apps/web/src/components/settings/SettingsSidebarNav.tsx
@@ -22,6 +22,7 @@ import {
   MessagesSquareIcon,
   PanelsTopLeftIcon,
   KeyboardIcon,
+  KeyRoundIcon,
   PaletteIcon,
   SearchIcon,
   ServerIcon,
@@ -102,6 +103,7 @@ const SETTINGS_SECTION_ICONS: Readonly<
   "/settings/worktrees": FolderTreeIcon,
   "/settings/connections": ServerIcon,
   "/settings/access": ShieldCheckIcon,
+  "/settings/secrets": KeyRoundIcon,
   "/settings/maintenance": WrenchIcon,
   "/settings/labs": FlaskConicalIcon,
   "/settings/about": InfoIcon,
diff --git a/apps/web/src/components/settings/settingsSearch.test.ts b/apps/web/src/components/settings/settingsSearch.test.ts
index 3013298c6ecb6..07d1d5dd6c8b9 100644
--- a/apps/web/src/components/settings/settingsSearch.test.ts
+++ b/apps/web/src/components/settings/settingsSearch.test.ts
@@ -14,12 +14,18 @@ import {
   isSettingsSearchScopeAvailable,
   movedSettingsPath,
   searchSettings,
+  SETTINGS_NAV_GROUPS,
   SETTINGS_SEARCH_ITEMS,
   sourceControlHostSearchItems,
   sourceControlHostSettingsSearchId,
   type SettingsSearchItem,
 } from "./settingsSearch";
 
+vi.mock("~/env", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("~/env")>()),
+  isSecretsFeatureEnabled: false,
+}));
+
 const ITEMS: ReadonlyArray<SettingsSearchItem> = [
   {
     id: "word-wrap",
@@ -60,6 +66,11 @@ describe("searchSettings", () => {
     expect(searchSettings("long lines", ITEMS).map((item) => item.id)).toEqual(["word-wrap"]);
   });
 
+  it("hides the Secrets page from nav and search while the secrets feature is disabled", () => {
+    expect(SETTINGS_NAV_GROUPS.flatMap((group) => group.paths)).not.toContain("/settings/secrets");
+    expect(searchSettings("1password").map((item) => item.to)).not.toContain("/settings/secrets");
+  });
+
   it("matches normalized title substrings", () => {
     expect(searchSettings("  WORD   WRAP  ", ITEMS).map((item) => item.id)).toEqual(["word-wrap"]);
     expect(searchSettings("glass").map((item) => item.id)).toEqual(["setting-glass-opacity"]);
diff --git a/apps/web/src/components/settings/settingsSearch.ts b/apps/web/src/components/settings/settingsSearch.ts
index 1d5c13e72a061..dc494caf5344d 100644
--- a/apps/web/src/components/settings/settingsSearch.ts
+++ b/apps/web/src/components/settings/settingsSearch.ts
@@ -1,5 +1,5 @@
 import { HOSTED_APP_CHANNEL } from "~/branding";
-import { isElectron } from "~/env";
+import { isElectron, isSecretsFeatureEnabled } from "~/env";
 import { isMacPlatform, isWindowsPlatform, normalizeSearchText } from "~/lib/utils";
 import { STATIC_KEYBINDING_COMMANDS, type KeybindingCommand } from "@t3tools/contracts";
 import type { EnvironmentId } from "@t3tools/contracts";
@@ -33,6 +33,7 @@ export type SettingsPath =
   | "/settings/worktrees"
   | "/settings/connections"
   | "/settings/access"
+  | "/settings/secrets"
   | "/settings/maintenance"
   | "/settings/labs"
   | "/settings/about"
@@ -57,6 +58,7 @@ export interface SettingsSearchItem {
   readonly macOnly?: boolean;
   readonly windowsOnly?: boolean;
   readonly releaseChannelOnly?: boolean;
+  readonly secretsFeatureOnly?: boolean;
   readonly cloudOnly?: boolean;
   readonly environmentOnly?: boolean;
   readonly providerSettingsOnly?: boolean;
@@ -101,6 +103,7 @@ export const SETTINGS_SECTION_LABELS: Readonly<Record<SettingsPath, string>> = {
   "/settings/worktrees": "Worktrees",
   "/settings/connections": "Environments",
   "/settings/access": "Sharing & access",
+  "/settings/secrets": "Secrets",
   "/settings/maintenance": "Maintenance",
   "/settings/labs": "Labs",
   "/settings/about": "About",
@@ -137,7 +140,14 @@ export const SETTINGS_NAV_GROUPS: ReadonlyArray<{
     heading: "Code",
     paths: ["/settings/projects", "/settings/source-control", "/settings/worktrees"],
   },
-  { heading: "Connections", paths: ["/settings/connections", "/settings/access"] },
+  {
+    heading: "Connections",
+    paths: [
+      "/settings/connections",
+      "/settings/access",
+      ...(isSecretsFeatureEnabled ? (["/settings/secrets"] as const) : []),
+    ],
+  },
   {
     heading: null,
     paths: ["/settings/maintenance", "/settings/labs", "/settings/about", "/settings/archived"],
@@ -1142,6 +1152,21 @@ export const SETTINGS_SEARCH_ITEMS = [
       `pull request routing trusted environments shared credentials permissions read actions source control ${SOURCE_CONTROL_HOST_LABELS}`,
     ],
   },
+  {
+    id: "secret-providers",
+    title: "Secret providers",
+    to: "/settings/secrets",
+    searchTerms: ["1password vault credentials api key"],
+    secretsFeatureOnly: true,
+  },
+  {
+    id: "secret-providers-add",
+    title: "Add secret provider",
+    to: "/settings/secrets",
+    targetId: "secret-providers",
+    searchTerms: ["new 1password vault op cli account"],
+    secretsFeatureOnly: true,
+  },
   {
     id: "archive",
     title: "Archived threads",
@@ -1171,6 +1196,7 @@ const SETTINGS_CATEGORY_SCOPES: Readonly<Record<SettingsPath, SettingsSearchScop
   "/settings/worktrees": "project-defaults",
   "/settings/connections": "connections",
   "/settings/access": "connections",
+  "/settings/secrets": null,
   "/settings/scheduled-tasks": null,
   "/settings/maintenance": null,
   "/settings/labs": null,
@@ -1313,6 +1339,7 @@ export function settingsForThisPlatform(
     (item) =>
       (isElectron || item.desktopOnly !== true) &&
       (!item.releaseChannelOnly || isElectron || HOSTED_APP_CHANNEL !== null) &&
+      (!item.secretsFeatureOnly || isSecretsFeatureEnabled) &&
       (!item.macOnly || isMacPlatform(platform)) &&
       (!item.windowsOnly || isWindowsPlatform(platform)),
   );
diff --git a/apps/web/src/env.ts b/apps/web/src/env.ts
index be2a563d736bd..a0a28c5d7fd60 100644
--- a/apps/web/src/env.ts
+++ b/apps/web/src/env.ts
@@ -1,2 +1,6 @@
 // Preload installs desktopBridge before web code runs, so module-load detection is reliable.
 export const isElectron = typeof window !== "undefined" && window.desktopBridge !== undefined;
+
+export const isSecretsFeatureEnabled = ["1", "true"].includes(
+  import.meta.env.T3CODE_FEATURE_SECRETS?.trim().toLowerCase() ?? "",
+);
diff --git a/apps/web/src/routeTree.gen.ts b/apps/web/src/routeTree.gen.ts
index d92ea6110863e..0e26ab6edd879 100644
--- a/apps/web/src/routeTree.gen.ts
+++ b/apps/web/src/routeTree.gen.ts
@@ -26,6 +26,7 @@ import { Route as ChatSettingsThreadsRouteImport } from './routes/_chat.settings
 import { Route as ChatSettingsStorageRouteImport } from './routes/_chat.settings.storage'
 import { Route as ChatSettingsSourceControlRouteImport } from './routes/_chat.settings.source-control'
 import { Route as ChatSettingsSnapShotRouteImport } from './routes/_chat.settings.snap-shot'
+import { Route as ChatSettingsSecretsRouteImport } from './routes/_chat.settings.secrets'
 import { Route as ChatSettingsScheduledTasksRouteImport } from './routes/_chat.settings.scheduled-tasks'
 import { Route as ChatSettingsProvidersRouteImport } from './routes/_chat.settings.providers'
 import { Route as ChatSettingsProjectsRouteImport } from './routes/_chat.settings.projects'
@@ -134,6 +135,11 @@ const ChatSettingsSnapShotRoute = ChatSettingsSnapShotRouteImport.update({
   path: '/snap-shot',
   getParentRoute: () => ChatSettingsRoute,
 } as any)
+const ChatSettingsSecretsRoute = ChatSettingsSecretsRouteImport.update({
+  id: '/secrets',
+  path: '/secrets',
+  getParentRoute: () => ChatSettingsRoute,
+} as any)
 const ChatSettingsScheduledTasksRoute =
   ChatSettingsScheduledTasksRouteImport.update({
     id: '/scheduled-tasks',
@@ -283,6 +289,7 @@ export interface FileRoutesByFullPath {
   '/settings/projects': typeof ChatSettingsProjectsRoute
   '/settings/providers': typeof ChatSettingsProvidersRoute
   '/settings/scheduled-tasks': typeof ChatSettingsScheduledTasksRoute
+  '/settings/secrets': typeof ChatSettingsSecretsRoute
   '/settings/snap-shot': typeof ChatSettingsSnapShotRoute
   '/settings/source-control': typeof ChatSettingsSourceControlRoute
   '/settings/storage': typeof ChatSettingsStorageRoute
@@ -323,6 +330,7 @@ export interface FileRoutesByTo {
   '/settings/projects': typeof ChatSettingsProjectsRoute
   '/settings/providers': typeof ChatSettingsProvidersRoute
   '/settings/scheduled-tasks': typeof ChatSettingsScheduledTasksRoute
+  '/settings/secrets': typeof ChatSettingsSecretsRoute
   '/settings/snap-shot': typeof ChatSettingsSnapShotRoute
   '/settings/source-control': typeof ChatSettingsSourceControlRoute
   '/settings/storage': typeof ChatSettingsStorageRoute
@@ -365,6 +373,7 @@ export interface FileRoutesById {
   '/_chat/settings/projects': typeof ChatSettingsProjectsRoute
   '/_chat/settings/providers': typeof ChatSettingsProvidersRoute
   '/_chat/settings/scheduled-tasks': typeof ChatSettingsScheduledTasksRoute
+  '/_chat/settings/secrets': typeof ChatSettingsSecretsRoute
   '/_chat/settings/snap-shot': typeof ChatSettingsSnapShotRoute
   '/_chat/settings/source-control': typeof ChatSettingsSourceControlRoute
   '/_chat/settings/storage': typeof ChatSettingsStorageRoute
@@ -407,6 +416,7 @@ export interface FileRouteTypes {
     | '/settings/projects'
     | '/settings/providers'
     | '/settings/scheduled-tasks'
+    | '/settings/secrets'
     | '/settings/snap-shot'
     | '/settings/source-control'
     | '/settings/storage'
@@ -447,6 +457,7 @@ export interface FileRouteTypes {
     | '/settings/projects'
     | '/settings/providers'
     | '/settings/scheduled-tasks'
+    | '/settings/secrets'
     | '/settings/snap-shot'
     | '/settings/source-control'
     | '/settings/storage'
@@ -488,6 +499,7 @@ export interface FileRouteTypes {
     | '/_chat/settings/projects'
     | '/_chat/settings/providers'
     | '/_chat/settings/scheduled-tasks'
+    | '/_chat/settings/secrets'
     | '/_chat/settings/snap-shot'
     | '/_chat/settings/source-control'
     | '/_chat/settings/storage'
@@ -626,6 +638,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof ChatSettingsSnapShotRouteImport
       parentRoute: typeof ChatSettingsRoute
     }
+    '/_chat/settings/secrets': {
+      id: '/_chat/settings/secrets'
+      path: '/secrets'
+      fullPath: '/settings/secrets'
+      preLoaderRoute: typeof ChatSettingsSecretsRouteImport
+      parentRoute: typeof ChatSettingsRoute
+    }
     '/_chat/settings/scheduled-tasks': {
       id: '/_chat/settings/scheduled-tasks'
       path: '/scheduled-tasks'
@@ -804,6 +823,7 @@ interface ChatSettingsRouteChildren {
   ChatSettingsProjectsRoute: typeof ChatSettingsProjectsRoute
   ChatSettingsProvidersRoute: typeof ChatSettingsProvidersRoute
   ChatSettingsScheduledTasksRoute: typeof ChatSettingsScheduledTasksRoute
+  ChatSettingsSecretsRoute: typeof ChatSettingsSecretsRoute
   ChatSettingsSnapShotRoute: typeof ChatSettingsSnapShotRoute
   ChatSettingsSourceControlRoute: typeof ChatSettingsSourceControlRoute
   ChatSettingsStorageRoute: typeof ChatSettingsStorageRoute
@@ -832,6 +852,7 @@ const ChatSettingsRouteChildren: ChatSettingsRouteChildren = {
   ChatSettingsProjectsRoute: ChatSettingsProjectsRoute,
   ChatSettingsProvidersRoute: ChatSettingsProvidersRoute,
   ChatSettingsScheduledTasksRoute: ChatSettingsScheduledTasksRoute,
+  ChatSettingsSecretsRoute: ChatSettingsSecretsRoute,
   ChatSettingsSnapShotRoute: ChatSettingsSnapShotRoute,
   ChatSettingsSourceControlRoute: ChatSettingsSourceControlRoute,
   ChatSettingsStorageRoute: ChatSettingsStorageRoute,
diff --git a/apps/web/src/routes/_chat.settings.secrets.tsx b/apps/web/src/routes/_chat.settings.secrets.tsx
new file mode 100644
index 0000000000000..d97e00fda19f7
--- /dev/null
+++ b/apps/web/src/routes/_chat.settings.secrets.tsx
@@ -0,0 +1,11 @@
+import { createFileRoute, redirect } from "@tanstack/react-router";
+
+import { SecretsSettingsPanel } from "../components/settings/SecretsSettings";
+import { isSecretsFeatureEnabled } from "../env";
+
+export const Route = createFileRoute("/_chat/settings/secrets")({
+  beforeLoad: () => {
+    if (!isSecretsFeatureEnabled) throw redirect({ to: "/settings/general", replace: true });
+  },
+  component: SecretsSettingsPanel,
+});
diff --git a/apps/web/src/routes/_chat.settings.tsx b/apps/web/src/routes/_chat.settings.tsx
index fdc350fe81ab0..7758c9ca55919 100644
--- a/apps/web/src/routes/_chat.settings.tsx
+++ b/apps/web/src/routes/_chat.settings.tsx
@@ -150,7 +150,7 @@ function SettingsRouteLayout() {
   return (
     <SettingsScopeProvider
       search={rawSearch}
-      singleEnvironment={pathname === "/settings/providers"}
+      singleEnvironment={pathname === "/settings/providers" || pathname === "/settings/secrets"}
       onChange={(next) => {
         // Send every axis so retain middleware recognizes "all" as an explicit target.
         void navigate({
diff --git a/apps/web/src/vite-env.d.ts b/apps/web/src/vite-env.d.ts
index 307b9c5d8284d..63f7cca9cbfc6 100644
--- a/apps/web/src/vite-env.d.ts
+++ b/apps/web/src/vite-env.d.ts
@@ -15,6 +15,7 @@ interface ImportMetaEnv {
   readonly VITE_RELAY_OTLP_TRACES_DATASET: string;
   readonly VITE_RELAY_OTLP_TRACES_TOKEN: string;
   readonly T3CODE_DESKTOP_UPDATE_REPOSITORY: string;
+  readonly T3CODE_FEATURE_SECRETS: string;
   readonly APP_VERSION: string;
 }
 
diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts
index 501bac5dba020..da07814b29f6a 100644
--- a/apps/web/vite.config.ts
+++ b/apps/web/vite.config.ts
@@ -49,6 +49,7 @@ const configuredDesktopUpdateRepository =
   process.env.T3CODE_DESKTOP_UPDATE_REPOSITORY?.trim() ||
   process.env.GITHUB_REPOSITORY?.trim() ||
   "";
+const configuredFeatureSecrets = process.env.T3CODE_FEATURE_SECRETS?.trim() || "";
 const configuredHostedAppUrl = (() => {
   const explicitHostedAppUrl = process.env.VITE_HOSTED_APP_URL?.trim();
   if (explicitHostedAppUrl) {
@@ -316,6 +317,7 @@ export default defineConfig(() => {
       "import.meta.env.T3CODE_DESKTOP_UPDATE_REPOSITORY": JSON.stringify(
         configuredDesktopUpdateRepository,
       ),
+      "import.meta.env.T3CODE_FEATURE_SECRETS": JSON.stringify(configuredFeatureSecrets),
       "import.meta.env.VITE_RELEASE_CHANNEL": JSON.stringify(configuredReleaseChannel),
       "import.meta.env.APP_VERSION": JSON.stringify(configuredAppVersion),
     },
diff --git a/packages/contracts/src/settings.test.ts b/packages/contracts/src/settings.test.ts
index 25523c2d0fb4a..fd25d9bb1719e 100644
--- a/packages/contracts/src/settings.test.ts
+++ b/packages/contracts/src/settings.test.ts
@@ -15,6 +15,7 @@ import {
   resolveProjectProviderInstanceEnabled,
   resolveProviderInstanceEnabled,
   ServerSettings,
+  OnePasswordSecretProviderConfig,
   ServerSettingsPatch,
   withIdleCompaction,
 } from "./settings.ts";
@@ -25,6 +26,7 @@ const encodeClientSettings = Schema.encodeSync(ClientSettingsSchema);
 const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
 const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 const encodeServerSettings = Schema.encodeSync(ServerSettings);
+const decodeOnePasswordConfig = Schema.decodeUnknownSync(OnePasswordSecretProviderConfig);
 const decodeClaudeSettings = Schema.decodeUnknownSync(ClaudeSettings);
 
 describe("storage cleanup settings", () => {
@@ -115,6 +117,54 @@ describe("ServerSettings usage price overrides", () => {
   });
 });
 
+describe("ServerSettings secret providers", () => {
+  const onePassword = (account: string) => ({
+    kind: "one_password",
+    label: "Personal",
+    config: { account },
+  });
+
+  it("keeps an unknown kind or a longer label from invalidating the rest of the settings", () => {
+    const openbao = { kind: "openbao", label: "V".repeat(65), config: { address: "https://x" } };
+    const decoded = decodeServerSettings({
+      worktreesDirectory: "/work",
+      secretProviders: { vault: openbao, personal: onePassword("my.1password.com") },
+    });
+    expect(decoded.worktreesDirectory).toBe("/work");
+    expect(encodeServerSettings(decoded).secretProviders).toEqual({
+      vault: openbao,
+      personal: onePassword("my.1password.com"),
+    });
+  });
+
+  it("accepts slug ids and null removals but no id that is not a slug", () => {
+    expect(
+      decodeServerSettingsPatch({
+        secretProviders: { "1password": onePassword("my.1password.com"), work: null },
+      }).secretProviders,
+    ).toEqual({ "1password": onePassword("my.1password.com"), work: null });
+    for (const id of ["", "My Vault", "a/b", "-vault"]) {
+      expect(() =>
+        decodeServerSettingsPatch({ secretProviders: { [id]: onePassword("my.1password.com") } }),
+      ).toThrow();
+    }
+    expect(() =>
+      decodeServerSettingsPatch({
+        secretProviders: { work: { ...onePassword("my.1password.com"), label: "V".repeat(65) } },
+      }),
+    ).toThrow();
+  });
+
+  it("rejects a 1Password account op could misread", () => {
+    for (const account of ["", "my account", "--help"]) {
+      expect(() => decodeOnePasswordConfig({ account })).toThrow();
+    }
+    expect(decodeOnePasswordConfig({ account: "my.1password.com" }).account).toBe(
+      "my.1password.com",
+    );
+  });
+});
+
 describe("custom model settings", () => {
   const capabilities = {
     optionDescriptors: [
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index 16eb51aa1769c..1339a9322fa3a 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -859,6 +859,56 @@ export const UsageLimitSourceConfig = Schema.Struct({
 });
 export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;
 
+// Final once shipped: a key or field that fails here fails the whole settings decode on older builds.
+// Unlike provider slugs it may start with a digit, so a provider named "1Password" fits.
+const SecretProviderSlug = TrimmedNonEmptyString.check(
+  Schema.isMaxLength(64),
+  Schema.isPattern(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/),
+);
+
+export const SecretProviderId = SecretProviderSlug.pipe(Schema.brand("SecretProviderId"));
+export type SecretProviderId = typeof SecretProviderId.Type;
+
+export const SecretProviderKind = SecretProviderSlug.pipe(Schema.brand("SecretProviderKind"));
+export type SecretProviderKind = typeof SecretProviderKind.Type;
+
+const ONE_PASSWORD_ACCOUNT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/**
+ * Any value `op --account` accepts: shorthand, sign-in address, account ID, or user ID.
+ * It is passed to the CLI as an argument, so it can never start with `-`.
+ */
+export const OnePasswordAccount = Schema.String.check(
+  Schema.isMaxLength(253),
+  Schema.makeFilter((value: string) =>
+    ONE_PASSWORD_ACCOUNT_PATTERN.test(value)
+      ? true
+      : "1Password account must be a shorthand, sign-in address, or ID with no spaces.",
+  ),
+).pipe(Schema.brand("OnePasswordAccount"));
+export type OnePasswordAccount = typeof OnePasswordAccount.Type;
+
+export const SecretProviderLabel = TrimmedNonEmptyString.check(Schema.isMaxLength(64));
+
+export const OnePasswordSecretProviderConfig = Schema.Struct({
+  account: OnePasswordAccount,
+});
+export type OnePasswordSecretProviderConfig = typeof OnePasswordSecretProviderConfig.Type;
+
+/** Kinds decode their own config; unknown-kind envelopes round-trip verbatim across versions. */
+export const SecretProviderConfig = Schema.Struct({
+  kind: SecretProviderKind,
+  label: TrimmedNonEmptyString,
+  config: Schema.optionalKey(Schema.Unknown),
+});
+export type SecretProviderConfig = typeof SecretProviderConfig.Type;
+
+// Limits that may change later are enforced on writes only, never on the stored envelope.
+const SecretProviderConfigWrite = Schema.Struct({
+  ...SecretProviderConfig.fields,
+  label: SecretProviderLabel,
+});
+
 export const SourceControlHostSettings = Schema.Record(Schema.String, Schema.Unknown);
 export type SourceControlHostSettings = typeof SourceControlHostSettings.Type;
 
@@ -1313,6 +1363,9 @@ export const ServerSettings = Schema.Struct({
   usageLimitSources: Schema.Record(UsageLimitSourceId, UsageLimitSourceConfig).pipe(
     Schema.withDecodingDefault(Effect.succeed({})),
   ),
+  secretProviders: Schema.Record(SecretProviderId, SecretProviderConfig).pipe(
+    Schema.withDecodingDefault(Effect.succeed({})),
+  ),
   cursorKeychainUsageEnabled: Schema.Boolean.pipe(
     Schema.withDecodingDefault(Effect.succeed(false)),
   ),
@@ -1626,6 +1679,9 @@ export const ServerSettingsPatch = Schema.Struct({
   usageLimitSources: Schema.optionalKey(
     Schema.Record(UsageLimitSourceId, Schema.NullOr(UsageLimitSourceConfig)),
   ),
+  secretProviders: Schema.optionalKey(
+    Schema.Record(SecretProviderId, Schema.NullOr(SecretProviderConfigWrite)),
+  ),
   cursorKeychainUsageEnabled: Schema.optionalKey(Schema.Boolean),
 
   usagePriceOverrides: Schema.optionalKey(
@@ -1645,7 +1701,12 @@ export function requiredScopesForServerSettingsPatch(
   let changesSettings = false;
   for (const [key, value] of Object.entries(patch)) {
     if (value === undefined) continue;
-    if (key === "providers" || key === "providerInstances" || key === "usageLimitSources") {
+    if (
+      key === "providers" ||
+      key === "providerInstances" ||
+      key === "usageLimitSources" ||
+      key === "secretProviders"
+    ) {
       changesProviders = true;
     } else {
       changesSettings = true;
diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index f9a43b6123a1e..bd315271c78e1 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -1,8 +1,11 @@
 import {
   DEFAULT_SERVER_SETTINGS,
+  OnePasswordAccount,
   ProjectId,
   ProviderDriverKind,
   ProviderInstanceId,
+  SecretProviderId,
+  SecretProviderKind,
   UsageLimitSourceId,
   type ServerProvider,
 } from "@t3tools/contracts";
@@ -544,6 +547,28 @@ describe("serverSettings helpers", () => {
     expect(Object.keys(removed.usageLimitSources)).toEqual([hubB]);
   });
 
+  it("upserts and removes secretProviders per entry so concurrent edits cannot clobber", () => {
+    const personal = SecretProviderId.make("personal");
+    const work = SecretProviderId.make("work");
+    const onePassword = (label: string, account: string) => ({
+      kind: SecretProviderKind.make("one_password"),
+      label,
+      config: { account: OnePasswordAccount.make(account) },
+    });
+    const current = {
+      ...DEFAULT_SERVER_SETTINGS,
+      secretProviders: { [personal]: onePassword("Personal", "my.1password.com") },
+    };
+
+    const added = applyServerSettingsPatch(current, {
+      secretProviders: { [work]: onePassword("Work", "team.1password.com") },
+    });
+    expect(Object.keys(added.secretProviders)).toEqual([personal, work]);
+
+    const removed = applyServerSettingsPatch(added, { secretProviders: { [personal]: null } });
+    expect(Object.keys(removed.secretProviders)).toEqual([work]);
+  });
+
   it("replaces and removes individual usage prices without clobbering other models", () => {
     const prices = { inputCostPerMillionTokens: 2, outputCostPerMillionTokens: 8 };
     const current = applyServerSettingsPatch(DEFAULT_SERVER_SETTINGS, {
diff --git a/packages/shared/src/serverSettings.ts b/packages/shared/src/serverSettings.ts
index e7c856070658a..11eecc6fe3df8 100644
--- a/packages/shared/src/serverSettings.ts
+++ b/packages/shared/src/serverSettings.ts
@@ -357,6 +357,7 @@ export function applyServerSettingsPatch(
     worktreeCleanup: worktreeCleanupPatch,
     // Merged per entry below; its `null` removals must not reach deepMerge.
     usageLimitSources: usageLimitSourcesPatch,
+    secretProviders: secretProvidersPatch,
     sourceControlHosts: sourceControlHostsPatch,
     usagePriceOverrides: usagePriceOverridesPatch,
     usageModelAliases: usageModelAliasesPatch,
@@ -554,6 +555,9 @@ export function applyServerSettingsPatch(
           ),
         }
       : {}),
+    ...(secretProvidersPatch !== undefined
+      ? { secretProviders: mergeSettingsEntries(current.secretProviders, secretProvidersPatch) }
+      : {}),
     ...(usagePriceOverridesPatch !== undefined
       ? {
           usagePriceOverrides: mergeSettingsEntries(

From d15278481b984379d1b639a93315c188b7e3fe67 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:39:01 -0500
Subject: [PATCH 018/146] fix(mobile): use monospace in the Android terminal
 preview (#23401)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../settings/appearance/components/AppearancePreviews.tsx       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/mobile/src/features/settings/appearance/components/AppearancePreviews.tsx b/apps/mobile/src/features/settings/appearance/components/AppearancePreviews.tsx
index 644c6d25ee3d4..afcf4ba30d9a1 100644
--- a/apps/mobile/src/features/settings/appearance/components/AppearancePreviews.tsx
+++ b/apps/mobile/src/features/settings/appearance/components/AppearancePreviews.tsx
@@ -44,7 +44,7 @@ export function TerminalAppearancePreview(props: { readonly fontSize: number })
   const theme = getMobileTerminalTheme(themeId, scheme);
   const lineHeight = Math.round(props.fontSize * 1.6);
   const lineStyle = {
-    fontFamily: "Menlo",
+    fontFamily: Platform.OS === "android" ? "monospace" : "Menlo",
     fontSize: props.fontSize,
     lineHeight,
   } as const;

From ecea6ca3e60cadb95248732d37de0e715ed6ab78 Mon Sep 17 00:00:00 2001
From: Lakshmi Tanmay <lakshmi@voltcrash.com>
Date: Thu, 29 Oct 2026 23:09:24 +0530
Subject: [PATCH 019/146] fix(web): edit from here uses a pencil icon (#21878)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/components/chat/TimelineUserMessageRow.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/chat/TimelineUserMessageRow.tsx b/apps/web/src/components/chat/TimelineUserMessageRow.tsx
index 2b231f6ddfe35..66cbb0bcc5ed4 100644
--- a/apps/web/src/components/chat/TimelineUserMessageRow.tsx
+++ b/apps/web/src/components/chat/TimelineUserMessageRow.tsx
@@ -34,7 +34,7 @@ import {
   type LucideIcon,
   MessagesSquareIcon,
   Redo2Icon,
-  Undo2Icon,
+  PencilIcon,
 } from "lucide-react";
 import { Link as LinkIconNode } from "lucide";
 import { Button, InlineButton } from "../ui/button";
@@ -744,7 +744,7 @@ function RevertUserMessageButton({
           />
         }
       >
-        <Undo2Icon className="size-3" />
+        <PencilIcon className="size-3" />
       </TooltipTrigger>
       <TooltipPopup side="top">Edit from here</TooltipPopup>
     </Tooltip>

From b4da8962fc871e221d00ae2c2790b2984998bc1c Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:39:47 -0500
Subject: [PATCH 020/146] fix(desktop): clear Cache Storage when deleting
 browser profile data (#22002)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/desktop/src/preview/BrowserSession.test.ts | 5 +++++
 apps/desktop/src/preview/BrowserSession.ts      | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/preview/BrowserSession.test.ts b/apps/desktop/src/preview/BrowserSession.test.ts
index 22af4a829e049..b1f2b7ca0df92 100644
--- a/apps/desktop/src/preview/BrowserSession.test.ts
+++ b/apps/desktop/src/preview/BrowserSession.test.ts
@@ -280,11 +280,16 @@ describe("BrowserSession", () => {
       assert.isUndefined(sessions.get(partition));
 
       yield* browserSessions.getSession("scope-untouched");
+      const other = yield* browserSessions.getSession("scope-other");
       yield* browserSessions.clearCookies([partition]);
 
       const created = sessions.get(partition);
       assert.isDefined(created);
       assert.strictEqual(created.clearStorageData.mock.calls.length, 1);
+      assert.deepStrictEqual(created.clearStorageData.mock.calls[0]?.[0], {
+        storages: ["cookies", "localstorage", "indexdb", "serviceworkers", "cachestorage"],
+      });
+      assert.strictEqual(vi.mocked(other.clearStorageData).mock.calls.length, 0);
     }).pipe(Effect.provide(layer)),
   );
 });
diff --git a/apps/desktop/src/preview/BrowserSession.ts b/apps/desktop/src/preview/BrowserSession.ts
index 2ea7efdb88ee0..e467c370d0f5b 100644
--- a/apps/desktop/src/preview/BrowserSession.ts
+++ b/apps/desktop/src/preview/BrowserSession.ts
@@ -367,7 +367,7 @@ export const make = Effect.gen(function* BrowserSessionMake() {
           Effect.tryPromise({
             try: () =>
               browserSession.clearStorageData({
-                storages: ["cookies", "localstorage", "indexdb", "serviceworkers"],
+                storages: ["cookies", "localstorage", "indexdb", "serviceworkers", "cachestorage"],
               }),
             catch: (cause) =>
               new BrowserSessionStorageClearError({

From 3d5baafecf5cb8ad22ca37962327fa4fdc130663 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Thu, 29 Oct 2026 17:40:10 +0000
Subject: [PATCH 021/146] fix(web): respect reduced motion in thread loading
 controls (#22100)

Co-authored-by: SAPHID <saphid@users.noreply.github.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/components/chat/ThreadLineageWorkflowRow.tsx   | 5 +++--
 apps/web/src/components/chat/ThreadRelationshipsControl.tsx | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/components/chat/ThreadLineageWorkflowRow.tsx b/apps/web/src/components/chat/ThreadLineageWorkflowRow.tsx
index 2e00e47ee7da0..f1df96dd92133 100644
--- a/apps/web/src/components/chat/ThreadLineageWorkflowRow.tsx
+++ b/apps/web/src/components/chat/ThreadLineageWorkflowRow.tsx
@@ -3,7 +3,7 @@ import type {
   RuntimeSubagent,
 } from "@t3tools/client-runtime/state/subagentRuntime";
 import type { ProviderDriverKind, ProviderInstanceId, ServerProvider } from "@t3tools/contracts";
-import { ChevronDownIcon, LoaderCircleIcon, SquareIcon } from "lucide-react";
+import { ChevronDownIcon, SquareIcon } from "lucide-react";
 import { useState, type ReactNode } from "react";
 
 import { AgentElapsed } from "./AgentElapsed";
@@ -14,6 +14,7 @@ import { cn } from "../../lib/utils";
 import { ThreadDetailsControl } from "./ThreadDetailsControl";
 import { CollapsibleSectionHeader, SectionHeaderStatus } from "../ui/collapsible-section-header";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
+import { Spinner } from "../ui/spinner";
 import {
   THREAD_DETAILS_PANEL_SPLIT_GROUP_CLASS,
   THREAD_DETAILS_PANEL_SPLIT_SEPARATOR_CLASS,
@@ -158,7 +159,7 @@ export function ThreadLineageWorkflowRow({
                 }
               >
                 {stopping ? (
-                  <LoaderCircleIcon aria-hidden className="size-3 animate-spin" />
+                  <Spinner aria-hidden size="xs" />
                 ) : (
                   <SquareIcon aria-hidden className="size-3 fill-current" />
                 )}
diff --git a/apps/web/src/components/chat/ThreadRelationshipsControl.tsx b/apps/web/src/components/chat/ThreadRelationshipsControl.tsx
index e107bbc4039c0..69403392b5ce8 100644
--- a/apps/web/src/components/chat/ThreadRelationshipsControl.tsx
+++ b/apps/web/src/components/chat/ThreadRelationshipsControl.tsx
@@ -49,7 +49,6 @@ import {
   ChevronDownIcon,
   CornerLeftUpIcon,
   GitForkIcon,
-  LoaderCircleIcon,
   MoreHorizontalIcon,
   PlusIcon,
   SquareIcon,
@@ -76,6 +75,7 @@ import { ThreadLineageWorkflowRow } from "./ThreadLineageWorkflowRow";
 import { Menu, MenuItem, MenuPopup, MenuTrigger } from "../ui/menu";
 import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
 import { toastManager } from "../ui/toast";
+import { Spinner } from "../ui/spinner";
 import { cn } from "~/lib/utils";
 import {
   THREAD_DETAILS_PANEL_CHEVRON_CLASS,
@@ -802,7 +802,7 @@ export function ThreadRelationshipsPanel(props: {
                               onClick={() => void merge()}
                             >
                               {busyAction === "merge" ? (
-                                <LoaderCircleIcon className="size-3 animate-spin" />
+                                <Spinner size="xs" />
                               ) : (
                                 <PullRequestGlyph.merged className="size-3" />
                               )}
@@ -841,7 +841,7 @@ export function ThreadRelationshipsPanel(props: {
                           }
                         >
                           {stoppingId === threadId ? (
-                            <LoaderCircleIcon aria-hidden className="size-3 animate-spin" />
+                            <Spinner aria-hidden size="xs" />
                           ) : (
                             <SquareIcon aria-hidden className="size-3 fill-current" />
                           )}

From 49d014245777bbf47756635886ddf0846d2330d3 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:40:33 -0500
Subject: [PATCH 022/146] fix(provider-acp): redact API keys with underscores
 in ACP stderr logs (#24015)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/provider-acp/src/server/stderr.test.ts | 13 +++++++++++++
 packages/provider-acp/src/server/stderr.ts      |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/provider-acp/src/server/stderr.test.ts b/packages/provider-acp/src/server/stderr.test.ts
index f582f47984ffb..fdf3c68f97e4d 100644
--- a/packages/provider-acp/src/server/stderr.test.ts
+++ b/packages/provider-acp/src/server/stderr.test.ts
@@ -50,4 +50,17 @@ describe("AcpStderr", () => {
     expect(excerpt).not.toContain("dXNlcjpwYXNz");
     expect(excerpt).not.toContain("ant-api-key-value");
   });
+
+  it("redacts the whole key when its body contains underscores", () => {
+    const excerpt = sanitizeAcpStderrExcerpt(
+      [
+        "anthropic=sk-ant-api03-AbCdEf_GhIjKlMnOpQr-StUvWx_yz0123456789-AA",
+        "openai=sk-proj-AbCdEfGhIj_KlMnOpQrStUv-WxYz_0123456789",
+      ].join("\n"),
+      "/Users/ada",
+      {},
+    );
+
+    expect(excerpt).toBe("anthropic=[redacted]\nopenai=[redacted]");
+  });
 });
diff --git a/packages/provider-acp/src/server/stderr.ts b/packages/provider-acp/src/server/stderr.ts
index f988f2d632d97..92ae01a4c27ef 100644
--- a/packages/provider-acp/src/server/stderr.ts
+++ b/packages/provider-acp/src/server/stderr.ts
@@ -6,7 +6,7 @@ const BEARER_TOKEN_PATTERN = /\bBearer\s+[A-Za-z0-9._\-+=/]+/gi;
 const BASIC_AUTH_PATTERN = /\bAuthorization:\s*Basic\s+\S+/gi;
 const API_KEY_HEADER_PATTERN = /\bx-api-key:\s*\S+/gi;
 const SECRET_TOKEN_PATTERN =
-  /\b(?:sk-[A-Za-z0-9][A-Za-z0-9-]{7,}|ghp_[A-Za-z0-9]+|xox[a-zA-Z]-[A-Za-z0-9-]+)\b/g;
+  /\b(?:sk-[A-Za-z0-9][A-Za-z0-9_-]{7,}|ghp_[A-Za-z0-9]+|xox[a-zA-Z]-[A-Za-z0-9-]+)\b/g;
 
 export function appendAcpStderrTail(current: string, chunk: string): string {
   const next = `${current}${chunk}`;

From 67afdd56c7905e9df721c61f5795578bb8c27867 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:40:55 -0500
Subject: [PATCH 023/146] fix(provider-core): redact compound credential keys
 in provider errors (#23313)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/provider-core/src/server/failure.test.ts | 14 ++++++++++++++
 packages/provider-core/src/server/failure.ts      |  4 ++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/packages/provider-core/src/server/failure.test.ts b/packages/provider-core/src/server/failure.test.ts
index 8fb2e153aa109..a50d3dac9599c 100644
--- a/packages/provider-core/src/server/failure.test.ts
+++ b/packages/provider-core/src/server/failure.test.ts
@@ -41,6 +41,20 @@ it("redacts credentials and URL secrets from provider failures", () => {
   assert.notInclude(failure.message, "sk-abcdefghijklmnop");
 });
 
+it("redacts credentials whose key names end in a credential word", () => {
+  const failure = makeProviderFailure({
+    code: '{"refresh_token":"code value"}',
+    message:
+      'oauth refresh failed: client_secret=client-value refresh_token=refresh-value {"client_secret":"json-value"} clientSecret: camel-value X-Auth-Token: header-value max_tokens=4096',
+  });
+
+  assert.equal(failure.code, '{"refresh_token":"[REDACTED]"}');
+  assert.equal(
+    failure.message,
+    'oauth refresh failed: client_secret=[REDACTED] refresh_token=[REDACTED] {"client_secret":"[REDACTED]"} clientSecret: [REDACTED] X-Auth-Token: [REDACTED] max_tokens=4096',
+  );
+});
+
 it("does not split a surrogate pair at the truncation boundary", () => {
   const failure = makeProviderFailure({
     message: `${"a".repeat(MAX_PROVIDER_FAILURE_MESSAGE_LENGTH - 2)}🚀tail`,
diff --git a/packages/provider-core/src/server/failure.ts b/packages/provider-core/src/server/failure.ts
index b0ac1ed8b938d..2dd418ea2dfac 100644
--- a/packages/provider-core/src/server/failure.ts
+++ b/packages/provider-core/src/server/failure.ts
@@ -194,11 +194,11 @@ function redactProviderFailureText(value: string): string {
     .replace(/\bhttps?:\/\/[^\s<>"']+/giu, redactUrl)
     .replace(/\b(Bearer|Basic)\s+[^\s,;]+/giu, "$1 [REDACTED]")
     .replace(
-      /(["'](?:access[_-]?token|api[_-]?key|authorization|credential|password|secret|token)["']\s*:\s*["'])[^"']*(["'])/giu,
+      /(["'][\w-]*(?:access[_-]?token|api[_-]?key|authorization|credential|password|secret|token)["']\s*:\s*["'])[^"']*(["'])/giu,
       "$1[REDACTED]$2",
     )
     .replace(
-      /(\b(?:access[_-]?token|api[_-]?key|authorization|credential|password|secret|token)\b\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/giu,
+      /((?<![\w-])[\w-]*(?:access[_-]?token|api[_-]?key|authorization|credential|password|secret|token)\b\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/giu,
       "$1[REDACTED]",
     )
     .replace(/\bsk-[A-Za-z0-9_-]{16,}\b/gu, "[REDACTED]")

From 456892da72abbf6cbe9140774a82265fe1329b7f Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:41:28 -0500
Subject: [PATCH 024/146] fix(web): show rounded diff counts as 1m instead of
 1000k (#23723)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/components/chat/DiffStatLabel.test.ts | 12 ++++++++++++
 apps/web/src/components/chat/DiffStatLabel.tsx     |  6 +++---
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 apps/web/src/components/chat/DiffStatLabel.test.ts

diff --git a/apps/web/src/components/chat/DiffStatLabel.test.ts b/apps/web/src/components/chat/DiffStatLabel.test.ts
new file mode 100644
index 0000000000000..2ea8bcdb83559
--- /dev/null
+++ b/apps/web/src/components/chat/DiffStatLabel.test.ts
@@ -0,0 +1,12 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { formatCompactDiffCount } from "./DiffStatLabel";
+
+describe("formatCompactDiffCount", () => {
+  it("promotes counts when rounding reaches the next suffix", () => {
+    expect(formatCompactDiffCount(999_499)).toBe("999k");
+    expect(formatCompactDiffCount(999_500)).toBe("1m");
+    expect(formatCompactDiffCount(999_499_999)).toBe("999m");
+    expect(formatCompactDiffCount(999_500_000)).toBe("1b");
+  });
+});
diff --git a/apps/web/src/components/chat/DiffStatLabel.tsx b/apps/web/src/components/chat/DiffStatLabel.tsx
index 9e4c0f7cef5e9..2b60c35723a6f 100644
--- a/apps/web/src/components/chat/DiffStatLabel.tsx
+++ b/apps/web/src/components/chat/DiffStatLabel.tsx
@@ -5,13 +5,13 @@ export function hasNonZeroStat(stat: { additions: number; deletions: number }):
   return stat.additions > 0 || stat.deletions > 0;
 }
 
-function formatCompactDiffCount(value: number): string {
+export function formatCompactDiffCount(value: number): string {
   if (value < 1000) return String(value);
-  if (value < 1_000_000) {
+  if (value < 999_500) {
     const k = value / 1000;
     return `${k < 10 ? k.toFixed(1).replace(/\.0$/, "") : Math.round(k)}k`;
   }
-  if (value < 1_000_000_000) {
+  if (value < 999_500_000) {
     const m = value / 1_000_000;
     return `${m < 10 ? m.toFixed(1).replace(/\.0$/, "") : Math.round(m)}m`;
   }

From 5e35f6ea1cec83da27a456818e5581dd24d325f2 Mon Sep 17 00:00:00 2001
From: tiliakoos <73005126+tiliakoos@users.noreply.github.com>
Date: Thu, 29 Oct 2026 13:41:51 -0400
Subject: [PATCH 025/146] fix(desktop): a timed-out login-shell probe no longer
 skips the server's PATH repair (#21771)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/shell/DesktopShellEnvironment.test.ts  | 18 ++++++++++++++++--
 .../src/shell/DesktopShellEnvironment.ts       |  6 ++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
index 9d12ed5a07fe6..4804823069024 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.test.ts
@@ -149,7 +149,7 @@ describe("DesktopShellEnvironment", () => {
       };
       const commands: ChildProcess.Command[] = [];
 
-      yield* runShellEnvironment({
+      const prepared = yield* runShellEnvironment({
         env,
         platform: "darwin",
         handler: (command) => {
@@ -167,6 +167,7 @@ describe("DesktopShellEnvironment", () => {
       assert.equal(env.PATH, "/opt/homebrew/bin:/usr/bin:/Users/test/.local/bin");
       assert.equal(env.SSH_AUTH_SOCK, "/tmp/secretive.sock");
       assert.equal(env.HOMEBREW_PREFIX, "/opt/homebrew");
+      assert.isTrue(prepared);
     }),
   );
 
@@ -267,7 +268,7 @@ describe("DesktopShellEnvironment", () => {
       };
       const commands: string[] = [];
 
-      yield* runShellEnvironment({
+      const prepared = yield* runShellEnvironment({
         env,
         platform: "darwin",
         handler: (command) => {
@@ -279,6 +280,19 @@ describe("DesktopShellEnvironment", () => {
 
       assert.deepEqual(commands, ["/opt/homebrew/bin/nu", "/bin/zsh", "/bin/launchctl"]);
       assert.equal(env.PATH, "/opt/homebrew/bin:/usr/bin");
+      assert.isFalse(prepared);
+    }),
+  );
+
+  it.effect("leaves macOS preparation incomplete when no login shell returns a PATH", () =>
+    Effect.gen(function* () {
+      const prepared = yield* runShellEnvironment({
+        env: { SHELL: "/bin/zsh", PATH: "/usr/bin:/bin:/usr/sbin:/sbin" },
+        platform: "darwin",
+        handler: () => "",
+      });
+
+      assert.isFalse(prepared);
     }),
   );
 
diff --git a/apps/desktop/src/shell/DesktopShellEnvironment.ts b/apps/desktop/src/shell/DesktopShellEnvironment.ts
index 25c37ecefc051..6e0fdbd38050f 100644
--- a/apps/desktop/src/shell/DesktopShellEnvironment.ts
+++ b/apps/desktop/src/shell/DesktopShellEnvironment.ts
@@ -392,7 +392,7 @@ const installPosixEnvironment = Effect.fn("desktop.shellEnvironment.installPosix
   function* (
     config: ShellEnvironmentConfig,
   ): Effect.fn.Return<
-    void,
+    boolean,
     never,
     ChildProcessSpawner.ChildProcessSpawner | FileSystem.FileSystem
   > {
@@ -491,6 +491,8 @@ const installPosixEnvironment = Effect.fn("desktop.shellEnvironment.installPosix
         }
       }
     }
+
+    return Option.isSome(trimNonEmpty(shellEnvironment.PATH));
   },
 );
 
@@ -505,7 +507,7 @@ const installShellEnvironment = (
     return installWindowsEnvironment(config);
   }
   if (config.platform === "darwin" || config.platform === "linux") {
-    return installPosixEnvironment(config).pipe(Effect.as(true));
+    return installPosixEnvironment(config);
   }
   return Effect.succeed(false);
 };

From 55e7b5f66d6bd9f3e8e1ba06d20262afcc9ea64c Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:42:15 -0500
Subject: [PATCH 026/146] fix(server): keep the previous preview browser
 version on a shared home (#23771)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../server/src/preview/PreviewBrowser.test.ts | 19 ++++++++++---------
 apps/server/src/preview/PreviewBrowser.ts     |  7 +++++--
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/apps/server/src/preview/PreviewBrowser.test.ts b/apps/server/src/preview/PreviewBrowser.test.ts
index 0cb1665d4f3d4..a5c241229a377 100644
--- a/apps/server/src/preview/PreviewBrowser.test.ts
+++ b/apps/server/src/preview/PreviewBrowser.test.ts
@@ -73,6 +73,7 @@ const browserArchive = makeZip([
 
 const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (
   options: {
+    readonly version?: string;
     readonly archive?: Buffer;
     readonly sha256?: string;
     readonly body?: Stream.Stream<Uint8Array>;
@@ -93,7 +94,7 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (
     release: options.unsupported
       ? null
       : {
-          version: "1.2.3",
+          version: options.version ?? "1.2.3",
           platform: "fixture",
           url: "https://storage.googleapis.com/chrome-headless-shell-fixture.zip",
           bytes: archive.byteLength,
@@ -121,10 +122,11 @@ const makeHarness = Effect.fn("test.makePreviewBrowser")(function* (
 });
 
 it.layer(NodeServices.layer)("PreviewBrowser", (it) => {
-  it.effect("installs a verified download with its file modes and then reuses it", () =>
+  it.effect.each(["0.8.0", "1.2.3"])("retains another version when installing %s", (current) =>
     Effect.gen(function* () {
-      const { browser, fs, path, installRoot, requests } = yield* makeHarness();
-      yield* fs.makeDirectory(path.join(installRoot, "1.0.0"), { recursive: true });
+      const { browser, fs, path, installRoot, requests } = yield* makeHarness({ version: current });
+      yield* fs.makeDirectory(path.join(installRoot, "0.9.0"), { recursive: true });
+      yield* fs.makeDirectory(path.join(installRoot, "0.10.0"));
       const active = path.join(installRoot, ".install-other");
       const abandoned = path.join(installRoot, ".install-abandoned");
       yield* fs.makeDirectory(active);
@@ -135,7 +137,7 @@ it.layer(NodeServices.layer)("PreviewBrowser", (it) => {
 
       const executable = yield* browser.executable;
 
-      const version = path.join(installRoot, "1.2.3");
+      const version = path.join(installRoot, current);
       expect(executable).toBe(path.join(version, executableName));
       expect(yield* fs.readFileString(path.join(version, "locales", "en-US.pak"))).toBe("strings");
       if (hostPlatform !== "win32") {
@@ -145,10 +147,9 @@ it.layer(NodeServices.layer)("PreviewBrowser", (it) => {
         expect(yield* mode("libEGL.so")).toBe(0o755);
         expect(yield* mode(path.join("locales", "en-US.pak"))).toBe(0o644);
       }
-      expect((yield* fs.readDirectory(installRoot)).toSorted()).toEqual([
-        ".install-other",
-        "1.2.3",
-      ]);
+      expect((yield* fs.readDirectory(installRoot)).toSorted()).toEqual(
+        [".install-other", "0.10.0", current].toSorted(),
+      );
       expect(yield* browser.executable).toBe(executable);
       expect(yield* browser.installed).toEqual(Option.some(executable));
       expect(requests).toHaveLength(1);
diff --git a/apps/server/src/preview/PreviewBrowser.ts b/apps/server/src/preview/PreviewBrowser.ts
index d13b495ef5c20..ea5539aad5e02 100644
--- a/apps/server/src/preview/PreviewBrowser.ts
+++ b/apps/server/src/preview/PreviewBrowser.ts
@@ -321,11 +321,14 @@ export const makePreviewBrowser = Effect.fn("PreviewBrowser.make")(function* (
         yield* fs.remove(destination, { recursive: true, force: true });
         yield* fs.rename(unpacked, destination);
       }).pipe(Effect.scoped);
-      // Shared homes may have another server installing; preserve staging directories touched within the last hour.
+      // Shared homes may still use the newest other version or staging directories touched within the last hour.
       const entries = yield* fs.readDirectory(installRoot);
+      const previous = entries
+        .filter((name) => name !== release.version && !name.startsWith("."))
+        .toSorted((left, right) => right.localeCompare(left, "en", { numeric: true }))[0];
       const now = yield* Clock.currentTimeMillis;
       yield* Effect.forEach(
-        entries.filter((name) => name !== release.version),
+        entries.filter((name) => name !== release.version && name !== previous),
         (name) =>
           Effect.gen(function* () {
             const target = path.join(installRoot, name);

From ee81ea4ce80ad21f5ee89b810127acf3ac126b1d Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 10:42:31 -0700
Subject: [PATCH 027/146] fix(settings): servers check secret provider writes
 and keep unknown configs to themselves (#27044)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/serverSettings.test.ts        | 18 ++++++++++++++
 apps/server/src/serverSettings.ts             | 17 ++++++++++++-
 apps/server/src/ws.ts                         |  1 +
 .../components/settings/SecretsSettings.tsx   | 11 ++++++++-
 packages/contracts/src/server.ts              |  2 ++
 packages/contracts/src/settings.test.ts       | 13 +++++-----
 packages/contracts/src/settings.ts            | 24 +++++++++++++++++--
 7 files changed, 75 insertions(+), 11 deletions(-)

diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index bd985cab203ac..29dea381e759a 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -235,6 +235,24 @@ it.layer(NodeServices.layer)("server settings", (it) => {
     }).pipe(Effect.provide(layerServerSettings())),
   );
 
+  it.effect("sends clients a known secret provider's config but never an unknown kind's", () =>
+    Effect.gen(function* () {
+      const settings = yield* decodeServerSettings({
+        secretProviders: {
+          personal: { kind: "one_password", label: "Personal", config: { account: "my" } },
+          vault: { kind: "openbao", label: "Vault", config: { token: "bao-token" } },
+        },
+      });
+      assert.deepStrictEqual<unknown>(
+        ServerSettingsModule.redactServerSettingsForClient(settings).secretProviders,
+        {
+          personal: { kind: "one_password", label: "Personal", config: { account: "my" } },
+          vault: { kind: "openbao", label: "Vault" },
+        },
+      );
+    }),
+  );
+
   it.effect("saves through a symlinked settings file without replacing the link", () =>
     Effect.gen(function* () {
       const config = yield* ServerConfig.ServerConfig;
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index a1e0d34c7dd53..e386b95cf506c 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -7,6 +7,7 @@ import {
   type ProviderInstanceConfig,
   type ProviderInstanceMutation,
   defaultInstanceIdForDriver,
+  isKnownSecretProviderKind,
   isProviderDriverKind,
   ProviderDriverKind,
   ProviderInstanceId,
@@ -128,11 +129,25 @@ const normalizeServerSettings = (
   );
 
 export function redactServerSettingsForClient(settings: ServerSettings): ServerSettings {
-  return mapSettingsSecrets(settings, (secret) =>
+  const redacted = mapSettingsSecrets(settings, (secret) =>
     secret.sensitive
       ? { value: "", redacted: secret.redacted || secret.value.length > 0 }
       : { value: secret.value, redacted: false },
   );
+  return { ...redacted, secretProviders: withoutUnknownSecretProviderConfigs(redacted) };
+}
+
+// A newer kind's config may hold credentials this build cannot recognize, so it never leaves the server.
+function withoutUnknownSecretProviderConfigs(
+  settings: ServerSettings,
+): ServerSettings["secretProviders"] {
+  return Object.fromEntries(
+    Object.entries(settings.secretProviders).map(([id, entry]) => {
+      if (isKnownSecretProviderKind(entry.kind)) return [id, entry];
+      const { config: _config, ...envelope } = entry;
+      return [id, envelope];
+    }),
+  ) as ServerSettings["secretProviders"];
 }
 
 export function applyProviderInstanceMutation(
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 8c8509550bc11..86c7a4db56af4 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -1791,6 +1791,7 @@ export const layerWsRpc = (
           threadSnapshotPagination: true,
           threadFind: true,
           threadFindProgressive: true,
+          secretProviderSettings: true,
           ...Option.match(scratchWorkspaceRoot, {
             onNone: () => ({}),
             onSome: (root) => ({ scratchWorkspaceRoot: root }),
diff --git a/apps/web/src/components/settings/SecretsSettings.tsx b/apps/web/src/components/settings/SecretsSettings.tsx
index e9efe2d85f6ed..2ff329ca6b73a 100644
--- a/apps/web/src/components/settings/SecretsSettings.tsx
+++ b/apps/web/src/components/settings/SecretsSettings.tsx
@@ -35,9 +35,18 @@ const SECRET_PROVIDER_KINDS: Readonly<
 
 export function SecretsSettingsPanel() {
   const { scope, environment } = useSettingsScope();
+  const connected = environment?.connection.phase === "connected";
   return (
     <SettingsPageContainer>
-      {environment?.connection.phase === "connected" ? (
+      {connected &&
+      environment.serverConfig !== null &&
+      environment.serverConfig.secretProviderSettings !== true ? (
+        <SettingsSection {...searchableSetting("secret-providers")}>
+          <p className="px-4 py-3 text-sm text-muted-foreground">
+            Update T3 Code on {environment.label} to manage its secret providers.
+          </p>
+        </SettingsSection>
+      ) : connected ? (
         <EnvironmentSecretProviders
           key={environment.environmentId}
           environment={environment}
diff --git a/packages/contracts/src/server.ts b/packages/contracts/src/server.ts
index 92dc88be173a8..9fd3813abf5fa 100644
--- a/packages/contracts/src/server.ts
+++ b/packages/contracts/src/server.ts
@@ -638,6 +638,8 @@ export const ServerConfig = Schema.Struct({
   threadSnapshotPagination: Schema.optionalKey(Schema.Boolean),
   threadFind: Schema.optionalKey(Schema.Boolean),
   threadFindProgressive: Schema.optionalKey(Schema.Boolean),
+  /** Settings patches may carry `secretProviders`; older servers drop the key without an error. */
+  secretProviderSettings: Schema.optionalKey(Schema.Boolean),
   scratchWorkspaceRoot: Schema.optionalKey(TrimmedNonEmptyString),
   newProjectsRoot: Schema.optionalKey(TrimmedNonEmptyString),
   /**
diff --git a/packages/contracts/src/settings.test.ts b/packages/contracts/src/settings.test.ts
index fd25d9bb1719e..6088cf7a2fa2a 100644
--- a/packages/contracts/src/settings.test.ts
+++ b/packages/contracts/src/settings.test.ts
@@ -15,7 +15,6 @@ import {
   resolveProjectProviderInstanceEnabled,
   resolveProviderInstanceEnabled,
   ServerSettings,
-  OnePasswordSecretProviderConfig,
   ServerSettingsPatch,
   withIdleCompaction,
 } from "./settings.ts";
@@ -26,7 +25,6 @@ const encodeClientSettings = Schema.encodeSync(ClientSettingsSchema);
 const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
 const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 const encodeServerSettings = Schema.encodeSync(ServerSettings);
-const decodeOnePasswordConfig = Schema.decodeUnknownSync(OnePasswordSecretProviderConfig);
 const decodeClaudeSettings = Schema.decodeUnknownSync(ClaudeSettings);
 
 describe("storage cleanup settings", () => {
@@ -155,13 +153,14 @@ describe("ServerSettings secret providers", () => {
     ).toThrow();
   });
 
-  it("rejects a 1Password account op could misread", () => {
+  it("rejects writes of an unknown kind or an account op could misread", () => {
+    const write = (entry: unknown) => () =>
+      decodeServerSettingsPatch({ secretProviders: { personal: entry } });
     for (const account of ["", "my account", "--help"]) {
-      expect(() => decodeOnePasswordConfig({ account })).toThrow();
+      expect(write(onePassword(account))).toThrow();
     }
-    expect(decodeOnePasswordConfig({ account: "my.1password.com" }).account).toBe(
-      "my.1password.com",
-    );
+    expect(write({ kind: "one_password", label: "Personal" })).toThrow();
+    expect(write({ kind: "openbao", label: "Vault", config: { address: "https://x" } })).toThrow();
   });
 });
 
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index 1339a9322fa3a..c7d61aeb5ee21 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -859,7 +859,7 @@ export const UsageLimitSourceConfig = Schema.Struct({
 });
 export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;
 
-// Final once shipped: a key or field that fails here fails the whole settings decode on older builds.
+// Final once shipped: older builds drop entries whose key fails here, and erase them on their next save.
 // Unlike provider slugs it may start with a digit, so a provider named "1Password" fits.
 const SecretProviderSlug = TrimmedNonEmptyString.check(
   Schema.isMaxLength(64),
@@ -903,11 +903,31 @@ export const SecretProviderConfig = Schema.Struct({
 });
 export type SecretProviderConfig = typeof SecretProviderConfig.Type;
 
+/** Kinds this build can resolve. Their `config` holds no credentials, so clients may read it. */
+const SECRET_PROVIDER_KIND_CONFIG_GUARDS: Readonly<Record<string, (config: unknown) => boolean>> = {
+  one_password: Schema.is(OnePasswordSecretProviderConfig),
+};
+
+export function isKnownSecretProviderKind(kind: string): boolean {
+  return Object.hasOwn(SECRET_PROVIDER_KIND_CONFIG_GUARDS, kind);
+}
+
 // Limits that may change later are enforced on writes only, never on the stored envelope.
+// Writes must be a kind this build knows with a config it accepts, so an older server
+// rejects a newer kind instead of storing what it cannot check.
 const SecretProviderConfigWrite = Schema.Struct({
   ...SecretProviderConfig.fields,
   label: SecretProviderLabel,
-});
+}).check(
+  Schema.makeFilter((entry) => {
+    if (!isKnownSecretProviderKind(entry.kind)) {
+      return `Unsupported secret provider kind: ${entry.kind}.`;
+    }
+    return SECRET_PROVIDER_KIND_CONFIG_GUARDS[entry.kind]!(entry.config)
+      ? true
+      : `Invalid ${entry.kind} secret provider config.`;
+  }),
+);
 
 export const SourceControlHostSettings = Schema.Record(Schema.String, Schema.Unknown);
 export type SourceControlHostSettings = typeof SourceControlHostSettings.Type;

From bfee44655ccbb4ec282f3cdd52e521b6258785db Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:42:37 -0500
Subject: [PATCH 028/146] fix(web): keep a closed split terminal's tab in view
 (#22106)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/terminalUiStateStore.test.ts | 22 ++++++++++++++++++++++
 apps/web/src/terminalUiStateStore.ts      |  8 +++++++-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/terminalUiStateStore.test.ts b/apps/web/src/terminalUiStateStore.test.ts
index 57e8836f27ff5..1ad8ba86c06ae 100644
--- a/apps/web/src/terminalUiStateStore.test.ts
+++ b/apps/web/src/terminalUiStateStore.test.ts
@@ -7,6 +7,7 @@ import {
   selectThreadTerminalUiState,
   useTerminalUiStateStore,
 } from "./terminalUiStateStore";
+import { DEFAULT_THREAD_TERMINAL_ID } from "./types";
 
 const THREAD_ID = ThreadId.make("thread-1");
 const THREAD_REF = scopeThreadRef("environment-a" as never, THREAD_ID);
@@ -138,6 +139,27 @@ describe("terminalUiStateStore actions", () => {
     ]);
   });
 
+  it.each([
+    ["terminal-3", "terminal-3", DEFAULT_THREAD_TERMINAL_ID],
+    [DEFAULT_THREAD_TERMINAL_ID, DEFAULT_THREAD_TERMINAL_ID, "terminal-3"],
+    ["terminal-3", DEFAULT_THREAD_TERMINAL_ID, "terminal-3"],
+  ])("keeps the split's tab when %s is active and %s closes", (activeId, closedId, nextId) => {
+    const store = useTerminalUiStateStore.getState();
+    store.setTerminalOpen(THREAD_REF, true);
+    store.newTerminal(THREAD_REF, "terminal-2");
+    store.setActiveTerminal(THREAD_REF, DEFAULT_THREAD_TERMINAL_ID);
+    store.splitTerminal(THREAD_REF, "terminal-3");
+    store.setActiveTerminal(THREAD_REF, activeId);
+    store.closeTerminal(THREAD_REF, closedId);
+
+    const terminalUiState = selectThreadTerminalUiState(
+      useTerminalUiStateStore.getState().terminalUiStateByThreadKey,
+      THREAD_REF,
+    );
+    expect(terminalUiState.activeTerminalId).toBe(nextId);
+    expect(terminalUiState.activeTerminalGroupId).toBe(`group-${DEFAULT_THREAD_TERMINAL_ID}`);
+  });
+
   it("does not import a closed panel terminal from stale metadata", () => {
     const store = useTerminalUiStateStore.getState();
     store.newTerminal(THREAD_REF, "term-2");
diff --git a/apps/web/src/terminalUiStateStore.ts b/apps/web/src/terminalUiStateStore.ts
index 6629d8a6d99bf..b442e855ca12d 100644
--- a/apps/web/src/terminalUiStateStore.ts
+++ b/apps/web/src/terminalUiStateStore.ts
@@ -413,9 +413,15 @@ function closeThreadTerminal(
   }
 
   const closedTerminalIndex = normalized.terminalIds.indexOf(terminalId);
+  const groupTerminalIds =
+    normalized.terminalGroups.find((group) => group.terminalIds.includes(terminalId))
+      ?.terminalIds ?? [];
+  const groupIndex = groupTerminalIds.indexOf(terminalId);
   const nextActiveTerminalId =
     normalized.activeTerminalId === terminalId
-      ? (remainingTerminalIds[Math.min(closedTerminalIndex, remainingTerminalIds.length - 1)] ??
+      ? (groupTerminalIds[groupIndex + 1] ??
+        groupTerminalIds[groupIndex - 1] ??
+        remainingTerminalIds[Math.min(closedTerminalIndex, remainingTerminalIds.length - 1)] ??
         remainingTerminalIds[0] ??
         "")
       : normalized.activeTerminalId;

From 69310dbd61a91db0f9ad7762a26d3c1b07710888 Mon Sep 17 00:00:00 2001
From: Onkar Pradip Jadhav <118719336+Onkarj012@users.noreply.github.com>
Date: Thu, 29 Oct 2026 23:12:59 +0530
Subject: [PATCH 029/146] fix(web): the ~ breadcrumb opens the home folder
 (#22412)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../web/src/components/files/filePath.test.ts | 28 ++++++++++++++++++-
 apps/web/src/components/files/filePath.ts     |  3 +-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/files/filePath.test.ts b/apps/web/src/components/files/filePath.test.ts
index 22cb582493df2..3bc371b5c1ab9 100644
--- a/apps/web/src/components/files/filePath.test.ts
+++ b/apps/web/src/components/files/filePath.test.ts
@@ -1,6 +1,12 @@
 import { describe, expect, it } from "vite-plus/test";
 
-import { fileBreadcrumbChildren, fileBreadcrumbs, retainedBreadcrumbTrail } from "./filePath";
+import {
+  breadcrumbPathOf,
+  fileBreadcrumbChildren,
+  fileBreadcrumbs,
+  isListableHostFolder,
+  retainedBreadcrumbTrail,
+} from "./filePath";
 
 describe("fileBreadcrumbs", () => {
   it("starts host paths outside the workspace at the filesystem root", () => {
@@ -20,6 +26,26 @@ describe("fileBreadcrumbs", () => {
       "\\\\server\\share\\report.md",
     ]);
   });
+
+  it("builds home-relative breadcrumbs with navigable folders", () => {
+    expect(fileBreadcrumbs("t3code", "~/.claude/CLAUDE.md")).toEqual([
+      { label: "~", path: "~/", kind: "directory" },
+      { label: ".claude", path: "~/.claude", kind: "directory" },
+      { label: "CLAUDE.md", path: "~/.claude/CLAUDE.md", kind: "file" },
+    ]);
+    expect(isListableHostFolder("~/")).toBe(true);
+    expect(isListableHostFolder("~/.claude")).toBe(true);
+  });
+
+  it("keeps a project folder named ~ inside the project", () => {
+    expect(fileBreadcrumbs("t3code", "~").map((crumb) => crumb.path)).toEqual(["", "~"]);
+  });
+});
+
+describe("breadcrumbPathOf", () => {
+  it("keeps the home root listable", () => {
+    expect(breadcrumbPathOf("~/")).toBe("~/");
+  });
 });
 
 describe("fileBreadcrumbChildren", () => {
diff --git a/apps/web/src/components/files/filePath.ts b/apps/web/src/components/files/filePath.ts
index 76e10839bb2c8..f9f3c9a5ac40a 100644
--- a/apps/web/src/components/files/filePath.ts
+++ b/apps/web/src/components/files/filePath.ts
@@ -23,7 +23,8 @@ export function fileBreadcrumbs(projectName: string, relativePath: string): File
       return {
         label: part,
         // A bare drive (`C:`) means the drive's current directory; its root is `C:\`.
-        path: /^[A-Za-z]:$/.test(path) ? `${path}\\` : path,
+        // A bare `~` is not a host path; the home folder is `~/`.
+        path: /^[A-Za-z]:$/.test(path) ? `${path}\\` : hostPath && path === "~" ? "~/" : path,
         kind: index === parts.length - 1 ? ("file" as const) : ("directory" as const),
       };
     }),

From 505d02282fc5ff398797df88be8a4160e56da412 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:43:22 -0500
Subject: [PATCH 030/146] fix(gitlab): accept merge request URLs from
 self-hosted hosts (#23848)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/pullRequestLinkInput.test.ts          |  7 ++++++
 .../src/shared/definition.test.ts             | 22 +++++++++++++++++++
 .../src/shared/definition.ts                  |  2 +-
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/packages/client-runtime/src/pullRequestLinkInput.test.ts b/packages/client-runtime/src/pullRequestLinkInput.test.ts
index 3747fdc833a4b..79bbc96bdea3b 100644
--- a/packages/client-runtime/src/pullRequestLinkInput.test.ts
+++ b/packages/client-runtime/src/pullRequestLinkInput.test.ts
@@ -161,6 +161,13 @@ describe("parsePullRequestReference", () => {
     ).toBe("https://acme.visualstudio.com/project/_git/t3code/pullrequest/42");
   });
 
+  it.each([
+    "https://code.example.com/group/project/-/merge_requests/42",
+    "http://git.internal/group/sub/project/-/merge_requests/7",
+  ])("accepts self-hosted GitLab merge request URL %s", (url) => {
+    expect(parsePullRequestReference(url)).toBe(url);
+  });
+
   it("accepts gh pr checkout commands with raw numbers", () => {
     expect(parsePullRequestReference("gh pr checkout 42")).toBe("42");
   });
diff --git a/packages/source-control-gitlab/src/shared/definition.test.ts b/packages/source-control-gitlab/src/shared/definition.test.ts
index a05ee047384db..7f9e94fa90887 100644
--- a/packages/source-control-gitlab/src/shared/definition.test.ts
+++ b/packages/source-control-gitlab/src/shared/definition.test.ts
@@ -31,6 +31,28 @@ describe("GitLab change request URLs", () => {
     expect(parse("https://gitlab.com/t3code/-/merge_requests/12")).toBeNull();
   });
 
+  it("recognizes only merge request URLs it can parse", () => {
+    for (const url of [
+      "https://gitlab.com/g/p?x=/-/merge_requests/5",
+      "https://gitlab.com/g/p#/-/merge_requests/5",
+      "https://gitlab.com?x=/g/p/-/merge_requests/5",
+      "https://gitlab.com#/g/p/-/merge_requests/5",
+      "https://gitlab.com/t3code/-/merge_requests/12",
+      "https://gitlab.com/g//-/merge_requests/5",
+    ]) {
+      expect(definition.isChangeRequestReference(url), url).toBe(false);
+      expect(parse(url), url).toBeNull();
+    }
+    for (const url of [
+      "https://code.acme.test/a/b/c/-/merge_requests/7?tab=diffs",
+      "http://git.internal/a/b/c/-/merge_requests/7#note_1",
+      "https://code.acme.test/a/b/c/-/merge_requests/7/diffs",
+    ]) {
+      expect(definition.isChangeRequestReference(url), url).toBe(true);
+      expect(parse(url), url).toMatchObject({ repository: "a/b/c", number: 7 });
+    }
+  });
+
   it("builds merge request URLs below the repository", () => {
     expect(
       definition.changeRequestUrl({
diff --git a/packages/source-control-gitlab/src/shared/definition.ts b/packages/source-control-gitlab/src/shared/definition.ts
index 1a3c417641ce4..437320c0d0419 100644
--- a/packages/source-control-gitlab/src/shared/definition.ts
+++ b/packages/source-control-gitlab/src/shared/definition.ts
@@ -11,7 +11,7 @@ import { icon } from "./icon.ts";
 
 const CHECKOUT_COMMAND = /^glab\s+mr\s+checkout\s+(.+)$/i;
 const CHANGE_REQUEST_REFERENCE =
-  /^https:\/\/[^/\s]*gitlab[^/\s]*\/.+\/-\/merge_requests\/(\d+)(?:[/?#].*)?$/i;
+  /^https?:\/\/[^/?#\s]+\/[^/?#\s]+(?:\/[^/?#\s]+)+\/-\/merge_requests\/(\d+)(?:[/?#].*)?$/i;
 
 // Self-managed GitLab runs on any hostname and nests projects in groups.
 const CHANGE_REQUEST_PATH = /^\/([^/]+(?:\/[^/]+)+)\/-\/merge_requests\/(\d+)(?:\/|$)/u;

From 2c3779762b5ae58c3ef4ae69bc9cb0b97ff74783 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:43:46 -0500
Subject: [PATCH 031/146] fix(server): commits no longer land on a branch
 switched in mid-action (#24473)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/git/GitManager.test.ts    | 21 +++++++++++----------
 apps/server/src/git/GitWorkflowService.ts | 10 ++++------
 2 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/apps/server/src/git/GitManager.test.ts b/apps/server/src/git/GitManager.test.ts
index 7f374a79934ce..5d363826458df 100644
--- a/apps/server/src/git/GitManager.test.ts
+++ b/apps/server/src/git/GitManager.test.ts
@@ -3906,7 +3906,7 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
     return { repoDir, manager, providerCalls, firstCommit, pullHead };
   });
 
-  it.effect.each(["switch", "create-and-switch", "feature-branch"] as const)(
+  it.effect.each(["switch", "create-and-switch", "feature-branch", "commit"] as const)(
     "local PR checkout excludes a concurrent %s from a nested project with an alternate root",
     (operation) =>
       Effect.gen(function* () {
@@ -3956,7 +3956,7 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
               ...manager,
               runStackedAction: (input, options) =>
                 Effect.sync(() => {
-                  events.push("feature-branch");
+                  events.push(input.featureBranch ? "feature-branch" : "commit");
                   NodeFS.writeFileSync(
                     NodePath.join(repoDir, "second-client.txt"),
                     "second client\n",
@@ -3993,9 +3993,9 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
                 })
               : workflows[1]!.runStackedAction({
                   cwd: nestedCwd,
-                  actionId: "second-client-feature-branch",
+                  actionId: `second-client-${operation}`,
                   action: "commit",
-                  featureBranch: true,
+                  featureBranch: operation === "feature-branch",
                   commitMessage: "Second client commit",
                 }),
           { startImmediately: true },
@@ -4008,15 +4008,16 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
         expect(events).toEqual([operation]);
         expect(prepared).toMatchObject({ branch: "feature/pr-safe", isOnPullRequestHead: true });
         expect((yield* runGit(repoDir, ["rev-parse", "main"])).stdout.trim()).toBe(mainCommit);
-        expect((yield* runGit(repoDir, ["rev-parse", "feature/pr-safe"])).stdout.trim()).toBe(
-          pullHead,
-        );
+        const pullBranch = operation === "commit" ? "feature/pr-safe^" : "feature/pr-safe";
+        expect((yield* runGit(repoDir, ["rev-parse", pullBranch])).stdout.trim()).toBe(pullHead);
         expect((yield* runGit(repoDir, ["branch", "--show-current"])).stdout.trim()).toBe(
           operation === "switch"
             ? "main"
-            : "branch" in switched
-              ? switched.branch.name
-              : "second-client",
+            : operation === "commit"
+              ? "feature/pr-safe"
+              : "branch" in switched
+                ? switched.branch.name
+                : "second-client",
         );
         if ("commit" in switched) {
           expect(switched.commit.status).toBe("created");
diff --git a/apps/server/src/git/GitWorkflowService.ts b/apps/server/src/git/GitWorkflowService.ts
index 7bb098da87862..fdc00849af2d0 100644
--- a/apps/server/src/git/GitWorkflowService.ts
+++ b/apps/server/src/git/GitWorkflowService.ts
@@ -377,12 +377,10 @@ export const make = Effect.gen(function* () {
     runStackedAction: Effect.fn("GitWorkflowService.runStackedAction")(function (input, options) {
       return ensureGit("GitWorkflowService.runStackedAction", input.cwd).pipe(
         Effect.flatMap((handle) =>
-          input.featureBranch
-            ? withCheckoutLease(
-                handle.repository.rootPath,
-                gitManager.runStackedAction(input, options),
-              )
-            : gitManager.runStackedAction(input, options),
+          withCheckoutLease(
+            handle.repository.rootPath,
+            gitManager.runStackedAction(input, options),
+          ),
         ),
       );
     }),

From 3b066dad5c7fa1db5803d655da5a803dde9c77d1 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Thu, 29 Oct 2026 13:44:08 -0400
Subject: [PATCH 032/146] fix(server): image attachments report their size when
 the T3 home is behind a symlink (#24245)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/assets/AssetAccess.test.ts | 27 ++++++++++++++++++++++
 apps/server/src/assets/AssetAccess.ts      |  5 +++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/assets/AssetAccess.test.ts b/apps/server/src/assets/AssetAccess.test.ts
index 39a6e651b84dd..11cb490901a52 100644
--- a/apps/server/src/assets/AssetAccess.test.ts
+++ b/apps/server/src/assets/AssetAccess.test.ts
@@ -1199,6 +1199,33 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(layerTest)),
   );
 
+  it.effect.skipIf(!symlinksSupported)(
+    "reports image attachment dimensions when the attachments directory is a symlink",
+    () =>
+      Effect.gen(function* () {
+        const config = yield* ServerConfig.ServerConfig;
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-attachments-link-" });
+        const realAttachmentsDir = path.join(root, "real");
+        const linkedAttachmentsDir = path.join(root, "linked");
+        yield* fs.makeDirectory(realAttachmentsDir);
+        yield* fs.symlink(realAttachmentsDir, linkedAttachmentsDir);
+        const attachmentId = "thread-1-00000000-0000-4000-8000-000000000041";
+        yield* fs.writeFile(path.join(realAttachmentsDir, `${attachmentId}.png`), screenshotPng);
+
+        const result = yield* issueAssetUrl({
+          resource: { _tag: "attachment", attachmentId },
+        }).pipe(
+          Effect.provideService(ServerConfig.ServerConfig, {
+            ...config,
+            attachmentsDir: linkedAttachmentsDir,
+          }),
+        );
+        expect(result.imageDimensions).toEqual({ width: 390, height: 844 });
+      }).pipe(Effect.provide(layerTest)),
+  );
+
   it.effect("serves document attachments inline when a viewer requests it", () =>
     Effect.gen(function* () {
       const config = yield* ServerConfig.ServerConfig;
diff --git a/apps/server/src/assets/AssetAccess.ts b/apps/server/src/assets/AssetAccess.ts
index 0ca85e6ea146e..8eb7894627230 100644
--- a/apps/server/src/assets/AssetAccess.ts
+++ b/apps/server/src/assets/AssetAccess.ts
@@ -659,7 +659,10 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
           ? inlinePreviewMimeTypeForExtension(extension)
           : undefined;
       if (!isGenericFile) {
-        imageDimensions = yield* readImageDimensionsFromHeader(attachmentPath);
+        imageDimensions = yield* fileSystem.realPath(attachmentPath).pipe(
+          Effect.flatMap(readImageDimensionsFromHeader),
+          Effect.orElseSucceed(() => null),
+        );
       }
       claims = {
         version: 1,

From ebc34dae6058a0b4ce05c3dc34c8fbf7cbe6e46e Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:44:30 +0000
Subject: [PATCH 033/146] fix(ssh): skip directories in config includes
 (#25187)

Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com>
---
 packages/ssh/src/config.test.ts | 33 +++++++++++++++++++++++++++++++++
 packages/ssh/src/config.ts      |  1 +
 2 files changed, 34 insertions(+)

diff --git a/packages/ssh/src/config.test.ts b/packages/ssh/src/config.test.ts
index 6871ebcfd18c9..82a6319aefd63 100644
--- a/packages/ssh/src/config.test.ts
+++ b/packages/ssh/src/config.test.ts
@@ -56,6 +56,39 @@ describe("ssh config", () => {
     }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
   );
 
+  it.effect("skips directory Include matches without losing file aliases or known hosts", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const homeDir = yield* makeTempHomeDir();
+      const sshDir = path.join(homeDir, ".ssh");
+      yield* fs.makeDirectory(path.join(sshDir, "config.d", "ignored"), { recursive: true });
+      yield* fs.makeDirectory(path.join(sshDir, "explicit-directory"));
+      yield* fs.writeFileString(
+        path.join(sshDir, "config"),
+        "Include config.d/*\nInclude explicit-directory\nHost real\n  HostName real.example.com\n",
+      );
+      yield* fs.writeFileString(
+        path.join(sshDir, "config.d", "team.conf"),
+        "Host team\n  HostName team.example.com\n",
+      );
+      yield* fs.writeFileString(
+        path.join(sshDir, "known_hosts"),
+        "known.example.com ssh-ed25519 AAAA\n",
+      );
+
+      const hosts = yield* discoverSshHosts({ homeDir });
+      assert.deepEqual(
+        hosts.map((host) => [host.alias, host.hostname, host.source]),
+        [
+          ["known.example.com", "known.example.com", "known-hosts"],
+          ["real", "real.example.com", "ssh-config"],
+          ["team", "team.example.com", "ssh-config"],
+        ],
+      );
+    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+  );
+
   it.effect("discovers ssh config hosts across included files", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/packages/ssh/src/config.ts b/packages/ssh/src/config.ts
index 634d38aa0f7f9..8b6683a968a38 100644
--- a/packages/ssh/src/config.ts
+++ b/packages/ssh/src/config.ts
@@ -177,6 +177,7 @@ const collectSshConfigAliasesFromFile = Effect.fnUntraced(function* (
     return;
   }
   if (!(yield* fs.exists(resolvedPath))) return;
+  if ((yield* fs.stat(resolvedPath)).type === "Directory") return;
   visited.add(resolvedPath);
 
   const directory = path.dirname(resolvedPath);

From 80dfe47ea529cc37a1c7833b1aeebed93d3a6976 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Thu, 29 Oct 2026 13:45:04 -0400
Subject: [PATCH 034/146] fix(server): Authorized clients names Edge, Firefox
 and Opera on phones correctly (#23340)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/auth/utils.test.ts | 29 +++++++++++++++++++++++++++++
 apps/server/src/auth/utils.ts      |  6 +++---
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/auth/utils.test.ts b/apps/server/src/auth/utils.test.ts
index 63336b29c9005..30784ab33ceb0 100644
--- a/apps/server/src/auth/utils.test.ts
+++ b/apps/server/src/auth/utils.test.ts
@@ -24,6 +24,35 @@ describe("deriveAuthClientMetadata", () => {
     });
   });
 
+  it.each([
+    [
+      "Edge on Android",
+      "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Mobile Safari/537.36 EdgA/129.0.0.0",
+      "Edge",
+    ],
+    [
+      "Edge on iOS",
+      "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 EdgiOS/129.0.2792.84 Mobile/15E148 Safari/605.1.15",
+      "Edge",
+    ],
+    [
+      "Firefox on iOS",
+      "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/131.0 Mobile/15E148 Safari/605.1.15",
+      "Firefox",
+    ],
+    [
+      "Opera on iOS",
+      "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 OPiOS/5.0.0 Mobile/15E148 Safari/605.1.15",
+      "Opera",
+    ],
+  ])("labels %s by its own browser token", (_name, userAgent, browser) => {
+    const metadata = deriveAuthClientMetadata({
+      request: { headers: { "user-agent": userAgent }, source: {} } as never,
+    });
+
+    expect(metadata.browser).toBe(browser);
+  });
+
   it("applies client-presented display identity without replacing transport metadata", () => {
     const metadata = deriveAuthClientMetadata({
       request: {
diff --git a/apps/server/src/auth/utils.ts b/apps/server/src/auth/utils.ts
index dc89a5da81140..29c0c5100a190 100644
--- a/apps/server/src/auth/utils.ts
+++ b/apps/server/src/auth/utils.ts
@@ -128,9 +128,9 @@ function inferBrowser(userAgent: string | undefined): string | undefined {
     return undefined;
   }
   const normalized = userAgent.toLowerCase();
-  if (/edg\//.test(normalized)) return "Edge";
-  if (/opr\//.test(normalized)) return "Opera";
-  if (/firefox\//.test(normalized)) return "Firefox";
+  if (/edg(?:e|a|ios)?\//.test(normalized)) return "Edge";
+  if (/opr\/|opios\//.test(normalized)) return "Opera";
+  if (/firefox\/|fxios\//.test(normalized)) return "Firefox";
   if (/electron\//.test(normalized)) return "Electron";
   if (/chrome\//.test(normalized) || /crios\//.test(normalized)) return "Chrome";
   if (/safari\//.test(normalized) && !/chrome\//.test(normalized)) return "Safari";

From 1d7af6591b8d6011bc449596d2be6184ab6c5c67 Mon Sep 17 00:00:00 2001
From: Jeremiah Jordan <jeremiah@apache.org>
Date: Thu, 29 Oct 2026 12:45:29 -0500
Subject: [PATCH 035/146] fix(mobile): fork rows show a readable label instead
 of a thread ID (#22064)

Co-authored-by: Jeremiah Jordan <zanson@zanson.org>
Co-authored-by: GPT-6.1-Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/mobile/src/lib/threadActivity.test.ts | 35 ++++++++++++++++++++++
 apps/mobile/src/lib/threadActivity.ts      |  1 +
 2 files changed, 36 insertions(+)

diff --git a/apps/mobile/src/lib/threadActivity.test.ts b/apps/mobile/src/lib/threadActivity.test.ts
index acdee2249c0d0..f2ced2d689794 100644
--- a/apps/mobile/src/lib/threadActivity.test.ts
+++ b/apps/mobile/src/lib/threadActivity.test.ts
@@ -24,6 +24,7 @@ import { describe, expect, it } from "vite-plus/test";
 
 import {
   buildThreadFeed,
+  workEntryRowLabel,
   threadFeedCompactionLabels,
   createThreadFeedCache,
   deriveThreadFeedPresentation,
@@ -731,6 +732,40 @@ describe("buildThreadFeed", () => {
     expect(activities.at(-1)?.prominent).toBe(true);
   });
 
+  it.each([
+    ["local", undefined],
+    ["inherited", undefined],
+    ["synthetic", undefined],
+    ["synthetic", "Forked from conversation"],
+  ] as const)(
+    "labels a %s fork row with title %s without exposing its target ID",
+    (visibility, title) => {
+      const { providerThreadId: _providerThreadId, ...forkBase } = base(
+        "item-fork",
+        "2026-06-20T00:00:03.000Z",
+        2,
+      );
+      const activity = buildThreadFeed([
+        projected(
+          {
+            ...forkBase,
+            type: "fork",
+            title: title ?? null,
+            source: { type: "run", threadId: sourceThreadId, runId },
+            targetThreadId: threadId,
+          },
+          0,
+          visibility,
+        ),
+      ]).flatMap((entry) => (entry.type === "activity-group" ? entry.activities : []))[0]!;
+
+      expect(workEntryRowLabel(activity.workEntry)).toBe(title ?? "Thread forked");
+      expect(workEntryRowLabel(activity.workEntry, true)).toBe(title ?? "Thread forked");
+      expect(activity.canExpand).toBe(true);
+      expect(activity.getFullDetail()).toContain(threadId);
+    },
+  );
+
   it("names the fold that hides a progress message, with or without a run", () => {
     const middle = {
       ...assistantMessage("2026-06-20T00:00:02.500Z"),
diff --git a/apps/mobile/src/lib/threadActivity.ts b/apps/mobile/src/lib/threadActivity.ts
index e17748d77aa6c..4cc5a842c21f9 100644
--- a/apps/mobile/src/lib/threadActivity.ts
+++ b/apps/mobile/src/lib/threadActivity.ts
@@ -253,6 +253,7 @@ function compactWorkEntryText(value: string): string {
 }
 
 export function workEntryRowLabel(entry: WorkLogPresentationEntry, expanded = false): string {
+  if (entry.itemType === "fork") return entry.label;
   if (expanded && entry.itemType === "reasoning")
     return entry.toolLifecycleStatus === "inProgress" ? "Thinking" : "Thought";
   const presentation = resolveWorkEntryToolPresentation(entry);

From 1d631342b01d0231cd1380606a0a0c5180322762 Mon Sep 17 00:00:00 2001
From: Nikita Maximilian Grimm <github@nikitagrimm.de>
Date: Thu, 29 Oct 2026 18:45:51 +0100
Subject: [PATCH 036/146] fix(markdown): formulas ending in a comma render
 (#22883)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 packages/shared/src/markdownMath.test.ts      | 21 +++++++++++++++++++
 .../micromark-extension-llm-math@3.1.0.patch  | 10 +++++++--
 pnpm-lock.yaml                                |  6 +++---
 3 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/packages/shared/src/markdownMath.test.ts b/packages/shared/src/markdownMath.test.ts
index cb920c0737972..0bc6941e494c0 100644
--- a/packages/shared/src/markdownMath.test.ts
+++ b/packages/shared/src/markdownMath.test.ts
@@ -124,8 +124,18 @@ describe("chat math parsing", () => {
       "It costs $5 and $10.",
       "Budget $5-$10 per seat, or $20,000-$30,000 a year.",
       "Plans are $5/$10 monthly.",
+      "Pay $5,$10 now.",
       "Run $browser then $deploy on it.",
       "Set $HOME before running.",
+      "Set $HOME,$PATH before running.",
+      "Set $HOME, $PATH before running.",
+      "Set $HOME,$_PATH before running.",
+      "Set $home,$path before running.",
+      "Set $HOME,${PATH} before running.",
+      "Set $HOME,$? before running.",
+      "Set $HOME,$@ before running.",
+      "Set $HOME,$(pwd) before running.",
+      "Pay $1,000,$2,000 now.",
     ]) {
       expect(formulas(prose), prose).toEqual([]);
       expect(text(prose), prose).toBe(prose);
@@ -143,6 +153,17 @@ describe("chat math parsing", () => {
     }
   });
 
+  it("reads formulas that end in a comma", () => {
+    for (const boundary of ["", " ", "\n", ".", ",", ";", ":", ")", "]", "}"]) {
+      expect(formulas(`$x,$${boundary}`)).toEqual([["inline", "x,"]]);
+    }
+    expect(formulas("Where $x = 1,$ with $$a,$$ and $$ b,$$.")).toEqual([
+      ["inline", "x = 1,"],
+      ["display", "a,"],
+      ["display", " b,"],
+    ]);
+  });
+
   it("leaves code, escapes, links, and citations alone", () => {
     for (const [markdown, rendered] of [
       ["Use `$x$` in code.", "Use  in code."],
diff --git a/patches/micromark-extension-llm-math@3.1.0.patch b/patches/micromark-extension-llm-math@3.1.0.patch
index 335ce4c11d57e..25da4f5f47755 100644
--- a/patches/micromark-extension-llm-math@3.1.0.patch
+++ b/patches/micromark-extension-llm-math@3.1.0.patch
@@ -235,6 +235,9 @@ diff --git a/dev/lib/math-tex-text.js b/dev/lib/math-tex-text.js
 diff --git a/dev/lib/math-text.js b/dev/lib/math-text.js
 --- a/dev/lib/math-text.js
 +++ b/dev/lib/math-text.js
+@@ -10 +10 @@
+-import {markdownLineEnding} from 'micromark-util-character'
++import {markdownLineEnding, markdownLineEndingOrSpace} from 'micromark-util-character'
 @@ -42,6 +42,13 @@
      let size
      /** @type {Token} */
@@ -299,7 +302,7 @@ diff --git a/dev/lib/math-text.js b/dev/lib/math-text.js
        if (
          code === codes.eof ||
          code === codes.space ||
-@@ -179,9 +207,26 @@
+@@ -179,9 +207,29 @@
  
        // Done!
        if (size === sizeOpen) {
@@ -314,11 +317,14 @@ diff --git a/dev/lib/math-text.js b/dev/lib/math-text.js
 +        if (code !== null && code >= codes.digit0 && code <= codes.digit9) {
 +          return nok(code)
 +        }
++        if (charBeforeClose === codes.comma && !openWhitespace && code !== codes.eof && !markdownLineEndingOrSpace(code) && !/[.,;:)\]}]/.test(String.fromCharCode(code))) {
++          return nok(code)
++        }
 +        // Check if closing sequence has matching whitespace pattern
 +        const closeWhitespace =
 +          charBeforeClose === codes.space ||
 +          charBeforeClose === codes.horizontalTab ||
-+          charBeforeClose === codes.comma
++          (charBeforeClose === codes.comma && openWhitespace)
 +        if (openWhitespace === closeWhitespace) {
 +          effects.exit('mathTextSequence')
 +          effects.exit('mathText')
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4bff27f291a17..196781c388b03 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -380,7 +380,7 @@ patchedDependencies:
   expo-widgets@58.0.20: 8bf49067f93742855e15f29559ac75c8b50230b47069060993c9ea01dac11171
   mdast-util-math@3.0.0: afe6b2c89e1eaddfd3c90cf2723f12c9a17d513e65beff51653781486013251c
   micromark-extension-gfm-table@2.1.1: 9ad23a530e45d9f83cba1da8654fe16d5af8b59d5c73d5c7a7c91fd25b9be1d8
-  micromark-extension-llm-math@3.1.0: 49ab4815c18b003f6af998dcc6c258c17a21b50b2cc87745f12d4bd8b6d591f9
+  micromark-extension-llm-math@3.1.0: 7beb6ac4ba52166286593a494531aace81547e55fdddecf892824c25bd84d15a
   node-pty@1.2.0-beta.15: f1e680afec85f650699ea756f91f469844ec4c976f4f168492a45c6b3f67d651
   react-native-gesture-handler@3.3.0: abe20e1d1c23549297cbbc818e14fe479b41455930d9663135d6b40fe359b626
   react-native-image-viewing@0.2.2: 419f35ee91eac88ced9438058281db5eb09d9c799d8974c1172926068c9448cf
@@ -20056,7 +20056,7 @@ snapshots:
       micromark-util-combine-extensions: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-extension-llm-math@3.1.0(patch_hash=49ab4815c18b003f6af998dcc6c258c17a21b50b2cc87745f12d4bd8b6d591f9):
+  micromark-extension-llm-math@3.1.0(patch_hash=7beb6ac4ba52166286593a494531aace81547e55fdddecf892824c25bd84d15a):
     dependencies:
       '@types/katex': 0.16.8
       devlop: 1.1.0
@@ -21348,7 +21348,7 @@ snapshots:
     dependencies:
       '@types/mdast': 4.0.4
       mdast-util-math: 3.0.0(patch_hash=afe6b2c89e1eaddfd3c90cf2723f12c9a17d513e65beff51653781486013251c)(supports-color@8.1.1)
-      micromark-extension-math: micromark-extension-llm-math@3.1.0(patch_hash=49ab4815c18b003f6af998dcc6c258c17a21b50b2cc87745f12d4bd8b6d591f9)
+      micromark-extension-math: micromark-extension-llm-math@3.1.0(patch_hash=7beb6ac4ba52166286593a494531aace81547e55fdddecf892824c25bd84d15a)
       unified: 11.0.5
     transitivePeerDependencies:
       - supports-color

From 20490521fa4adc3b16a652bc3592405d0ec4a790 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Thu, 29 Oct 2026 13:46:14 -0400
Subject: [PATCH 037/146] fix(scripts): dev runner expands ~ in --home-dir and
 T3CODE_HOME (#25560)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 scripts/dev-runner.test.ts | 31 +++++++++++++++++++++++++++++++
 scripts/dev-runner.ts      |  6 ++++++
 2 files changed, 37 insertions(+)

diff --git a/scripts/dev-runner.test.ts b/scripts/dev-runner.test.ts
index 895144079fc5b..d522bfdb15794 100644
--- a/scripts/dev-runner.test.ts
+++ b/scripts/dev-runner.test.ts
@@ -412,6 +412,37 @@ it.layer(NodeServices.layer)("dev-runner", (it) => {
       }),
     );
 
+    it.effect("expands a home-relative T3 home the way the server does", () =>
+      Effect.gen(function* () {
+        const path = yield* Path.Path;
+        const homeFor = (t3Home: string) =>
+          createDevRunnerEnv({
+            mode: "dev",
+            baseEnv: {},
+            serverOffset: 0,
+            webOffset: 0,
+            t3Home,
+            browser: undefined,
+            autoBootstrapProjectFromCwd: undefined,
+            logWebSocketEvents: undefined,
+            host: undefined,
+            port: undefined,
+            devUrl: undefined,
+          }).pipe(
+            Effect.provideService(HostProcess.HomeDirectory, "/home/dev"),
+            Effect.map((env) => env.T3CODE_HOME),
+          );
+
+        assert.equal(yield* homeFor("~/t3-dev"), path.join("/home/dev", "t3-dev"));
+        assert.equal(yield* homeFor("~"), "/home/dev");
+        assert.equal(yield* homeFor("~\\t3-dev"), path.join("/home/dev", "t3-dev"));
+        assert.equal(yield* homeFor("  ~/t3-dev  "), path.join("/home/dev", "t3-dev"));
+        assert.equal(yield* homeFor("~someone/t3-dev"), path.resolve("~someone/t3-dev"));
+        assert.equal(yield* homeFor("relative/t3-dev"), path.resolve("relative/t3-dev"));
+        assert.equal(yield* homeFor("/tmp/t3-dev"), path.resolve("/tmp/t3-dev"));
+      }),
+    );
+
     it.effect("rejects a specific non-loopback --host for browser dev modes", () => {
       const spawnerLayer = Layer.succeed(
         ChildProcessSpawner.ChildProcessSpawner,
diff --git a/scripts/dev-runner.ts b/scripts/dev-runner.ts
index 0495c513dc685..5903cb7686e9c 100644
--- a/scripts/dev-runner.ts
+++ b/scripts/dev-runner.ts
@@ -272,6 +272,12 @@ const resolveBaseDir = Effect.fn("dev-runner.resolveBaseDir")(function* (
   const path = yield* Path.Path;
   const configured = baseDir?.trim();
 
+  if (configured === "~") {
+    return yield* HostProcess.HomeDirectory;
+  }
+  if (configured?.startsWith("~/") || configured?.startsWith("~\\")) {
+    return path.join(yield* HostProcess.HomeDirectory, configured.slice(2));
+  }
   if (configured) {
     return path.resolve(configured);
   }

From 1dd8c676e43f1fd6dee98fa81bdec4a5c3750bab Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:46:36 -0500
Subject: [PATCH 038/146] fix(desktop): keep development protocol requests on
 the configured server (#22010)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/electron/ElectronProtocol.test.ts     | 33 +++++++++++++++++++
 apps/desktop/src/electron/ElectronProtocol.ts |  5 ++-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/electron/ElectronProtocol.test.ts b/apps/desktop/src/electron/ElectronProtocol.test.ts
index 45d1771f26f07..aec3a2d5b45c0 100644
--- a/apps/desktop/src/electron/ElectronProtocol.test.ts
+++ b/apps/desktop/src/electron/ElectronProtocol.test.ts
@@ -130,6 +130,39 @@ describe("ElectronProtocol", () => {
     }).pipe(Effect.provide(layerProtocol)),
   );
 
+  it.effect("keeps proxied paths on the configured server", () =>
+    Effect.gen(function* () {
+      let handler: ((request: Request) => Promise<Response>) | undefined;
+      handleMock.mockImplementation((_scheme, nextHandler) => {
+        handler = nextHandler;
+      });
+      netFetchMock.mockImplementation(async () => new Response("ok"));
+
+      yield* Effect.scoped(
+        Effect.gen(function* () {
+          const protocol = yield* ElectronProtocol.ElectronProtocol;
+          yield* protocol.registerDesktopProtocol({
+            scheme: "t3code-dev",
+            targetOrigin: new URL("http://127.0.0.1:5733/"),
+            clerkFrontendApiHostname: undefined,
+          });
+          yield* Effect.promise(() =>
+            handler!(new Request("t3code-dev://app//example.com/src/main.tsx?t=1")),
+          );
+          yield* Effect.promise(() => handler!(new Request("t3code-dev://app/\\example.com/")));
+        }),
+      );
+
+      assert.deepEqual(
+        netFetchMock.mock.calls.map((call) => call[0]),
+        [
+          "http://127.0.0.1:5733//example.com/src/main.tsx?t=1",
+          "http://127.0.0.1:5733//example.com/",
+        ],
+      );
+    }).pipe(Effect.provide(layerProtocol)),
+  );
+
   it.effect("rejects custom protocol requests for another host", () =>
     Effect.gen(function* () {
       let handler: ((request: Request) => Promise<Response>) | undefined;
diff --git a/apps/desktop/src/electron/ElectronProtocol.ts b/apps/desktop/src/electron/ElectronProtocol.ts
index d84b6f360c89e..27af3f2cfd8ae 100644
--- a/apps/desktop/src/electron/ElectronProtocol.ts
+++ b/apps/desktop/src/electron/ElectronProtocol.ts
@@ -167,7 +167,10 @@ const proxyRequest = Effect.fn("desktop.protocol.proxyRequest")(function* (
     return new Response(null, { status: 404 });
   }
 
-  const targetUrl = new URL(`${requestUrl.pathname}${requestUrl.search}`, targetOrigin);
+  // Assign the path so leading slashes cannot replace the configured host.
+  const targetUrl = new URL(targetOrigin);
+  targetUrl.pathname = requestUrl.pathname;
+  targetUrl.search = requestUrl.search;
   const headers = new Headers(request.headers);
   const headersToRemove: string[] = [];
   for (const name of headers.keys()) {

From e0f972e3759c628b8c202930d5d38a53d4569b72 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:46:58 -0500
Subject: [PATCH 039/146] fix(mobile): apply terminal toolbar modifiers to
 arrow keys (#22161)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../features/terminal/terminalInput.test.ts   | 32 +++++++++++++++++++
 .../src/features/terminal/terminalInput.ts    |  8 +++++
 2 files changed, 40 insertions(+)

diff --git a/apps/mobile/src/features/terminal/terminalInput.test.ts b/apps/mobile/src/features/terminal/terminalInput.test.ts
index 74240215af08a..17fabe588115c 100644
--- a/apps/mobile/src/features/terminal/terminalInput.test.ts
+++ b/apps/mobile/src/features/terminal/terminalInput.test.ts
@@ -12,6 +12,38 @@ const ESC = byte(0x1b);
 const CTRL_V = byte(0x16);
 
 describe("resolveModifiedTerminalInput", () => {
+  it.each(["A", "B", "C", "D"])("encodes ctrl+arrow %s with the cursor modifier", (arrow) => {
+    expect(
+      resolveModifiedTerminalInput({
+        data: `${ESC}[${arrow}`,
+        modifier: "ctrl",
+        hostPlatform: "linux",
+      }),
+    ).toEqual({ kind: "write", data: `${ESC}[1;5${arrow}` });
+  });
+
+  it.each(["A", "B", "C", "D"])("encodes meta+arrow %s with the cursor modifier", (arrow) => {
+    expect(
+      resolveModifiedTerminalInput({
+        data: `${ESC}[${arrow}`,
+        modifier: "meta",
+        hostPlatform: "linux",
+      }),
+    ).toEqual({ kind: "write", data: `${ESC}[1;3${arrow}` });
+  });
+
+  it.each(["a", "", ESC, `${ESC}[H`, `${ESC}[1;5D`, `${ESC}[D\n`])(
+    "preserves non-arrow modifier handling for %j",
+    (data) => {
+      expect(
+        resolveModifiedTerminalInput({ data, modifier: "meta", hostPlatform: "linux" }),
+      ).toEqual({
+        kind: "write",
+        data: `${ESC}${data}`,
+      });
+    },
+  );
+
   it("pastes on ctrl+v for windows, linux, and unknown hosts", () => {
     for (const hostPlatform of ["windows", "linux", "unknown"] as const) {
       expect(resolveModifiedTerminalInput({ data: "v", modifier: "ctrl", hostPlatform })).toEqual({
diff --git a/apps/mobile/src/features/terminal/terminalInput.ts b/apps/mobile/src/features/terminal/terminalInput.ts
index 09886b41cb2bb..9c5e05dcc24f0 100644
--- a/apps/mobile/src/features/terminal/terminalInput.ts
+++ b/apps/mobile/src/features/terminal/terminalInput.ts
@@ -45,6 +45,14 @@ export function resolveModifiedTerminalInput(input: {
     return { kind: "paste" };
   }
 
+  if (
+    input.data.length === 3 &&
+    input.data.startsWith("\u001b[") &&
+    /[ABCD]/.test(input.data.charAt(2))
+  ) {
+    return { kind: "write", data: `\u001b[1;${input.modifier === "ctrl" ? 5 : 3}${input.data[2]}` };
+  }
+
   return {
     kind: "write",
     data: input.modifier === "ctrl" ? applyCtrlModifier(input.data) : `\u001b${input.data}`,

From 40f6f5b8f033628a672b7a9213c27cd64db05cb3 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:47:21 -0500
Subject: [PATCH 040/146] fix(server): clean old logs and artifacts under a
 symlinked T3 home (#24097)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/storageCleanup.test.ts | 36 ++++++++++++++++++++++++++
 apps/server/src/storageCleanup.ts      |  4 ++-
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/storageCleanup.test.ts b/apps/server/src/storageCleanup.test.ts
index c05d4aed4cfbf..9cbf0f092f7bd 100644
--- a/apps/server/src/storageCleanup.test.ts
+++ b/apps/server/src/storageCleanup.test.ts
@@ -1814,6 +1814,42 @@ describe("storage cleanup reports and local file policies", () => {
       }),
     ),
   );
+  it.live.each([
+    { linked: "home", outcome: "removed", reason: "Removed 1 rotated logs" },
+    { linked: "logs folder", outcome: "kept", reason: "No expired files" },
+  ] as const)(
+    "rotated logs behind a symlinked $linked are $outcome",
+    ({ linked, outcome, reason }) =>
+      runCleanupTest(
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const config = yield* ServerConfig.ServerConfig;
+          const disk = yield* fs.realPath(yield* fs.makeTempDirectoryScoped());
+          yield* fs.makeDirectory(`${disk}/real/logs`, { recursive: true });
+          if (linked === "home") {
+            yield* fs.symlink(`${disk}/real`, `${disk}/home`);
+          } else {
+            yield* fs.makeDirectory(`${disk}/home`);
+            yield* fs.symlink(`${disk}/real/logs`, `${disk}/home/logs`);
+          }
+          yield* fs.writeFileString(`${disk}/real/logs/server.log.1`, "log");
+          yield* fs.utimes(`${disk}/real/logs/server.log.1`, 1, 1);
+          const { service, enableFiles, disable } = yield* cleanupFixture().pipe(
+            Effect.provideService(ServerConfig.ServerConfig, {
+              ...config,
+              logsDir: `${disk}/home/logs`,
+            }),
+          );
+          disable();
+          enableFiles();
+          const report = yield* service.runNow;
+          expect(report.entries.filter((entry) => entry.kind === "logs")).toMatchObject([
+            { outcome, reason },
+          ]);
+          expect(yield* fs.exists(`${disk}/real/logs/server.log.1`)).toBe(outcome === "kept");
+        }),
+      ),
+  );
   it.live("reports git failures without aborting the remaining categories", () =>
     runCleanupTest(
       Effect.gen(function* () {
diff --git a/apps/server/src/storageCleanup.ts b/apps/server/src/storageCleanup.ts
index 526aaffa2abb3..9bf040b0cd17c 100644
--- a/apps/server/src/storageCleanup.ts
+++ b/apps/server/src/storageCleanup.ts
@@ -1059,8 +1059,10 @@ const make = Effect.gen(function* () {
     removed: { files: number; bytes: number },
   ) {
     if (days === null || !(yield* fs.exists(root))) return removed;
+    // A symlinked parent (a linked T3 home) is fine; a symlinked folder is not.
     const realRoot = yield* fs.realPath(root);
-    if (realRoot !== path.resolve(root)) return removed;
+    const realParent = yield* fs.realPath(path.dirname(root));
+    if (realRoot !== path.join(realParent, path.basename(root))) return removed;
     const visit = Effect.fn("StorageCleanup.visitFiles")(function* (
       directory: string,
     ): Effect.fn.Return<void, PlatformError | ServerSettingsError> {

From b02b436e26f9c0c6c193ea2af22a50885ffe8aac Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:47:44 +0000
Subject: [PATCH 041/146] fix(server): preserve URL arguments in Android device
 actions (#25205)

Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com>
---
 apps/server/src/device/DeviceActions.test.ts | 38 ++++++++++++++++++++
 apps/server/src/device/DeviceActions.ts      |  6 +++-
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/device/DeviceActions.test.ts b/apps/server/src/device/DeviceActions.test.ts
index 41e1de4304692..1a8cab7f29837 100644
--- a/apps/server/src/device/DeviceActions.test.ts
+++ b/apps/server/src/device/DeviceActions.test.ts
@@ -1,5 +1,9 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
 import { describe, expect, it } from "@effect/vitest";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Effect from "effect/Effect";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import { readDeviceDetail, runDeviceAction } from "./DeviceActions.ts";
 import type { DeviceHostReady } from "./DeviceHost.ts";
@@ -43,6 +47,40 @@ const makeReady = (
 const udid = "SIM-1";
 
 describe("runDeviceAction", () => {
+  it.live.each([
+    "https://example.com/callback?code=1&state=2",
+    "https://example.com/it's?a=1&b=2",
+    "https://example.com/a b?key=value",
+    "https://example.com/plain",
+  ])("opens the complete Android URL %s", (url) =>
+    Effect.gen(function* () {
+      if ((yield* HostProcess.Platform) === "win32") return;
+      const { ready, calls } = makeReady();
+      yield* runDeviceAction(ready, "android", {
+        type: "openUrl",
+        deviceId: "emulator-5554",
+        url,
+      });
+      const args = calls[0]!.args;
+      expect(args.slice(0, 3)).toEqual(["-s", "emulator-5554", "shell"]);
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      // adb joins arguments verbatim before the Android shell parses them.
+      const stdout = yield* spawner.string(
+        ChildProcess.make("/bin/sh", [
+          "-c",
+          `am() { printf '%s\\0' "$@"; }\n${args.slice(3).join(" ")}`,
+        ]),
+      );
+      expect(stdout.split("\0").slice(0, -1)).toEqual([
+        "start",
+        "-a",
+        "android.intent.action.VIEW",
+        "-d",
+        url,
+      ]);
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+
   it.effect.each([
     ["emulator-5554", "Physical size: 2560x1600", "portrait", "-9.81:0:0"],
     ["emulator-5554", "Physical size: 2560x1600", "landscape_left", "0:9.81:0"],
diff --git a/apps/server/src/device/DeviceActions.ts b/apps/server/src/device/DeviceActions.ts
index 002d8cb3e7d28..905a23d5cc726 100644
--- a/apps/server/src/device/DeviceActions.ts
+++ b/apps/server/src/device/DeviceActions.ts
@@ -342,13 +342,17 @@ const serveSimPermissions = Effect.fn("DeviceActions.serveSimPermissions")(funct
 const adb = (run: Runner, serial: string, args: ReadonlyArray<string>, operation: string) =>
   run("adb", ["-s", serial, ...args]).pipe(Effect.flatMap(ok(operation)));
 
+// adb shell joins arguments without escaping before the device's shell parses them.
+const androidShellWord = (value: string) =>
+  /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+
 const runAndroid = Effect.fn("DeviceActions.runAndroid")(function* (
   run: Runner,
   input: DeviceActionInput,
 ) {
   const serial = input.deviceId;
   const shell = (args: ReadonlyArray<string>, operation: string) =>
-    adb(run, serial, ["shell", ...args], operation);
+    adb(run, serial, ["shell", ...args.map(androidShellWord)], operation);
   switch (input.type) {
     case "setAppearance":
       yield* shell(["cmd", "uimode", "night", input.value === "dark" ? "yes" : "no"], "appearance");

From c839797b6dceaa28cc61b7044fcae36bd7a11462 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:48:06 +0000
Subject: [PATCH 042/146] fix(server): keep terminal history after cancelled
 sequences (#25193)

Co-authored-by: Aditya Garud <153842990+yashranaway@users.noreply.github.com>
---
 apps/server/src/terminal/Manager.test.ts | 29 ++++++++++++++++++++++++
 apps/server/src/terminal/Manager.ts      | 16 +++++++++----
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/terminal/Manager.test.ts b/apps/server/src/terminal/Manager.test.ts
index e30a4cd3d720d..5b166d8b1452b 100644
--- a/apps/server/src/terminal/Manager.test.ts
+++ b/apps/server/src/terminal/Manager.test.ts
@@ -881,6 +881,35 @@ it.layer(
     }),
   );
 
+  it.effect.each([
+    { name: "OSC", sequence: "\u001b]0;unfinished" },
+    { name: "DCS", sequence: "\u001bPunfinished" },
+    { name: "PM", sequence: "\u001b^unfinished" },
+    { name: "APC", sequence: "\u001b_unfinished" },
+    { name: "CSI", sequence: "\u001b[5" },
+    { name: "C1 OSC", sequence: "\u009d0;unfinished" },
+    { name: "C1 DCS", sequence: "\u0090unfinished" },
+    { name: "C1 PM", sequence: "\u009eunfinished" },
+    { name: "C1 APC", sequence: "\u009funfinished" },
+    { name: "C1 CSI", sequence: "\u009b5" },
+  ])("keeps output after a cancelled $name sequence in history", ({ sequence }) =>
+    Effect.gen(function* () {
+      const { manager, ptyAdapter } = yield* createManager();
+      yield* manager.open(openInput());
+      const process = ptyAdapter.processes[0]!;
+      for (const cancel of ["\u0018", "\u001a"]) {
+        process.emitData(sequence);
+        process.emitData(cancel);
+        process.emitData("next line\n");
+        process.emitData(`${sequence}${cancel}next line\n`);
+      }
+      yield* manager.close({ threadId: "thread-1" });
+
+      const reopened = yield* manager.open(openInput());
+      expect(reopened.history.match(/next line/g)).toHaveLength(4);
+    }),
+  );
+
   it.effect("handles CSI and DCS query sequences split across output chunks", () =>
     Effect.gen(function* () {
       const { manager, ptyAdapter } = yield* createManager();
diff --git a/apps/server/src/terminal/Manager.ts b/apps/server/src/terminal/Manager.ts
index 4c5229a7bae4f..a08b3e4afe784 100644
--- a/apps/server/src/terminal/Manager.ts
+++ b/apps/server/src/terminal/Manager.ts
@@ -1067,6 +1067,10 @@ function isCsiFinalByte(codePoint: number): boolean {
   return codePoint >= 0x40 && codePoint <= 0x7e;
 }
 
+function isControlSequenceCancel(codePoint: number): boolean {
+  return codePoint === 0x18 || codePoint === 0x1a;
+}
+
 function shouldStripCsiSequence(body: string, finalByte: string): boolean {
   if (finalByte === "n") {
     return true;
@@ -1115,7 +1119,7 @@ function stripStringTerminator(value: string): string {
 function findStringTerminatorIndex(input: string, start: number): number | null {
   for (let index = start; index < input.length; index += 1) {
     const codePoint = input.charCodeAt(index);
-    if (codePoint === 0x07 || codePoint === 0x9c) {
+    if (codePoint === 0x07 || codePoint === 0x9c || isControlSequenceCancel(codePoint)) {
       return index + 1;
     }
     if (codePoint === 0x1b && input.charCodeAt(index + 1) === 0x5c) {
@@ -1177,10 +1181,11 @@ function sanitizeTerminalHistoryChunk(
       if (nextCodePoint === 0x5b) {
         let cursor = index + 2;
         while (cursor < input.length) {
-          if (isCsiFinalByte(input.charCodeAt(cursor))) {
+          const cancelled = isControlSequenceCancel(input.charCodeAt(cursor));
+          if (cancelled || isCsiFinalByte(input.charCodeAt(cursor))) {
             const sequence = input.slice(index, cursor + 1);
             const body = input.slice(index + 2, cursor);
-            if (!shouldStripCsiSequence(body, input[cursor] ?? "")) {
+            if (cancelled || !shouldStripCsiSequence(body, input[cursor] ?? "")) {
               append(sequence);
             }
             index = cursor + 1;
@@ -1231,10 +1236,11 @@ function sanitizeTerminalHistoryChunk(
     if (codePoint === 0x9b) {
       let cursor = index + 1;
       while (cursor < input.length) {
-        if (isCsiFinalByte(input.charCodeAt(cursor))) {
+        const cancelled = isControlSequenceCancel(input.charCodeAt(cursor));
+        if (cancelled || isCsiFinalByte(input.charCodeAt(cursor))) {
           const sequence = input.slice(index, cursor + 1);
           const body = input.slice(index + 1, cursor);
-          if (!shouldStripCsiSequence(body, input[cursor] ?? "")) {
+          if (cancelled || !shouldStripCsiSequence(body, input[cursor] ?? "")) {
             append(sequence);
           }
           index = cursor + 1;

From 5aa81a31718dcd667c502022a568b9ca39c02b7f Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:48:28 -0500
Subject: [PATCH 043/146] fix(auth): accept a typed pairing code regardless of
 letter case (#22089)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../server/src/auth/PairingGrantStore.test.ts | 33 +++++++++++++++++--
 apps/server/src/auth/PairingGrantStore.ts     | 14 ++++++--
 2 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/auth/PairingGrantStore.test.ts b/apps/server/src/auth/PairingGrantStore.test.ts
index 561633d3524b2..4e940cd36cc51 100644
--- a/apps/server/src/auth/PairingGrantStore.test.ts
+++ b/apps/server/src/auth/PairingGrantStore.test.ts
@@ -1,6 +1,7 @@
 import { AuthStandardClientScopes } from "@t3tools/contracts";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { expect, it } from "@effect/vitest";
+import * as Crypto from "effect/Crypto";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
@@ -45,11 +46,11 @@ const layerPairingGrantStore = (
   );
 
 it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
-  it.effect("issues one-time bootstrap tokens that can only be consumed once", () =>
+  it.effect("accepts lowercase one-time tokens exactly once", () =>
     Effect.gen(function* () {
       const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
       const issued = yield* bootstrapCredentials.issueOneTimeToken({ label: "Julius iPhone" });
-      const first = yield* bootstrapCredentials.consume(issued.credential);
+      const first = yield* bootstrapCredentials.consume(issued.credential.toLowerCase());
       const second = yield* Effect.flip(bootstrapCredentials.consume(issued.credential));
 
       expect(first.method).toBe("one-time-token");
@@ -59,7 +60,16 @@ it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
       expect(issued.label).toBe("Julius iPhone");
       expect(second._tag).toBe("UnknownBootstrapCredentialError");
       expect(second.message).toContain("Unknown bootstrap credential");
-    }).pipe(Effect.provide(layerPairingGrantStore())),
+    }).pipe(
+      Effect.provide(layerPairingGrantStore()),
+      Effect.provideServiceEffect(
+        Crypto.Crypto,
+        Effect.map(Crypto.Crypto, (crypto) => ({
+          ...crypto,
+          randomBytes: (size) => Effect.succeed(new Uint8Array(size).fill(8)),
+        })),
+      ),
+    ),
   );
 
   it.effect("atomically consumes a one-time token when multiple requests race", () =>
@@ -124,6 +134,23 @@ it.layer(NodeServices.layer)("PairingGrantStore.layer", (it) => {
     }).pipe(Effect.provide(layerPairingGrantStore())),
   );
 
+  it.effect("matches a seeded desktop bootstrap credential exactly", () =>
+    Effect.gen(function* () {
+      const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
+      const exact = yield* bootstrapCredentials.consume("abcdefghjkmn");
+      const otherCase = yield* Effect.flip(bootstrapCredentials.consume("ABCDEFGHJKMN"));
+
+      expect(exact.method).toBe("desktop-bootstrap");
+      expect(otherCase._tag).toBe("UnknownBootstrapCredentialError");
+    }).pipe(
+      Effect.provide(
+        layerPairingGrantStore({
+          desktopBootstrapToken: "abcdefghjkmn",
+        }),
+      ),
+    ),
+  );
+
   it.effect("reports seeded desktop bootstrap credentials as expired after their ttl", () =>
     Effect.gen(function* () {
       const bootstrapCredentials = yield* PairingGrantStore.PairingGrantStore;
diff --git a/apps/server/src/auth/PairingGrantStore.ts b/apps/server/src/auth/PairingGrantStore.ts
index 4999fef9c49b7..440dbe3788a45 100644
--- a/apps/server/src/auth/PairingGrantStore.ts
+++ b/apps/server/src/auth/PairingGrantStore.ts
@@ -254,6 +254,11 @@ const PAIRING_TOKEN_LENGTH = 12;
 const PAIRING_TOKEN_REJECTION_LIMIT =
   Math.floor(256 / PAIRING_TOKEN_ALPHABET.length) * PAIRING_TOKEN_ALPHABET.length;
 
+const PAIRING_TOKEN_PATTERN = new RegExp(
+  `^[${PAIRING_TOKEN_ALPHABET}]{${PAIRING_TOKEN_LENGTH}}$`,
+  "i",
+);
+
 const make = Effect.gen(function* () {
   const crypto = yield* Crypto.Crypto;
   const config = yield* ServerConfig.ServerConfig;
@@ -532,10 +537,15 @@ const make = Effect.gen(function* () {
         return yield* seededResult.error;
       }
 
+      // Only credentials in the issued pairing-code format are case-insensitive.
+      const pairingCredential = PAIRING_TOKEN_PATTERN.test(credential)
+        ? credential.toUpperCase()
+        : credential;
+
       // Check scopes in the UPDATE so rejected requests cannot spend one-time links.
       const consumed = yield* pairingLinks
         .consumeAvailable({
-          credential,
+          credential: pairingCredential,
           proofKeyThumbprint: input?.proofKeyThumbprint ?? null,
           ...(input?.requestedScopes !== undefined
             ? { requestedScopes: input.requestedScopes }
@@ -560,7 +570,7 @@ const make = Effect.gen(function* () {
       }
 
       const matching = yield* pairingLinks
-        .getByCredential({ credential })
+        .getByCredential({ credential: pairingCredential })
         .pipe(Effect.mapError((cause) => new BootstrapCredentialLookupError({ cause })));
       if (Option.isNone(matching)) {
         return yield* new UnknownBootstrapCredentialError({});

From a03e630705bc874dc8d0c297a741af3cf7e3a99f Mon Sep 17 00:00:00 2001
From: Mantas Kantautas <mantas.kantautas@gmail.com>
Date: Thu, 29 Oct 2026 19:48:50 +0200
Subject: [PATCH 044/146] fix(web): find in thread opens from the thread title
 menu, so phones can reach it (#22352)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/components/ChatView.tsx            |  6 ++++++
 apps/web/src/components/chat/ChatHeader.tsx     |  4 ++++
 .../src/components/threadActionMenu.logic.ts    |  6 ++++++
 apps/web/src/contextMenuFallback.ts             |  7 +++++++
 apps/web/src/hooks/useThreadActionMenu.test.ts  | 17 ++++++++++++++++-
 apps/web/src/hooks/useThreadActionMenu.ts       |  7 ++++++-
 6 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index 665bb2fc5f5cf..1bf6f9b0fc0e8 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -2636,6 +2636,11 @@ export default function ChatView(props: ChatViewProps) {
     : EMPTY_PROVIDER_SKILLS;
   const threadFindEnabled = isServerThread && serverConfig?.threadFind === true;
   const isThreadFindActive = useThreadFindOpen(activeThreadRef, threadFindEnabled);
+  const openThreadFindStable = useStableCallback((threadRef: ScopedThreadRef) => {
+    if (threadFindEnabled && scopedThreadKey(threadRef) === activeThreadKey) {
+      openThreadFind(activeThreadKey);
+    }
+  });
 
   useChatShortcuts({
     enabled: activeThreadId !== null && !backgroundThread,
@@ -3241,6 +3246,7 @@ export default function ChatView(props: ChatViewProps) {
             {...(activeDraftLogicalProjectKey
               ? { onOpenProjectSettings: handleOpenDraftProjectSettingsStable }
               : {})}
+            {...(threadFindEnabled ? { onFindInThread: openThreadFindStable } : {})}
           />
         </header>
 
diff --git a/apps/web/src/components/chat/ChatHeader.tsx b/apps/web/src/components/chat/ChatHeader.tsx
index ec92540efd1b0..144402d1dfe9f 100644
--- a/apps/web/src/components/chat/ChatHeader.tsx
+++ b/apps/web/src/components/chat/ChatHeader.tsx
@@ -1,6 +1,7 @@
 import {
   AuthOrchestrationOperateScope,
   type EnvironmentId,
+  type ScopedThreadRef,
   type ThreadId,
 } from "@t3tools/contracts";
 import { scopeThreadRef } from "@t3tools/client-runtime/environment";
@@ -54,6 +55,7 @@ interface ChatHeaderProps {
   rightPanelOpen: boolean;
   onNewThreadInProject: () => void;
   onOpenProjectSettings?: (() => void) | undefined;
+  onFindInThread?: ((threadRef: ScopedThreadRef) => void) | undefined;
 }
 
 function resolveRenameCommit(input: {
@@ -80,6 +82,7 @@ export const ChatHeader = memo(function ChatHeader({
   rightPanelOpen,
   onNewThreadInProject,
   onOpenProjectSettings,
+  onFindInThread,
 }: ChatHeaderProps) {
   const activeProjectName = activeProject?.isScratch ? "No project" : activeProject?.title;
   const activeProjectCwd = activeProject?.workspaceRoot ?? null;
@@ -196,6 +199,7 @@ export const ChatHeader = memo(function ChatHeader({
     threadRef: isServerThread ? activeThreadRef : null,
     projectCwd: activeProjectCwd,
     onStartRename: startRename,
+    onFind: onFindInThread,
     canShareWithGuest,
   });
   const titleButtonRef = useRef<HTMLButtonElement | null>(null);
diff --git a/apps/web/src/components/threadActionMenu.logic.ts b/apps/web/src/components/threadActionMenu.logic.ts
index 3c4626c1ea1ad..ac4ef649ed07c 100644
--- a/apps/web/src/components/threadActionMenu.logic.ts
+++ b/apps/web/src/components/threadActionMenu.logic.ts
@@ -2,6 +2,7 @@ import type { ContextMenuItem } from "@t3tools/contracts";
 import type { SnoozePreset } from "@t3tools/client-runtime/state/thread-settled";
 
 export type ThreadActionMenuId =
+  | "find"
   | "new-thread-on-branch"
   | "filter-by-project"
   | "turn-into-project"
@@ -68,6 +69,7 @@ export function buildDraftActionMenuItems(options: {
 
 export interface ThreadActionMenuState {
   readonly canOperate: boolean;
+  readonly canFind?: boolean;
   readonly branch: string | null;
   readonly projectFilter: {
     readonly label: string;
@@ -98,6 +100,7 @@ export interface ThreadActionMenuState {
 /** Local navigation, read markers, and copying remain available to read-only clients. */
 export function threadActionRequiresOperate(action: ThreadActionMenuId): boolean {
   return ![
+    "find",
     "new-thread-on-branch",
     "project-settings",
     "mark-unread",
@@ -114,6 +117,9 @@ export function buildThreadActionMenuItems(
   state: ThreadActionMenuState,
 ): ReadonlyArray<ContextMenuItem<ThreadActionMenuId>> {
   const items: ReadonlyArray<ContextMenuItem<ThreadActionMenuId>> = [
+    ...(state.canFind
+      ? [{ id: "find" as const, label: "Find in thread", icon: "text-search" }]
+      : []),
     ...(state.branch
       ? [
           {
diff --git a/apps/web/src/contextMenuFallback.ts b/apps/web/src/contextMenuFallback.ts
index eece920cba664..b63fc5b3ff7a2 100644
--- a/apps/web/src/contextMenuFallback.ts
+++ b/apps/web/src/contextMenuFallback.ts
@@ -150,6 +150,13 @@ const ICON_PATHS: Record<string, ReadonlyArray<{ tag: string; attrs: Record<stri
     { tag: "path", attrs: { d: "M3 5a2 2 0 0 0 2 2h3" } },
     { tag: "path", attrs: { d: "M3 3v13a2 2 0 0 0 2 2h3" } },
   ],
+  "text-search": [
+    { tag: "path", attrs: { d: "M21 5H3" } },
+    { tag: "path", attrs: { d: "M10 12H3" } },
+    { tag: "path", attrs: { d: "M10 19H3" } },
+    { tag: "circle", attrs: { cx: "17", cy: "15", r: "3" } },
+    { tag: "path", attrs: { d: "m21 19-1.9-1.9" } },
+  ],
   trash: [
     { tag: "path", attrs: { d: "M3 6h18" } },
     { tag: "path", attrs: { d: "M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6" } },
diff --git a/apps/web/src/hooks/useThreadActionMenu.test.ts b/apps/web/src/hooks/useThreadActionMenu.test.ts
index e87092d59c37e..3c8255b04c088 100644
--- a/apps/web/src/hooks/useThreadActionMenu.test.ts
+++ b/apps/web/src/hooks/useThreadActionMenu.test.ts
@@ -149,11 +149,12 @@ const target = {
   threadId: ThreadId.make("thread"),
 };
 const position = { x: 10, y: 20 };
-const createMenu = () =>
+const createMenu = (options: { readonly onFind?: (threadRef: typeof target) => void } = {}) =>
   useThreadActionMenu({
     threadRef: target,
     projectCwd: "/project",
     onStartRename: () => recordEffect("rename"),
+    onFind: options.onFind,
     canShareWithGuest: false,
   });
 
@@ -178,4 +179,18 @@ describe("thread menu permissions", () => {
       expect(state.effects).toEqual([]);
     },
   );
+
+  it("offers find only to a header that can open it, without task permission", async () => {
+    createMenu().openMenu(position);
+    expect(state.show.mock.calls[0]![0].some((item) => item.id === "find")).toBe(false);
+    state.show.mockResolvedValue("find");
+    const onFind = vi.fn(() => recordEffect("find"));
+    createMenu({ onFind }).openMenu(position);
+    await state.completed.promise;
+    const items = state.show.mock.calls[1]![0];
+    expect(items[0]).toMatchObject({ id: "find", label: "Find in thread" });
+    expect(items[0]?.disabled).not.toBe(true);
+    expect(state.effects).toEqual(["find"]);
+    expect(onFind).toHaveBeenCalledExactlyOnceWith(target);
+  });
 });
diff --git a/apps/web/src/hooks/useThreadActionMenu.ts b/apps/web/src/hooks/useThreadActionMenu.ts
index 0e25cebeef878..cddef6046cf8b 100644
--- a/apps/web/src/hooks/useThreadActionMenu.ts
+++ b/apps/web/src/hooks/useThreadActionMenu.ts
@@ -61,9 +61,10 @@ export function useThreadActionMenu(input: {
   readonly threadRef: ScopedThreadRef | null;
   readonly projectCwd: string | null;
   readonly onStartRename: () => void;
+  readonly onFind?: ((threadRef: ScopedThreadRef) => void) | undefined;
   readonly canShareWithGuest: boolean;
 }) {
-  const { threadRef, projectCwd, onStartRename, canShareWithGuest } = input;
+  const { threadRef, projectCwd, onStartRename, onFind, canShareWithGuest } = input;
   const router = useRouter();
   const projects = useProjects();
   const primaryEnvironmentId = usePrimaryEnvironmentId();
@@ -133,6 +134,7 @@ export function useThreadActionMenu(input: {
       const snoozePresets = resolveSnoozePresets(now, timestampFormat, threadRef.environmentId);
       const items = buildThreadActionMenuItems({
         canOperate: readEnvironmentScope(threadRef.environmentId, AuthOrchestrationOperateScope),
+        canFind: onFind !== undefined,
         branch: thread.branch ?? null,
         projectFilter: null,
         isPinned: thread.pinnedAt != null,
@@ -187,6 +189,9 @@ export function useThreadActionMenu(input: {
         }
       };
       switch (action) {
+        case "find":
+          onFind?.(threadRef);
+          return;
         case "project-settings": {
           const project = projects.find(
             (candidate) =>

From e692729e22a2fa1445b7417f7039f20e0700b0a6 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:49:15 -0500
Subject: [PATCH 045/146] fix(desktop): resolve executable commands when
 checking CLI shadowing (#22046)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../desktop/src/app/DesktopCliCommand.test.ts | 34 +++++++++++++++++++
 apps/desktop/src/app/DesktopCliCommand.ts     | 14 +++++++-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/apps/desktop/src/app/DesktopCliCommand.test.ts b/apps/desktop/src/app/DesktopCliCommand.test.ts
index 3cdfdb6cfa383..7141ebde70537 100644
--- a/apps/desktop/src/app/DesktopCliCommand.test.ts
+++ b/apps/desktop/src/app/DesktopCliCommand.test.ts
@@ -1,5 +1,6 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { afterEach, beforeEach, expect, it } from "@effect/vitest";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Option from "effect/Option";
@@ -183,6 +184,39 @@ it.layer(NodeServices.layer)("DesktopCliCommand", (it) => {
     }).pipe(Effect.scoped),
   );
 
+  it.effect.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+    "skips a t3 directory or a file this user cannot execute",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const home = yield* fs.makeTempDirectoryScoped();
+        const folder = path.join(home, "folder");
+        const plain = path.join(home, "plain");
+        const shadow = path.join(home, "shadow");
+        yield* fs.makeDirectory(path.join(folder, "t3"), { recursive: true });
+        yield* fs.makeDirectory(plain);
+        yield* fs.writeFileString(path.join(plain, "t3"), "notes\n");
+        // Root can execute mode 0o601; other users must honor the owner permissions.
+        yield* fs.chmod(path.join(plain, "t3"), process.getuid?.() === 0 ? 0o600 : 0o601);
+        yield* fs.makeDirectory(shadow);
+        yield* fs.writeFileString(path.join(shadow, "t3"), "#!/bin/sh\n", { mode: 0o755 });
+        process.env.PATH = [folder, plain, shadow, path.join(home, ".local", "bin")].join(":");
+
+        const command = yield* commandIn({ home });
+        expect((yield* command.state).shadowedBy).toBe(path.join(shadow, "t3"));
+
+        const error = yield* Effect.flip(command.install);
+        expect(error.message).toContain(path.join(shadow, "t3"));
+
+        yield* fs.remove(shadow, { recursive: true });
+        expect(yield* command.install).toMatchObject({
+          onPath: true,
+          installedPath: path.join(home, ".local", "bin", "t3"),
+        });
+      }).pipe(Effect.scoped),
+  );
+
   it.effect("leaves the Windows PATH alone when it cannot be read", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/desktop/src/app/DesktopCliCommand.ts b/apps/desktop/src/app/DesktopCliCommand.ts
index 2ae070d638263..8a89a366814ed 100644
--- a/apps/desktop/src/app/DesktopCliCommand.ts
+++ b/apps/desktop/src/app/DesktopCliCommand.ts
@@ -1,3 +1,6 @@
+// @effect-diagnostics-next-line nodeBuiltinImport:off -- FileSystem.access has no execute check.
+import * as NodeFSP from "node:fs/promises";
+
 import type { DesktopCliCommandState } from "@t3tools/contracts";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
@@ -118,10 +121,19 @@ export const make = Effect.gen(function* () {
       Effect.mapError(() => fail("Could not update your PATH.")),
     );
 
+  const isExecutableFile = Effect.fn("DesktopCliCommand.isExecutableFile")(
+    function* (target: string) {
+      if ((yield* fs.stat(target)).type !== "File") return false;
+      yield* Effect.tryPromise(() => NodeFSP.access(target, NodeFSP.constants.X_OK));
+      return true;
+    },
+    Effect.orElseSucceed(() => false),
+  );
+
   const firstOnPath = Effect.gen(function* () {
     for (const directory of pathEntries(process.env.PATH, ":")) {
       const candidate = path.join(directory, "t3");
-      if (yield* exists(candidate)) return Option.some(candidate);
+      if (yield* isExecutableFile(candidate)) return Option.some(candidate);
     }
     return Option.none<string>();
   });

From a8e418885e203ea6014f0ca3f714fca149d4fbd0 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:49:39 -0500
Subject: [PATCH 046/146] fix(server): SQLite temp files no longer block the
 event loop (#24194)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/persistence/Sqlite.test.ts | 45 ++++++++++++++++++++++
 apps/server/src/persistence/Sqlite.ts      |  3 ++
 2 files changed, 48 insertions(+)

diff --git a/apps/server/src/persistence/Sqlite.test.ts b/apps/server/src/persistence/Sqlite.test.ts
index 45b28834a4ad7..940d626514336 100644
--- a/apps/server/src/persistence/Sqlite.test.ts
+++ b/apps/server/src/persistence/Sqlite.test.ts
@@ -5,12 +5,57 @@ import * as NodePath from "node:path";
 
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, it } from "@effect/vitest";
+import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as SqlClient from "effect/sql/SqlClient";
 
 import * as SqlitePersistence from "./Sqlite.ts";
 
+// Linux names an open, already-deleted file "<path> (deleted)" in /proc/self/fd.
+// SQLite names its temp files "etilqs_*" and, without TMPDIR, puts them in
+// /var/tmp while os.tmpdir() is /tmp, so match the name, not the directory.
+const openDeletedTempFiles = () =>
+  NodeFS.readdirSync("/proc/self/fd").flatMap((fd) => {
+    try {
+      const target = NodeFS.readlinkSync(`/proc/self/fd/${fd}`);
+      return target.includes("/etilqs_") && target.endsWith(" (deleted)") ? [target] : [];
+    } catch {
+      return [];
+    }
+  });
+
+it.effect.skipIf(HostProcess.Platform.defaultValue() !== "linux")(
+  "keeps a write transaction's statement journal off the temp directory",
+  () => {
+    const tempDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-sqlite-temp-"));
+    const persistence = SqlitePersistence.layerFromPath(
+      NodePath.join(tempDir, "state.sqlite"),
+    ).pipe(Layer.provide(NodeServices.layer));
+
+    return Effect.gen(function* () {
+      const sql = yield* SqlClient.SqlClient;
+      yield* sql`CREATE TABLE journal_probe(id INTEGER PRIMARY KEY, payload TEXT NOT NULL)`;
+      for (let id = 0; id < 64; id++) {
+        yield* sql`INSERT INTO journal_probe VALUES (${id}, ${"x".repeat(4096)})`;
+      }
+      const before = new Set(openDeletedTempFiles());
+      const opened = yield* sql.withTransaction(
+        Effect.gen(function* () {
+          // A multi-row update can fail halfway, so SQLite journals every page
+          // it changes, here well past the 64 KiB it holds in memory by default.
+          yield* sql`UPDATE journal_probe SET payload = payload || 'y'`;
+          return openDeletedTempFiles().filter((target) => !before.has(target));
+        }),
+      );
+      assert.deepEqual(opened, []);
+    }).pipe(
+      Effect.provide(persistence),
+      Effect.ensuring(Effect.sync(() => NodeFS.rmSync(tempDir, { recursive: true, force: true }))),
+    );
+  },
+);
+
 it.effect("drops planner statistics a database already has", () => {
   const tempDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-sqlite-stats-"));
   const dbPath = NodePath.join(tempDir, "state.sqlite");
diff --git a/apps/server/src/persistence/Sqlite.ts b/apps/server/src/persistence/Sqlite.ts
index 48c1ab8fc8913..2f21ea0a8a942 100644
--- a/apps/server/src/persistence/Sqlite.ts
+++ b/apps/server/src/persistence/Sqlite.ts
@@ -28,6 +28,9 @@ const layerSetup = Layer.effectDiscard(
     yield* sql`PRAGMA synchronous = NORMAL;`;
     // macOS fsync misses drive caches; F_FULLFSYNC flushes them at checkpoints and is ignored elsewhere.
     yield* sql`PRAGMA checkpoint_fullfsync = ON;`;
+    // Keep statement journals and sort spills off the main thread's disk path.
+    // Large statements and open savepoints can increase peak memory use.
+    yield* sql`PRAGMA temp_store = MEMORY;`;
     // PASSIVE checkpoints retain peak WAL size until the last connection closes.
     yield* sql.unsafe(`PRAGMA journal_size_limit = ${WAL_SIZE_LIMIT_BYTES};`);
     yield* runMigrations();

From 849d2b5ac8fc9b1a891f0115f030c73d672ec646 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Thu, 29 Oct 2026 13:50:01 -0400
Subject: [PATCH 047/146] fix(server): a branch named like a tag no longer
 reads as heads/<name> (#24258)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 17 +++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      | 31 ++++++++++++--------
 2 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 18709ecf0e290..b26f7d82a903b 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -404,6 +404,7 @@ describe("pullCurrentBranch", () => {
         const driver = yield* GitVcsDriver.GitVcsDriver;
         const fs = yield* FileSystem.FileSystem;
         const { cwd, updater, initialBranch, remoteHead } = yield* cloneBehindRemote;
+        yield* git(cwd, ["tag", initialBranch]);
         yield* git(updater, ["push", "origin", "HEAD:refs/heads/other"]);
         const remoteName = customMapping ? "team/upstream" : "origin";
         const refPrefix = customMapping
@@ -2279,6 +2280,22 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
   });
 
   describe("repository status", () => {
+    it.effect("reads the current branch by name when a tag shares it", () =>
+      Effect.gen(function* () {
+        const cwd = yield* makeTmpDir();
+        yield* initRepoWithCommit(cwd);
+        yield* git(cwd, ["checkout", "-b", "release"]);
+        yield* git(cwd, ["tag", "release"]);
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+
+        const remoteStatus = yield* driver.statusDetailsRemote(cwd, { refreshUpstream: false });
+        assert.equal(remoteStatus.branch, "release");
+        const preview = yield* driver.getReviewDiffPreview({ cwd });
+        const branchRange = preview.sources.find((source) => source.kind === "branch-range");
+        assert.equal(branchRange?.headRef, "release");
+      }),
+    );
+
     it.effect("does not open a project folder laid out as a bare repository", () =>
       Effect.gen(function* () {
         const cwd = yield* makeTmpDir();
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index f0b78aa564fb5..a7ba2b86771ac 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -514,6 +514,15 @@ function classifyGitFailure(stderr: string): GitCommandFailureReason | null {
   return null;
 }
 
+// `--short` and `--abbrev-ref` print `heads/<name>` when a tag shares the branch's name, so
+// branch reads take the full ref and strip the prefix themselves.
+function branchNameFromHeadRef(value: string): string | null {
+  const ref = value.trim();
+  return ref.startsWith("refs/heads/") && ref.length > "refs/heads/".length
+    ? ref.slice("refs/heads/".length)
+    : null;
+}
+
 function parseDefaultBranchFromRemoteHeadRef(value: string, remoteName: string): string | null {
   const trimmed = value.trim();
   const prefix = `refs/remotes/${remoteName}/`;
@@ -1412,7 +1421,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         executeGit(
           "GitVcsDriver.resolveRepositoryPaths.currentBranch",
           cwd,
-          ["symbolic-ref", "--quiet", "--short", "HEAD"],
+          ["symbolic-ref", "--quiet", "HEAD"],
           {
             timeoutMs: 5_000,
             allowNonZeroExit: true,
@@ -1443,11 +1452,8 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
             Effect.map((physicalCwd) => path.relative(worktreeRoot, physicalCwd) === ""),
             Effect.orElseSucceed(() => undefined),
           );
-    const currentBranchOutput = currentBranchResult.stdout.trim();
     const currentBranch =
-      currentBranchResult.exitCode === 0 && currentBranchOutput.length > 0
-        ? currentBranchOutput
-        : null;
+      currentBranchResult.exitCode === 0 ? branchNameFromHeadRef(currentBranchResult.stdout) : null;
 
     return {
       gitCommonDir,
@@ -1938,7 +1944,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     const branchResult = yield* executeGitWithStableDiagnostics(
       "GitVcsDriver.statusDetailsRemote.branch",
       cwd,
-      ["rev-parse", "--abbrev-ref", "HEAD"],
+      ["rev-parse", "--symbolic-full-name", "HEAD"],
       { allowNonZeroExit: true },
     ).pipe(
       Effect.catchTags({
@@ -1960,7 +1966,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           ...gitCommandContext({
             operation: "GitVcsDriver.statusDetailsRemote.branch",
             cwd,
-            args: ["rev-parse", "--abbrev-ref", "HEAD"],
+            args: ["rev-parse", "--symbolic-full-name", "HEAD"],
           }),
           detail: "Git branch lookup failed.",
           exitCode: branchResult.exitCode,
@@ -1972,12 +1978,11 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       const branchValue = yield* runGitStdout(
         "GitVcsDriver.statusDetailsRemote.unbornBranch",
         cwd,
-        ["symbolic-ref", "--quiet", "--short", "HEAD"],
+        ["symbolic-ref", "--quiet", "HEAD"],
       );
-      branch = branchValue.trim() || null;
+      branch = branchNameFromHeadRef(branchValue);
     } else {
-      const branchValue = branchResult.stdout.trim();
-      branch = branchValue.length > 0 && branchValue !== "HEAD" ? branchValue : null;
+      branch = branchNameFromHeadRef(branchResult.stdout);
     }
     const currentUpstreamRef = yield* readCurrentUpstreamRef(cwd);
     let upstreamRef =
@@ -2781,9 +2786,9 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         runGitStdout(
           "GitVcsDriver.pullCurrentBranch.currentBranch",
           cwd,
-          ["symbolic-ref", "--quiet", "--short", "HEAD"],
+          ["symbolic-ref", "--quiet", "HEAD"],
           true,
-        ).pipe(Effect.map((stdout) => stdout.trim())),
+        ).pipe(Effect.map(branchNameFromHeadRef)),
         runGitStdout("GitVcsDriver.pullCurrentBranch.currentSha", cwd, ["rev-parse", "HEAD"]).pipe(
           Effect.map((stdout) => stdout.trim()),
         ),

From 0ed554001a9be58c2e2080592096f784f8c7a65b Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:50:24 +0000
Subject: [PATCH 048/146] fix(server): cap generated worktree folder names
 (#25212)

Co-authored-by: Dara Adedeji <76637177+SunkenInTime@users.noreply.github.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 36 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      | 13 +++++--
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index b26f7d82a903b..47b3f3a62b7e9 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -3488,6 +3488,42 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
       }),
     );
 
+    it.effect("keeps generated worktree folders short without changing long branch names", () =>
+      Effect.gen(function* () {
+        const pathService = yield* Path.Path;
+        const cwd = yield* makeTmpDir();
+        const { initialBranch } = yield* initRepoWithCommit(cwd);
+        const worktreesDirectory = yield* makeTmpDir("custom-worktrees-");
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+        const folders = new Set<string>();
+        const branches = [
+          `feature/${"a".repeat(90)}/${"b".repeat(90)}/${"c".repeat(90)}`,
+          `feature/${"a".repeat(90)}/${"b".repeat(90)}/${"d".repeat(90)}`,
+          `feature/${"a".repeat(40)}/5fac`,
+          `feature/${"a".repeat(40)}/18828`,
+          `${"a".repeat(22)}😀/${"b".repeat(30)}`,
+          "z".repeat(40),
+          "z".repeat(41),
+        ];
+        for (const branch of branches) {
+          const created = yield* driver.createWorktree(
+            { cwd, path: null, refName: initialBranch, newRefName: branch },
+            { worktreesDirectory },
+          );
+          const folder = pathService.basename(created.worktree.path);
+          assert.isAtMost(folder.length, 40);
+          if (branch.length <= 40) assert.equal(folder, branch);
+          assert.equal(yield* git(created.worktree.path, ["branch", "--show-current"]), branch);
+          assert.include(
+            yield* git(cwd, ["-c", "core.quotePath=false", "worktree", "list", "--porcelain"]),
+            `worktree ${created.worktree.path}`,
+          );
+          folders.add(folder);
+        }
+        assert.equal(folders.size, branches.length);
+      }),
+    );
+
     it.effect("resolves the submodule mode from the option, then t3.json", () =>
       Effect.gen(function* () {
         const fileSystem = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index a7ba2b86771ac..49149d95f58f6 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -3811,7 +3811,6 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     yield* refuseOptionLikeRefName("GitVcsDriver.createWorktree", input.cwd, input.refName);
     yield* refuseOptionLikeRefName("GitVcsDriver.createWorktree", input.cwd, input.newRefName);
     const targetBranch = input.newRefName ?? input.refName;
-    const sanitizedBranch = targetBranch.replace(/\//g, "-");
     // Resolve sub/.. before taking the basename.
     const repoName = path.basename(path.resolve(input.cwd));
     let worktreePath = input.path;
@@ -3830,7 +3829,17 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           detail: `The worktree location "${options?.worktreesDirectory}" must be an absolute folder on this machine, not a drive root. Change it in Settings → Worktrees.`,
         });
       }
-      worktreePath = path.join(parentDir, repoName, sanitizedBranch);
+      let directoryName = targetBranch.replace(/\//g, "-");
+      // Leave room for files beneath the worktree on Windows, regardless of branch length.
+      if (directoryName.length > 40) {
+        const digest = yield* crypto
+          .digest("SHA-256", new TextEncoder().encode(targetBranch))
+          .pipe(Effect.orDie);
+        // Avoid splitting a surrogate pair, which Git would list back as a different path.
+        const prefix = directoryName.slice(0, 23).replace(/[\uD800-\uDBFF]$/, "");
+        directoryName = `${prefix}-${Hex.encode(digest).slice(0, 16)}`;
+      }
+      worktreePath = path.join(parentDir, repoName, directoryName);
     }
     if (input.newRefName) {
       // Kept apart from the checkout so the shared-config lock only covers the tracking write.

From c6f2b7dbae472b1a6ce75bd74bc7071f4c96b789 Mon Sep 17 00:00:00 2001
From: Joseph Vidal <135430578+josephv123@users.noreply.github.com>
Date: Thu, 29 Oct 2026 13:50:47 -0400
Subject: [PATCH 049/146] perf(server): checkpoint capture scans the index
 listing by record instead of by byte (#21329)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/vcs/GitVcsDriver.test.ts | 14 +++++----
 apps/server/src/vcs/GitVcsDriver.ts      | 36 +++++++++++++++---------
 2 files changed, 31 insertions(+), 19 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriver.test.ts b/apps/server/src/vcs/GitVcsDriver.test.ts
index 0e3d2b5063ed2..c7a06c3bdc31f 100644
--- a/apps/server/src/vcs/GitVcsDriver.test.ts
+++ b/apps/server/src/vcs/GitVcsDriver.test.ts
@@ -682,9 +682,13 @@ it.effect.each(
     }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
 );
 
-it.effect.each(["normal", "flags", "sparse"] as const)(
-  "checkpoint index inspection handles entries beyond the output cap (index=%s)",
-  (indexMode) =>
+it.effect.each(
+  (["normal", "flags", "sparse"] as const).flatMap((indexMode) =>
+    [1, 3, 4096].map((chunkSize) => ({ indexMode, chunkSize })),
+  ),
+)(
+  "checkpoint index inspection handles entries beyond the output cap (index=$indexMode, chunk=$chunkSize)",
+  ({ indexMode, chunkSize }) =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
       const path = yield* Path.Path;
@@ -720,8 +724,8 @@ it.effect.each(["normal", "flags", "sparse"] as const)(
                     ...input,
                     maxOutputBytes: 8,
                     onStdoutChunk: (chunk) => {
-                      for (let i = 0; i < chunk.length; i++)
-                        input.onStdoutChunk?.(chunk.subarray(i, i + 1));
+                      for (let i = 0; i < chunk.length; i += chunkSize)
+                        input.onStdoutChunk?.(chunk.subarray(i, i + chunkSize));
                     },
                   }
                 : input,
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index e3249c70882ec..acbf817462c12 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -899,7 +899,7 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
             let specialFlags = false;
             let recordStart = true;
             let skipped = false;
-            let skippedRecord: number[] = [];
+            let skippedRecord: Uint8Array[] = [];
             const skippedPaths: string[] = [];
             yield* vcsProcess.run({
               operation,
@@ -909,27 +909,35 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
               env: commitEnv,
               maxOutputBytes: 4_096,
               outputMode: "truncate",
+              // Only tags and sparse skip-worktree paths matter; scan NUL-delimited records.
               onStdoutChunk: (chunk) => {
-                for (const byte of chunk) {
-                  if (recordStart) skipped = byte === 83;
+                let start = 0;
+                while (start < chunk.length) {
+                  const end = chunk.indexOf(0, start);
+                  if (recordStart) {
+                    const tag = chunk[start]!;
+                    skipped = tag === 83;
+                    if ((tag >= 97 && tag <= 122) || (!sparseCheckout && tag === 83)) {
+                      specialFlags = true;
+                    }
+                  }
                   if (skipped && sparseCheckout) {
-                    if (byte !== 0) skippedRecord.push(byte);
-                    else {
-                      if (skippedRecord.at(-1) !== 47) {
-                        const name = Buffer.from(skippedRecord).subarray(2);
+                    skippedRecord.push(
+                      Buffer.from(chunk.subarray(start, end === -1 ? undefined : end)),
+                    );
+                    if (end !== -1) {
+                      const record = Buffer.concat(skippedRecord);
+                      if (record.at(-1) !== 47) {
+                        const name = record.subarray(2);
                         if (!NodeBuffer.isUtf8(name)) specialFlags = true;
                         else skippedPaths.push(name.toString("utf8"));
                       }
                       skippedRecord = [];
                     }
                   }
-                  if (
-                    recordStart &&
-                    ((byte >= 97 && byte <= 122) || (!sparseCheckout && byte === 83))
-                  ) {
-                    specialFlags = true;
-                  }
-                  recordStart = byte === 0;
+                  recordStart = end !== -1;
+                  if (!recordStart) break;
+                  start = end + 1;
                 }
               },
             });

From aaba9de94f6e3f8b57ef9b605621afde791e625e Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 10:51:06 -0700
Subject: [PATCH 050/146] fix(server): PR discovery sweeps skip hidden subagent
 threads (#26983)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ThreadPullRequestService.test.ts          | 122 ++++++++++++++++++
 .../ThreadPullRequestService.ts               |  13 +-
 2 files changed, 132 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts b/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
index 5627a6dc37aa9..5f380c7e0ace7 100644
--- a/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts
@@ -179,6 +179,128 @@ describe("ThreadPullRequestServiceV2 reads", () => {
     ),
   );
 
+  it.effect("leaves delegated child threads to their own refresh instead of the sweep", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const parent = {
+          ...threadShell("parent-thread"),
+          branch: "feature/parent",
+          worktreePath: "/workspace/parent",
+        };
+        const child: OrchestrationV2ThreadShell = {
+          ...threadShell("child-thread"),
+          branch: "t3/reply-ok",
+          worktreePath: "/workspace/child",
+          lineage: {
+            rootThreadId: parent.id,
+            parentThreadId: parent.id,
+            relationshipToParent: "subagent",
+          },
+        };
+        const project: OrchestrationProjectShell = {
+          id: parent.projectId,
+          title: "Project",
+          workspaceRoot: "/workspace/project",
+          defaultModelSelection: null,
+          scripts: [],
+          createdAt: "2026-08-01T00:00:00.000Z",
+          updatedAt: "2026-08-01T00:00:00.000Z",
+        };
+        const activation = yield* Deferred.make<void>();
+        const domainEvents = yield* Queue.unbounded<OrchestrationV2DomainEvent>();
+        const sweeps = yield* Queue.unbounded<void>();
+        const childLookup = yield* Deferred.make<void>();
+        const lookups: Array<{ readonly branch: string; readonly refresh: boolean }> = [];
+        const dependencies = Layer.mergeAll(
+          Layer.mock(Orchestrator.OrchestratorV2)({
+            streamDomainEvents: Stream.fromQueue(domainEvents),
+            getShellSnapshot: () =>
+              Queue.offer(sweeps, undefined).pipe(
+                Effect.as({
+                  schemaVersion: 2,
+                  snapshotSequence: 1,
+                  threads: [parent, child],
+                  archivedThreads: [],
+                }),
+              ),
+            getThreadEventSequence: () => Effect.succeed(1),
+            getThreadShell: (threadId) =>
+              Effect.succeed([parent, child].find((thread) => thread.id === threadId) ?? null),
+          }),
+          Layer.mock(ProjectStore.ProjectStoreV2)({
+            listShells: () => Effect.succeed([project]),
+            getShell: () => Effect.succeedSome(project),
+          }),
+          Layer.mock(GitManager.GitManager)({
+            branchPullRequest: (input, options) =>
+              Effect.gen(function* () {
+                const refresh = options?.refresh ?? false;
+                lookups.push({ branch: input.branch, refresh });
+                if (input.branch === child.branch && refresh) {
+                  yield* Deferred.succeed(childLookup, undefined);
+                }
+                return null;
+              }),
+          }),
+          Layer.mock(PullRequestService.PullRequestService)({}),
+          Layer.mock(RepositoryIdentityResolver.RepositoryIdentityResolver)({
+            resolve: () =>
+              Effect.succeed({
+                canonicalKey: "github.com/acme/project",
+                locator: {
+                  source: "git-remote" as const,
+                  remoteName: "origin",
+                  remoteUrl: "git@github.com:acme/project.git",
+                },
+                provider: SourceControlProviderKind.make("github"),
+                owner: "acme",
+                name: "project",
+              }),
+          }),
+          Layer.mock(BackgroundPolicy.BackgroundPolicy)({
+            shouldRunScopeWork: () => Effect.succeed(true),
+            shouldRunOpportunisticWork: Effect.succeed(true),
+          }),
+          Layer.succeed(ServerActivation.ServerActivation, Deferred.await(activation)),
+          Layer.succeed(
+            Crypto.Crypto,
+            Crypto.make({
+              randomBytes: (size) => new Uint8Array(size).fill(1),
+              digest: (_algorithm, data) => Effect.succeed(data),
+            }),
+          ),
+          FileSystem.layerNoop({}),
+        );
+        yield* Effect.gen(function* () {
+          const service = yield* ThreadPullRequestService.make;
+          yield* service.start();
+          yield* Deferred.succeed(activation, undefined);
+
+          // Startup backfill sweep, then one periodic sweep.
+          yield* Queue.take(sweeps);
+          yield* service.drain;
+          yield* TestClock.adjust("1 minute");
+          yield* Queue.take(sweeps);
+          yield* service.drain;
+          const sweepLookups = lookups.map((lookup) => lookup.branch).toSorted();
+
+          // The child's own turn still discovers its pull request.
+          yield* Queue.offer(domainEvents, {
+            type: "checkpoint.captured",
+            threadId: child.id,
+          } as OrchestrationV2DomainEvent);
+          yield* Deferred.await(childLookup);
+          yield* service.drain;
+
+          expect(sweepLookups).toEqual([parent.branch, parent.branch]);
+          expect(lookups.slice(sweepLookups.length)).toEqual([
+            { branch: child.branch, refresh: true },
+          ]);
+        }).pipe(Effect.provide(dependencies));
+      }),
+    ),
+  );
+
   it.effect.each([
     { state: "closed", sameBranch: false },
     { state: "merged", sameBranch: false },
diff --git a/apps/server/src/orchestration-v2/ThreadPullRequestService.ts b/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
index 7b3c09ba15b8a..0db9feac8587e 100644
--- a/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
+++ b/apps/server/src/orchestration-v2/ThreadPullRequestService.ts
@@ -139,9 +139,16 @@ export const make = Effect.gen(function* () {
       readThreadSnapshot(request),
       projectStore.listShells(),
     ]);
+    // Subagent children refresh after their own runs; sweeping them costs a lookup each per minute.
+    const snapshotThreads =
+      request.threadId === null
+        ? threadSnapshot.threads.filter(
+            (thread) => thread.lineage.relationshipToParent !== "subagent",
+          )
+        : threadSnapshot.threads;
     const projects = new Map(projectShells.map((project) => [project.id, project]));
     if (request.backfill) {
-      for (const thread of threadSnapshot.threads) {
+      for (const thread of snapshotThreads) {
         if (
           (thread.settledOverride === "settled" || thread.settledAt !== null) &&
           thread.branchPullRequest == null
@@ -151,13 +158,13 @@ export const make = Effect.gen(function* () {
       }
     }
     const visibleThreadIds = new Set(
-      threadSnapshot.threads.filter((thread) => thread.branch !== null).map((thread) => thread.id),
+      snapshotThreads.filter((thread) => thread.branch !== null).map((thread) => thread.id),
     );
     const checkedIds = request.threadId === null ? [...pendingBackfill.keys()] : [request.threadId];
     for (const threadId of checkedIds) {
       if (!visibleThreadIds.has(threadId)) pendingBackfill.delete(threadId);
     }
-    const threads = threadSnapshot.threads.filter(
+    const threads = snapshotThreads.filter(
       (thread) =>
         thread.archivedAt === null &&
         ((thread.settledOverride !== "settled" && thread.settledAt === null) ||

From 8084e00bced3939c93c87f70301a7135c2f9d794 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:51:10 +0000
Subject: [PATCH 051/146] fix(shared): stop parsing CLI flags after -- (#25204)

Co-authored-by: Simone <185146821+Lucenx9@users.noreply.github.com>
---
 .../Adapters/ClaudeAdapterV2.test.ts          | 15 +++++++++
 packages/shared/src/cliArgs.test.ts           | 33 ++++++++++++++++++-
 packages/shared/src/cliArgs.ts                |  6 +++-
 3 files changed, 52 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index ea5ee249a787f..38253cd82f1d1 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -235,6 +235,21 @@ function makeClaudeTestTurnInput(input: {
 }
 
 describe("ClaudeAdapterV2 runtime query policy", () => {
+  it.each([
+    "-- --thinking-display omitted",
+    "--thinking-display summarized -- --thinking-display omitted",
+  ])("does not treat operands after -- as SDK flags: %s", (launchArgs) => {
+    const options = ClaudeAdapterV2.makeClaudeQueryOptions({
+      modelSelection: CLAUDE_TEST_MODEL_SELECTION,
+      nativeThreadId: "thinking-thread",
+      resume: false,
+      cwd: "/workspace",
+      settings: { ...DEFAULT_CLAUDE_SETTINGS, launchArgs },
+    });
+    assert.deepEqual(options.thinking, { type: "adaptive", display: "summarized" });
+    assert.equal(options.extraArgs?.["thinking-display"], "summarized");
+  });
+
   it.each([
     ["--permission-mode acceptEdits", "acceptEdits"],
     ["--dangerously-skip-permissions", "bypassPermissions"],
diff --git a/packages/shared/src/cliArgs.test.ts b/packages/shared/src/cliArgs.test.ts
index e4fdfe3c2dbac..d4006e3bf4ebd 100644
--- a/packages/shared/src/cliArgs.test.ts
+++ b/packages/shared/src/cliArgs.test.ts
@@ -54,10 +54,41 @@ describe("parseCliArgs", () => {
     });
   });
 
-  it("ignores bare -- with no flag name", () => {
+  it("accepts a trailing -- without operands", () => {
     expect(parseCliArgs("--")).toEqual({ flags: {}, positionals: [] });
   });
 
+  it.each([
+    { args: "--effort low -- --effort high --chrome" },
+    { args: ["--effort", "low", "--", "--effort", "high", "--chrome"] },
+  ])("ends option parsing at -- for $args", ({ args }) => {
+    expect(parseCliArgs(args)).toEqual({
+      flags: { effort: "low" },
+      positionals: ["--effort", "high", "--chrome"],
+    });
+  });
+
+  it("preserves all operands after --, including empty strings and another --", () => {
+    expect(parseCliArgs(["--", "", "--", "--model=example", "-x"])).toEqual({
+      flags: {},
+      positionals: ["", "--", "--model=example", "-x"],
+    });
+  });
+
+  it("ends option parsing with explicit boolean flags too", () => {
+    expect(parseCliArgs(["--chrome", "--", "--verbose"], { booleanFlags: ["chrome"] })).toEqual({
+      flags: { chrome: null },
+      positionals: ["--verbose"],
+    });
+  });
+
+  it("keeps -- inside an equals-form option value", () => {
+    expect(parseCliArgs("--append-system-prompt=-- --chrome")).toEqual({
+      flags: { "append-system-prompt": "--", chrome: null },
+      positionals: [],
+    });
+  });
+
   it("boolean flag does not consume next token as value", () => {
     expect(parseCliArgs(["--github-output", "1.2.3"], { booleanFlags: ["github-output"] })).toEqual(
       {
diff --git a/packages/shared/src/cliArgs.ts b/packages/shared/src/cliArgs.ts
index e6e348797a907..253b7191ed83d 100644
--- a/packages/shared/src/cliArgs.ts
+++ b/packages/shared/src/cliArgs.ts
@@ -77,9 +77,13 @@ export function parseCliArgs(
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]!;
 
+    if (token === "--") {
+      positionals.push(...tokens.slice(i + 1));
+      break;
+    }
+
     if (token.startsWith("--")) {
       const rest = token.slice(2);
-      if (!rest) continue;
 
       const eqIndex = rest.indexOf("=");
       if (eqIndex !== -1) {

From 293669d759c009ce61b47510eceb0703c4c08b0c Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:51:32 +0000
Subject: [PATCH 052/146] fix(server): remove abandoned v1 database copies on
 startup (#25301)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Matěj Suchánek <16311043+immakermatty@users.noreply.github.com>
---
 .../persistence/initializeV2Database.test.ts  | 26 ++++++++++++++++
 .../src/persistence/initializeV2Database.ts   | 30 ++++++++++++++++++-
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/persistence/initializeV2Database.test.ts b/apps/server/src/persistence/initializeV2Database.test.ts
index 561cd72ea9f71..ec8ded1cab5ac 100644
--- a/apps/server/src/persistence/initializeV2Database.test.ts
+++ b/apps/server/src/persistence/initializeV2Database.test.ts
@@ -1,4 +1,5 @@
 // @effect-diagnostics nodeBuiltinImport:off
+import * as NodeChildProcess from "node:child_process";
 import * as NodeFS from "node:fs";
 import * as NodeOS from "node:os";
 import * as NodePath from "node:path";
@@ -182,3 +183,28 @@ it.effect("starts fresh without V1 and never imports over existing V2 state", ()
     Effect.ensuring(Effect.sync(() => NodeFS.rmSync(directory, { recursive: true, force: true }))),
   );
 });
+
+it.effect("removes copies left by a killed start, but not one that is still running", () => {
+  const directory = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-v2-abandoned-"));
+  const killed = NodeChildProcess.spawnSync(process.execPath, ["-e", ""]).pid;
+  const running = `.v2-import-${process.pid}-Kq81Zx`;
+  const unrelated = ".v2-import-not-a-copy";
+  return Effect.gen(function* () {
+    for (const name of [`.v2-import-${killed}-Wm3nPa`, ".v2-import-Q3xZ9a", running]) {
+      NodeFS.mkdirSync(NodePath.join(directory, name));
+      NodeFS.writeFileSync(NodePath.join(directory, name, "snapshot.sqlite"), "partial copy");
+    }
+    NodeFS.mkdirSync(NodePath.join(directory, unrelated));
+    const destinationPath = NodePath.join(directory, "statev2.sqlite");
+    NodeFS.writeFileSync(destinationPath, "existing V2 database");
+    yield* initializeV2Database(destinationPath);
+    assert.deepEqual(
+      NodeFS.readdirSync(directory).sort(),
+      [running, unrelated, "statev2.sqlite"].sort(),
+    );
+    assert.equal(NodeFS.readFileSync(destinationPath, "utf8"), "existing V2 database");
+  }).pipe(
+    Effect.provide(NodeServices.layer),
+    Effect.ensuring(Effect.sync(() => NodeFS.rmSync(directory, { recursive: true, force: true }))),
+  );
+});
diff --git a/apps/server/src/persistence/initializeV2Database.ts b/apps/server/src/persistence/initializeV2Database.ts
index 755907b5076f9..4f6d8d969c3ec 100644
--- a/apps/server/src/persistence/initializeV2Database.ts
+++ b/apps/server/src/persistence/initializeV2Database.ts
@@ -14,6 +14,33 @@ export class V2DatabaseImportError extends Schema.TaggedError<V2DatabaseImportEr
   }
 }
 
+const isProcessAlive = (pid: number): boolean => {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "EPERM";
+  }
+};
+
+// Legacy names have no PID; newer copies stay while their process is alive.
+const removeAbandonedCopies = Effect.fn("removeAbandonedCopies")(function* (directory: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const entries = yield* fs.readDirectory(directory).pipe(
+    Effect.catchIf(
+      (error) => error.reason._tag === "NotFound",
+      () => Effect.succeed([]),
+    ),
+  );
+  for (const entry of entries) {
+    const copy = /^\.v2-import-(?:(\d+)-)?[A-Za-z0-9]{6}$/.exec(entry);
+    if (copy === null || (copy[1] !== undefined && isProcessAlive(Number(copy[1])))) continue;
+    yield* fs.remove(path.join(directory, entry), { recursive: true });
+  }
+});
+
 /** Its copied legacy tables remain the source for lazy transcript import. */
 export const initializeV2Database = Effect.fn("initializeV2Database")(function* (
   destinationPath: string,
@@ -22,12 +49,13 @@ export const initializeV2Database = Effect.fn("initializeV2Database")(function*
   const path = yield* Path.Path;
   const directory = path.dirname(destinationPath);
   const sourcePath = path.join(directory, "state.sqlite");
+  yield* removeAbandonedCopies(directory).pipe(Effect.ignore({ log: true }));
   yield* Effect.gen(function* () {
     if (yield* fs.exists(destinationPath)) return;
     if (!(yield* fs.exists(sourcePath))) return;
     const temporaryDirectory = yield* fs.makeTempDirectoryScoped({
       directory,
-      prefix: ".v2-import-",
+      prefix: `.v2-import-${process.pid}-`,
     });
     const snapshotPath = path.join(temporaryDirectory, "snapshot.sqlite");
     yield* Effect.tryPromise(async () => {

From 6ca95bd92a066108a04f854b858908e942e5b322 Mon Sep 17 00:00:00 2001
From: Mantas Kantautas <mantas.kantautas@gmail.com>
Date: Thu, 29 Oct 2026 19:51:54 +0200
Subject: [PATCH 053/146] fix(web): Enter no longer skips an unanswered
 question (#23626)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 ...UserInputPanel.navigation.browser.test.tsx | 55 ++++++++++++++++---
 .../chat/usePendingThreadRequests.ts          |  1 +
 2 files changed, 47 insertions(+), 9 deletions(-)

diff --git a/apps/web/src/components/chat/ComposerPendingUserInputPanel.navigation.browser.test.tsx b/apps/web/src/components/chat/ComposerPendingUserInputPanel.navigation.browser.test.tsx
index 52800d94a8bca..58ad8e8c0900d 100644
--- a/apps/web/src/components/chat/ComposerPendingUserInputPanel.navigation.browser.test.tsx
+++ b/apps/web/src/components/chat/ComposerPendingUserInputPanel.navigation.browser.test.tsx
@@ -9,6 +9,7 @@ import {
 import { makeThreadRequestsResolvedAnnouncer } from "@t3tools/client-runtime/state/thread-requests";
 import { useLayoutEffect, useRef, type ComponentProps } from "react";
 import { expect, it, vi } from "vite-plus/test";
+import { userEvent } from "vite-plus/test/browser";
 
 vi.mock(import("../ChatMarkdown"), async (importOriginal) => ({
   ...(await importOriginal()),
@@ -73,20 +74,16 @@ function questionProjection(threadId: ThreadId, requestIds = ["first", "second"]
   } satisfies OrchestrationV2ThreadProjection;
 }
 
-let requests: ReturnType<typeof usePendingThreadRequests>;
-
-function PendingRequestsProbe({
-  environmentId,
-  projection,
-  loading = false,
-}: {
+interface ProbeProps {
   environmentId: EnvironmentId;
   projection: OrchestrationV2ThreadProjection;
   loading?: boolean;
-}) {
+}
+
+function useProbeRequests({ environmentId, projection, loading = false }: ProbeProps) {
   const promptRef = useRef("");
   const composerRef = useRef(null);
-  const state = usePendingThreadRequests({
+  return usePendingThreadRequests({
     environmentId,
     activeThreadId: projection.thread.id,
     serverProjection: loading ? null : projection,
@@ -97,6 +94,12 @@ function PendingRequestsProbe({
     composerRef,
     setThreadError: () => {},
   });
+}
+
+let requests: ReturnType<typeof usePendingThreadRequests>;
+
+function PendingRequestsProbe(props: ProbeProps) {
+  const state = useProbeRequests(props);
   useLayoutEffect(() => {
     requests = state;
   });
@@ -138,6 +141,40 @@ it("retains answers, selections and question position after leaving chat, includ
   expect(requests).toMatchObject(expected);
 });
 
+function QuestionPositionProbe(props: ProbeProps) {
+  const state = useProbeRequests(props);
+  return (
+    <>
+      <output>Question {state.activePendingQuestionIndex + 1}</output>
+      <button
+        type="button"
+        onClick={() => state.onSelectActivePendingUserInputOption("question-0", "Incremental")}
+      >
+        Choose Incremental
+      </button>
+      <button type="button" onClick={() => state.onAdvanceActivePendingUserInput()}>
+        Submit
+      </button>
+    </>
+  );
+}
+
+it("stays on an unanswered question when the composer submits", async () => {
+  await using screen = await render(
+    <QuestionPositionProbe
+      environmentId={EnvironmentId.make("unanswered-environment")}
+      projection={questionProjection(threadRef.threadId)}
+    />,
+  );
+  const submit = screen.getByRole("button", { name: "Submit" });
+  await userEvent.click(submit);
+  await expect.element(screen.getByRole("status")).toHaveTextContent("Question 1");
+
+  await userEvent.click(screen.getByRole("button", { name: "Choose Incremental" }));
+  await userEvent.click(submit);
+  await expect.element(screen.getByRole("status")).toHaveTextContent("Question 2");
+});
+
 it("isolates drafts by environment, thread and request and discards only resolved requests", async () => {
   using _timers = fakeTimers();
   const environmentId = EnvironmentId.make("scope-environment");
diff --git a/apps/web/src/components/chat/usePendingThreadRequests.ts b/apps/web/src/components/chat/usePendingThreadRequests.ts
index 91c5bd0d6c912..8a07b86b5eece 100644
--- a/apps/web/src/components/chat/usePendingThreadRequests.ts
+++ b/apps/web/src/components/chat/usePendingThreadRequests.ts
@@ -473,6 +473,7 @@ export function usePendingThreadRequests(input: {
       }
       return;
     }
+    if (!activePendingProgress.canAdvance) return;
     setActivePendingUserInputQuestionIndex(activePendingProgress.questionIndex + 1);
   };
   const onAdvanceActivePendingUserInputStable = useStableCallback(onAdvanceActivePendingUserInput);

From d15233544ecfa8c746e5a3d0b7e7c3a08532fc74 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:52:16 -0500
Subject: [PATCH 054/146] fix(web): keep wide characters in terminal links
 (#24013)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/web/src/terminal/ghostty/core.ts         |  3 +-
 apps/web/src/terminal/ghostty/surface.test.ts | 36 +++++++++++++++++++
 apps/web/src/terminal/ghostty/surface.ts      | 23 +++++++++---
 3 files changed, 57 insertions(+), 5 deletions(-)

diff --git a/apps/web/src/terminal/ghostty/core.ts b/apps/web/src/terminal/ghostty/core.ts
index 3bd8a89807e44..60c81478f7436 100644
--- a/apps/web/src/terminal/ghostty/core.ts
+++ b/apps/web/src/terminal/ghostty/core.ts
@@ -1067,7 +1067,8 @@ export class GhosttyTerminalCore {
         }
       }
       let wide = 0;
-      if (text.length === 0 && cells.at(-1)?.text.length) {
+      // A wrap spacer in the final column can follow a spacer tail.
+      if (text.length === 0 && (cells.at(-1)?.text.length || cells.length === cols - 1)) {
         this.assertSuccess(
           "ghostty_render_state_row_cells_get(raw)",
           this.runtime.call(
diff --git a/apps/web/src/terminal/ghostty/surface.test.ts b/apps/web/src/terminal/ghostty/surface.test.ts
index 8816105599b83..5473e3c4ffa1c 100644
--- a/apps/web/src/terminal/ghostty/surface.test.ts
+++ b/apps/web/src/terminal/ghostty/surface.test.ts
@@ -512,6 +512,42 @@ const cell = (text: string): GhosttyCell => ({
 });
 
 describe("terminalLinkAtPositionWithRange", () => {
+  it.each([
+    { text: "https://example.com/日本", cols: 80, end: { x: 23, y: 0 } },
+    { text: "src/日本/main.ts:3:1", cols: 80, end: { x: 19, y: 0 } },
+    { text: "https://example.com/🙂", cols: 80, end: { x: 21, y: 0 } },
+    { text: "https://example.com/日本", cols: 23, end: { x: 1, y: 1 } },
+  ])("keeps every cell of $text clickable at $cols columns", async ({ text, cols, end }) => {
+    const core = await GhosttyTerminalCore.create(
+      cols,
+      3,
+      8,
+      16,
+      {
+        foreground: { r: 255, g: 255, b: 255 },
+        background: { r: 0, g: 0, b: 0 },
+        cursor: { r: 255, g: 255, b: 255 },
+      },
+      () => {},
+    );
+    try {
+      core.write(text + " next");
+      const rows = core.snapshot().rowData;
+      for (let y = 0; y <= end.y; y += 1) {
+        const lastColumn = y === end.y ? end.x : cols - 2;
+        for (let x = 0; x <= lastColumn; x += 1) {
+          expect(terminalLinkAtPositionWithRange(rows, y, x)).toEqual({
+            text,
+            range: { start: { x: 0, y: 0 }, end },
+          });
+        }
+      }
+      expect(terminalLinkAtPositionWithRange(rows, end.y, end.x + 1)).toBeNull();
+    } finally {
+      core.dispose();
+    }
+  });
+
   it("activates a wrapped quoted Windows path from its spaces and position suffix", () => {
     const row = (text: string, isWrapContinuation: boolean): GhosttyRow => ({
       cells: Array.from(text, (character) => cell(character)),
diff --git a/apps/web/src/terminal/ghostty/surface.ts b/apps/web/src/terminal/ghostty/surface.ts
index cb05acdc5e03d..802d39e594075 100644
--- a/apps/web/src/terminal/ghostty/surface.ts
+++ b/apps/web/src/terminal/ghostty/surface.ts
@@ -2,7 +2,9 @@ import { isMacPlatform } from "../../lib/utils";
 import { SELECTION_MULTI_CLICK_INTERVAL_MS } from "../../lib/selectionActions";
 import { collectWrappedTerminalLinkLine, extractTerminalLinks } from "../../terminal-links";
 import {
+  GHOSTTY_CELL_WIDE,
   GhosttyTerminalCore,
+  type GhosttyCell,
   type GhosttyScrollbar,
   type GhosttySnapshot,
   type GhosttyTheme,
@@ -201,15 +203,23 @@ function terminalGridCellAt(options: {
   };
 }
 
+function terminalCellText(cell: GhosttyCell): string {
+  if (cell.wide === GHOSTTY_CELL_WIDE.spacerTail || cell.wide === GHOSTTY_CELL_WIDE.spacerHead) {
+    return "";
+  }
+  return cell.text || " ";
+}
+
 function terminalRowText(row: GhosttySnapshot["rowData"][number], trimRight: boolean): string {
-  const text = row.cells.map((cell) => cell.text || " ").join("");
+  const text = row.cells.map(terminalCellText).join("");
   return trimRight ? text.trimEnd() : text;
 }
 
 function terminalColumnOffset(row: GhosttySnapshot["rowData"][number], column: number): number {
   let offset = 0;
   for (let cellIndex = 0; cellIndex < column; cellIndex += 1) {
-    offset += row.cells[cellIndex]?.text.length || 1;
+    const cell = row.cells[cellIndex];
+    offset += cell ? terminalCellText(cell).length : 1;
   }
   return offset;
 }
@@ -265,7 +275,8 @@ export function terminalLinkAtPositionWithRange(
   const lastSegment = wrappedLine.segments.at(-1);
   const lastRow = lastSegment ? rows[lastSegment.bufferLineNumber - 1] : undefined;
   const continuesBelowViewport = lastRow !== undefined && lastRow.wrapsToNext;
-  const offset = segment.startIndex + terminalColumnOffset(row, column);
+  const hitColumn = row.cells[column]?.wide === GHOSTTY_CELL_WIDE.spacerTail ? column - 1 : column;
+  const offset = segment.startIndex + terminalColumnOffset(row, hitColumn);
   for (const match of extractTerminalLinks(wrappedLine.text)) {
     if (offset >= match.start && offset < match.end) {
       if (match.end === wrappedLine.text.length && continuesBelowViewport) return null;
@@ -278,6 +289,7 @@ export function terminalLinkAtPositionWithRange(
       const startRow = startSegment ? rows[startSegment.bufferLineNumber - 1] : undefined;
       const endRow = endSegment ? rows[endSegment.bufferLineNumber - 1] : undefined;
       if (!startSegment || !endSegment || !startRow || !endRow) return null;
+      const endColumn = terminalColumnAtOffset(endRow, match.end - 1 - endSegment.startIndex);
       return {
         text: match.text,
         range: {
@@ -286,7 +298,10 @@ export function terminalLinkAtPositionWithRange(
             y: startSegment.bufferLineNumber - 1,
           },
           end: {
-            x: terminalColumnAtOffset(endRow, match.end - 1 - endSegment.startIndex),
+            x:
+              endRow.cells[endColumn + 1]?.wide === GHOSTTY_CELL_WIDE.spacerTail
+                ? endColumn + 1
+                : endColumn,
             y: endSegment.bufferLineNumber - 1,
           },
         },

From a49a3f771b4566d79e93a85afc3480a60c33bfed Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 10:52:24 -0700
Subject: [PATCH 055/146] fix(server): session stops no longer trigger storage
 sweeps unless a deleted worktree waits (#26038)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/storageCleanup.test.ts | 367 ++++++++++++++++++++++++-
 apps/server/src/storageCleanup.ts      |  77 ++++--
 2 files changed, 412 insertions(+), 32 deletions(-)

diff --git a/apps/server/src/storageCleanup.test.ts b/apps/server/src/storageCleanup.test.ts
index 9cbf0f092f7bd..5f945abd1858c 100644
--- a/apps/server/src/storageCleanup.test.ts
+++ b/apps/server/src/storageCleanup.test.ts
@@ -16,6 +16,8 @@ import {
   DEFAULT_SERVER_SETTINGS,
   type WorktreeKeepWhen,
   type StorageCleanupSettings,
+  type TerminalMetadataStreamEvent,
+  type TerminalSummary,
 } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as ServerConfig from "./config.ts";
@@ -32,8 +34,11 @@ import { CodexProviderCapabilitiesV2 } from "./orchestration-v2/Adapters/CodexAd
 import { ServerActivation } from "./serverActivation.ts";
 import { describe, expect, it } from "@effect/vitest";
 import {
+  EventId,
   ProjectId,
+  ProviderDriverKind,
   ProviderInstanceId,
+  ProviderSessionId,
   RunId,
   RuntimeRequestId,
   ThreadId,
@@ -268,8 +273,11 @@ const cleanupFixture = (
     let editBeforeRemoval = false;
     let openSessionCwd: string | null = null;
     let sessionLive = true;
+    let onLiveCheck: Effect.Effect<void> = Effect.void;
+    let outboxStatus: string | null = null;
     let fullStatusCalls = 0;
     let snapshotReads = 0;
+    let terminalListener: ((event: TerminalMetadataStreamEvent) => Effect.Effect<void>) | undefined;
     let events: Stream.Stream<OrchestrationV2DomainEvent> = Stream.empty;
     const activated = yield* Deferred.make<void>();
     const context = yield* Layer.build(StorageCleanup.layer).pipe(
@@ -335,7 +343,8 @@ const cleanupFixture = (
           Effect.sync(() => threads.find((thread) => thread.id === threadId) ?? null),
       } as unknown as ProjectionStore.ProjectionStoreV2["Service"]),
       Effect.provideService(ProviderSessionManager.ProviderSessionManagerV2, {
-        isLive: () => Effect.sync(() => sessionLive),
+        isLive: () =>
+          Effect.sync(() => sessionLive).pipe(Effect.tap(() => Effect.suspend(() => onLiveCheck))),
       } as unknown as ProviderSessionManager.ProviderSessionManagerV2["Service"]),
       Effect.provideService(Orchestrator.OrchestratorV2, {
         streamDomainEvents: Stream.suspend(() => events),
@@ -359,29 +368,39 @@ const cleanupFixture = (
                   }),
                 },
               ]
-            : strings.join("").includes("deleted_at IS NOT NULL")
-              ? deletedThreads.map((thread) => ({
-                  payload_json: JSON.stringify(thread),
-                  workspaceRoot: repo,
-                }))
-              : strings.join("").includes('AS "worktreePath"')
-                ? [
-                    ...threads.flatMap((thread) => thread.worktreePath ?? []),
-                    ...storedWorktreePaths,
-                  ].map((worktreePath) => ({ worktreePath }))
-                : [],
+            : outboxStatus !== null && strings.join("").includes("orchestration_v2_effect_outbox")
+              ? [{ status: outboxStatus }]
+              : strings.join("").includes("deleted_at IS NOT NULL")
+                ? deletedThreads.map((thread) => ({
+                    payload_json: JSON.stringify(thread),
+                    workspaceRoot: repo,
+                  }))
+                : strings.join("").includes('AS "worktreePath"')
+                  ? [
+                      ...threads.flatMap((thread) => thread.worktreePath ?? []),
+                      ...storedWorktreePaths,
+                    ].map((worktreePath) => ({ worktreePath }))
+                  : [],
         )) as unknown as SqlClient.SqlClient),
       Effect.provideService(GitManager.GitManager, {
         invalidateStatus: () => Effect.void,
       } as unknown as GitManager.GitManager["Service"]),
       Effect.provideService(TerminalManager.TerminalManager, {
-        subscribeMetadata: () => Effect.succeed(() => {}),
+        subscribeMetadata: (
+          listener: (event: TerminalMetadataStreamEvent) => Effect.Effect<void>,
+        ) =>
+          Effect.sync(() => {
+            terminalListener = listener;
+            return () => {};
+          }),
       } as unknown as TerminalManager.TerminalManager["Service"]),
       Effect.provideService(ServerActivation, Deferred.await(activated)),
     );
     return {
       service: Context.get(context, StorageCleanup.StorageCleanup),
       repo,
+      setTerminals: (terminals: TerminalSummary[]) =>
+        terminalListener?.({ type: "snapshot", terminals }) ?? Effect.void,
       editBeforeRemoval: () => {
         editBeforeRemoval = true;
       },
@@ -421,6 +440,12 @@ const cleanupFixture = (
       setThreads: (next: typeof threads) => {
         threads = next;
       },
+      setOnLiveCheck: (hook: Effect.Effect<void>) => {
+        onLiveCheck = hook;
+      },
+      setOutboxStatus: (status: string | null) => {
+        outboxStatus = status;
+      },
       setDeletedThreads: (next: OrchestrationV2ThreadShell[]) => {
         deletedThreads = next;
       },
@@ -925,6 +950,322 @@ describe("deleted thread worktrees", () => {
     }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
   );
 
+  // Releases one stopped-session event after the startup sweep and returns the snapshot reads it caused.
+  const stopSessionAfterStartupSweep = (
+    fixture: Effect.Success<ReturnType<typeof cleanupFixture>>,
+    threadId: ThreadId,
+    beforeStop: Effect.Effect<void> = Effect.void,
+    cwd = fixture.worktree,
+  ) =>
+    Effect.gen(function* () {
+      const startupSwept = yield* Deferred.make<void>();
+      const delivered = yield* Deferred.make<void>();
+      const stopped: OrchestrationV2DomainEvent = {
+        id: EventId.make("event:session-stopped"),
+        type: "provider-session.updated",
+        threadId,
+        occurredAt: at(0),
+        payload: {
+          id: ProviderSessionId.make("session-1"),
+          driver: ProviderDriverKind.make("codex"),
+          providerInstanceId: ProviderInstanceId.make("codex"),
+          status: "stopped",
+          cwd,
+          model: null,
+          capabilities: CodexProviderCapabilitiesV2,
+          createdAt: at(-DAY_MS),
+          updatedAt: at(0),
+          lastError: null,
+        },
+      };
+      yield* fixture.activate(
+        Stream.fromEffect(Deferred.await(startupSwept)).pipe(
+          Stream.flatMap(() => Stream.make(stopped)),
+          Stream.concat(
+            Stream.fromEffect(Deferred.succeed(delivered, undefined)).pipe(Stream.drain),
+          ),
+        ),
+      );
+      yield* fixture.service.reports.pipe(
+        Stream.filter((report) => report !== null),
+        Stream.take(1),
+        Stream.runDrain,
+      );
+      yield* fixture.service.drain;
+      yield* beforeStop;
+      const readsBefore = fixture.snapshotReads();
+      yield* Deferred.succeed(startupSwept, undefined);
+      yield* Deferred.await(delivered);
+      yield* fixture.service.drain;
+      return fixture.snapshotReads() - readsBefore;
+    });
+
+  it.effect("does not sweep when a live thread's session stops and no deleted worktree waits", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(NOW_MS);
+      const fixture = yield* cleanupFixture();
+      const reads = yield* stopSessionAfterStartupSweep(fixture, ThreadId.make("thread-1"));
+      expect(reads, "a live thread's stopped session re-read every thread").toBe(0);
+    }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect("removes a deleted thread's worktree once its session stops", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(NOW_MS);
+      const fixture = yield* cleanupFixture({
+        ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+        worktreeAfterDays: null,
+        worktreeOnDelete: true,
+      });
+      const owner = parent(fixture.worktree);
+      fixture.setDeletedThreads([owner]);
+      fixture.setThreads([]);
+      fixture.setOpenSessionCwd(fixture.worktree);
+      const reads = yield* stopSessionAfterStartupSweep(
+        fixture,
+        owner.id,
+        Effect.sync(() => fixture.setSessionLive(false)),
+      );
+      expect(reads).toBeGreaterThan(0);
+      expect(yield* fixture.fs.exists(fixture.worktree)).toBe(false);
+    }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect("removes a deleted thread's worktree once a live thread's session in it stops", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(NOW_MS);
+      const fixture = yield* cleanupFixture({
+        ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+        worktreeAfterDays: null,
+        worktreeOnDelete: true,
+      });
+      const owner = parent(fixture.worktree);
+      const child = subagent(owner);
+      fixture.setDeletedThreads([owner]);
+      fixture.setThreads([child]);
+      fixture.setOpenSessionCwd(fixture.worktree);
+      const reads = yield* stopSessionAfterStartupSweep(
+        fixture,
+        child.id,
+        Effect.gen(function* () {
+          expect((yield* fixture.service.latestReport)?.entries[0]).toMatchObject({
+            threadId: owner.id,
+            outcome: "kept",
+            reason: "Provider session is still open",
+          });
+          fixture.setSessionLive(false);
+        }),
+      );
+      expect(reads).toBeGreaterThan(0);
+      expect(yield* fixture.fs.exists(fixture.worktree)).toBe(false);
+    }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect(
+    "removes a deleted thread's worktree once its terminal closes and its session stops",
+    () =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(NOW_MS);
+        const fixture = yield* cleanupFixture({
+          ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+          worktreeAfterDays: null,
+          worktreeOnDelete: true,
+        });
+        const owner = parent(fixture.worktree);
+        fixture.setDeletedThreads([owner]);
+        fixture.setThreads([]);
+        yield* fixture.setTerminals([
+          {
+            threadId: owner.id,
+            terminalId: "terminal-1",
+            cwd: fixture.worktree,
+            worktreePath: fixture.worktree,
+            status: "running",
+            pid: 1,
+            exitCode: null,
+            exitSignal: null,
+            hasRunningSubprocess: false,
+            label: "Terminal",
+            updatedAt: DateTime.formatIso(at(0)),
+          },
+        ]);
+        const reads = yield* stopSessionAfterStartupSweep(
+          fixture,
+          owner.id,
+          Effect.gen(function* () {
+            expect((yield* fixture.service.latestReport)?.entries[0]).toMatchObject({
+              threadId: owner.id,
+              outcome: "kept",
+              reason: "Open terminal",
+            });
+            yield* fixture.setTerminals([]);
+          }),
+          fixture.repo,
+        );
+        expect(reads).toBeGreaterThan(0);
+        expect(yield* fixture.fs.exists(fixture.worktree)).toBe(false);
+      }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect(
+    "retries a deleted thread's worktree kept for another reason when a session in it stops",
+    () =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(NOW_MS);
+        const fixture = yield* cleanupFixture({
+          ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+          worktreeAfterDays: null,
+          worktreeOnDelete: true,
+        });
+        const owner = parent(fixture.worktree);
+        fixture.setDeletedThreads([owner]);
+        fixture.setThreads([]);
+        yield* fixture.fs.writeFileString(`${fixture.worktree}/tracked.txt`, "agent edit\n");
+        const reads = yield* stopSessionAfterStartupSweep(
+          fixture,
+          owner.id,
+          Effect.gen(function* () {
+            expect((yield* fixture.service.latestReport)?.entries[0]).toMatchObject({
+              threadId: owner.id,
+              outcome: "kept",
+              reason: "Has uncommitted changes (1 file)",
+            });
+            yield* fixture.fs
+              .writeFileString(`${fixture.worktree}/tracked.txt`, "original\n")
+              .pipe(Effect.orDie);
+          }),
+        );
+        expect(reads).toBeGreaterThan(0);
+        expect(yield* fixture.fs.exists(fixture.worktree)).toBe(false);
+      }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect("does not sweep for a kept deleted worktree when a session elsewhere stops", () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(NOW_MS);
+      const fixture = yield* cleanupFixture({
+        ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+        worktreeAfterDays: null,
+        worktreeOnDelete: true,
+      });
+      fixture.setDeletedThreads([parent(fixture.worktree)]);
+      fixture.setThreads([]);
+      yield* fixture.fs.writeFileString(`${fixture.worktree}/tracked.txt`, "agent edit\n");
+      const reads = yield* stopSessionAfterStartupSweep(
+        fixture,
+        ThreadId.make("thread-elsewhere"),
+        Effect.void,
+        fixture.repo,
+      );
+      expect(reads).toBe(0);
+      expect(yield* fixture.fs.exists(fixture.worktree)).toBe(true);
+    }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect(
+    "does not sweep for a deleted thread whose cleanup effect failed when a session elsewhere stops",
+    () =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(NOW_MS);
+        const fixture = yield* cleanupFixture({
+          ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+          worktreeAfterDays: null,
+          worktreeOnDelete: true,
+        });
+        const owner = parent(fixture.worktree);
+        fixture.setDeletedThreads([owner]);
+        fixture.setThreads([]);
+        fixture.setOutboxStatus("failed");
+        const reads = yield* stopSessionAfterStartupSweep(
+          fixture,
+          ThreadId.make("thread-elsewhere"),
+          Effect.gen(function* () {
+            expect((yield* fixture.service.latestReport)?.entries[0]).toMatchObject({
+              threadId: owner.id,
+              outcome: "kept",
+              reason: "Thread deletion is still pending",
+            });
+          }),
+          fixture.repo,
+        );
+        expect(reads).toBe(0);
+      }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
+  it.effect(
+    "removes a deleted thread's worktree when its session stops during the deletion's sweep",
+    () =>
+      Effect.gen(function* () {
+        yield* TestClock.setTime(NOW_MS);
+        const fixture = yield* cleanupFixture({
+          ...DEFAULT_SERVER_SETTINGS.storageCleanup,
+          worktreeAfterDays: null,
+          worktreeOnDelete: true,
+        });
+        const owner = parent(fixture.worktree);
+        fixture.setThreads([]);
+        const startupSwept = yield* Deferred.make<void>();
+        const sessionChecked = yield* Deferred.make<void>();
+        const delivered = yield* Deferred.make<void>();
+        const deleted = {
+          id: EventId.make("event:thread-deleted"),
+          type: "thread.deleted",
+          threadId: owner.id,
+          occurredAt: at(0),
+          payload: owner,
+        } as unknown as OrchestrationV2DomainEvent;
+        const stopped: OrchestrationV2DomainEvent = {
+          id: EventId.make("event:session-stopped"),
+          type: "provider-session.updated",
+          threadId: owner.id,
+          occurredAt: at(0),
+          payload: {
+            id: ProviderSessionId.make("session-1"),
+            driver: ProviderDriverKind.make("codex"),
+            providerInstanceId: ProviderInstanceId.make("codex"),
+            status: "stopped",
+            cwd: fixture.worktree,
+            model: null,
+            capabilities: CodexProviderCapabilitiesV2,
+            createdAt: at(-DAY_MS),
+            updatedAt: at(0),
+            lastError: null,
+          },
+        };
+        yield* fixture.activate(
+          Stream.fromEffect(Deferred.await(startupSwept)).pipe(
+            Stream.flatMap(() => Stream.make(deleted)),
+            Stream.concat(Stream.fromEffect(Deferred.await(sessionChecked)).pipe(Stream.drain)),
+            Stream.concat(Stream.make(stopped)),
+            Stream.concat(
+              Stream.fromEffect(Deferred.succeed(delivered, undefined)).pipe(Stream.drain),
+            ),
+          ),
+        );
+        yield* fixture.service.reports.pipe(
+          Stream.filter((report) => report !== null),
+          Stream.take(1),
+          Stream.runDrain,
+        );
+        yield* fixture.service.drain;
+        fixture.setDeletedThreads([owner]);
+        fixture.setOpenSessionCwd(fixture.worktree);
+        // The deletion's sweep sees the session live; it stops before that sweep publishes its result.
+        fixture.setOnLiveCheck(
+          Effect.gen(function* () {
+            fixture.setOnLiveCheck(Effect.void);
+            yield* Deferred.succeed(sessionChecked, undefined);
+            yield* Deferred.await(delivered);
+            fixture.setSessionLive(false);
+          }),
+        );
+        yield* Deferred.succeed(startupSwept, undefined);
+        yield* Deferred.await(delivered);
+        yield* fixture.service.drain;
+        expect(yield* fixture.fs.exists(fixture.worktree)).toBe(false);
+      }).pipe(Effect.provide(cleanupTestLayer), Effect.scoped),
+  );
+
   it.effect("waits out the settle grace of a subagent that just settled", () =>
     Effect.gen(function* () {
       yield* TestClock.setTime(NOW_MS);
diff --git a/apps/server/src/storageCleanup.ts b/apps/server/src/storageCleanup.ts
index 9bf040b0cd17c..48154835e7bb4 100644
--- a/apps/server/src/storageCleanup.ts
+++ b/apps/server/src/storageCleanup.ts
@@ -705,7 +705,10 @@ const make = Effect.gen(function* () {
     now: number,
     entries: StorageCleanupReportEntry[],
   ) {
-    if (!anyWorktreePolicy(serverSettings, worktreeCleanupEnabled)) return;
+    if (!anyWorktreePolicy(serverSettings, worktreeCleanupEnabled))
+      return { waiting: false, kept: [] };
+    let waiting = false;
+    const kept: string[] = [];
     const roots: Array<string> = [];
     for (const directory of managedWorktreesDirectories(
       serverSettings,
@@ -779,7 +782,15 @@ const make = Effect.gen(function* () {
         bytes: null,
         files: null,
       };
-      const keep = (reason: string) => entries.push({ ...entry, reason: sentence(reason) });
+      const keep = (reason: string) => {
+        if (deleted && settings.worktreeOnDelete) kept.push(worktreePath);
+        entries.push({ ...entry, reason: sentence(reason) });
+      };
+      // Reasons a provider session stop or finished deletion work can clear.
+      const waitForStop = (reason: string) => {
+        if (deleted && settings.worktreeOnDelete) waiting = true;
+        return reason;
+      };
       yield* Effect.gen(function* () {
         if (!(yield* fs.exists(worktreePath))) return;
         if (deleted && !settings.worktreeOnDelete) return keep("no rules apply");
@@ -790,10 +801,10 @@ const make = Effect.gen(function* () {
           thread.branch === null ||
           !group.every((member) => storageCleanupThreadIdle(member, now))
         )
-          return keep("thread is running or has pending work");
+          return keep(waitForStop("thread is running or has pending work"));
         if (group.some((member) => member.branch !== thread.branch))
           return keep("a subagent thread's branch differs from this worktree's branch");
-        if (hasTerminal(worktreePath)) return keep("open terminal");
+        if (hasTerminal(worktreePath)) return keep(waitForStop("open terminal"));
         // Compare canonical roots while allowing symlinked parents, never symlinked worktree directories.
         const realPath = yield* fs.realPath(worktreePath);
         const realParent = yield* fs.realPath(path.dirname(worktreePath));
@@ -817,7 +828,7 @@ const make = Effect.gen(function* () {
                 SETTLE_SCRIPT_GRACE_MS,
           )
         )
-          return keep("settled moments ago");
+          return keep(waitForStop("settled moments ago"));
         const head = yield* git.resolveCommit({ cwd: worktreePath, revision: "HEAD" });
         const old =
           !deleted &&
@@ -924,7 +935,7 @@ const make = Effect.gen(function* () {
           const latest = (yield* projections.getThreadWorktreePaths({
             includeArchived: true,
           })).filter((entry) => path.resolve(entry.worktreePath) === worktreePath);
-          if (hasTerminal(worktreePath)) return "open terminal";
+          if (hasTerminal(worktreePath)) return waitForStop("open terminal");
           if (deleted) {
             if (
               !resolveWorktreeCleanup(yield* settingsService.getSettings, thread.projectId)
@@ -932,10 +943,13 @@ const make = Effect.gen(function* () {
             )
               return "thread or cleanup settings changed since check";
             // Durable deletion cleanup must succeed or be explicitly cancelled before removing its checkout.
-            const pendingCleanup = yield* sql`
-              SELECT 1 FROM orchestration_v2_effect_outbox
-              WHERE thread_id = ${thread.id} AND status NOT IN ('succeeded', 'cancelled') LIMIT 1
+            const pendingCleanup = yield* sql<{ status: string }>`
+              SELECT status FROM orchestration_v2_effect_outbox
+              WHERE thread_id = ${thread.id} AND status NOT IN ('succeeded', 'cancelled')
             `.pipe(NodeSqliteClient.readOnly);
+            // Failed effects never retry, so only running work can finish and free the path.
+            if (pendingCleanup.some((row) => row.status !== "failed"))
+              return waitForStop("thread deletion is still pending");
             if (pendingCleanup.length > 0) return "thread deletion is still pending";
           }
           const latestShells = yield* Effect.forEach(latest, (entry) =>
@@ -960,7 +974,7 @@ const make = Effect.gen(function* () {
               );
             })
           )
-            return "thread activity or shared worktree changed since check";
+            return waitForStop("thread activity or shared worktree changed since check");
           // Sessions can outlive their run and can be shared across app threads.
           const sessionRows = yield* sql<{ payload_json: string }>`
             SELECT payload_json FROM orchestration_v2_projection_provider_sessions
@@ -976,7 +990,7 @@ const make = Effect.gen(function* () {
               (cwd === worktreePath || inside(worktreePath, cwd)) &&
               (yield* providerSessions.isLive(session.id))
             )
-              return "provider session is still open";
+              return waitForStop("provider session is still open");
           }
           return null;
         });
@@ -1036,6 +1050,7 @@ const make = Effect.gen(function* () {
               outcome: "failed",
               reason: cleanupFailureReason(error),
             });
+            if (deleted && settings.worktreeOnDelete) kept.push(worktreePath);
             yield* Effect.logWarning("storage cleanup failed for worktree", {
               threadId: thread.id,
               error,
@@ -1049,6 +1064,7 @@ const make = Effect.gen(function* () {
       yield* projectStore.list({ includeDeleted: true }),
       entries,
     );
+    return { waiting, kept };
   });
 
   const cleanFiles = Effect.fn("StorageCleanup.cleanFiles")(function* (
@@ -1090,14 +1106,21 @@ const make = Effect.gen(function* () {
   });
 
   const reportRef = yield* SubscriptionRef.make<StorageCleanupReport | null>(null);
+  // Only deleted threads' worktrees wait on session stops: any stop while one waits, or a stop inside one kept for another reason.
+  // A deletion stays pending until a sweep that started after it finishes.
+  let deletedWorktreeWaits = true;
+  let keptDeletedWorktrees: ReadonlyArray<string> = [];
+  let deletions = 0;
+  let sweptDeletions = 0;
   const sweep = Effect.fn("StorageCleanup.sweep")(function* (
     trigger: StorageCleanupReport["trigger"],
   ) {
+    const deletionsAtStart = deletions;
     const now = yield* Clock.currentTimeMillis;
     const serverSettings = yield* settingsService.getSettings;
     const settings = serverSettings.storageCleanup;
     const entries: StorageCleanupReportEntry[] = [];
-    yield* cleanWorktrees(serverSettings, now, entries).pipe(
+    const deletedWorktrees = yield* cleanWorktrees(serverSettings, now, entries).pipe(
       Effect.catch((error) =>
         Effect.gen(function* () {
           entries.push({
@@ -1112,9 +1135,13 @@ const make = Effect.gen(function* () {
             files: null,
           });
           yield* Effect.logWarning("worktree cleanup failed", { error });
+          return { waiting: true, kept: [] };
         }),
       ),
     );
+    deletedWorktreeWaits = deletedWorktrees.waiting;
+    keptDeletedWorktrees = deletedWorktrees.kept;
+    sweptDeletions = deletionsAtStart;
     for (const category of [
       {
         kind: "browser-artifacts" as const,
@@ -1255,14 +1282,26 @@ const make = Effect.gen(function* () {
       }),
     );
     yield* forkParked(
-      Stream.runForEach(events, (event) =>
-        (event.type === "thread.deleted" ||
-          (event.type === "provider-session.updated" &&
-            (event.payload.status === "stopped" || event.payload.status === "error"))) &&
-        anyWorktreePolicy(lastSettings, (rules) => rules.worktreeOnDelete)
+      Stream.runForEach(events, (event) => {
+        if (event.type === "thread.deleted") deletions++;
+        else if (
+          event.type !== "provider-session.updated" ||
+          (event.payload.status !== "stopped" && event.payload.status !== "error")
+        )
+          return Effect.void;
+        else if (!deletedWorktreeWaits && deletions === sweptDeletions) {
+          const cwd = pathKey(event.payload.cwd);
+          if (
+            !keptDeletedWorktrees.some(
+              (worktreePath) => pathKey(worktreePath) === cwd || inside(worktreePath, cwd),
+            )
+          )
+            return Effect.void;
+        }
+        return anyWorktreePolicy(lastSettings, (rules) => rules.worktreeOnDelete)
           ? requestSweep
-          : Effect.void,
-      ).pipe(
+          : Effect.void;
+      }).pipe(
         Effect.catchCause((cause) =>
           Effect.logWarning("Storage cleanup event stream failed", { cause }),
         ),

From 443edd553fce0f00de480311583579fcc91c529c Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:52:42 -0500
Subject: [PATCH 056/146] fix(provider-core): subagent threads no longer
 inherit the parent's pin (#21271)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../SubagentProjection.test.ts                | 61 ++++++++++++++++++-
 .../src/server/subagentProjection.ts          |  2 +
 2 files changed, 61 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/SubagentProjection.test.ts b/apps/server/src/orchestration-v2/SubagentProjection.test.ts
index d3506649f6a62..95abcbaf5c1a8 100644
--- a/apps/server/src/orchestration-v2/SubagentProjection.test.ts
+++ b/apps/server/src/orchestration-v2/SubagentProjection.test.ts
@@ -16,6 +16,7 @@ import {
 } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
 
 import {
   makeSubagentChildThread,
@@ -26,7 +27,9 @@ import {
   endRunlessRootTurns,
 } from "@t3tools/provider-core/server/subagentProjection";
 
-import { emptyProjection } from "./ProjectionStore.ts";
+import * as SqlitePersistence from "../persistence/Sqlite.ts";
+import * as ProjectionStore from "./ProjectionStore.ts";
+import { resolveAutoSettlementAt } from "./ThreadSettlementService.ts";
 
 const parentThreadId = ThreadId.make("thread:subagent-snoozed-parent");
 const childThreadId = ThreadId.make("thread:subagent-awake-child");
@@ -117,8 +120,62 @@ it("keeps a subagent child awake when its parent thread is snoozed", () => {
   });
 });
 
+it.effect.each([
+  ["sql", ProjectionStore.layer.pipe(Layer.provideMerge(SqlitePersistence.layerMemory))],
+] as const)(
+  "%s: a pinned parent's subagent child is born unpinned and settles once idle",
+  ([, testLayer]) =>
+    Effect.gen(function* () {
+      const store = yield* ProjectionStore.ProjectionStoreV2;
+      const parentThread = { ...makeParentThread(), pinnedAt: parentCreatedAt, pinOrderKey: "a0" };
+      const childThread = makeSubagentChildThread({
+        parentThread,
+        childThreadId,
+        parentNodeId: NodeId.make("node:subagent-parent"),
+        activeProviderThreadId: null,
+        providerInstanceId: childProviderInstanceId,
+        modelSelection: childModelSelection,
+        title: "Child",
+        now: childCreatedAt,
+        createdBy: "agent",
+        creationSource: "provider",
+      });
+
+      assert.equal(parentThread.pinnedAt, parentCreatedAt);
+      assert.equal(parentThread.pinOrderKey, "a0");
+      assert.isNull(childThread.pinnedAt);
+      assert.isNull(childThread.pinOrderKey);
+
+      for (const thread of [parentThread, childThread]) {
+        yield* store.apply({
+          id: EventId.make(`event:${thread.id}`),
+          type: "thread.created",
+          threadId: thread.id,
+          occurredAt: thread.createdAt,
+          payload: thread,
+        });
+      }
+      const savedParent = yield* store.getThread(parentThreadId);
+      assert.deepEqual(savedParent.pinnedAt, parentCreatedAt);
+      assert.equal(savedParent.pinOrderKey, "a0");
+      const candidates = yield* store.getSettlementCandidates();
+      assert.deepEqual(
+        candidates.map((candidate) => candidate.id),
+        [childThreadId],
+      );
+      const settledAt = resolveAutoSettlementAt({
+        thread: candidates[0]!,
+        pullRequest: null,
+        nowMs: DateTime.toEpochMillis(DateTime.add(childCreatedAt, { days: 4 })),
+        autoSettleAfterDays: 3,
+        autoSettleOnMerge: false,
+      });
+      assert.equal(settledAt && DateTime.formatIso(settledAt), DateTime.formatIso(childCreatedAt));
+    }).pipe(Effect.provide(testLayer)),
+);
+
 function taskFixture() {
-  const projection = emptyProjection({
+  const projection = ProjectionStore.emptyProjection({
     type: "thread.created",
     id: EventId.make("task-fixture"),
     threadId: parentThreadId,
diff --git a/packages/provider-core/src/server/subagentProjection.ts b/packages/provider-core/src/server/subagentProjection.ts
index f83a0b376233b..be8c4bf98aa54 100644
--- a/packages/provider-core/src/server/subagentProjection.ts
+++ b/packages/provider-core/src/server/subagentProjection.ts
@@ -82,6 +82,8 @@ export function makeSubagentChildThread(input: {
     settledAt: null,
     snoozedUntil: null,
     snoozedAt: null,
+    pinnedAt: null,
+    pinOrderKey: null,
     // A guest link belongs to the thread it was made for.
     guestShare: null,
     lastVisitedAt: null,

From 1b3e330c98f8f063911b730b1befb77c13c7d791 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:53:05 -0500
Subject: [PATCH 057/146] fix(device): report failed Android permission changes
 (#22358)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/device/DeviceActions.test.ts | 54 ++++++++++++++++++++
 apps/server/src/device/DeviceActions.ts      | 11 ++--
 2 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/device/DeviceActions.test.ts b/apps/server/src/device/DeviceActions.test.ts
index 1a8cab7f29837..90f46a4b66d33 100644
--- a/apps/server/src/device/DeviceActions.test.ts
+++ b/apps/server/src/device/DeviceActions.test.ts
@@ -98,6 +98,60 @@ describe("runDeviceAction", () => {
         expect(calls.at(-1)?.args.at(-1)).toBe(expected);
       }),
   );
+
+  it.effect.each([
+    ["camera", "grant", "android.permission.CAMERA"],
+    ["photos", "revoke", "android.permission.READ_MEDIA_IMAGES"],
+  ] as const)(
+    "reports an Android %s %s that no pm command applied",
+    ([permission, decision, firstPermission]) =>
+      Effect.gen(function* () {
+        const { ready } = makeReady((call) => ({
+          code: 1,
+          stderr: `Unknown package: ${call.args.at(-1)}`,
+        }));
+        const error = yield* Effect.flip(
+          runDeviceAction(ready, "android", {
+            type: "setPermission",
+            deviceId: "emulator-5554",
+            appId: "com.example.missing",
+            permission,
+            decision,
+          }),
+        );
+        expect(error._tag).toBe("DeviceOperationError");
+        expect(error.operation).toBe("permission");
+        expect(error._tag === "DeviceOperationError" && error.cause).toMatchObject({
+          stderr: `Unknown package: ${firstPermission}`,
+        });
+      }),
+  );
+
+  it.effect.each([
+    [
+      "photos",
+      ["android.permission.READ_MEDIA_IMAGES", "android.permission.READ_EXTERNAL_STORAGE"],
+      1,
+    ],
+    ["contacts", ["android.permission.READ_CONTACTS", "android.permission.WRITE_CONTACTS"], 0],
+  ] as const)(
+    "keeps a partially applied %s permission change",
+    ([permission, permissions, success]) =>
+      Effect.gen(function* () {
+        const { ready, calls } = makeReady((call) => ({
+          code: call.args.at(-1) === permissions[success] ? 0 : 1,
+        }));
+        const result = yield* runDeviceAction(ready, "android", {
+          type: "setPermission",
+          deviceId: "emulator-5554",
+          appId: "com.example.app",
+          permission,
+          decision: "grant",
+        });
+        expect(result).toBeUndefined();
+        expect(calls.map((call) => call.args.at(-1))).toEqual(permissions);
+      }),
+  );
 });
 
 describe("readDeviceDetail", () => {
diff --git a/apps/server/src/device/DeviceActions.ts b/apps/server/src/device/DeviceActions.ts
index 905a23d5cc726..6b734b6b9b484 100644
--- a/apps/server/src/device/DeviceActions.ts
+++ b/apps/server/src/device/DeviceActions.ts
@@ -11,6 +11,7 @@ import {
   type DeviceTextSize,
 } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
 
 import type { DeviceHostReady } from "./DeviceHost.ts";
@@ -432,9 +433,13 @@ const runAndroid = Effect.fn("DeviceActions.runAndroid")(function* (
         });
       }
       const verb = input.decision === "grant" ? "grant" : "revoke";
-      for (const permission of permissions) {
-        yield* shell(["pm", verb, input.appId, permission], "permission").pipe(Effect.ignore);
-      }
+      // `pm` rejects a permission the app or system image does not declare, and Photos lists both
+      // the Android 13 and the older storage permission, so fail only when none of them applied.
+      const results = yield* Effect.forEach(permissions, (permission) =>
+        shell(["pm", verb, input.appId, permission], "permission").pipe(Effect.result),
+      );
+      const failure = results.find(Result.isFailure);
+      if (failure && !results.some(Result.isSuccess)) return yield* failure.failure;
       return;
     }
     case "openUrl":

From 0d51375ef765636549410286e42b391a9e2b7ca2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 10:53:18 -0700
Subject: [PATCH 058/146] fix(server): thread lists load beyond SQLite variable
 limit (#25696)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/ProjectionStore.test.ts  | 64 +++++++++++++++++++
 .../src/orchestration-v2/ProjectionStore.ts   | 14 ++--
 2 files changed, 71 insertions(+), 7 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index 2af87ecf4feb7..17b8bb818864a 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -1374,6 +1374,70 @@ it.effect("lists only active subagent IDs without loading shell data", () =>
   }).pipe(Effect.provide(layerTest)),
 );
 
+// regression: #25621 SQLite rejects statements binding more than 32,766 variables
+it.effect("lists every thread in the shell snapshot past SQLite's bound variable limit", () =>
+  Effect.gen(function* () {
+    const store = yield* ProjectionStore.ProjectionStoreV2;
+    const sql = yield* SqlClient.SqlClient;
+    const now = yield* DateTime.now;
+    const templateId = ThreadId.make("thread:many:00000");
+    yield* store.apply({
+      id: EventId.make(`event:${templateId}:created`),
+      type: "thread.created",
+      threadId: templateId,
+      occurredAt: now,
+      payload: {
+        createdBy: "user",
+        creationSource: "web",
+        id: templateId,
+        projectId: ProjectId.make("project:many"),
+        title: "Many",
+        providerInstanceId,
+        modelSelection,
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        branch: null,
+        worktreePath: null,
+        activeProviderThreadId: null,
+        lineage: { parentThreadId: null, relationshipToParent: null, rootThreadId: templateId },
+        forkedFrom: null,
+        createdAt: now,
+        updatedAt: now,
+        archivedAt: null,
+        settledOverride: null,
+        settledAt: null,
+        lastVisitedAt: null,
+        deletedAt: null,
+      },
+    });
+    const threadCount = 32_767;
+    yield* sql`
+      CREATE TEMP TABLE many_threads AS
+      WITH RECURSIVE n(i) AS (SELECT 1 UNION ALL SELECT i + 1 FROM n WHERE i < ${threadCount - 1})
+      SELECT t.*, n.i AS clone_index FROM orchestration_v2_projection_threads t, n
+      WHERE t.thread_id = ${templateId}
+    `;
+    yield* sql`
+      UPDATE many_threads SET
+        thread_id = printf('thread:many:%05d', clone_index),
+        payload_json = json_set(
+          payload_json,
+          '$.id', printf('thread:many:%05d', clone_index),
+          '$.lineage.rootThreadId', printf('thread:many:%05d', clone_index)
+        )
+    `;
+    yield* sql`ALTER TABLE many_threads DROP COLUMN clone_index`;
+    yield* sql`INSERT INTO orchestration_v2_projection_threads SELECT * FROM many_threads`;
+
+    const [unscoped, active] = yield* Effect.all([
+      store.getShellSnapshot(),
+      store.getShellSnapshot({ location: "active" }),
+    ]);
+    assert.strictEqual(unscoped.threads.length, threadCount);
+    assert.strictEqual(active.threads.length, threadCount);
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.layer(layerTest)("ProjectionStoreV2", (it) => {
   // regression: #21969 keep corrupt plan JSON in the typed read error
   it.effect("returns a typed read error for malformed stored plan JSON", () =>
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 2a21bfae4bd32..287a30a9d904e 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -5940,7 +5940,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
               worktreePath === undefined
                 ? sql``
                 : sql` AND json_extract(t.payload_json, '$.worktreePath') = ${worktreePath}`
-            }${threadIds === undefined ? sql`` : sql` AND t.thread_id IN ${sql.in(threadIds)}`}
+            }${threadIds === undefined ? sql`` : sql` AND t.thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))`}
             ORDER BY t.updated_at ASC, t.thread_id ASC
           `;
 
@@ -5953,14 +5953,14 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         : sql<ShellRunRow>`
             SELECT thread_id, run_id, ordinal
             FROM orchestration_v2_projection_runs
-            WHERE thread_id IN ${sql.in(threadIds)}
+            WHERE thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))
           `;
 
     const selectShellRunItemCounts = (threadIds: ReadonlyArray<ThreadId>) =>
       sql<ShellRunItemCountRow>`
         SELECT thread_id, run_id, COUNT(*) AS item_count
         FROM orchestration_v2_projection_turn_items
-        WHERE run_id IS NOT NULL AND thread_id IN ${sql.in(threadIds)}
+        WHERE run_id IS NOT NULL AND thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))
         GROUP BY thread_id, run_id
       `;
 
@@ -5975,7 +5975,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         FROM (
           SELECT thread_id, run_id, COUNT(*) AS item_count
           FROM orchestration_v2_projection_turn_items
-          WHERE thread_id IN ${sql.in(threadIds)}
+          WHERE thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))
           GROUP BY thread_id, run_id
         ) counts
         LEFT JOIN orchestration_v2_projection_runs r ON r.run_id = counts.run_id
@@ -5992,7 +5992,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         : sql<PayloadRow & { readonly thread_id: string }>`
             SELECT thread_id, payload_json
             FROM orchestration_v2_projection_provider_threads
-            WHERE thread_id IN ${sql.in(threadIds)}
+            WHERE thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))
           `;
 
     const selectShellPendingTurnItemRows = (
@@ -6008,7 +6008,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       WHERE i.type IN ('command_execution', 'dynamic_tool', 'subagent')
         AND i.status NOT IN ('completed', 'interrupted', 'failed', 'cancelled')
         AND (i.run_id IS NULL OR r.status <> 'rolled_back')
-        ${threadIds === undefined ? sql`` : sql`AND i.thread_id IN ${sql.in(threadIds)}`}
+        ${threadIds === undefined ? sql`` : sql`AND i.thread_id IN (SELECT value FROM json_each(${encodeIdList(threadIds)}))`}
       ${
         activeRunIds.length === 0
           ? sql``
@@ -6017,7 +6017,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         UNION ALL
         SELECT i.thread_id, i.payload_json, NULL AS owning_provider_instance_id
         FROM orchestration_v2_projection_turn_items i
-        WHERE i.run_id IN ${sql.in(activeRunIds)}
+        WHERE i.run_id IN (SELECT value FROM json_each(${encodeIdList(activeRunIds)}))
           AND i.type IN ('file_change', 'file_search', 'web_search', 'compaction')
           AND i.status IN ('running', 'waiting')
       `

From 1e3e3a8dfd87cfc085828a7ae4de995b7addcb4f Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:53:38 +0000
Subject: [PATCH 059/146] fix(server): allow large git status metadata (#25207)

Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 39 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      | 29 ++++++++-------
 2 files changed, 55 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 47b3f3a62b7e9..cbc3efcc3b4e7 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -1003,6 +1003,45 @@ describe("rejected git refs", () => {
 });
 
 it.layer(layerTest)("GitVcsDriver core integration", (it) => {
+  it.effect("keeps large change sets available for status and commit preparation", () =>
+    Effect.gen(function* () {
+      const cwd = yield* makeTmpDir();
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const driver = yield* GitVcsDriver.GitVcsDriver;
+      yield* git(cwd, ["init"]);
+      yield* git(cwd, ["config", "user.email", "test@test.com"]);
+      yield* git(cwd, ["config", "user.name", "Test"]);
+      const files = Array.from(
+        { length: 6_000 },
+        (_, index) => `file-${String(index).padStart(5, "0")}-${"x".repeat(160)}.txt`,
+      );
+      yield* Effect.forEach(files, (file) => fs.writeFileString(path.join(cwd, file), "before\n"), {
+        concurrency: 16,
+        discard: true,
+      });
+      yield* git(cwd, ["add", "."]);
+      const unborn = yield* driver.statusDetailsLocal(cwd);
+      assert.lengthOf(unborn.workingTree.files, files.length);
+      assert.equal(unborn.workingTree.insertions, files.length);
+      const initial = yield* driver.commit(cwd, "initial", "");
+      assert.match(initial.commitSha, /^[a-f0-9]{40}$/);
+      assert.isFalse((yield* driver.statusDetailsLocal(cwd)).hasWorkingTreeChanges);
+      yield* Effect.forEach(files, (file) => fs.writeFileString(path.join(cwd, file), "after\n"), {
+        concurrency: 16,
+        discard: true,
+      });
+      const status = yield* driver.statusDetailsLocal(cwd);
+      assert.isTrue(status.hasWorkingTreeChanges);
+      assert.lengthOf(status.workingTree.files, files.length);
+      assert.equal(status.workingTree.insertions, files.length);
+      assert.equal(status.workingTree.deletions, files.length);
+      const context = yield* driver.prepareCommitContext(cwd, undefined, { includePatch: false });
+      assert.isNotNull(context);
+      assert.isAbove(context!.stagedSummary.length, 1_000_000);
+      assert.lengthOf(context!.stagedSummary.split("\n"), files.length);
+    }),
+  );
   describe("structured errors", () => {
     it.effect("does not retain git arguments or stderr in command failures", () =>
       Effect.gen(function* () {
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 49149d95f58f6..c486c6744cb5f 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -2097,6 +2097,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       statusArgs,
       {
         allowNonZeroExit: true,
+        maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES,
       },
     ).pipe(
       Effect.catchTags({
@@ -2137,24 +2138,25 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           "GitVcsDriver.statusDetails.numstat",
           cwd,
           ["diff-index", "-M", "--numstat", "-z", "HEAD", "--"],
-          { allowNonZeroExit: true },
+          { allowNonZeroExit: true, maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
         ).pipe(
           Effect.flatMap((result) => {
             if (result.exitCode === 0) return Effect.succeed(parseReviewNumstat(result.stdout));
             if (isUnbornHeadStderr(result.stderr)) {
               return Effect.map(
                 Effect.all([
-                  runGitStdout("GitVcsDriver.statusDetails.numstat.unborn", cwd, [
-                    "diff-files",
-                    "--numstat",
-                    "-z",
-                  ]),
-                  runGitStdout("GitVcsDriver.statusDetails.numstat.unborn.staged", cwd, [
-                    "diff",
-                    "--cached",
-                    "--numstat",
-                    "-z",
-                  ]),
+                  runGitStdoutWithOptions(
+                    "GitVcsDriver.statusDetails.numstat.unborn",
+                    cwd,
+                    ["diff-files", "--numstat", "-z"],
+                    { maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
+                  ),
+                  runGitStdoutWithOptions(
+                    "GitVcsDriver.statusDetails.numstat.unborn.staged",
+                    cwd,
+                    ["diff", "--cached", "--numstat", "-z"],
+                    { maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
+                  ),
                 ]),
                 ([unstagedStdout, stagedStdout]) => [
                   ...parseReviewNumstat(stagedStdout),
@@ -2444,7 +2446,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
             "GitVcsDriver.prepareCommitContext.stagedSummary",
             cwd,
             ["diff", "--cached", "--name-status"],
-            { env },
+            { env, maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
           ).pipe(Effect.map((stdout) => stdout.trim()));
           if (stagedSummary.length === 0) {
             return null;
@@ -2508,6 +2510,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
               options.progress?.onOutputLine?.({ stream: "stderr", text: line }) ?? Effect.void,
           };
     yield* executeGit("GitVcsDriver.commit.commit", cwd, args, {
+      maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES,
       ...(options?.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
       ...(progress ? { progress } : {}),
     }).pipe(Effect.asVoid);

From 781cc55c2d182566fbf650abc08d0ad6e67a7fbf Mon Sep 17 00:00:00 2001
From: luke <97411838+luke2x@users.noreply.github.com>
Date: Thu, 29 Oct 2026 17:54:01 +0000
Subject: [PATCH 060/146] perf(mobile): flatten large file trees without
 copying descendants (#21276)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/features/files/fileTree.test.ts       | 61 +++++++++++++++++++
 apps/mobile/src/features/files/fileTree.ts    |  8 +--
 2 files changed, 65 insertions(+), 4 deletions(-)
 create mode 100644 apps/mobile/src/features/files/fileTree.test.ts

diff --git a/apps/mobile/src/features/files/fileTree.test.ts b/apps/mobile/src/features/files/fileTree.test.ts
new file mode 100644
index 0000000000000..d978333d2732f
--- /dev/null
+++ b/apps/mobile/src/features/files/fileTree.test.ts
@@ -0,0 +1,61 @@
+import { expect, it } from "vite-plus/test";
+
+import { buildFileTree, flattenFileTree } from "./fileTree";
+
+it("flattens a wide expanded directory without exceeding argument limits", () => {
+  const children = Array.from({ length: 200_000 }, (_, index) => ({
+    path: `root/file-${index}`,
+    name: `file-${index}`,
+    kind: "file" as const,
+    children: [],
+  }));
+  const nodes = [{ path: "root", name: "root", kind: "directory" as const, children }];
+  const rows = flattenFileTree({ nodes, expanded: new Set(["root"]) });
+  expect(rows).toHaveLength(children.length + 1);
+  expect(rows[0]).toEqual({ node: nodes[0], depth: 0 });
+  const middleChildIndex = Math.floor(children.length / 2);
+  expect(rows[middleChildIndex + 1]).toEqual({
+    node: children[middleChildIndex],
+    depth: 1,
+  });
+  expect(rows.at(-1)).toEqual({ node: children.at(-1), depth: 1 });
+});
+
+it("prunes unmatched subtrees without losing adjacent rows or their depths", () => {
+  const nodes = buildFileTree([
+    { kind: "file", path: "root/a/hidden.txt" },
+    { kind: "file", path: "root/b/match.txt" },
+    { kind: "file", path: "root/b/other.txt" },
+    { kind: "file", path: "root/c/hidden.txt" },
+    { kind: "file", path: "tail.txt" },
+  ]);
+  const expanded = new Set(["root", "root/a", "root/b", "root/c"]);
+  const rows = (searchResultPaths: ReadonlySet<string> | null) =>
+    flattenFileTree({ nodes, expanded, searchResultPaths }).map(
+      ({ node, depth }) => `${depth}:${node.path}`,
+    );
+
+  expect(rows(new Set(["root/b/match.txt", "tail.txt"]))).toEqual([
+    "0:root",
+    "1:root/b",
+    "2:root/b/match.txt",
+    "0:tail.txt",
+  ]);
+  expect(rows(new Set(["root/b"]))).toEqual(["0:root", "1:root/b"]);
+  expect(rows(new Set())).toEqual([]);
+  expect(rows(null)).toEqual([
+    "0:root",
+    "1:root/a",
+    "2:root/a/hidden.txt",
+    "1:root/b",
+    "2:root/b/match.txt",
+    "2:root/b/other.txt",
+    "1:root/c",
+    "2:root/c/hidden.txt",
+    "0:tail.txt",
+  ]);
+  expect(flattenFileTree({ nodes, expanded: new Set() }).map(({ node }) => node.path)).toEqual([
+    "root",
+    "tail.txt",
+  ]);
+});
diff --git a/apps/mobile/src/features/files/fileTree.ts b/apps/mobile/src/features/files/fileTree.ts
index 4e4b4b77171dd..22e8e9bd5bd8d 100644
--- a/apps/mobile/src/features/files/fileTree.ts
+++ b/apps/mobile/src/features/files/fileTree.ts
@@ -100,11 +100,12 @@ function flattenNode(
   const isSearching = searchResultPaths !== null;
   const matches = searchResultPaths?.has(node.path) ?? false;
   let descendantMatches = false;
-  const childOutput: VisibleFileTreeNode[] = [];
+  const start = output.length;
+  output.push({ node, depth });
 
   if (node.kind === "directory" && (expanded.has(node.path) || isSearching)) {
     for (const child of node.children) {
-      if (flattenNode(childOutput, child, depth + 1, expanded, searchResultPaths)) {
+      if (flattenNode(output, child, depth + 1, expanded, searchResultPaths)) {
         descendantMatches = true;
       }
     }
@@ -112,11 +113,10 @@ function flattenNode(
 
   const visible = !isSearching || matches || descendantMatches;
   if (!visible) {
+    output.length = start;
     return false;
   }
 
-  output.push({ node, depth });
-  output.push(...childOutput);
   return matches || descendantMatches;
 }
 

From 80ae9b53015bc3df7f1b5d1c2bc13602ee88625b Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:54:24 -0500
Subject: [PATCH 061/146] fix(web): show theme conflicts even when another
 import fails (#23223)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../ThemeImportDialog.browser.test.tsx        | 58 +++++++++++++++++++
 .../components/settings/ThemeImportDialog.tsx | 11 ++--
 2 files changed, 63 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/components/settings/ThemeImportDialog.browser.test.tsx b/apps/web/src/components/settings/ThemeImportDialog.browser.test.tsx
index 3a6478434c940..2ee0085bbb1c6 100644
--- a/apps/web/src/components/settings/ThemeImportDialog.browser.test.tsx
+++ b/apps/web/src/components/settings/ThemeImportDialog.browser.test.tsx
@@ -3,6 +3,14 @@ import { describe, expect, it, vi } from "vite-plus/test";
 import { page, userEvent } from "vite-plus/test/browser";
 
 import { render } from "../../../test/render";
+import {
+  CUSTOM_THEMES_STORAGE_KEY,
+  getCustomThemes,
+  installCustomTheme,
+  invalidateCustomThemes,
+  parseThemeFile,
+  THEME_FILE_VERSION,
+} from "../../themePalette";
 import type { OpenVsxThemeExtension } from "../../openVsxThemes";
 import { ThemeImportDialog } from "./ThemeImportDialog";
 
@@ -54,3 +62,53 @@ describe("ThemeImportDialog", () => {
     );
   });
 });
+
+const theme = (name: string, accent = "#3b82f6") => ({
+  version: THEME_FILE_VERSION,
+  name,
+  appearance: "dark",
+  colors: { accent },
+});
+
+const themeFile = (name: string, accent?: string) =>
+  new File([JSON.stringify(theme(name, accent))], `${name}.json`, { type: "application/json" });
+
+it.each(["Update existing", "Keep both"])(
+  "keeps batch failures visible after %s",
+  async (choice) => {
+    using _themes = {
+      [Symbol.dispose]() {
+        window.localStorage.removeItem(CUSTOM_THEMES_STORAGE_KEY);
+        invalidateCustomThemes();
+      },
+    };
+    installCustomTheme(parseThemeFile(theme("Dusk")));
+    const onOpenChange = vi.fn();
+    await using _screen = await render(
+      <ThemeImportDialog
+        open
+        onOpenChange={onOpenChange}
+        onImported={() => true}
+        onImportedMany={() => {}}
+      />,
+    );
+    const input = document.querySelector<HTMLInputElement>('input[type="file"]')!;
+    await userEvent.upload(input, [
+      themeFile("Dawn"),
+      themeFile("Dusk", "#f97316"),
+      new File(["{"], "broken.json", { type: "application/json" }),
+    ]);
+
+    await expect.element(page.getByText("Already installed")).toBeVisible();
+    await expect.element(page.getByText(/^broken\.json:/)).toBeVisible();
+    expect(getCustomThemes().map((theme) => theme.label)).toContain("Dawn");
+    await page.getByRole("button", { name: choice }).click();
+    invalidateCustomThemes();
+    const label = choice === "Update existing" ? "Dusk" : "Dusk (1)";
+    expect(getCustomThemes().find((theme) => theme.label === label)?.colors).toEqual(
+      parseThemeFile(theme("Dusk", "#f97316")).colors,
+    );
+    await expect.element(page.getByText(/^broken\.json:/)).toBeVisible();
+    expect(onOpenChange).not.toHaveBeenCalledWith(false);
+  },
+);
diff --git a/apps/web/src/components/settings/ThemeImportDialog.tsx b/apps/web/src/components/settings/ThemeImportDialog.tsx
index 8536498ba5a68..e9d37f45322d1 100644
--- a/apps/web/src/components/settings/ThemeImportDialog.tsx
+++ b/apps/web/src/components/settings/ThemeImportDialog.tsx
@@ -284,11 +284,10 @@ function ThemeImportBody({
       }
     }
     if (installed.length > 0) onImportedMany(installed, { updated: false });
-    if (failures.length > 0) {
-      setError(failures.join("; "));
-    } else if (conflicting.length > 0) {
+    setError(failures.length > 0 ? failures.join("; ") : null);
+    if (conflicting.length > 0) {
       setConflicts(conflicting);
-    } else if (installed.length > 0) {
+    } else if (installed.length > 0 && failures.length === 0) {
       onClose();
     }
   };
@@ -387,8 +386,8 @@ function ThemeImportBody({
     }
     if (resolved.length > 0) onImportedMany(resolved, { updated: mode === "update" });
     setConflicts(null);
-    if (failures.length > 0) setError(failures.join("; "));
-    else onClose();
+    if (failures.length > 0) setError([error, ...failures].filter(Boolean).join("; "));
+    else if (!error) onClose();
   };
 
   const handleSubmit = () => {

From 061dc79e3bf7a56709fda2c5dd71b6dcefe4d787 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:54:47 -0500
Subject: [PATCH 062/146] fix(usage): reject cyclic model mappings before
 saving (#23963)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../components/usage/usagePriceTable.test.ts  | 49 ++++++++++++++++++-
 .../src/components/usage/usagePriceTable.ts   | 20 ++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/apps/web/src/components/usage/usagePriceTable.test.ts b/apps/web/src/components/usage/usagePriceTable.test.ts
index 6a1c1e71ecb44..2ef6ea31c9b37 100644
--- a/apps/web/src/components/usage/usagePriceTable.test.ts
+++ b/apps/web/src/components/usage/usagePriceTable.test.ts
@@ -1,6 +1,11 @@
 import { EnvironmentId } from "@t3tools/contracts";
 import { describe, expect, it } from "vite-plus/test";
-import { usagePriceCell, usagePriceTableChanges, type UsagePriceDraft } from "./usagePriceTable";
+import {
+  usagePriceCell,
+  usagePriceTableChanges,
+  usagePriceTableErrors,
+  type UsagePriceDraft,
+} from "./usagePriceTable";
 import type { UsagePriceTarget } from "./usagePriceTargets";
 
 const price = { inputCostPerMillionTokens: 2, outputCostPerMillionTokens: 8 };
@@ -116,3 +121,45 @@ describe("price table edits", () => {
     ).toBe("Map to a different model.");
   });
 });
+
+describe("model mapping validation", () => {
+  const mapping = (model: string, alias: string): UsagePriceDraft => ({
+    id: `model:${model}`,
+    model,
+    alias,
+    isNew: false,
+    values: {},
+  });
+
+  it("rejects a cycle created by several mappings in one save", () => {
+    const edits = [mapping("a", "b"), mapping("b", "c"), mapping("c", "a")];
+    const result = usagePriceTableChanges(target("local", {}), edits);
+    expect([...result.errors.keys()]).toEqual(["model:a", "model:b", "model:c"]);
+  });
+
+  it("checks each environment's saved chain when an edited mapping closes it", () => {
+    const edits = [mapping("c", "a")];
+    const acyclic = target("one", {}, { a: "b" });
+    const cyclic = target("two", {}, { a: "b", b: "c" });
+    expect(usagePriceTableChanges(acyclic, edits).errors.size).toBe(0);
+    expect(usagePriceTableErrors([acyclic, cyclic], edits).get("model:c")).toBe(
+      "Model mappings cannot form a cycle on two.",
+    );
+  });
+
+  it("validates the final batch so a mapping can be reversed in either row order", () => {
+    const environment = target("local", {}, { constructor: "__proto__" });
+    const clear = mapping("constructor", "");
+    const reverse = mapping("__proto__", "constructor");
+    for (const edits of [
+      [reverse, clear],
+      [clear, reverse],
+    ]) {
+      const result = usagePriceTableChanges(environment, edits);
+      expect(result.errors.size).toBe(0);
+      expect(result.changes).toEqual(
+        edits.map(({ model, alias }) => ({ model, alias: alias || null })),
+      );
+    }
+  });
+});
diff --git a/apps/web/src/components/usage/usagePriceTable.ts b/apps/web/src/components/usage/usagePriceTable.ts
index e6ad3d72da8bb..04b667c2ec30d 100644
--- a/apps/web/src/components/usage/usagePriceTable.ts
+++ b/apps/web/src/components/usage/usagePriceTable.ts
@@ -115,6 +115,26 @@ export function usagePriceTableChanges(
     if (USAGE_PRICE_FIELDS.some((field) => original[field.key] !== next[field.key]))
       changes.push(parsed);
   }
+  // Check the final batch so clearing a mapping and reversing it in one save stays valid.
+  const aliases = new Map(Object.entries(target.aliases ?? {}));
+  for (const change of changes) {
+    if (!("alias" in change)) continue;
+    if (change.alias === null) aliases.delete(change.model);
+    else aliases.set(change.model, change.alias);
+  }
+  for (const draft of drafts) {
+    if (draft.removed || errors.has(draft.id)) continue;
+    let model = draft.model.trim();
+    const seen = new Set<string>();
+    while (aliases.has(model)) {
+      if (seen.has(model)) {
+        errors.set(draft.id, `Model mappings cannot form a cycle on ${target.label}.`);
+        break;
+      }
+      seen.add(model);
+      model = aliases.get(model)!;
+    }
+  }
   return { changes, errors };
 }
 

From bae3c1962ce31eefd09e9625586cbd6a904bedc2 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:55:10 -0500
Subject: [PATCH 063/146] fix(settings): offer Use existing CLI in managed
 Codex settings (#23160)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../components/settings/CodexSetupSection.tsx | 12 +++-
 ...SettingsPanel.environment.browser.test.tsx | 58 ++++++++++++++++++-
 2 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/components/settings/CodexSetupSection.tsx b/apps/web/src/components/settings/CodexSetupSection.tsx
index bab910d5eda82..e7ef1c9a20404 100644
--- a/apps/web/src/components/settings/CodexSetupSection.tsx
+++ b/apps/web/src/components/settings/CodexSetupSection.tsx
@@ -914,7 +914,7 @@ function ManagedCodexSetup({
         title="ChatGPT account"
         description={accountDescription}
         control={
-          <div className="flex flex-wrap items-center justify-end gap-2">
+          <div className="flex max-w-88 flex-wrap items-center justify-end gap-2">
             {authActive ? (
               <>
                 {waitingControl}
@@ -1001,6 +1001,16 @@ function ManagedCodexSetup({
                     Use a different account
                   </Button>
                 ) : null}
+                {allowExistingCli ? (
+                  <Button
+                    size="sm"
+                    variant="ghost"
+                    disabled={readOnly || busy}
+                    onClick={() => onModeChange("existing")}
+                  >
+                    Use existing CLI
+                  </Button>
+                ) : null}
               </>
             )}
           </div>
diff --git a/apps/web/src/components/settings/ProviderSettingsPanel.environment.browser.test.tsx b/apps/web/src/components/settings/ProviderSettingsPanel.environment.browser.test.tsx
index 89fa5250a3a09..4ad9b3986bb3a 100644
--- a/apps/web/src/components/settings/ProviderSettingsPanel.environment.browser.test.tsx
+++ b/apps/web/src/components/settings/ProviderSettingsPanel.environment.browser.test.tsx
@@ -4,6 +4,7 @@ import {
   EnvironmentId,
   ProviderDriverKind,
   ProviderInstanceId,
+  type ProviderAuthState,
   type ServerProvider,
   type UnifiedSettings,
 } from "@t3tools/contracts";
@@ -17,6 +18,8 @@ import { act, render } from "../../../test/render";
 
 const state = vi.hoisted(() => ({
   providers: null as unknown as Atom.Writable<ReadonlyArray<ServerProvider>>,
+  providerAuthQuery: null as unknown,
+  providerAuth: null as ProviderAuthState | null,
   settings: null as unknown as UnifiedSettings,
   canManageProviders: true,
   canWriteSettings: true,
@@ -40,6 +43,8 @@ vi.mock(import("../../state/server"), async (original) => {
   const providers = Atom.make<ReadonlyArray<ServerProvider>>([]).pipe(Atom.keepAlive);
   state.providers = providers;
   const config = Atom.make(null);
+  const providerAuth = Atom.make(null);
+  state.providerAuthQuery = providerAuth;
   const commandLabels = {
     refreshProviders: "refresh",
     updateProvider: "update",
@@ -59,6 +64,7 @@ vi.mock(import("../../state/server"), async (original) => {
       ...actual.serverEnvironment,
       ...labelled,
       configValueAtom: (() => config) as never,
+      providerAuthState: (() => providerAuth) as never,
       providersValueAtom: (() => providers) as never,
     } as never,
   };
@@ -75,8 +81,8 @@ vi.mock(import("../../state/use-atom-command"), async (original) => ({
 }));
 vi.mock(import("../../state/query"), async (original) => ({
   ...(await original()),
-  useEnvironmentQuery: (() => ({
-    data: null,
+  useEnvironmentQuery: ((query: unknown) => ({
+    data: query === state.providerAuthQuery ? state.providerAuth : null,
     error: null,
     isPending: false,
     refresh: vi.fn(),
@@ -216,6 +222,7 @@ async function setup() {
   state.canManageProviders = true;
   state.canWriteSettings = true;
   state.searchTargetId = null;
+  state.providerAuth = null;
   state.readEnvironmentIds = [];
   state.updateEnvironmentIds = [];
   state.mutationEnvironmentIds = [];
@@ -302,4 +309,51 @@ describe("EnvironmentProviderSettings routing", () => {
       input: { instanceId, elicitationId: action.elicitationId },
     });
   });
+
+  it("lets a signed-out managed Codex account switch to the existing CLI", async () => {
+    await setup();
+    const codex = ProviderDriverKind.make("codex");
+    state.settings = {
+      ...DEFAULT_UNIFIED_SETTINGS,
+      providerInstances: {
+        [codexId]: {
+          driver: codex,
+          enabled: true,
+          config: { enabled: true, setupMode: "managed" },
+        },
+      },
+    };
+    state.providerAuth = {
+      instanceId: codexId,
+      phase: "idle",
+      flowId: null,
+      authorizationUrl: null,
+      expiresAt: null,
+      message: null,
+      methods: [{ id: "chatgpt-profile:work", name: "Work", description: null, type: "agent" }],
+    };
+    await setProviders([
+      {
+        ...provider(),
+        auth: { status: "unauthenticated" },
+        setup: { canAuthenticate: true, canInstall: true },
+      },
+    ]);
+    await using _screen = await render(panel({ targetInstanceId: codexId }));
+    await expect.element(page.getByRole("button", { name: "Reconnect account" })).toBeVisible();
+    await userEvent.click(page.getByRole("button", { name: "Use existing CLI" }).element());
+
+    expect(state.mutateProviderInstance).toHaveBeenCalledWith(
+      {
+        operation: "upsert",
+        instanceId: codexId,
+        instance: {
+          driver: codex,
+          enabled: true,
+          config: { enabled: true, setupMode: "existing" },
+        },
+      },
+      {},
+    );
+  });
 });

From 1e95da77c41968eee9e7fce1f6d29b27a9e39339 Mon Sep 17 00:00:00 2001
From: parmartejas <110296251+parmartejass@users.noreply.github.com>
Date: Thu, 29 Oct 2026 23:25:32 +0530
Subject: [PATCH 064/146] fix(git): honor project provider settings (#23672)

Co-authored-by: Tejas Parmar <parmartejas@vanojay.in>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../features/threads/DraftThreadHeader.tsx    |  6 ++-
 apps/server/src/git/GitManager.test.ts        | 41 ++++++++++++++++++-
 apps/server/src/git/GitManager.ts             | 24 +++++++----
 3 files changed, 60 insertions(+), 11 deletions(-)

diff --git a/apps/mobile/src/features/threads/DraftThreadHeader.tsx b/apps/mobile/src/features/threads/DraftThreadHeader.tsx
index 509545b58c8bb..5c3d758f45513 100644
--- a/apps/mobile/src/features/threads/DraftThreadHeader.tsx
+++ b/apps/mobile/src/features/threads/DraftThreadHeader.tsx
@@ -87,7 +87,11 @@ export function DraftThreadHeader(props: {
         },
         onRunAction: async (input) => {
           if (!canWriteGit || !props.cwd) return null;
-          const result = await runAction({ ...input, actionId: uuidv4() });
+          const result = await runAction({
+            ...input,
+            projectId: props.project.id,
+            actionId: uuidv4(),
+          });
           if (AsyncResult.isFailure(result)) {
             Dialog.alert("Git action failed", String(Cause.squash(result.cause)));
             return null;
diff --git a/apps/server/src/git/GitManager.test.ts b/apps/server/src/git/GitManager.test.ts
index 5d363826458df..3c13991426f92 100644
--- a/apps/server/src/git/GitManager.test.ts
+++ b/apps/server/src/git/GitManager.test.ts
@@ -2599,7 +2599,45 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
     }),
   );
 
-  it.effect("applies a V2-native thread's project settings to generated commit text", () =>
+  it.effect("uses an explicit project's provider settings for generated commit text", () =>
+    Effect.gen(function* () {
+      const repoDir = yield* makeTempDir("t3code-git-manager-");
+      yield* initRepo(repoDir);
+      NodeFS.writeFileSync(NodePath.join(repoDir, "README.md"), "hello\nproject\n");
+      const projectId = ProjectId.make("project:git-action-settings");
+      const disabledInstanceId = DEFAULT_SERVER_SETTINGS.textGenerationModelSelection.instanceId;
+      let generatedModelSelection:
+        | TextGeneration.CommitMessageGenerationInput["modelSelection"]
+        | undefined;
+
+      const { manager } = yield* makeManager({
+        serverSettings: {
+          projectSettingsOverrides: {
+            [projectId]: {
+              providerInstances: { [disabledInstanceId]: { enabled: false } },
+            },
+          },
+        },
+        textGeneration: {
+          generateCommitMessage: (input) => {
+            generatedModelSelection = input.modelSelection;
+            return Effect.succeed({ subject: "Use the project writer", body: "" });
+          },
+        },
+      });
+
+      yield* manager.runStackedAction({
+        actionId: "test-project-action-settings",
+        cwd: repoDir,
+        action: "commit",
+        projectId,
+      });
+
+      expect(generatedModelSelection?.instanceId).toBe(ProviderInstanceId.make("claudeAgent"));
+    }),
+  );
+
+  it.effect("prefers a V2-native thread's project settings over an explicit project", () =>
     Effect.gen(function* () {
       const repoDir = yield* makeTempDir("t3code-git-manager-");
       yield* initRepo(repoDir);
@@ -2686,6 +2724,7 @@ it.layer(layerGitManagerTest)("GitManager", (it) => {
         cwd: repoDir,
         action: "commit",
         threadId,
+        projectId: ProjectId.make("project:other"),
       });
 
       expect(generatedModelSelection).toEqual(projectModel);
diff --git a/apps/server/src/git/GitManager.ts b/apps/server/src/git/GitManager.ts
index 53d0b4f5853ff..71e5edb3b697b 100644
--- a/apps/server/src/git/GitManager.ts
+++ b/apps/server/src/git/GitManager.ts
@@ -672,19 +672,25 @@ export const make = Effect.gen(function* () {
   const projectSettingsFor = Effect.fnUntraced(function* (input: {
     readonly cwd: string;
     readonly threadId?: ThreadId | undefined;
+    readonly projectId?: ProjectId | undefined;
   }) {
     const settings = yield* serverSettingsService.getSettings;
     if (!hasProjectSettingsOverrides(settings))
       return { settings, projectId: null as ProjectId | null };
-    const projectId: ProjectId | null = yield* input.threadId !== undefined
-      ? threads.getThreadShell(input.threadId).pipe(
-          Effect.map((thread) => thread?.projectId ?? null),
-          Effect.orElseSucceed(() => null),
-        )
-      : projects.findActiveByWorkspaceRoot(input.cwd).pipe(
-          Effect.map((project) => Option.getOrNull(project)?.projectId ?? null),
-          Effect.orElseSucceed(() => null),
-        );
+    const threadProjectId =
+      input.threadId === undefined
+        ? null
+        : yield* threads.getThreadShell(input.threadId).pipe(
+            Effect.map((thread) => thread?.projectId ?? null),
+            Effect.orElseSucceed(() => null),
+          );
+    const projectId =
+      threadProjectId ??
+      input.projectId ??
+      (yield* projects.findActiveByWorkspaceRoot(input.cwd).pipe(
+        Effect.map((project) => Option.getOrNull(project)?.projectId ?? null),
+        Effect.orElseSucceed(() => null),
+      ));
     return { settings: resolveProjectSettings(settings, projectId).settings, projectId };
   });
   const readThreadContext = Effect.fnUntraced(

From efb940dbaf97674c455f9f74d33ca5fc34a1de83 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:55:54 +0000
Subject: [PATCH 065/146] fix(desktop): force-close stalled Linux MIME cache
 helpers (#25210)

Co-authored-by: Simone <185146821+Lucenx9@users.noreply.github.com>
---
 .../src/app/DesktopLinuxUrlHandler.test.ts    | 71 +++++++++++++++++++
 .../desktop/src/app/DesktopLinuxUrlHandler.ts |  1 +
 2 files changed, 72 insertions(+)

diff --git a/apps/desktop/src/app/DesktopLinuxUrlHandler.test.ts b/apps/desktop/src/app/DesktopLinuxUrlHandler.test.ts
index feedbbd580074..9404b0ac3087c 100644
--- a/apps/desktop/src/app/DesktopLinuxUrlHandler.test.ts
+++ b/apps/desktop/src/app/DesktopLinuxUrlHandler.test.ts
@@ -1,7 +1,11 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { assert, describe, it } from "@effect/vitest";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+import * as Cause from "effect/Cause";
 import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
@@ -9,6 +13,8 @@ import * as Path from "effect/Path";
 import * as PlatformError from "effect/PlatformError";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
+import * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import * as DesktopEnvironment from "./DesktopEnvironment.ts";
@@ -56,6 +62,7 @@ const layerHandler = (
   recorded: RecordedRegistration,
   input: {
     readonly environment?: Record<string, unknown>;
+    readonly processSpawner?: ChildProcessSpawner.ChildProcessSpawner["Service"];
     readonly updateDesktopDatabaseExitCode?: number;
     readonly updateDesktopDatabaseStalled?: boolean;
     readonly updateDesktopDatabaseStarted?: Deferred.Deferred<void>;
@@ -106,6 +113,7 @@ const layerHandler = (
         Layer.succeed(
           ChildProcessSpawner.ChildProcessSpawner,
           ChildProcessSpawner.make((command) => {
+            if (input.processSpawner) return input.processSpawner.spawn(command);
             const childProcess = command as unknown as {
               readonly command: string;
               readonly args: ReadonlyArray<string>;
@@ -358,6 +366,69 @@ describe("DesktopLinuxUrlHandler", () => {
       assert.deepEqual(writeFailed.commands, []);
     });
   });
+
+  it.effect.skipIf(HostProcess.Platform.defaultValue() !== "linux")(
+    "continues registration after a timed-out cache helper ignores SIGTERM",
+    () =>
+      Effect.gen(function* () {
+        const realSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const nodeExecutable = yield* HostProcess.ExecutablePath;
+        const recorded = emptyRecording();
+        const spawned = yield* Deferred.make<ChildProcessSpawner.ChildProcessHandle>();
+        const ready = yield* Deferred.make<void>();
+        const processSpawner = ChildProcessSpawner.make((command) =>
+          Effect.gen(function* () {
+            if (!ChildProcess.isStandardCommand(command)) {
+              return yield* Effect.die("expected a single registration command");
+            }
+            recorded.commands.push({ command: command.command, args: command.args });
+            if (command.command !== "update-desktop-database") return mockProcess(0);
+            const child = yield* realSpawner.spawn(
+              ChildProcess.make(
+                nodeExecutable,
+                [
+                  "-e",
+                  // The watchdog makes the unfixed case exit with a distinguishable code.
+                  "process.on('SIGTERM', () => setTimeout(() => process.exit(99), 5000));" +
+                    "process.stdout.write('ready\\n'); setInterval(() => {}, 2147483647);",
+                ],
+                { ...command.options, stdout: "pipe" },
+              ),
+            );
+            yield* Deferred.succeed(spawned, child);
+            yield* Stream.runHead(child.stdout);
+            yield* Deferred.succeed(ready, undefined);
+            return child;
+          }),
+        );
+        const registration = yield* runRegister(recorded, { processSpawner }).pipe(
+          Effect.forkScoped,
+        );
+        const child = yield* Deferred.await(spawned);
+        yield* Effect.addFinalizer(() =>
+          child.isRunning.pipe(
+            Effect.flatMap((running) =>
+              running ? child.kill({ killSignal: "SIGKILL" }) : Effect.void,
+            ),
+            Effect.ignore,
+          ),
+        );
+        yield* Deferred.await(ready);
+        yield* TestClock.adjust("5 seconds");
+        yield* Fiber.join(registration);
+
+        const exit = yield* Effect.exit(child.exitCode);
+        if (Exit.isFailure(exit)) {
+          assert.include(Cause.pretty(exit.cause), "SIGKILL");
+        } else {
+          assert.fail(`cache helper exited with ${exit.value} instead of being force-killed`);
+        }
+        assert.deepEqual(
+          recorded.commands.map(({ command }) => command),
+          ["update-desktop-database", "xdg-mime"],
+        );
+      }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
 });
 
 interface ThemeIconRun {
diff --git a/apps/desktop/src/app/DesktopLinuxUrlHandler.ts b/apps/desktop/src/app/DesktopLinuxUrlHandler.ts
index dd38acbc3894e..ebd7d71b25726 100644
--- a/apps/desktop/src/app/DesktopLinuxUrlHandler.ts
+++ b/apps/desktop/src/app/DesktopLinuxUrlHandler.ts
@@ -174,6 +174,7 @@ export const make = Effect.gen(function* () {
           stdin: "ignore",
           stdout: "ignore",
           stderr: "ignore",
+          forceKillAfter: "1 second",
         },
       );
       const handle = yield* spawner.spawn(command);

From bdf84df8ca24bd6ab6f4cdbadef2f8a205da4441 Mon Sep 17 00:00:00 2001
From: MarcoDotIO <Marcus.Arnett10@gmail.com>
Date: Thu, 29 Oct 2026 13:56:17 -0400
Subject: [PATCH 066/146] fix(cli): auth pairing create rejects a --base-url
 without http(s):// (#23343)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/cli/auth.ts      | 12 ++++++-
 apps/server/src/cli/pair.test.ts | 60 ++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/cli/auth.ts b/apps/server/src/cli/auth.ts
index 0aeb7d6a3b5ab..06b949e3013ab 100644
--- a/apps/server/src/cli/auth.ts
+++ b/apps/server/src/cli/auth.ts
@@ -4,6 +4,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as References from "effect/References";
+import * as Schema from "effect/Schema";
 import { Argument, Command, Flag, GlobalFlag } from "effect/cli";
 
 import * as EnvironmentAuth from "../auth/EnvironmentAuth.ts";
@@ -68,6 +69,15 @@ const subjectFlag = Flag.String("subject").pipe(
 );
 
 const baseUrlFlag = Flag.String("base-url").pipe(
+  Flag.withSchema(
+    Schema.URLFromString.pipe(
+      Schema.check(
+        Schema.makeFilter((url) => url.protocol === "http:" || url.protocol === "https:", {
+          expected: "an http:// or https:// URL",
+        }),
+      ),
+    ),
+  ),
   Flag.withDescription("Optional public base URL used to print a ready `/pair#token=...` link."),
   Flag.optional,
 );
@@ -99,7 +109,7 @@ const pairingCreateCommand = Command.make("create", {
           });
           const output = formatIssuedPairingCredential(issued, {
             json: flags.json,
-            ...(Option.isSome(flags.baseUrl) ? { baseUrl: flags.baseUrl.value } : {}),
+            ...(Option.isSome(flags.baseUrl) ? { baseUrl: flags.baseUrl.value.href } : {}),
           });
           yield* Console.log(output);
         }),
diff --git a/apps/server/src/cli/pair.test.ts b/apps/server/src/cli/pair.test.ts
index 5ad9bde0acc28..88fc9cec74c13 100644
--- a/apps/server/src/cli/pair.test.ts
+++ b/apps/server/src/cli/pair.test.ts
@@ -488,3 +488,63 @@ describe("auth scope options", () => {
     }),
   );
 });
+
+describe("auth pairing create --base-url", () => {
+  it.effect.each(["192.168.1.5:3773", "localhost:3773", "ftp://localhost:3773"])(
+    "rejects %s before issuing a token",
+    (baseUrl) =>
+      Effect.gen(function* () {
+        const baseDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-cli-base-url-test-"));
+        const error = yield* runCli([
+          "auth",
+          "pairing",
+          "create",
+          "--base-dir",
+          baseDir,
+          "--base-url",
+          baseUrl,
+        ]).pipe(Effect.provide(layerCliRuntime), Effect.flip);
+
+        if (!CliError.isCliError(error) || error._tag !== "ShowHelp") {
+          assert.fail(`Expected ShowHelp, got ${String(error)}`);
+        }
+        const flagError = error.errors[0];
+        if (flagError?._tag !== "InvalidValue") {
+          assert.fail(`Expected InvalidValue, got ${String(flagError?._tag)}`);
+        }
+        assert.equal(flagError.option, "base-url");
+        assert.equal(flagError.value, baseUrl);
+
+        const listOutput = yield* captureStdout(
+          runCli(["auth", "pairing", "list", "--base-dir", baseDir, "--json"]),
+        );
+        assert.deepEqual(JSON.parse(listOutput), []);
+      }),
+  );
+
+  it.effect.each(["http://192.168.1.5:3773", "https://example.com", "http:localhost:3773"])(
+    "prints a pair URL for %s",
+    (baseUrl) =>
+      Effect.gen(function* () {
+        const baseDir = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-cli-base-url-test-"));
+        const output = yield* captureStdout(
+          runCli([
+            "auth",
+            "pairing",
+            "create",
+            "--base-dir",
+            baseDir,
+            "--base-url",
+            baseUrl,
+            "--json",
+          ]),
+        );
+        const issued = JSON.parse(output) as {
+          readonly credential: string;
+          readonly pairUrl: string;
+        };
+
+        assert.equal(issued.pairUrl, `${new URL(baseUrl).origin}/pair#token=${issued.credential}`);
+      }),
+  );
+});

From 4afdabab4479a68c7ea02d09174fe7936f084882 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:56:40 -0500
Subject: [PATCH 067/146] fix(server): signed asset and upload URLs stay out of
 HTTP traces (#24556)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/http.test.ts | 63 ++++++++++++++++++++++++++++++++++++
 apps/server/src/http.ts      |  9 ++++--
 2 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/http.test.ts b/apps/server/src/http.test.ts
index 0319bbb55c03d..5f7df20c738c8 100644
--- a/apps/server/src/http.test.ts
+++ b/apps/server/src/http.test.ts
@@ -13,7 +13,10 @@ import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
 import * as PlatformError from "effect/PlatformError";
 import * as Queue from "effect/Queue";
+import * as Tracer from "effect/Tracer";
 import { HttpClient, HttpClientRequest, HttpRouter, HttpServerResponse } from "effect/http";
+import { ASSET_ROUTE_PREFIX } from "./assets/AssetAccess.ts";
+import { ATTACHMENT_UPLOAD_ROUTE_PREFIX } from "./assets/AttachmentUpload.ts";
 import { openMediaFile } from "./assets/MediaFile.ts";
 
 import {
@@ -139,6 +142,66 @@ describe("browser API CORS", () => {
   });
 });
 
+describe("untraced requests", () => {
+  it.effect("keeps signed asset and upload URLs out of HTTP server spans", () =>
+    Effect.gen(function* () {
+      const serverSpans: Array<string> = [];
+      const layerTracer = Layer.succeed(
+        Tracer.Tracer,
+        Tracer.make({
+          span: (options) => {
+            if (options.kind === "server") serverSpans.push(options.name);
+            return new Tracer.NativeSpan(options);
+          },
+        }),
+      );
+      const layerRoutes = Layer.effectDiscard(
+        Effect.gen(function* () {
+          const router = yield* HttpRouter.HttpRouter;
+          yield* router.add("GET", `${ASSET_ROUTE_PREFIX}/*`, HttpServerResponse.empty());
+          yield* router.add(
+            "POST",
+            `${ATTACHMENT_UPLOAD_ROUTE_PREFIX}/*`,
+            HttpServerResponse.empty(),
+          );
+          yield* router.add("GET", "/api/environment", HttpServerResponse.empty());
+        }),
+      );
+      const services = yield* Layer.build(
+        HttpRouter.serve(layerRoutes, { disableListenLog: true, disableLogger: true }).pipe(
+          ServerHttp.withUntracedRequests,
+          Layer.provideMerge(NodeHttpServer.layerTest),
+          Layer.provide(layerTracer),
+        ),
+      );
+      const client = Context.get(services, HttpClient.HttpClient);
+
+      // Each URL is a bearer credential: url.full and url.path would carry it.
+      for (const request of [
+        HttpClientRequest.get(`${ASSET_ROUTE_PREFIX}/payload.signature/image.png`),
+        HttpClientRequest.get(`${ASSET_ROUTE_PREFIX}/payload.signature/image.png?v=1`),
+        HttpClientRequest.post(`${ATTACHMENT_UPLOAD_ROUTE_PREFIX}/payload.signature`),
+        HttpClientRequest.post(`${ATTACHMENT_UPLOAD_ROUTE_PREFIX}/payload.signature?v=1`),
+        HttpClientRequest.head(`${ASSET_ROUTE_PREFIX}/payload.signature/image.png`),
+      ]) {
+        expect((yield* client.execute(request)).status).toBe(204);
+      }
+      expect(serverSpans).toEqual([]);
+
+      expect((yield* client.execute(HttpClientRequest.get("/api/environment"))).status).toBe(204);
+      expect(serverSpans).toEqual(["GET"]);
+
+      for (const path of [
+        `${ASSET_ROUTE_PREFIX}-other/file`,
+        `${ATTACHMENT_UPLOAD_ROUTE_PREFIX}-other/token`,
+      ]) {
+        expect((yield* client.execute(HttpClientRequest.get(path))).status).toBe(404);
+      }
+      expect(serverSpans).toEqual(["GET", "GET", "GET"]);
+    }).pipe(Effect.provide(NodeServices.layer)),
+  );
+});
+
 const layerFileResponse = Layer.mergeAll(NodeHttpPlatform.layer, NodeServices.layer);
 
 const makeStaticRequest = Effect.fn("HttpTest.makeStaticRequest")(function* (staticDir: string) {
diff --git a/apps/server/src/http.ts b/apps/server/src/http.ts
index 8f9737a3efc18..e792a233c6f06 100644
--- a/apps/server/src/http.ts
+++ b/apps/server/src/http.ts
@@ -391,8 +391,13 @@ const UNTRACED_REQUEST_PATHS: ReadonlySet<string> = new Set([OTLP_TRACES_PROXY_P
 const layerUntracedRequests = Layer.succeed(HttpMiddleware.TracerDisabledWhen)((request) => {
   const queryIndex = request.url.indexOf("?");
   const path = queryIndex === -1 ? request.url : request.url.slice(0, queryIndex);
-  // Webhook URLs carry their secret token in the path, so they never reach a trace.
-  return UNTRACED_REQUEST_PATHS.has(path) || path.startsWith(`${WEBHOOK_ROUTE_PREFIX}/`);
+  // Signed URLs carry bearer tokens in the path, so they never reach a trace.
+  return (
+    UNTRACED_REQUEST_PATHS.has(path) ||
+    path.startsWith(`${WEBHOOK_ROUTE_PREFIX}/`) ||
+    path.startsWith(`${ASSET_ROUTE_PREFIX}/`) ||
+    path.startsWith(`${ATTACHMENT_UPLOAD_ROUTE_PREFIX}/`)
+  );
 });
 
 export const withUntracedRequests = Layer.provide(layerUntracedRequests);

From 1cc9d413a52c05ad51df5faa8d11437ca97043c7 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:57:04 -0500
Subject: [PATCH 068/146] fix(server): clone errors no longer show a token from
 the URL's query (#24698)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../SourceControlRepositoryService.test.ts    | 56 +++++++++++++++++++
 .../SourceControlRepositoryService.ts         | 16 ++++--
 2 files changed, 68 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
index 4a9105e9f5d9e..b0770b06d4830 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
@@ -383,6 +383,62 @@ it.effect.each([
   }),
 );
 
+it.effect.each([
+  ["a plain token", "s3cret"],
+  ["a token with an apostrophe", "s3'cret"],
+  ["a token with a double quote", 's3"cret'],
+  ["a host-only token with an at sign", "abc@secret"],
+  ["an unquoted token with an apostrophe", "s3'cret", true],
+  ["an unquoted token with a double quote", 's3"cret', true],
+  ["an unquoted URL with an apostrophe in its path", "path-token", true],
+] as const)("keeps %s in the query out of a failed clone's error text", ([, token, unquoted]) =>
+  Effect.gen(function* () {
+    const remote =
+      token === "abc@secret"
+        ? "https://github.com"
+        : token === "path-token"
+          ? "https://github.com/octocat/t3code's.git"
+          : "https://github.com/octocat/t3code.git";
+    const error = yield* Effect.flip(
+      cloneInTemporaryDirectory(
+        {
+          execute: (input) =>
+            Effect.gen(function* () {
+              const cloneUrl = input.args.at(-2)!;
+              // Git treats @ in a pathless URL's query as userinfo, losing the query delimiter.
+              const diagnosticUrl =
+                cloneUrl === "https://github.com?access_token=abc@secret"
+                  ? "https://secret"
+                  : cloneUrl;
+              yield* (
+                input.progress?.onStderrLine?.(
+                  unquoted
+                    ? `fatal: ${diagnosticUrl}/info/refs not valid: is this a git repository?`
+                    : `fatal: unable to access '${diagnosticUrl}/': Could not resolve host: github.com`,
+                ) ?? Effect.void
+              );
+              return yield* new GitCommandError({
+                operation: input.operation,
+                command: "git",
+                cwd: input.cwd,
+                detail: "Git command exited with a non-zero status.",
+                exitCode: 128,
+              });
+            }),
+        },
+        { remoteUrl: `${remote}?access_token=${token}` },
+      ),
+    );
+
+    assert.strictEqual(
+      error.detail,
+      unquoted
+        ? `fatal: ${remote} not valid: is this a git repository?`
+        : `fatal: unable to access '${remote}${token === "abc@secret" ? "/" : ""}': Could not resolve host: github.com`,
+    );
+  }),
+);
+
 it.effect("strips embedded credentials from the remote URL it reports", () =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
index b6e7679037040..44d31a43b6978 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
@@ -110,7 +110,7 @@ function toRepositoryInfo(
   };
 }
 
-// Redact credentials from client clone snapshots; git still receives the original URL.
+// Redact credentials from client clone snapshots; git still receives the credentials.
 function redactRemoteUrl(remoteUrl: string): string {
   try {
     const url = new URL(remoteUrl);
@@ -128,10 +128,16 @@ function redactRemoteUrl(remoteUrl: string): string {
 }
 
 // Userinfo can contain @; remove through the last one before the host boundary.
-const URL_WITH_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/]+@/gi;
+const URL_WITH_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/?#]+@/gi;
+// Git leaves quotes inside query tokens unescaped; consume through the closing quote.
+const QUOTED_URL_QUERY = /(['"])([a-z][a-z0-9+.-]*:\/\/[^\s?]*)\?.*\1(?=[\s:]|$)/gi;
+const URL_QUERY = /\b([a-z][a-z0-9+.-]*:\/\/[^\s?]*)\?[^\s]*/gi;
 
 function redactUrlCredentials(text: string): string {
-  return text.replace(URL_WITH_USERINFO, "$1");
+  return text
+    .replace(QUOTED_URL_QUERY, "$1$2$1")
+    .replace(URL_QUERY, "$1")
+    .replace(URL_WITH_USERINFO, "$1");
 }
 
 // The remote already exists after push failure; advise fixing access and pushing.
@@ -340,11 +346,13 @@ export const make = Effect.gen(function* () {
         if (stderrTail.length > 4) stderrTail.shift();
       });
     };
+    // Git misreads @ in a pathless URL's query as userinfo and echoes its suffix as the host.
+    const normalizedCloneUrl = cloneUrl.replace(/^([a-z][a-z0-9+.-]*:\/\/[^/?#]+)\?/i, "$1/?");
     yield* git
       .execute({
         operation: "SourceControlRepositoryService.cloneRepository",
         cwd: path.dirname(destinationPath),
-        args: ["clone", "--progress", "--", cloneUrl, path.basename(destinationPath)],
+        args: ["clone", "--progress", "--", normalizedCloneUrl, path.basename(destinationPath)],
         timeoutMs: options?.timeoutMs === undefined ? CLONE_TIMEOUT_MS : options.timeoutMs,
         // Buffered output is unused and progress can be huge; cap it while retaining line callbacks.
         maxOutputBytes: 256 * 1024,

From c9d3f7c9f4c312e61990ea5184afd9c3056b4791 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:57:27 -0500
Subject: [PATCH 069/146] fix(claude): pass every --add-dir launch directory to
 Claude (#23281)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../Adapters/ClaudeAdapterV2.test.ts          | 22 ++++++++++
 .../Adapters/ClaudeAdapterV2.ts               |  8 +++-
 .../src/provider/Drivers/ClaudeSkills.test.ts |  2 +
 .../src/provider/Drivers/ClaudeSkills.ts      | 41 ++++++++++++-------
 4 files changed, 58 insertions(+), 15 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index 38253cd82f1d1..fb17c34713fd8 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -268,6 +268,28 @@ describe("ClaudeAdapterV2 runtime query policy", () => {
     assert.isUndefined(options.extraArgs?.["dangerously-skip-permissions"]);
   });
 
+  it("passes every --add-dir launch directory to Claude", () => {
+    const options = ClaudeAdapterV2.makeClaudeQueryOptions({
+      modelSelection: CLAUDE_TEST_MODEL_SELECTION,
+      nativeThreadId: "native-add-dir",
+      resume: false,
+      cwd: "/workspace",
+      attachmentsDir: "/attachments",
+      settings: {
+        ...AUTO_COMPACT_CLAUDE_SETTINGS,
+        launchArgs: "--add-dir ../apps ../lib --verbose --add-dir=/shared",
+      },
+    });
+    assert.deepEqual(options.additionalDirectories, [
+      "/workspace",
+      "/attachments",
+      "../apps",
+      "../lib",
+      "/shared",
+    ]);
+    assert.isUndefined(options.extraArgs?.["add-dir"]);
+  });
+
   it("gives delegated children Claude's subagent prompt cache TTL", () => {
     const lineage = (relationshipToParent: "fork" | "subagent" | null) => ({
       lineage: {
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index b1273cee72061..496a0b2e77d0f 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -135,7 +135,10 @@ import {
   planClaudeSkillDispatch,
   type ClaudeSkillTarget,
 } from "../../provider/Drivers/ClaudeSkillDispatch.ts";
-import { discoverClaudeSkills } from "../../provider/Drivers/ClaudeSkills.ts";
+import {
+  claudeLaunchArgDirectories,
+  discoverClaudeSkills,
+} from "../../provider/Drivers/ClaudeSkills.ts";
 import {
   compileClaudeModelSelection,
   type CompiledClaudeModelSelection,
@@ -1473,6 +1476,8 @@ export function makeClaudeQueryOptions(input: {
 }): ClaudeAgentSdkQueryOptions {
   const compiledSelection = compileClaudeModelSelection(input.modelSelection);
   const {
+    // claudeLaunchArgDirectories reads every --add-dir into additionalDirectories.
+    "add-dir": _launchArgAddDir,
     "permission-mode": launchArgPermissionMode,
     "dangerously-skip-permissions": launchArgSkipPermissions,
     "append-system-prompt": launchArgAppendSystemPrompt,
@@ -1592,6 +1597,7 @@ export function makeClaudeQueryOptions(input: {
   const additionalDirectories = [
     ...(input.cwd === null ? [] : [input.cwd]),
     ...(input.attachmentsDir === undefined ? [] : [input.attachmentsDir]),
+    ...claudeLaunchArgDirectories(input.settings?.launchArgs),
   ];
   const withDirectories =
     additionalDirectories.length === 0 ? options : { ...options, additionalDirectories };
diff --git a/apps/server/src/provider/Drivers/ClaudeSkills.test.ts b/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
index 2897cc0b84282..860280aa91e89 100644
--- a/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
+++ b/apps/server/src/provider/Drivers/ClaudeSkills.test.ts
@@ -358,6 +358,8 @@ it.layer(NodeServices.layer)("discoverClaudeSkills", (it) => {
         '--add-dir "extra skills"',
         '--add-dir="extra skills"',
         `--add-dir missing --add-dir "${extraDir}"`,
+        `--add-dir "${extraDir}" --add-dir missing`,
+        `--add-dir missing "${extraDir}"`,
       ]) {
         const settings = { homePath: configDir, launchArgs };
         const skills = yield* discoverClaudeSkills(settings, workspace);
diff --git a/apps/server/src/provider/Drivers/ClaudeSkills.ts b/apps/server/src/provider/Drivers/ClaudeSkills.ts
index 56c2ff19bebdf..bc68e42b76a2a 100644
--- a/apps/server/src/provider/Drivers/ClaudeSkills.ts
+++ b/apps/server/src/provider/Drivers/ClaudeSkills.ts
@@ -5,7 +5,7 @@ import * as Path from "effect/Path";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as HostProcess from "@t3tools/shared/HostProcess";
-import { parseCliArgs } from "@t3tools/shared/cliArgs";
+import { tokenizeCliArgs } from "@t3tools/shared/cliArgs";
 import { fromLenientJson } from "@t3tools/shared/schemaJson";
 import { SKILL_MENTION_PATTERN } from "@t3tools/shared/composerInlineTokens";
 import { parse as parseYamlDocument } from "yaml";
@@ -427,6 +427,26 @@ const resolveClaudeConfigDirPath = Effect.fn("resolveClaudeConfigDirPath")(funct
   return path.join(home, ".claude");
 });
 
+// Claude's --add-dir is repeatable and variadic; parseCliArgs keeps only one value.
+export function claudeLaunchArgDirectories(launchArgs?: string): ReadonlyArray<string> {
+  const directories: string[] = [];
+  let collecting = false;
+  for (const token of tokenizeCliArgs(launchArgs)) {
+    if (token === "--") break;
+    if (token === "--add-dir") {
+      collecting = true;
+    } else if (token.startsWith("--add-dir=")) {
+      directories.push(token.slice("--add-dir=".length));
+      collecting = false;
+    } else if (token.startsWith("-")) {
+      collecting = false;
+    } else if (collecting) {
+      directories.push(token);
+    }
+  }
+  return directories;
+}
+
 /** First name wins, matching Claude Code's precedence of user skills over project skills. */
 export const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function* (
   config: Pick<ClaudeSettings, "homePath"> & Partial<Pick<ClaudeSettings, "launchArgs">>,
@@ -442,22 +462,15 @@ export const discoverClaudeSkills = Effect.fn("discoverClaudeSkills")(function*
     environment ?? process.env,
   );
 
-  const additionalDirectory = parseCliArgs(config.launchArgs ?? "").flags["add-dir"];
   const roots: ReadonlyArray<ClaudeSkillRoot> = [
     { directory: path.join(configDirPath, "skills"), scope: "user" },
     ...(cwd ? [{ directory: path.join(cwd, ".claude", "skills"), scope: "project" as const }] : []),
-    ...(additionalDirectory && (cwd || path.isAbsolute(additionalDirectory))
-      ? [
-          {
-            directory: path.join(
-              path.resolve(cwd ?? ".", additionalDirectory),
-              ".claude",
-              "skills",
-            ),
-            scope: "project" as const,
-          },
-        ]
-      : []),
+    ...claudeLaunchArgDirectories(config.launchArgs)
+      .filter((directory) => directory && (cwd || path.isAbsolute(directory)))
+      .map((directory) => ({
+        directory: path.join(path.resolve(cwd ?? ".", directory), ".claude", "skills"),
+        scope: "project" as const,
+      })),
     ...(yield* discoverPluginSkillRoots(
       configDirPath,
       cwd,

From 4b7a347ca9372aea7e2cc93d8b2835cdf34f69eb Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:57:51 -0500
Subject: [PATCH 070/146] fix(composer): retry expired catalogs after failed
 discovery (#23174)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../client-runtime/src/providerSkills.test.ts | 57 +++++++++++++++++++
 packages/client-runtime/src/providerSkills.ts | 21 +++++--
 2 files changed, 73 insertions(+), 5 deletions(-)

diff --git a/packages/client-runtime/src/providerSkills.test.ts b/packages/client-runtime/src/providerSkills.test.ts
index 7539861026165..ccc5bf6ef2807 100644
--- a/packages/client-runtime/src/providerSkills.test.ts
+++ b/packages/client-runtime/src/providerSkills.test.ts
@@ -199,6 +199,63 @@ describe("provider workspace snapshot refresh atom", () => {
     unmount();
   });
 
+  it.each(["already expired", "expires during discovery"])(
+    "retries an unchanged catalog that %s after the short cooldown",
+    async (expiry) => {
+      const start = Date.parse("2026-01-01T00:05:00.000Z");
+      vi.useFakeTimers({ now: expiry === "expires during discovery" ? start - 1 : start });
+      const stale = withSnapshot("2026-01-01T00:00:00.000Z");
+      const { registry, atom, responses, run, unmount } = setup(
+        expiry === "expires during discovery"
+          ? withSnapshot("2026-01-01T00:00:00.000Z", true)
+          : stale,
+        [
+          () => {
+            if (expiry === "expires during discovery") vi.setSystemTime(start + 1);
+            return stale;
+          },
+        ],
+      );
+      await vi.advanceTimersByTimeAsync(0);
+      await vi.advanceTimersByTimeAsync(9_999);
+      registry.refresh(atom);
+      expect(run).toHaveBeenCalledTimes(1);
+      responses.push(() => withSnapshot("2026-01-01T00:05:10.000Z"));
+      await vi.advanceTimersByTimeAsync(1);
+      registry.refresh(atom);
+      expect(run).toHaveBeenCalledTimes(2);
+      unmount();
+    },
+  );
+
+  it("keeps the TTL guard for a newly scanned catalog when the client clock is ahead", async () => {
+    vi.useFakeTimers({ now: Date.parse("2026-01-01T01:00:00.000Z") });
+    const { registry, atom, run, unmount } = setup(withSnapshot("2026-01-01T00:00:00.000Z"), [
+      () => withSnapshot("2026-01-01T00:01:00.000Z"),
+    ]);
+    await vi.advanceTimersByTimeAsync(10_000);
+    registry.refresh(atom);
+    expect(run).toHaveBeenCalledTimes(1);
+    unmount();
+  });
+
+  it("bounds retries when discovery repeatedly returns the same expired catalog", async () => {
+    vi.useFakeTimers({ now: Date.parse("2026-01-01T00:05:00.000Z") });
+    const stale = withSnapshot("2026-01-01T00:00:00.000Z");
+    const { registry, atom, run, unmount } = setup(stale, [() => stale, () => stale, () => stale]);
+    await vi.advanceTimersByTimeAsync(0);
+    await vi.advanceTimersByTimeAsync(10_000);
+    registry.refresh(atom);
+    await vi.advanceTimersByTimeAsync(0);
+    await vi.advanceTimersByTimeAsync(10_000);
+    registry.refresh(atom);
+    await vi.advanceTimersByTimeAsync(0);
+    await vi.advanceTimersByTimeAsync(10_000);
+    registry.refresh(atom);
+    expect(run).toHaveBeenCalledTimes(3);
+    unmount();
+  });
+
   it("does not rescan a current snapshot, and rescans once it ages past the TTL", () => {
     vi.useFakeTimers({ now: Date.parse("2026-01-01T00:01:00.000Z") });
     const { registry, atom, run, unmount } = setup(withSnapshot("2026-01-01T00:00:00.000Z"));
diff --git a/packages/client-runtime/src/providerSkills.ts b/packages/client-runtime/src/providerSkills.ts
index e0e15450669f8..63ded7a47dc5c 100644
--- a/packages/client-runtime/src/providerSkills.ts
+++ b/packages/client-runtime/src/providerSkills.ts
@@ -144,7 +144,7 @@ interface ProviderWorkspaceSnapshotRefreshState {
   readonly requestedAt: number | null;
   /** A failed scan is not retried before this time. */
   readonly retryNotBefore: number | null;
-  /** Scans in a row that ended without a complete snapshot. */
+  /** Failed scans within the current request TTL. */
   readonly failedAttempts: number;
   readonly hadSnapshot: boolean;
 }
@@ -183,8 +183,10 @@ function planProviderWorkspaceSnapshotRefresh(
   const state = {
     requestedAt,
     retryNotBefore,
-    // A complete snapshot ends the run of failures.
-    failedAttempts: hasSnapshot ? 0 : previous.failedAttempts,
+    failedAttempts:
+      lost || (requestedAt !== null && now - requestedAt >= PROVIDER_WORKSPACE_SNAPSHOT_TTL_MS)
+        ? 0
+        : previous.failedAttempts,
     hadSnapshot: hasSnapshot,
   };
   const refresh =
@@ -305,9 +307,18 @@ export function createProviderWorkspaceSnapshotRefreshAtomFamily(input: {
           { environmentId, input: { instanceId, cwd } },
           { reportFailure: false },
         ).then((result) => {
+          const refreshedProvider =
+            result._tag === "Success" ? findProvider(result.value.providers) : undefined;
+          const snapshot =
+            refreshedProvider && resolveProviderWorkspaceSnapshot(refreshedProvider, cwd);
+          // A new server timestamp proves progress even when the client clock is ahead.
+          // @effect-diagnostics-next-line globalDate:off
+          const completedAt = Date.now();
           const refreshed =
-            result._tag === "Success" &&
-            hasCompleteProviderWorkspaceSnapshot(findProvider(result.value.providers), cwd);
+            hasCompleteProviderWorkspaceSnapshot(refreshedProvider, cwd) &&
+            (hasCurrentProviderWorkspaceSnapshot(refreshedProvider, cwd, completedAt) ||
+              snapshot?.checkedAt !==
+                (provider && resolveProviderWorkspaceSnapshot(provider, cwd))?.checkedAt);
           if (!refreshed) retryLater();
         }, retryLater);
         return plan.state;

From 7860ee983d81d287eaf15664ffd92dc6964d92cc Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:58:14 +0000
Subject: [PATCH 071/146] fix(auth): preserve pairing codes after scope
 rejection (#25222)

Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com>
---
 apps/server/src/auth/EnvironmentAuth.test.ts  | 29 +++++++++++++++++++
 apps/server/src/auth/EnvironmentAuth.ts       | 15 ++++++----
 apps/server/src/auth/McpOAuth.test.ts         |  3 +-
 apps/server/src/auth/PairingGrantStore.ts     | 15 +++++++---
 .../src/persistence/AuthPairingLinks.ts       | 17 ++++++++++-
 5 files changed, 67 insertions(+), 12 deletions(-)

diff --git a/apps/server/src/auth/EnvironmentAuth.test.ts b/apps/server/src/auth/EnvironmentAuth.test.ts
index 8558a6664c8a6..bd5d3b569958f 100644
--- a/apps/server/src/auth/EnvironmentAuth.test.ts
+++ b/apps/server/src/auth/EnvironmentAuth.test.ts
@@ -377,6 +377,35 @@ it.layer(NodeServices.layer)("EnvironmentAuth.layer", (it) => {
     }).pipe(Effect.provide(layerEnvironmentAuth())),
   );
 
+  it.effect(
+    "preserves a rejected MCP pairing code for exactly one concurrent lower-access retry",
+    () =>
+      Effect.gen(function* () {
+        const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
+        const pairing = yield* serverAuth.issuePairingCredential({
+          scopes: ["orchestration:read"],
+        });
+
+        const rejected = yield* Effect.flip(
+          serverAuth.consumeMcpApprovalCode(pairing.credential, "full-access"),
+        );
+        expect(rejected).toMatchObject({
+          _tag: "ServerAuthMcpApprovalCodeError",
+          reason: "insufficient_scope",
+        });
+
+        const retry = Effect.result(
+          serverAuth.consumeMcpApprovalCode(pairing.credential, "read-only"),
+        );
+        const results = yield* Effect.all([retry, retry], { concurrency: "unbounded" });
+
+        expect(results.filter((result) => result._tag === "Success")).toHaveLength(1);
+        expect(results.filter((result) => result._tag === "Failure")).toMatchObject([
+          { failure: { _tag: "ServerAuthMcpApprovalCodeError", reason: "unknown_or_used" } },
+        ]);
+      }).pipe(Effect.provide(layerEnvironmentAuth())),
+  );
+
   it.effect("narrows seeded desktop grants to the requested scopes", () =>
     Effect.gen(function* () {
       const serverAuth = yield* EnvironmentAuth.EnvironmentAuth;
diff --git a/apps/server/src/auth/EnvironmentAuth.ts b/apps/server/src/auth/EnvironmentAuth.ts
index 3fbe5a0061c0e..7d73e65925228 100644
--- a/apps/server/src/auth/EnvironmentAuth.ts
+++ b/apps/server/src/auth/EnvironmentAuth.ts
@@ -429,7 +429,7 @@ export class ServerAuthMcpApprovalCodeError extends Schema.TaggedError<ServerAut
 ) {
   override get message(): string {
     return this.reason === "insufficient_scope"
-      ? "That pairing code cannot grant this access, and it is now used up. Create one with the standard scopes, or choose Read only with a new code."
+      ? "That pairing code cannot grant this access. It has not been used, so choose an access level it grants, or create a code with the standard scopes."
       : this.reason === "not_a_pairing_code"
         ? "That is not a one-time pairing code."
         : "That pairing code is unknown, expired, or already used.";
@@ -902,6 +902,7 @@ export const make = Effect.gen(function* () {
     input?: {
       readonly proofKeyThumbprint?: string;
       readonly requestedScopes?: ReadonlyArray<AuthEnvironmentScope>;
+      readonly requiredScopes?: ReadonlyArray<AuthEnvironmentScope>;
     },
   ): Effect.Effect<
     ResolvedBootstrapGrant,
@@ -920,6 +921,12 @@ export const make = Effect.gen(function* () {
     }
     return sessions.verify(credential).pipe(
       mapSessionVerificationErrors,
+      Effect.filterOrFail(
+        (session) =>
+          input?.requiredScopes === undefined ||
+          input.requiredScopes.every((scope) => session.scopes.includes(scope)),
+        () => new ServerAuthScopeNotGrantedError({}),
+      ),
       Effect.map(
         (session) =>
           ({
@@ -1340,7 +1347,7 @@ export const make = Effect.gen(function* () {
     code,
     access,
   ) =>
-    resolveBootstrapGrant(code.trim()).pipe(
+    resolveBootstrapGrant(code.trim(), { requiredScopes: mcpClientScopes(access) }).pipe(
       Effect.catchTags({
         ServerAuthInvalidCredentialError: () =>
           Effect.fail(new ServerAuthMcpApprovalCodeError({ reason: "unknown_or_used" })),
@@ -1350,9 +1357,7 @@ export const make = Effect.gen(function* () {
       Effect.flatMap((grant) =>
         grant.method !== "one-time-token" && grant.method !== "reusable-dev-token"
           ? Effect.fail(new ServerAuthMcpApprovalCodeError({ reason: "not_a_pairing_code" }))
-          : mcpClientScopes(access).every((scope) => grant.scopes.includes(scope))
-            ? Effect.void
-            : Effect.fail(new ServerAuthMcpApprovalCodeError({ reason: "insufficient_scope" })),
+          : Effect.void,
       ),
       Effect.withSpan("EnvironmentAuth.consumeMcpApprovalCode"),
     );
diff --git a/apps/server/src/auth/McpOAuth.test.ts b/apps/server/src/auth/McpOAuth.test.ts
index 3dc35aca981b9..29588040217ae 100644
--- a/apps/server/src/auth/McpOAuth.test.ts
+++ b/apps/server/src/auth/McpOAuth.test.ts
@@ -457,11 +457,10 @@ it.live(
         });
         expect(operatorFull.status).toBe(400);
 
-        const readOnlyCode = yield* auth.issuePairingCredential({ scopes: ["orchestration:read"] });
         const readOnlyApproval = yield* decide(handler, params, {
           _tag: "pairing-code",
           access: "read-only",
-          code: readOnlyCode.credential,
+          code: readOnly.credential,
         });
         expect(readOnlyApproval.status).toBe(200);
         const readOnlyToken = yield* handler(
diff --git a/apps/server/src/auth/PairingGrantStore.ts b/apps/server/src/auth/PairingGrantStore.ts
index 440dbe3788a45..0709f371684fb 100644
--- a/apps/server/src/auth/PairingGrantStore.ts
+++ b/apps/server/src/auth/PairingGrantStore.ts
@@ -226,6 +226,8 @@ export class PairingGrantStore extends Context.Service<
       input?: {
         readonly proofKeyThumbprint?: string;
         readonly requestedScopes?: ReadonlyArray<AuthEnvironmentScope>;
+        /** All scopes must be granted; requestedScopes only requires an overlap for OAuth. */
+        readonly requiredScopes?: ReadonlyArray<AuthEnvironmentScope>;
       },
     ) => Effect.Effect<BootstrapGrant, BootstrapCredentialError>;
   }
@@ -486,8 +488,10 @@ const make = Effect.gen(function* () {
           }
 
           if (
-            input?.requestedScopes !== undefined &&
-            !input.requestedScopes.some((scope) => grant.scopes.includes(scope))
+            (input?.requestedScopes !== undefined &&
+              !input.requestedScopes.some((scope) => grant.scopes.includes(scope))) ||
+            (input?.requiredScopes !== undefined &&
+              !input.requiredScopes.every((scope) => grant.scopes.includes(scope)))
           ) {
             return [
               {
@@ -550,6 +554,7 @@ const make = Effect.gen(function* () {
           ...(input?.requestedScopes !== undefined
             ? { requestedScopes: input.requestedScopes }
             : {}),
+          ...(input?.requiredScopes !== undefined ? { requiredScopes: input.requiredScopes } : {}),
           consumedAt: now,
           now,
         })
@@ -596,8 +601,10 @@ const make = Effect.gen(function* () {
       }
 
       if (
-        input?.requestedScopes !== undefined &&
-        !input.requestedScopes.some((scope) => matching.value.scopes.includes(scope))
+        (input?.requestedScopes !== undefined &&
+          !input.requestedScopes.some((scope) => matching.value.scopes.includes(scope))) ||
+        (input?.requiredScopes !== undefined &&
+          !input.requiredScopes.every((scope) => matching.value.scopes.includes(scope)))
       ) {
         return yield* new BootstrapCredentialScopeNotGrantedError({});
       }
diff --git a/apps/server/src/persistence/AuthPairingLinks.ts b/apps/server/src/persistence/AuthPairingLinks.ts
index 4e2d572bd96b4..8754bdbd2edcd 100644
--- a/apps/server/src/persistence/AuthPairingLinks.ts
+++ b/apps/server/src/persistence/AuthPairingLinks.ts
@@ -48,6 +48,7 @@ export const ConsumeAuthPairingLinkInput = Schema.Struct({
   credential: Schema.String,
   proofKeyThumbprint: Schema.NullOr(Schema.String),
   requestedScopes: Schema.optionalKey(AuthEnvironmentScopes),
+  requiredScopes: Schema.optionalKey(AuthEnvironmentScopes),
   consumedAt: Schema.DateTimeUtcFromString,
   now: Schema.DateTimeUtcFromString,
 });
@@ -161,7 +162,14 @@ export const make = Effect.gen(function* () {
   const consumeAvailablePairingLinkRow = SqlSchema.findOneOption({
     Request: ConsumeAuthPairingLinkInput,
     Result: AuthPairingLinkRawDbRow,
-    execute: ({ credential, proofKeyThumbprint, requestedScopes, consumedAt, now }) =>
+    execute: ({
+      credential,
+      proofKeyThumbprint,
+      requestedScopes,
+      requiredScopes,
+      consumedAt,
+      now,
+    }) =>
       sql`
         UPDATE auth_pairing_links
         SET consumed_at = ${consumedAt}
@@ -180,6 +188,13 @@ export const make = Effect.gen(function* () {
               SELECT value FROM json_each(auth_pairing_links.scopes)
             )
           ))
+          AND NOT EXISTS (
+            SELECT 1
+            FROM json_each(${JSON.stringify(requiredScopes ?? [])}) AS required
+            WHERE required.value NOT IN (
+              SELECT value FROM json_each(auth_pairing_links.scopes)
+            )
+          )
         RETURNING
           id AS "id",
           credential AS "credential",

From 04f35381b65015f5204c2ceb11a94ba931a38fea Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 17:58:36 +0000
Subject: [PATCH 072/146] fix(mobile): discard unchanged queued edits after
 starting (#25232)

Co-authored-by: Tristan Knight <18444302+tris203@users.noreply.github.com>
---
 apps/mobile/src/state/queued-run-edit.test.ts | 80 ++++++++++++++++++-
 1 file changed, 78 insertions(+), 2 deletions(-)

diff --git a/apps/mobile/src/state/queued-run-edit.test.ts b/apps/mobile/src/state/queued-run-edit.test.ts
index 361a743ac71b5..6670505ad3988 100644
--- a/apps/mobile/src/state/queued-run-edit.test.ts
+++ b/apps/mobile/src/state/queued-run-edit.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vite-plus/test";
+import { describe, expect, it, vi } from "vite-plus/test";
 import { Atom } from "effect/reactivity";
 import {
   ChatAttachmentId,
@@ -20,7 +20,25 @@ import {
   type QueuedRunEdit,
 } from "./queued-run-edit";
 import { threadComposerErrorsAtom } from "./thread-composer-error";
-import { getComposerDraftSnapshot, setComposerDraftText } from "./use-composer-drafts";
+import {
+  flushComposerDrafts,
+  getComposerDraftSnapshot,
+  setComposerDraftText,
+  waitForComposerDraftsLoaded,
+} from "./use-composer-drafts";
+
+vi.mock("expo-file-system", () => ({
+  Directory: class {
+    create() {}
+  },
+  File: class {
+    exists = false;
+    create() {}
+    write() {}
+    moveSync() {}
+  },
+  Paths: { document: { uri: "file:///documents" } },
+}));
 
 const image = (id: string): ChatAttachment => ({
   type: "image",
@@ -94,6 +112,64 @@ describe("resolveQueuedEditPayload", () => {
 });
 
 describe("beginQueuedRunEdit", () => {
+  it("silently drops an untouched edit when its run starts", () => {
+    const threadKey = "env-exit:thread-untouched";
+    const runId = RunId.make("run-1");
+    const runs = Atom.make<ReadonlyArray<{ readonly id: RunId; readonly status: string }> | null>([
+      { id: runId, status: "queued" },
+    ]);
+    beginQueuedRunEdit(threadKey, edit([]), runs);
+
+    appAtomRegistry.set(runs, [{ id: runId, status: "running" }]);
+
+    expect(getQueuedRunEdit(threadKey)).toBeNull();
+    expect(getComposerDraftSnapshot(threadKey).text).toBe("");
+    expect(getComposerDraftSnapshot(queuedEditDraftKey(threadKey, runId)).text).toBe("");
+    expect(appAtomRegistry.get(threadComposerErrorsAtom)[threadKey]?.message).toBeUndefined();
+  });
+
+  it("recovers text after a server attachment was removed", async () => {
+    await waitForComposerDraftsLoaded();
+    const threadKey = "env-exit:thread-removed-recover";
+    const runId = RunId.make("run-1");
+    const runs = Atom.make<ReadonlyArray<{ readonly id: RunId; readonly status: string }> | null>([
+      { id: runId, status: "queued" },
+    ]);
+    beginQueuedRunEdit(threadKey, edit([image("removed")]), runs);
+    removeQueuedRunEditAttachment(threadKey, "removed");
+
+    appAtomRegistry.set(runs, [{ id: runId, status: "running" }]);
+    await flushComposerDrafts();
+
+    expect(getQueuedRunEdit(threadKey)).toBeNull();
+    expect(getComposerDraftSnapshot(threadKey).text).toBe("original");
+    expect(getComposerDraftSnapshot(queuedEditDraftKey(threadKey, runId)).text).toBe("");
+    expect(appAtomRegistry.get(threadComposerErrorsAtom)[threadKey]?.message).toBe(
+      "That message already started. Your edit is back in the composer.",
+    );
+  });
+
+  it("recovers changed text into an empty thread draft", async () => {
+    await waitForComposerDraftsLoaded();
+    const threadKey = "env-exit:thread-changed-recover";
+    const runId = RunId.make("run-1");
+    const runs = Atom.make<ReadonlyArray<{ readonly id: RunId; readonly status: string }> | null>([
+      { id: runId, status: "queued" },
+    ]);
+    beginQueuedRunEdit(threadKey, edit([]), runs);
+    setComposerDraftText(queuedEditDraftKey(threadKey, runId), "revised");
+
+    appAtomRegistry.set(runs, [{ id: runId, status: "running" }]);
+    await flushComposerDrafts();
+
+    expect(getQueuedRunEdit(threadKey)).toBeNull();
+    expect(getComposerDraftSnapshot(threadKey).text).toBe("revised");
+    expect(getComposerDraftSnapshot(queuedEditDraftKey(threadKey, runId)).text).toBe("");
+    expect(appAtomRegistry.get(threadComposerErrorsAtom)[threadKey]?.message).toBe(
+      "That message already started. Your edit is back in the composer.",
+    );
+  });
+
   it("ends a changed edit when its run starts, without the thread's composer mounted", () => {
     const threadKey = "env-exit:thread-exit";
     const runId = RunId.make("run-1");

From b7c7a7819a9bd144072cb8ea11b4896cf435473d Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:58:59 -0500
Subject: [PATCH 073/146] fix(server): t3 project commands wait for a busy
 server's reply (#24090)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/cli/project.test.ts | 67 +++++++++++++++++++++++++++++
 apps/server/src/cli/project.ts      | 23 +++++-----
 2 files changed, 78 insertions(+), 12 deletions(-)

diff --git a/apps/server/src/cli/project.test.ts b/apps/server/src/cli/project.test.ts
index 40a7ab7113839..723f5254e7a2c 100644
--- a/apps/server/src/cli/project.test.ts
+++ b/apps/server/src/cli/project.test.ts
@@ -18,11 +18,14 @@ import {
 import * as NetService from "@t3tools/shared/Net";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as References from "effect/References";
 import * as Stream from "effect/Stream";
 import { Command } from "effect/cli";
+import { FetchHttpClient } from "effect/http";
+import * as TestClock from "effect/testing/TestClock";
 
 import * as ServerSecretStore from "../auth/ServerSecretStore.ts";
 import { cli } from "../binCli.ts";
@@ -37,6 +40,10 @@ import * as ProjectFaviconResolver from "../project/ProjectFaviconResolver.ts";
 import * as ProjectService from "../project/ProjectService.ts";
 import * as RepositoryIdentityResolver from "../project/RepositoryIdentityResolver.ts";
 import * as T3ProjectFileLoader from "../project/T3ProjectFileLoader.ts";
+import {
+  makePersistedServerRuntimeState,
+  persistServerRuntimeState,
+} from "../serverRuntimeState.ts";
 import * as ServerSettings from "../serverSettings.ts";
 import * as WorkspacePaths from "../workspace/WorkspacePaths.ts";
 
@@ -121,6 +128,66 @@ it.effect("adds, renames, and removes projects through the V2 project CLI domain
   }).pipe(Effect.provide(NodeServices.layer)),
 );
 
+it.effect.each(["snapshot", "mutation"] as const)(
+  "waits for a busy live server's %s response",
+  (slowRequest) =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-live-project-cli-" });
+      const baseDir = NodePath.join(root, "state");
+      const workspaceRoot = NodePath.join(root, "workspace");
+      yield* fs.makeDirectory(workspaceRoot);
+      yield* persistServerRuntimeState({
+        path: NodePath.join(baseDir, "userdata", "server-runtime.json"),
+        state: yield* makePersistedServerRuntimeState({
+          config: { host: "127.0.0.1", devUrl: undefined },
+          port: 3_773,
+        }),
+      });
+      const now = "2026-01-01T00:00:00.000Z";
+      const requestReceived = Promise.withResolvers<void>();
+      const releaseResponse = Promise.withResolvers<void>();
+      let snapshotRequests = 0;
+      let mutations = 0;
+      const fetch: typeof globalThis.fetch = async (_input, init) => {
+        const isMutation = init?.method === "POST";
+        if (isMutation) mutations++;
+        else snapshotRequests++;
+        if (slowRequest === "mutation" ? isMutation : !isMutation && snapshotRequests === 2) {
+          requestReceived.resolve();
+          await releaseResponse.promise;
+        }
+        return Response.json(
+          isMutation
+            ? {
+                id: "live-project",
+                title: NodePath.basename(workspaceRoot),
+                workspaceRoot,
+                defaultModelSelection: null,
+                scripts: [],
+                createdAt: now,
+                updatedAt: now,
+                deletedAt: null,
+              }
+            : { projects: [], updatedAt: now },
+        );
+      };
+
+      const add = yield* runCli(["project", "add", workspaceRoot, "--base-dir", baseDir]).pipe(
+        Effect.provideService(FetchHttpClient.Fetch, fetch),
+        Effect.forkChild,
+      );
+      yield* Effect.promise(() => requestReceived.promise);
+      yield* TestClock.adjust("2 seconds");
+      releaseResponse.resolve();
+      yield* Fiber.join(add);
+
+      assert.equal(snapshotRequests, 2);
+      assert.equal(mutations, 1);
+      assert.deepEqual((yield* readProjects(baseDir)).projects, []);
+    }).pipe(Effect.provide(NodeServices.layer), Effect.scoped),
+);
+
 const makeProjectLookupFixture = Effect.fn("ProjectCliTest.makeProjectLookupFixture")(function* () {
   const fs = yield* FileSystem.FileSystem;
   const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-v2-project-lookup-" });
diff --git a/apps/server/src/cli/project.ts b/apps/server/src/cli/project.ts
index a5c8aa532ff3e..3d02f9c921fce 100644
--- a/apps/server/src/cli/project.ts
+++ b/apps/server/src/cli/project.ts
@@ -214,7 +214,8 @@ const layerProjectCliRuntime = RuntimeLayer.layerProjectService.pipe(
   Layer.provideMerge(SqlitePersistence.layerConfig),
 );
 
-const PROJECT_CLI_LIVE_SERVER_TIMEOUT = Duration.seconds(1);
+const PROJECT_CLI_LIVE_SERVER_PROBE_TIMEOUT = Duration.seconds(1);
+const PROJECT_CLI_LIVE_SERVER_REQUEST_TIMEOUT = Duration.seconds(10);
 const withProjectCliSessionToken = <A, E, R>(
   environmentAuth: EnvironmentAuth.EnvironmentAuth["Service"],
   run: (token: string) => Effect.Effect<A, E, R>,
@@ -228,9 +229,6 @@ const withProjectCliSessionToken = <A, E, R>(
     (issued) => environmentAuth.revokeSession(issued.sessionId).pipe(Effect.ignore({ log: true })),
   );
 
-const withProjectCliLiveServerTimeout = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
-  effect.pipe(Effect.timeout(PROJECT_CLI_LIVE_SERVER_TIMEOUT));
-
 const makeLiveServerClient = (origin: string) =>
   HttpApiClient.make(EnvironmentHttpApi, {
     baseUrl: origin,
@@ -317,17 +315,14 @@ const findActiveProjectTarget = Effect.fn("findActiveProjectTarget")(function* (
 });
 
 const fetchLiveOrchestrationSnapshot = Effect.fn("project.fetchLiveOrchestrationSnapshot")(
-  function* (origin: string, bearerToken: string) {
+  function* (origin: string, bearerToken: string, _timeout?: Duration.Duration) {
     const client = yield* makeLiveServerClient(origin);
     return yield* client.projects.snapshot({
       headers: { authorization: `Bearer ${bearerToken}` },
     });
   },
-  (effect, _origin, _bearerToken) =>
-    effect.pipe(
-      withProjectCliLiveServerTimeout,
-      Effect.mapError(projectCommandErrorFromLiveServerRequest),
-    ),
+  (effect, _origin, _bearerToken, timeout = PROJECT_CLI_LIVE_SERVER_REQUEST_TIMEOUT) =>
+    effect.pipe(Effect.timeout(timeout), Effect.mapError(projectCommandErrorFromLiveServerRequest)),
 );
 
 const dispatchLiveOrchestrationCommand = Effect.fn("project.dispatchLiveOrchestrationCommand")(
@@ -340,7 +335,7 @@ const dispatchLiveOrchestrationCommand = Effect.fn("project.dispatchLiveOrchestr
   },
   (effect, _origin, _bearerToken, _command) =>
     effect.pipe(
-      withProjectCliLiveServerTimeout,
+      Effect.timeout(PROJECT_CLI_LIVE_SERVER_REQUEST_TIMEOUT),
       Effect.mapError(projectCommandErrorFromLiveServerRequest),
     ),
 );
@@ -361,7 +356,11 @@ const tryResolveLiveProjectExecutionMode = Effect.fn("tryResolveLiveProjectExecu
     }
 
     const attempt = withProjectCliSessionToken(environmentAuth, (token) =>
-      fetchLiveOrchestrationSnapshot(runtimeState.value.origin, token).pipe(
+      fetchLiveOrchestrationSnapshot(
+        runtimeState.value.origin,
+        token,
+        PROJECT_CLI_LIVE_SERVER_PROBE_TIMEOUT,
+      ).pipe(
         Effect.as({
           origin: runtimeState.value.origin,
         }),

From 9d38d68d0437da92966866a789164a135af5c050 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:59:21 -0500
Subject: [PATCH 074/146] fix(web): wait for fresh diff pages in review guides
 (#23225)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../guide/useGuideDiffFiles.browser.test.tsx  | 70 +++++++++++++++++++
 .../pullRequest/guide/useGuideDiffFiles.ts    |  2 +-
 .../client-runtime/src/state/runtime.test.ts  | 29 ++++++++
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 apps/web/src/components/pullRequest/guide/useGuideDiffFiles.browser.test.tsx

diff --git a/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.browser.test.tsx b/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.browser.test.tsx
new file mode 100644
index 0000000000000..cdb7d4099e5c7
--- /dev/null
+++ b/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.browser.test.tsx
@@ -0,0 +1,70 @@
+import { RegistryContext } from "@effect/atom-react";
+import { EnvironmentId, ProjectId, type PullRequestDiffResult } from "@t3tools/contracts";
+import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
+import { expect, it, vi } from "vite-plus/test";
+
+import { act, render } from "../../../../test/render";
+
+const state = vi.hoisted(() => ({
+  pages: new Map<string | null, Atom.Writable<AsyncResult.AsyncResult<PullRequestDiffResult>>>(),
+}));
+vi.mock("~/state/pullRequests", () => ({
+  pullRequestEnvironment: {
+    diff: ({ input }: { input: { cursor?: string } }) => state.pages.get(input.cursor ?? null)!,
+  },
+}));
+
+import { useGuideDiffFiles } from "./useGuideDiffFiles";
+
+function Probe({ wantedPaths }: { wantedPaths: string[] }) {
+  const diff = useGuideDiffFiles({
+    environmentId: EnvironmentId.make("test"),
+    reference: { projectId: ProjectId.make("project"), repository: "owner/repo", number: 1 },
+    headSha: "new-head",
+    wantedPaths,
+  });
+  return (
+    <output>
+      {JSON.stringify({
+        loading: diff.loading,
+        files: [...diff.files].map(([path, file]) => [path, file.additionLines.join("")]),
+      })}
+    </output>
+  );
+}
+
+function page(path: string, value: string, nextCursor: string | null): PullRequestDiffResult {
+  return {
+    patch: `diff --git a/${path} b/${path}\n--- a/${path}\n+++ b/${path}\n@@ -1 +1 @@\n-old\n+${value}\n`,
+    truncated: false,
+    nextCursor,
+  };
+}
+
+it.each([
+  { name: "contains the requested file", path: "wanted.ts", cursor: null },
+  { name: "ends before a newly added file", path: "other.ts", cursor: null },
+  { name: "has an obsolete next cursor", path: "other.ts", cursor: "old-next" },
+])("waits for a cached page that $name to settle", async ({ path, cursor }) => {
+  state.pages.clear();
+  await using stack = new AsyncDisposableStack();
+  const registry = stack.adopt(AtomRegistry.make(), (value) => value.dispose());
+  const first = Atom.make<AsyncResult.AsyncResult<PullRequestDiffResult>>(
+    AsyncResult.success(page(path, "STALE", cursor), { waiting: true }),
+  );
+  state.pages.set(null, first);
+  state.pages.set(
+    "old-next",
+    Atom.make<AsyncResult.AsyncResult<PullRequestDiffResult>>(AsyncResult.initial(true)),
+  );
+  await using screen = await render(
+    <RegistryContext.Provider value={registry}>
+      <Probe wantedPaths={["wanted.ts"]} />
+    </RegistryContext.Provider>,
+  );
+  const result = () => JSON.parse(screen.container.querySelector("output")!.textContent!);
+  expect(result()).toEqual({ loading: true, files: [] });
+
+  await act(() => registry.set(first, AsyncResult.success(page("wanted.ts", "FRESH", null))));
+  expect(result()).toEqual({ loading: false, files: [["wanted.ts", "FRESH"]] });
+});
diff --git a/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.ts b/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.ts
index c905488949cff..21765c68d18e8 100644
--- a/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.ts
+++ b/apps/web/src/components/pullRequest/guide/useGuideDiffFiles.ts
@@ -51,7 +51,7 @@ export function useGuideDiffFiles({
   );
 
   const data = query.data;
-  if (data !== null && !current.done && current.folded !== data) {
+  if (data !== null && !query.isPending && !current.done && current.folded !== data) {
     const parsed = getRenderablePatch(
       data.patch,
       `pull-request-guide:${key}:${current.cursor ?? "first"}`,
diff --git a/packages/client-runtime/src/state/runtime.test.ts b/packages/client-runtime/src/state/runtime.test.ts
index 963b3a7bfdeb7..519ccd025b070 100644
--- a/packages/client-runtime/src/state/runtime.test.ts
+++ b/packages/client-runtime/src/state/runtime.test.ts
@@ -1212,6 +1212,35 @@ describe("runtime command runner", () => {
 });
 
 describe("persisted environment queries", () => {
+  it.effect("keeps an in-memory cached page pending until revalidation settles", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const refreshStarted = Latch.makeUnsafe();
+        const finishRefresh = Latch.makeUnsafe();
+        let executions = 0;
+        const harness = yield* makeEnvironmentQueryHarness(
+          Effect.suspend(() => {
+            if (++executions === 1) return Effect.succeed("cached");
+            refreshStarted.openUnsafe();
+            return finishRefresh.await.pipe(Effect.as("fresh"));
+          }),
+          { persistence: { load: () => Effect.succeedNone, save: () => Effect.void } },
+        );
+        const registry = yield* mountEnvironmentQuery(harness.atom);
+        expect(yield* readEnvironmentQuery(registry, harness.atom)).toBe("cached");
+        registry.refresh(harness.atom);
+        yield* refreshStarted.await;
+        expect(registry.get(harness.atom)).toMatchObject({
+          _tag: "Success",
+          value: "cached",
+          waiting: true,
+        });
+        finishRefresh.openUnsafe();
+        expect(yield* readEnvironmentQuery(registry, harness.atom)).toBe("fresh");
+      }),
+    ),
+  );
+
   it.effect(
     "restores cached data in a new registry while offline, then refreshes on reconnect",
     () =>

From 99ff58abe8507acc4a97abb89c6854c4e74fbd08 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 12:59:44 -0500
Subject: [PATCH 075/146] fix(server): Antigravity stops retrying session
 startup while signed out (#24939)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../Adapters/AntigravityAdapterV2.test.ts     | 59 +++++++++++++++++++
 .../Adapters/AntigravityAdapterV2.ts          |  2 +
 .../ProviderTurnStartService.test.ts          | 28 +++++++++
 .../ProviderTurnStartService.ts               | 10 +++-
 packages/provider-acp/src/server/adapter.ts   |  2 +
 .../src/server/ProviderAdapter.ts             |  1 +
 6 files changed, 101 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
index 90226cc68bd2a..0f5670f1d2de0 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts
@@ -24,6 +24,7 @@ import * as Path from "effect/Path";
 import * as Stream from "effect/Stream";
 import { ChildProcessSpawner } from "effect/process";
 import type * as EffectAcpSchema from "effect-acp/compat";
+import * as EffectAcpErrors from "effect-acp/errors";
 
 import * as ProviderHost from "@t3tools/provider-core/server/ProviderHost";
 import * as McpProviderSessions from "@t3tools/provider-core/server/McpProviderSessions";
@@ -32,6 +33,7 @@ import type * as AcpSessionRuntime from "@t3tools/provider-acp/server/AcpSession
 import { makeAntigravityAcpRuntime } from "../../provider/acp/AntigravityAcpSupport.ts";
 import { resolveAttachmentPath } from "../../attachmentStore.ts";
 import { normalizeAntigravitySessionUpdate } from "../../provider/acp/AntigravityProtocol.ts";
+import { ANTIGRAVITY_SIGN_IN_REQUIRED_MESSAGE } from "../../provider/antigravityAuthSupport.ts";
 import * as IdAllocator from "@t3tools/provider-core/server/IdAllocator";
 import * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
 import {
@@ -126,6 +128,63 @@ const layerSession = Layer.mergeAll(
   TestProviderHost.layer().pipe(Layer.provide(NodeServices.layer)),
 );
 
+describe("AntigravityAdapterV2 session open", () => {
+  it.effect.each([
+    {
+      name: "browser sign-in",
+      cause: new EffectAcpErrors.AcpTransportError({
+        detail: ANTIGRAVITY_SIGN_IN_REQUIRED_MESSAGE,
+        cause: undefined,
+      }),
+      requiresSignIn: true,
+    },
+    {
+      name: "ACP authentication required",
+      cause: EffectAcpErrors.AcpRequestError.authRequired(),
+      requiresSignIn: true,
+    },
+    {
+      name: "transport failure",
+      cause: new EffectAcpErrors.AcpTransportError({
+        detail: "Connection closed",
+        cause: undefined,
+      }),
+      requiresSignIn: undefined,
+    },
+  ] as const)("classifies $name during session open", ({ cause, requiresSignIn }) =>
+    Effect.gen(function* () {
+      const instanceId = ProviderInstanceId.make("antigravity-sign-in-test");
+      const adapter = yield* makeAntigravityAdapterV2({
+        instanceId,
+        selfInvocation: yield* resolveSelfInvocation(),
+        makeRuntime: () => Effect.fail(cause),
+        withProcess: (_stop, task) => task,
+        // @effect-diagnostics-next-line effectSucceedWithVoid:off - This optional result requires undefined, not the wider void type.
+        defaultModel: Effect.succeed(undefined),
+      });
+      const threadId = ThreadId.make("thread-antigravity-sign-in");
+      const error = yield* adapter
+        .openSession({
+          threadId,
+          providerSessionId: ProviderSessionId.make("provider-session-antigravity-sign-in"),
+          modelSelection: { instanceId, model: "gemini-test-low" },
+          runtimePolicy: ProviderAdapter.ProviderAdapterV2RuntimePolicy.make({
+            runtimeMode: "full-access",
+            interactionMode: "default",
+            cwd: process.cwd(),
+          }),
+        })
+        .pipe(Effect.flip);
+
+      assert.equal(error._tag, "ProviderAdapterOpenSessionError");
+      assert.equal(
+        error._tag === "ProviderAdapterOpenSessionError" && error.requiresSignIn,
+        requiresSignIn,
+      );
+    }).pipe(Effect.provide(layerSession), Effect.scoped),
+  );
+});
+
 describe("AntigravityAdapterV2 client file system", () => {
   it.effect("serves confined reads and leaves edits to the agent's diff tools", () =>
     Effect.gen(function* () {
diff --git a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
index 4d06da900f4a8..9ccaca83b542f 100644
--- a/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts
@@ -34,6 +34,7 @@ import {
   makeAntigravityUserInputResponse,
   normalizeAntigravityToolCall,
 } from "../../provider/acp/AntigravityProtocol.ts";
+import { isAntigravitySignInRequiredError } from "../../provider/antigravityAuthSupport.ts";
 import {
   AcpProviderCapabilitiesV2,
   makeAcpAdapterV2,
@@ -238,6 +239,7 @@ export function makeAntigravityAcpAdapterFlavor(
     extractSubagentUpdate: extractAntigravitySubagentUpdate,
     supportsImagePrompts: true,
     supportsCompaction: true,
+    requiresSignIn: isAntigravitySignInRequiredError,
   };
 }
 
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
index 7a922d79c7317..beaf7961e3782 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts
@@ -1304,6 +1304,34 @@ effectIt.effect("leaves the run starting when a session-open failure will be ret
   }),
 );
 
+effectIt.effect("fails the run without a retry when the provider needs sign-in", () =>
+  Effect.gen(function* () {
+    const harness = makeLocalCommandHarness({
+      text: "Continue",
+      openFailure: new ProviderAdapter.ProviderAdapterOpenSessionError({
+        driver: ProviderDriverKind.make("antigravity"),
+        providerSessionId: ProviderSessionId.make("new-provider-session"),
+        requiresSignIn: true,
+      }),
+    });
+
+    yield* harness.startWithRetry;
+
+    expect(harness.open).toHaveBeenCalledOnce();
+    expect(harness.projection().runs.at(-1)?.status).toBe("failed");
+    expect(harness.projection().turnItems).toMatchObject([
+      {
+        type: "error",
+        status: "failed",
+        failure: {
+          class: "provider_error",
+          message: "Failed to open antigravity provider session new-provider-session.",
+        },
+      },
+    ]);
+  }),
+);
+
 effectIt.effect("does not terminalize a provider-session open interruption", () =>
   Effect.gen(function* () {
     const harness = makeLocalCommandHarness({ text: "Continue", interruptOpen: true });
diff --git a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
index 94ba406b106f5..fad06732fb48e 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnStartService.ts
@@ -92,6 +92,9 @@ class WorktreeRecreateNoBaseError extends Schema.TaggedError<WorktreeRecreateNoB
 }
 
 const isProviderTurnStartError = Schema.is(ProviderTurnStartError);
+const isProviderAdapterOpenSessionError = Schema.is(
+  ProviderAdapter.ProviderAdapterOpenSessionError,
+);
 
 /**
  * Claude refuses these before it reads the prompt: replacing a process running background work,
@@ -732,7 +735,12 @@ export const layer: Layer.Layer<
         }),
       );
       if (sessionResult._tag === "Failure") {
-        if (input.willRetry === true) return yield* sessionResult.failure;
+        const failure = sessionResult.failure;
+        const requiresSignIn =
+          "cause" in failure &&
+          isProviderAdapterOpenSessionError(failure.cause) &&
+          failure.cause.requiresSignIn === true;
+        if (input.willRetry === true && !requiresSignIn) return yield* failure;
         yield* settleStartFailure({
           signal: "provider-session-open-failure",
           title: "Provider session failed to open",
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index 398eac2170e70..13f0cbbc240d5 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -224,6 +224,7 @@ export interface AcpAdapterV2Flavor {
     readonly promptCapabilities: EffectAcpSchema.AgentCapabilities["promptCapabilities"];
   }) => Effect.Effect<ReadonlyArray<EffectAcpSchema.ContentBlock>, EffectAcpErrors.AcpError>;
   readonly promptFailure?: (cause: unknown) => OrchestrationV2ProviderFailure;
+  readonly requiresSignIn?: (cause: unknown) => boolean;
   /**
    * Runs before attachment paths, T3 instructions and native slash-command detection,
    * so a rewrite can turn the user's text into a native command.
@@ -8555,6 +8556,7 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
               new ProviderAdapter.ProviderAdapterOpenSessionError({
                 driver,
                 providerSessionId: input.providerSessionId,
+                ...(flavor.requiresSignIn?.(cause) === true ? { requiresSignIn: true } : {}),
                 cause,
               }),
           ),
diff --git a/packages/provider-core/src/server/ProviderAdapter.ts b/packages/provider-core/src/server/ProviderAdapter.ts
index 9dc7ec1f62285..e168512736c7c 100644
--- a/packages/provider-core/src/server/ProviderAdapter.ts
+++ b/packages/provider-core/src/server/ProviderAdapter.ts
@@ -183,6 +183,7 @@ export class ProviderAdapterOpenSessionError extends Schema.TaggedError<Provider
   {
     driver: ProviderDriverKind,
     providerSessionId: ProviderSessionId,
+    requiresSignIn: Schema.optional(Schema.Literal(true)),
     cause: Schema.optional(Schema.Defect()),
   },
 ) {

From de386ada9ec392d52c2f5eed85c88f70475e6b57 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 13:00:06 -0500
Subject: [PATCH 076/146] fix(web): create tasks on a permitted connected
 environment (#23244)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../ScheduledTasksSettings.browser.test.tsx   | 79 ++++++++++++++++---
 .../settings/ScheduledTasksSettings.tsx       | 24 ++++--
 2 files changed, 87 insertions(+), 16 deletions(-)

diff --git a/apps/web/src/components/settings/ScheduledTasksSettings.browser.test.tsx b/apps/web/src/components/settings/ScheduledTasksSettings.browser.test.tsx
index e42242f01093e..124a27c7b11f4 100644
--- a/apps/web/src/components/settings/ScheduledTasksSettings.browser.test.tsx
+++ b/apps/web/src/components/settings/ScheduledTasksSettings.browser.test.tsx
@@ -1,3 +1,5 @@
+import { RegistryContext } from "@effect/atom-react";
+import { Atom, AtomRegistry } from "effect/reactivity";
 import {
   DEFAULT_UNIFIED_SETTINGS,
   EnvironmentId,
@@ -10,7 +12,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 import { page, userEvent } from "vite-plus/test/browser";
 
 import "~/index.css";
-import { render } from "../../../test/render";
+import { act, render } from "../../../test/render";
 import { ScheduledTasksSettings } from "./ScheduledTasksSettings";
 
 const environmentId = EnvironmentId.make("laptop");
@@ -38,7 +40,23 @@ const task: ScheduledTask = {
   runCount: 0,
 };
 
-const state = vi.hoisted(() => ({ connected: true, tasksLoaded: true }));
+const state = vi.hoisted(() => ({ connected: true, tasksLoaded: true, secondary: false }));
+const secondaryId = EnvironmentId.make("secondary");
+const permissions = new Map<string, Atom.Writable<boolean>>();
+
+function setup() {
+  state.connected = true;
+  state.tasksLoaded = true;
+  state.secondary = false;
+  permissions.clear();
+  permissions.set(environmentId, Atom.make(true));
+  permissions.set(secondaryId, Atom.make(true));
+  permissions.set("", Atom.make(false));
+}
+
+function secondaryEnvironment() {
+  return { ...environment(), environmentId: secondaryId, label: "Secondary" };
+}
 
 function environment() {
   return {
@@ -54,8 +72,12 @@ vi.mock(import("./SettingsScopeContext"), async (original) => {
     const entry = environment();
     return {
       scope: { kind: "all", label: "All", members: [], environmentIds: [environmentId] },
-      environments: [entry],
-      connectedEnvironments: state.connected ? [entry] : [],
+      environments: state.secondary ? [entry, secondaryEnvironment()] : [entry],
+      connectedEnvironments: state.connected
+        ? state.secondary
+          ? [entry, secondaryEnvironment()]
+          : [entry]
+        : [],
       environment: entry,
       target: null,
       targets: [],
@@ -68,15 +90,14 @@ vi.mock(import("./SettingsScopeContext"), async (original) => {
 });
 vi.mock(import("../../state/server"), async (original) => {
   const actual = await original();
-  const { Atom } = await import("effect/reactivity");
-  const allowed = Atom.make(true);
+
   return {
     ...actual,
     serverEnvironment: {
       ...actual.serverEnvironment,
       upsertScheduledTask: {
         ...actual.serverEnvironment.upsertScheduledTask,
-        permissionAtom: () => allowed,
+        permissionAtom: (id: string | null) => permissions.get(id ?? "")!,
       },
     },
   };
@@ -93,7 +114,8 @@ vi.mock(import("../../state/query"), async (original) => ({
 }));
 vi.mock(import("../../state/environments"), async (original) => ({
   ...(await original()),
-  useEnvironment: (() => environment()) as never,
+  useEnvironment: ((id: EnvironmentId) =>
+    id === secondaryId ? secondaryEnvironment() : environment()) as never,
 }));
 vi.mock(import("../../state/entities"), async (original) => ({
   ...(await original()),
@@ -105,9 +127,44 @@ vi.mock(import("../../hooks/useSettings"), async (original) => ({
 }));
 
 describe("ScheduledTasksSettings", () => {
+  it("creates on a permitted secondary and reacts to permission changes", async () => {
+    setup();
+    state.secondary = true;
+    const registry = AtomRegistry.make();
+    using _registry = { [Symbol.dispose]: () => registry.dispose() };
+    registry.set(permissions.get(environmentId)!, false);
+    await using screen = await render(
+      <RegistryContext.Provider value={registry}>
+        <ScheduledTasksSettings />
+      </RegistryContext.Provider>,
+    );
+    const create = screen.getByRole("button", { name: "New task" });
+    await expect.element(create).toBeEnabled();
+    await act(() => registry.set(permissions.get(secondaryId)!, false));
+    await expect.element(create).toBeDisabled();
+    await act(() => registry.set(permissions.get(secondaryId)!, true));
+    await expect.element(create).toBeEnabled();
+    await create.click();
+    await expect.element(page.getByLabelText("Runs on")).toHaveTextContent("Secondary");
+  });
+
+  it("keeps the permitted representative as the creation target", async () => {
+    setup();
+    state.secondary = true;
+    await using screen = await render(<ScheduledTasksSettings />);
+    await screen.getByRole("button", { name: "New task" }).click();
+    await expect.element(page.getByLabelText("Runs on")).toHaveTextContent("Laptop");
+  });
+
+  it("disables creation without a connected target", async () => {
+    setup();
+    state.connected = false;
+    await using screen = await render(<ScheduledTasksSettings />);
+    await expect.element(screen.getByRole("button", { name: "New task" })).toBeDisabled();
+  });
+
   it("keeps a linked task's unsaved edits across a disconnect and reconnect", async () => {
-    state.connected = true;
-    state.tasksLoaded = true;
+    setup();
     await using screen = await render(<ScheduledTasksSettings taskId={task.id} />);
     const name = page.getByRole("dialog").getByRole("textbox", { name: "Name" });
     await expect.element(name).toHaveValue("Review issues");
@@ -124,7 +181,7 @@ describe("ScheduledTasksSettings", () => {
   });
 
   it("keeps an editor the user opened when the linked task loads later", async () => {
-    state.connected = true;
+    setup();
     state.tasksLoaded = false;
     await using screen = await render(<ScheduledTasksSettings taskId={task.id} />);
     await userEvent.click(page.getByRole("button", { name: "New task" }));
diff --git a/apps/web/src/components/settings/ScheduledTasksSettings.tsx b/apps/web/src/components/settings/ScheduledTasksSettings.tsx
index 1f64fe501af1d..e027438a6abdb 100644
--- a/apps/web/src/components/settings/ScheduledTasksSettings.tsx
+++ b/apps/web/src/components/settings/ScheduledTasksSettings.tsx
@@ -396,9 +396,18 @@ export function ScheduledTasksSettings(target: {
       replace: true,
     });
   };
-  const canCreate = useAtomValue(
-    serverEnvironment.upsertScheduledTask.permissionAtom(defaultEnvironment?.environmentId ?? null),
+  const createPermissions = useAtomValue(
+    scheduledTaskCreatePermissionsAtom(
+      environmentIdsKey(connectedEnvironments.map((entry) => entry.environmentId)),
+    ),
   );
+  const permittedEnvironments = connectedEnvironments.filter(
+    (_entry, index) => createPermissions[index],
+  );
+  const creationEnvironment =
+    permittedEnvironments.find(
+      (entry) => entry.environmentId === defaultEnvironment?.environmentId,
+    ) ?? permittedEnvironments[0];
   return (
     <SettingsPageContainer>
       <SettingsSection
@@ -408,10 +417,10 @@ export function ScheduledTasksSettings(target: {
           <Button
             size="xs"
             variant="ghost-muted"
-            disabled={!defaultEnvironment || !canCreate}
+            disabled={!creationEnvironment}
             onClick={() =>
-              defaultEnvironment &&
-              setEditor({ environmentId: defaultEnvironment.environmentId, task: null })
+              creationEnvironment &&
+              setEditor({ environmentId: creationEnvironment.environmentId, task: null })
             }
           >
             <PlusIcon className="size-3" />
@@ -464,6 +473,11 @@ export function ScheduledTasksSettings(target: {
   );
 }
 
+const scheduledTaskCreatePermissionsAtom = environmentAtomList(
+  "web-scheduled-task-create-permissions",
+  serverEnvironment.upsertScheduledTask.permissionAtom,
+);
+
 const scheduledTasksListAtom = environmentAtomList("web-scheduled-tasks-list", (environmentId) =>
   serverEnvironment.scheduledTasksLive({ environmentId, input: {} }),
 );

From fa2a2dc7749eded7352c04f72c7c48167e6f2b78 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 13:00:29 -0500
Subject: [PATCH 077/146] fix(mobile): recognize this thread's main checkout
 (#23764)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../git/GitBranchesSheet.occupancy.test.tsx   | 100 ++++++++++++++++++
 .../features/threads/git/GitBranchesSheet.tsx |   4 +-
 apps/mobile/vite.config.ts                    |   1 +
 3 files changed, 103 insertions(+), 2 deletions(-)
 create mode 100644 apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx

diff --git a/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx b/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx
new file mode 100644
index 0000000000000..7667b0c793fc4
--- /dev/null
+++ b/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx
@@ -0,0 +1,100 @@
+import { act, type ReactNode } from "react";
+import { createRoot } from "react-dom/client";
+import { expect, it, vi } from "vite-plus/test";
+
+const checkout = vi.hoisted(() => ({
+  projectRoot: "",
+  worktreePath: null as string | null,
+  branches: [] as Array<{ name: string; worktreePath: string | null }>,
+}));
+
+vi.mock("react-native", () => ({
+  Platform: { OS: "android" },
+  View: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  ScrollView: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+  Pressable: ({ children, disabled }: { children: ReactNode; disabled: boolean }) => (
+    <button disabled={disabled}>{children}</button>
+  ),
+  useWindowDimensions: () => ({ height: 800 }),
+}));
+vi.mock("@react-navigation/native", () => ({ useNavigation: () => ({}) }));
+vi.mock("react-native-safe-area-context", () => ({ useSafeAreaInsets: () => ({ bottom: 0 }) }));
+vi.mock("../../../components/ui/AndroidScreenHeader", () => ({ AndroidSheetHeader: () => null }));
+vi.mock("../../../components/ui/SheetHeader", () => ({ SheetHeader: () => null }));
+vi.mock("../../../components/ui/ScreenContent", () => ({
+  ScreenContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}));
+vi.mock("../../../native/StackHeader", () => ({ NativeStackScreenOptions: () => null }));
+vi.mock("../../../components/ui/AppText", () => ({
+  AppText: ({ children }: { children: ReactNode }) => <span>{children}</span>,
+  AppTextInput: () => null,
+}));
+vi.mock("./gitSheetComponents", () => ({ SheetActionButton: () => null }));
+vi.mock("../../../state/use-thread-selection", () => ({
+  useThreadSelection: () => ({
+    selectedThread: { environmentId: "environment-1", worktreePath: checkout.worktreePath },
+    selectedThreadProject: { workspaceRoot: checkout.projectRoot },
+  }),
+}));
+vi.mock("../../../state/use-thread-detail", () => ({
+  useSelectedThreadWorktreePath: () => checkout.worktreePath,
+}));
+vi.mock("../../../state/use-selected-thread-git-state", () => ({
+  useSelectedThreadGitState: () => ({
+    selectedThreadBranches: checkout.branches,
+    selectedThreadBranchesLoading: false,
+    gitOperationLabel: null,
+  }),
+}));
+vi.mock("../../../state/use-selected-thread-git-actions", () => ({
+  useSelectedThreadGitActions: () => ({ canChangeThreadBranch: true }),
+}));
+vi.mock("../../../state/query", () => ({ useEnvironmentQuery: () => ({ data: null }) }));
+vi.mock("../../../state/vcs", () => ({ vcsEnvironment: { status: () => null } }));
+
+import { GitBranchesSheet } from "./GitBranchesSheet";
+
+it("recognizes both the main checkout and a linked worktree as this thread's checkout", () => {
+  const directory = "/repo";
+  const linked = "/repo-linked";
+  checkout.projectRoot = directory;
+  checkout.branches = [
+    { name: "feature/available", worktreePath: null },
+    { name: "feature/linked", worktreePath: linked },
+    { name: "main", worktreePath: directory },
+  ];
+  (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  const container = document.createElement("div");
+  const root = createRoot(container);
+  const rows = () => {
+    act(() => {
+      root.render(
+        <GitBranchesSheet
+          route={{ params: { environmentId: "environment-1", threadId: "thread-1" } }}
+        />,
+      );
+    });
+    return [...container.querySelectorAll("button")].map((button) => ({
+      name: button.querySelectorAll("span")[0]?.textContent,
+      subtitle: button.querySelectorAll("span")[1]?.textContent,
+      disabled: button.disabled,
+    }));
+  };
+  try {
+    checkout.worktreePath = null;
+    expect(rows()).toEqual([
+      { name: "feature/available", subtitle: "Local branch", disabled: false },
+      { name: "feature/linked", subtitle: "Checked out in another worktree", disabled: true },
+      { name: "main", subtitle: "Checked out in this thread", disabled: false },
+    ]);
+
+    checkout.worktreePath = linked;
+    expect(rows()).toEqual([
+      { name: "feature/available", subtitle: "Local branch", disabled: false },
+      { name: "feature/linked", subtitle: "Checked out in this thread", disabled: false },
+      { name: "main", subtitle: "Checked out in another worktree", disabled: true },
+    ]);
+  } finally {
+    act(() => root.unmount());
+  }
+});
diff --git a/apps/mobile/src/features/threads/git/GitBranchesSheet.tsx b/apps/mobile/src/features/threads/git/GitBranchesSheet.tsx
index 4075a49e9774a..dcaf96818bfe0 100644
--- a/apps/mobile/src/features/threads/git/GitBranchesSheet.tsx
+++ b/apps/mobile/src/features/threads/git/GitBranchesSheet.tsx
@@ -28,7 +28,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
   const insets = useSafeAreaInsets();
   const { height: windowHeight } = useWindowDimensions();
   const { selectedThread } = useThreadSelection();
-  const { selectedThreadCwd, selectedThreadWorktreePath } = useSelectedThreadWorktree();
+  const { selectedThreadCwd } = useSelectedThreadWorktree();
   const gitState = useSelectedThreadGitState();
   const gitActions = useSelectedThreadGitActions();
   const { canChangeThreadBranch } = gitActions;
@@ -43,7 +43,7 @@ export function GitBranchesSheet(_props: GitBranchesSheetProps) {
   );
 
   const currentBranchLabel = gitStatus.data?.refName ?? selectedThread?.branch ?? "Detached HEAD";
-  const currentWorktreePath = selectedThreadWorktreePath;
+  const currentWorktreePath = selectedThreadCwd;
   const availableBranches = gitState.selectedThreadBranches;
   const branchesLoading = gitState.selectedThreadBranchesLoading;
   const busy = gitState.gitOperationLabel !== null;
diff --git a/apps/mobile/vite.config.ts b/apps/mobile/vite.config.ts
index 6a92a025778d9..9ddb84efbc832 100644
--- a/apps/mobile/vite.config.ts
+++ b/apps/mobile/vite.config.ts
@@ -4,6 +4,7 @@ import { defineConfig, normalizePath } from "vite-plus";
 import "vite-plus/test/config";
 
 const reactTests = [
+  "src/features/threads/git/GitBranchesSheet.occupancy.test.tsx",
   "src/features/files/useFileTreeEntries.test.tsx",
   "src/features/projects/AddProjectScreen.test.ts",
   "src/lib/useMediaVideoPlayback.test.tsx",

From 06ded0b60049cf213c62bf34b0b2ad85efd8d1f4 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 13:00:53 -0500
Subject: [PATCH 078/146] fix(web): keep usage hubs that share a host (#23767)

Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../AddUsageLimitSourceDialog.logic.test.ts   | 61 +++++++++++++++++++
 .../AddUsageLimitSourceDialog.logic.ts        | 24 ++++++++
 .../settings/AddUsageLimitSourceDialog.tsx    | 19 ++----
 .../settings/UsageProviderSettings.tsx        |  1 +
 4 files changed, 91 insertions(+), 14 deletions(-)
 create mode 100644 apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.test.ts
 create mode 100644 apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.ts

diff --git a/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.test.ts b/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.test.ts
new file mode 100644
index 0000000000000..33192bbaab71f
--- /dev/null
+++ b/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.test.ts
@@ -0,0 +1,61 @@
+import { DEFAULT_SERVER_SETTINGS, type ServerSettings } from "@t3tools/contracts";
+import { applyServerSettingsPatch } from "@t3tools/shared/serverSettings";
+import { describe, expect, it } from "vite-plus/test";
+
+import { sourceIdFromUrl } from "./AddUsageLimitSourceDialog.logic";
+
+describe("adding usage limit sources", () => {
+  it.each([
+    ["http://proxy.test:8318/hub-a", "http://proxy.test:8318/hub-b"],
+    ["localhost:8318", "localhost:9318"],
+  ])("retains saved configurations for %s and %s", (firstUrl, secondUrl) => {
+    let settings: ServerSettings = DEFAULT_SERVER_SETTINGS;
+    const sources = [
+      [firstUrl, "First hub", "first-key"],
+      [secondUrl, "Second hub", "second-key"],
+      [`${secondUrl}/extra`, "Third hub", "third-key"],
+    ] as const;
+    for (const [url, label, managementKey] of sources) {
+      const id = sourceIdFromUrl(url, settings.usageLimitSources);
+      settings = applyServerSettingsPatch(settings, {
+        usageLimitSources: {
+          [id]: { kind: "cliproxy", url, label, managementKey, enabled: true },
+        },
+      });
+    }
+    expect(Object.values(settings.usageLimitSources)).toEqual(
+      sources.map(([url, label, managementKey]) => ({
+        kind: "cliproxy",
+        url,
+        label,
+        managementKey,
+        enabled: true,
+      })),
+    );
+  });
+
+  it("updates a saved hub when its URL is added again", () => {
+    let settings: ServerSettings = DEFAULT_SERVER_SETTINGS;
+    for (const managementKey of ["old-key", "new-key"]) {
+      const url = "http://proxy.test:8318/hub-a";
+      settings = applyServerSettingsPatch(settings, {
+        usageLimitSources: {
+          [sourceIdFromUrl(url, settings.usageLimitSources)]: {
+            kind: "cliproxy",
+            url,
+            managementKey,
+            enabled: true,
+          },
+        },
+      });
+    }
+    expect(Object.values(settings.usageLimitSources)).toEqual([
+      {
+        kind: "cliproxy",
+        url: "http://proxy.test:8318/hub-a",
+        managementKey: "new-key",
+        enabled: true,
+      },
+    ]);
+  });
+});
diff --git a/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.ts b/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.ts
new file mode 100644
index 0000000000000..67ccabdefefc9
--- /dev/null
+++ b/apps/web/src/components/settings/AddUsageLimitSourceDialog.logic.ts
@@ -0,0 +1,24 @@
+import { type UnifiedSettings, UsageLimitSourceId } from "@t3tools/contracts";
+
+export function sourceIdFromUrl(
+  url: string,
+  sources: UnifiedSettings["usageLimitSources"],
+): UsageLimitSourceId {
+  const saved = Object.entries(sources).find(([, source]) => source.url === url);
+  if (saved) return UsageLimitSourceId.make(saved[0]);
+  let host = url;
+  try {
+    host = new URL(url).host;
+  } catch {}
+  const slug = host
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+  // Settings merge by ID, so adding a different hub must not replace an existing entry.
+  const base = `cliproxy-${slug || "hub"}`;
+  let id = base;
+  for (let suffix = 2; id in sources; suffix += 1) {
+    id = `${base}-${suffix}`;
+  }
+  return UsageLimitSourceId.make(id);
+}
diff --git a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
index cc150016d73ce..e3abd8b951067 100644
--- a/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
+++ b/apps/web/src/components/settings/AddUsageLimitSourceDialog.tsx
@@ -1,4 +1,4 @@
-import { type EnvironmentId, UsageLimitSourceId } from "@t3tools/contracts";
+import type { EnvironmentId, UnifiedSettings } from "@t3tools/contracts";
 import { useState } from "react";
 
 import { useUpdateEnvironmentSettings } from "../../hooks/useSettings";
@@ -13,32 +13,23 @@ import {
   DialogTitle,
 } from "../ui/dialog";
 import { Input } from "../ui/input";
+import { sourceIdFromUrl } from "./AddUsageLimitSourceDialog.logic";
 import { SecretInput } from "./SecretInput";
 import { Label } from "../ui/label";
 
-function sourceIdFromUrl(url: string): UsageLimitSourceId {
-  let host = url;
-  try {
-    host = new URL(url).host;
-  } catch {}
-  const slug = host
-    .toLowerCase()
-    .replace(/[^a-z0-9.-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-  return UsageLimitSourceId.make(`cliproxy-${slug || "hub"}`);
-}
-
 /** Send the management key once to server secret storage; settings retain only a redaction marker. */
 export function AddUsageLimitSourceDialog({
   open,
   onOpenChange,
   environmentId,
   environmentLabel,
+  sources,
 }: {
   readonly open: boolean;
   readonly onOpenChange: (open: boolean) => void;
   readonly environmentId: EnvironmentId;
   readonly environmentLabel: string;
+  readonly sources: UnifiedSettings["usageLimitSources"];
 }) {
   const updateSettings = useUpdateEnvironmentSettings(environmentId);
   const [label, setLabel] = useState("");
@@ -55,7 +46,7 @@ export function AddUsageLimitSourceDialog({
 
   const save = () => {
     if (!canSave) return;
-    const id = sourceIdFromUrl(trimmedUrl);
+    const id = sourceIdFromUrl(trimmedUrl, sources);
     updateSettings({
       usageLimitSources: {
         [id]: {
diff --git a/apps/web/src/components/settings/UsageProviderSettings.tsx b/apps/web/src/components/settings/UsageProviderSettings.tsx
index bab7ddd9c52a6..f238850ae04d0 100644
--- a/apps/web/src/components/settings/UsageProviderSettings.tsx
+++ b/apps/web/src/components/settings/UsageProviderSettings.tsx
@@ -121,6 +121,7 @@ export function UsageProviderSettings({
           onOpenChange={setAdding}
           environmentId={environmentId}
           environmentLabel={environmentLabel}
+          sources={sources}
         />
       ) : null}
     </>

From f8646e00c1528ef2aaa161a5c246119a6e5f7780 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:01:16 +0000
Subject: [PATCH 079/146] fix(github): read text and mixed-case pull request
 templates (#25025)

Co-authored-by: Simone <185146821+Lucenx9@users.noreply.github.com>
---
 .../gitHubChangeRequestTemplate.test.ts       | 38 ++++++++++
 .../src/server/gitHubChangeRequestTemplate.ts | 72 ++++++++++++++++---
 2 files changed, 100 insertions(+), 10 deletions(-)

diff --git a/packages/source-control-github/src/server/gitHubChangeRequestTemplate.test.ts b/packages/source-control-github/src/server/gitHubChangeRequestTemplate.test.ts
index 58b094063ecba..29bf922020d0d 100644
--- a/packages/source-control-github/src/server/gitHubChangeRequestTemplate.test.ts
+++ b/packages/source-control-github/src/server/gitHubChangeRequestTemplate.test.ts
@@ -227,3 +227,41 @@ it.effect("bounds template reads and marks truncated content", () =>
     }),
   ),
 );
+
+it.effect.each([
+  ".github/pull_request_template.txt",
+  "PULL_REQUEST_TEMPLATE.TXT",
+  "docs/PuLl_ReQuEsT_TeMpLaTe.Md",
+  ".github/PULL_REQUEST_TEMPLATE/template.TxT",
+])("reads committed text and mixed-case template $0 from a subdirectory", (relativePath) =>
+  runWithTempDirectory((cwd) =>
+    Effect.gen(function* () {
+      const path = yield* Path.Path;
+      yield* runGit(cwd, ["config", "grep.patternType", "fixed"]);
+      yield* runGit(cwd, ["config", "color.grep", "always"]);
+      yield* writeTemplate(cwd, relativePath, "committed template");
+      yield* writeTemplate(cwd, "nested/README.md", "project");
+      for (let index = 0; index < 600; index += 1) {
+        yield* writeTemplate(cwd, `docs/${index}-${"a".repeat(180)}.md`, "guide");
+      }
+      yield* commitTemplates(cwd);
+      yield* writeTemplate(cwd, relativePath, "uncommitted template");
+
+      assert.strictEqual(
+        Option.getOrUndefined(yield* detectTemplate(path.join(cwd, "nested"))),
+        "committed template",
+      );
+    }),
+  ),
+);
+
+it.effect("does not guess between Markdown and text directory templates", () =>
+  runWithTempDirectory((cwd) =>
+    Effect.gen(function* () {
+      yield* writeTemplate(cwd, ".github/PULL_REQUEST_TEMPLATE/a.md", "markdown");
+      yield* writeTemplate(cwd, ".github/PULL_REQUEST_TEMPLATE/b.TXT", "text");
+      yield* commitTemplates(cwd);
+      assert.isTrue(Option.isNone(yield* detectTemplate(cwd)));
+    }),
+  ),
+);
diff --git a/packages/source-control-github/src/server/gitHubChangeRequestTemplate.ts b/packages/source-control-github/src/server/gitHubChangeRequestTemplate.ts
index c6af80389d1f7..9edbccdd504dc 100644
--- a/packages/source-control-github/src/server/gitHubChangeRequestTemplate.ts
+++ b/packages/source-control-github/src/server/gitHubChangeRequestTemplate.ts
@@ -11,10 +11,16 @@ const TRUNCATION_MARKER = "[truncated]";
 const TEMPLATE_PATHS = [
   ".github/pull_request_template.md",
   ".github/PULL_REQUEST_TEMPLATE.md",
+  ".github/pull_request_template.txt",
+  ".github/PULL_REQUEST_TEMPLATE.txt",
   "pull_request_template.md",
   "PULL_REQUEST_TEMPLATE.md",
+  "pull_request_template.txt",
+  "PULL_REQUEST_TEMPLATE.txt",
   "docs/pull_request_template.md",
   "docs/PULL_REQUEST_TEMPLATE.md",
+  "docs/pull_request_template.txt",
+  "docs/PULL_REQUEST_TEMPLATE.txt",
 ] as const;
 
 const TEMPLATE_DIRECTORIES = [
@@ -23,8 +29,6 @@ const TEMPLATE_DIRECTORIES = [
   "docs/PULL_REQUEST_TEMPLATE",
 ] as const;
 
-const TREE_PATHS = [...TEMPLATE_PATHS, ...TEMPLATE_DIRECTORIES] as const;
-
 type ExecuteGit = SourceControlHost.SourceControlHost["Service"]["git"]["execute"];
 
 interface TemplateTreeEntry {
@@ -105,7 +109,7 @@ const readTemplateDirectory = Effect.fn("gitHubChangeRequestTemplate.readTemplat
         return false;
       }
       const relativePath = entry.path.slice(prefix.length);
-      return !relativePath.includes("/") && relativePath.toLowerCase().endsWith(".md");
+      return !relativePath.includes("/") && /\.(?:md|txt)$/i.test(relativePath);
     });
 
     const templates: string[] = [];
@@ -132,10 +136,50 @@ export const detect = Effect.fn("gitHubChangeRequestTemplate.detect")(function*
 ) {
   return yield* Effect.gen(function* () {
     // Read committed regular blobs; worktree paths can become symlinks between validation and open.
+    // ls-tree does not support case-insensitive pathspecs; grep discovers only matching names.
+    const paths = yield* executeGit({
+      operation: "gitHubChangeRequestTemplate.findTemplatePaths",
+      cwd,
+      args: [
+        "grep",
+        "-G",
+        "--no-color",
+        "-l",
+        "-z",
+        "--full-name",
+        "--no-recurse-submodules",
+        "-e",
+        "^",
+        treeish,
+        "--",
+        ...TEMPLATE_PATHS.map((path) => `:(top,icase,literal)${path}`),
+      ],
+      maxOutputBytes: TREE_LIST_MAX_BYTES,
+    }).pipe(
+      Effect.map((result) =>
+        result.stdoutTruncated
+          ? []
+          : result.stdout
+              .split("\0")
+              .filter((path) => path.startsWith(`${treeish}:`))
+              .map((path) => path.slice(treeish.length + 1)),
+      ),
+      // grep exits with status 1 when no nonempty templates match.
+      Effect.orElseSucceed(() => []),
+    );
     const result = yield* executeGit({
       operation: "gitHubChangeRequestTemplate.listTemplates",
       cwd,
-      args: ["ls-tree", "-r", "-z", "--full-tree", treeish, "--", ...TREE_PATHS],
+      args: [
+        "ls-tree",
+        "-r",
+        "-z",
+        "--full-tree",
+        treeish,
+        "--",
+        ...new Set([...TEMPLATE_PATHS, ...paths]),
+        ...TEMPLATE_DIRECTORIES,
+      ],
       maxOutputBytes: TREE_LIST_MAX_BYTES,
       appendTruncationMarker: true,
     });
@@ -144,12 +188,20 @@ export const detect = Effect.fn("gitHubChangeRequestTemplate.detect")(function*
     }
 
     const entries = parseTemplateTreeEntries(result.stdout);
-    const entriesByPath = new Map(entries.map((entry) => [entry.path, entry]));
-    for (const templatePath of TEMPLATE_PATHS) {
-      const entry = entriesByPath.get(templatePath);
-      if (!entry) {
-        continue;
-      }
+    const candidates = [".github/", "", "docs/"].flatMap((location) => {
+      const paths = TEMPLATE_PATHS.filter(
+        (path) => path.slice(0, path.lastIndexOf("/") + 1) === location,
+      );
+      return [
+        ...paths.flatMap((path) => entries.filter((entry) => entry.path === path)),
+        ...entries.filter(
+          (entry) =>
+            !paths.some((path) => path === entry.path) &&
+            paths.some((path) => path.toLowerCase() === entry.path.toLowerCase()),
+        ),
+      ];
+    });
+    for (const entry of candidates) {
       const template = yield* readTemplateBlob({ cwd, executeGit, entry });
       if (Option.isSome(template)) {
         return template;

From de2b1d33582edee2604567dc572fde4c3b906450 Mon Sep 17 00:00:00 2001
From: Stevan Borus <steva.borus@gmail.com>
Date: Thu, 29 Oct 2026 19:01:27 +0100
Subject: [PATCH 080/146] fix(web): keep HTML prototype selection rings visible
 (#23745)

Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../src/provider/agentContextBudget.json      |   2 +-
 .../BrowserDocumentFrame.browser.test.tsx     | 107 ++++++++++++++++++
 packages/shared/src/htmlRender.ts             |   3 +-
 3 files changed, 110 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/provider/agentContextBudget.json b/apps/server/src/provider/agentContextBudget.json
index d5496ea8cfc57..1711e148d4ca4 100644
--- a/apps/server/src/provider/agentContextBudget.json
+++ b/apps/server/src/provider/agentContextBudget.json
@@ -1,5 +1,5 @@
 {
   "claudeSystemAppendBytes": 5135,
   "codexAdditionalContextBytes": 6865,
-  "mcpToolListJsonBytes": 45907
+  "mcpToolListJsonBytes": 46007
 }
diff --git a/apps/web/src/components/files/BrowserDocumentFrame.browser.test.tsx b/apps/web/src/components/files/BrowserDocumentFrame.browser.test.tsx
index 9785a6764b2b6..3915ecce9a4ca 100644
--- a/apps/web/src/components/files/BrowserDocumentFrame.browser.test.tsx
+++ b/apps/web/src/components/files/BrowserDocumentFrame.browser.test.tsx
@@ -1,3 +1,4 @@
+import { injectHtmlRenderBootstrap } from "@t3tools/shared/htmlRender";
 import { describe, expect, it, vi } from "vite-plus/test";
 
 import "~/index.css";
@@ -34,3 +35,109 @@ describe("HtmlRenderDocument", () => {
     expect(onContentHeight).toHaveBeenCalledTimes(1);
   });
 });
+
+it("keeps the first and last selected card rings inside the fitted renderer frame", async () => {
+  const html = injectHtmlRenderBootstrap(`<!doctype html><html><head><style>
+    main { display: grid; gap: 12px; }
+    button { box-sizing: border-box; width: 100%; height: 72px; border: 0; }
+    button[aria-pressed="true"] { outline: 3px solid blue; outline-offset: 2px; }
+  </style></head><body><main>
+    <button id="first" aria-pressed="false">Meadow</button>
+    <button id="middle" aria-pressed="false">Harbor</button>
+    <button id="last" aria-pressed="false">Orchid</button>
+  </main><script>
+    document.querySelectorAll("button").forEach(function(button) {
+      button.addEventListener("click", function() {
+        document.querySelectorAll("button").forEach(function(card) {
+          card.setAttribute("aria-pressed", String(card === button));
+        });
+      });
+    });
+    window.addEventListener("message", function(event) {
+      if (event.source !== window.parent || event.data.type !== "select-card") return;
+      var button = document.getElementById(event.data.id);
+      button.click();
+      var rect = button.getBoundingClientRect();
+      var style = getComputedStyle(button);
+      var ring = parseFloat(style.outlineWidth) + parseFloat(style.outlineOffset);
+      window.parent.postMessage({
+        type: "selected-card-bounds",
+        id: button.id,
+        selected: button.getAttribute("aria-pressed") === "true",
+        ring: ring,
+        left: rect.left - ring,
+        right: rect.right + ring,
+        top: rect.top - ring,
+        bottom: rect.bottom + ring,
+        pageHeight: document.documentElement.getBoundingClientRect().height,
+        viewportHeight: window.innerHeight,
+        viewportWidth: window.innerWidth,
+        scrollWidth: document.documentElement.scrollWidth
+      }, "*");
+    });
+  </script></body></html>`);
+  const src = URL.createObjectURL(new Blob([html], { type: "text/html" }));
+  using _url = { [Symbol.dispose]: () => URL.revokeObjectURL(src) };
+  const container = document.createElement("div");
+  container.style.width = "728px";
+  const reports = new Map<
+    string,
+    {
+      selected: boolean;
+      ring: number;
+      left: number;
+      right: number;
+      top: number;
+      bottom: number;
+      pageHeight: number;
+      viewportHeight: number;
+      viewportWidth: number;
+      scrollWidth: number;
+    }
+  >();
+  const messages = new AbortController();
+  using _messages = { [Symbol.dispose]: () => messages.abort() };
+  window.addEventListener(
+    "message",
+    (event) => {
+      const frame = container.querySelector("iframe");
+      if (event.source === frame?.contentWindow && event.data?.type === "selected-card-bounds") {
+        reports.set(event.data.id, event.data);
+      }
+    },
+    { signal: messages.signal },
+  );
+  const contentHeight = vi.fn((height: number) => {
+    container.style.setProperty("--content-height", `${height}px`);
+  });
+  await using screen = await render(
+    <>
+      <style>{`iframe[title="Edge cards"] {
+        display: block; width: 100%; height: var(--content-height, 120px); border: 0;
+      }`}</style>
+      <HtmlRenderDocument src={src} title="Edge cards" onContentHeight={contentHeight} />
+    </>,
+    { container },
+  );
+
+  await vi.waitFor(() => expect(contentHeight).toHaveBeenCalled());
+  const frame = screen.getByTitle("Edge cards").element() as HTMLIFrameElement;
+  await vi.waitFor(() => {
+    expect(frame.getBoundingClientRect().height).toBe(contentHeight.mock.lastCall?.[0]);
+  });
+
+  for (const id of ["first", "last"]) {
+    frame.contentWindow?.postMessage({ type: "select-card", id }, "*");
+    await vi.waitFor(() => expect(reports.get(id)?.selected).toBe(true));
+    const bounds = reports.get(id)!;
+    expect(bounds.ring).toBe(5);
+    expect(bounds.viewportWidth).toBe(728);
+    expect(bounds.pageHeight).toBe(contentHeight.mock.lastCall?.[0]);
+    expect(bounds.viewportHeight).toBe(bounds.pageHeight);
+    expect(bounds.left).toBeGreaterThanOrEqual(0);
+    expect(bounds.top).toBeGreaterThanOrEqual(0);
+    expect(bounds.right).toBeLessThanOrEqual(bounds.viewportWidth);
+    expect(bounds.bottom).toBeLessThanOrEqual(bounds.viewportHeight);
+    expect(bounds.scrollWidth).toBeLessThanOrEqual(bounds.viewportWidth);
+  }
+});
diff --git a/packages/shared/src/htmlRender.ts b/packages/shared/src/htmlRender.ts
index 572441ffe5366..12af0f39336b2 100644
--- a/packages/shared/src/htmlRender.ts
+++ b/packages/shared/src/htmlRender.ts
@@ -232,6 +232,7 @@ export const HTML_RENDER_THEME_GUIDE = [
 export const HTML_RENDER_LAYOUT_GUIDE = [
   `Frame width is reply width (${HTML_RENDER_COLUMN_WIDTH}px desktop, about 360px phones), on the thread background.`,
   "Leave html, body, and the outer element with no background color, no outer card, border, banner title, or side padding. This wins over any rule that sets a page background.",
+  "T3 adds an overridable 8px html gutter for selection rings and shadows. Use fluid widths within it.",
   "A box that needs its own background gets 16px padding and var(--radius) corners. Give charts fixed pixel heights.",
   "Let content set the height. Do not use vh units or height:100% on html or body. Both are rejected or loop.",
 ].join(" ");
@@ -353,7 +354,7 @@ export function htmlRenderThemeMessage(theme: HtmlRenderTheme) {
 }
 
 const BASE_CSS =
-  "html{background:var(--background);color:var(--foreground);font-family:var(--font-sans);font-size:14px;line-height:1.5;-webkit-font-smoothing:antialiased;-webkit-text-size-adjust:100%;scrollbar-width:none}" +
+  "html{box-sizing:border-box;padding:8px;background:var(--background);color:var(--foreground);font-family:var(--font-sans);font-size:14px;line-height:1.5;-webkit-font-smoothing:antialiased;-webkit-text-size-adjust:100%;scrollbar-width:none}" +
   "html::-webkit-scrollbar{display:none}body{margin:0}code,kbd,pre,samp{font-family:var(--font-mono)}" +
   // Focus outlines paint inside the element, so the frame edge never clips them.
   ":where(:focus-visible){outline:2px solid var(--ring)}:focus-visible{outline-width:2px!important;outline-offset:-2px!important}" +

From 12bd9d6a618ad0f2eadf34d31f6c428a12a8d150 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:01:49 +0000
Subject: [PATCH 081/146] fix(mobile): list pull request repositories once per
 environment (#25219)

Co-authored-by: Tristan Knight <18444302+tris203@users.noreply.github.com>
---
 .../pull-requests/PullRequestsScreen.tsx      | 13 +++--
 .../pull-requests/pullRequestList.test.ts     | 49 +++++++++++++++++++
 .../features/pull-requests/pullRequestList.ts | 29 +++++++++++
 .../pullRequestProjectFilter.logic.test.ts    |  2 +-
 .../pullRequest/usePullRequestListView.ts     |  2 +-
 packages/client-runtime/package.json          |  4 ++
 .../src/pullRequestProjectFilter.ts           | 13 ++---
 7 files changed, 100 insertions(+), 12 deletions(-)
 rename apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.ts => packages/client-runtime/src/pullRequestProjectFilter.ts (82%)

diff --git a/apps/mobile/src/features/pull-requests/PullRequestsScreen.tsx b/apps/mobile/src/features/pull-requests/PullRequestsScreen.tsx
index b5fb14b198ab4..6c675219dc943 100644
--- a/apps/mobile/src/features/pull-requests/PullRequestsScreen.tsx
+++ b/apps/mobile/src/features/pull-requests/PullRequestsScreen.tsx
@@ -44,6 +44,7 @@ import {
   scopedPullRequestListKey as pullRequestKey,
   type EnvironmentPullRequestListEntry,
   withoutScratchProjectScope,
+  pullRequestProjectChoices,
 } from "./pullRequestList";
 import { useDebouncedValue } from "../../state/queries";
 import { useWorkspaceTabs } from "../workspace/WorkspaceTabsContext";
@@ -221,10 +222,14 @@ export function PullRequestsScreen(
   }
   const labelColors =
     knownFacets.environmentId === environmentId ? knownFacets.labelColors : facets.labelColors;
-  const projects = allProjects.filter(
-    (project) =>
-      !project.isScratch && (environmentId === null || project.environmentId === environmentId),
-  );
+  const projects = pullRequestProjectChoices(allProjects, {
+    environmentId,
+    controls,
+    environmentLabels: new Map(
+      environments.map((item) => [item.environmentId, item.environmentLabel]),
+    ),
+    servesPullRequests: (id) => configs.get(id)?.environment.capabilities.pullRequests === true,
+  });
   const filters = usePullRequestListFilters({
     environments: environments.map((item) => ({
       id: String(item.environmentId),
diff --git a/apps/mobile/src/features/pull-requests/pullRequestList.test.ts b/apps/mobile/src/features/pull-requests/pullRequestList.test.ts
index f7b1a7a1bf832..b6f47b6533ee2 100644
--- a/apps/mobile/src/features/pull-requests/pullRequestList.test.ts
+++ b/apps/mobile/src/features/pull-requests/pullRequestList.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vite-plus/test";
 import {
   EnvironmentId,
+  ProjectId,
   SourceControlProviderKind,
   type PullRequestListEntry,
   type PullRequestListResult,
@@ -26,6 +27,7 @@ import {
   withListedPullRequests,
   withShownPullRequestStats,
   withoutScratchProjectScope,
+  pullRequestProjectChoices,
 } from "./pullRequestList";
 
 function entry(number: number, patch: Partial<PullRequestListEntry> = {}): PullRequestListEntry {
@@ -402,6 +404,53 @@ describe("pullRequestFilterChoices", () => {
   });
 });
 
+describe("pullRequestProjectChoices", () => {
+  const laptop = EnvironmentId.make("env-laptop");
+  const desktop = EnvironmentId.make("env-desktop");
+  const project = (id: string, environmentId: EnvironmentId) => ({
+    id: ProjectId.make(id),
+    environmentId,
+    title: "t3code",
+    workspaceRoot: `/work/${id}`,
+    repositoryIdentity: { canonicalKey: "github.com/pingdotgg/t3code" },
+  });
+  const projects = [project("main", laptop), project("worktree", laptop), project("main", desktop)];
+  const choices = (
+    servesPullRequests: (environmentId: EnvironmentId) => boolean,
+    scope: { projectId?: string; projectEnvironmentId?: string } = {},
+  ) =>
+    pullRequestProjectChoices(projects, {
+      environmentId: null,
+      controls: { ...DEFAULT_PR_LIST_CONTROLS, ...scope },
+      environmentLabels: new Map([
+        [laptop, "laptop"],
+        [desktop, "desktop"],
+      ]),
+      servesPullRequests,
+    }).map(({ id, environmentId, title }) => ({ id, environmentId, title }));
+
+  it("lists each repository once per environment that serves pull requests", () => {
+    expect(choices(() => true)).toEqual([
+      { id: "main", environmentId: desktop, title: "t3code · desktop" },
+      { id: "main", environmentId: laptop, title: "t3code · laptop" },
+    ]);
+    expect(choices((environmentId) => environmentId === desktop)).toEqual([
+      { id: "main", environmentId: desktop, title: "t3code" },
+    ]);
+  });
+
+  it("keeps the saved scope when its environment stops serving or has not loaded", () => {
+    const scope = { projectId: "worktree", projectEnvironmentId: laptop };
+    expect(choices((environmentId) => environmentId === desktop, scope)).toEqual([
+      { id: "main", environmentId: desktop, title: "t3code · desktop" },
+      { id: "worktree", environmentId: laptop, title: "t3code · laptop" },
+    ]);
+    expect(choices(() => false, scope)).toEqual([
+      { id: "worktree", environmentId: laptop, title: "t3code" },
+    ]);
+  });
+});
+
 describe("shown PR diff stats", () => {
   const cups = EnvironmentId.make("cups");
   const stat = (number: number, additions: number, deletions: number) => ({
diff --git a/apps/mobile/src/features/pull-requests/pullRequestList.ts b/apps/mobile/src/features/pull-requests/pullRequestList.ts
index fcb41ac8ec861..674d3b0e24fe3 100644
--- a/apps/mobile/src/features/pull-requests/pullRequestList.ts
+++ b/apps/mobile/src/features/pull-requests/pullRequestList.ts
@@ -1,3 +1,4 @@
+import { pullRequestFilterProjects } from "@t3tools/client-runtime/pull-request-project-filter";
 import { parsePullRequestQuery } from "@t3tools/client-runtime/pull-request-query";
 import {
   ProjectId,
@@ -34,6 +35,34 @@ export function withoutScratchProjectScope(
     : controls;
 }
 
+type FilterProject = Parameters<typeof pullRequestFilterProjects>[0][number];
+
+export function pullRequestProjectChoices<
+  Project extends FilterProject & { readonly isScratch?: true },
+>(
+  projects: readonly Project[],
+  input: {
+    readonly environmentId: string | null;
+    readonly controls: PullRequestListControls;
+    readonly environmentLabels: ReadonlyMap<EnvironmentId, string>;
+    readonly servesPullRequests: (environmentId: EnvironmentId) => boolean;
+  },
+) {
+  const isSelected = (project: Project) =>
+    project.id === input.controls.projectId &&
+    project.environmentId === input.controls.projectEnvironmentId;
+  return pullRequestFilterProjects(
+    projects.filter(
+      (project) =>
+        !project.isScratch &&
+        (input.environmentId === null || project.environmentId === input.environmentId) &&
+        (input.servesPullRequests(project.environmentId) || isSelected(project)),
+    ),
+    input.environmentLabels,
+    projects.find(isSelected),
+  );
+}
+
 export function pullRequestListKey(
   item: Pick<PullRequestListEntry, "host" | "repository" | "number">,
 ) {
diff --git a/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.test.ts b/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.test.ts
index ec3319f010843..59d7e0c83ad12 100644
--- a/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.test.ts
+++ b/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.test.ts
@@ -2,7 +2,7 @@ import { EnvironmentId, ProjectId } from "@t3tools/contracts";
 import { describe, expect, it } from "vite-plus/test";
 
 import { findScopedProject } from "./pullRequestList.logic";
-import { pullRequestFilterProjects } from "./pullRequestProjectFilter.logic";
+import { pullRequestFilterProjects } from "@t3tools/client-runtime/pull-request-project-filter";
 
 const cups = EnvironmentId.make("env-cups");
 const nucbox = EnvironmentId.make("env-nucbox");
diff --git a/apps/web/src/components/pullRequest/usePullRequestListView.ts b/apps/web/src/components/pullRequest/usePullRequestListView.ts
index c4e917fa7134e..fe22fe5af2838 100644
--- a/apps/web/src/components/pullRequest/usePullRequestListView.ts
+++ b/apps/web/src/components/pullRequest/usePullRequestListView.ts
@@ -36,7 +36,7 @@ import {
 import type { PullRequestExpectedHost } from "./PullRequestListFilters";
 import type { PullRequestListPreferences, PullRequestListSort } from "./pullRequestListPreferences";
 import { assignProjectsToEnvironments } from "./pullRequestProjectAssignment.logic";
-import { pullRequestFilterProjects } from "./pullRequestProjectFilter.logic";
+import { pullRequestFilterProjects } from "@t3tools/client-runtime/pull-request-project-filter";
 import { pullRequestListEntryId } from "./pullRequestListGroups.logic";
 
 export interface PullRequestsSearch extends PullRequestListPreferences {
diff --git a/packages/client-runtime/package.json b/packages/client-runtime/package.json
index 5808641a5606a..e1f81638ea3d4 100644
--- a/packages/client-runtime/package.json
+++ b/packages/client-runtime/package.json
@@ -415,6 +415,10 @@
       "types": "./src/threadReference.ts",
       "default": "./src/threadReference.ts"
     },
+    "./pull-request-project-filter": {
+      "types": "./src/pullRequestProjectFilter.ts",
+      "default": "./src/pullRequestProjectFilter.ts"
+    },
     "./thread-pull-request-compatibility": {
       "types": "./src/threadPullRequestCompatibility.ts",
       "default": "./src/threadPullRequestCompatibility.ts"
diff --git a/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.ts b/packages/client-runtime/src/pullRequestProjectFilter.ts
similarity index 82%
rename from apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.ts
rename to packages/client-runtime/src/pullRequestProjectFilter.ts
index 040f3537446cf..03e47dcafab16 100644
--- a/apps/web/src/components/pullRequest/pullRequestProjectFilter.logic.ts
+++ b/packages/client-runtime/src/pullRequestProjectFilter.ts
@@ -1,8 +1,9 @@
-import type { EnvironmentId } from "@t3tools/contracts";
+import type { EnvironmentId, ProjectId } from "@t3tools/contracts";
 
-import type { AssignableProject } from "./pullRequestProjectAssignment.logic";
-
-interface FilterProject extends AssignableProject {
+interface FilterProject {
+  readonly id: ProjectId;
+  readonly environmentId: EnvironmentId;
+  readonly repositoryIdentity?: { readonly canonicalKey?: string | undefined } | null | undefined;
   readonly title: string;
   readonly workspaceRoot: string;
 }
@@ -25,7 +26,7 @@ function distinguishTitles<Project extends FilterProject>(
 export function pullRequestFilterProjects<Project extends FilterProject>(
   projects: ReadonlyArray<Project>,
   environmentLabels: ReadonlyMap<EnvironmentId, string>,
-  selectedProject?: Pick<AssignableProject, "id" | "environmentId">,
+  selectedProject?: Pick<FilterProject, "id" | "environmentId">,
 ) {
   const byRepository = new Map<string, Project>();
   for (const project of projects) {
@@ -45,7 +46,7 @@ export function pullRequestFilterProjects<Project extends FilterProject>(
   );
   const byPath = distinguishTitles(byServer, (project) => project.workspaceRoot);
   const byEnvironment = distinguishTitles(byPath, (project) => project.environmentId);
-  return distinguishTitles(byEnvironment, (project) => project.id).toSorted((left, right) =>
+  return distinguishTitles(byEnvironment, (project) => project.id).sort((left, right) =>
     left.title.localeCompare(right.title),
   );
 }

From 4e274aed25fdb94d71320c4565a1c3c35ca17093 Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <pujitha.rathna@gmail.com>
Date: Thu, 29 Oct 2026 11:02:12 -0700
Subject: [PATCH 082/146] fix(shared): Open in Zed prefers zeditor over the ZFS
 zed on Linux (#23416)

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/process/externalLauncher.test.ts      | 103 ++++++++++++++++++
 packages/shared/src/editor.ts                 |  14 ++-
 2 files changed, 114 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/process/externalLauncher.test.ts b/apps/server/src/process/externalLauncher.test.ts
index 1e816f31b77d5..265c4a2fc36bd 100644
--- a/apps/server/src/process/externalLauncher.test.ts
+++ b/apps/server/src/process/externalLauncher.test.ts
@@ -10,11 +10,14 @@ import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
+import * as Option from "effect/Option";
 import * as PlatformError from "effect/PlatformError";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
+import { EDITORS } from "@t3tools/contracts";
+import { resolveEditorCommand } from "@t3tools/shared/editor";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import { SpawnExecutableResolution } from "@t3tools/shared/shell";
 import * as ExternalLauncher from "./externalLauncher.ts";
@@ -335,6 +338,106 @@ for (const cwd of ["/workspace with spaces/", "/workspace with spaces/file.ts:12
   );
 }
 
+for (const { layout, pathNames, fallbackNames, expected } of [
+  { layout: "PATH", pathNames: ["zed", "zeditor"], fallbackNames: [], expected: "zeditor" },
+  {
+    layout: "mixed locations",
+    pathNames: ["zed"],
+    fallbackNames: ["zeditor"],
+    expected: "fallback",
+  },
+  {
+    layout: "fallback directory",
+    pathNames: [],
+    fallbackNames: ["zed", "zeditor"],
+    expected: "fallback",
+  },
+]) {
+  it.effect.skipIf(windowsHost)(`prefers the Zed editor on Linux with ${layout}`, () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-zed-linux-" });
+      const binDir = path.join(home, "bin");
+      const fallbackDir = path.join(home, ".local/bin");
+      for (const [dir, names] of [
+        [binDir, pathNames],
+        [fallbackDir, fallbackNames],
+      ] as const) {
+        yield* fs.makeDirectory(dir, { recursive: true });
+        for (const name of names) {
+          yield* fs.writeFileString(path.join(dir, name), "#!/bin/sh\n");
+          yield* fs.chmod(path.join(dir, name), 0o755);
+        }
+      }
+
+      let spawned: ChildProcess.StandardCommand | undefined;
+      yield* Effect.gen(function* () {
+        const launcher = yield* ExternalLauncher.ExternalLauncher;
+        assert.include(yield* launcher.resolveAvailableEditors(), "zed");
+        yield* launcher.launchEditor({ editor: "zed", cwd: "/workspace" });
+      }).pipe(
+        Effect.provide(
+          layerTest({
+            platform: "linux",
+            env: { HOME: home, PATH: binDir },
+            onSpawn: (command) => {
+              spawned = command;
+            },
+          }),
+        ),
+      );
+      assert.ok(spawned);
+      assert.equal(
+        spawned.command,
+        expected === "fallback" ? path.join(fallbackDir, "zeditor") : expected,
+      );
+      assert.deepEqual(spawned.args, ["/workspace"]);
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+}
+
+it.effect.skipIf(windowsHost)("prefers zeditor in a later Linux fallback directory", () =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-zed-fallback-" });
+    const localBin = path.join(home, ".local/bin");
+    const systemBin = path.join(home, "system-bin");
+    for (const [dir, name] of [
+      [localBin, "zed"],
+      [systemBin, "zeditor"],
+    ] as const) {
+      yield* fs.makeDirectory(dir, { recursive: true });
+      const executable = path.join(dir, name);
+      yield* fs.writeFileString(executable, "#!/bin/sh\n");
+      yield* fs.chmod(executable, 0o755);
+    }
+    const editor = EDITORS.find((editor) => editor.id === "zed")!;
+    const resolve = resolveEditorCommand(editor, { HOME: home, PATH: "" }).pipe(
+      Effect.provideService(HostProcess.Platform, "linux"),
+      Effect.provideService(Path.Path, {
+        ...path,
+        join: (...parts) =>
+          path.join(
+            ...parts.map((part) =>
+              ["/usr/local/bin", "/usr/bin", "/snap/bin"].includes(part) ? systemBin : part,
+            ),
+          ),
+      }),
+    );
+    assert.deepEqual(
+      yield* resolve,
+      Option.some({ command: path.join(systemBin, "zeditor"), baseArgs: [] }),
+    );
+    yield* fs.remove(path.join(systemBin, "zeditor"));
+    assert.deepEqual(
+      yield* resolve,
+      Option.some({ command: path.join(localBin, "zed"), baseArgs: [] }),
+    );
+  }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+);
+
 it.effect.each([
   { editor: "webstorm", installPath: "Applications/WebStorm 2026.2.app/Contents/MacOS/webstorm" },
   { editor: "idea", installPath: "Applications/IntelliJ IDEA 2026.1.4.app/Contents/MacOS/idea" },
diff --git a/packages/shared/src/editor.ts b/packages/shared/src/editor.ts
index dd9f11b0751e4..57bc67afdcfa6 100644
--- a/packages/shared/src/editor.ts
+++ b/packages/shared/src/editor.ts
@@ -34,7 +34,8 @@ export const resolveEditorCommand = Effect.fn("editor.resolveEditorCommand")(fun
   const platform = yield* HostProcess.Platform;
   // Prefer Zed's macOS bundle because OpenZFS also installs a zed executable.
   const preferBundle = platform === "darwin" && editor.id === "zed";
-  if (!preferBundle) {
+  const preferZeditor = platform === "linux" && editor.id === "zed";
+  if (!preferBundle && !preferZeditor) {
     for (const command of editor.commands) {
       if (yield* isCommandAvailable(command, { env })) return Option.some({ command, baseArgs });
     }
@@ -129,8 +130,15 @@ export const resolveEditorCommand = Effect.fn("editor.resolveEditorCommand")(fun
       const dataHome = env.XDG_DATA_HOME || (home ? path.join(home, ".local/share") : undefined);
       if (dataHome) dirs.push(path.join(dataHome, "JetBrains/Toolbox/scripts"));
     }
-    for (const dir of dirs) {
-      for (const name of editor.commands) candidates.push(path.join(dir, name));
+    if (preferZeditor) {
+      // Linux packages use zeditor because OpenZFS owns the zed command.
+      for (const name of ["zeditor", "zed"]) {
+        candidates.push(name, ...dirs.map((dir) => path.join(dir, name)));
+      }
+    } else {
+      for (const dir of dirs) {
+        for (const name of editor.commands) candidates.push(path.join(dir, name));
+      }
     }
   }
 

From ef515949d0c1914a29a279ada1a45002f94601ed Mon Sep 17 00:00:00 2001
From: Koushik_xd <122906171+koushikxd@users.noreply.github.com>
Date: Thu, 29 Oct 2026 23:32:34 +0530
Subject: [PATCH 083/146] fix(server): native Codex subagents no longer show
 the parent's reasoning effort (#24467)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../Adapters/CodexAdapterV2.test.ts           | 106 +++++++++++++++++-
 .../Adapters/CodexAdapterV2.ts                |  12 +-
 2 files changed, 113 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
index 69fca8c0825b8..19eb2a1e23913 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
@@ -16,6 +16,7 @@ import {
   type OrchestrationV2ProviderThread,
   type OrchestrationV2ProviderTurn,
   type OrchestrationV2RuntimeRequest,
+  type OrchestrationV2Subagent,
   type OrchestrationV2TurnItem,
   ProjectId,
   type ProviderApprovalDecision,
@@ -566,6 +567,7 @@ function codexReplayPreamble(input: {
   readonly nativeTurnId: string;
   readonly prompt: string;
   readonly sentPrompt?: string;
+  readonly effort?: string;
 }): Array<CodexReplay.CodexAppServerReplayEntry> {
   return [
     {
@@ -664,7 +666,14 @@ function codexReplayPreamble(input: {
           approvalsReviewer: "user",
           sandboxPolicy: { type: "dangerFullAccess" },
           summary: "detailed",
-          collaborationMode: { mode: "default", settings: { model: "gpt-5.4" } },
+          ...(input.effort === undefined ? {} : { effort: input.effort }),
+          collaborationMode: {
+            mode: "default",
+            settings: {
+              model: "gpt-5.4",
+              ...(input.effort === undefined ? {} : { reasoning_effort: input.effort }),
+            },
+          },
         },
       },
     },
@@ -6211,6 +6220,101 @@ describe("CodexAdapterV2 post-settle continuation", () => {
       ),
   );
 
+  it.effect.each(["activity", "spawn", "activity then spawn"] as const)(
+    "creates a child from %s without the parent's effort",
+    (source) =>
+      Effect.scoped(
+        Effect.gen(function* () {
+          const created = yield* Deferred.make<OrchestrationV2AppThread>();
+          const completed = yield* Deferred.make<OrchestrationV2Subagent>();
+          const activity = {
+            type: "subAgentActivity",
+            id: "call-codex-resume-spawn",
+            kind: "started",
+            agentThreadId: RESUME_CHILD_THREAD,
+            agentPath: "/root/resume_agent",
+          };
+          const spawn = {
+            type: "collabAgentToolCall",
+            id: "call-codex-resume-spawn",
+            tool: "spawnAgent",
+            status: "completed",
+            senderThreadId: RESUME_NATIVE_THREAD,
+            receiverThreadIds: [RESUME_CHILD_THREAD],
+            model: "gpt-5.4",
+            reasoningEffort: "high",
+            agentsStates: { [RESUME_CHILD_THREAD]: { status: "completed", message: "finished" } },
+          };
+          const items =
+            source === "activity" ? [activity] : source === "spawn" ? [spawn] : [activity, spawn];
+          const harness = yield* makeCodexReplayHarness(
+            makeCodexReplayTranscript({
+              scenario: RESUME_SCENARIO,
+              entries: [
+                ...codexReplayPreamble({
+                  nativeThreadId: RESUME_NATIVE_THREAD,
+                  nativeTurnId: RESUME_NATIVE_TURN,
+                  prompt: RESUME_PROMPT,
+                  effort: "low",
+                }),
+                ...items.map((item) => ({
+                  type: "emit_inbound" as const,
+                  frame: {
+                    method: "item/completed",
+                    params: {
+                      item,
+                      threadId: RESUME_NATIVE_THREAD,
+                      turnId: RESUME_NATIVE_TURN,
+                      completedAtMs: 1782622441000,
+                    },
+                  },
+                })),
+              ],
+            }),
+            (event) =>
+              event.type === "app_thread.created"
+                ? Deferred.succeed(created, event.appThread)
+                : event.type === "subagent.updated" && event.subagent.status === "completed"
+                  ? Deferred.succeed(completed, event.subagent)
+                  : Effect.void,
+          );
+          yield* harness.runtime.startTurn({
+            ...makeCodexTestTurnInput({
+              threadId: harness.threadId,
+              providerThread: harness.providerThread,
+              now: yield* DateTime.now,
+              attemptId: RunAttemptId.make("attempt-child-effort"),
+              text: RESUME_PROMPT,
+            }),
+            modelSelection: {
+              ...CODEX_TEST_MODEL_SELECTION,
+              options: [{ id: "reasoningEffort", value: "low" }],
+            },
+          });
+          const child = yield* Deferred.await(created);
+          assert.equal(
+            child.modelSelection.options?.find(({ id }) => id === "reasoningEffort")?.value,
+            source === "spawn" ? "high" : undefined,
+          );
+          if (source !== "activity") {
+            const task = yield* Deferred.await(completed);
+            assert.equal(
+              task.modelSelection?.options?.find(({ id }) => id === "reasoningEffort")?.value,
+              "high",
+            );
+            assert.lengthOf(
+              harness.events.filter((event) => event.type === "app_thread.created"),
+              1,
+            );
+          }
+        }).pipe(
+          Effect.provide(
+            Layer.mergeAll(IdAllocator.layer, McpProviderSessions.layer, NodeServices.layer),
+          ),
+        ),
+      ),
+  );
+
   it.effect("preserves a subagent result across a trailing empty final and resume", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
index 58cd4a0c0c17b..51796da166eda 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
@@ -2717,9 +2717,6 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
             readonly emitInitialPrompt: boolean;
           }) {
             const registeredSubagents = yield* Ref.get(subagentThreads);
-            if (registeredSubagents.has(input.nativeThreadId)) {
-              return;
-            }
             if (input.model && !subagentSelections.has(input.nativeThreadId)) {
               yield* updateSubagentSelection(
                 input.nativeThreadId,
@@ -2727,6 +2724,9 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
                 input.reasoningEffort,
               );
             }
+            if (registeredSubagents.has(input.nativeThreadId)) {
+              return;
+            }
 
             const now = yield* DateTime.now;
             const subagentNodeId = idAllocator.derive.nodeFromProviderItem({
@@ -2803,9 +2803,13 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
               parentNodeId: subagentNodeId,
               activeProviderThreadId: providerThread.id,
               providerInstanceId: input.context.input.modelSelection.instanceId,
-              modelSelection: {
+              // A child's effort can differ from the parent's. Until Codex reports it, show none.
+              modelSelection: task.modelSelection ?? {
                 ...input.context.input.modelSelection,
                 model: task.model ?? input.context.input.modelSelection.model,
+                options: (input.context.input.modelSelection.options ?? []).filter(
+                  ({ id }) => id !== "reasoningEffort",
+                ),
               },
               title: subagentThreadTitle({
                 parentTitle: input.context.projectionAppThread.title,

From 3bd64cf2c1c72c3c09d8258653a8e1e2d30b5116 Mon Sep 17 00:00:00 2001
From: oliver <97427849+flamboh@users.noreply.github.com>
Date: Thu, 29 Oct 2026 11:02:57 -0700
Subject: [PATCH 084/146] fix(server): mark unread works after an automatic
 compaction (#25286)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/orchestration-v2/Orchestrator.ts      |  10 +-
 .../src/orchestration-v2/runtimeLayer.test.ts | 108 ++++++++++++++++++
 2 files changed, 116 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index d0edd5dacf8f6..94de805b46522 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -3229,8 +3229,14 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
     }
     let markUnreadVisitedAt: DateTime.Utc | null = null;
     if (command.type === "thread.mark-unread") {
-      const projection = yield* loadProjectionForCommand(command, ["runs"]);
-      const latestRunCompletedAt = projection.runs.at(-1)?.completedAt ?? null;
+      const shell = yield* projectionStore
+        .getThreadShell(command.threadId)
+        .pipe(
+          Effect.mapError(
+            (cause) => new OrchestratorProjectionError({ threadId: command.threadId, cause }),
+          ),
+        );
+      const latestRunCompletedAt = shell?.latestRunCompletedAt ?? null;
       if (latestRunCompletedAt === null) {
         return yield* new OrchestratorDispatchError({
           commandId: command.commandId,
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index 65c0c040e0daf..428202d17b651 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -6278,6 +6278,114 @@ it.layer(layerSharedApplicationDataPlaneTest)("visited projection", (it) => {
       assert.instanceOf(invalidVisit, Orchestrator.OrchestratorDispatchError);
     }),
   );
+
+  it.effect("marks unread before the user's last turn when an automatic compaction followed", () =>
+    Effect.gen(function* () {
+      const orchestrator = yield* Orchestrator.OrchestratorV2;
+      const threadId = ThreadId.make("runtime-layer-mark-unread-compacted");
+      const turnCompletedAt = DateTime.makeUnsafe("2026-07-24T10:00:00.000Z");
+      yield* orchestrator.dispatch({
+        type: "thread.create",
+        createdBy: "user",
+        creationSource: "web",
+        commandId: CommandId.make(`${threadId}:create`),
+        threadId,
+        projectId: ProjectId.make(`${threadId}:project`),
+        title: "Compacted thread",
+        modelSelection,
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        branch: null,
+        worktreePath: null,
+      });
+      const runs = [
+        { text: "Continue", at: turnCompletedAt },
+        {
+          text: "/compact",
+          idleCompaction: "beforeCacheExpires" as const,
+          at: DateTime.makeUnsafe("2026-07-24T11:00:00.000Z"),
+        },
+      ];
+      yield* (yield* EventSink.EventSinkV2).write({
+        commandId: CommandId.make(`${threadId}:seed`),
+        events: runs.flatMap(({ at, ...message }, index) => {
+          const runId = RunId.make(`${threadId}:run-${index}`);
+          const messageId = MessageId.make(`${threadId}:message-${index}`);
+          return [
+            {
+              id: EventId.make(`${messageId}:event`),
+              type: "message.updated" as const,
+              threadId,
+              occurredAt: at,
+              payload: {
+                ...message,
+                id: messageId,
+                threadId,
+                runId,
+                nodeId: null,
+                role: "user" as const,
+                attachments: [],
+                streaming: false,
+                createdBy: "user" as const,
+                creationSource: "web" as const,
+                createdAt: at,
+                updatedAt: at,
+              },
+            },
+            {
+              id: EventId.make(`${runId}:event`),
+              type: "run.created" as const,
+              threadId,
+              runId,
+              providerInstanceId: modelSelection.instanceId,
+              occurredAt: at,
+              payload: {
+                id: runId,
+                threadId,
+                ordinal: index + 1,
+                providerInstanceId: modelSelection.instanceId,
+                modelSelection,
+                providerThreadId: null,
+                userMessageId: messageId,
+                rootNodeId: null,
+                activeAttemptId: null,
+                status: "completed" as const,
+                queuePosition: null,
+                requestedAt: at,
+                startedAt: at,
+                completedAt: at,
+                checkpointId: null,
+                contextHandoffId: null,
+              },
+            },
+          ];
+        }),
+      });
+
+      yield* orchestrator.dispatch({
+        type: "thread.mark-unread",
+        commandId: CommandId.make(`${threadId}:mark-unread`),
+        threadId,
+      });
+      const projection = yield* orchestrator.getThreadProjection(threadId);
+      assert.deepEqual(
+        projection.thread.lastVisitedAt,
+        DateTime.subtract(turnCompletedAt, { milliseconds: 1 }),
+      );
+      const shell = yield* orchestrator.getThreadShell(threadId);
+      assert.deepEqual(shell!.latestRunCompletedAt, turnCompletedAt);
+      assert.deepEqual(shell!.lastVisitedAt, projection.thread.lastVisitedAt);
+
+      yield* orchestrator.dispatch({
+        type: "thread.visit",
+        commandId: CommandId.make(`${threadId}:visit`),
+        threadId,
+        visitedAt: DateTime.formatIso(turnCompletedAt),
+      });
+      const revisited = yield* orchestrator.getThreadShell(threadId);
+      assert.deepEqual(revisited!.lastVisitedAt, turnCompletedAt);
+    }),
+  );
 });
 
 it.layer(Layer.fresh(layerSharedApplicationDataPlaneTest))("thread opens", (it) => {

From a1621a81af727fe40bdb2a351860b2704827d31c Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:03:19 +0000
Subject: [PATCH 085/146] fix(server): show MCP App forms from failed tool
 results (#25225)

Co-authored-by: shivam <91240327+shivamhwp@users.noreply.github.com>
---
 apps/mobile/src/lib/threadActivity.test.ts    | 18 +++++
 apps/mobile/src/lib/threadActivity.ts         |  5 +-
 .../Adapters/CodexAdapterV2.test.ts           | 67 +++++++++++++++++++
 .../Adapters/CodexAdapterV2.ts                | 10 ++-
 apps/web/src/session-logic.test.ts            | 17 +++++
 apps/web/src/session-logic.ts                 |  5 +-
 6 files changed, 112 insertions(+), 10 deletions(-)

diff --git a/apps/mobile/src/lib/threadActivity.test.ts b/apps/mobile/src/lib/threadActivity.test.ts
index f2ced2d689794..96626a5caefab 100644
--- a/apps/mobile/src/lib/threadActivity.test.ts
+++ b/apps/mobile/src/lib/threadActivity.test.ts
@@ -38,6 +38,24 @@ const threadId = ThreadId.make("thread-1");
 const sourceThreadId = ThreadId.make("thread-source");
 const runId = RunId.make("run-1");
 
+it("shows a captured MCP app for a failed deferred write", () => {
+  const mcpApp = {
+    attachmentId: "deferred-app-html",
+    server: "github",
+    tool: "create_pull_request",
+    resourceUri: "ui://github-mcp-server/pr-create",
+  };
+  const item: OrchestrationV2TurnItem = {
+    ...base("deferred-app", "2026-08-29T00:00:00.000Z", 1),
+    type: "dynamic_tool",
+    toolName: "github.create_pull_request",
+    status: "failed",
+    input: {},
+    output: { t3McpApp: mcpApp, result: { content: [], isError: true } },
+  };
+  expect(buildThreadFeed([projected(item, 0)])).toMatchObject([{ type: "mcp-app", app: mcpApp }]);
+});
+
 it("keeps historical plan detail accessible from its paged turn item", () => {
   const item = {
     ...base("historical-plan", "2026-08-29T00:00:00.000Z", 1),
diff --git a/apps/mobile/src/lib/threadActivity.ts b/apps/mobile/src/lib/threadActivity.ts
index 4cc5a842c21f9..bd7af44b2fa07 100644
--- a/apps/mobile/src/lib/threadActivity.ts
+++ b/apps/mobile/src/lib/threadActivity.ts
@@ -2102,10 +2102,7 @@ export function buildThreadFeed(
       entryRows.push(index);
       continue;
     }
-    const app =
-      item.type === "dynamic_tool" && item.status === "completed"
-        ? mcpAppFromToolItem(item)
-        : undefined;
+    const app = item.type === "dynamic_tool" ? mcpAppFromToolItem(item) : undefined;
     if (app) {
       const entry: RawThreadFeedEntry = {
         type: "mcp-app",
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
index 19eb2a1e23913..c20994423f3e9 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts
@@ -5138,6 +5138,73 @@ describe("CodexAdapterV2 post-settle continuation", () => {
     ),
   );
 
+  const MCP_APP_DEFERRED_RESULT = {
+    content: [{ type: "text", text: "An interactive form is being shown to the user." }],
+    structuredContent: { status: "awaiting_user_submission" },
+  };
+  const mcpAppDeferredTranscript = makeCodexReplayTranscript({
+    scenario: MCP_APP_SCENARIO,
+    entries: mcpAppTranscript.entries.map((entry) =>
+      entry.type === "emit_inbound" && entry.label === "item/completed/app-tool"
+        ? {
+            ...entry,
+            frame: {
+              method: "item/completed",
+              params: {
+                item: {
+                  ...mcpAppToolItem("inProgress"),
+                  status: "failed",
+                  result: MCP_APP_DEFERRED_RESULT,
+                },
+                threadId: MCP_APP_NATIVE_THREAD,
+                turnId: MCP_APP_NATIVE_TURN,
+                completedAtMs: 1782622441500,
+              },
+            },
+          }
+        : entry,
+    ),
+  });
+
+  it.effect("captures the app of a tool call that defers to its form", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const appCaptured = yield* Deferred.make<OrchestrationV2TurnItem>();
+        const harness = yield* makeCodexReplayHarness(mcpAppDeferredTranscript, (event) =>
+          event.type === "turn_item.updated" &&
+          event.turnItem.type === "dynamic_tool" &&
+          event.turnItem.status === "failed"
+            ? Deferred.succeed(appCaptured, event.turnItem)
+            : Effect.void,
+        );
+        const now = yield* DateTime.now;
+
+        yield* harness.runtime.startTurn(
+          makeCodexTestTurnInput({
+            threadId: harness.threadId,
+            providerThread: harness.providerThread,
+            now,
+            attemptId: RunAttemptId.make("attempt-codex-mcp-app-deferred"),
+            text: MCP_APP_PROMPT,
+          }),
+        );
+        const item = yield* Deferred.await(appCaptured);
+
+        const output = item.type === "dynamic_tool" ? (item.output as Record<string, unknown>) : {};
+        assert.equal(
+          readMcpAppReference(output[MCP_APP_OUTPUT_KEY])?.resourceUri,
+          MCP_APP_RESOURCE,
+        );
+        assert.deepEqual(output.result, { ...MCP_APP_DEFERRED_RESULT, isError: true });
+        assert.isFalse(yield* harness.hasPendingBackgroundWork);
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(IdAllocator.layer, McpProviderSessions.layer, NodeServices.layer),
+        ),
+      ),
+    ),
+  );
+
   const ORPHAN_WAIT_SCENARIO = "codex-orphaned-dynamic-tool";
   const ORPHAN_WAIT_NATIVE_THREAD = "native-codex-orphan-wait-thread";
   const ORPHAN_WAIT_NATIVE_TURN = "native-codex-orphan-wait-turn";
diff --git a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
index 51796da166eda..51a686e270389 100644
--- a/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts
@@ -3744,7 +3744,7 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
           Effect.uninterruptibleMask((restore) =>
             Effect.gen(function* () {
               const reference =
-                item.status === "completed" && item.result != null && item.error == null
+                item.result != null && item.error == null
                   ? yield* restore(
                       getNativeThreadId(context.providerThread).pipe(
                         Effect.flatMap((threadId) =>
@@ -3798,7 +3798,13 @@ export const makeCodexAdapterV2 = Effect.fn("makeCodexAdapterV2")(function* (
                   ? artifacts.turnItem
                   : {
                       ...artifacts.turnItem,
-                      output: { [MCP_APP_OUTPUT_KEY]: reference, result: item.result },
+                      output: {
+                        [MCP_APP_OUTPUT_KEY]: reference,
+                        result:
+                          item.status === "failed"
+                            ? { ...item.result, isError: true }
+                            : item.result,
+                      },
                     };
               yield* emitProviderEvent({
                 type: "node.updated",
diff --git a/apps/web/src/session-logic.test.ts b/apps/web/src/session-logic.test.ts
index 9c4e38c30e510..df3eb85c3db38 100644
--- a/apps/web/src/session-logic.test.ts
+++ b/apps/web/src/session-logic.test.ts
@@ -1307,6 +1307,23 @@ describe("HTML renders in the timeline", () => {
     expect(rowsFor(entries, false)).toEqual(["message", "turn-fold", "mcp-app", "message"]);
   });
 
+  it("hosts an MCP app whose call failed, as a form-deferring write does", () => {
+    const mcpApp = {
+      attachmentId: "render-thread-app-html",
+      server: "github",
+      tool: "create_pull_request",
+      resourceUri: "ui://github-mcp-server/pr-create",
+    };
+    const call = renderCall("failed", {
+      t3McpApp: mcpApp,
+      result: { content: [], isError: true },
+    });
+    const entries = turn(
+      call.type === "dynamic_tool" ? { ...call, toolName: "github.create_pull_request" } : call,
+    );
+    expect(entries.find((entry) => entry.kind === "mcp-app")).toMatchObject({ mcpApp });
+  });
+
   it("keeps a render visible when its superseded attempt folds", () => {
     const attempt: OrchestrationV2RunAttempt = {
       id: RunAttemptId.make("attempt-superseded"),
diff --git a/apps/web/src/session-logic.ts b/apps/web/src/session-logic.ts
index 7b79dea6f7401..6cf2761d3d6d3 100644
--- a/apps/web/src/session-logic.ts
+++ b/apps/web/src/session-logic.ts
@@ -711,10 +711,7 @@ export function deriveTimelineEntriesFromVisibleTurnItems(
       continue;
     }
 
-    const mcpApp =
-      item.type === "dynamic_tool" && item.status === "completed"
-        ? mcpAppFromToolItem(item)
-        : undefined;
+    const mcpApp = item.type === "dynamic_tool" ? mcpAppFromToolItem(item) : undefined;
     if (mcpApp !== undefined) {
       entries.push({
         id: item.id,

From ad5ba437bd0b467879915efa9a14411b71a54fe7 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:03:42 +0000
Subject: [PATCH 086/146] fix(server): restore Linux session display for editor
 launches (#25228)

Co-authored-by: Inaya Yousfi <193243337+inayayousfi@users.noreply.github.com>
---
 .../src/process/externalLauncher.test.ts      | 73 +++++++++++++++++++
 apps/server/src/process/externalLauncher.ts   | 54 +++++++++++++-
 2 files changed, 126 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/process/externalLauncher.test.ts b/apps/server/src/process/externalLauncher.test.ts
index 265c4a2fc36bd..3262c555bcf8c 100644
--- a/apps/server/src/process/externalLauncher.test.ts
+++ b/apps/server/src/process/externalLauncher.test.ts
@@ -140,6 +140,79 @@ it.effect.skipIf(windowsHost)(
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
 );
 
+// Windows drive letters cannot resolve the POSIX editor stub.
+it.effect.skipIf(windowsHost)(
+  "a Linux editor launch without a display takes the desktop session's display from the systemd user manager",
+  () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const binDir = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-editors-" });
+      const codiumPath = path.join(binDir, "codium");
+      yield* fileSystem.writeFileString(codiumPath, "#!/bin/sh\n");
+      yield* fileSystem.chmod(codiumPath, 0o755);
+
+      const launchEnv = (sessionManager: MockSpawnResult) =>
+        Effect.gen(function* () {
+          const spawned: ChildProcess.StandardCommand[] = [];
+          yield* Effect.gen(function* () {
+            const launcher = yield* ExternalLauncher.ExternalLauncher;
+            yield* launcher.launchEditor({ editor: "vscodium", cwd: "/workspace" });
+            yield* launcher.launchBrowser("https://example.com");
+          }).pipe(
+            Effect.provide(
+              layerTest({
+                platform: "linux",
+                env: { PATH: binDir },
+                onSpawn: (command) => spawned.push(command),
+                spawnResult: (command) =>
+                  command.command === "busctl" ? sessionManager : undefined,
+              }),
+            ),
+            Effect.provideService(HostProcess.Environment, { PATH: binDir }),
+          );
+          // Only editors borrow the session display; a browser must not open on that screen.
+          assert.deepEqual(spawned.find((command) => command.command === "xdg-open")?.options.env, {
+            PATH: binDir,
+          });
+          return spawned.find((command) => command.command === "codium")?.options.env;
+        });
+
+      assert.deepEqual(
+        yield* launchEnv({
+          stdout: JSON.stringify({
+            type: "as",
+            data: [
+              "DISPLAY=:0",
+              "HOME=/home/user",
+              "WAYLAND_DISPLAY=wayland-1",
+              "XAUTHORITY=/home/user/auth files/cookie",
+            ],
+          }),
+        }),
+        {
+          PATH: binDir,
+          DISPLAY: ":0",
+          WAYLAND_DISPLAY: "wayland-1",
+          // Raw, not the $'...' quoting `systemctl show-environment` would print.
+          XAUTHORITY: "/home/user/auth files/cookie",
+        },
+      );
+      assert.deepEqual(yield* launchEnv({ stdout: "invalid JSON" }), { PATH: binDir });
+      assert.deepEqual(yield* launchEnv({ stdout: '{"data":[42]}' }), { PATH: binDir });
+      assert.deepEqual(
+        yield* launchEnv({
+          spawnError: PlatformError.systemError({
+            _tag: "NotFound",
+            module: "ChildProcess",
+            method: "spawn",
+          }),
+        }),
+        { PATH: binDir },
+      );
+    }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+);
+
 it.effect("launches an installed editor with platform-safe arguments", () =>
   Effect.gen(function* () {
     const fileSystem = yield* FileSystem.FileSystem;
diff --git a/apps/server/src/process/externalLauncher.ts b/apps/server/src/process/externalLauncher.ts
index b8c0911a520d2..6a2eb145162e2 100644
--- a/apps/server/src/process/externalLauncher.ts
+++ b/apps/server/src/process/externalLauncher.ts
@@ -31,6 +31,7 @@ import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Ref from "effect/Ref";
+import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import * as ChildProcess from "effect/process/ChildProcess";
@@ -672,6 +673,56 @@ const launchEditor = Effect.fn("externalLauncher.launchEditor")(function* (
   yield* launchEditorProcess(launch);
 });
 
+const GRAPHICAL_SESSION_ENV_KEYS: ReadonlySet<string> = new Set([
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "XAUTHORITY",
+]);
+
+// The user manager's environment over D-Bus. `systemctl show-environment` would
+// shell-quote values with spaces as $'...', while this JSON carries them raw.
+const decodeManagerEnvironment = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(Schema.Struct({ data: Schema.Array(Schema.String) })),
+);
+
+// Boot services miss the desktop environment imported later into the systemd user manager.
+const readGraphicalSessionEnv = Effect.fn("externalLauncher.readGraphicalSessionEnv")(
+  function* () {
+    const hostEnv = yield* HostProcess.Environment;
+    if ((yield* HostProcess.Platform) !== "linux" || hasGraphicalLinuxSession(hostEnv)) {
+      return {};
+    }
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const output = yield* spawner.string(
+      ChildProcess.make(
+        "busctl",
+        [
+          "--user",
+          "--json=short",
+          "get-property",
+          "org.freedesktop.systemd1",
+          "/org/freedesktop/systemd1",
+          "org.freedesktop.systemd1.Manager",
+          "Environment",
+        ],
+        { stdin: "ignore", stderr: "ignore" },
+      ),
+    );
+    const { data } = yield* decodeManagerEnvironment(output);
+    return Object.fromEntries(
+      data.flatMap((line) => {
+        const separator = line.indexOf("=");
+        const key = line.slice(0, separator);
+        return separator > 0 && GRAPHICAL_SESSION_ENV_KEYS.has(key)
+          ? [[key, line.slice(separator + 1)]]
+          : [];
+      }),
+    );
+  },
+  Effect.timeout("2 seconds"),
+  Effect.orElseSucceed((): NodeJS.ProcessEnv => ({})),
+);
+
 const launchAndUnref = Effect.fn("externalLauncher.launchAndUnref")(function* (
   launch: ProcessLaunch,
   onError: (cause: unknown) => ExternalLauncherError,
@@ -681,7 +732,7 @@ const launchAndUnref = Effect.fn("externalLauncher.launchAndUnref")(function* (
   const { ELECTRON_RUN_AS_NODE: _runAsNode, ...env } = yield* HostProcess.Environment;
   const command = ChildProcess.make(launch.command, launch.args, {
     ...launch.options,
-    env,
+    env: { ...env, ...launch.options.env },
     extendEnv: false,
   });
 
@@ -735,6 +786,7 @@ const launchEditorProcess = Effect.fn("externalLauncher.launchEditorProcess")(fu
       options: {
         detached: launch.detached ?? true,
         shell: spawnCommand.shell,
+        env: yield* readGraphicalSessionEnv(),
         stdin: "ignore",
         stdout: "ignore",
         stderr: "ignore",

From 9e60e945d27a27f6505d0718122473454ce4afae Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:04:04 +0000
Subject: [PATCH 087/146] fix(usage): keep host identity across container
 recreation (#25220)

Co-authored-by: maria <254055478+maria-rcks@users.noreply.github.com>
---
 apps/server/src/usage/UsageService.test.ts | 89 ++++++++++++++++++++++
 apps/server/src/usage/UsageService.ts      | 35 ++++++++-
 docs/user/usage.md                         |  4 +
 3 files changed, 125 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/usage/UsageService.test.ts b/apps/server/src/usage/UsageService.test.ts
index b77d3437bef78..bee7a8a480bc1 100644
--- a/apps/server/src/usage/UsageService.test.ts
+++ b/apps/server/src/usage/UsageService.test.ts
@@ -142,6 +142,7 @@ const layerService = (input: {
   ) => Effect.Effect<Response, HttpClientError.HttpClientError>;
   readonly environment?: NodeJS.ProcessEnv;
   readonly platform?: NodeJS.Platform;
+  readonly hostname?: string;
 }) =>
   layerCursorUsageAccounts(
     CursorAccountReader.layer.pipe(Layer.provide(CursorKeychain.layer)),
@@ -157,6 +158,7 @@ const layerService = (input: {
     ),
     Layer.provideMerge(NodeServices.layer),
     Layer.provideMerge(Layer.succeed(HostProcess.Platform, input.platform ?? "linux")),
+    Layer.provideMerge(Layer.succeed(HostProcess.Hostname, input.hostname ?? "usage-test-host")),
     Layer.provideMerge(ServerSettings.layerTest(input.settings)),
     Layer.provideMerge(
       Layer.succeed(
@@ -465,6 +467,93 @@ describe("Codex usage history", () => {
 });
 
 describe("UsageService", () => {
+  it.live("keeps the first host identity across recreation and explicit override removal", () =>
+    Effect.gen(function* () {
+      const { transcript, settings, home } = yield* setup;
+      yield* Effect.promise(() => NodeFSP.writeFile(transcript, claudeLine(1, 5)));
+      for (const [hostname, override, expected] of [
+        ["container-a", undefined, "container-a"],
+        ["container-b", undefined, "container-a"],
+        ["container-c", "physical-host", "physical-host"],
+        ["container-d", undefined, "container-a"],
+      ] as const) {
+        const summary = yield* Effect.gen(function* () {
+          const service = yield* UsageService.make;
+          return yield* service.readSummary(WINDOW);
+        }).pipe(
+          Effect.scoped,
+          Effect.provide(
+            layerService({
+              prefix: "usage-host-id",
+              home,
+              settings,
+              hostname,
+              environment: override === undefined ? {} : { T3CODE_HOST_ID: override },
+            }),
+          ),
+        );
+        const source = summary.sources.find((source) => source.fingerprint.provider === "claude");
+        assert.strictEqual(source?.fingerprint.hostId, expected);
+      }
+    }).pipe(Effect.scoped),
+  );
+
+  it.live("concurrent initialization keeps one host identity across service recreation", () =>
+    Effect.gen(function* () {
+      const { transcript, settings, home } = yield* setup;
+      yield* Effect.promise(() => NodeFSP.writeFile(transcript, claudeLine(1, 5)));
+      const prefix = "usage-host-id-race";
+      const hostIdPath = NodePath.join(home, prefix, "usage-host-id");
+      const bothRead = yield* Deferred.make<void>();
+      let reads = 0;
+      const summaries = yield* Effect.forEach(
+        ["container-a", "container-b"],
+        (hostname) =>
+          Effect.gen(function* () {
+            const fileSystem = yield* FileSystem.FileSystem;
+            let firstRead = true;
+            const service = yield* UsageService.make.pipe(
+              Effect.provideService(FileSystem.FileSystem, {
+                ...fileSystem,
+                readFileString: (path, encoding) =>
+                  Effect.gen(function* () {
+                    if (path !== hostIdPath || !firstRead) {
+                      return yield* fileSystem.readFileString(path, encoding);
+                    }
+                    firstRead = false;
+                    // Both instances observe the missing file before either can create it.
+                    const result = yield* Effect.exit(fileSystem.readFileString(path, encoding));
+                    reads += 1;
+                    if (reads === 2) yield* Deferred.succeed(bothRead, undefined);
+                    yield* Deferred.await(bothRead);
+                    return yield* result;
+                  }),
+              }),
+            );
+            return yield* service.readSummary(WINDOW);
+          }).pipe(
+            Effect.scoped,
+            Effect.provide(layerService({ prefix, home, settings, hostname })),
+          ),
+        { concurrency: "unbounded" },
+      );
+      const persisted = yield* Effect.promise(() => NodeFSP.readFile(hostIdPath, "utf8"));
+      const hostId = persisted.trim();
+      assert.include(["container-a", "container-b"], hostId);
+      const restarted = yield* Effect.gen(function* () {
+        const service = yield* UsageService.make;
+        return yield* service.readSummary(WINDOW);
+      }).pipe(
+        Effect.scoped,
+        Effect.provide(layerService({ prefix, home, settings, hostname: "container-c" })),
+      );
+      for (const summary of [...summaries, restarted]) {
+        const source = summary.sources.find((source) => source.fingerprint.provider === "claude");
+        assert.strictEqual(source?.fingerprint.hostId, hostId);
+      }
+    }).pipe(Effect.scoped),
+  );
+
   it.live(
     "repairs initial Codex prices after unchanged-file retries, persists evidence and corrections, and honors later native tiers",
     () =>
diff --git a/apps/server/src/usage/UsageService.ts b/apps/server/src/usage/UsageService.ts
index 6150ab1d3cc35..c1f619eaae177 100644
--- a/apps/server/src/usage/UsageService.ts
+++ b/apps/server/src/usage/UsageService.ts
@@ -1,5 +1,3 @@
-import * as NodeOS from "node:os";
-
 import {
   type ProviderInstanceConfig,
   ProviderInstanceId,
@@ -155,6 +153,7 @@ export const make = Effect.gen(function* () {
   const settingsService = yield* ServerSettings.ServerSettingsService;
   const httpClient = yield* HttpClient.HttpClient;
   const hostEnvironment = yield* HostProcess.Environment;
+  const hostname = yield* HostProcess.Hostname;
   const readerContext = yield* Effect.context<BuiltInUsageReadersEnv>();
 
   const fileCache: ScanCache = new Map();
@@ -177,6 +176,37 @@ export const make = Effect.gen(function* () {
       Effect.provideService(FileSystem.FileSystem, fileSystem),
       Effect.provideService(Path.Path, path),
     );
+  const hostIdPath = path.join(config.baseDir, "usage-host-id");
+  const explicitHostId = hostEnvironment["T3CODE_HOST_ID"]?.trim();
+  const hostId =
+    explicitHostId ||
+    (yield* fileSystem.readFileString(hostIdPath).pipe(
+      Effect.catchIf(
+        (error) => error.reason._tag === "NotFound",
+        () =>
+          Effect.scoped(
+            Effect.gen(function* () {
+              yield* fileSystem.makeDirectory(config.baseDir, { recursive: true });
+              const tempDirectory = yield* fileSystem.makeTempDirectoryScoped({
+                directory: config.baseDir,
+                prefix: "usage-host-id.",
+              });
+              const tempFile = path.join(tempDirectory, "identity");
+              yield* fileSystem.writeFileString(tempFile, `${hostname}\n`);
+              // Publish complete contents without replacing another initializer's identity.
+              yield* fileSystem.link(tempFile, hostIdPath).pipe(
+                Effect.catchIf(
+                  (error) => error.reason._tag === "AlreadyExists",
+                  () => Effect.void,
+                ),
+              );
+              return yield* fileSystem.readFileString(hostIdPath);
+            }),
+          ),
+      ),
+      Effect.map((value) => value.trim() || hostname),
+      Effect.orElseSucceed(() => hostname),
+    ));
   let rates: RateTable = new Map();
   let ratesFetchedAtMs: number | null = null;
   let ratesLastFailedAtMs: number | null = null;
@@ -664,7 +694,6 @@ export const make = Effect.gen(function* () {
     const startedAtMs = yield* Clock.currentTimeMillis;
     yield* ensureScanCacheLoaded;
 
-    const hostId = NodeOS.hostname();
     const windowStart = DateTime.make(`${input.sinceDay}T00:00:00Z`);
     if (Option.isNone(windowStart)) {
       return yield* new UsageReadError({
diff --git a/docs/user/usage.md b/docs/user/usage.md
index 155175351c550..af1fc02352f83 100644
--- a/docs/user/usage.md
+++ b/docs/user/usage.md
@@ -43,6 +43,10 @@ Use absolute paths or `~/` paths in the account's environment settings; relative
 depend on each project's working directory and cannot be reliably discovered by Usage. Accounts
 sharing a history directory count once.
 
+The server saves its first hostname in `<T3 home>/usage-host-id`, so a recreated container keeps
+its usage identity when T3 home is persisted. Set `T3CODE_HOST_ID` to choose the identity
+explicitly.
+
 When your app and server support different providers, usage totals may cover only the providers
 your app understands. Update the app to include newly supported providers.
 

From d796063f78a96c8816196fac3fa5660bebdd99a9 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:04:25 +0000
Subject: [PATCH 088/146] fix(opencode): authenticate with the resolved server
 password (#25230)

Co-authored-by: Alex Southwell <4596216+saphid@users.noreply.github.com>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../src/server/adapter.test.ts                | 126 ++++++++++++++++++
 .../provider-opencode/src/server/adapter.ts   |   7 +-
 2 files changed, 131 insertions(+), 2 deletions(-)

diff --git a/packages/provider-opencode/src/server/adapter.test.ts b/packages/provider-opencode/src/server/adapter.test.ts
index 41da6bd0ff435..52f7590e63f42 100644
--- a/packages/provider-opencode/src/server/adapter.test.ts
+++ b/packages/provider-opencode/src/server/adapter.test.ts
@@ -1,3 +1,8 @@
+// @effect-diagnostics-next-line nodeBuiltinImport:off - Exercise HTTP authentication with the real SDK.
+import * as NodeHttp from "node:http";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as OpenCodeServerLedger from "./OpenCodeServerLedger.ts";
 import { assert, describe, it } from "@effect/vitest";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import type { OpencodeClient, ToolPart } from "@opencode-ai/sdk/v2";
@@ -50,6 +55,7 @@ import {
 import * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
 
 const encodeUnknownJson = Schema.encodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+const decodeOpenCodeSettings = Schema.decodeEffect(OpenCodeSettings);
 const OPEN_CODE_TEST_SETTINGS = Schema.decodeSync(OpenCodeSettings)({
   serverUrl: "http://test.invalid",
 });
@@ -2671,3 +2677,123 @@ it.effect.each([false, true])(
       Effect.scoped,
     ),
 );
+
+it.live.each([true, false])("opens an authenticated OpenCode session (external=%s)", (external) =>
+  Effect.gen(function* () {
+    const password = external ? "settings-password" : "environment-password";
+    const requests: string[] = [];
+    let eventConnected!: () => void;
+    const eventRequest = new Promise<void>((resolve) => {
+      eventConnected = resolve;
+    });
+    const server = yield* Effect.acquireRelease(
+      Effect.promise(
+        () =>
+          new Promise<ReturnType<typeof NodeHttp.createServer>>((resolve) => {
+            const server = NodeHttp.createServer((request, response) => {
+              if (
+                request.headers.authorization !==
+                `Basic ${Buffer.from(`opencode:${password}`).toString("base64")}`
+              ) {
+                response.writeHead(401).end("Unauthorized");
+                return;
+              }
+              const url = new URL(request.url!, "http://localhost");
+              requests.push(url.pathname);
+              if (url.pathname === "/event") {
+                response.writeHead(200, { "Content-Type": "text/event-stream" });
+                response.write(": connected\n\n");
+                eventConnected();
+                return;
+              }
+              response.writeHead(200, { "Content-Type": "application/json" });
+              response.end(
+                JSON.stringify(
+                  url.pathname.endsWith("/children")
+                    ? []
+                    : url.pathname === "/session"
+                      ? { id: "native-auth", time: { created: 1, updated: 1 } }
+                      : { healthy: true, version: "1.14.19" },
+                ),
+              );
+            });
+            server.listen(0, "127.0.0.1", () => resolve(server));
+          }),
+      ),
+      (server) =>
+        Effect.promise(
+          () =>
+            new Promise<void>((resolve) => {
+              server.closeAllConnections();
+              server.close(() => resolve());
+            }),
+        ),
+    );
+    const address = server.address();
+    assert.isNotNull(address);
+    if (!address || typeof address === "string") return;
+    const url = `http://127.0.0.1:${address.port}`;
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    let managedStarts = 0;
+    const runtimeLayer = OpenCodeRuntime.layer.pipe(
+      Layer.provide(
+        Layer.succeed(
+          ChildProcessSpawner.ChildProcessSpawner,
+          ChildProcessSpawner.make((command) => {
+            assert.isTrue(ChildProcess.isStandardCommand(command));
+            if (!ChildProcess.isStandardCommand(command)) return Effect.die("Unexpected pipeline");
+            assert.include(command.args, "serve");
+            assert.equal(command.options.env?.OPENCODE_SERVER_PASSWORD, password);
+            managedStarts += 1;
+            return spawner.spawn(
+              ChildProcess.make(
+                process.execPath,
+                [
+                  "-e",
+                  `console.log("server listening on " + process.argv[1]); setInterval(() => {}, 1000)`,
+                  url,
+                ],
+                command.options,
+              ),
+            );
+          }),
+        ),
+      ),
+      Layer.provide(OpenCodeServerLedger.layerTest),
+      Layer.provideMerge(NodeServices.layer),
+    );
+    const instanceId = ProviderInstanceId.make("opencode-auth");
+    const adapter = yield* makeOpenCodeAdapterV2({
+      instanceId,
+      settings: yield* decodeOpenCodeSettings({
+        serverUrl: external ? url : "",
+        ...(external ? { serverPassword: password } : {}),
+      }),
+      environment: { OPENCODE_SERVER_PASSWORD: "environment-password" },
+    }).pipe(Effect.provide(runtimeLayer));
+    const session = yield* adapter.openSession({
+      threadId: ThreadId.make("thread-opencode-auth"),
+      providerSessionId: ProviderSessionId.make("session-opencode-auth"),
+      modelSelection: { instanceId, model: "anthropic/claude-sonnet", options: [] },
+      runtimePolicy: { runtimeMode: "full-access", interactionMode: "default", cwd: null },
+    });
+    yield* session.ensureThread({
+      threadId: ThreadId.make("thread-opencode-auth"),
+      modelSelection: { instanceId, model: "anthropic/claude-sonnet", options: [] },
+      runtimePolicy: { runtimeMode: "full-access", interactionMode: "default", cwd: null },
+    });
+    assert.include(requests, "/session");
+    yield* Effect.promise(() => eventRequest);
+    assert.include(requests, "/event");
+    assert.include(requests, "/global/health");
+    assert.equal(managedStarts, external ? 0 : 1);
+  }).pipe(
+    Effect.scoped,
+    Effect.provide([
+      NodeServices.layer,
+      TestProviderHost.layer().pipe(Layer.provide(NodeServices.layer)),
+      IdAllocator.layer,
+      McpProviderSessions.layer,
+    ]),
+  ),
+);
diff --git a/packages/provider-opencode/src/server/adapter.ts b/packages/provider-opencode/src/server/adapter.ts
index 2a851188d076e..7762c3b64503d 100644
--- a/packages/provider-opencode/src/server/adapter.ts
+++ b/packages/provider-opencode/src/server/adapter.ts
@@ -936,13 +936,16 @@ export const makeOpenCodeAdapterV2 = Effect.fn("makeOpenCodeAdapterV2")(function
           binaryPath: options.settings.binaryPath,
           directory: cwd,
           serverUrl: options.settings.serverUrl,
+          ...(options.settings.serverPassword
+            ? { serverPassword: options.settings.serverPassword }
+            : {}),
           environment: options.environment,
         });
         const client = runtime.createOpenCodeSdkClient({
           baseUrl: connection.url,
           directory: cwd,
-          ...(connection.external && options.settings.serverPassword
-            ? { serverPassword: options.settings.serverPassword }
+          ...(connection.serverPassword !== undefined
+            ? { serverPassword: connection.serverPassword }
             : {}),
         });
 

From f06dd4bbf5ad19226344279effcaa5928ce452f0 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:04:47 +0000
Subject: [PATCH 089/146] feat(web): allow resizing the file explorer (#25737)

Co-authored-by: Rishabh Bothra <37180068+07rjain@users.noreply.github.com>
---
 .../src/components/files/FileExplorerPane.tsx | 90 +++++++++++++++++++
 .../src/components/files/FilePreviewPanel.tsx | 12 +--
 .../preview/RightPanelResizeHandle.tsx        | 13 ++-
 apps/web/src/hooks/useResizableWidth.ts       | 19 ++--
 4 files changed, 116 insertions(+), 18 deletions(-)
 create mode 100644 apps/web/src/components/files/FileExplorerPane.tsx

diff --git a/apps/web/src/components/files/FileExplorerPane.tsx b/apps/web/src/components/files/FileExplorerPane.tsx
new file mode 100644
index 0000000000000..c13a814f63051
--- /dev/null
+++ b/apps/web/src/components/files/FileExplorerPane.tsx
@@ -0,0 +1,90 @@
+import { type CSSProperties, type ReactNode, useState } from "react";
+
+import { RightPanelResizeHandle } from "~/components/preview/RightPanelResizeHandle";
+import { RESIZABLE_WIDTH_PROPERTY, useResizableWidth } from "~/hooks/useResizableWidth";
+import { observeResize } from "~/lib/observeResize";
+import { cn } from "~/lib/utils";
+
+const MIN_WIDTH = 160;
+const MAX_WIDTH = 560;
+const FILE_CONTENT_MIN_WIDTH = 256;
+
+export function FileExplorerPane({
+  resizable,
+  children,
+}: {
+  resizable: boolean;
+  children: ReactNode;
+}) {
+  const [maxWidth, setMaxWidth] = useState(MAX_WIDTH);
+  const { width, setWidth, handlers } = useResizableWidth({
+    storageKey: "t3code.fileExplorerWidth",
+    defaultWidth: 256,
+    minWidth: MIN_WIDTH,
+    maxWidth,
+    edge: "left",
+  });
+
+  return (
+    <aside
+      ref={(host) => {
+        const row = host?.parentElement;
+        if (!row || !resizable) return;
+        const measure = () =>
+          setMaxWidth(
+            Math.max(MIN_WIDTH, Math.min(MAX_WIDTH, row.clientWidth - FILE_CONTENT_MIN_WIDTH)),
+          );
+        measure();
+        return observeResize(row, measure);
+      }}
+      aria-label="File explorer"
+      className={cn(
+        "relative flex min-h-0 min-w-0 shrink-0 bg-background",
+        resizable ? "border-l border-border/60" : "flex-1",
+      )}
+      style={
+        resizable
+          ? ({
+              [RESIZABLE_WIDTH_PROPERTY]: `${width}px`,
+              width: `var(${RESIZABLE_WIDTH_PROPERTY})`,
+            } as CSSProperties)
+          : undefined
+      }
+    >
+      {resizable ? (
+        <RightPanelResizeHandle
+          handlers={handlers}
+          label="Resize file explorer"
+          tabIndex={0}
+          aria-valuenow={width}
+          aria-valuemin={MIN_WIDTH}
+          aria-valuemax={maxWidth}
+          onKeyDown={(event) => {
+            if (event.altKey || event.ctrlKey || event.metaKey) return;
+            let nextWidth: number;
+            switch (event.key) {
+              case "ArrowLeft":
+                nextWidth = width + 16;
+                break;
+              case "ArrowRight":
+                nextWidth = width - 16;
+                break;
+              case "Home":
+                nextWidth = MIN_WIDTH;
+                break;
+              case "End":
+                nextWidth = maxWidth;
+                break;
+              default:
+                return;
+            }
+            event.preventDefault();
+            event.stopPropagation();
+            setWidth(nextWidth);
+          }}
+        />
+      ) : null}
+      {children}
+    </aside>
+  );
+}
diff --git a/apps/web/src/components/files/FilePreviewPanel.tsx b/apps/web/src/components/files/FilePreviewPanel.tsx
index 03e682758e321..e9b257e3e312c 100644
--- a/apps/web/src/components/files/FilePreviewPanel.tsx
+++ b/apps/web/src/components/files/FilePreviewPanel.tsx
@@ -84,6 +84,7 @@ import { BrowserDocumentFrame, isPdfPreviewFile } from "./BrowserDocumentFrame";
 import { DelimitedTablePreview } from "./DelimitedTablePreview";
 import { PreviewImage } from "./PreviewImage";
 import FileBrowserPanel from "./FileBrowserPanel";
+import { FileExplorerPane } from "./FileExplorerPane";
 import { FileBreadcrumbs } from "./FileBreadcrumbs";
 import { breadcrumbPathOf, retainedBreadcrumbTrail, trailChildOf } from "./filePath";
 import { FileMarkdownPreview } from "./FileMarkdownPreview";
@@ -1513,14 +1514,7 @@ export default function FilePreviewPanel({
           ) : null}
         </div>
         {showExplorer ? (
-          <aside
-            className={cn(
-              "flex min-h-0 shrink-0 bg-background",
-              previewPath
-                ? "w-[min(22rem,46%)] min-w-64 border-l border-border/60"
-                : "min-w-0 flex-1",
-            )}
-          >
+          <FileExplorerPane resizable={Boolean(previewPath)}>
             <FileBrowserPanel
               key={`${environmentId}:${hostFolderPath ?? cwd}`}
               environmentId={environmentId}
@@ -1544,7 +1538,7 @@ export default function FilePreviewPanel({
                   }
                 : {})}
             />
-          </aside>
+          </FileExplorerPane>
         ) : null}
       </div>
     </div>
diff --git a/apps/web/src/components/preview/RightPanelResizeHandle.tsx b/apps/web/src/components/preview/RightPanelResizeHandle.tsx
index dd644ccf0c822..851daaebe5eab 100644
--- a/apps/web/src/components/preview/RightPanelResizeHandle.tsx
+++ b/apps/web/src/components/preview/RightPanelResizeHandle.tsx
@@ -1,16 +1,23 @@
+import type { ComponentProps } from "react";
 import type { ResizableWidthHandlers } from "~/hooks/useResizableWidth";
 import { cn } from "~/lib/utils";
 
-interface Props {
+interface Props extends Pick<
+  ComponentProps<"div">,
+  "tabIndex" | "onKeyDown" | "aria-valuenow" | "aria-valuemin" | "aria-valuemax"
+> {
   handlers: ResizableWidthHandlers;
   className?: string;
+  label?: string;
 }
 
-export function RightPanelResizeHandle({ handlers, className }: Props) {
+export function RightPanelResizeHandle({ handlers, className, label, ...separatorProps }: Props) {
   return (
     <div
       role="separator"
+      aria-label={label}
       aria-orientation="vertical"
+      {...separatorProps}
       className={cn(
         "group absolute inset-y-0 -left-1 z-20 w-2 cursor-col-resize select-none",
         className,
@@ -19,7 +26,7 @@ export function RightPanelResizeHandle({ handlers, className }: Props) {
     >
       <span
         aria-hidden
-        className="pointer-events-none absolute inset-y-0 left-1/2 w-px -translate-x-1/2 bg-transparent transition-colors duration-150 group-hover:bg-border group-active:bg-primary/60"
+        className="pointer-events-none absolute inset-y-0 left-1/2 w-px -translate-x-1/2 bg-transparent transition-colors duration-150 group-hover:bg-border group-focus-visible:bg-primary/60 group-active:bg-primary/60"
       />
     </div>
   );
diff --git a/apps/web/src/hooks/useResizableWidth.ts b/apps/web/src/hooks/useResizableWidth.ts
index 16bb19829135b..50fdba38a9fc5 100644
--- a/apps/web/src/hooks/useResizableWidth.ts
+++ b/apps/web/src/hooks/useResizableWidth.ts
@@ -29,6 +29,7 @@ export interface ResizableWidthHandlers {
 /** Persist on drag end to avoid a storage write on every animation frame. */
 export function useResizableWidth(options: UseResizableWidthOptions): {
   readonly width: number;
+  readonly setWidth: (width: number) => void;
   readonly handlers: ResizableWidthHandlers;
 } {
   const { storageKey, defaultWidth, minWidth, maxWidth, edge } = options;
@@ -55,6 +56,16 @@ export function useResizableWidth(options: UseResizableWidthOptions): {
 
   const clampedWidth = clamp(widthState.width);
 
+  const commitWidth = (nextStorageKey: string, nextWidth: number) => {
+    // Resizing remains usable for this session when browser storage is unavailable.
+    setWidthState({ storageKey: nextStorageKey, width: nextWidth });
+    try {
+      setLocalStorageItem(nextStorageKey, nextWidth, WidthSchema);
+    } catch (error) {
+      console.error("Could not persist panel width.", error);
+    }
+  };
+
   const drag = useResizeDrag<HTMLElement>((event) => {
     const host = event.currentTarget.parentElement;
     // Disable drag transitions through transition-property; the host renders transition-duration.
@@ -72,12 +83,7 @@ export function useResizableWidth(options: UseResizableWidthOptions): {
         return nextWidth;
       },
       finish(finalWidth) {
-        setWidthState({ storageKey: startStorageKey, width: finalWidth });
-        try {
-          setLocalStorageItem(startStorageKey, finalWidth, WidthSchema);
-        } catch (error) {
-          console.error("Could not persist panel width.", error);
-        }
+        commitWidth(startStorageKey, finalWidth);
       },
       cleanup(committed) {
         host?.style.removeProperty("transition-property");
@@ -94,6 +100,7 @@ export function useResizableWidth(options: UseResizableWidthOptions): {
 
   return {
     width: clampedWidth,
+    setWidth: (value) => commitWidth(storageKey, clamp(value)),
     handlers: {
       ref: drag.ref,
       onPointerDown: drag.onPointerDown,

From f4147ddf7948c30163714975dc8b9de671434f3c Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:05:09 +0000
Subject: [PATCH 090/146] fix(server): update shared Codex installs from their
 owning home (#25235)

Co-authored-by: shivam <91240327+shivamhwp@users.noreply.github.com>
---
 .../src/provider/Drivers/CodexDriver.test.ts  | 101 ++++++++++++++++++
 .../src/provider/Drivers/CodexDriver.ts       |  27 +++--
 .../src/server/maintenanceResolver.ts         |   9 +-
 3 files changed, 129 insertions(+), 8 deletions(-)

diff --git a/apps/server/src/provider/Drivers/CodexDriver.test.ts b/apps/server/src/provider/Drivers/CodexDriver.test.ts
index 90e37cc66712b..0aacca303e6a6 100644
--- a/apps/server/src/provider/Drivers/CodexDriver.test.ts
+++ b/apps/server/src/provider/Drivers/CodexDriver.test.ts
@@ -377,6 +377,107 @@ it.layer(layerTest)("CodexDriver", (it) => {
       ),
   );
 
+  it.effect.skipIf(windowsHost)(
+    "runs the standalone updater against the home that holds a shared install",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const tempDir = yield* fs
+          .makeTempDirectoryScoped({ prefix: "t3-codex-driver-" })
+          .pipe(Effect.flatMap((directory) => fs.realPath(directory)));
+        // One standalone install, linked onto PATH and used by two account homes.
+        // `İ` gets longer when lowercased, so the home must not be sliced from a
+        // lowercased copy of the path.
+        const installHome = NodePath.join(tempDir, "codex-İnstall");
+        const realBinaryPath = NodePath.join(
+          installHome,
+          "packages",
+          "standalone",
+          "releases",
+          "0.162.1-x86_64-unknown-linux-musl",
+          "bin",
+          "codex",
+        );
+        const binaryPath = NodePath.join(tempDir, "bin", "codex");
+        yield* fs.makeDirectory(NodePath.dirname(realBinaryPath), { recursive: true });
+        yield* fs.makeDirectory(NodePath.dirname(binaryPath), { recursive: true });
+        yield* fs.writeFileString(realBinaryPath, "#!/bin/sh\n");
+        yield* fs.chmod(realBinaryPath, 0o755);
+        yield* fs.symlink(realBinaryPath, binaryPath);
+
+        const updates = yield* Effect.forEach(["codex-p", "codex-vm"], (account) =>
+          Effect.gen(function* () {
+            const homePath = NodePath.join(tempDir, `home-${account}`);
+            yield* fs.makeDirectory(homePath, { recursive: true });
+            const instance = yield* CodexDriver.create({
+              instanceId: ProviderInstanceId.make(account),
+              displayName: account,
+              enabled: false,
+              environment: [],
+              config: { ...CodexDriver.defaultConfig(), binaryPath, homePath },
+            });
+            return (yield* instance.snapshot.resolveMaintenance()).update;
+          }),
+        );
+
+        for (const update of updates) {
+          expect(update).toMatchObject({
+            command: `${binaryPath} update`,
+            args: ["update"],
+            lockKey: "codex-native",
+            env: { CODEX_HOME: installHome },
+          });
+        }
+      }).pipe(
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, noSpawn),
+        Effect.scoped,
+      ),
+  );
+
+  it.effect.skipIf(windowsHost)("derives the standalone update home from either command path", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const tempDir = yield* fs
+        .makeTempDirectoryScoped({ prefix: "t3-codex-update-home-" })
+        .pipe(Effect.flatMap((directory) => fs.realPath(directory)));
+      const linkedInstallHome = NodePath.join(tempDir, "install");
+      const fixtures = [
+        { binary: "codex", realPath: "/packages/standalone/bin/codex", home: "/" },
+        { binary: "codex", realPath: "C:\\Packages\\Standalone\\bin\\codex.exe", home: "C:\\" },
+        // The standalone tree itself is a symlink, so only the resolved path names its home.
+        {
+          binary: NodePath.join("install", "packages", "standalone", "bin", "codex"),
+          realPath: "/disk/codex/releases/0.163.0/bin/codex",
+          home: linkedInstallHome,
+        },
+      ];
+
+      for (const fixture of fixtures) {
+        const binaryPath = NodePath.join(tempDir, fixture.binary);
+        yield* fs.makeDirectory(NodePath.dirname(binaryPath), { recursive: true });
+        yield* fs.writeFileString(binaryPath, "#!/bin/sh\n");
+        yield* fs.chmod(binaryPath, 0o755);
+        const instance = yield* CodexDriver.create({
+          instanceId: ProviderInstanceId.make("codex-update-home"),
+          displayName: "Codex update home",
+          enabled: false,
+          environment: [],
+          config: { ...CodexDriver.defaultConfig(), binaryPath, homePath: tempDir },
+        }).pipe(
+          // Virtualize only the executable target: these trees do not belong to this test.
+          Effect.provideService(FileSystem.FileSystem, {
+            ...fs,
+            realPath: (path) =>
+              path === binaryPath ? Effect.succeed(fixture.realPath) : fs.realPath(path),
+          }),
+        );
+        expect((yield* instance.snapshot.resolveMaintenance()).update?.env).toEqual({
+          CODEX_HOME: fixture.home,
+        });
+      }
+    }).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, noSpawn), Effect.scoped),
+  );
+
   for (const fixture of [
     {
       name: "leaves mise npm-backend installations manual-only",
diff --git a/apps/server/src/provider/Drivers/CodexDriver.ts b/apps/server/src/provider/Drivers/CodexDriver.ts
index 2d078cf32594f..bbd910cf5d4a9 100644
--- a/apps/server/src/provider/Drivers/CodexDriver.ts
+++ b/apps/server/src/provider/Drivers/CodexDriver.ts
@@ -37,7 +37,6 @@ import {
   enrichProviderSnapshotWithVersionAdvisory,
   makeCachedProviderMaintenanceResolution,
   makePackageManagedProviderMaintenanceResolver,
-  normalizeCommandPath,
   resolveProviderMaintenanceCapabilitiesEffect,
 } from "@t3tools/provider-core/server/maintenanceResolver";
 import {
@@ -60,20 +59,36 @@ import * as HostProcess from "@t3tools/shared/HostProcess";
 const decodeCodexSettings = Schema.decodeSync(CodexSettings);
 
 const DRIVER_KIND = ProviderDriverKind.make("codex");
-function isCodexStandaloneCommandPath(commandPath: string): boolean {
-  return normalizeCommandPath(commandPath).includes("/packages/standalone/");
+const CODEX_STANDALONE_HOME_PATTERN = /^(.*)\/packages\/standalone\//is;
+
+function codexStandaloneHome(commandPath: string): string | null {
+  // Slash replacement preserves indices; Unicode lowercasing can change the path length.
+  const match = CODEX_STANDALONE_HOME_PATTERN.exec(commandPath.replaceAll("\\", "/"));
+  if (!match) {
+    return null;
+  }
+  const home = match[1]!;
+  // Keep root separators: `C:` is drive-relative, and an empty home is not `/`.
+  const isRoot = home === "" || /^[a-z]:$/i.test(home);
+  return commandPath.slice(0, home.length + (isRoot ? 1 : 0));
 }
 
-/** `codex update` owns the shared home's standalone tree; auth-overlay homes do not carry it. */
+// Standalone updates locate their install through CODEX_HOME. Account and auth-overlay
+// homes can share an executable, so only the updater uses the executable's owning home.
 function makeCodexMaintenanceResolver(sharedHomePath: string) {
   return makePackageManagedProviderMaintenanceResolver({
     provider: DRIVER_KIND,
     npmPackageName: "@openai/codex",
     nativeUpdate: {
       args: ["update"],
-      isCommandPath: isCodexStandaloneCommandPath,
+      isCommandPath: (commandPath) => codexStandaloneHome(commandPath) !== null,
       requiresCommandPath: true,
-      env: { CODEX_HOME: sharedHomePath },
+      env: (context) => ({
+        CODEX_HOME:
+          codexStandaloneHome(context.realCommandPath) ??
+          codexStandaloneHome(context.resolvedCommandPath) ??
+          sharedHomePath,
+      }),
     },
   });
 }
diff --git a/packages/provider-core/src/server/maintenanceResolver.ts b/packages/provider-core/src/server/maintenanceResolver.ts
index 2e3aad166c58e..8a8e11e2ec0d7 100644
--- a/packages/provider-core/src/server/maintenanceResolver.ts
+++ b/packages/provider-core/src/server/maintenanceResolver.ts
@@ -87,7 +87,9 @@ export interface PackageManagedProviderMaintenanceDefinition {
     readonly isCommandPath?: (commandPath: string) => boolean;
     /** The updater cannot detect installs outside `isCommandPath`, so leave those manual-only. */
     readonly requiresCommandPath?: boolean;
-    readonly env?: NodeJS.ProcessEnv;
+    readonly env?:
+      | NodeJS.ProcessEnv
+      | ((context: ProviderMaintenanceResolutionContext) => NodeJS.ProcessEnv);
   } | null;
 }
 
@@ -446,6 +448,7 @@ export const resolvePackageManagedProviderMaintenance = Effect.fn(
   }
 
   const nativeUpdate = definition.nativeUpdate;
+  const nativeEnv = nativeUpdate?.env;
   const native = nativeUpdate
     ? makeProviderMaintenanceCapabilities({
         provider: definition.provider,
@@ -454,7 +457,9 @@ export const resolvePackageManagedProviderMaintenance = Effect.fn(
         updateArgs: nativeUpdate.args,
         updateLockKey: `${definition.provider}-native`,
         platform: context.platform,
-        ...(nativeUpdate.env ? { env: nativeUpdate.env } : {}),
+        ...(nativeEnv
+          ? { env: typeof nativeEnv === "function" ? nativeEnv(context) : nativeEnv }
+          : {}),
       })
     : manual;
   // A native-looking launcher can still delegate to a mise-owned install.

From 8bcc9911f11e5dd9666e1a1b625766e0ccd2cb49 Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 13:05:45 -0500
Subject: [PATCH 091/146] fix(cli): keep published runtimes in place during
 installation (#24092)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 scripts/build-npm-launcher.test.ts | 112 +++++++++++++++++++++++++++++
 scripts/npm-launcher/t3.mjs        |  29 +++++++-
 2 files changed, 139 insertions(+), 2 deletions(-)

diff --git a/scripts/build-npm-launcher.test.ts b/scripts/build-npm-launcher.test.ts
index 749e27bd5454a..4c7edd4763359 100644
--- a/scripts/build-npm-launcher.test.ts
+++ b/scripts/build-npm-launcher.test.ts
@@ -195,6 +195,118 @@ it.layer(NodeServices.layer)("build-npm-launcher", (it) => {
           VERSION,
         ]);
 
+        // A peer's executable and sidecar stay available after every later rename or removal,
+        // even when it publishes after our missing-marker read.
+        const staleHome = path.join(root, "stale-home");
+        const staleDir = path.join(staleHome, "runtime/versions", VERSION);
+        const peerDir = path.join(root, "peer-runtime");
+        yield* fs.makeDirectory(staleDir, { recursive: true });
+        yield* fs.writeFileString(path.join(staleDir, "t3"), "");
+        yield* fs.makeDirectory(peerDir);
+        yield* fs.writeFileString(path.join(peerDir, "t3"), '#!/bin/sh\necho "peer $*"\nexit 7\n');
+        yield* fs.chmod(path.join(peerDir, "t3"), 0o755);
+        yield* fs.writeFileString(path.join(peerDir, ".install-complete"), `${VERSION}\n`);
+        yield* fs.writeFileString(path.join(peerDir, "sidecar"), "peer sidecar");
+        const peerChecks = path.join(root, "peer-checks.txt");
+        // The peer publishes after the launcher's rename fails and it reads the marker.
+        const peerHook = path.join(root, "peer-publishes.mjs");
+        yield* fs.writeFileString(
+          peerHook,
+          `import fs from "node:fs";
+import { spawnSync } from "node:child_process";
+const dir = ${JSON.stringify(staleDir)};
+const { readFileSync, renameSync, rmSync } = fs;
+let checking = false;
+let published = false;
+const checkPeer = () => {
+  const child = spawnSync(dir + "/t3", ["--version"], { encoding: "utf8" });
+  let sidecar;
+  try {
+    sidecar = readFileSync(dir + "/sidecar", "utf8");
+  } catch (error) {
+    sidecar = error.code;
+  }
+  fs.appendFileSync(${JSON.stringify(peerChecks)},
+    [child.status, child.error?.code ?? child.stdout.trim(), sidecar].join("|") + "\\n");
+};
+fs.renameSync = (from, to) => {
+  try {
+    return renameSync(from, to);
+  } catch (error) {
+    checking ||= to === dir;
+    throw error;
+  } finally {
+    if (published) checkPeer();
+  }
+};
+fs.rmSync = (...args) => {
+  try {
+    return rmSync(...args);
+  } finally {
+    if (published) checkPeer();
+  }
+};
+fs.readFileSync = (file, ...rest) => {
+  try {
+    return readFileSync(file, ...rest);
+  } finally {
+    if (checking && file === dir + "/.install-complete") {
+      checking = false;
+      rmSync(dir, { recursive: true });
+      renameSync(${JSON.stringify(peerDir)}, dir);
+      published = true;
+      checkPeer();
+    }
+  }
+};
+`,
+        );
+        const recovered = yield* run(
+          process.execPath,
+          ["--import", peerHook, launcher, "--version"],
+          { cwd: root, env: { ...env, T3CODE_HOME: staleHome } },
+        );
+        const checks = (yield* fs.readFileString(peerChecks)).trim().split("\n");
+        assert.isAtLeast(checks.length, 2);
+        assert.deepStrictEqual([...new Set(checks)], ["7|peer --version|peer sidecar"]);
+        assert.equal(recovered.stdout.trim(), "peer --version", recovered.stderr);
+        assert.equal(recovered.exitCode, 7);
+        assert.deepStrictEqual(yield* fs.readDirectory(path.join(staleHome, "runtime/versions")), [
+          VERSION,
+        ]);
+
+        // While another launch holds the lock, a stale folder is left alone and the error says
+        // how to clear a lock left by a crash.
+        const staleOnlyHome = path.join(root, "stale-only-home");
+        const staleOnlyDir = path.join(staleOnlyHome, "runtime/versions", VERSION);
+        yield* fs.makeDirectory(staleOnlyDir, { recursive: true });
+        yield* fs.writeFileString(path.join(staleOnlyDir, "t3"), "incomplete");
+        yield* fs.makeDirectory(`${staleOnlyDir}.lock`);
+        const locked = yield* run(process.execPath, [launcher, "--version"], {
+          cwd: root,
+          env: { ...env, T3CODE_HOME: staleOnlyHome },
+        });
+        assert.equal(locked.exitCode, 1);
+        assert.include(locked.stderr, `delete ${staleOnlyDir}.lock`);
+        assert.equal(yield* fs.readFileString(path.join(staleOnlyDir, "t3")), "incomplete");
+
+        // Without a peer, the stale folder is replaced by our own download.
+        yield* fs.remove(`${staleOnlyDir}.lock`, { recursive: true });
+        const replaced = yield* run(process.execPath, [launcher, "--version"], {
+          cwd: root,
+          env: { ...env, T3CODE_HOME: staleOnlyHome },
+        });
+        assert.equal(
+          replaced.stdout.trim(),
+          `stub --version launcher=${launcher}`,
+          replaced.stderr,
+        );
+        assert.equal(replaced.exitCode, 7);
+        assert.deepStrictEqual(
+          yield* fs.readDirectory(path.join(staleOnlyHome, "runtime/versions")),
+          [VERSION],
+        );
+
         release.corruptChecksum();
         const corrupt = yield* run(process.execPath, [launcher, "--version"], {
           cwd: root,
diff --git a/scripts/npm-launcher/t3.mjs b/scripts/npm-launcher/t3.mjs
index 4973cf10a423a..f8828210862e3 100644
--- a/scripts/npm-launcher/t3.mjs
+++ b/scripts/npm-launcher/t3.mjs
@@ -109,11 +109,36 @@ const isComplete = (dir) => {
 function publish(staging, dir) {
   try {
     fs.renameSync(staging, dir);
+    return;
   } catch (error) {
     if (isComplete(dir)) return;
     if (!fs.existsSync(dir)) throw error;
-    fs.rmSync(dir, { recursive: true, force: true });
-    fs.renameSync(staging, dir);
+  }
+  const lock = `${dir}.lock`;
+  try {
+    fs.mkdirSync(lock);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    throw new Error(
+      `another t3 is installing ${version}. If none is running, delete ${lock} and try again.`,
+      { cause: error },
+    );
+  }
+  const stale = `${staging}.stale`;
+  try {
+    // A peer may have published between our marker check and taking the lock.
+    if (isComplete(dir)) return;
+    // Move it aside rather than deleting in place: once the folder is empty, a
+    // peer's first rename can land in it.
+    fs.renameSync(dir, stale);
+    try {
+      fs.renameSync(staging, dir);
+    } catch (error) {
+      if (!isComplete(dir)) throw error;
+    }
+  } finally {
+    fs.rmSync(lock, { recursive: true, force: true });
+    fs.rmSync(stale, { recursive: true, force: true });
   }
 }
 

From e836ab1275cdb17494e708ad34447071b472b82f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcel=20Jiron=20=C2=B7=20MarMarLabs?=
 <marmar9615@icloud.com>
Date: Thu, 29 Oct 2026 13:06:08 -0500
Subject: [PATCH 092/146] fix(web): right panel launcher letters work on
 non-Latin keyboard layouts (#21508)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../src/components/RightPanelTabs.test.tsx    | 69 +++++++++++++++++++
 apps/web/src/components/RightPanelTabs.tsx    |  9 +--
 .../components/chat/composerFocusRedirect.ts  | 12 ++--
 .../chat/useChatShortcuts.browser.test.tsx    | 40 ++++++++++-
 apps/web/src/lib/surfaceShortcutKey.ts        | 14 ++++
 5 files changed, 135 insertions(+), 9 deletions(-)
 create mode 100644 apps/web/src/lib/surfaceShortcutKey.ts

diff --git a/apps/web/src/components/RightPanelTabs.test.tsx b/apps/web/src/components/RightPanelTabs.test.tsx
index fa9cbf0141c3e..88793cce44850 100644
--- a/apps/web/src/components/RightPanelTabs.test.tsx
+++ b/apps/web/src/components/RightPanelTabs.test.tsx
@@ -26,8 +26,62 @@ describe("surface shortcuts", () => {
   const actions = [
     { shortcut: "B", available: true, label: "Browser" },
     { shortcut: "D", available: false, label: "Diff" },
+    { shortcut: "T", available: true, label: "Terminal" },
+    { shortcut: "M", available: true, label: "Device" },
   ] as const;
 
+  it("falls back to the physical key when the layout types a non-Latin letter or mark", () => {
+    // Ukrainian layout: the B key types "и".
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("\u0438", { code: "KeyB" }))).toBe(
+      actions[0],
+    );
+    // Greek layout: the B key types "β".
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("\u03b2", { code: "KeyB" }))).toBe(
+      actions[0],
+    );
+    // Thai layout: the B key types the vowel sign "\u0e34", a combining mark.
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("\u0e34", { code: "KeyB" }))).toBe(
+      actions[0],
+    );
+    // Arabic (101) layout: the B key types lam alef "\u0644\u0627", two code points.
+    expect(
+      surfaceShortcutActionForKey(actions, shortcutEvent("\u0644\u0627", { code: "KeyB" })),
+    ).toBe(actions[0]);
+    // Ukrainian layout: the D key types "\u0432", but the Diff surface is unavailable.
+    expect(
+      surfaceShortcutActionForKey(actions, shortcutEvent("\u0432", { code: "KeyD" })),
+    ).toBeNull();
+  });
+
+  it("follows the typed letter on Latin layouts that move it", () => {
+    // Dvorak: the key at QWERTY B types "x", and "b" sits on QWERTY N.
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("x", { code: "KeyB" }))).toBeNull();
+    // The same key with Shift or Caps Lock types "X".
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("X", { code: "KeyB" }))).toBeNull();
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent("b", { code: "KeyN" }))).toBe(
+      actions[0],
+    );
+  });
+
+  it("keeps accented Latin letters typed on a letter key", () => {
+    // Bépo: the T key types "è".
+    expect(
+      surfaceShortcutActionForKey(actions, shortcutEvent("\u00e8", { code: "KeyT" })),
+    ).toBeNull();
+  });
+
+  it("keeps punctuation typed on a letter key", () => {
+    // French AZERTY: the M key types ",".
+    expect(surfaceShortcutActionForKey(actions, shortcutEvent(",", { code: "KeyM" }))).toBeNull();
+  });
+
+  it("keeps a dead key on a letter key", () => {
+    // A dead key starts an accented letter on a Latin layout.
+    expect(
+      surfaceShortcutActionForKey(actions, shortcutEvent("Dead", { code: "KeyT" })),
+    ).toBeNull();
+  });
+
   it("leaves modified, composing, and already-handled key events alone", () => {
     expect(surfaceShortcutActionForKey(actions, shortcutEvent("b", { metaKey: true }))).toBeNull();
     expect(
@@ -37,6 +91,21 @@ describe("surface shortcuts", () => {
       surfaceShortcutActionForKey(actions, shortcutEvent("b", { defaultPrevented: true })),
     ).toBeNull();
   });
+
+  it("leaves AltGr text alone unless it is a plain letter", () => {
+    const getModifierState = (key: string) => key === "AltGraph";
+    // German layout: AltGr+M types "\u00b5" and sets only AltGraph on Linux and Windows.
+    expect(
+      surfaceShortcutActionForKey(
+        actions,
+        shortcutEvent("\u00b5", { code: "KeyM", getModifierState }),
+      ),
+    ).toBeNull();
+    // Finnish layout: AltGr+B types "b", which still matches, as it does in keybindings.ts.
+    expect(
+      surfaceShortcutActionForKey(actions, shortcutEvent("b", { code: "KeyB", getModifierState })),
+    ).toBe(actions[0]);
+  });
 });
 
 describe("surface shortcut typing contexts", () => {
diff --git a/apps/web/src/components/RightPanelTabs.tsx b/apps/web/src/components/RightPanelTabs.tsx
index dd62a684e92e4..d74e03ea842ab 100644
--- a/apps/web/src/components/RightPanelTabs.tsx
+++ b/apps/web/src/components/RightPanelTabs.tsx
@@ -92,6 +92,7 @@ import { PierreEntryIcon } from "./chat/PierreEntryIcon";
 import { resolvePullRequestState } from "./pullRequest/pullRequestPresentation";
 import { PullRequestGlyph } from "~/components/pullRequest/pullRequestIcons";
 import { observeResize } from "~/lib/observeResize";
+import { surfaceShortcutKey } from "~/lib/surfaceShortcutKey";
 
 export interface RightPanelTabsProps {
   mode: PreviewPanelMode;
@@ -238,17 +239,17 @@ function tabAudioState(overlay: DesktopPreviewOverlay | null): TabAudioState {
 type SurfaceShortcutEvent = Pick<
   KeyboardEvent,
   "altKey" | "ctrlKey" | "defaultPrevented" | "isComposing" | "key" | "metaKey"
->;
+> &
+  Partial<Pick<KeyboardEvent, "code" | "getModifierState">>;
 
 export function surfaceShortcutActionForKey<
   const Action extends { available: boolean; shortcut: string },
 >(actions: readonly Action[], event: SurfaceShortcutEvent): Action | null {
   if (event.defaultPrevented || event.isComposing) return null;
   if (event.metaKey || event.ctrlKey || event.altKey) return null;
+  const key = surfaceShortcutKey(event);
   return (
-    actions.find(
-      (action) => action.available && action.shortcut.toLowerCase() === event.key.toLowerCase(),
-    ) ?? null
+    actions.find((action) => action.available && action.shortcut.toLowerCase() === key) ?? null
   );
 }
 
diff --git a/apps/web/src/components/chat/composerFocusRedirect.ts b/apps/web/src/components/chat/composerFocusRedirect.ts
index 9f791f944ea3e..f7730b367925e 100644
--- a/apps/web/src/components/chat/composerFocusRedirect.ts
+++ b/apps/web/src/components/chat/composerFocusRedirect.ts
@@ -1,3 +1,5 @@
+import { surfaceShortcutKey } from "~/lib/surfaceShortcutKey";
+
 export const TYPE_TO_FOCUS_EDITABLE_SELECTOR = [
   "input",
   "textarea",
@@ -48,11 +50,13 @@ const SURFACE_LAUNCHER_KEYS_ATTRIBUTE = "data-surface-launcher-keys";
 // The right-panel launcher registers its own window capture listener when it
 // mounts. When the panel opens after page load that listener runs after ours,
 // so we must leave its letters alone or the composer takes them first.
-function isSurfaceLauncherKey(key: string): boolean {
+function isSurfaceLauncherKey(event: KeyboardEvent): boolean {
   const launcherKeys = document
     .querySelector(`[${SURFACE_LAUNCHER_KEYS_ATTRIBUTE}]`)
-    ?.getAttribute(SURFACE_LAUNCHER_KEYS_ATTRIBUTE);
-  return launcherKeys?.toLowerCase().includes(key.toLowerCase()) ?? false;
+    ?.getAttribute(SURFACE_LAUNCHER_KEYS_ATTRIBUTE)
+    ?.toLowerCase();
+  const key = surfaceShortcutKey(event);
+  return key !== null && (launcherKeys?.includes(key) ?? false);
 }
 
 export function shouldRedirectInputToComposer(event: Event): boolean {
@@ -70,7 +74,7 @@ export function shouldTypeToFocusComposer(event: KeyboardEvent): boolean {
   if (event.metaKey || event.ctrlKey || event.altKey) return false;
   if (event.key.length !== 1) return false;
   if (!shouldRedirectInputToComposer(event)) return false;
-  if (isSurfaceLauncherKey(event.key)) return false;
+  if (isSurfaceLauncherKey(event)) return false;
 
   return true;
 }
diff --git a/apps/web/src/components/chat/useChatShortcuts.browser.test.tsx b/apps/web/src/components/chat/useChatShortcuts.browser.test.tsx
index b601de299dac5..64f56007ceaaa 100644
--- a/apps/web/src/components/chat/useChatShortcuts.browser.test.tsx
+++ b/apps/web/src/components/chat/useChatShortcuts.browser.test.tsx
@@ -2,6 +2,7 @@ import { useEffect } from "react";
 import { expect, it } from "vite-plus/test";
 import { userEvent } from "vite-plus/test/browser";
 
+import { surfaceShortcutKey } from "~/lib/surfaceShortcutKey";
 import { render } from "../../../test/render";
 import type { ChatComposerHandle } from "./ChatComposer";
 import { useChatShortcuts } from "./useChatShortcuts";
@@ -25,7 +26,8 @@ function Launcher(props: { keys: string; received: string[] }) {
   useEffect(() => {
     const claim = (event: KeyboardEvent) => {
       if (event.defaultPrevented) return;
-      if (!props.keys.toLowerCase().split("").includes(event.key.toLowerCase())) return;
+      const key = surfaceShortcutKey(event);
+      if (key === null || !props.keys.toLowerCase().includes(key)) return;
       event.preventDefault();
       props.received.push(event.key);
     };
@@ -94,3 +96,39 @@ it("still types other letters into the composer while the launcher is open", asy
   expect(composerKeys).toEqual(["a"]);
   expect(received).toEqual([]);
 });
+
+it("leaves a non-Latin launcher letter to the launcher by its physical key", async () => {
+  const composerKeys: string[] = [];
+  const received: string[] = [];
+  await using screen = await render(<Chat composerKeys={composerKeys} />, options);
+  await screen.rerender(<Chat composerKeys={composerKeys} launcher={{ keys: "BT", received }} />);
+
+  // Playwright cannot press a key its US layout lacks, so send what a Ukrainian T key sends.
+  const event = new KeyboardEvent("keydown", {
+    key: "\u0435",
+    code: "KeyT",
+    bubbles: true,
+    cancelable: true,
+  });
+  (document.activeElement ?? document.body).dispatchEvent(event);
+
+  expect(composerKeys).toEqual([]);
+  expect(received).toEqual(["\u0435"]);
+});
+
+it.each([
+  { key: "b", code: "KeyN", composer: [], launcher: ["b"] },
+  { key: "x", code: "KeyB", composer: ["x"], launcher: [] },
+  { key: "è", code: "KeyT", composer: ["è"], launcher: [] },
+])("routes $key on $code by the typed letter", async ({ key, code, composer, launcher }) => {
+  const composerKeys: string[] = [];
+  const received: string[] = [];
+  await using screen = await render(<Chat composerKeys={composerKeys} />, options);
+  await screen.rerender(<Chat composerKeys={composerKeys} launcher={{ keys: "BT", received }} />);
+
+  const event = new KeyboardEvent("keydown", { key, code, bubbles: true, cancelable: true });
+  (document.activeElement ?? document.body).dispatchEvent(event);
+
+  expect(composerKeys).toEqual(composer);
+  expect(received).toEqual(launcher);
+});
diff --git a/apps/web/src/lib/surfaceShortcutKey.ts b/apps/web/src/lib/surfaceShortcutKey.ts
new file mode 100644
index 0000000000000..98c4d6660da11
--- /dev/null
+++ b/apps/web/src/lib/surfaceShortcutKey.ts
@@ -0,0 +1,14 @@
+type SurfaceKeyEvent = Pick<KeyboardEvent, "key"> &
+  Partial<Pick<KeyboardEvent, "code" | "getModifierState">>;
+
+export function surfaceShortcutKey(event: SurfaceKeyEvent): string | null {
+  // AltGr text must stay text even when the browser omits Ctrl and Alt.
+  if (event.getModifierState?.("AltGraph") && !/^[a-z0-9]$/i.test(event.key)) return null;
+  const typed = event.key.toLowerCase();
+  // Preserve Latin layouts, punctuation and dead keys; non-Latin letters/marks use the physical key.
+  const physical =
+    /^[\p{L}\p{M}]+$/u.test(typed) && !/\p{Script=Latin}/u.test(typed)
+      ? event.code?.match(/^Key([A-Z])$/)?.[1]?.toLowerCase()
+      : undefined;
+  return physical ?? typed;
+}

From 5b4f2aa1532730d4dd51d2cb48a57ff74a0f54eb Mon Sep 17 00:00:00 2001
From: Scott Norteman <snorteman@gmail.com>
Date: Thu, 29 Oct 2026 14:06:30 -0400
Subject: [PATCH 093/146] fix(server): report a deleted or replaced ownership
 lock (#21886)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 apps/server/src/serverOwnership.ts         | 54 +++++++++++--
 apps/server/src/serverRuntimeState.test.ts | 91 ++++++++++++++++++++++
 2 files changed, 140 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/serverOwnership.ts b/apps/server/src/serverOwnership.ts
index 1959735425515..6d89f45cb792e 100644
--- a/apps/server/src/serverOwnership.ts
+++ b/apps/server/src/serverOwnership.ts
@@ -44,7 +44,7 @@ export class ServerAlreadyRunningError extends Schema.TaggedError<ServerAlreadyR
   override readonly [Runtime.errorExitCode] = SERVER_EXIT_CODE_STATE_DIR_OWNED;
 
   override get message(): string {
-    return `A T3 Code server already owns ${this.stateDir}. Stop that server, or use a separate T3 home and pair with it, then retry. No server was stopped.`;
+    return `A T3 Code server already owns ${this.stateDir}. Stop that server, or use a separate T3 home and pair with it, then retry. No server was stopped. server-owner.sqlite is the ownership lock; do not delete it while a server is running.`;
   }
 }
 
@@ -188,25 +188,36 @@ export const acquireServerOwnership = Effect.fn("acquireServerOwnership")(functi
   const ownerId = yield* crypto
     .randomUUIDv4()
     .pipe(Effect.mapError((cause) => new ServerOwnershipError({ stateDir, cause })));
-  yield* Effect.acquireRelease(
+  const lockPath = NodePath.join(stateDir, "server-owner.sqlite");
+  const lock = yield* Effect.acquireRelease(
     Effect.try({
       try: () => {
         NodeFS.mkdirSync(stateDir, { recursive: true });
-        const db = new NodeSqlite.DatabaseSync(NodePath.join(stateDir, "server-owner.sqlite"));
+        let before = NodeFS.statSync(lockPath, { bigint: true, throwIfNoEntry: false });
+        if (before === undefined) {
+          NodeFS.closeSync(NodeFS.openSync(lockPath, "a", 0o644));
+          before = NodeFS.statSync(lockPath, { bigint: true });
+        }
+        const db = new NodeSqlite.DatabaseSync(lockPath);
         try {
           db.exec("PRAGMA busy_timeout = 0; BEGIN EXCLUSIVE;");
+          const identity = NodeFS.statSync(lockPath, { bigint: true });
+          return {
+            db,
+            identity,
+            replacedDuringAcquire: before.dev !== identity.dev || before.ino !== identity.ino,
+          };
         } catch (cause) {
           db.close();
           throw cause;
         }
-        return db;
       },
       catch: (cause) =>
         isSqliteBusy(cause)
           ? new ServerAlreadyRunningError({ stateDir })
           : new ServerOwnershipError({ stateDir, cause }),
     }),
-    (db) =>
+    ({ db }) =>
       readPersistedServerRuntimeState(statePath).pipe(
         Effect.flatMap((state) =>
           Option.isSome(state) && state.value.ownerId === ownerId
@@ -233,6 +244,39 @@ export const acquireServerOwnership = Effect.fn("acquireServerOwnership")(functi
     return yield* new OlderBootServiceError({ baseDir: olderServiceHome });
   }
 
+  yield* Effect.gen(function* () {
+    let lost = lock.replacedDuringAcquire;
+    let statWarningLogged = false;
+    while (!lost) {
+      yield* Effect.sleep("5 seconds");
+      // Closing another descriptor for this inode releases SQLite's POSIX locks. Stat by path only.
+      const current = yield* Effect.sync(() => {
+        try {
+          return NodeFS.statSync(lockPath, { bigint: true, throwIfNoEntry: false });
+        } catch (cause) {
+          return cause instanceof Error && "code" in cause ? String(cause.code) : "unknown";
+        }
+      });
+      if (typeof current === "string") {
+        if (!statWarningLogged) {
+          yield* Effect.logWarning(
+            `Cannot check server ownership lock at ${lockPath} (${current}).`,
+          );
+          statWarningLogged = true;
+        }
+        continue;
+      }
+      statWarningLogged = false;
+      lost =
+        current === undefined ||
+        current.dev !== lock.identity.dev ||
+        current.ino !== lock.identity.ino;
+    }
+    yield* Effect.logError(
+      `Server ownership lock at ${lockPath} was deleted or replaced. Another server may now share this T3 home. Stop any other server using this home, then restart this server. Do not delete server-owner.sqlite while a server is running.`,
+    );
+  }).pipe(Effect.forkScoped);
+
   return {
     publish: (state: PersistedServerRuntimeState) =>
       persistServerRuntimeState({ path: statePath, state: { ...state, ownerId } }),
diff --git a/apps/server/src/serverRuntimeState.test.ts b/apps/server/src/serverRuntimeState.test.ts
index abafbc7e24f62..b75ab72594add 100644
--- a/apps/server/src/serverRuntimeState.test.ts
+++ b/apps/server/src/serverRuntimeState.test.ts
@@ -1,13 +1,20 @@
+// @effect-diagnostics nodeBuiltinImport:off - Injects a real file replacement during the native SQLite transaction.
+import * as NodeFS from "node:fs";
+import * as NodeSqlite from "node:sqlite";
+
 import { assert, describe, it } from "@effect/vitest";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Runtime from "effect/Runtime";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+import * as TestClock from "effect/testing/TestClock";
+import { vi } from "vite-plus/test";
 
 import { renderBootServicePlist, renderBootServiceUnit } from "./cloud/bootService.ts";
 import { ServiceLauncherHostProcess } from "./cloud/serviceLauncherClient.ts";
@@ -179,6 +186,7 @@ describe("server ownership", () => {
             Effect.flip,
           );
           assert.equal(refused._tag, "ServerAlreadyRunningError");
+          assert.include(refused.message, "do not delete it while a server is running");
           assert.equal(yield* fs.readFileString(statePath), before);
         }),
       );
@@ -187,6 +195,89 @@ describe("server ownership", () => {
     }).pipe(Effect.provide(layerOwnership)),
   );
 
+  describe.skipIf(HostProcess.Platform.defaultValue() === "win32")("lock file checks", () => {
+    it.effect.each([
+      "unchanged",
+      "unlink",
+      "replace",
+      "during acquisition",
+      "first acquisition",
+      // Root bypasses directory permissions, so chmod cannot force EACCES.
+      ...(process.getuid?.() === 0 ? [] : (["stat error"] as const)),
+    ] as const)("monitors ownership after %s", (operation) => {
+      const messages: unknown[] = [];
+      const warnings: unknown[] = [];
+      const logger = Logger.make(({ message, logLevel }) =>
+        (logLevel === "Warn" ? warnings : messages).push(message),
+      );
+      return Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const root = yield* fs.makeTempDirectoryScoped({ prefix: "t3-owner-lost-" });
+        const statePath = path.join(root, "server-runtime.json");
+        const lockPath = path.join(root, "server-owner.sqlite");
+        const replacement = path.join(root, "replacement.sqlite");
+        if (operation === "during acquisition" || operation === "first acquisition") {
+          if (operation === "during acquisition") yield* fs.writeFileString(lockPath, "");
+          yield* fs.writeFileString(replacement, "");
+          const exec = NodeSqlite.DatabaseSync.prototype.exec;
+          yield* Effect.acquireRelease(
+            Effect.sync(() =>
+              vi.spyOn(NodeSqlite.DatabaseSync.prototype, "exec").mockImplementationOnce(function (
+                this: NodeSqlite.DatabaseSync,
+                sql: string,
+              ) {
+                exec.call(this, sql);
+                NodeFS.renameSync(replacement, lockPath);
+              }),
+            ),
+            (spy) => Effect.sync(() => spy.mockRestore()),
+          );
+        }
+        yield* ServerOwnership.acquireServerOwnership(statePath);
+        if (operation === "unlink") {
+          yield* fs.remove(lockPath);
+        } else if (operation === "replace") {
+          yield* fs.writeFileString(replacement, "");
+          yield* fs.rename(replacement, lockPath);
+        }
+        if (operation === "stat error") {
+          yield* fs.chmod(root, 0);
+          yield* TestClock.adjust("15 seconds").pipe(
+            Effect.ensuring(fs.chmod(root, 0o700).pipe(Effect.orDie)),
+          );
+          assert.deepEqual(warnings, [
+            [`Cannot check server ownership lock at ${lockPath} (EACCES).`],
+          ]);
+          yield* TestClock.adjust("5 seconds");
+          assert.deepEqual(messages, []);
+          yield* fs.remove(lockPath);
+        }
+        yield* TestClock.adjust("5 seconds");
+        const expected =
+          operation === "unchanged"
+            ? []
+            : [
+                [
+                  `Server ownership lock at ${lockPath} was deleted or replaced. Another server may now share this T3 home. Stop any other server using this home, then restart this server. Do not delete server-owner.sqlite while a server is running.`,
+                ],
+              ];
+        assert.deepEqual(messages, expected);
+        if (operation !== "unchanged") {
+          yield* fs.remove(`${lockPath}-journal`, { force: true });
+          yield* Effect.scoped(ServerOwnership.acquireServerOwnership(statePath));
+        }
+        yield* TestClock.adjust("15 seconds");
+        assert.deepEqual(messages, expected);
+        assert.lengthOf(warnings, operation === "stat error" ? 1 : 0);
+      }).pipe(
+        Effect.provide(
+          Layer.merge(layerOwnership, Logger.layer([logger], { mergeWithExisting: false })),
+        ),
+      );
+    });
+  });
+
   it.effect("refuses beside a live pre-lock server and ignores a stale record", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;

From cb5fac907a21576e1e4b4da24aa70e0e2ea2e8d9 Mon Sep 17 00:00:00 2001
From: fixfon <12512757+fixfon@users.noreply.github.com>
Date: Thu, 29 Oct 2026 21:06:53 +0300
Subject: [PATCH 094/146] fix(server): mark unread no longer brings back a
 dismissed wake (#24080)

Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../Orchestrator.control-reads.test.ts        | 114 ++++++++++++++++++
 .../src/orchestration-v2/Orchestrator.ts      |  15 ++-
 .../src/state/threadVisits.test.ts            |  18 +++
 .../client-runtime/src/state/threadVisits.ts  |   3 +-
 4 files changed, 147 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.control-reads.test.ts b/apps/server/src/orchestration-v2/Orchestrator.control-reads.test.ts
index c36dfc365af60..61515a053ac36 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.control-reads.test.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.control-reads.test.ts
@@ -260,6 +260,120 @@ it.effect("marks a never-visited thread's first completion unread", () =>
   }).pipe(Effect.provide(layerTest)),
 );
 
+const completeAndSnoozeThread = Effect.fn("test.completeAndSnoozeThread")(function* (
+  name: string,
+  snoozeMinutes: number,
+) {
+  const orchestrator = yield* Orchestrator.OrchestratorV2;
+  const projections = yield* ProjectionStore.ProjectionStoreV2;
+  const threadId = ThreadId.make(`thread:${name}`);
+  yield* orchestrator.dispatch({
+    type: "thread.create",
+    commandId: CommandId.make(`create-${name}`),
+    threadId,
+    projectId: ProjectId.make(`project:${name}`),
+    title: "Snoozed completion",
+    modelSelection,
+    runtimeMode: "full-access",
+    interactionMode: "default",
+    branch: null,
+    worktreePath: null,
+    createdBy: "user",
+    creationSource: "web",
+  });
+  yield* orchestrator.dispatch({
+    type: "message.dispatch",
+    commandId: CommandId.make(`dispatch-${name}`),
+    threadId,
+    messageId: MessageId.make(`dispatch-${name}`),
+    text: "Run in the background",
+    attachments: [],
+    dispatchMode: { type: "defer_start" },
+    createdBy: "agent",
+    creationSource: "mcp",
+  });
+  yield* orchestrator.dispatch({
+    type: "run.interrupt",
+    commandId: CommandId.make(`interrupt-${name}`),
+    threadId,
+    runId: (yield* projections.getThreadProjection(threadId)).runs[0]!.id,
+  });
+  const completedAt = (yield* projections.getThreadProjection(threadId)).runs.at(-1)?.completedAt;
+  assert.ok(completedAt);
+  yield* TestClock.adjust("1 second");
+  const snoozedUntil = DateTime.add(yield* DateTime.now, { minutes: snoozeMinutes });
+  yield* orchestrator.dispatch({
+    type: "thread.snooze",
+    commandId: CommandId.make(`snooze-${name}`),
+    threadId,
+    snoozedUntil: DateTime.formatIso(snoozedUntil),
+  });
+  return { threadId, completedAt, snoozedUntil };
+});
+
+it.effect("mark unread retires an expired snooze so a dismissed wake stays dismissed", () =>
+  Effect.gen(function* () {
+    const orchestrator = yield* Orchestrator.OrchestratorV2;
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const { threadId, completedAt, snoozedUntil } = yield* completeAndSnoozeThread(
+      "mark-unread-expired-snooze",
+      1,
+    );
+    yield* TestClock.adjust("2 minutes");
+    yield* orchestrator.dispatch({
+      type: "thread.visit",
+      commandId: CommandId.make("dismiss-woke"),
+      threadId,
+      visitedAt: DateTime.formatIso(snoozedUntil),
+    });
+    const dismissed = yield* projections.getThread(threadId);
+    assert.deepEqual(dismissed.lastVisitedAt, snoozedUntil);
+
+    yield* orchestrator.dispatch({
+      type: "thread.mark-unread",
+      commandId: CommandId.make("mark-unread-expired-snooze"),
+      threadId,
+    });
+    assert.deepEqual(yield* projections.getThread(threadId), {
+      ...dismissed,
+      lastVisitedAt: DateTime.subtract(completedAt, { milliseconds: 1 }),
+      snoozedUntil: null,
+      snoozedAt: null,
+      lastSnoozeWakeAt: snoozedUntil,
+    });
+  }).pipe(Effect.provide(layerTest)),
+);
+
+it.effect("mark unread leaves a future snooze untouched", () =>
+  Effect.gen(function* () {
+    const orchestrator = yield* Orchestrator.OrchestratorV2;
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const { threadId, completedAt } = yield* completeAndSnoozeThread(
+      "mark-unread-future-snooze",
+      60,
+    );
+    yield* TestClock.adjust("1 minute");
+    yield* orchestrator.dispatch({
+      type: "thread.visit",
+      commandId: CommandId.make("visit-snoozed"),
+      threadId,
+      visitedAt: DateTime.formatIso(yield* DateTime.now),
+    });
+    const visited = yield* projections.getThread(threadId);
+    assert.isNotNull(visited.snoozedUntil);
+
+    yield* orchestrator.dispatch({
+      type: "thread.mark-unread",
+      commandId: CommandId.make("mark-unread-future-snooze"),
+      threadId,
+    });
+    assert.deepEqual(yield* projections.getThread(threadId), {
+      ...visited,
+      lastVisitedAt: DateTime.subtract(completedAt, { milliseconds: 1 }),
+    });
+  }).pipe(Effect.provide(layerTest)),
+);
+
 it.effect(
   "dispatches metadata, queue resume and request controls without hydrating unrelated history",
   () =>
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 94de805b46522..76bcc00bbcb4e 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -3360,8 +3360,19 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
             updatedAt: thread.updatedAt,
           };
         }
-        case "thread.mark-unread":
-          return { ...thread, lastVisitedAt: markUnreadVisitedAt };
+        case "thread.mark-unread": {
+          // Retire the wake before rewinding the visit, preserving its settlement timer.
+          const snoozeExpired =
+            thread.snoozedUntil != null &&
+            DateTime.toEpochMillis(thread.snoozedUntil) <= DateTime.toEpochMillis(now);
+          return {
+            ...thread,
+            lastVisitedAt: markUnreadVisitedAt,
+            ...(snoozeExpired
+              ? { snoozedUntil: null, snoozedAt: null, lastSnoozeWakeAt: thread.snoozedUntil }
+              : {}),
+          };
+        }
         case "thread.metadata.update": {
           const previousRecovery =
             thread.limitRecovery?.runId === command.limitRecovery?.runId &&
diff --git a/packages/client-runtime/src/state/threadVisits.test.ts b/packages/client-runtime/src/state/threadVisits.test.ts
index a99417534ea7a..adcac7139e82a 100644
--- a/packages/client-runtime/src/state/threadVisits.test.ts
+++ b/packages/client-runtime/src/state/threadVisits.test.ts
@@ -111,6 +111,24 @@ it("keeps a mark-unread on the open thread until new activity lands", () => {
   expect(t.visits.slice(1)).toEqual([{ threadId: t.ref.threadId, visitedAt: at(30) }]);
 });
 
+it("keeps mark unread sticky after an expired wake is retired", () => {
+  using t = setup("thread-unread-retired-wake", {
+    updatedAt: at(10),
+    lastVisitedAt: at(0),
+    latestRun: { completedAt: at(9) },
+    wokeAt: at(15),
+  });
+  t.mount();
+  expect(t.visits).toEqual([{ threadId: t.ref.threadId, visitedAt: at(15), opened: true }]);
+  t.update({ lastVisitedAt: at(15) });
+  t.update({ lastVisitedAt: at(8), wokeAt: null });
+  vi.advanceTimersByTime(VISIT_DISPATCH_THROTTLE_MS);
+  expect(t.visits).toHaveLength(1);
+
+  t.update({ updatedAt: at(30) });
+  expect(t.visits.slice(1)).toEqual([{ threadId: t.ref.threadId, visitedAt: at(30) }]);
+});
+
 it("waits for the shell and records local visits for servers without tracking", () => {
   using t = setup("thread-local", null);
   t.mount();
diff --git a/packages/client-runtime/src/state/threadVisits.ts b/packages/client-runtime/src/state/threadVisits.ts
index 08d05909a2dad..c08f47ed01436 100644
--- a/packages/client-runtime/src/state/threadVisits.ts
+++ b/packages/client-runtime/src/state/threadVisits.ts
@@ -115,7 +115,8 @@ export function createThreadVisitTracker(options: ThreadVisitTrackerOptions) {
         }
         const lastVisitedAtMs = shell.lastVisitedAt ? Date.parse(shell.lastVisitedAt) : NaN;
         if (!Number.isNaN(lastVisitedAtMs) && lastVisitedAtMs >= updatedAtMs) return;
-        if (lastDispatchedUpdatedAt === visitedAt) return;
+        if (lastDispatchedUpdatedAt !== null && Date.parse(lastDispatchedUpdatedAt) >= updatedAtMs)
+          return;
 
         const completedAtMs = shell.latestRun?.completedAt
           ? Date.parse(shell.latestRun.completedAt)

From fa4f3a2925822201e6fe4f11db45c8649383e420 Mon Sep 17 00:00:00 2001
From: Alex Southwell <saphid@gmail.com>
Date: Thu, 29 Oct 2026 18:07:16 +0000
Subject: [PATCH 095/146] fix(mobile): stop refreshes in hidden PR Guide panes
 (#25486)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
---
 .../pull-requests/PullRequestRouteScreen.tsx  |   7 +-
 .../guide/PullRequestGuideScreen.tsx          |  10 +-
 .../guide/useReviewGuide.test.tsx             | 130 ++++++++++++++++--
 .../pull-requests/guide/useReviewGuide.ts     |   4 +-
 4 files changed, 137 insertions(+), 14 deletions(-)

diff --git a/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx b/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
index 446794800eadb..bd3f04d9d6b4d 100644
--- a/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
+++ b/apps/mobile/src/features/pull-requests/PullRequestRouteScreen.tsx
@@ -794,7 +794,12 @@ export function PullRequestRouteScreen({ route }: StaticScreenProps<PullRequestP
                               </View>
                             </View>
                           ) : null}
-                          {tab === "guide" ? <PullRequestGuideContent params={params} /> : null}
+                          {tab === "guide" ? (
+                            <PullRequestGuideContent
+                              params={params}
+                              visible={section === "guide"}
+                            />
+                          ) : null}
                           {tab === "activity" ? (
                             <PullRequestActivityFilters
                               value={activityFilter}
diff --git a/apps/mobile/src/features/pull-requests/guide/PullRequestGuideScreen.tsx b/apps/mobile/src/features/pull-requests/guide/PullRequestGuideScreen.tsx
index d198ea5b09e07..caa1e72938c87 100644
--- a/apps/mobile/src/features/pull-requests/guide/PullRequestGuideScreen.tsx
+++ b/apps/mobile/src/features/pull-requests/guide/PullRequestGuideScreen.tsx
@@ -48,9 +48,15 @@ const attentionLabels = {
   accessibility: "An accessibility call",
 };
 
-export function PullRequestGuideContent({ params }: { readonly params: PullRequestParams }) {
+export function PullRequestGuideContent({
+  params,
+  visible = true,
+}: {
+  readonly params: PullRequestParams;
+  readonly visible?: boolean;
+}) {
   const navigation = useNavigation();
-  const state = useReviewGuide(params);
+  const state = useReviewGuide(params, visible);
   const { guide, stale } = reviewGuideState(state.data);
   return (
     <Animated.View layout={PR_ROW_LAYOUT} className="w-full max-w-[760px] self-center">
diff --git a/apps/mobile/src/features/pull-requests/guide/useReviewGuide.test.tsx b/apps/mobile/src/features/pull-requests/guide/useReviewGuide.test.tsx
index 764cd5f881ac9..e797a12a57217 100644
--- a/apps/mobile/src/features/pull-requests/guide/useReviewGuide.test.tsx
+++ b/apps/mobile/src/features/pull-requests/guide/useReviewGuide.test.tsx
@@ -3,18 +3,21 @@ import {
   type NavigationProp,
   type ParamListBase,
 } from "@react-navigation/native";
-import { act } from "react";
+import { AsyncResult } from "effect/reactivity";
+import { act, useLayoutEffect } from "react";
 import { createRoot } from "react-dom/client";
 import { expect, it, vi } from "vite-plus/test";
 
 const mocks = vi.hoisted(() => ({
+  enabled: true,
+  generate: vi.fn(),
   query: {
-    data: null as { run: { _tag: "Running" | "Completed" } } | null,
+    data: null as { run: { _tag: "Running" | "Completed" | "Failed" } | null } | null,
     isPending: false,
     refresh: vi.fn<() => void>(),
   },
   otherQuery: {
-    data: null as { run: { _tag: "Running" | "Completed" } } | null,
+    data: null as { run: { _tag: "Running" | "Completed" | "Failed" } | null } | null,
     isPending: false,
     refresh: vi.fn<() => void>(),
   },
@@ -33,7 +36,8 @@ vi.mock("@react-navigation/native", async () => {
   return { NavigationContext, useFocusEffect };
 });
 vi.mock("@effect/atom-react", () => ({
-  useAtomValue: (atom: unknown) => (atom === "settings" ? { reviewGuidesEnabled: true } : true),
+  useAtomValue: (atom: unknown) =>
+    atom === "settings" ? { reviewGuidesEnabled: mocks.enabled } : true,
 }));
 vi.mock("../../../state/server", () => ({
   serverEnvironment: { settingsValueAtom: () => "settings" },
@@ -48,7 +52,7 @@ vi.mock("../../../state/pull-requests", () => ({
 vi.mock("../../../state/query", () => ({
   useEnvironmentQuery: (number: number) => ({ ...(number === 1 ? mocks.query : mocks.otherQuery) }),
 }));
-vi.mock("../../../state/use-atom-command", () => ({ useAtomCommand: () => vi.fn() }));
+vi.mock("../../../state/use-atom-command", () => ({ useAtomCommand: () => mocks.generate }));
 vi.mock("../usePullRequestConnected", () => ({ usePullRequestConnected: () => true }));
 vi.mock("../usePullRequestDiff", () => ({
   pullRequestTarget: (params: unknown) => params,
@@ -78,6 +82,8 @@ function createNavigation() {
 
 function setup() {
   (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+  mocks.enabled = true;
+  mocks.generate = vi.fn().mockResolvedValue(AsyncResult.success(undefined));
   mocks.query = { data: null, isPending: false, refresh: vi.fn() };
   mocks.otherQuery = { data: null, isPending: false, refresh: vi.fn() };
   const root = createRoot(document.createElement("div"));
@@ -88,20 +94,35 @@ function setup() {
     repository: "repo",
     number: 1,
   };
-  function Probe({ number, environmentId }: { number: number; environmentId: string }) {
-    useReviewGuide({ ...params, number, environmentId });
+  let current: ReturnType<typeof useReviewGuide>;
+  function Probe({
+    number,
+    environmentId,
+    visible,
+  }: {
+    number: number;
+    environmentId: string;
+    visible?: boolean;
+  }) {
+    const state = useReviewGuide({ ...params, number, environmentId }, visible);
+    useLayoutEffect(() => {
+      current = state;
+    });
     return null;
   }
   return {
-    render(number = 1, environmentId = params.environmentId) {
+    render(number = 1, environmentId = params.environmentId, visible?: boolean) {
       act(() =>
         root.render(
           <NavigationContext.Provider value={navigation.value}>
-            <Probe number={number} environmentId={environmentId} />
+            <Probe number={number} environmentId={environmentId} visible={visible} />
           </NavigationContext.Provider>,
         ),
       );
     },
+    get current() {
+      return current;
+    },
     focus: navigation.focus,
     [Symbol.dispose]() {
       act(() => root.unmount());
@@ -188,3 +209,94 @@ it("retires the old environment's polling on target change and clears polling on
   expect(mocks.otherQuery.refresh).toHaveBeenCalledTimes(2);
   expect(vi.getTimerCount()).toBe(0);
 });
+
+it("suspends only manual refresh while hidden, including focus and target changes", () => {
+  vi.useFakeTimers();
+  using _timers = { [Symbol.dispose]: () => vi.useRealTimers() };
+  {
+    using screen = setup();
+    mocks.query.data = { run: { _tag: "Running" } };
+    mocks.otherQuery.data = { run: { _tag: "Running" } };
+    screen.render();
+    const cached = screen.current.data;
+    screen.render(1, "environment", false);
+    act(() => vi.advanceTimersByTime(60_000));
+    expect(mocks.query.refresh).toHaveBeenCalledTimes(1);
+    expect(screen.current.data).toBe(cached);
+    screen.render();
+    expect(mocks.query.refresh).toHaveBeenCalledTimes(2);
+    act(() => vi.advanceTimersByTime(5_000));
+    expect(mocks.query.refresh).toHaveBeenCalledTimes(3);
+    screen.render(1, "environment", false);
+    screen.focus(false);
+    screen.focus(true);
+    expect(mocks.query.refresh).toHaveBeenCalledTimes(3);
+
+    screen.render(2, "other-environment", false);
+    act(() => vi.advanceTimersByTime(5_000));
+    expect(mocks.otherQuery.refresh).not.toHaveBeenCalled();
+    screen.focus(false);
+    screen.render(2, "other-environment", true);
+    expect(mocks.otherQuery.refresh).not.toHaveBeenCalled();
+    screen.focus(true);
+    expect(mocks.otherQuery.refresh).toHaveBeenCalledTimes(1);
+    act(() => vi.advanceTimersByTime(5_000));
+    expect(mocks.otherQuery.refresh).toHaveBeenCalledTimes(2);
+    expect(mocks.query.refresh).toHaveBeenCalledTimes(3);
+  }
+  expect(vi.getTimerCount()).toBe(0);
+});
+
+it("keeps disabled, completed and failed guides idle and refreshes once on reveal", () => {
+  vi.useFakeTimers();
+  using _timers = { [Symbol.dispose]: () => vi.useRealTimers() };
+  using screen = setup();
+  mocks.enabled = false;
+  screen.render();
+  act(() => vi.advanceTimersByTime(5_000));
+  expect(mocks.query.refresh).not.toHaveBeenCalled();
+  mocks.enabled = true;
+  mocks.query.data = { run: null };
+  screen.render();
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(1);
+  act(() => vi.advanceTimersByTime(10_000));
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(1);
+  screen.render(1, "environment", false);
+  mocks.query.data = { run: { _tag: "Failed" } };
+  screen.render(1, "environment", false);
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(1);
+  screen.render();
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(2);
+  act(() => vi.advanceTimersByTime(10_000));
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(2);
+  expect(vi.getTimerCount()).toBe(0);
+});
+
+it("leaves generation running when hidden and accepts its completion without a refresh", async () => {
+  vi.useFakeTimers();
+  using _timers = { [Symbol.dispose]: () => vi.useRealTimers() };
+  using screen = setup();
+  const generated = Promise.withResolvers<ReturnType<typeof AsyncResult.success<void>>>();
+  mocks.generate.mockReturnValue(generated.promise);
+  screen.render();
+  let writing: Promise<void>;
+  act(() => {
+    writing = screen.current.write();
+  });
+  expect(screen.current.running).toBe(true);
+  screen.render(1, "environment", false);
+  const beforeHidden = mocks.query.refresh.mock.calls.length;
+  act(() => vi.advanceTimersByTime(60_000));
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(beforeHidden);
+  expect(mocks.generate).toHaveBeenCalledTimes(1);
+  expect(screen.current.running).toBe(true);
+  await act(async () => {
+    generated.resolve(AsyncResult.success(undefined));
+    await writing;
+  });
+  expect(screen.current.running).toBe(false);
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(beforeHidden);
+  screen.render();
+  expect(mocks.query.refresh).toHaveBeenCalledTimes(beforeHidden + 1);
+  expect(vi.getTimerCount()).toBe(0);
+});
diff --git a/apps/mobile/src/features/pull-requests/guide/useReviewGuide.ts b/apps/mobile/src/features/pull-requests/guide/useReviewGuide.ts
index 5dad083e76108..bbdb6caee00c3 100644
--- a/apps/mobile/src/features/pull-requests/guide/useReviewGuide.ts
+++ b/apps/mobile/src/features/pull-requests/guide/useReviewGuide.ts
@@ -17,7 +17,7 @@ export function useReviewGuidesEnabled(params: PullRequestParams) {
   return settings?.reviewGuidesEnabled === true;
 }
 
-export function useReviewGuide(params: PullRequestParams) {
+export function useReviewGuide(params: PullRequestParams, visible = true) {
   const target = pullRequestTarget(params);
   const enabled = useReviewGuidesEnabled(params);
   const query = useEnvironmentQuery(enabled ? composerPullRequests.reviewGuide(target) : null);
@@ -35,7 +35,7 @@ export function useReviewGuide(params: PullRequestParams) {
   const running = starting || query.data?.run?._tag === "Running";
   const refresh = query.refresh;
   useFocusEffect(() => {
-    if (!enabled) return;
+    if (!enabled || !visible) return;
     refresh();
     if (!running) return;
     const timer = setInterval(refresh, 5_000);

From b6fbd181cae49d38927360913851121cc35ec4ff Mon Sep 17 00:00:00 2001
From: Gourav Kumar Dhiman <gkrdhiman@gmail.com>
Date: Thu, 29 Oct 2026 23:54:19 +0530
Subject: [PATCH 096/146] fix(desktop): installing the t3 command no longer
 reports its own launcher as another t3 (#22375)

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../desktop/src/app/DesktopCliCommand.test.ts | 36 +++++++++++++++++++
 apps/desktop/src/app/DesktopCliCommand.ts     | 30 ++++++++++++----
 2 files changed, 60 insertions(+), 6 deletions(-)

diff --git a/apps/desktop/src/app/DesktopCliCommand.test.ts b/apps/desktop/src/app/DesktopCliCommand.test.ts
index 7141ebde70537..8566613dd6069 100644
--- a/apps/desktop/src/app/DesktopCliCommand.test.ts
+++ b/apps/desktop/src/app/DesktopCliCommand.test.ts
@@ -136,6 +136,14 @@ it.layer(NodeServices.layer)("DesktopCliCommand", (it) => {
       yield* command.uninstall;
       expect(yield* fs.readFileString(theirs)).toBe("npm's t3\n");
       expect(yield* fs.readLink(path.join(home, "bin", "t3"))).toBe(path.join(home, "gone"));
+
+      const launcher = path.join(home, ".t3", "bin", "t3");
+      yield* fs.writeFileString(launcher, "npm's t3\n");
+      process.env.PATH = path.dirname(launcher);
+      expect(yield* command.state).toMatchObject({ onPath: false, shadowedBy: launcher });
+      expect((yield* Effect.flip(command.install)).message).toContain("Could not set up");
+      yield* command.uninstall;
+      expect(yield* fs.readFileString(launcher)).toBe("npm's t3\n");
     }).pipe(Effect.scoped),
   );
 
@@ -217,6 +225,34 @@ it.layer(NodeServices.layer)("DesktopCliCommand", (it) => {
       }).pipe(Effect.scoped),
   );
 
+  it.effect("does not treat its own launcher as another t3 when its folder is first on PATH", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const home = yield* fs.makeTempDirectoryScoped();
+      const launcher = path.join(home, ".t3", "bin", "t3");
+      process.env.PATH = [path.dirname(launcher), path.join(home, ".local", "bin")].join(":");
+
+      const command = yield* commandIn({ home });
+      const installed = yield* command.install;
+
+      expect(yield* fs.exists(launcher)).toBe(true);
+      expect(installed).toMatchObject({
+        onPath: true,
+        installedPath: path.join(home, ".local", "bin", "t3"),
+      });
+      expect(installed.shadowedBy).toBeUndefined();
+      expect(yield* command.state).toEqual(installed);
+
+      const removed = yield* command.uninstall;
+      expect(removed.installedPath).toBeNull();
+      expect(removed.onPath).toBe(true);
+      expect(yield* command.state).toEqual(removed);
+      expect(yield* fs.exists(installed.installedPath!)).toBe(false);
+      expect(yield* fs.exists(launcher)).toBe(true);
+    }).pipe(Effect.scoped),
+  );
+
   it.effect("leaves the Windows PATH alone when it cannot be read", () =>
     Effect.gen(function* () {
       const fs = yield* FileSystem.FileSystem;
diff --git a/apps/desktop/src/app/DesktopCliCommand.ts b/apps/desktop/src/app/DesktopCliCommand.ts
index 8a89a366814ed..f53895a60a570 100644
--- a/apps/desktop/src/app/DesktopCliCommand.ts
+++ b/apps/desktop/src/app/DesktopCliCommand.ts
@@ -92,6 +92,19 @@ export const make = Effect.gen(function* () {
     Effect.orElseSucceed(() => false),
   );
 
+  // PATH can reach the regular launcher directly; removal still requires isOurLink.
+  const runsOurLauncher = Effect.fn("DesktopCliCommand.runsOurLauncher")(
+    function* (candidate: string) {
+      if (yield* isOurLink(candidate)) return true;
+      const [resolved, ours] = yield* Effect.all([fs.realPath(candidate), fs.realPath(launcher)]);
+      if (resolved !== ours) return false;
+      const info = yield* fs.stat(candidate);
+      if (info.type !== "File" || Number(info.size) > 16_384) return false;
+      return (yield* fs.readFileString(candidate)).includes(DesktopCliShim.MARKER);
+    },
+    Effect.orElseSucceed(() => false),
+  );
+
   const powershell = (env: Record<string, string>) =>
     Effect.scoped(
       Effect.gen(function* () {
@@ -141,7 +154,7 @@ export const make = Effect.gen(function* () {
   const foreignFirstOnPath = Effect.gen(function* () {
     if (windows) return Option.none<string>();
     const first = yield* firstOnPath;
-    if (Option.isNone(first) || (yield* isOurLink(first.value))) return Option.none<string>();
+    if (Option.isNone(first) || (yield* runsOurLauncher(first.value))) return Option.none<string>();
     return first;
   });
 
@@ -168,12 +181,17 @@ export const make = Effect.gen(function* () {
     const installed = yield* installedAt;
     const shadowedBy = yield* foreignFirstOnPath;
     const shadow = Option.isSome(shadowedBy) ? { shadowedBy: shadowedBy.value } : {};
-    if (Option.isNone(installed)) {
-      return { supported: true, installedPath: null, onPath: false, launcherPath, ...shadow };
-    }
     const first = yield* firstOnPath;
-    const onPath = windows || (Option.isSome(first) && (yield* isOurLink(first.value)));
-    return { supported: true, installedPath: installed.value, onPath, launcherPath, ...shadow };
+    const onPath = windows
+      ? Option.isSome(installed)
+      : Option.isSome(first) && (yield* runsOurLauncher(first.value));
+    return {
+      supported: true,
+      installedPath: Option.getOrNull(installed),
+      onPath,
+      launcherPath,
+      ...shadow,
+    };
   }).pipe(
     Effect.orElseSucceed(() => ({
       supported: false,

From 1fe8ddd222d127815064d400d1667c88f60cd71a Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Thu, 29 Oct 2026 18:28:30 +0000
Subject: [PATCH 097/146] test(mobile): load the branch occupancy test without
 native sources (#27063)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 .../features/threads/git/GitBranchesSheet.occupancy.test.tsx    | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx b/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx
index 7667b0c793fc4..e611b95d3f683 100644
--- a/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx
+++ b/apps/mobile/src/features/threads/git/GitBranchesSheet.occupancy.test.tsx
@@ -30,6 +30,8 @@ vi.mock("../../../components/ui/AppText", () => ({
   AppTextInput: () => null,
 }));
 vi.mock("./gitSheetComponents", () => ({ SheetActionButton: () => null }));
+vi.mock("../../../state/entities", () => ({}));
+vi.mock("../../../state/threads", () => ({}));
 vi.mock("../../../state/use-thread-selection", () => ({
   useThreadSelection: () => ({
     selectedThread: { environmentId: "environment-1", worktreePath: checkout.worktreePath },

From 08a463e29976617134de01e9341f898bc881d0eb Mon Sep 17 00:00:00 2001
From: Victor Vogel <satsdev@only21mil.xyz>
Date: Thu, 29 Oct 2026 13:34:43 -0500
Subject: [PATCH 098/146] fix(settings): project edits keep overrides the
 client does not know (#24472)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: maria-rcks <maria@kuuro.net>
Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
---
 apps/server/src/serverSettings.test.ts     | 25 +++++++++++++++
 apps/server/src/serverSettings.ts          | 11 ++++---
 packages/contracts/src/settings.test.ts    | 22 +++++++++++++
 packages/contracts/src/settings.ts         | 27 ++++++++++++----
 packages/shared/src/serverSettings.test.ts | 37 ++++++++++++++++++++++
 packages/shared/src/serverSettings.ts      | 16 ++++++++--
 6 files changed, 125 insertions(+), 13 deletions(-)

diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index 29dea381e759a..f34b653c8cbc8 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -212,6 +212,31 @@ it.layer(NodeServices.layer)("server settings", (it) => {
     }).pipe(Effect.provide(layerServerSettings())),
   );
 
+  it.effect("keeps an override key a newer server saved when a project setting is edited", () =>
+    Effect.gen(function* () {
+      const config = yield* ServerConfig.ServerConfig;
+      const fs = yield* FileSystem.FileSystem;
+      const service = yield* ServerSettingsModule.ServerSettingsService;
+      const projectId = ProjectId.make("project-a");
+      yield* fs.writeFileString(
+        config.settingsPath,
+        `{ "projectSettingsOverrides": { "project-a": { "defaultAutoPull": true, "addedByNewerServer": 3 } } }`,
+      );
+      const loaded = yield* service.getSettings;
+
+      yield* service.updateSettings({
+        projectSettingsOverrides: {
+          [projectId]: { ...loaded.projectSettingsOverrides[projectId], defaultAutoPull: false },
+        },
+      });
+
+      const persisted = JSON.parse(yield* fs.readFileString(config.settingsPath));
+      assert.deepEqual(persisted.projectSettingsOverrides, {
+        [projectId]: { defaultAutoPull: false, addedByNewerServer: 3 },
+      });
+    }).pipe(Effect.provide(layerServerSettings())),
+  );
+
   it.effect("moves an idle compaction mode saved in the legacy switch to its own field", () =>
     Effect.gen(function* () {
       const config = yield* ServerConfig.ServerConfig;
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index e386b95cf506c..6f6a1db5a292a 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -3,6 +3,7 @@ import {
   ModelSelection,
   ProjectId,
   ProjectScript,
+  keepUnknownOverrideKeys,
   ProjectSettingsOverrides,
   type ProviderInstanceConfig,
   type ProviderInstanceMutation,
@@ -292,10 +293,12 @@ const ServerSettingsJson = fromLenientJson(
     ),
     projectSettingsOverrides: Schema.Record(
       ProjectId,
-      Schema.Struct({
-        ...ProjectSettingsOverrides.fields,
-        responseStreamingMode: Schema.optionalKey(PersistedResponseStreamingMode),
-      }),
+      keepUnknownOverrideKeys(
+        Schema.Struct({
+          ...ProjectSettingsOverrides.fields,
+          responseStreamingMode: Schema.optionalKey(PersistedResponseStreamingMode),
+        }),
+      ),
     ).pipe(Schema.withDecodingDefault(Effect.succeed({}))),
   }),
 );
diff --git a/packages/contracts/src/settings.test.ts b/packages/contracts/src/settings.test.ts
index 6088cf7a2fa2a..9d765ccee92c6 100644
--- a/packages/contracts/src/settings.test.ts
+++ b/packages/contracts/src/settings.test.ts
@@ -25,6 +25,7 @@ const encodeClientSettings = Schema.encodeSync(ClientSettingsSchema);
 const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
 const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 const encodeServerSettings = Schema.encodeSync(ServerSettings);
+const encodeServerSettingsPatch = Schema.encodeSync(ServerSettingsPatch);
 const decodeClaudeSettings = Schema.decodeUnknownSync(ClaudeSettings);
 
 describe("storage cleanup settings", () => {
@@ -372,6 +373,27 @@ it("validates remote device hosts and rejects ambiguous host ids", () => {
   expect(() => decodeDeviceHostSettings({ deviceHosts: [{ ...host, port: 0 }] })).toThrow();
 });
 
+describe("ServerSettings project overrides across versions", () => {
+  it("sends back an override key from a newer server when an older client edits the entry", () => {
+    const projectId = ProjectId.make("project-a");
+    // As an older client reads a newer server's settings, with one key it does not know.
+    const entry = decodeServerSettings({
+      projectSettingsOverrides: {
+        [projectId]: { defaultAutoPull: true, addedByNewerServer: { mode: "kept" } },
+      },
+    }).projectSettingsOverrides[projectId];
+
+    const sent = encodeServerSettingsPatch({
+      projectSettingsOverrides: { [projectId]: { ...entry, defaultAutoPull: false } },
+    });
+
+    expect(decodeServerSettingsPatch(sent).projectSettingsOverrides?.[projectId]).toEqual({
+      defaultAutoPull: false,
+      addedByNewerServer: { mode: "kept" },
+    });
+  });
+});
+
 describe("resolveProjectProviderInstanceEnabled", () => {
   const projectId = "project-a" as ProjectId;
   const instanceId = ProviderInstanceId.make("codex_work");
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index c7d61aeb5ee21..179e58b7a0b56 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -1137,6 +1137,16 @@ export const ProjectSettingsOverrides = Schema.Struct({
 } satisfies Record<ProjectScopedServerSettingKey | "providerInstances", unknown>);
 export type ProjectSettingsOverrides = typeof ProjectSettingsOverrides.Type;
 
+// Whole-entry writers must round-trip unknown keys; keep the type closed to catch misspellings.
+export const keepUnknownOverrideKeys = <Entry extends Schema.Struct<Schema.Struct.Fields>>(
+  entry: Entry,
+): Schema.Codec<
+  Entry["Type"],
+  Entry["Encoded"],
+  Entry["DecodingServices"],
+  Entry["EncodingServices"]
+> => Schema.StructWithRest(entry, [Schema.Record(Schema.String, Schema.Unknown)]);
+
 /** True if null stores an override; otherwise null removes it. */
 export function isNullableProjectSettingsOverride(key: ProjectScopedServerSettingKey): boolean {
   return NULLABLE_PROJECT_SETTINGS_OVERRIDES.has(key);
@@ -1263,9 +1273,10 @@ export const ServerSettings = Schema.Struct({
     Schema.withDecodingDefault(Effect.succeed(DEFAULT_RUNTIME_MODE)),
   ),
 
-  projectSettingsOverrides: Schema.Record(ProjectId, ProjectSettingsOverrides).pipe(
-    Schema.withDecodingDefault(Effect.succeed({})),
-  ),
+  projectSettingsOverrides: Schema.Record(
+    ProjectId,
+    keepUnknownOverrideKeys(ProjectSettingsOverrides),
+  ).pipe(Schema.withDecodingDefault(Effect.succeed({}))),
   /** Fold once so restarts cannot undo later UI resets. */
   projectSettingsFolded: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
 
@@ -1626,10 +1637,12 @@ export const ServerSettingsPatch = Schema.Struct({
     Schema.Record(
       ProjectId,
       Schema.NullOr(
-        Schema.Struct({
-          ...ProjectSettingsOverrides.fields,
-          sourceControlWritingStyle: Schema.optionalKey(SourceControlWritingStyleSettings),
-        }),
+        keepUnknownOverrideKeys(
+          Schema.Struct({
+            ...ProjectSettingsOverrides.fields,
+            sourceControlWritingStyle: Schema.optionalKey(SourceControlWritingStyleSettings),
+          }),
+        ),
       ),
     ),
   ),
diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index bd315271c78e1..5a02f302826de 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -6,10 +6,13 @@ import {
   ProviderInstanceId,
   SecretProviderId,
   SecretProviderKind,
+  ServerSettings,
+  ServerSettingsPatch,
   UsageLimitSourceId,
   type ServerProvider,
 } from "@t3tools/contracts";
 import * as Duration from "effect/Duration";
+import * as Schema from "effect/Schema";
 import { describe, expect, it } from "vite-plus/test";
 import { resolveServerBackgroundActivitySettings } from "./backgroundActivitySettings.ts";
 import { createModelSelection } from "./model.ts";
@@ -24,6 +27,9 @@ import {
   resolveSourceControlWriterModelSelection,
 } from "./serverSettings.ts";
 
+const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
+const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
+
 const FOLDED_SERVER_SETTINGS = { ...DEFAULT_SERVER_SETTINGS, projectSettingsFolded: true };
 
 describe("fallbackTextGenerationModelSelection", () => {
@@ -499,6 +505,37 @@ describe("serverSettings helpers", () => {
     });
   });
 
+  // regression: #18334 a newer client must still see this server drop a key it does not know
+  it("drops an override key this server does not know from a patch and keeps one it stored", () => {
+    const projectId = ProjectId.make("project-a");
+    const current = decodeServerSettings({
+      projectSettingsFolded: true,
+      projectSettingsOverrides: {
+        [projectId]: { defaultAutoPull: true, addedByNewerServer: 3 },
+      },
+    });
+    const patch = decodeServerSettingsPatch({
+      projectSettingsOverrides: {
+        [projectId]: { defaultAutoPull: false, addedByNewerServer: 4, addedByNewerClient: "x" },
+      },
+    });
+
+    const updated = applyServerSettingsPatch(current, patch);
+    expect(updated.projectSettingsOverrides[projectId]).toEqual({
+      defaultAutoPull: false,
+      addedByNewerServer: 3,
+    });
+    const reset = applyServerSettingsPatch(updated, {
+      projectSettingsOverrides: { [projectId]: {} },
+    });
+    expect(reset.projectSettingsOverrides[projectId]).toEqual({ addedByNewerServer: 3 });
+    expect(
+      applyServerSettingsPatch(reset, {
+        projectSettingsOverrides: { [projectId]: null },
+      }).projectSettingsOverrides[projectId],
+    ).toBeUndefined();
+  });
+
   it("clears a project's providerInstances override when a patch entry sends an empty map", () => {
     const instanceId = ProviderInstanceId.make("codex_work");
     const projectId = ProjectId.make("project-a");
diff --git a/packages/shared/src/serverSettings.ts b/packages/shared/src/serverSettings.ts
index 11eecc6fe3df8..e936c9f83acba 100644
--- a/packages/shared/src/serverSettings.ts
+++ b/packages/shared/src/serverSettings.ts
@@ -14,7 +14,7 @@ import {
   type ModelSelection,
   type ProjectId,
   type ProjectScopedServerSettingKey,
-  type ProjectSettingsOverrides,
+  ProjectSettingsOverrides,
   ProviderDriverKind,
   ProviderInstanceId,
   type ServerProvider,
@@ -226,6 +226,16 @@ function mergeSettingsEntries<Value>(
   return Object.fromEntries(next);
 }
 
+const knownProjectOverrideKeys = new Set(Object.keys(ProjectSettingsOverrides.fields));
+
+function pickOverrideKeys(entry: ProjectSettingsOverrides | undefined, known: boolean) {
+  return Object.fromEntries(
+    Object.entries<unknown>(entry ?? {}).filter(
+      ([key]) => knownProjectOverrideKeys.has(key) === known,
+    ),
+  );
+}
+
 // Older clients omit providerInstances during whole-entry replacement; preserve it to avoid wiping overrides.
 function mergeProjectSettingsOverridesPatch(
   current: Readonly<Record<string, ProjectSettingsOverrides>>,
@@ -239,7 +249,9 @@ function mergeProjectSettingsOverridesPatch(
     }
     const storedProviderInstances = current[projectId]?.providerInstances;
     next.set(projectId, {
-      ...entry,
+      // Preserve downgraded storage, but reject new unknown writes so clients can detect unsupported settings.
+      ...pickOverrideKeys(current[projectId], false),
+      ...pickOverrideKeys(entry, true),
       ...(Object.hasOwn(entry, "providerInstances") || storedProviderInstances === undefined
         ? {}
         : { providerInstances: storedProviderInstances }),

From 4092c4ac567b791c84c20a15403f2b7d5051d42d Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 12:49:29 -0700
Subject: [PATCH 099/146] fix(client): retry the permissions check after a
 reconnect (#27008)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../settings/EnvironmentRoutesSection.tsx     |  15 +-
 .../SettingsEnvironmentDetailRouteScreen.tsx  |  14 +-
 .../settings/SessionPermissions.tsx           |  11 +-
 .../client-runtime/src/state/session.test.ts  | 133 ++++++++++++++++++
 packages/client-runtime/src/state/session.ts  |  57 +++++++-
 packages/shared/src/authScopeOptions.ts       |  16 +++
 6 files changed, 230 insertions(+), 16 deletions(-)
 create mode 100644 packages/client-runtime/src/state/session.test.ts

diff --git a/apps/mobile/src/features/settings/EnvironmentRoutesSection.tsx b/apps/mobile/src/features/settings/EnvironmentRoutesSection.tsx
index 012d00737d1df..842965dbf1575 100644
--- a/apps/mobile/src/features/settings/EnvironmentRoutesSection.tsx
+++ b/apps/mobile/src/features/settings/EnvironmentRoutesSection.tsx
@@ -12,7 +12,10 @@ import {
   isLearned,
 } from "@t3tools/client-runtime/connection";
 import { type EnvironmentId, sessionGrantsScope } from "@t3tools/contracts";
-import { AUTH_SCOPE_OPTIONS } from "@t3tools/shared/authScopeOptions";
+import {
+  AUTH_SCOPE_OPTIONS,
+  sessionPermissionsUnavailableMessage,
+} from "@t3tools/shared/authScopeOptions";
 import { AsyncResult } from "effect/reactivity";
 import * as Option from "effect/Option";
 import { useState } from "react";
@@ -163,8 +166,14 @@ export function EnvironmentRoutesSection({
             </>
           ) : (
             <Text className="text-sm text-foreground-muted">
-              Permissions not checked. Connect to this environment to view this session’s
-              permissions.
+              {sessionPermissionsUnavailableMessage({
+                connected: activeRouteId !== null,
+                failed: sessionResult._tag === "Failure",
+                rejected:
+                  sessionResult._tag !== "Failure" &&
+                  !sessionResult.waiting &&
+                  session?.authenticated === false,
+              })}
             </Text>
           )}
         </View>
diff --git a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
index cd9d8e03c9c1f..c581cbc688142 100644
--- a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
@@ -8,6 +8,7 @@ import {
   type ServerProvider,
 } from "@t3tools/contracts";
 import { settlePromise, squashAtomCommandFailure } from "@t3tools/client-runtime/state/runtime";
+import { sessionPermissionsUnavailableMessage } from "@t3tools/shared/authScopeOptions";
 import * as Cause from "effect/Cause";
 import * as Exit from "effect/Exit";
 import { AsyncResult } from "effect/reactivity";
@@ -208,11 +209,14 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
               </Text>
             ) : !allowed ? (
               <Text className="px-2 text-sm text-foreground-muted">
-                {AsyncResult.isFailure(sessionResult)
-                  ? "Could not verify your permissions. Reconnect to try again."
-                  : session === null
-                    ? "Checking permissions…"
-                    : "This connection does not have permission to manage the environment."}
+                {AsyncResult.isFailure(sessionResult) || session === null || !session.authenticated
+                  ? sessionPermissionsUnavailableMessage({
+                      connected,
+                      failed: AsyncResult.isFailure(sessionResult),
+                      rejected:
+                        !AsyncResult.isFailure(sessionResult) && session?.authenticated === false,
+                    })
+                  : "This connection does not have permission to manage the environment."}
               </Text>
             ) : null}
             {error ? (
diff --git a/apps/web/src/components/settings/SessionPermissions.tsx b/apps/web/src/components/settings/SessionPermissions.tsx
index 1cbff3d750cf3..30f61ddd80371 100644
--- a/apps/web/src/components/settings/SessionPermissions.tsx
+++ b/apps/web/src/components/settings/SessionPermissions.tsx
@@ -1,5 +1,8 @@
 import { type EnvironmentId, sessionGrantsScope } from "@t3tools/contracts";
-import { AUTH_SCOPE_OPTIONS } from "@t3tools/shared/authScopeOptions";
+import {
+  AUTH_SCOPE_OPTIONS,
+  sessionPermissionsUnavailableMessage,
+} from "@t3tools/shared/authScopeOptions";
 import { useEnvironmentSessionState } from "~/state/session";
 
 export function SessionPermissions({
@@ -32,7 +35,11 @@ export function SessionPermissions({
     </div>
   ) : (
     <p className="py-3 text-xs text-muted-foreground">
-      Permissions not checked. Connect to this environment to view this session’s permissions.
+      {sessionPermissionsUnavailableMessage({
+        connected,
+        failed: session.hasError,
+        rejected: !session.hasError && !session.isPending && session.data?.authenticated === false,
+      })}
     </p>
   );
 }
diff --git a/packages/client-runtime/src/state/session.test.ts b/packages/client-runtime/src/state/session.test.ts
new file mode 100644
index 0000000000000..740ab2229bdb4
--- /dev/null
+++ b/packages/client-runtime/src/state/session.test.ts
@@ -0,0 +1,133 @@
+import { describe, expect, it } from "@effect/vitest";
+import { EnvironmentId, type AuthSessionState } from "@t3tools/contracts";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Queue from "effect/Queue";
+import * as Stream from "effect/Stream";
+import * as SubscriptionRef from "effect/SubscriptionRef";
+import * as TestClock from "effect/testing/TestClock";
+import { AsyncResult, Atom, AtomRegistry } from "effect/reactivity";
+
+import {
+  AVAILABLE_CONNECTION_STATE,
+  PrimaryConnectionTarget,
+  type PreparedConnection,
+} from "../connection/model.ts";
+import * as EnvironmentRegistry from "../connection/registry.ts";
+import * as EnvironmentSupervisor from "../connection/supervisor.ts";
+import * as RpcHttp from "../rpc/http.ts";
+import type { RpcSession } from "../rpc/session.ts";
+import { createEnvironmentSessionAtoms } from "./session.ts";
+
+const TARGET = new PrimaryConnectionTarget({
+  environmentId: EnvironmentId.make("environment-1"),
+  label: "Test environment",
+  httpBaseUrl: "https://environment.example.test",
+  wsBaseUrl: "wss://environment.example.test",
+});
+const PREPARED: PreparedConnection = {
+  environmentId: TARGET.environmentId,
+  label: TARGET.label,
+  httpBaseUrl: "https://environment.example.test",
+  socketUrl: "wss://environment.example.test/ws",
+  httpAuthorization: { _tag: "Bearer", token: "bearer-token" },
+  target: TARGET,
+};
+const SESSION = {
+  authenticated: true,
+  auth: {
+    policy: "remote-reachable",
+    bootstrapMethods: [],
+    sessionMethods: [],
+    sessionCookieName: "t3_session",
+  },
+  scopes: ["orchestration:read"],
+} satisfies AuthSessionState;
+
+const rpcSession = (): RpcSession => ({ closed: Effect.never }) as unknown as RpcSession;
+
+const makeHarness = Effect.fn("TestSessionState.makeHarness")(function* (
+  reply: (requestNumber: number) => Promise<Response>,
+) {
+  let requestCount = 0;
+  const transport = yield* SubscriptionRef.make(Option.some(rpcSession()));
+  const supervisor = EnvironmentSupervisor.EnvironmentSupervisor.of({
+    target: TARGET,
+    state: yield* SubscriptionRef.make(AVAILABLE_CONNECTION_STATE),
+    session: transport,
+    prepared: yield* SubscriptionRef.make(Option.some(PREPARED)),
+    connect: Effect.void,
+    disconnect: Effect.void,
+    retryNow: Effect.void,
+  } satisfies EnvironmentSupervisor.EnvironmentSupervisor["Service"]);
+  const followStream: EnvironmentRegistry.EnvironmentRegistry["Service"]["followStream"] = (
+    _environmentId,
+    stream,
+  ) => Stream.provideService(stream, EnvironmentSupervisor.EnvironmentSupervisor, supervisor);
+  const runtime = Atom.runtime(
+    Layer.mergeAll(
+      Layer.succeed(
+        EnvironmentRegistry.EnvironmentRegistry,
+        EnvironmentRegistry.EnvironmentRegistry.of({
+          followStream,
+        } as unknown as EnvironmentRegistry.EnvironmentRegistry["Service"]),
+      ),
+      RpcHttp.layerRemoteHttpClient(async () => reply(++requestCount)),
+      // The test's clock, so the retry wait moves with `TestClock.adjust`.
+      Layer.succeed(Clock.Clock, yield* Clock.Clock),
+    ),
+  );
+  const registry = yield* Effect.acquireRelease(Effect.sync(AtomRegistry.make), (registry) =>
+    Effect.sync(() => registry.dispose()),
+  );
+  const results = yield* Queue.unbounded<AsyncResult.AsyncResult<AuthSessionState, unknown>>();
+  const atom = createEnvironmentSessionAtoms(runtime).sessionStateAtom(TARGET.environmentId);
+  const unsubscribe = registry.subscribe(atom, (result) => Queue.offerUnsafe(results, result), {
+    immediate: true,
+  });
+  yield* Effect.addFinalizer(() => Effect.sync(unsubscribe));
+  const nextSettled = Effect.fn("TestSessionState.nextSettled")(function* () {
+    for (;;) {
+      const result = yield* Queue.take(results);
+      if (!result.waiting && result._tag !== "Initial") return result;
+    }
+  });
+  return { transport, nextSettled };
+});
+
+const unreachable = () => Promise.reject(new TypeError("Network request failed"));
+
+describe("environment session state", () => {
+  it.effect("fetches permissions again when the connection is re-established", () =>
+    Effect.gen(function* () {
+      const harness = yield* makeHarness((requestNumber) =>
+        requestNumber === 1 ? unreachable() : Promise.resolve(Response.json(SESSION)),
+      );
+      expect((yield* harness.nextSettled())._tag).toBe("Failure");
+
+      yield* SubscriptionRef.set(harness.transport, Option.some(rpcSession()));
+
+      expect(yield* harness.nextSettled()).toMatchObject({ _tag: "Success", value: SESSION });
+    }),
+  );
+
+  it.effect("retries a failed permission check with backoff that restarts per connection", () =>
+    Effect.gen(function* () {
+      const harness = yield* makeHarness((requestNumber) =>
+        requestNumber <= 3 ? unreachable() : Promise.resolve(Response.json(SESSION)),
+      );
+      expect((yield* harness.nextSettled())._tag).toBe("Failure");
+
+      yield* TestClock.adjust("2 seconds");
+      expect((yield* harness.nextSettled())._tag).toBe("Failure");
+
+      yield* SubscriptionRef.set(harness.transport, Option.some(rpcSession()));
+      expect((yield* harness.nextSettled())._tag).toBe("Failure");
+
+      yield* TestClock.adjust("2 seconds");
+      expect(yield* harness.nextSettled()).toMatchObject({ _tag: "Success", value: SESSION });
+    }),
+  );
+});
diff --git a/packages/client-runtime/src/state/session.ts b/packages/client-runtime/src/state/session.ts
index efdf0b37c0a09..90afa29f9d05d 100644
--- a/packages/client-runtime/src/state/session.ts
+++ b/packages/client-runtime/src/state/session.ts
@@ -14,6 +14,7 @@ import type { PreparedConnection } from "../connection/model.ts";
 import * as EnvironmentSupervisor from "../connection/supervisor.ts";
 import * as ManagedRelay from "../relay/managedRelay.ts";
 import type { RemoteEnvironmentRequestError } from "../rpc/http.ts";
+import type { RpcSession } from "../rpc/session.ts";
 import { safeErrorLogAttributes } from "../errors/safeLog.ts";
 import { executeAuthenticatedEnvironmentHttpRequest } from "./environmentHttpAuth.ts";
 import { followStreamInEnvironment } from "./environmentStreams.ts";
@@ -39,6 +40,8 @@ function initialConfigOption<E>(
 
 const DEFAULT_SESSION_STATE_TIMEOUT_MS = 6_000;
 const MAX_SESSION_STATE_TIMEOUT_MS = 60_000;
+const SESSION_STATE_RETRY_BASE_MS = 2_000;
+const SESSION_STATE_RETRY_MAX_MS = 60_000;
 
 export const fetchEnvironmentSessionState = Effect.fn(
   "clientRuntime.state.fetchEnvironmentSessionState",
@@ -136,13 +139,38 @@ function makeEnvironmentSessionAtoms<R, E>(
     ).pipe(Atom.withLabel(`environment-prepared-connection:${environmentId}`)),
   );
 
-  const sessionStateAtom = Atom.family((environmentId: EnvironmentId) =>
-    runtime
+  const transportSessionAtom = Atom.family((environmentId: EnvironmentId) =>
+    runtime.atom(
+      followStreamInEnvironment(
+        environmentId,
+        Stream.unwrap(
+          EnvironmentSupervisor.EnvironmentSupervisor.pipe(
+            Effect.map((supervisor) => SubscriptionRef.changes(supervisor.session)),
+          ),
+        ),
+      ),
+      { initialValue: Option.none() },
+    ),
+  );
+
+  const sessionStateAtom = Atom.family((environmentId: EnvironmentId) => {
+    let consecutiveFailures = 0;
+    let backoffConnection: RpcSession | null = null;
+    return runtime
       .atom((get) => {
         const prepared = Option.getOrNull(get(preparedConnectionValueAtom(environmentId)));
-        if (prepared === null) {
+        // Each established connection fetches anew, and a failure retries while it stays up,
+        // so a fetch that failed mid-reconnect cannot outlive the socket that recovered.
+        const connection = AsyncResult.getOrElse(get(transportSessionAtom(environmentId)), () =>
+          Option.none(),
+        );
+        if (prepared === null || Option.isNone(connection)) {
           return Effect.never;
         }
+        if (connection.value !== backoffConnection) {
+          backoffConnection = connection.value;
+          consecutiveFailures = 0;
+        }
         return Effect.gen(function* () {
           const signer = yield* Effect.serviceOption(ManagedRelay.ManagedRelayDpopSigner);
           const remoteAuthorization = yield* Effect.serviceOption(
@@ -155,14 +183,31 @@ function makeEnvironmentSessionAtoms<R, E>(
             signer,
             remoteAuthorization,
           }).pipe(Effect.provideService(HttpClient.HttpClient, client.value));
-        });
+        }).pipe(
+          Effect.tap(() =>
+            Effect.sync(() => {
+              consecutiveFailures = 0;
+            }),
+          ),
+          Effect.tapError(() => {
+            const delayMs = Math.min(
+              SESSION_STATE_RETRY_BASE_MS * 2 ** consecutiveFailures,
+              SESSION_STATE_RETRY_MAX_MS,
+            );
+            consecutiveFailures += 1;
+            return Effect.sleep(delayMs).pipe(
+              Effect.andThen(Effect.sync(() => get.refreshSelf())),
+              Effect.forkScoped,
+            );
+          }),
+        );
       })
       .pipe(
         Atom.swr({ staleTime: 30_000, revalidateOnMount: true }),
         Atom.setIdleTTL(5 * 60_000),
         Atom.withLabel(`environment-session-state:${environmentId}`),
-      ),
-  );
+      );
+  });
 
   const sessionStateValueAtom = Atom.family((environmentId: EnvironmentId) =>
     Atom.make(
diff --git a/packages/shared/src/authScopeOptions.ts b/packages/shared/src/authScopeOptions.ts
index d443e50326d28..9a2261a09f3e9 100644
--- a/packages/shared/src/authScopeOptions.ts
+++ b/packages/shared/src/authScopeOptions.ts
@@ -104,3 +104,19 @@ export const AUTH_SCOPE_OPTIONS: ReadonlyArray<{
     description: "Change managed tunnel connectivity.",
   },
 ];
+
+/** Shown instead of the granted scopes while they are unknown, so every surface says the same thing. */
+export function sessionPermissionsUnavailableMessage(input: {
+  readonly connected: boolean;
+  /** The check errored; the client retries it while connected. */
+  readonly failed: boolean;
+  /** The environment answered that this session is not signed in; retrying will not change that. */
+  readonly rejected: boolean;
+}): string {
+  if (!input.connected) return "Connect to this environment to view this session’s permissions.";
+  if (input.rejected)
+    return "This environment did not accept your session. Reconnect to try again.";
+  return input.failed
+    ? "Could not verify your permissions. Retrying automatically."
+    : "Checking permissions…";
+}

From da04ebc5087477a82deae9ce19c03539a627359f Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:06:51 -0700
Subject: [PATCH 100/146] fix(mobile): tab bar spans the screen on iOS before
 26 (#27089)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../workspace/WorkspaceNativeTabs.ios.tsx        | 16 ++++++++++------
 .../features/workspace/WorkspaceToolbar.ios.tsx  | 10 +++++-----
 .../workspace/useSystemWorkspaceTabBar.ts        | 13 +++++++++++++
 3 files changed, 28 insertions(+), 11 deletions(-)

diff --git a/apps/mobile/src/features/workspace/WorkspaceNativeTabs.ios.tsx b/apps/mobile/src/features/workspace/WorkspaceNativeTabs.ios.tsx
index 929660587d731..e93175677fc02 100644
--- a/apps/mobile/src/features/workspace/WorkspaceNativeTabs.ios.tsx
+++ b/apps/mobile/src/features/workspace/WorkspaceNativeTabs.ios.tsx
@@ -18,7 +18,11 @@ import {
   NativeWorkspaceTabActivityContext,
   WorkspaceSlotOptionsContext,
 } from "../../native/v5-workspace-context";
-import { useCompactWorkspaceTabs, useSystemWorkspaceTabBar } from "./useSystemWorkspaceTabBar";
+import {
+  useCompactWorkspaceTabs,
+  useFloatingWorkspaceTabs,
+  useSystemWorkspaceTabBar,
+} from "./useSystemWorkspaceTabBar";
 import { useControlTheme } from "../../components/ui/useControlTheme";
 import { useDeviceType } from "../../native/native-layout-metrics";
 import { WorkspaceSidebarTabs } from "./WorkspaceSidebarTabs";
@@ -80,7 +84,7 @@ export function WorkspaceNativeTabs(props: {
   const deviceType = useDeviceType();
   const compactTabs = useCompactWorkspaceTabs();
   const { layout, startNewTask } = useAdaptiveWorkspaceLayout();
-  const compactSidebarTabs = deviceType === "phone" || !layout.usesSplitView;
+  const floatingTabs = useFloatingWorkspaceTabs();
   const { width } = useWindowDimensions();
   const { colors } = useControlTheme();
   const selectedTab = workspace.state.selectedTab;
@@ -158,17 +162,17 @@ export function WorkspaceNativeTabs(props: {
             bottom: 0,
             // UIKit can shrink the sidebar to 280pt independently of its preferred width.
             width:
-              deviceType === "pad"
+              deviceType === "pad" && (floatingTabs || layout.usesSplitView)
                 ? Math.min(280, layout.listPaneWidth ?? width, width)
                 : (layout.listPaneWidth ?? width),
             height: 128,
           }}
         >
           <WorkspaceSidebarTabs
-            compact={compactSidebarTabs}
-            reserveComposeSpace={compactSidebarTabs}
+            compact={floatingTabs}
+            reserveComposeSpace={floatingTabs}
             onNewTask={
-              compactSidebarTabs && !workspace.settingsOpen && selectedTab === "threads"
+              floatingTabs && !workspace.settingsOpen && selectedTab === "threads"
                 ? startNewTask
                 : undefined
             }
diff --git a/apps/mobile/src/features/workspace/WorkspaceToolbar.ios.tsx b/apps/mobile/src/features/workspace/WorkspaceToolbar.ios.tsx
index b9ae95cd52c0c..57b8dd69965d2 100644
--- a/apps/mobile/src/features/workspace/WorkspaceToolbar.ios.tsx
+++ b/apps/mobile/src/features/workspace/WorkspaceToolbar.ios.tsx
@@ -16,7 +16,7 @@ import {
 import { useHardwareKeyboardCommand } from "../keyboard/hardwareKeyboardCommands";
 import { useAdaptiveWorkspaceLayout } from "../layout/AdaptiveWorkspaceLayout";
 import { useWorkspaceTabs } from "./WorkspaceTabsContext";
-import { useCompactWorkspaceTabs, useSidebarWorkspaceTabs } from "./useSystemWorkspaceTabBar";
+import { useFloatingWorkspaceTabs, useSidebarWorkspaceTabs } from "./useSystemWorkspaceTabBar";
 import { WorkspaceTabToolbarButtons } from "./WorkspaceSectionToolbar";
 
 const SEARCH_LABELS = {
@@ -33,7 +33,7 @@ export function WorkspaceToolbar(props: {
   const activeNewTask = useActiveNewTask();
   const deviceType = useDeviceType();
   const sidebarTabs = useSidebarWorkspaceTabs();
-  const compactTabs = useCompactWorkspaceTabs();
+  const floatingTabs = useFloatingWorkspaceTabs();
   const duoSearch = NATIVE_LIQUID_GLASS_SUPPORTED && isDuoDevice(deviceType);
   const bottomSearch = duoSearch && sidebarTabs !== "picker";
   // On the Duo, compose belongs to the threads tab, in the detail column's bar when unfolded.
@@ -45,7 +45,7 @@ export function WorkspaceToolbar(props: {
     activeNewTask === null;
   const tabActive = use(NativeWorkspaceTabActivityContext)?.active ?? true;
   const focused = useIsFocused();
-  const { panes, togglePrimarySidebar } = useAdaptiveWorkspaceLayout();
+  const { layout, panes, togglePrimarySidebar } = useAdaptiveWorkspaceLayout();
   const searchRef = useRef<SearchBarCommands>(null);
   // The Settings list takes the selected tab's place, so search follows it.
   const selectedTab = workspace.settingsOpen ? "settings" : workspace.state.selectedTab;
@@ -189,9 +189,9 @@ export function WorkspaceToolbar(props: {
           {composeButton}
           {selectedTab !== "threads" ||
           isDuoDevice(deviceType) ||
-          deviceType === "pad" ||
+          (deviceType === "pad" && layout.usesSplitView) ||
           sidebarTabs === "picker" ||
-          compactTabs ? null : (
+          floatingTabs ? null : (
             <Toolbar.Button
               accessibilityLabel="New chat"
               icon="square.and.pencil"
diff --git a/apps/mobile/src/features/workspace/useSystemWorkspaceTabBar.ts b/apps/mobile/src/features/workspace/useSystemWorkspaceTabBar.ts
index f91723d86b304..5aa714eb6dcbd 100644
--- a/apps/mobile/src/features/workspace/useSystemWorkspaceTabBar.ts
+++ b/apps/mobile/src/features/workspace/useSystemWorkspaceTabBar.ts
@@ -1,5 +1,6 @@
 import { isDuoDevice } from "../../lib/device-type";
 import { Platform } from "react-native";
+import { NATIVE_LIQUID_GLASS_SUPPORTED } from "../../native/native-glass";
 import { useAdaptiveWorkspaceLayout } from "../layout/adaptive-workspace-context";
 import { useDeviceType, useNativeLayoutMetrics } from "../../native/native-layout-metrics";
 import { useWorkspaceTabs } from "./WorkspaceTabsContext";
@@ -37,6 +38,18 @@ export function useCompactWorkspaceTabs() {
   );
 }
 
+/** The workspace tab bar floats with compose beside it. Before iOS 26 UITabBar is opaque and
+ * full width, so it sits flush and compose stays in the header. */
+export function useFloatingWorkspaceTabs() {
+  const { layout } = useAdaptiveWorkspaceLayout();
+  const deviceType = useDeviceType();
+  const compactTabs = useCompactWorkspaceTabs();
+  return (
+    NATIVE_LIQUID_GLASS_SUPPORTED &&
+    (compactTabs || (deviceType === "pad" && !layout.usesSplitView))
+  );
+}
+
 export function useSystemWorkspaceTabBar() {
   const deviceType = useDeviceType();
   const { layout } = useAdaptiveWorkspaceLayout();

From 624e70ecdd48c388c324e18eaa170dd62319cb28 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:17:45 -0700
Subject: [PATCH 101/146] perf(server): thread recovery reads are 10x faster
 (#27099)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/ProjectionStore.test.ts  | 15 ++++++++++++++-
 apps/server/src/persistence/Migrations.ts     |  2 ++
 .../Migrations/073_ActiveTurnItemIndexes.ts   | 19 +++++++++++++++++++
 .../reconcileV2PreviewMigration.test.ts       |  2 ++
 4 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 apps/server/src/persistence/Migrations/073_ActiveTurnItemIndexes.ts

diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index 17b8bb818864a..8d46b51031506 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -6640,10 +6640,23 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
           completedAt: releasedAt,
         },
       });
+      const { statements, tracer } = traceSqlStatements();
       assert.deepEqual(
-        (yield* store.getRuntimeRecoveryProjection(threadId)).runs.map((run) => run.id),
+        (yield* store
+          .getRuntimeRecoveryProjection(threadId)
+          .pipe(Effect.withTracer(tracer))).runs.map((run) => run.id),
         [runId, newerRunId],
       );
+      // Live-item filters must hit the active partial indexes, not walk the thread's history.
+      const sql = yield* SqlClient.SqlClient;
+      for (const statement of statements.filter((query) => query.includes("turn_items"))) {
+        const plan = (yield* sql.unsafe<{ readonly detail: string }>(
+          `EXPLAIN QUERY PLAN ${statement}`,
+        )).map((row) => row.detail);
+        for (const detail of plan) {
+          assert.notMatch(detail, /turn_items_(thread_ordinal|thread_run)_idx \(thread_id=\?\)$/);
+        }
+      }
     }),
   );
 });
diff --git a/apps/server/src/persistence/Migrations.ts b/apps/server/src/persistence/Migrations.ts
index cc395406eb502..8143a86b15034 100644
--- a/apps/server/src/persistence/Migrations.ts
+++ b/apps/server/src/persistence/Migrations.ts
@@ -75,6 +75,7 @@ import Migration0069 from "./Migrations/069_ThreadMessageSearch.ts";
 import Migration0070 from "./Migrations/070_PeerLinks.ts";
 import Migration0071 from "./Migrations/071_PeerLinkFence.ts";
 import Migration0072 from "./Migrations/072_WaitingLinkRequestIndex.ts";
+import Migration0073 from "./Migrations/073_ActiveTurnItemIndexes.ts";
 
 const migrationEntries = [
   [1, "OrchestrationEvents", Migration0001],
@@ -150,6 +151,7 @@ const migrationEntries = [
   [70, "PeerLinks", Migration0070],
   [71, "PeerLinkFence", Migration0071],
   [72, "WaitingLinkRequestIndex", Migration0072],
+  [73, "ActiveTurnItemIndexes", Migration0073],
 ] as const;
 
 export const migrationManifest = migrationEntries.map(([id, name]) => [id, name] as const);
diff --git a/apps/server/src/persistence/Migrations/073_ActiveTurnItemIndexes.ts b/apps/server/src/persistence/Migrations/073_ActiveTurnItemIndexes.ts
new file mode 100644
index 0000000000000..d9759bca6d82a
--- /dev/null
+++ b/apps/server/src/persistence/Migrations/073_ActiveTurnItemIndexes.ts
@@ -0,0 +1,19 @@
+import * as Effect from "effect/Effect";
+import * as SqlClient from "effect/sql/SqlClient";
+
+export default Effect.gen(function* () {
+  const sql = yield* SqlClient.SqlClient;
+
+  // Recovery and provider-thread reads filter live items by this exact predicate; without
+  // these, each read walked every historical item in the thread.
+  yield* sql`
+    CREATE INDEX orchestration_v2_projection_turn_items_active_ordinal_idx
+    ON orchestration_v2_projection_turn_items(thread_id, ordinal, turn_item_id)
+    WHERE status IN ('pending', 'running', 'waiting')
+  `;
+  yield* sql`
+    CREATE INDEX orchestration_v2_projection_turn_items_active_run_idx
+    ON orchestration_v2_projection_turn_items(thread_id, run_id)
+    WHERE status IN ('pending', 'running', 'waiting')
+  `;
+});
diff --git a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
index 91e40578091a7..c08062c09d1ad 100644
--- a/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
+++ b/apps/server/src/persistence/reconcileV2PreviewMigration.test.ts
@@ -52,6 +52,7 @@ describe("V2 preview upgrade", () => {
         [70, "PeerLinks"],
         [71, "PeerLinkFence"],
         [72, "WaitingLinkRequestIndex"],
+        [73, "ActiveTurnItemIndexes"],
       ]);
       assert.deepStrictEqual(yield* runMigrations(), []);
       assert.deepStrictEqual(yield* sql`SELECT * FROM orchestration_v2_legacy_imports`, imports);
@@ -147,6 +148,7 @@ describe("V2 preview upgrade", () => {
         [70, "PeerLinks"],
         [71, "PeerLinkFence"],
         [72, "WaitingLinkRequestIndex"],
+        [73, "ActiveTurnItemIndexes"],
       ]);
     }).pipe(Effect.provide(NodeSqliteClient.layer({ filename: ":memory:" }))),
   );

From 3898c3298617e8a12177dbc8cd1ad681c96e3fac Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:17:50 -0700
Subject: [PATCH 102/146] perf(server): source control discovery no longer
 stalls up to 10s on Bitbucket (#27102)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../SourceControlProviderRegistry.test.ts     | 32 +++++++++-
 .../src/server/BitbucketApi.test.ts           |  3 +-
 .../src/server/BitbucketApi.ts                | 31 ++++++----
 .../src/server/discovery.ts                   | 60 ++++++++++---------
 4 files changed, 85 insertions(+), 41 deletions(-)

diff --git a/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts b/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
index 249bc07b3ad3f..05b6a1a8d0e42 100644
--- a/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
+++ b/apps/server/src/sourceControl/SourceControlProviderRegistry.test.ts
@@ -118,7 +118,12 @@ function makeRegistry(input: {
         kind: provider.kind,
         label: provider.kind,
         installHint: "unused",
-        probeAuth: Effect.die("unused"),
+        probeAuth: Effect.succeed({
+          status: "unknown",
+          account: Option.none(),
+          host: Option.none(),
+          detail: Option.none(),
+        }),
       },
     })),
   ).pipe(
@@ -440,3 +445,28 @@ it.effect("asks again once Settings change", () =>
     assert.strictEqual((yield* resolveUnknown(registry, "c")).provider.kind, "github");
   }),
 );
+
+it.effect("answers discovery without waiting on a hosting API that stalls", () =>
+  Effect.gen(function* () {
+    const registry = yield* makeRegistry({
+      remotes: [],
+      discovery: [
+        claimingCli("gitlab"),
+        {
+          type: "api",
+          kind: kind("bitbucket"),
+          label: "Bitbucket",
+          installHint: "unused",
+          probeAuth: Effect.never,
+        },
+      ],
+    });
+    const discovering = yield* registry.discover.pipe(Effect.forkChild);
+    yield* TestClock.adjust("3 seconds");
+    const items = yield* Fiber.join(discovering);
+    const bitbucket = items.find((item) => item.kind === "bitbucket");
+    assert.strictEqual(bitbucket?.status, "available");
+    assert.strictEqual(bitbucket?.auth.status, "unknown");
+    assert.strictEqual(items.find((item) => item.kind === "gitlab")?.status, "available");
+  }),
+);
diff --git a/packages/source-control-bitbucket/src/server/BitbucketApi.test.ts b/packages/source-control-bitbucket/src/server/BitbucketApi.test.ts
index 26891c3548974..c0464276abf24 100644
--- a/packages/source-control-bitbucket/src/server/BitbucketApi.test.ts
+++ b/packages/source-control-bitbucket/src/server/BitbucketApi.test.ts
@@ -513,7 +513,7 @@ it.effect("never puts a saved token that is unsafe for an HTTP header on the wir
 });
 
 it.effect("reports saved credentials as configured when Bitbucket cannot confirm them", () => {
-  const { layer } = makeLayer({
+  const { execute, layer } = makeLayer({
     response: () => new Response(null, { status: 401 }),
     env: { T3CODE_BITBUCKET_API_BASE_URL: "https://api.test.local/2.0" },
   });
@@ -523,6 +523,7 @@ it.effect("reports saved credentials as configured when Bitbucket cannot confirm
     const settings = yield* TestSourceControlHost.TestSourceControlHostSettings;
 
     assert.strictEqual((yield* bitbucket.probeAuth).status, "unauthenticated");
+    assert.strictEqual(execute.mock.calls.length, 0);
 
     yield* settings.update({
       sourceControlHosts: { bitbucket: { accessToken: "saved-access-token" } },
diff --git a/packages/source-control-bitbucket/src/server/BitbucketApi.ts b/packages/source-control-bitbucket/src/server/BitbucketApi.ts
index 72077040aa870..863b206d95578 100644
--- a/packages/source-control-bitbucket/src/server/BitbucketApi.ts
+++ b/packages/source-control-bitbucket/src/server/BitbucketApi.ts
@@ -986,18 +986,25 @@ export const make = Effect.gen(function* () {
 
   return BitbucketApi.of({
     request,
-    probeAuth: executeJson(
-      "probeAuth",
-      HttpClientRequest.get(apiUrl("/user")),
-      BitbucketUserSchema,
-    ).pipe(
-      Effect.map((user) => ({
-        status: "authenticated" as const,
-        account: nonEmpty(user.username ?? user.display_name ?? user.account_id),
-        host: Option.some("bitbucket.org"),
-        detail: Option.none<string>(),
-      })),
-      Effect.catch(() => currentCredential.pipe(Effect.map(authFromCredential))),
+    // Bitbucket answers anonymous /user with 401, so without a credential there is nothing to ask.
+    probeAuth: currentCredential.pipe(
+      Effect.flatMap((credential) =>
+        credential === null
+          ? Effect.succeed(authFromCredential(null))
+          : executeJson(
+              "probeAuth",
+              HttpClientRequest.get(apiUrl("/user")),
+              BitbucketUserSchema,
+            ).pipe(
+              Effect.map((user) => ({
+                status: "authenticated" as const,
+                account: nonEmpty(user.username ?? user.display_name ?? user.account_id),
+                host: Option.some("bitbucket.org"),
+                detail: Option.none<string>(),
+              })),
+              Effect.catch(() => currentCredential.pipe(Effect.map(authFromCredential))),
+            ),
+      ),
     ),
     listPullRequests: Effect.fn("BitbucketApi.listPullRequests")(function (input) {
       return resolveRepository(input).pipe(
diff --git a/packages/source-control-core/src/server/discovery.ts b/packages/source-control-core/src/server/discovery.ts
index 66889ddc4f2ab..2f018bfa10ca3 100644
--- a/packages/source-control-core/src/server/discovery.ts
+++ b/packages/source-control-core/src/server/discovery.ts
@@ -75,6 +75,8 @@ type SourceControlCliRemoteRefinementSpec = SourceControlCliDiscoverySpec & {
 };
 
 const DEFAULT_PROBE_TIMEOUT_MS = 5_000;
+/** An API host that stalls must not hold the whole discovery answer behind it. */
+const API_PROBE_TIMEOUT = "3 seconds";
 
 function probeTimeoutMs(spec: SourceControlCliDiscoverySpec): number {
   return spec.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
@@ -236,6 +238,12 @@ export function probeSourceControlProvider(input: {
   if (input.spec.type === "managed-cli") return input.spec.probe(input.cwd);
   if (input.spec.type === "api") {
     return input.spec.probeAuth.pipe(
+      Effect.timeoutOption(API_PROBE_TIMEOUT),
+      Effect.map(
+        Option.getOrElse(() =>
+          unknownAuth("The hosting service did not answer in time. Refresh to try again."),
+        ),
+      ),
       Effect.map(
         (auth) =>
           ({
@@ -253,20 +261,15 @@ export function probeSourceControlProvider(input: {
 
   const spec = input.spec;
 
-  return probeCli({
-    spec,
-    process: input.process,
-    cwd: input.cwd,
-  }).pipe(
-    Effect.flatMap((item) => {
-      if (item.status !== "available") {
-        return Effect.succeed({
-          ...item,
-          auth: unknownAuth("Hosting integration command was not found on the server PATH."),
-        } satisfies SourceControlProviderDiscoveryItem);
-      }
-
-      return input.process
+  // The auth check does not depend on the version output, so both spawn at once.
+  return Effect.all(
+    [
+      probeCli({
+        spec,
+        process: input.process,
+        cwd: input.cwd,
+      }),
+      input.process
         .run({
           operation: "source-control.discovery.auth",
           command: spec.executable,
@@ -278,21 +281,24 @@ export function probeSourceControlProvider(input: {
           appendTruncationMarker: true,
         })
         .pipe(
-          Effect.map(
-            (result) =>
-              ({
-                ...item,
-                auth: spec.parseAuth(result),
-              }) satisfies SourceControlProviderDiscoveryItem,
-          ),
+          Effect.map(spec.parseAuth),
           Effect.catch((cause) =>
-            Effect.succeed({
-              ...item,
-              auth: unknownAuth(Option.getOrUndefined(detailFromCause(cause))),
-            } satisfies SourceControlProviderDiscoveryItem),
+            Effect.succeed(unknownAuth(Option.getOrUndefined(detailFromCause(cause)))),
           ),
-        );
-    }),
+        ),
+    ],
+    { concurrency: "unbounded" },
+  ).pipe(
+    Effect.map(
+      ([item, auth]) =>
+        ({
+          ...item,
+          auth:
+            item.status === "available"
+              ? auth
+              : unknownAuth("Hosting integration command was not found on the server PATH."),
+        }) satisfies SourceControlProviderDiscoveryItem,
+    ),
   );
 }
 

From 7f39a860d9775e1c5e7cf9c0655d719d966f64f6 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:17:55 -0700
Subject: [PATCH 103/146] perf: huge checkpoints ship up to 75x smaller to
 clients (#27110)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mobile/src/features/review/reviewModel.ts |  7 ++-
 .../src/orchestration-v2/ThreadStream.ts      | 10 ++--
 .../orchestration-v2/WireProjection.test.ts   | 43 ++++++++++++++
 .../src/orchestration-v2/WireProjection.ts    | 58 ++++++++++++++++++-
 apps/web/src/components/ChatView.logic.ts     | 10 ++--
 .../src/components/chat/ChangedFilesTree.tsx  | 34 +++++++----
 .../components/chat/TimelineAssistantRows.tsx |  2 +
 apps/web/src/lib/turnDiffTree.ts              | 14 -----
 .../src/state/threadCheckpoints.ts            | 17 ++++++
 packages/contracts/src/orchestrationV2.ts     | 10 ++++
 10 files changed, 167 insertions(+), 38 deletions(-)

diff --git a/apps/mobile/src/features/review/reviewModel.ts b/apps/mobile/src/features/review/reviewModel.ts
index bc0e23b336582..1b2131c73e0c1 100644
--- a/apps/mobile/src/features/review/reviewModel.ts
+++ b/apps/mobile/src/features/review/reviewModel.ts
@@ -1,6 +1,9 @@
 import { parsePatchFiles } from "@pierre/diffs/utils/parsePatchFiles";
 import type { ChangeTypes, FileDiffMetadata } from "@pierre/diffs/types";
-import type { ThreadCheckpointSummary } from "@t3tools/client-runtime/state/thread-checkpoints";
+import {
+  checkpointFileTotals,
+  type ThreadCheckpointSummary,
+} from "@t3tools/client-runtime/state/thread-checkpoints";
 import type { ReviewDiffPreviewSource } from "@t3tools/contracts";
 import { quoteGitPatchPath } from "@t3tools/shared/gitPatchPath";
 import * as Arr from "effect/Array";
@@ -107,7 +110,7 @@ function checkpointTitle(checkpoint: ThreadCheckpointSummary): string {
 }
 
 function checkpointSubtitle(checkpoint: ThreadCheckpointSummary): string {
-  const fileCount = checkpoint.files.length;
+  const fileCount = checkpointFileTotals(checkpoint).count;
   if (checkpoint.status !== "ready") {
     return `Diff ${checkpoint.status}`;
   }
diff --git a/apps/server/src/orchestration-v2/ThreadStream.ts b/apps/server/src/orchestration-v2/ThreadStream.ts
index 3c4baab80ef07..80ee5c32d6152 100644
--- a/apps/server/src/orchestration-v2/ThreadStream.ts
+++ b/apps/server/src/orchestration-v2/ThreadStream.ts
@@ -10,7 +10,10 @@ import {
   buildBoundedThreadProjection,
   type BoundedProjectionResult,
 } from "./threadHistoryPaging.ts";
-import { projectThreadProjectionForWire } from "./WireProjection.ts";
+import {
+  capProjectionCheckpointFilesForWire,
+  projectThreadProjectionForWire,
+} from "./WireProjection.ts";
 
 export const THREAD_RESUME_MAX_REPLAY_EVENTS = 128;
 
@@ -44,10 +47,9 @@ export function boundedSnapshotResponseFields(input: {
   readonly compactIds: boolean;
 }) {
   const { bounded } = input;
+  const capped = capProjectionCheckpointFilesForWire(bounded.projection);
   // Dedupe keeps shared items one object, which the compaction's identity check needs.
-  const projection = input.dedupeBodies
-    ? dedupeSnapshotBodies(bounded.projection)
-    : bounded.projection;
+  const projection = input.dedupeBodies ? dedupeSnapshotBodies(capped) : capped;
   const compactProjection = input.compactTurnItems ? omitLocalVisibleTurnItems(projection) : null;
   return {
     projection: compactProjection ?? projection,
diff --git a/apps/server/src/orchestration-v2/WireProjection.test.ts b/apps/server/src/orchestration-v2/WireProjection.test.ts
index d449aeb933dbf..0d63d832f0ca9 100644
--- a/apps/server/src/orchestration-v2/WireProjection.test.ts
+++ b/apps/server/src/orchestration-v2/WireProjection.test.ts
@@ -1,4 +1,7 @@
 import {
+  CheckpointId,
+  CheckpointRef,
+  CheckpointScopeId,
   MessageId,
   ContextHandoffId,
   ProviderThreadId,
@@ -381,6 +384,46 @@ describe("live body deduper", () => {
     ]);
   });
 
+  it("caps a large checkpoint's files for the wire and still dedupes its item", () => {
+    const files = Array.from({ length: 250 }, (_, index) => ({
+      path: `vendor/file-${index}.ts`,
+      kind: "modified",
+      additions: 2,
+      deletions: 1,
+    }));
+    const checkpointId = CheckpointId.make("checkpoint-large");
+    const scopeId = CheckpointScopeId.make("scope-large");
+    const captured = event(1, {
+      type: "checkpoint.captured",
+      payload: {
+        id: checkpointId,
+        threadId: base.threadId,
+        scopeId,
+        runId: null,
+        nodeId: NodeId.make("node-large"),
+        parentCheckpointId: null,
+        ordinalWithinScope: 1,
+        appRunOrdinal: null,
+        ref: CheckpointRef.make("refs/t3/checkpoints/large"),
+        status: "ready",
+        files,
+        capturedAt: at,
+      },
+    });
+    const item = event(2, {
+      type: "turn-item.updated",
+      payload: { ...base, type: "checkpoint", checkpointId, scopeId, files },
+    });
+    const dedupe = makeLiveBodyDeduper();
+    const [record, card] = [captured, item].map((streamed) =>
+      dedupe({ ...streamed, event: projectDomainEventForWire(streamed.event) }),
+    );
+
+    const filesTotal = { count: 250, additions: 500, deletions: 250 };
+    expect(payloadOf(record!)).toMatchObject({ files: files.slice(0, 200), filesTotal });
+    expect(payloadOf(card!)).toMatchObject({ files: [], filesOmitted: true, filesTotal });
+  });
+
   it("ships a reply whole when its message arrives after it", () => {
     const first = reply(1, "a");
     expect([first, message(2, "a")].map(makeLiveBodyDeduper())[0]).toBe(first);
diff --git a/apps/server/src/orchestration-v2/WireProjection.ts b/apps/server/src/orchestration-v2/WireProjection.ts
index 6b66f1b91f204..2181b7feec5fa 100644
--- a/apps/server/src/orchestration-v2/WireProjection.ts
+++ b/apps/server/src/orchestration-v2/WireProjection.ts
@@ -21,6 +21,8 @@ import {
   toolOutputIndicatesFailure,
 } from "@t3tools/shared/toolOutput";
 
+// A checkpoint over vendored or generated trees can list 15k+ files; the card needs a prefix.
+const MAX_WIRE_CHECKPOINT_FILES = 200;
 const MAX_DETAIL_STRING_BYTES = 32_768;
 const MAX_DYNAMIC_VALUE_BYTES = 16_384;
 const MAX_ON_DEMAND_BYTES = 256 * 1024;
@@ -96,8 +98,59 @@ function summarizeDynamicValue(value: unknown): unknown {
   };
 }
 
+type CheckpointFiles = Pick<OrchestrationV2Checkpoint, "files" | "filesTotal">;
+
+// Same input, same output object: snapshot compaction relies on shared item identity.
+const cappedCheckpointFiles = new WeakMap<object, object>();
+
+function capCheckpointFiles<T extends CheckpointFiles>(value: T): T {
+  if (value.files.length <= MAX_WIRE_CHECKPOINT_FILES || value.filesTotal !== undefined) {
+    return value;
+  }
+  const cached = cappedCheckpointFiles.get(value);
+  if (cached !== undefined) return cached as T;
+  let additions = 0;
+  let deletions = 0;
+  for (const file of value.files) {
+    additions += file.additions;
+    deletions += file.deletions;
+  }
+  const capped = {
+    ...value,
+    files: value.files.slice(0, MAX_WIRE_CHECKPOINT_FILES),
+    filesTotal: { count: value.files.length, additions, deletions },
+  };
+  cappedCheckpointFiles.set(value, capped);
+  return capped;
+}
+
+/** Idempotent; bounded snapshots that skip `projectThreadProjectionForWire` still need it. */
+export function capProjectionCheckpointFilesForWire(
+  projection: OrchestrationV2ThreadProjection,
+): OrchestrationV2ThreadProjection {
+  const checkpoints = projection.checkpoints.map(capCheckpointFiles);
+  const turnItems = projection.turnItems.map(capCheckpointItemFiles);
+  const visibleTurnItems = projection.visibleTurnItems.map((row) => {
+    const item = capCheckpointItemFiles(row.item);
+    return item === row.item ? row : { ...row, item };
+  });
+  const unchanged = (next: ReadonlyArray<unknown>, previous: ReadonlyArray<unknown>) =>
+    next.every((value, index) => value === previous[index]);
+  return unchanged(checkpoints, projection.checkpoints) &&
+    unchanged(turnItems, projection.turnItems) &&
+    unchanged(visibleTurnItems, projection.visibleTurnItems)
+    ? projection
+    : { ...projection, checkpoints, turnItems, visibleTurnItems };
+}
+
+function capCheckpointItemFiles(item: OrchestrationV2TurnItem): OrchestrationV2TurnItem {
+  return item.type === "checkpoint" ? capCheckpointFiles(item) : item;
+}
+
 export function projectTurnItemForWire(item: OrchestrationV2TurnItem): OrchestrationV2TurnItem {
   switch (item.type) {
+    case "checkpoint":
+      return capCheckpointFiles(item);
     case "handoff": {
       const { summary: _summary, ...projected } = item;
       return projected;
@@ -241,6 +294,7 @@ export function projectThreadProjectionForWire(
   };
   return {
     ...projection,
+    checkpoints: projection.checkpoints.map(capCheckpointFiles),
     contextHandoffs: projection.contextHandoffs.map(projectContextHandoffForWire),
     turnItems: projection.turnItems.map(project),
     visibleTurnItems: projection.visibleTurnItems.map((row) => ({
@@ -257,7 +311,9 @@ export function projectDomainEventForWire(
     ? { ...event, payload: projectTurnItemForWire(event.payload) }
     : event.type === "context-handoff.updated"
       ? { ...event, payload: projectContextHandoffForWire(event.payload) }
-      : event;
+      : event.type === "checkpoint.captured"
+        ? { ...event, payload: capCheckpointFiles(event.payload) }
+        : event;
 }
 
 const LIVE_DEDUPE_MEMORY = 32;
diff --git a/apps/web/src/components/ChatView.logic.ts b/apps/web/src/components/ChatView.logic.ts
index c7c0f77bc97fb..bef8f7ab405f1 100644
--- a/apps/web/src/components/ChatView.logic.ts
+++ b/apps/web/src/components/ChatView.logic.ts
@@ -3,6 +3,7 @@ import {
   deriveLatestThreadRun,
   deriveThreadRuntime,
 } from "@t3tools/client-runtime/state/thread-execution";
+import { checkpointFileTotals } from "@t3tools/client-runtime/state/thread-checkpoints";
 import { derivePendingBackgroundWork } from "@t3tools/shared/orchestrationV2PendingBackgroundWork";
 import {
   latestUnheldRun,
@@ -218,7 +219,7 @@ export function shouldOpenProactiveTurnDiff(input: {
 }
 
 export function resolveProactiveTurnDiffAction(input: {
-  checkpoint: Pick<TurnDiffSummary, "status" | "files"> | undefined;
+  checkpoint: Pick<TurnDiffSummary, "status" | "files" | "filesTotal"> | undefined;
   isGitRepo: boolean | undefined;
 }): "defer" | "ignore" | "open" {
   if (input.checkpoint === undefined || input.checkpoint.status === "missing") return "defer";
@@ -230,11 +231,8 @@ export function resolveProactiveTurnDiffAction(input: {
   ) {
     return "ignore";
   }
-  const changedLines = input.checkpoint.files.reduce(
-    (total, file) => total + file.additions + file.deletions,
-    0,
-  );
-  return input.checkpoint.files.length >= 3 || changedLines >= 50 ? "open" : "ignore";
+  const totals = checkpointFileTotals(input.checkpoint);
+  return totals.count >= 3 || totals.additions + totals.deletions >= 50 ? "open" : "ignore";
 }
 
 /** Mark reactivated Diff tabs to preserve review scope. Already-active tabs must not leave a marker for
diff --git a/apps/web/src/components/chat/ChangedFilesTree.tsx b/apps/web/src/components/chat/ChangedFilesTree.tsx
index 0b569cbc0c563..868484f37b474 100644
--- a/apps/web/src/components/chat/ChangedFilesTree.tsx
+++ b/apps/web/src/components/chat/ChangedFilesTree.tsx
@@ -1,11 +1,7 @@
-import { type RunId } from "@t3tools/contracts";
+import { type OrchestrationV2CheckpointFileTotals, type RunId } from "@t3tools/contracts";
 import { type MouseEvent, type ReactNode, memo, useLayoutEffect, useRef, useState } from "react";
 import { type TurnDiffFileChange } from "../../types";
-import {
-  buildTurnDiffTree,
-  summarizeTurnDiffStats,
-  type TurnDiffTreeNode,
-} from "../../lib/turnDiffTree";
+import { buildTurnDiffTree, type TurnDiffTreeNode } from "../../lib/turnDiffTree";
 import { ChevronRightIcon, FileDiffIcon } from "lucide-react";
 import { ChevronsDownUp, ChevronsUpDown, Folder, FolderClosed } from "lucide";
 import { cn } from "~/lib/utils";
@@ -30,7 +26,9 @@ type ChangedFileContextMenuHandler = (filePath: string, event: MouseEvent) => vo
 
 export const ChangedFilesCard = memo(function ChangedFilesCard(props: {
   runId: RunId;
+  /** May be a prefix of the changed files; `totals` covers all of them. */
   files: ReadonlyArray<TurnDiffFileChange>;
+  totals: OrchestrationV2CheckpointFileTotals;
   allDirectoriesExpanded: boolean;
   resolvedTheme: "light" | "dark";
   onToggleAllDirectories: () => void;
@@ -40,13 +38,14 @@ export const ChangedFilesCard = memo(function ChangedFilesCard(props: {
   const {
     runId,
     files,
+    totals,
     allDirectoriesExpanded,
     resolvedTheme,
     onToggleAllDirectories,
     onOpenTurnDiff,
     onFileContextMenu,
   } = props;
-  const summaryStat = summarizeTurnDiffStats(files);
+  const hiddenFileCount = totals.count - files.length;
   const hasDirectories = files.some((file) => /[/\\]/.test(file.path));
 
   return (
@@ -60,12 +59,12 @@ export const ChangedFilesCard = memo(function ChangedFilesCard(props: {
       >
         <div className="flex min-w-0 flex-wrap items-center gap-x-3 gap-y-1 text-xs font-medium text-foreground">
           <span>
-            {files.length} changed file{files.length === 1 ? "" : "s"}
+            {totals.count.toLocaleString()} changed file{totals.count === 1 ? "" : "s"}
           </span>
-          {hasNonZeroStat(summaryStat) && (
+          {hasNonZeroStat(totals) && (
             <DiffStatLabel
-              additions={summaryStat.additions}
-              deletions={summaryStat.deletions}
+              additions={totals.additions}
+              deletions={totals.deletions}
               layout="inline"
               className="text-xs leading-4"
             />
@@ -126,6 +125,19 @@ export const ChangedFilesCard = memo(function ChangedFilesCard(props: {
         onOpenTurnDiff={onOpenTurnDiff}
         onFileContextMenu={onFileContextMenu}
       />
+      {hiddenFileCount > 0 && (
+        <div className="px-3 pb-2">
+          <Button
+            type="button"
+            size="xs"
+            variant="ghost-muted"
+            onClick={() => onOpenTurnDiff(runId, files[0]?.path)}
+          >
+            {hiddenFileCount.toLocaleString()} more file{hiddenFileCount === 1 ? "" : "s"} in the
+            full diff
+          </Button>
+        </div>
+      )}
     </div>
   );
 });
diff --git a/apps/web/src/components/chat/TimelineAssistantRows.tsx b/apps/web/src/components/chat/TimelineAssistantRows.tsx
index 89b52ae5c5cba..228eb6f79b9c3 100644
--- a/apps/web/src/components/chat/TimelineAssistantRows.tsx
+++ b/apps/web/src/components/chat/TimelineAssistantRows.tsx
@@ -9,6 +9,7 @@ import { Button } from "../ui/button";
 import { ProposedPlanCard } from "./ProposedPlanCard";
 import { HtmlRenderFrame } from "./HtmlRenderFrame";
 import { McpAppFrame } from "./McpAppFrame";
+import { checkpointFileTotals } from "@t3tools/client-runtime/state/thread-checkpoints";
 import { ChangedFilesCard } from "./ChangedFilesTree";
 import { useFileContextMenuHandler } from "../../fileContextMenu";
 import { useProject, useThreadShell } from "../../state/entities";
@@ -347,6 +348,7 @@ function AssistantChangedFilesSectionInner({
     <ChangedFilesCard
       runId={turnSummary.runId}
       files={checkpointFiles}
+      totals={checkpointFileTotals(turnSummary)}
       allDirectoriesExpanded={allDirectoriesExpanded}
       resolvedTheme={resolvedTheme}
       onToggleAllDirectories={() =>
diff --git a/apps/web/src/lib/turnDiffTree.ts b/apps/web/src/lib/turnDiffTree.ts
index 810a04755e895..e841e18ce24d2 100644
--- a/apps/web/src/lib/turnDiffTree.ts
+++ b/apps/web/src/lib/turnDiffTree.ts
@@ -98,20 +98,6 @@ function toTreeNodes(directory: MutableDirectoryNode): TurnDiffTreeNode[] {
   return [...subdirectories, ...files];
 }
 
-export function summarizeTurnDiffStats(files: ReadonlyArray<TurnDiffFileChange>): TurnDiffStat {
-  return files.reduce(
-    (acc, file) => {
-      const stat = readStat(file);
-      if (!stat) return acc;
-      return {
-        additions: acc.additions + stat.additions,
-        deletions: acc.deletions + stat.deletions,
-      };
-    },
-    { additions: 0, deletions: 0 },
-  );
-}
-
 export function buildTurnDiffTree(files: ReadonlyArray<TurnDiffFileChange>): TurnDiffTreeNode[] {
   const root: MutableDirectoryNode = {
     name: "",
diff --git a/packages/client-runtime/src/state/threadCheckpoints.ts b/packages/client-runtime/src/state/threadCheckpoints.ts
index 4501007e20053..ee2fe45d9c756 100644
--- a/packages/client-runtime/src/state/threadCheckpoints.ts
+++ b/packages/client-runtime/src/state/threadCheckpoints.ts
@@ -3,6 +3,7 @@ import type {
   CheckpointRef,
   CheckpointScopeId,
   MessageId,
+  OrchestrationV2CheckpointFileTotals,
   OrchestrationV2ThreadProjection,
   RunId,
 } from "@t3tools/contracts";
@@ -15,12 +16,14 @@ export interface ThreadCheckpointSummary {
   readonly checkpointTurnCount: number;
   readonly checkpointRef: CheckpointRef;
   readonly status: "ready" | "missing" | "error" | "stale";
+  /** A prefix of the changed files when `filesTotal` is set; see `checkpointFileTotals`. */
   readonly files: ReadonlyArray<{
     readonly path: string;
     readonly kind: string;
     readonly additions: number;
     readonly deletions: number;
   }>;
+  readonly filesTotal?: OrchestrationV2CheckpointFileTotals;
   readonly assistantMessageId: MessageId | null;
   readonly completedAt: string;
 }
@@ -43,9 +46,23 @@ export function deriveThreadCheckpointSummaries(
         checkpointRef: checkpoint.ref,
         status: checkpoint.status,
         files: checkpoint.files,
+        ...(checkpoint.filesTotal === undefined ? {} : { filesTotal: checkpoint.filesTotal }),
         assistantMessageId,
         completedAt: DateTime.formatIso(checkpoint.capturedAt),
       },
     ];
   });
 }
+
+export function checkpointFileTotals(
+  checkpoint: Pick<ThreadCheckpointSummary, "files" | "filesTotal">,
+): OrchestrationV2CheckpointFileTotals {
+  if (checkpoint.filesTotal !== undefined) return checkpoint.filesTotal;
+  let additions = 0;
+  let deletions = 0;
+  for (const file of checkpoint.files) {
+    additions += file.additions;
+    deletions += file.deletions;
+  }
+  return { count: checkpoint.files.length, additions, deletions };
+}
diff --git a/packages/contracts/src/orchestrationV2.ts b/packages/contracts/src/orchestrationV2.ts
index 747d05e7ce4eb..026e74831233d 100644
--- a/packages/contracts/src/orchestrationV2.ts
+++ b/packages/contracts/src/orchestrationV2.ts
@@ -1349,6 +1349,14 @@ export const OrchestrationV2CheckpointFileSummary = Schema.Struct({
 });
 export type OrchestrationV2CheckpointFileSummary = typeof OrchestrationV2CheckpointFileSummary.Type;
 
+/** Sent only when the wire carries a prefix of `files`; the totals cover the full list. */
+export const OrchestrationV2CheckpointFileTotals = Schema.Struct({
+  count: NonNegativeInt,
+  additions: NonNegativeInt,
+  deletions: NonNegativeInt,
+});
+export type OrchestrationV2CheckpointFileTotals = typeof OrchestrationV2CheckpointFileTotals.Type;
+
 export const OrchestrationV2Checkpoint = Schema.Struct({
   id: CheckpointId,
   threadId: ThreadId,
@@ -1361,6 +1369,7 @@ export const OrchestrationV2Checkpoint = Schema.Struct({
   ref: CheckpointRef,
   status: Schema.Literals(["ready", "missing", "error", "stale"]),
   files: Schema.Array(OrchestrationV2CheckpointFileSummary),
+  filesTotal: Schema.optionalKey(OrchestrationV2CheckpointFileTotals),
   capturedAt: Schema.DateTimeUtc,
 });
 export type OrchestrationV2Checkpoint = typeof OrchestrationV2Checkpoint.Type;
@@ -1659,6 +1668,7 @@ export const OrchestrationV2TurnItem = Schema.Union([
     checkpointId: CheckpointId,
     scopeId: CheckpointScopeId,
     files: Schema.Array(OrchestrationV2CheckpointFileSummary),
+    filesTotal: Schema.optionalKey(OrchestrationV2CheckpointFileTotals),
     /** Same as the files of checkpoint `checkpointId`. */
     filesOmitted: DedupedBodyMarker,
   }),

From 8bf4822f5eb5b24f3129960ce771daacc5c01a44 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:18:37 -0700
Subject: [PATCH 104/146] perf(server): sidebar shell loads 3x faster and
 startup thread counts 80x faster (#27106)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../transferBudgetV2.integration.test.ts      |   1 +
 .../src/orchestration-v2/Orchestrator.ts      |  12 +
 .../orchestration-v2/ProjectionStore.test.ts  |  34 +++
 .../src/orchestration-v2/ProjectionStore.ts   | 110 +++++++
 .../ProviderTurnControlService.test.ts        |   2 +
 .../src/orchestration-v2/ShellStream.ts       | 287 +++++++++++++-----
 .../orchestration-v2/ThreadLaunchService.ts   |   7 +-
 .../ThreadManagementService.ts                |  13 +-
 apps/server/src/orchestration-v2/http.ts      |  31 +-
 apps/server/src/project/ProjectService.ts     |   6 +-
 .../src/relay/AgentAwarenessRelay.test.ts     |   2 +
 apps/server/src/relay/AgentAwarenessRelay.ts  |  13 +-
 .../src/serverRuntimeStartup.autoPull.test.ts |   8 +-
 apps/server/src/serverRuntimeStartup.test.ts  |   9 +-
 apps/server/src/serverRuntimeStartup.ts       |   9 +-
 apps/server/src/ws.test.ts                    |  15 +-
 apps/server/src/ws.ts                         |  31 +-
 17 files changed, 436 insertions(+), 154 deletions(-)

diff --git a/apps/server/integration/transferBudgetV2.integration.test.ts b/apps/server/integration/transferBudgetV2.integration.test.ts
index 22db0e643db9b..68a622c541fe9 100644
--- a/apps/server/integration/transferBudgetV2.integration.test.ts
+++ b/apps/server/integration/transferBudgetV2.integration.test.ts
@@ -117,6 +117,7 @@ const layerManagement = Layer.unwrap(
           .pipe(Effect.orDie),
       getThreadShell: (id) => projections.getThreadShell(id).pipe(Effect.orDie),
       getShellSnapshot: (options) => projections.getShellSnapshot(options).pipe(Effect.orDie),
+      listActiveShellIndex: () => projections.listActiveShellIndex().pipe(Effect.orDie),
       listActiveSubagentThreadIds: () =>
         projections.listActiveSubagentThreadIds().pipe(Effect.orDie),
       readShellSnapshot: (options) =>
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 76bcc00bbcb4e..c464a8743f3c2 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -141,6 +141,7 @@ import {
   type ProjectionRecords,
   type ProjectionCheckpointContext,
   type OlderSettledThreadsListing,
+  type ActiveShellIndexEntry,
   type OlderSettledThreadsQuery,
   type ShellSnapshotOptions,
 } from "./ProjectionStore.ts";
@@ -392,6 +393,11 @@ export interface OrchestratorV2Shape {
     ReadonlyArray<ThreadId>,
     OrchestratorV2Error
   >;
+  readonly countThreads: () => Effect.Effect<number, OrchestratorV2Error>;
+  readonly listActiveShellIndex: () => Effect.Effect<
+    ReadonlyArray<ActiveShellIndexEntry>,
+    OrchestratorV2Error
+  >;
   readonly listOlderSettledThreads: (
     query: OlderSettledThreadsQuery,
   ) => Effect.Effect<OlderSettledThreadsListing, OrchestratorV2Error>;
@@ -13434,6 +13440,12 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
           .pipe(Effect.mapError(shellProjectionError));
       },
     ),
+    countThreads: Effect.fn("OrchestratorV2.countThreads")(function () {
+      return projectionStore.countThreads().pipe(Effect.mapError(shellProjectionError));
+    }),
+    listActiveShellIndex: Effect.fn("OrchestratorV2.listActiveShellIndex")(function () {
+      return projectionStore.listActiveShellIndex().pipe(Effect.mapError(shellProjectionError));
+    }),
     listOlderSettledThreads: Effect.fn("OrchestratorV2.listOlderSettledThreads")(function (query) {
       return projectionStore
         .listOlderSettledThreads(query)
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.test.ts b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
index 8d46b51031506..1dc7c912e7765 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.test.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.test.ts
@@ -26,6 +26,7 @@ import {
   ThreadId,
   TurnItemId,
   type ThreadPullRequestLink,
+  isLiveSubagentShell,
 } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
@@ -76,6 +77,33 @@ const traceSqlStatements = () => {
   return { statements, tracer };
 };
 
+/** The shell index flags every live shell and matches its shells on the fields subscriber trims read. */
+const assertShellIndexCoversShells = Effect.fnUntraced(function* () {
+  const store = yield* ProjectionStore.ProjectionStoreV2;
+  const shells = (yield* store.getShellSnapshot({ location: "active" })).threads;
+  const index = yield* store.listActiveShellIndex();
+  const iso = (value: DateTime.Utc | null | undefined) =>
+    value == null ? null : DateTime.formatIso(value);
+  const trimmed = (
+    row: Pick<
+      ProjectionStore.ActiveShellIndexEntry,
+      "id" | "projectId" | "lineage" | "settledOverride" | "settledAt" | "pinnedAt" | "snoozedUntil"
+    >,
+  ) => ({
+    id: row.id,
+    projectId: row.projectId,
+    lineage: row.lineage,
+    settledOverride: row.settledOverride,
+    settledAt: iso(row.settledAt),
+    pinnedAt: iso(row.pinnedAt),
+    snoozedUntil: iso(row.snoozedUntil),
+  });
+  assert.deepEqual(index.map(trimmed), shells.map(trimmed));
+  shells.forEach((shell, position) => {
+    if (isLiveSubagentShell(shell)) assert.isTrue(index[position]?.mayBeLive, shell.id);
+  });
+});
+
 const addRolledBackRecoveryCandidate = Effect.fn("addRolledBackRecoveryCandidate")(function* (
   suffix: string,
 ) {
@@ -272,6 +300,7 @@ it.effect("SQL shells flag only an active turn blocked solely on T3 thread waits
         assert.equal(shell?.status, "running");
         assert.equal(shell?.blockedOnThreadWait ?? false, expected);
       }
+      yield* assertShellIndexCoversShells();
     });
     const wait = {
       ...itemBase,
@@ -531,6 +560,7 @@ it.effect("SQL shells use the latest subagent owner for duplicate provider-threa
       const listed = (yield* store.getShellSnapshot()).threads.find(
         (thread) => thread.id === targetThreadId,
       );
+      yield* assertShellIndexCoversShells();
       for (const shell of [yield* store.getThreadShell(targetThreadId), listed]) {
         assert.equal(shell?.providerInstanceId, otherInstanceId);
         assert.equal(shell?.activeRunId, null);
@@ -1336,6 +1366,7 @@ it.effect("SQL list older settled threads below a cursor", () =>
     const next = yield* list({ settledAt: DateTime.formatIso(at(4)), threadId: id("b") }, 10);
     assert.deepEqual(next.threadIds, [id("c"), id("d"), id("snoozed")]);
     assert.deepEqual(yield* list(before, 25, []), { threadIds: [], counts: [] });
+    yield* assertShellIndexCoversShells();
     const scoped = yield* list(before, 0, [ProjectId.make("project:b")]);
     assert.deepEqual(scoped, {
       threadIds: [],
@@ -3798,6 +3829,7 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
         const sqlShell = (yield* projectionStore.getShellSnapshot()).threads.find(
           (row) => row.id === threadId,
         )!;
+        yield* assertShellIndexCoversShells();
         for (const questionShell of [
           sqlShell,
           ProjectionStore.threadShellFromProjection(projection),
@@ -4860,6 +4892,7 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
         SET status = 'running', payload_json = json_set(payload_json, '$.status', 'running')
         WHERE run_id = ${runId}
       `;
+      yield* assertShellIndexCoversShells();
       const secretOnlyShell = (yield* projectionStore.getShellSnapshot()).threads.find(
         (thread) => thread.id === threadId,
       );
@@ -6466,6 +6499,7 @@ it.layer(layerTest)("ProjectionStoreV2", (it) => {
           (candidate) => candidate.id === threadId,
         );
         assert.deepEqual(listed?.pendingBackgroundTasks, shell?.pendingBackgroundTasks);
+        yield* assertShellIndexCoversShells();
         return shell && projectThreadAwarenessV2({ environmentId, project, thread: shell })?.phase;
       });
 
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 287a30a9d904e..6bb04041c75b6 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -393,6 +393,15 @@ export interface ShellSnapshotOptions {
   readonly threadIds?: ReadonlyArray<ThreadId>;
 }
 
+/** What a shell subscriber's trims read from an active thread, without building its shell. */
+export interface ActiveShellIndexEntry extends Pick<
+  OrchestrationV2ThreadShell,
+  "id" | "projectId" | "lineage" | "settledOverride" | "settledAt" | "pinnedAt" | "snoozedUntil"
+> {
+  /** False only when no run, request, work item, or watch can make the shell live. */
+  readonly mayBeLive: boolean;
+}
+
 export interface OlderSettledThreadsQuery {
   readonly before: OrchestrationV2OlderSettledCursor;
   readonly projectIds?: ReadonlyArray<ProjectId> | undefined;
@@ -450,6 +459,13 @@ export interface ProjectionStoreV2Shape {
     ReadonlyArray<ThreadId>,
     ProjectionStoreV2Error
   >;
+  /** Threads that are not deleted, archived ones included. */
+  readonly countThreads: () => Effect.Effect<number, ProjectionStoreV2Error>;
+  /** Every active thread, in shell order. */
+  readonly listActiveShellIndex: () => Effect.Effect<
+    ReadonlyArray<ActiveShellIndexEntry>,
+    ProjectionStoreV2Error
+  >;
   /** Older settled thread ids below a cursor, newest settle first, and per-project counts. */
   readonly listOlderSettledThreads: (
     query: OlderSettledThreadsQuery,
@@ -6614,6 +6630,98 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       Effect.mapError(shellSnapshotReadError),
     );
 
+    const countThreads = Effect.fn("ProjectionStore.countThreads")(function* () {
+      const rows = yield* sql<{ readonly count: number }>`
+        SELECT COUNT(*) AS count FROM orchestration_v2_projection_threads WHERE deleted_at IS NULL
+      `;
+      return rows[0]?.count ?? 0;
+    }, Effect.mapError(shellSnapshotReadError));
+
+    const listActiveShellIndex = Effect.fn("ProjectionStore.listActiveShellIndex")(function* () {
+      const rows = yield* sql<{
+        readonly thread_id: string;
+        readonly project_id: string;
+        readonly relationship_to_parent: string | null;
+        readonly parent_thread_id: string | null;
+        readonly root_thread_id: string;
+        readonly settled_override: string | null;
+        readonly settled_at: string | null;
+        readonly pinned_at: string | null;
+        readonly snoozed_until: string | null;
+        readonly may_be_live: number;
+      }>`
+        SELECT
+          t.thread_id,
+          t.project_id,
+          json_extract(t.payload_json, '$.lineage.relationshipToParent') AS relationship_to_parent,
+          json_extract(t.payload_json, '$.lineage.parentThreadId') AS parent_thread_id,
+          json_extract(t.payload_json, '$.lineage.rootThreadId') AS root_thread_id,
+          json_extract(t.payload_json, '$.settledOverride') AS settled_override,
+          json_extract(t.payload_json, '$.settledAt') AS settled_at,
+          json_extract(t.payload_json, '$.pinnedAt') AS pinned_at,
+          json_extract(t.payload_json, '$.snoozedUntil') AS snoozed_until,
+          -- A superset of isLiveSubagentShell: the sources of its run status, pending request,
+          -- and pending background work.
+          (
+            EXISTS (
+              SELECT 1 FROM orchestration_v2_projection_runs r
+              WHERE r.thread_id = t.thread_id
+                AND r.status IN ('queued', 'preparing', 'starting', 'running', 'waiting')
+            )
+            OR EXISTS (
+              SELECT 1 FROM orchestration_v2_projection_runtime_requests request
+              WHERE request.thread_id = t.thread_id AND request.status = 'pending'
+            )
+            -- Same predicates as the shell's pending item and link reads, for their partial indexes.
+            OR EXISTS (
+              SELECT 1 FROM orchestration_v2_projection_turn_items item
+              WHERE item.thread_id = t.thread_id
+                AND item.type IN ('command_execution', 'dynamic_tool', 'subagent')
+                AND item.status NOT IN ('completed', 'interrupted', 'failed', 'cancelled')
+            )
+            OR EXISTS (
+              SELECT 1 FROM orchestration_v2_projection_turn_items link_request
+              WHERE link_request.thread_id = t.thread_id
+                AND link_request.type = 'link_request' AND link_request.status = 'waiting'
+            )
+            OR EXISTS (
+              SELECT 1 FROM orchestration_v2_projection_provider_threads provider_thread
+              WHERE provider_thread.thread_id = t.thread_id
+                AND json_array_length(provider_thread.payload_json, '$.pendingBackgroundTasks') > 0
+            )
+            OR EXISTS (
+              SELECT 1 FROM json_each(t.payload_json, '$.pullRequests') link
+              WHERE json_type(link.value, '$.watch') IS NOT NULL
+            )
+          ) AS may_be_live
+        FROM orchestration_v2_projection_threads t
+        WHERE t.deleted_at IS NULL
+          AND json_extract(t.payload_json, '$.archivedAt') IS NULL
+        ORDER BY t.updated_at ASC, t.thread_id ASC
+      `;
+      return rows.map((row): ActiveShellIndexEntry => ({
+        id: ThreadId.make(row.thread_id),
+        projectId: ProjectId.make(row.project_id),
+        lineage: {
+          parentThreadId:
+            row.parent_thread_id === null ? null : ThreadId.make(row.parent_thread_id),
+          relationshipToParent:
+            row.relationship_to_parent === "fork" || row.relationship_to_parent === "subagent"
+              ? row.relationship_to_parent
+              : null,
+          rootThreadId: ThreadId.make(row.root_thread_id),
+        },
+        settledOverride:
+          row.settled_override === "settled" || row.settled_override === "active"
+            ? row.settled_override
+            : null,
+        settledAt: row.settled_at === null ? null : DateTime.makeUnsafe(row.settled_at),
+        pinnedAt: row.pinned_at === null ? null : DateTime.makeUnsafe(row.pinned_at),
+        snoozedUntil: row.snoozed_until === null ? null : DateTime.makeUnsafe(row.snoozed_until),
+        mayBeLive: row.may_be_live === 1,
+      }));
+    }, Effect.mapError(shellSnapshotReadError));
+
     const findGuestShareThreadId = Effect.fn("ProjectionStore.findGuestShareThreadId")(function* (
       shareId: GuestShareId,
     ) {
@@ -6768,6 +6876,8 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       apply,
       getShellSnapshot: readOnReader(getShellSnapshot),
       listActiveSubagentThreadIds: readOnReader(listActiveSubagentThreadIds),
+      countThreads: readOnReader(countThreads),
+      listActiveShellIndex: readOnReader(listActiveShellIndex),
       readShellSnapshot: readOnReader(readShellSnapshot),
       listOlderSettledThreads: readOnReader(listOlderSettledThreads),
       getThreadShell: readOnReader(getThreadShell),
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
index a39f6b7f036a6..1d79e87eb9b91 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
@@ -213,6 +213,8 @@ it.effect(
           getOpenRemoteDelegatedTasks: Effect.die("unused getOpenRemoteDelegatedTasks"),
           getShellSnapshot: () => Effect.die("unused getShellSnapshot"),
           listActiveSubagentThreadIds: () => Effect.die("unused listActiveSubagentThreadIds"),
+          countThreads: () => Effect.die("unused countThreads"),
+          listActiveShellIndex: () => Effect.die("unused listActiveShellIndex"),
           listOlderSettledThreads: () => Effect.die("unused listOlderSettledThreads"),
           readShellSnapshot: () => Effect.die("unused readShellSnapshot"),
           getThreadShell: () => Effect.die("unused getThreadShell"),
diff --git a/apps/server/src/orchestration-v2/ShellStream.ts b/apps/server/src/orchestration-v2/ShellStream.ts
index 8a075e13c528b..67d07d6684c08 100644
--- a/apps/server/src/orchestration-v2/ShellStream.ts
+++ b/apps/server/src/orchestration-v2/ShellStream.ts
@@ -31,6 +31,7 @@ import type * as SqlClient from "effect/sql/SqlClient";
 import * as Stream from "effect/Stream";
 
 import { bufferLatestLiveStream } from "./LiveStreamBudget.ts";
+import type { ActiveShellIndexEntry } from "./ProjectionStore.ts";
 
 type ShellDelta = Extract<OrchestrationV2ShellStreamItem, { readonly sequence: number }>;
 
@@ -56,7 +57,7 @@ export const bufferShellLiveStream = <E, R>(
     limits,
   );
 
-export function buildActiveShellSnapshot(input: {
+function buildActiveShellSnapshot(input: {
   readonly projects: ReadonlyArray<OrchestrationProjectShell>;
   readonly threads: OrchestrationV2ThreadShellSnapshot;
   readonly snapshotSequence: number;
@@ -70,26 +71,119 @@ export function buildActiveShellSnapshot(input: {
   };
 }
 
+type ShellTrimRow = Pick<
+  OrchestrationV2ThreadShell,
+  "id" | "projectId" | "lineage" | "settledOverride" | "settledAt"
+>;
+
 /**
- * Idle subagent children have no sidebar row, so clients that opt in read them from their thread
- * family instead. A child stays while it is live or the parent of another child, so the request
- * and working walks over shell rows never meet a gap in a nested chain.
+ * What a subscriber's trims read across every active row. Computed from full shells or from the
+ * store's index, so a snapshot read only for the rows it sends trims the same way.
  */
-export function omitIdleSubagentShells(
-  threads: ReadonlyArray<OrchestrationV2ThreadShell>,
-): ReadonlyArray<OrchestrationV2ThreadShell> {
-  const parentIds = new Set<string>();
-  for (const thread of threads) {
-    if (thread.lineage.relationshipToParent === "subagent" && thread.lineage.parentThreadId) {
-      parentIds.add(thread.lineage.parentThreadId);
+interface ShellTrimFacts {
+  readonly subagentParentIds: ReadonlySet<string>;
+  readonly subagentThreadIds: Set<string>;
+  /** Undefined when no thread is settled, so none is older. */
+  readonly olderSettledBeforeMs: number | undefined;
+  readonly olderSettledCounts: ReadonlyArray<OrchestrationV2OlderSettledCount>;
+}
+
+const NEWEST_SETTLED_KEPT = 25;
+
+function shellTrimFacts(rows: ReadonlyArray<ShellTrimRow>): ShellTrimFacts {
+  const subagentParentIds = new Set<string>();
+  const subagentThreadIds = new Set<string>();
+  const settledTimes: Array<number> = [];
+  for (const row of rows) {
+    if (row.lineage.relationshipToParent === "subagent") {
+      subagentThreadIds.add(row.id);
+      if (row.lineage.parentThreadId) subagentParentIds.add(row.lineage.parentThreadId);
+    } else if (row.settledOverride === "settled" && row.settledAt !== null) {
+      settledTimes.push(DateTime.toEpochMillis(row.settledAt));
+    }
+  }
+  settledTimes.sort((left, right) => right - left);
+  // With fewer than 25, the oldest one is the cut, so nothing is older.
+  const olderSettledBeforeMs = settledTimes[NEWEST_SETTLED_KEPT - 1] ?? settledTimes.at(-1);
+  const counts = new Map<ProjectId, number>();
+  if (olderSettledBeforeMs !== undefined) {
+    for (const row of rows) {
+      if (isOlderSettledThreadShell(row, olderSettledBeforeMs)) {
+        counts.set(row.projectId, (counts.get(row.projectId) ?? 0) + 1);
+      }
     }
   }
+  return {
+    subagentParentIds,
+    subagentThreadIds,
+    olderSettledBeforeMs,
+    olderSettledCounts: Array.from(counts, ([projectId, count]) => ({ projectId, count })),
+  };
+}
+
+function subagentAncestorIds(threads: ReadonlyArray<Pick<OrchestrationV2ThreadShell, "lineage">>) {
+  const ancestorIds = new Set<string>();
+  for (const thread of threads) {
+    if (thread.lineage.relationshipToParent !== "subagent") continue;
+    if (thread.lineage.parentThreadId !== null) ancestorIds.add(thread.lineage.parentThreadId);
+    ancestorIds.add(thread.lineage.rootThreadId);
+  }
+  return ancestorIds;
+}
+
+function omitIdleSubagentShellsWith(
+  threads: ReadonlyArray<OrchestrationV2ThreadShell>,
+  facts: Pick<ShellTrimFacts, "subagentParentIds">,
+): ReadonlyArray<OrchestrationV2ThreadShell> {
   return threads.filter(
     (thread) =>
       thread.lineage.relationshipToParent !== "subagent" ||
       isLiveSubagentShell(thread) ||
-      parentIds.has(thread.id),
+      facts.subagentParentIds.has(thread.id),
+  );
+}
+
+function omitOlderSettledShellsWith(
+  input: {
+    readonly threads: ReadonlyArray<OrchestrationV2ThreadShell>;
+    readonly snapshotSequence: number;
+    readonly now: DateTime.Utc;
+  },
+  facts: Pick<ShellTrimFacts, "olderSettledBeforeMs" | "olderSettledCounts">,
+): {
+  readonly threads: ReadonlyArray<OrchestrationV2ThreadShell>;
+  readonly olderSettled: OrchestrationV2OlderSettledThreads;
+} {
+  const nowMs = DateTime.toEpochMillis(input.now);
+  const beforeMs = facts.olderSettledBeforeMs ?? nowMs;
+  const ancestorIds = subagentAncestorIds(input.threads);
+  const threads = input.threads.filter(
+    (thread) =>
+      !isOlderSettledThreadShell(thread, beforeMs) ||
+      thread.pinnedAt != null ||
+      (thread.snoozedUntil != null && DateTime.toEpochMillis(thread.snoozedUntil) > nowMs) ||
+      isLiveSubagentShell(thread) ||
+      ancestorIds.has(thread.id),
   );
+  return {
+    threads,
+    olderSettled: {
+      before: DateTime.formatIso(DateTime.makeUnsafe(beforeMs)),
+      asOfSequence: input.snapshotSequence,
+      counts: facts.olderSettledCounts,
+    },
+  };
+}
+
+/**
+ * Idle subagent children have no sidebar row, so clients that opt in read them from their thread
+ * family instead. A child stays while it is live or the parent of another child, so the request
+ * and working walks over shell rows never meet a gap in a nested chain.
+ */
+export function omitIdleSubagentShells(
+  threads: ReadonlyArray<OrchestrationV2ThreadShell>,
+): ReadonlyArray<OrchestrationV2ThreadShell> {
+  return omitIdleSubagentShellsWith(threads, shellTrimFacts(threads));
 }
 
 /**
@@ -103,18 +197,13 @@ export function activeShellRowsForSubscriber(
   readonly threads: ReadonlyArray<OrchestrationV2ThreadShell>;
   readonly subagentThreadIds: Set<string>;
 } {
+  const facts = shellTrimFacts(threads);
   return {
-    threads: omitIdleSubagents ? omitIdleSubagentShells(threads) : threads,
-    subagentThreadIds: new Set(
-      threads
-        .filter((thread) => thread.lineage.relationshipToParent === "subagent")
-        .map((thread) => thread.id),
-    ),
+    threads: omitIdleSubagents ? omitIdleSubagentShellsWith(threads, facts) : threads,
+    subagentThreadIds: facts.subagentThreadIds,
   };
 }
 
-const NEWEST_SETTLED_KEPT = 25;
-
 /**
  * Opted-in snapshots keep the 25 newest settled top-level threads (and ties) and count the rest per
  * project in `olderSettled`; clients page them with `getOlderSettledThreads`. Older rows stay while
@@ -128,77 +217,107 @@ export function omitOlderSettledShells(input: {
   readonly threads: ReadonlyArray<OrchestrationV2ThreadShell>;
   readonly olderSettled: OrchestrationV2OlderSettledThreads;
 } {
-  const nowMs = DateTime.toEpochMillis(input.now);
-  const settledTimes = input.threads
-    .flatMap((thread) =>
-      thread.lineage.relationshipToParent !== "subagent" &&
-      thread.settledOverride === "settled" &&
-      thread.settledAt !== null
-        ? [DateTime.toEpochMillis(thread.settledAt)]
+  return omitOlderSettledShellsWith(input, shellTrimFacts(input.threads));
+}
+
+interface ShellSubscriberOptions {
+  readonly omitIdleSubagents: boolean;
+  readonly omitOlderSettled: boolean;
+}
+
+function trimShellSnapshot(
+  base: OrchestrationV2ShellSnapshot,
+  facts: ShellTrimFacts,
+  options: ShellSubscriberOptions & { readonly now: DateTime.Utc },
+): OrchestrationV2ShellSnapshot {
+  const threads = options.omitIdleSubagents
+    ? omitIdleSubagentShellsWith(base.threads, facts)
+    : base.threads;
+  if (!options.omitOlderSettled) return { ...base, threads };
+  const older = omitOlderSettledShellsWith(
+    { threads, snapshotSequence: base.snapshotSequence, now: options.now },
+    facts,
+  );
+  return { ...base, threads: older.threads, olderSettled: older.olderSettled };
+}
+
+/**
+ * The threads whose shells a trimmed snapshot can contain: a superset of what the trims keep, so
+ * trimming the shells read for these ids gives the snapshot trimming every shell would.
+ */
+function shellSubscriberThreadIds(
+  index: ReadonlyArray<ActiveShellIndexEntry>,
+  options: ShellSubscriberOptions,
+): ReadonlyArray<ThreadId> {
+  const facts = shellTrimFacts(index);
+  const subagents = index.filter(
+    (entry) =>
+      entry.lineage.relationshipToParent === "subagent" &&
+      (!options.omitIdleSubagents || entry.mayBeLive || facts.subagentParentIds.has(entry.id)),
+  );
+  const ancestorIds = subagentAncestorIds(subagents);
+  const keptSubagentIds = new Set(subagents.map((entry) => entry.id));
+  const beforeMs = facts.olderSettledBeforeMs;
+  return index.flatMap((entry) =>
+    entry.lineage.relationshipToParent === "subagent"
+      ? keptSubagentIds.has(entry.id)
+        ? [entry.id]
+        : []
+      : !options.omitOlderSettled ||
+          beforeMs === undefined ||
+          !isOlderSettledThreadShell(entry, beforeMs) ||
+          entry.pinnedAt != null ||
+          entry.snoozedUntil != null ||
+          entry.mayBeLive ||
+          ancestorIds.has(entry.id)
+        ? [entry.id]
         : [],
-    )
-    .sort((left, right) => right - left);
-  // With fewer than 25, the oldest one is the cut, so nothing is older.
-  const beforeMs = settledTimes[NEWEST_SETTLED_KEPT - 1] ?? settledTimes.at(-1) ?? nowMs;
-  const ancestorIds = new Set<string>();
-  for (const thread of input.threads) {
-    if (thread.lineage.relationshipToParent !== "subagent") continue;
-    if (thread.lineage.parentThreadId !== null) ancestorIds.add(thread.lineage.parentThreadId);
-    ancestorIds.add(thread.lineage.rootThreadId);
-  }
-  const counts = new Map<ProjectId, number>();
-  const threads = input.threads.filter((thread) => {
-    if (!isOlderSettledThreadShell(thread, beforeMs)) return true;
-    counts.set(thread.projectId, (counts.get(thread.projectId) ?? 0) + 1);
-    return (
-      thread.pinnedAt != null ||
-      (thread.snoozedUntil != null && DateTime.toEpochMillis(thread.snoozedUntil) > nowMs) ||
-      isLiveSubagentShell(thread) ||
-      ancestorIds.has(thread.id)
-    );
-  });
-  return {
-    threads,
-    olderSettled: {
-      before: DateTime.formatIso(DateTime.makeUnsafe(beforeMs)),
-      asOfSequence: input.snapshotSequence,
-      counts: Array.from(counts, ([projectId, count]) => ({ projectId, count })),
-    },
-  };
+  );
 }
 
 /**
- * The snapshot a shell subscriber gets for its opt-ins, and the subagent ids whose transcript
- * events its stream drops (from every row, so an omitted child that wakes keeps that filter).
+ * A subscriber's active shell snapshot, read like `loadShellSnapshotParts`. With an opt-in, the
+ * store's index decides which shells to read, so threads the trims drop are never built.
  */
-export function shellSnapshotForSubscriber(
-  base: OrchestrationV2ShellSnapshot,
-  options: {
-    readonly omitIdleSubagents: boolean;
-    readonly omitOlderSettled: boolean;
-    readonly now: DateTime.Utc;
-  },
-): {
-  readonly snapshot: OrchestrationV2ShellSnapshot;
-  readonly subagentThreadIds: Set<string>;
-} {
-  const rows = activeShellRowsForSubscriber(base.threads, options.omitIdleSubagents);
-  if (!options.omitOlderSettled) {
+export const loadSubscriberShellSnapshot = Effect.fn("ShellStream.loadSubscriberShellSnapshot")(
+  function* <E1, E2, E3, E4, E5>(input: {
+    readonly sql: SqlClient.SqlClient;
+    readonly listShellIndex: Effect.Effect<ReadonlyArray<ActiveShellIndexEntry>, E1>;
+    readonly readThreads: (
+      threadIds: ReadonlyArray<ThreadId> | undefined,
+    ) => Effect.Effect<Effect.Effect<OrchestrationV2ThreadShellSnapshot, E3>, E2>;
+    readonly listProjects: Effect.Effect<ReadonlyArray<OrchestrationProjectShell>, E4>;
+    readonly latestSequence: Effect.Effect<number, E5>;
+    readonly options: ShellSubscriberOptions;
+  }) {
+    const trims = input.options.omitIdleSubagents || input.options.omitOlderSettled;
+    const read = yield* input.sql
+      .withTransaction(
+        Effect.gen(function* () {
+          const index = trims ? yield* input.listShellIndex : null;
+          return {
+            index,
+            decodeThreads: yield* input.readThreads(
+              index === null ? undefined : shellSubscriberThreadIds(index, input.options),
+            ),
+            projects: yield* input.listProjects,
+            snapshotSequence: yield* input.latestSequence,
+          };
+        }),
+      )
+      .pipe(NodeSqliteClient.readOnly);
+    const base = buildActiveShellSnapshot({
+      projects: read.projects,
+      threads: yield* read.decodeThreads,
+      snapshotSequence: read.snapshotSequence,
+    });
+    const facts = shellTrimFacts(read.index ?? base.threads);
     return {
-      snapshot: { ...base, threads: rows.threads },
-      subagentThreadIds: rows.subagentThreadIds,
+      snapshot: trimShellSnapshot(base, facts, { ...input.options, now: yield* DateTime.now }),
+      subagentThreadIds: facts.subagentThreadIds,
     };
-  }
-  const older = omitOlderSettledShells({
-    threads: rows.threads,
-    snapshotSequence: base.snapshotSequence,
-    now: options.now,
-  });
-  return {
-    snapshot: { ...base, threads: older.threads, olderSettled: older.olderSettled },
-    subagentThreadIds: rows.subagentThreadIds,
-  };
-}
+  },
+);
 
 /**
  * One transaction covers the reads so they agree; the threads are decoded after it commits,
diff --git a/apps/server/src/orchestration-v2/ThreadLaunchService.ts b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
index 7a45a54a312f4..5c51b8c48b859 100644
--- a/apps/server/src/orchestration-v2/ThreadLaunchService.ts
+++ b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
@@ -514,12 +514,9 @@ const make = Effect.gen(function* () {
               // Update parents first so children inherit names; reread each pass for newly updated descendants.
               const visited = new Set([threadId]);
               while (true) {
-                const snapshot = yield* threads.getShellSnapshot();
+                const snapshot = yield* threads.getShellSnapshot({ worktreePath: worktreeCwd });
                 const sharing = [...snapshot.threads, ...snapshot.archivedThreads].filter(
-                  (thread) =>
-                    !visited.has(thread.id) &&
-                    thread.worktreePath === worktreeCwd &&
-                    thread.branch === oldBranch,
+                  (thread) => !visited.has(thread.id) && thread.branch === oldBranch,
                 );
                 if (sharing.length === 0) break;
                 for (const thread of sharing) {
diff --git a/apps/server/src/orchestration-v2/ThreadManagementService.ts b/apps/server/src/orchestration-v2/ThreadManagementService.ts
index cfbbd4a68a51d..7b79b21e88153 100644
--- a/apps/server/src/orchestration-v2/ThreadManagementService.ts
+++ b/apps/server/src/orchestration-v2/ThreadManagementService.ts
@@ -394,10 +394,15 @@ export interface ThreadManagementServiceShape {
     ProjectionRecords<K>,
     ThreadManagementProjectionLoadError | ThreadManagementThreadNotFoundError
   >;
-  readonly getShellSnapshot: (options?: {
-    readonly location?: "active" | "archive";
-  }) => Effect.Effect<OrchestrationV2ThreadShellSnapshot, Orchestrator.OrchestratorV2Error>;
+  readonly getShellSnapshot: (
+    options?: Pick<
+      ShellSnapshotOptions,
+      "location" | "projectId" | "unsettledOnly" | "worktreePath" | "threadIds"
+    >,
+  ) => Effect.Effect<OrchestrationV2ThreadShellSnapshot, Orchestrator.OrchestratorV2Error>;
   readonly listActiveSubagentThreadIds: Orchestrator.OrchestratorV2["Service"]["listActiveSubagentThreadIds"];
+  readonly countThreads: Orchestrator.OrchestratorV2["Service"]["countThreads"];
+  readonly listActiveShellIndex: Orchestrator.OrchestratorV2["Service"]["listActiveShellIndex"];
   readonly listOlderSettledThreads: Orchestrator.OrchestratorV2["Service"]["listOlderSettledThreads"];
   readonly readShellSnapshot: (
     options?: Pick<ShellSnapshotOptions, "location" | "familyOf" | "worktreePath" | "threadIds">,
@@ -1333,6 +1338,8 @@ const make = Effect.gen(function* () {
     getProjectThreadRecords,
     getShellSnapshot: orchestrator.getShellSnapshot,
     listActiveSubagentThreadIds: orchestrator.listActiveSubagentThreadIds,
+    countThreads: orchestrator.countThreads,
+    listActiveShellIndex: orchestrator.listActiveShellIndex,
     listOlderSettledThreads: orchestrator.listOlderSettledThreads,
     readShellSnapshot: orchestrator.readShellSnapshot,
     getThreadShell: orchestrator.getThreadShell,
diff --git a/apps/server/src/orchestration-v2/http.ts b/apps/server/src/orchestration-v2/http.ts
index 61ff54d0c794f..c2c67eb04d9dc 100644
--- a/apps/server/src/orchestration-v2/http.ts
+++ b/apps/server/src/orchestration-v2/http.ts
@@ -3,7 +3,6 @@ import {
   EnvironmentHttpApi,
   type OrchestrationProjectShell,
 } from "@t3tools/contracts";
-import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Result from "effect/Result";
 import * as Predicate from "effect/Predicate";
@@ -32,11 +31,7 @@ import {
 } from "./threadHistoryPaging.ts";
 import * as ThreadManagementService from "./ThreadManagementService.ts";
 import * as ProjectStore from "./ProjectStore.ts";
-import {
-  buildActiveShellSnapshot,
-  loadShellSnapshotParts,
-  shellSnapshotForSubscriber,
-} from "./ShellStream.ts";
+import { loadSubscriberShellSnapshot } from "./ShellStream.ts";
 import { boundedSnapshotResponseFields } from "./ThreadStream.ts";
 import { projectThreadProjectionForWire } from "./WireProjection.ts";
 
@@ -84,19 +79,19 @@ export const layer = HttpApiBuilder.group(
         readonly omitIdleSubagents: boolean;
         readonly omitOlderSettled: boolean;
       }) {
-        const base = buildActiveShellSnapshot(
-          yield* loadShellSnapshotParts({
-            sql,
-            readThreads: threadManagement.readShellSnapshot({ location: "active" }),
-            listProjects: projectStore.listShells(),
-            latestSequence: applicationEvents.latestApplicationSequence,
-          }),
-        );
-        const { snapshot } = shellSnapshotForSubscriber(base, {
-          ...options,
-          now: yield* DateTime.now,
+        const { snapshot } = yield* loadSubscriberShellSnapshot({
+          sql,
+          listShellIndex: threadManagement.listActiveShellIndex(),
+          readThreads: (threadIds) =>
+            threadManagement.readShellSnapshot({
+              location: "active",
+              ...(threadIds === undefined ? {} : { threadIds }),
+            }),
+          listProjects: projectStore.listShells(),
+          latestSequence: applicationEvents.latestApplicationSequence,
+          options,
         });
-        const projects = yield* enrichProjectShells(base.projects);
+        const projects = yield* enrichProjectShells(snapshot.projects);
         return { ...snapshot, projects };
       },
     );
diff --git a/apps/server/src/project/ProjectService.ts b/apps/server/src/project/ProjectService.ts
index 18004510baa45..3ba57db6d7e5a 100644
--- a/apps/server/src/project/ProjectService.ts
+++ b/apps/server/src/project/ProjectService.ts
@@ -457,15 +457,13 @@ export const make = Effect.gen(function* () {
   ) {
     const { projectId } = input;
     const snapshot = yield* threadProjections
-      .getShellSnapshot()
+      .getShellSnapshot({ projectId })
       .pipe(
         Effect.mapError(
           (cause) => new ProjectOperationError({ operation: "list-threads", projectId, cause }),
         ),
       );
-    const projectThreads = [...snapshot.threads, ...snapshot.archivedThreads].filter(
-      (thread) => thread.projectId === projectId,
-    );
+    const projectThreads = [...snapshot.threads, ...snapshot.archivedThreads];
     if (projectThreads.length > 0 && input.force !== true) {
       return yield* new ProjectNotEmptyError({ projectId });
     }
diff --git a/apps/server/src/relay/AgentAwarenessRelay.test.ts b/apps/server/src/relay/AgentAwarenessRelay.test.ts
index 7f0e86bd6cf49..48c4a5c240ea9 100644
--- a/apps/server/src/relay/AgentAwarenessRelay.test.ts
+++ b/apps/server/src/relay/AgentAwarenessRelay.test.ts
@@ -190,6 +190,8 @@ const makeTestRelay = Effect.fnUntraced(function* (
         return { schemaVersion: 2, snapshotSequence: 1, threads: [], archivedThreads: [] };
       }),
     listActiveSubagentThreadIds: unused,
+    countThreads: unused,
+    listActiveShellIndex: () => Effect.succeed([]),
     listOlderSettledThreads: unused,
     readShellSnapshot: unused,
     ensureLegacyTranscript: unused,
diff --git a/apps/server/src/relay/AgentAwarenessRelay.ts b/apps/server/src/relay/AgentAwarenessRelay.ts
index cbe7b35ef409e..54742a0af7d66 100644
--- a/apps/server/src/relay/AgentAwarenessRelay.ts
+++ b/apps/server/src/relay/AgentAwarenessRelay.ts
@@ -726,10 +726,15 @@ export const make = Effect.gen(function* () {
       return "unlinked" as const;
     }
     const environmentId = yield* serverEnvironment.getEnvironmentId;
-    const [projectSnapshot, shellSnapshot] = yield* Effect.all([
-      projects.snapshot,
-      threads.getShellSnapshot(),
-    ]);
+    const projectSnapshot = yield* projects.snapshot;
+    // Subagents never publish awareness, and they are most threads.
+    const topLevelThreadIds = (yield* threads.listActiveShellIndex()).flatMap((thread) =>
+      thread.lineage.relationshipToParent === "subagent" ? [] : [thread.id],
+    );
+    const shellSnapshot = yield* threads.getShellSnapshot({
+      location: "active",
+      threadIds: topLevelThreadIds,
+    });
     const activeThreadIds = resolveAgentAwarenessRelayActiveThreadIds({
       environmentId,
       startedAt,
diff --git a/apps/server/src/serverRuntimeStartup.autoPull.test.ts b/apps/server/src/serverRuntimeStartup.autoPull.test.ts
index 59f6b67f04509..549aae79e8be5 100644
--- a/apps/server/src/serverRuntimeStartup.autoPull.test.ts
+++ b/apps/server/src/serverRuntimeStartup.autoPull.test.ts
@@ -141,13 +141,7 @@ it.effect("parks automatic pull until activation without delaying command readin
         }),
         Layer.mock(ProjectService.ProjectService)({ snapshot: Effect.succeed(snapshot) }),
         Layer.mock(ThreadManagement.ThreadManagementService)({
-          getShellSnapshot: () =>
-            Effect.succeed({
-              schemaVersion: 1,
-              snapshotSequence: 0,
-              threads: [],
-              archivedThreads: [],
-            }),
+          countThreads: () => Effect.succeed(0),
         }),
         Layer.mock(ThreadLaunch.ThreadLaunchService)({}),
         Layer.mock(ServiceLauncherClient.ServiceLauncherClient)({
diff --git a/apps/server/src/serverRuntimeStartup.test.ts b/apps/server/src/serverRuntimeStartup.test.ts
index 274b149c66efc..bef61bbca56fd 100644
--- a/apps/server/src/serverRuntimeStartup.test.ts
+++ b/apps/server/src/serverRuntimeStartup.test.ts
@@ -176,13 +176,8 @@ it.effect.each([
                 }),
         }),
         Layer.mock(ThreadManagement.ThreadManagementService)({
-          getShellSnapshot: () =>
-            Effect.succeed({
-              threads: [],
-              archivedThreads: [],
-              schemaVersion: 1,
-              snapshotSequence: 0,
-            }),
+          countThreads: () => Effect.succeed(0),
+          listActiveShellIndex: () => Effect.succeed([]),
         }),
         Layer.mock(ThreadLaunch.ThreadLaunchService)({
           launch: (input) => {
diff --git a/apps/server/src/serverRuntimeStartup.ts b/apps/server/src/serverRuntimeStartup.ts
index d8d62dc029c24..b812ad07fa6d6 100644
--- a/apps/server/src/serverRuntimeStartup.ts
+++ b/apps/server/src/serverRuntimeStartup.ts
@@ -153,11 +153,11 @@ const recordStartupHeartbeat = Effect.gen(function* () {
 
   const { threadCount, projectCount } = yield* Effect.all({
     projects: projects.snapshot,
-    threads: threads.getShellSnapshot(),
+    threadCount: threads.countThreads(),
   }).pipe(
-    Effect.map(({ projects: projectSnapshot, threads: shellSnapshot }) => ({
+    Effect.map(({ projects: projectSnapshot, threadCount }) => ({
       projectCount: projectSnapshot.projects.length,
-      threadCount: shellSnapshot.threads.length + shellSnapshot.archivedThreads.length,
+      threadCount,
     })),
     Effect.catch((cause) =>
       Effect.logWarning("failed to gather V2 startup counts for telemetry", {
@@ -279,8 +279,7 @@ const resolveAutoBootstrapWelcomeTargets = Effect.gen(function* () {
       title: path.basename(serverConfig.cwd) || "project",
       workspaceRoot: serverConfig.cwd,
     });
-    const shell = yield* threads.getShellSnapshot();
-    const existingThread = shell.threads.find(
+    const existingThread = (yield* threads.listActiveShellIndex()).find(
       (thread) =>
         thread.projectId === project.id && thread.lineage.relationshipToParent !== "subagent",
     );
diff --git a/apps/server/src/ws.test.ts b/apps/server/src/ws.test.ts
index bce9450778736..2c6adce82f390 100644
--- a/apps/server/src/ws.test.ts
+++ b/apps/server/src/ws.test.ts
@@ -412,12 +412,23 @@ it.effect("shell snapshots omit idle children and older settled threads only on
         Effect.flatMap((stream) => stream.pipe(Stream.take(1), Stream.runCollect)),
         Effect.map(([item]) => (item?.kind === "snapshot" ? item.snapshot : null)),
         Effect.provideService(ThreadManagement.ThreadManagementService, {
-          readShellSnapshot: () =>
+          listActiveShellIndex: () =>
+            Effect.succeed(
+              threads.map((thread) => ({
+                ...thread,
+                pinnedAt: null,
+                snoozedUntil: null,
+                mayBeLive: thread.activityRunStatus !== null,
+              })),
+            ),
+          readShellSnapshot: (options?: { readonly threadIds?: ReadonlyArray<string> }) =>
             Effect.succeed(
               Effect.succeed({
                 schemaVersion: 1,
                 snapshotSequence: 0,
-                threads,
+                threads: threads.filter(
+                  (thread) => options?.threadIds?.includes(thread.id) ?? true,
+                ),
                 archivedThreads: [],
               }),
             ),
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 86c7a4db56af4..a7ef5dedf24fb 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -124,7 +124,6 @@ import * as ScheduledTasks from "./scheduledTasks/ScheduledTaskService.ts";
 import * as SecretRequests from "./secrets/SecretRequests.ts";
 import * as GuestShareService from "./guest/GuestShareService.ts";
 import {
-  buildActiveShellSnapshot,
   bufferShellLiveStream,
   coalesceShellApplicationEvents,
   composeShellStreamWithEnrichment,
@@ -134,7 +133,7 @@ import {
   shellStreamItemFromEnrichmentRefresh,
   shellStreamItemFromThreadShell,
   shellStreamItemsFromInitialSnapshot,
-  shellSnapshotForSubscriber,
+  loadSubscriberShellSnapshot,
   shellStreamItemsFromResumeSnapshot,
   shouldPublishShellApplicationEvent,
   skipUnchangedThreadShells,
@@ -1010,21 +1009,23 @@ export const subscribeOrchestrationV2Shell = Effect.fn("ws.orchestrationV2.subsc
       },
     );
     const loadSnapshot = Effect.fn("ws.orchestrationV2.loadShellSnapshot")(function* () {
-      const base = buildActiveShellSnapshot(
-        yield* loadShellSnapshotParts({
-          sql,
-          readThreads: threadManagement.readShellSnapshot({ location: "active" }),
-          listProjects: projects.listShells(),
-          latestSequence: applicationEvents.latestApplicationSequence,
-        }),
-      );
-      const forSubscriber = shellSnapshotForSubscriber(base, {
-        omitIdleSubagents: input.omitIdleSubagents === true,
-        omitOlderSettled: input.omitOlderSettled === true,
-        now: yield* DateTime.now,
+      const forSubscriber = yield* loadSubscriberShellSnapshot({
+        sql,
+        listShellIndex: threadManagement.listActiveShellIndex(),
+        readThreads: (threadIds) =>
+          threadManagement.readShellSnapshot({
+            location: "active",
+            ...(threadIds === undefined ? {} : { threadIds }),
+          }),
+        listProjects: projects.listShells(),
+        latestSequence: applicationEvents.latestApplicationSequence,
+        options: {
+          omitIdleSubagents: input.omitIdleSubagents === true,
+          omitOlderSettled: input.omitOlderSettled === true,
+        },
       });
       subagentThreadIds = forSubscriber.subagentThreadIds;
-      const enriched = yield* enrichProjectShells(base.projects);
+      const enriched = yield* enrichProjectShells(forSubscriber.snapshot.projects);
       return {
         snapshot: {
           ...forSubscriber.snapshot,

From 22c37a8da4567d59b0759396dd5412b28da9ab4a Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:23:56 -0700
Subject: [PATCH 105/146] perf(server): preparing a run is 15x faster and uses
 200x less memory (#27105)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../orchestration-v2/ThreadLaunchService.ts   | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadLaunchService.ts b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
index 5c51b8c48b859..b68eef4b2a40c 100644
--- a/apps/server/src/orchestration-v2/ThreadLaunchService.ts
+++ b/apps/server/src/orchestration-v2/ThreadLaunchService.ts
@@ -1063,12 +1063,14 @@ const make = Effect.gen(function* () {
     "ThreadLaunchService.prepareRun",
   )(function* (input) {
     const scheduled = yield* Effect.gen(function* () {
-      const projection = yield* threads.getThreadProjection(input.threadId);
-      const run = projection.runs.find((candidate) => candidate.id === input.runId);
+      const { thread, runs } = yield* threads.getThreadRecords(input.threadId, ["runs"], {
+        runIds: [input.runId],
+      });
+      const run = runs.find((candidate) => candidate.id === input.runId);
       const workspacePreparation = run?.workspacePreparation;
       if (run?.status !== "preparing" || workspacePreparation === undefined) return;
       if (!(yield* reservePreparation(input.commandId))) return;
-      yield* scheduleRunPreparation(input, projection, run, workspacePreparation).pipe(
+      yield* scheduleRunPreparation(input, thread, run, workspacePreparation).pipe(
         Effect.onError(() => releasePreparation(input.commandId)),
       );
     }).pipe(Effect.exit);
@@ -1090,30 +1092,33 @@ const make = Effect.gen(function* () {
     return dispatched;
   });
 
-  const scheduleRunPreparation = (
+  const scheduleRunPreparation = Effect.fn("ThreadLaunchService.scheduleRunPreparation")(function* (
     input: ThreadLaunchPreparationInput,
-    projection: OrchestrationV2ThreadProjection,
+    thread: OrchestrationV2ThreadProjection["thread"],
     run: OrchestrationV2ThreadProjection["runs"][number],
     workspacePreparation: ThreadLaunchWorkspaceStrategy,
-  ) => {
-    const message = projection.messages.find((candidate) => candidate.id === run.userMessageId);
+  ) {
+    const { messages } = yield* threads.getThreadRecords(input.threadId, ["messages"], {
+      messageIds: [run.userMessageId],
+    });
+    const message = messages.find((candidate) => candidate.id === run.userMessageId);
     const reuse =
       workspacePreparation.type === "worktree" &&
-      projection.thread.worktreePath !== null &&
-      projection.thread.branch !== null
+      thread.worktreePath !== null &&
+      thread.branch !== null
         ? {
             strategy: {
               type: "existing_worktree" as const,
-              worktreePath: projection.thread.worktreePath,
-              branch: projection.thread.branch,
+              worktreePath: thread.worktreePath,
+              branch: thread.branch,
             },
             reusedWorktree: { baseRef: workspacePreparation.baseRef },
           }
         : null;
-    return schedulePreparation(
+    return yield* schedulePreparation(
       {
         commandId: input.commandId,
-        projectId: projection.thread.projectId,
+        projectId: thread.projectId,
         workspaceStrategy: reuse?.strategy ?? workspacePreparation,
         ...(reuse === null ? {} : { reusedWorktree: reuse.reusedWorktree }),
         ...(message === undefined
@@ -1129,7 +1134,7 @@ const make = Effect.gen(function* () {
       input.threadId,
       run.id,
     );
-  };
+  });
 
   return ThreadLaunchService.of({ launch, checkWorktreeBase, retryPreparation, prepareRun });
 });

From 2f4da5de4e6ce094da698e969dfa245f6891d8f4 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:28:21 -0700
Subject: [PATCH 106/146] =?UTF-8?q?feat(server):=20traces=20name=20what=20?=
 =?UTF-8?q?grew=20the=20heap,=20for=20~0.3=C2=B5s=20per=20span=20(#27104)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/observability/HeapAttribution.test.ts |  69 +++++++++++
 .../src/observability/HeapAttribution.ts      | 108 ++++++++++++++++++
 .../server/src/observability/Observability.ts |   6 +-
 3 files changed, 182 insertions(+), 1 deletion(-)
 create mode 100644 apps/server/src/observability/HeapAttribution.test.ts
 create mode 100644 apps/server/src/observability/HeapAttribution.ts

diff --git a/apps/server/src/observability/HeapAttribution.test.ts b/apps/server/src/observability/HeapAttribution.test.ts
new file mode 100644
index 0000000000000..b355ba5c35e1f
--- /dev/null
+++ b/apps/server/src/observability/HeapAttribution.test.ts
@@ -0,0 +1,69 @@
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Context from "effect/Context";
+import * as TestClock from "effect/testing/TestClock";
+import * as Tracer from "effect/Tracer";
+
+import * as HeapAttribution from "./HeapAttribution.ts";
+
+const MB = 1024 * 1024;
+
+it.effect("names the span that grew the heap in a spike, not an older open or ended one", () =>
+  Effect.gen(function* () {
+    const ended: Array<Tracer.NativeSpan> = [];
+    const inner = Tracer.make({
+      span(options) {
+        const span = new Tracer.NativeSpan(options);
+        const end = span.end.bind(span);
+        span.end = (endTime, exit) => {
+          end(endTime, exit);
+          ended.push(span);
+        };
+        return span;
+      },
+    });
+    let heap = 300 * MB;
+    const attribution = yield* HeapAttribution.make(inner, () => heap);
+    yield* attribution.run;
+    // The sampler's baseline: heap before the spans allocate.
+    yield* TestClock.adjust("1 second");
+    const open = (name: string) =>
+      attribution.tracer.span({
+        name,
+        parent: Option.none(),
+        annotations: Context.empty(),
+        links: [],
+        startTime: 0n,
+        kind: "internal",
+        root: false,
+        sampled: true,
+      });
+
+    const subscription = open("ws.rpc.orchestration.subscribeShell");
+    const old = open("ProjectionStore.getSnapshot");
+    // Slow drift never spikes, but leaves the long-lived span far above its start.
+    for (let step = 0; step < 5; step++) {
+      heap += 80 * MB;
+      yield* TestClock.adjust("11 seconds");
+      if (step === 1) old.end(1n, undefined as never);
+    }
+    const small = open("ProjectionStore.getThreadShell");
+    const big = open("ProjectionStore.getThreadProjection");
+    heap += 2 * MB;
+    small.end(1n, undefined as never);
+    heap += 198 * MB;
+    yield* TestClock.adjust("2 seconds");
+
+    const spike = ended.find((span) => span.name === "server.heap.spike");
+    assert.isDefined(spike);
+    assert.deepEqual(spike!.attributes.get("suspects"), [
+      "ProjectionStore.getThreadProjection +200 MB",
+    ]);
+    big.end(2n, undefined as never);
+    subscription.end(3n, undefined as never);
+    assert.equal(big.attributes.get("memory.heap_growth_bytes"), 200 * MB);
+    assert.isUndefined(small.attributes.get("memory.heap_growth_bytes"));
+    assert.equal(old.attributes.get("memory.heap_growth_bytes"), 160 * MB);
+  }),
+);
diff --git a/apps/server/src/observability/HeapAttribution.ts b/apps/server/src/observability/HeapAttribution.ts
new file mode 100644
index 0000000000000..4b18efd0fb911
--- /dev/null
+++ b/apps/server/src/observability/HeapAttribution.ts
@@ -0,0 +1,108 @@
+// @effect-diagnostics nodeBuiltinImport:off - only node:v8 exposes a heap reading cheap enough to take per span.
+import * as NodeV8 from "node:v8";
+
+import * as Effect from "effect/Effect";
+import type * as Scope from "effect/Scope";
+import * as Tracer from "effect/Tracer";
+
+const MB = 1024 * 1024;
+// Smaller growth is noise from concurrent fibers; an attribute on every span would bloat exports.
+const SPAN_GROWTH_ATTRIBUTE_BYTES = 8 * MB;
+const SPIKE_GROWTH_BYTES = 128 * MB;
+const SPIKE_WINDOW_SAMPLES = 10;
+const SPIKE_COOLDOWN_SAMPLES = 60;
+const RECENT_SPANS = 32;
+const REPORTED_SPANS = 8;
+
+const readHeapUsed = () => NodeV8.getHeapStatistics().used_heap_size;
+
+interface Growth {
+  readonly name: string;
+  readonly growthBytes: number;
+}
+
+/**
+ * Heap growth is approximate: it includes other fibers' allocations and GC, so it names
+ * suspects, not culprits. A spike lists what was open or just grew.
+ */
+export const make = (tracer: Tracer.Tracer, heapUsed: () => number = readHeapUsed) =>
+  Effect.sync(() => {
+    const open = new Map<
+      Tracer.Span,
+      { readonly name: string; readonly startHeap: number; readonly startTick: number }
+    >();
+    const recent: Array<Growth & { readonly endTick: number }> = [];
+    const samples: Array<number> = [];
+    let cooldown = 0;
+    let tick = 0;
+
+    const wrapped = Tracer.make({
+      ...(tracer.context === undefined ? {} : { context: tracer.context }),
+      span(options) {
+        const span = tracer.span(options);
+        const startHeap = heapUsed();
+        open.set(span, { name: options.name, startHeap, startTick: tick });
+        const end = span.end.bind(span);
+        span.end = (endTime, exit) => {
+          open.delete(span);
+          const growthBytes = heapUsed() - startHeap;
+          if (growthBytes >= SPAN_GROWTH_ATTRIBUTE_BYTES) {
+            span.attribute("memory.heap_growth_bytes", growthBytes);
+            recent.push({ name: options.name, growthBytes, endTick: tick });
+            if (recent.length > RECENT_SPANS) recent.shift();
+          }
+          end(endTime, exit);
+        };
+        return span;
+      },
+    });
+
+    // Untraced: it runs every second and only emits a span when the heap spikes.
+    const sample = Effect.fnUntraced(function* () {
+      const heap = heapUsed();
+      tick++;
+      samples.push(heap);
+      if (samples.length > SPIKE_WINDOW_SAMPLES) samples.shift();
+      if (cooldown > 0) {
+        cooldown--;
+        return;
+      }
+      const growthBytes = heap - Math.min(...samples);
+      if (growthBytes < SPIKE_GROWTH_BYTES) return;
+      cooldown = SPIKE_COOLDOWN_SAMPLES;
+      const suspects = [
+        // Spans open since before the window, such as subscriptions, would claim all of its growth.
+        ...[...open.values()]
+          .filter(({ startTick }) => tick - startTick <= samples.length)
+          .map(({ name, startHeap }) => ({ name, growthBytes: heap - startHeap })),
+        ...recent.filter(({ endTick }) => tick - endTick <= samples.length),
+      ]
+        .filter((suspect) => suspect.growthBytes >= SPAN_GROWTH_ATTRIBUTE_BYTES)
+        .toSorted((left, right) => right.growthBytes - left.growthBytes)
+        .slice(0, REPORTED_SPANS)
+        .map(({ name, growthBytes }) => `${name} +${Math.round(growthBytes / MB)} MB`);
+      recent.length = 0;
+      // A span, not a log: this fiber starts before the server logger is provided.
+      yield* Effect.void.pipe(
+        Effect.withSpan("server.heap.spike", {
+          root: true,
+          level: "Warn",
+          attributes: {
+            heapUsedMb: Math.round(heap / MB),
+            growthMb: Math.round(growthBytes / MB),
+            suspects,
+          },
+        }),
+      );
+    });
+
+    const run: Effect.Effect<void, never, Scope.Scope> = sample().pipe(
+      Effect.andThen(Effect.sleep("1 second")),
+      Effect.forever,
+      Effect.withTracer(wrapped),
+      Effect.forkScoped,
+      Effect.asVoid,
+    );
+
+    return { tracer: wrapped, run };
+  });
diff --git a/apps/server/src/observability/Observability.ts b/apps/server/src/observability/Observability.ts
index 343851e3d1d11..166d8ac194a8c 100644
--- a/apps/server/src/observability/Observability.ts
+++ b/apps/server/src/observability/Observability.ts
@@ -16,6 +16,7 @@ import * as ServerConfig from "../config.ts";
 import * as ResourceAttribution from "../resourceTelemetry/ResourceAttribution.ts";
 import * as ServerLogger from "../serverLogger.ts";
 import * as BrowserTraceCollector from "./BrowserTraceCollector.ts";
+import * as HeapAttribution from "./HeapAttribution.ts";
 
 export const layer = Layer.unwrap(
   Effect.gen(function* () {
@@ -71,8 +72,11 @@ export const layer = Layer.unwrap(
           ...(delegate ? { delegate } : {}),
         });
 
+        const heapAttribution = yield* HeapAttribution.make(tracer);
+        yield* heapAttribution.run;
+
         return Layer.mergeAll(
-          Layer.succeed(Tracer.Tracer, tracer),
+          Layer.succeed(Tracer.Tracer, heapAttribution.tracer),
           BrowserTraceCollector.layer(sink),
         );
       }),

From 52f4ec6f9420abc8f4c033528f95397fd2716f0b Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:35:12 -0700
Subject: [PATCH 107/146] perf(gitcafe): PR sync makes 2x fewer GitCafe
 requests for unchanged PRs (#27100)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../server/GitCafePullRequestProvider.test.ts | 69 +++++++++++++------
 .../src/server/GitCafePullRequestProvider.ts  | 63 +++++++++++++----
 2 files changed, 97 insertions(+), 35 deletions(-)

diff --git a/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts b/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts
index 7c257f037003e..113a388e853bb 100644
--- a/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts
+++ b/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.test.ts
@@ -1226,43 +1226,70 @@ describe("GitCafePullRequestProvider", () => {
 
   it.effect("recounts summary lines only when the compared commits move", () => {
     const landedBase = "fedcba9876543210fedcba9876543210fedcba98";
+    const mainTip = "0123012301230123012301230123012301230123";
     let comparisonBaseOid = baseOid;
+    let tips = { targetBranch: "main", observedBaseOid: baseOid };
     let pullReads = 0;
+    let listingCut = true;
+    let hunksDown = false;
+    const hunks = (request: SentRequest) => ({
+      version: 4,
+      headOid,
+      comparisonBaseOid,
+      items: (request.body as { paths: ReadonlyArray<string> }).paths.map((path) => ({
+        path,
+        additions: comparisonBaseOid === baseOid ? 3 : 1,
+        deletions: 1,
+      })),
+    });
     const server = fakeGitCafe({
       // A comment moves the version without moving the compared commits.
-      "GET /repos/owner/repo/pulls/7": () => ({ ...pull, version: 4 + pullReads++ }),
-      "GET /repos/owner/repo/pulls/7/changes": () => ({
-        version: 4,
-        headOid,
-        comparisonBaseOid,
-        items: [{ path: "a.ts" }, { path: "b.ts" }],
-        next: null,
-      }),
-      "POST /repos/owner/repo/pulls/7/diff-files": (request: SentRequest) => ({
+      "GET /repos/owner/repo/pulls/7": () => ({ ...pull, ...tips, version: 4 + pullReads++ }),
+      "GET /repos/owner/repo/pulls/7/changes": (request: SentRequest) => ({
         version: 4,
         headOid,
         comparisonBaseOid,
-        items: (request.body as { paths: ReadonlyArray<string> }).paths.map((path) => ({
-          path,
-          additions: comparisonBaseOid === baseOid ? 3 : 1,
-          deletions: 1,
-        })),
+        ...(!listingCut
+          ? { items: [{ path: "a.ts" }, { path: "b.ts" }], next: null }
+          : request.query.has("after")
+            ? { items: [], next: "more" }
+            : { items: [{ path: "a.ts" }], next: "more" }),
       }),
+      get "POST /repos/owner/repo/pulls/7/diff-files"() {
+        return hunksDown
+          ? new Response(encodeJson({ type: "https://cafe.sh/errors/conflict" }), { status: 409 })
+          : hunks;
+      },
     });
-    const hunkReads = () =>
-      server.sent.filter((request) => request.path.endsWith("/diff-files")).length;
+    const reads = (suffix: string) =>
+      server.sent.filter((request) => request.path.endsWith(suffix)).length;
     return Effect.gen(function* () {
       const provider = yield* GitCafePullRequestProvider.make;
+      // A listing that stops before its last page holds nothing for its commits.
+      yield* provider.getChangeRequestSummary!(target);
+      listingCut = false;
+      hunksDown = true;
+      // Unread hunks leave the lines unknown, and are read again next time.
+      const unread = yield* provider.getChangeRequestSummary!(target);
+      assert.strictEqual(unread.additions, undefined);
+      hunksDown = false;
       const first = yield* provider.getChangeRequestSummary!(target);
       const second = yield* provider.getChangeRequestSummary!(target);
       assert.deepInclude(first, { additions: 6, deletions: 2, changedFiles: 2 });
       assert.deepInclude(second, { additions: 6, deletions: 2, changedFiles: 2 });
-      assert.strictEqual(hunkReads(), 1);
-      // A landed parent layer moves the comparison base under the same head.
-      comparisonBaseOid = landedBase;
+      // Neither the head nor the target tip moved, so the file list is not read again.
+      assert.deepStrictEqual([reads("/changes"), reads("/diff-files")], [4, 3]);
+      // The target branch advancing keeps the merge base, so only the file list is read.
+      tips = { ...tips, observedBaseOid: mainTip };
       const third = yield* provider.getChangeRequestSummary!(target);
-      assert.deepInclude(third, { additions: 2, deletions: 2, changedFiles: 2 });
-      assert.strictEqual(hunkReads(), 2);
+      assert.deepInclude(third, { additions: 6, deletions: 2, changedFiles: 2 });
+      assert.deepStrictEqual([reads("/changes"), reads("/diff-files")], [5, 3]);
+      // A landed parent layer retargets the pull and moves the comparison base under the same head.
+      comparisonBaseOid = landedBase;
+      tips = { targetBranch: "trunk", observedBaseOid: mainTip };
+      const fourth = yield* provider.getChangeRequestSummary!(target);
+      assert.deepInclude(fourth, { additions: 2, deletions: 2, changedFiles: 2 });
+      assert.deepStrictEqual([reads("/changes"), reads("/diff-files")], [6, 4]);
     }).pipe(Effect.provide(server.layer));
   });
 
diff --git a/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.ts b/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.ts
index 1d4b7338f3c12..e87a4e154d69b 100644
--- a/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.ts
+++ b/packages/source-control-gitcafe/src/server/GitCafePullRequestProvider.ts
@@ -636,11 +636,19 @@ export const make = Effect.gen(function* () {
   // so hunk totals are held per compared pair of commits. The file list that names the pair is
   // cheap; a retarget or a landed parent layer moves the base without moving the head.
   const lineTotals = new Map<string, { readonly additions: number; readonly deletions: number }>();
+  // The compared pair follows from the head and the target tip the pull reports, so while neither
+  // moves the stats are reused without listing the files again.
+  const statsByTips = new Map<
+    string,
+    { readonly changedFiles: number; readonly additions?: number; readonly deletions?: number }
+  >();
+  const remember = <K, V>(cache: Map<K, V>, key: K, value: V) => {
+    if (cache.size >= LINE_STATS_CACHE_SIZE) cache.delete(cache.keys().next().value!);
+    cache.set(key, value);
+  };
 
-  const readLineStats = Effect.fn("GitCafePullRequestProvider.readLineStats")(function* (
-    input: PullRef,
-    version: number,
-  ) {
+  // readLineStats owns the span.
+  const countLines = Effect.fnUntraced(function* (input: PullRef, version: number) {
     const path = yield* pullPath("getChangeRequest", input);
     const files: Array<Json.GitCafeDiffFile> = [];
     let revision: { version: number; headOid: string; baseOid: string } | undefined;
@@ -667,13 +675,23 @@ export const make = Effect.gen(function* () {
       after = batch.next;
       if (after === null || after === previous || batch.items.length === 0) break;
     }
-    if (revision === undefined) return { changedFiles: 0, additions: 0, deletions: 0 };
+    if (revision === undefined)
+      return {
+        headOid: null,
+        complete: true,
+        stats: { changedFiles: 0, additions: 0, deletions: 0 },
+      };
     const key = `${input.host} ${input.repository.toLowerCase()} ${input.number} ${revision.baseOid} ${revision.headOid}`;
     const held = lineTotals.get(key);
-    if (held !== undefined) return { changedFiles: files.length, ...held };
+    const { headOid } = revision;
+    // A listing that stopped before its last page counts only part of the diff, so nothing is held.
+    const listed = after === null;
+    if (held !== undefined)
+      return { headOid, complete: listed, stats: { changedFiles: files.length, ...held } };
+    const tooMany = files.length > LINE_STATS_MAX_FILES;
     const details = files.some((file) => file.additions !== undefined)
       ? Option.some(files)
-      : files.length > LINE_STATS_MAX_FILES
+      : tooMany
         ? Option.none()
         : yield* Effect.forEach(
             chunk(detailablePaths(files), DIFF_FILES_BATCH),
@@ -684,16 +702,33 @@ export const make = Effect.gen(function* () {
             Effect.option,
           );
     // Unread hunks leave the lines unknown rather than zero; the file count still stands.
-    if (Option.isNone(details)) return { changedFiles: files.length };
+    if (Option.isNone(details))
+      return { headOid, complete: listed && tooMany, stats: { changedFiles: files.length } };
     const counted = details.value;
     const totals = {
       additions: counted.reduce((total, file) => total + (file.additions ?? 0), 0),
       deletions: counted.reduce((total, file) => total + (file.deletions ?? 0), 0),
     };
-    if (lineTotals.size >= LINE_STATS_CACHE_SIZE)
-      lineTotals.delete(lineTotals.keys().next().value!);
-    lineTotals.set(key, totals);
-    return { changedFiles: files.length, ...totals };
+    if (listed) remember(lineTotals, key, totals);
+    return { headOid, complete: listed, stats: { changedFiles: files.length, ...totals } };
+  });
+
+  const readLineStats = Effect.fn("GitCafePullRequestProvider.readLineStats")(function* (
+    input: PullRef,
+    pull: Json.GitCafePullDetail,
+  ) {
+    const tipsKey =
+      pull.headOid === null || pull.observedBaseOid == null
+        ? null
+        : `${input.host} ${input.repository.toLowerCase()} ${input.number} ${pull.targetBranch} ${pull.observedBaseOid} ${pull.headOid}`;
+    const heldStats = tipsKey === null ? undefined : statsByTips.get(tipsKey);
+    if (heldStats !== undefined) return heldStats;
+    const stats = yield* countLines(input, pull.version);
+    // A failed hunk read is retried next time rather than held as unknown, and a head that moved
+    // between the two reads would hold another pair's stats.
+    if (tipsKey !== null && stats.complete && stats.headOid === pull.headOid)
+      remember(statsByTips, tipsKey, stats.stats);
+    return stats.stats;
   });
 
   const merge = Effect.fn("GitCafePullRequestProvider.merge")(function* (
@@ -870,7 +905,7 @@ export const make = Effect.gen(function* () {
         const changes =
           pull.headOid === null
             ? null
-            : yield* readLineStats(input, pull.version).pipe(Effect.orElseSucceed(() => null));
+            : yield* readLineStats(input, pull).pipe(Effect.orElseSucceed(() => null));
         // A count that could not be read is absent rather than zero.
         const {
           additions: _additions,
@@ -904,7 +939,7 @@ export const make = Effect.gen(function* () {
               ),
           pull.headOid === null
             ? Effect.succeed(null)
-            : readLineStats(input, pull.version).pipe(Effect.orElseSucceed(() => null)),
+            : readLineStats(input, pull).pipe(Effect.orElseSucceed(() => null)),
           // Reviewers need `pr:review:read`, which a contents-only token lacks.
           readPages("getChangeRequest", input, `${path}/reviewers`, Json.GitCafeActorEntries).pipe(
             // @effect-diagnostics-next-line catchConditionalRefailToCatchIf:off - catchIf widens this paginated result to any in tsc-rs.

From facaa08b36c5511108752aa08d48182c37412ce4 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:38:31 -0700
Subject: [PATCH 108/146] perf(shared): SQLite reads stop queueing behind each
 other, up to 5x faster under load (#27097)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 packages/shared/src/nodeSqliteClient.test.ts |  40 ++++
 packages/shared/src/nodeSqliteClient.ts      | 232 ++++++++++++-------
 2 files changed, 183 insertions(+), 89 deletions(-)

diff --git a/packages/shared/src/nodeSqliteClient.test.ts b/packages/shared/src/nodeSqliteClient.test.ts
index 99eb8b37a215b..ac786993fa0bf 100644
--- a/packages/shared/src/nodeSqliteClient.test.ts
+++ b/packages/shared/src/nodeSqliteClient.test.ts
@@ -238,6 +238,27 @@ it.effect("lets the writer commit while a read-only transaction is open", () =>
   ),
 );
 
+it.effect("serves another read while a read-only transaction is open", () =>
+  withReaderClient((sql) =>
+    Effect.gen(function* () {
+      const opened = yield* Deferred.make<void>();
+      const other = yield* Effect.forkChild(
+        Deferred.await(opened).pipe(Effect.andThen(countEntries(sql).pipe(SqliteClient.readOnly))),
+      );
+      yield* sql
+        .withTransaction(
+          Effect.gen(function* () {
+            yield* countEntries(sql);
+            yield* Deferred.succeed(opened, undefined);
+            // One shared reader would make this join wait on the transaction forever.
+            assert.equal(yield* Fiber.join(other), 1);
+          }),
+        )
+        .pipe(SqliteClient.readOnly);
+    }),
+  ),
+);
+
 // regression: #19226 read-only transactions run on the separate reader connection
 it.effect("rejects a write in a read-only transaction", () =>
   withReaderClient((sql) =>
@@ -333,6 +354,25 @@ it.effect("uses the writer when the reader cannot open the database", () =>
 
       assert.equal(yield* sql.withTransaction(countEntries(sql)).pipe(SqliteClient.readOnly), 1);
       assert.equal(yield* sql.withTransaction(countEntries(sql)).pipe(SqliteClient.readOnly), 1);
+
+      // A read beside an open read transaction must not start a worker on the next slot.
+      const held = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      const holder = yield* sql
+        .withTransaction(
+          countEntries(sql).pipe(
+            Effect.andThen(Deferred.succeed(held, undefined)),
+            Effect.andThen(Deferred.await(release)),
+          ),
+        )
+        .pipe(SqliteClient.readOnly, Effect.forkChild);
+      yield* Deferred.await(held);
+      const other = yield* countEntries(sql).pipe(SqliteClient.readOnly, (effect) =>
+        Effect.forkChild(effect, { startImmediately: true }),
+      );
+      yield* Deferred.succeed(release, undefined);
+      yield* Fiber.join(holder);
+      assert.equal(yield* Fiber.join(other), 1);
       assert.equal(startedWorkers.length, startedBefore + 1);
     }),
   ),
diff --git a/packages/shared/src/nodeSqliteClient.ts b/packages/shared/src/nodeSqliteClient.ts
index a42943c065ac0..c0edfdb868d1f 100644
--- a/packages/shared/src/nodeSqliteClient.ts
+++ b/packages/shared/src/nodeSqliteClient.ts
@@ -293,8 +293,14 @@ const failed = (cause: unknown, message: string, operation: string) =>
 // Read-transaction cleanup succeeds after worker exit because it can no longer change anything.
 const endsReadTransaction = (sql: string) => /^\s*ROLLBACK\b|^\s*COMMIT\b/i.test(sql);
 
+// WAL readers run concurrently; one worker serialized every read behind the slowest transaction.
+const READER_POOL_SIZE = 4;
+
 // Bind transactions to one worker; fail after its exit instead of resuming outside the transaction on a replacement.
-const makeReader = Effect.fnUntraced(function* (options: SqliteClientConfig) {
+const makeReader = Effect.fnUntraced(function* (
+  options: SqliteClientConfig,
+  pool: { unavailable: boolean },
+) {
   let current:
     | {
         readonly worker: NodeWorkerThreads.Worker;
@@ -302,7 +308,6 @@ const makeReader = Effect.fnUntraced(function* (options: SqliteClientConfig) {
         readonly started: Promise<ReaderStartup>;
       }
     | undefined;
-  let unavailable = false;
   let nextRequestId = 0;
 
   const start = () => {
@@ -439,8 +444,8 @@ const makeReader = Effect.fnUntraced(function* (options: SqliteClientConfig) {
         void reader.worker.terminate();
       }
       // @effect-diagnostics-next-line effectSucceedWithVoid:off - The connection result distinguishes undefined from void.
-      if (unavailable) return Effect.succeed(undefined);
-      unavailable = true;
+      if (pool.unavailable) return Effect.succeed(undefined);
+      pool.unavailable = true;
       return Effect.logWarning("SQLite reader worker unavailable; reads use the main connection", {
         reason,
       }).pipe(Effect.as(undefined));
@@ -448,7 +453,7 @@ const makeReader = Effect.fnUntraced(function* (options: SqliteClientConfig) {
 
   return Effect.suspend((): Effect.Effect<Connection | undefined> => {
     // @effect-diagnostics-next-line effectSucceedWithVoid:off - The connection result distinguishes undefined from void.
-    if (unavailable) return Effect.succeed(undefined);
+    if (pool.unavailable) return Effect.succeed(undefined);
     let reader: NonNullable<typeof current>;
     try {
       reader = current ?? start();
@@ -467,7 +472,7 @@ const makeReader = Effect.fnUntraced(function* (options: SqliteClientConfig) {
       }),
       (startup): Effect.Effect<Connection | undefined> =>
         // A late ready event must not hand out a worker retired by another acquire timeout.
-        unavailable || current !== reader
+        pool.unavailable || current !== reader
           ? // @effect-diagnostics-next-line effectSucceedWithVoid:off - The connection result distinguishes undefined from void.
             Effect.succeed(undefined)
           : Option.isSome(startup) && startup.value.type === "ready"
@@ -1073,21 +1078,48 @@ const make = Effect.fn("makeWithDatabase")(function* (
 
   const semaphore = yield* Semaphore.make(1);
   const connection = yield* makeConnection;
-  const acquireReader =
-    options.readerWorker && isFileDatabase ? yield* makeReader(options) : undefined;
-  const readerSemaphore = yield* Semaphore.make(1);
+  // A reader that cannot start turns off the whole pool, so routing never picks a dead slot.
+  const readerPool = { unavailable: false };
+  const readers =
+    options.readerWorker && isFileDatabase
+      ? yield* Effect.forEach(Array.from({ length: READER_POOL_SIZE }), () =>
+          Effect.map(
+            Effect.all([makeReader(options, readerPool), Semaphore.make(1)]),
+            ([acquire, lock]) => ({
+              acquire,
+              lock,
+              claims: 0,
+            }),
+          ),
+        )
+      : [];
 
   const writer = { name: "writer" as const, lock: semaphore, connection };
   let activeWriter: ConnectionOwner | undefined;
-  const route = Effect.withFiber((fiber) =>
-    acquireReader !== undefined && Context.get(fiber.context, ReadOnly)
-      ? Effect.map(acquireReader, (readerConnection) =>
+  // Callers must run route uninterruptibly and pass `claimed` a finalizer that runs `release` once.
+  const route = (claimed: (release: Effect.Effect<void>) => Effect.Effect<void>) =>
+    Effect.withFiber((fiber) => {
+      if (readers.length === 0 || readerPool.unavailable || !Context.get(fiber.context, ReadOnly)) {
+        return Effect.succeed(writer);
+      }
+      // Least claimed wins and ties go to the lowest slot, so idle slots never start a worker.
+      let slot = readers[0]!;
+      for (const candidate of readers) if (candidate.claims < slot.claims) slot = candidate;
+      slot.claims++;
+      const reader = slot;
+      return Effect.andThen(
+        claimed(
+          Effect.sync(() => {
+            reader.claims--;
+          }),
+        ),
+        Effect.map(reader.acquire, (readerConnection) =>
           readerConnection === undefined
             ? writer
-            : { name: "reader" as const, lock: readerSemaphore, connection: readerConnection },
-        )
-      : Effect.succeed(writer),
-  );
+            : { name: "reader" as const, lock: reader.lock, connection: readerConnection },
+        ),
+      );
+    });
 
   const acquired = (
     target: { readonly name: Acquired["connection"] },
@@ -1101,88 +1133,110 @@ const make = Effect.fn("makeWithDatabase")(function* (
   const writerBorrowBatchSize = 16;
   let writerBorrowsSinceYield = 0;
   const borrower: Borrower = (use) =>
-    Effect.flatMap(route, (target) =>
-      Effect.withFiber((fiber) => {
-        const clock = fiber.getRef(Clock.Clock);
-        const start = clock.monotonicTimeNanosUnsafe();
-        const ownerAtWaitStart = target.name === "writer" ? activeWriter : undefined;
-        const owner = target.name === "writer" ? connectionOwner(fiber) : undefined;
-        const useConnection = Effect.suspend(() => {
-          if (target.name === "writer") activeWriter = owner;
-          if (
-            fiber.getRef(References.TracerEnabled) &&
-            fiber.getRef(Statement.SpanPropagationEnabled)
-          ) {
-            annotateAcquired(fiber, acquired(target, clock, start), ownerAtWaitStart);
-          }
-          return use(target.connection);
-        });
-        const useOwnedConnection =
-          target.name === "writer"
-            ? Effect.onExit(useConnection, () =>
-                Effect.sync(() => {
-                  if (activeWriter === owner) activeWriter = undefined;
-                }),
-              )
-            : useConnection;
-        if (!options.checkpointWorker || target.name !== "writer") {
-          return target.lock.withPermits(1)(useOwnedConnection);
-        }
-        const writerUse = Effect.onExit(useOwnedConnection, (exit) =>
-          Effect.sync(() => {
-            writerBorrowsSinceYield = Exit.hasInterrupts(exit)
-              ? 0
-              : Math.min(writerBorrowsSinceYield + 1, writerBorrowBatchSize);
-          }),
-        );
-        return Effect.flatMap(target.lock.withPermitsIfAvailable(1)(writerUse), (result) =>
-          Option.isSome(result)
-            ? Effect.succeed(result.value)
-            : target.lock.withPermits(1)(
-                Effect.andThen(
-                  // Failed SQL also consumes the batch; cancellation hands off immediately.
-                  Effect.suspend(() => {
-                    if (writerBorrowsSinceYield < writerBorrowBatchSize) return Effect.void;
-                    writerBorrowsSinceYield = 0;
-                    return Effect.callback<void>((resume) => {
-                      const immediate = setImmediate(() => resume(Effect.void));
-                      return Effect.sync(() => clearImmediate(immediate));
-                    });
-                  }),
-                  writerUse,
-                ),
-              ),
-        );
-      }),
-    );
-  const transactionAcquirer = Effect.flatMap(route, (target) =>
     Effect.uninterruptibleMask((restore) => {
-      const fiber = Fiber.getCurrent()!;
-      const scope = Context.getUnsafe(fiber.context, Scope.Scope);
+      let release: Effect.Effect<void> = Effect.void;
+      const claimed = (next: Effect.Effect<void>) =>
+        Effect.sync(() => {
+          release = next;
+        });
+      return Effect.flatMap(route(claimed), (target) => restore(borrowTarget(target, use))).pipe(
+        Effect.ensuring(Effect.suspend(() => release)),
+      );
+    });
+  const borrowTarget = <A, E, R>(
+    target: {
+      readonly name: Acquired["connection"];
+      readonly lock: Semaphore.Semaphore;
+      readonly connection: Connection;
+    },
+    use: (connection: Connection) => Effect.Effect<A, E, R>,
+  ): Effect.Effect<A, E, R> =>
+    Effect.withFiber((fiber) => {
       const clock = fiber.getRef(Clock.Clock);
       const start = clock.monotonicTimeNanosUnsafe();
-      const pending = fiber.getRef(TransactionAcquire);
       const ownerAtWaitStart = target.name === "writer" ? activeWriter : undefined;
       const owner = target.name === "writer" ? connectionOwner(fiber) : undefined;
-      const acquire = Effect.tap((pending?.restore ?? restore)(target.lock.take(1)), () => {
+      const useConnection = Effect.suspend(() => {
         if (target.name === "writer") activeWriter = owner;
-        if (pending !== undefined) {
-          pending.acquired = acquired(target, clock, start);
-          pending.ownerAtWaitStart = ownerAtWaitStart;
+        if (
+          fiber.getRef(References.TracerEnabled) &&
+          fiber.getRef(Statement.SpanPropagationEnabled)
+        ) {
+          annotateAcquired(fiber, acquired(target, clock, start), ownerAtWaitStart);
         }
-        return Scope.addFinalizer(
-          scope,
-          Effect.sync(() => {
-            if (target.name === "writer" && activeWriter === owner) activeWriter = undefined;
-          }).pipe(Effect.andThen(target.lock.release(1))),
-        );
+        return use(target.connection);
       });
-      return Effect.as(
-        // A scheduler yield after taking the permit must not precede its release finalizer.
-        Effect.provideService(acquire, Scheduler.PreventSchedulerYield, true),
-        target.connection,
+      const useOwnedConnection =
+        target.name === "writer"
+          ? Effect.onExit(useConnection, () =>
+              Effect.sync(() => {
+                if (activeWriter === owner) activeWriter = undefined;
+              }),
+            )
+          : useConnection;
+      if (!options.checkpointWorker || target.name !== "writer") {
+        return target.lock.withPermits(1)(useOwnedConnection);
+      }
+      const writerUse = Effect.onExit(useOwnedConnection, (exit) =>
+        Effect.sync(() => {
+          writerBorrowsSinceYield = Exit.hasInterrupts(exit)
+            ? 0
+            : Math.min(writerBorrowsSinceYield + 1, writerBorrowBatchSize);
+        }),
       );
-    }),
+      return Effect.flatMap(target.lock.withPermitsIfAvailable(1)(writerUse), (result) =>
+        Option.isSome(result)
+          ? Effect.succeed(result.value)
+          : target.lock.withPermits(1)(
+              Effect.andThen(
+                // Failed SQL also consumes the batch; cancellation hands off immediately.
+                Effect.suspend(() => {
+                  if (writerBorrowsSinceYield < writerBorrowBatchSize) return Effect.void;
+                  writerBorrowsSinceYield = 0;
+                  return Effect.callback<void>((resume) => {
+                    const immediate = setImmediate(() => resume(Effect.void));
+                    return Effect.sync(() => clearImmediate(immediate));
+                  });
+                }),
+                writerUse,
+              ),
+            ),
+      );
+    });
+  const claimedUntilScopeCloses = (release: Effect.Effect<void>) =>
+    Effect.withFiber((fiber) =>
+      Scope.addFinalizer(Context.getUnsafe(fiber.context, Scope.Scope), release),
+    );
+  const transactionAcquirer = Effect.uninterruptible(route(claimedUntilScopeCloses)).pipe(
+    Effect.flatMap((target) =>
+      Effect.uninterruptibleMask((restore) => {
+        const fiber = Fiber.getCurrent()!;
+        const scope = Context.getUnsafe(fiber.context, Scope.Scope);
+        const clock = fiber.getRef(Clock.Clock);
+        const start = clock.monotonicTimeNanosUnsafe();
+        const pending = fiber.getRef(TransactionAcquire);
+        const ownerAtWaitStart = target.name === "writer" ? activeWriter : undefined;
+        const owner = target.name === "writer" ? connectionOwner(fiber) : undefined;
+        const acquire = Effect.tap((pending?.restore ?? restore)(target.lock.take(1)), () => {
+          if (target.name === "writer") activeWriter = owner;
+          if (pending !== undefined) {
+            pending.acquired = acquired(target, clock, start);
+            pending.ownerAtWaitStart = ownerAtWaitStart;
+          }
+          return Scope.addFinalizer(
+            scope,
+            Effect.sync(() => {
+              if (target.name === "writer" && activeWriter === owner) activeWriter = undefined;
+            }).pipe(Effect.andThen(target.lock.release(1))),
+          );
+        });
+        return Effect.as(
+          // A scheduler yield after taking the permit must not precede its release finalizer.
+          Effect.provideService(acquire, Scheduler.PreventSchedulerYield, true),
+          target.connection,
+        );
+      }),
+    ),
   );
 
   const client = yield* Client.make({

From 7c29f2d20be6d26ed3914cc4e075681ad1aa5db2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:39:24 -0700
Subject: [PATCH 109/146] perf(server): git status runs in parallel and repo
 detection spawns 3x fewer git processes (#27103)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriver.test.ts      |  18 +++
 apps/server/src/vcs/GitVcsDriver.ts           |  46 +++++--
 apps/server/src/vcs/GitVcsDriverCore.ts       | 120 ++++++++++--------
 apps/server/src/vcs/VcsDriverRegistry.test.ts |  14 +-
 apps/server/src/vcs/VcsProcess.ts             |   3 +-
 .../src/vcs/VcsStatusBroadcaster.test.ts      |  48 ++++++-
 apps/server/src/vcs/VcsStatusBroadcaster.ts   |  25 +++-
 7 files changed, 194 insertions(+), 80 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriver.test.ts b/apps/server/src/vcs/GitVcsDriver.test.ts
index c7a06c3bdc31f..88ca1eed8f5ea 100644
--- a/apps/server/src/vcs/GitVcsDriver.test.ts
+++ b/apps/server/src/vcs/GitVcsDriver.test.ts
@@ -1006,6 +1006,24 @@ it.effect("GitVcsDriver treats a missing git executable as outside any repositor
   }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
 );
 
+it.effect.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+  "GitVcsDriver detects a repository whose path contains a newline",
+  () =>
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const parent = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-newline-repo-" });
+      const cwd = path.join(parent, "multi\nline");
+      yield* fileSystem.makeDirectory(cwd);
+      yield* runGit(cwd, ["init"]);
+      const driver = yield* GitVcsDriver.makeVcsDriverShape();
+
+      const repository = yield* driver.detectRepository(cwd);
+      assert.strictEqual(repository?.rootPath, yield* fileSystem.realPath(cwd));
+      assert.strictEqual(repository?.metadataPath, ".git");
+    }).pipe(Effect.scoped, Effect.provide(layerGitContract)),
+);
+
 it.effect.skipIf(HostProcess.Platform.defaultValue() === "win32")(
   "GitVcsDriver still fails detection when git exists but cannot be spawned",
   () =>
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index acbf817462c12..95833200a1b5f 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -587,25 +587,43 @@ export const makeVcsDriverShape = Effect.fn("makeGitVcsDriverShape")(function* (
   const detectRepository: VcsDriver.VcsDriver["Service"]["detectRepository"] = Effect.fn(
     "detectRepository",
   )(function* (cwd) {
-    if (!(yield* isInsideWorkTree(cwd))) {
-      return null;
-    }
-
-    const root = yield* gitCommand(vcsProcess, "GitVcsDriver.detectRepository.root", cwd, [
-      "rev-parse",
-      "--show-toplevel",
-    ]);
-    const gitCommonDir = yield* gitCommand(
+    // One spawn answers all three; outside a work tree it exits non-zero or prints "false".
+    const result = yield* gitCommand(
       vcsProcess,
-      "GitVcsDriver.detectRepository.commonDir",
+      "GitVcsDriver.detectRepository",
       cwd,
-      ["rev-parse", "--git-common-dir"],
-    ).pipe(Effect.orElseSucceed(() => null));
+      ["rev-parse", "--is-inside-work-tree", "--show-toplevel", "--git-common-dir"],
+      {
+        allowNonZeroExit: true,
+        timeoutMs: 5_000,
+        maxOutputBytes: 16_384,
+      },
+    ).pipe(Effect.catchIf(isMissingExecutable, () => Effect.succeed(null)));
+    if (result === null || result.exitCode !== 0) return null;
+    const lines = result.stdout.replace(/\r?\n$/u, "").split(/\r?\n/u);
+    if (lines[0]?.trim() !== "true") return null;
+    // A newline inside a path breaks the line framing; ask for each path on its own.
+    if (lines.length !== 3) {
+      const root = yield* gitCommand(vcsProcess, "GitVcsDriver.detectRepository", cwd, [
+        "rev-parse",
+        "--show-toplevel",
+      ]);
+      const gitCommonDir = yield* gitCommand(vcsProcess, "GitVcsDriver.detectRepository", cwd, [
+        "rev-parse",
+        "--git-common-dir",
+      ]).pipe(Effect.orElseSucceed(() => null));
+      return {
+        kind: "git" as const,
+        rootPath: root.stdout.trim(),
+        metadataPath: gitCommonDir?.stdout.trim() || null,
+        freshness: yield* nowFreshness(),
+      };
+    }
 
     return {
       kind: "git" as const,
-      rootPath: root.stdout.trim(),
-      metadataPath: gitCommonDir?.stdout.trim() || null,
+      rootPath: lines[1]!.trim(),
+      metadataPath: lines[2]!.trim() || null,
       freshness: yield* nowFreshness(),
     };
   });
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index c486c6744cb5f..03f0286ce50d7 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -2091,7 +2091,11 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
         return yield* lockError;
       }
     }
-    const statusResult = yield* executeGitWithStableDiagnostics(
+    const repositoryPaths = yield* resolveRepositoryPaths(cwd).pipe(
+      Effect.catchTags({ GitCommandError: () => Effect.succeed(null) }),
+    );
+    const statusCacheKey = repositoryPaths?.gitCommonDir;
+    const readStatus = executeGitWithStableDiagnostics(
       "GitVcsDriver.statusDetails.status",
       cwd,
       statusArgs,
@@ -2105,34 +2109,10 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
           isMissingGitCwdError(error) ? Effect.succeed(null) : Effect.fail(error),
       }),
     );
-
-    if (statusResult === null) {
-      return NON_REPOSITORY_STATUS_DETAILS;
-    }
-
-    if (statusResult.exitCode !== 0) {
-      if (isNonRepositoryGitStderr(statusResult.stderr)) {
-        return NON_REPOSITORY_STATUS_DETAILS;
-      }
-      return yield* new GitCommandError({
-        ...gitCommandContext({
-          operation: "GitVcsDriver.statusDetails.status",
-          cwd,
-          args: statusArgs,
-        }),
-        detail: "Git status failed.",
-        exitCode: statusResult.exitCode,
-        stdoutLength: statusResult.stdout.length,
-        stderrLength: statusResult.stderr.length,
-      });
-    }
-
-    const repositoryPaths = yield* resolveRepositoryPaths(cwd).pipe(
-      Effect.catchTags({ GitCommandError: () => Effect.succeed(null) }),
-    );
-    const statusCacheKey = repositoryPaths?.gitCommonDir;
-    const [numstatEntries, defaultBranch, hasPrimaryRemote] = yield* Effect.all(
+    // diff-index does not read status output, so both spawn together; a non-repository discards it.
+    const [statusResult, numstatResult, defaultBranch, hasPrimaryRemote] = yield* Effect.all(
       [
+        readStatus,
         // Porcelain diff rewrites indexes despite GIT_OPTIONAL_LOCKS=0; plumbing with -M preserves rename detection.
         executeGitWithStableDiagnostics(
           "GitVcsDriver.statusDetails.numstat",
@@ -2178,6 +2158,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
               }),
             );
           }),
+          Effect.result,
         ),
         statusCacheKey
           ? Cache.get(defaultBranchCache, statusCacheKey).pipe(Effect.orElseSucceed(() => null))
@@ -2188,6 +2169,28 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       ],
       { concurrency: "unbounded" },
     );
+    if (statusResult === null) {
+      return NON_REPOSITORY_STATUS_DETAILS;
+    }
+
+    if (statusResult.exitCode !== 0) {
+      if (isNonRepositoryGitStderr(statusResult.stderr)) {
+        return NON_REPOSITORY_STATUS_DETAILS;
+      }
+      return yield* new GitCommandError({
+        ...gitCommandContext({
+          operation: "GitVcsDriver.statusDetails.status",
+          cwd,
+          args: statusArgs,
+        }),
+        detail: "Git status failed.",
+        exitCode: statusResult.exitCode,
+        stdoutLength: statusResult.stdout.length,
+        stderrLength: statusResult.stderr.length,
+      });
+    }
+
+    const numstatEntries = yield* Effect.fromResult(numstatResult);
     const statusStdout = statusResult.stdout;
 
     let refName: string | null = null;
@@ -2231,25 +2234,34 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       }
     }
 
-    const fallbackAheadCount =
-      includeDivergence && !upstreamRef && refName
-        ? yield* computeAheadCountAgainstBase(cwd, refName).pipe(Effect.orElseSucceed(() => 0))
-        : null;
-
-    if (fallbackAheadCount !== null) {
-      aheadCount = fallbackAheadCount;
-      behindCount = 0;
-    }
-
     const isDefaultBranch =
       refName !== null &&
       (refName === defaultBranch ||
         (defaultBranch === null && (refName === "main" || refName === "master")));
-    if (includeDivergence && refName && !isDefaultBranch) {
-      aheadOfDefaultCount =
-        fallbackAheadCount !== null
-          ? fallbackAheadCount
-          : yield* computeAheadCountAgainstBase(cwd, refName).pipe(Effect.orElseSucceed(() => 0));
+    const needsFallbackAhead = includeDivergence && !upstreamRef && refName !== null;
+    const needsAheadOfDefault = includeDivergence && refName !== null && !isDefaultBranch;
+    const [baseAheadCount, branchChanges] = yield* Effect.all(
+      [
+        refName !== null && (needsFallbackAhead || needsAheadOfDefault)
+          ? computeAheadCountAgainstBase(cwd, refName, {
+              knownOriginDefaultBranch: defaultBranch,
+            }).pipe(Effect.orElseSucceed(() => 0))
+          : Effect.succeed(0),
+        options?.includeBranchChanges
+          ? readBranchChangeTotals(repositoryPaths?.worktreeRoot ?? cwd, refName, {
+              knownOriginDefaultBranch: defaultBranch,
+            }).pipe(Effect.orElseSucceed(() => undefined))
+          : Effect.undefined,
+      ],
+      { concurrency: "unbounded" },
+    );
+
+    if (needsFallbackAhead) {
+      aheadCount = baseAheadCount;
+      behindCount = 0;
+    }
+    if (needsAheadOfDefault) {
+      aheadOfDefaultCount = baseAheadCount;
     }
 
     const fileStatMap = new Map<string, { insertions: number; deletions: number }>();
@@ -2276,12 +2288,6 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     }
     files.sort((a, b) => a.path.localeCompare(b.path));
 
-    const branchChanges = options?.includeBranchChanges
-      ? yield* readBranchChangeTotals(repositoryPaths?.worktreeRoot ?? cwd, refName).pipe(
-          Effect.orElseSucceed(() => undefined),
-        )
-      : undefined;
-
     return {
       isRepo: true,
       hasOriginRemote: hasPrimaryRemote,
@@ -3014,6 +3020,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     cwd: string,
     branch: string | null,
     explicitBaseRef?: string,
+    knownOriginDefaultBranch: string | null = null,
   ) {
     const base =
       explicitBaseRef !== undefined
@@ -3025,9 +3032,10 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
                 : explicitBaseRef,
           })
         : branch
-          ? yield* resolveBaseBranchForNoUpstream(cwd, branch, { allowRemoteOfCurrent: true }).pipe(
-              Effect.orElseSucceed(() => null),
-            )
+          ? yield* resolveBaseBranchForNoUpstream(cwd, branch, {
+              allowRemoteOfCurrent: true,
+              knownOriginDefaultBranch,
+            }).pipe(Effect.orElseSucceed(() => null))
           : null;
     if (base === null) return { baseRef: null, mergeBase: "HEAD" };
     const { baseRef, comparisonRef } = base;
@@ -3058,8 +3066,14 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
   const readBranchChangeTotals = Effect.fn("readBranchChangeTotals")(function* (
     cwd: string,
     branch: string | null,
+    options?: { readonly knownOriginDefaultBranch: string | null },
   ) {
-    const { baseRef, mergeBase } = yield* resolveReviewMergeBase(cwd, branch);
+    const { baseRef, mergeBase } = yield* resolveReviewMergeBase(
+      cwd,
+      branch,
+      undefined,
+      options?.knownOriginDefaultBranch ?? null,
+    );
     const untracked = yield* prepareUntrackedReviewIndex(cwd, []);
     if (untracked === null) {
       return yield* new GitCommandError({
diff --git a/apps/server/src/vcs/VcsDriverRegistry.test.ts b/apps/server/src/vcs/VcsDriverRegistry.test.ts
index e5c8169774830..b6f7dae813744 100644
--- a/apps/server/src/vcs/VcsDriverRegistry.test.ts
+++ b/apps/server/src/vcs/VcsDriverRegistry.test.ts
@@ -21,6 +21,8 @@ const processOutput = (stdout: string): VcsProcess.VcsProcessOutput => ({
 const normalizeGitArgs = (args: ReadonlyArray<string>): ReadonlyArray<string> =>
   args[0] === "-C" && args.length >= 2 ? args.slice(2) : args;
 
+const DETECT_COMMAND = "rev-parse --is-inside-work-tree --show-toplevel --git-common-dir";
+
 describe("VcsDriverRegistry", () => {
   const makeDiskBackedLayer = (rootDir: string, calls: string[]) =>
     Layer.effect(VcsDriverRegistry.VcsDriverRegistry, VcsDriverRegistry.make).pipe(
@@ -49,10 +51,10 @@ describe("VcsDriverRegistry", () => {
                   stderr: "fatal: not a git repository",
                 };
               }
-              if (command === "rev-parse --is-inside-work-tree") return processOutput("true\n");
-              if (command === "rev-parse --show-toplevel") return processOutput(`${repoDir}\n`);
-              if (command === "rev-parse --git-common-dir") {
-                return processOutput(`${path.relative(input.cwd, path.join(repoDir, ".git"))}\n`);
+              if (command === DETECT_COMMAND) {
+                return processOutput(
+                  `true\n${repoDir}\n${path.relative(input.cwd, path.join(repoDir, ".git"))}\n`,
+                );
               }
               return processOutput("");
             }).pipe(Effect.provide(NodeServices.layer), Effect.orDie),
@@ -75,7 +77,7 @@ describe("VcsDriverRegistry", () => {
         yield* fs.remove(path.join(repoDir, ".git"), { recursive: true });
 
         assert.equal(yield* registry.detect({ cwd: repoDir }), null);
-        assert.equal(calls.filter((call) => call === "rev-parse --is-inside-work-tree").length, 2);
+        assert.equal(calls.filter((call) => call === DETECT_COMMAND).length, 2);
       }).pipe(Effect.provide(makeDiskBackedLayer(repoDir, calls)));
     }).pipe(Effect.provide(NodeServices.layer)),
   );
@@ -118,7 +120,7 @@ describe("VcsDriverRegistry", () => {
         yield* fs.makeDirectory(path.join(repoDir, ".git"));
 
         assert.equal((yield* registry.detect({ cwd: repoDir }))?.repository.rootPath, repoDir);
-        assert.equal(calls.filter((call) => call === "rev-parse --is-inside-work-tree").length, 2);
+        assert.equal(calls.filter((call) => call === DETECT_COMMAND).length, 2);
       }).pipe(Effect.provide(makeDiskBackedLayer(repoDir, calls)));
     }).pipe(Effect.provide(NodeServices.layer)),
   );
diff --git a/apps/server/src/vcs/VcsProcess.ts b/apps/server/src/vcs/VcsProcess.ts
index e2055e3400531..00218397481ff 100644
--- a/apps/server/src/vcs/VcsProcess.ts
+++ b/apps/server/src/vcs/VcsProcess.ts
@@ -83,8 +83,7 @@ const gitMetricOperations = new Set([
   "GitVcsDriver.checkpoints.resolveGitCommonDir",
   "GitVcsDriver.checkpoints.resolveHeadCommit",
   "GitVcsDriver.checkpoints.restoreCheckpoint",
-  "GitVcsDriver.detectRepository.commonDir",
-  "GitVcsDriver.detectRepository.root",
+  "GitVcsDriver.detectRepository",
   "GitVcsDriver.filterIgnoredPaths",
   "GitVcsDriver.initRepository",
   "GitVcsDriver.isInsideWorkTree",
diff --git a/apps/server/src/vcs/VcsStatusBroadcaster.test.ts b/apps/server/src/vcs/VcsStatusBroadcaster.test.ts
index cc1b6d24e3873..042f8274543e5 100644
--- a/apps/server/src/vcs/VcsStatusBroadcaster.test.ts
+++ b/apps/server/src/vcs/VcsStatusBroadcaster.test.ts
@@ -76,6 +76,7 @@ function layerTestFor(state: {
   backgroundWorkEnabled?: boolean;
   automaticFetchInterval?: Effect.Effect<Duration.Duration>;
   beforeRemoteStatus?: Effect.Effect<void>;
+  beforeLocalStatus?: Effect.Effect<void>;
   fileSystem?: FileSystem.FileSystem;
   pullCurrentBranch?: GitWorkflowService.GitWorkflowService["Service"]["pullCurrentBranch"];
 }) {
@@ -95,9 +96,11 @@ function layerTestFor(state: {
     Layer.provide(
       Layer.mock(GitWorkflowService.GitWorkflowService)({
         localStatus: () =>
-          Effect.sync(() => {
+          Effect.suspend(() => {
             state.localStatusCalls += 1;
-            return state.currentLocalStatus;
+            return (state.beforeLocalStatus ?? Effect.void).pipe(
+              Effect.as(state.currentLocalStatus),
+            );
           }),
         currentBranch: () => Effect.sync(() => state.currentLocalStatus.refName),
         remoteStatus: (_input, options) =>
@@ -163,6 +166,47 @@ function layerBackgroundPolicy(shouldRunScopeWork: (scope: BackgroundScope) => b
 }
 
 describe("VcsStatusBroadcaster", () => {
+  it.effect("refreshes queued behind a running one share the next git status read", () => {
+    const state: Parameters<typeof layerTestFor>[0] = {
+      currentLocalStatus: baseLocalStatus,
+      currentRemoteStatus: baseRemoteStatus,
+      localStatusCalls: 0,
+      remoteStatusCalls: 0,
+      localInvalidationCalls: 0,
+      remoteInvalidationCalls: 0,
+      fileSystem: FileSystem.makeNoop({ realPath: (cwd) => Effect.succeed(cwd) }),
+    };
+
+    return Effect.gen(function* () {
+      const broadcaster = yield* VcsStatusBroadcaster.VcsStatusBroadcaster;
+      const started = yield* Deferred.make<void>();
+      const release = yield* Deferred.make<void>();
+      state.beforeLocalStatus = Deferred.succeed(started, undefined).pipe(
+        Effect.andThen(Deferred.await(release)),
+      );
+      const running = yield* broadcaster
+        .refreshLocalStatus("/repo")
+        .pipe(Effect.forkScoped({ startImmediately: true }));
+      yield* Deferred.await(started);
+      // Requested while the first read runs, so that read may predate their change.
+      state.currentLocalStatus = { ...baseLocalStatus, hasWorkingTreeChanges: true };
+      const queued = yield* Effect.all(
+        [broadcaster.refreshLocalStatus("/repo"), broadcaster.refreshLocalStatus("/repo")],
+        { concurrency: "unbounded" },
+      ).pipe(Effect.forkScoped({ startImmediately: true }));
+      yield* Deferred.succeed(release, undefined);
+
+      assert.isFalse((yield* Fiber.join(running)).hasWorkingTreeChanges);
+      const [second, third] = yield* Fiber.join(queued);
+      assert.isTrue(second.hasWorkingTreeChanges);
+      assert.isTrue(third.hasWorkingTreeChanges);
+      assert.strictEqual(state.localStatusCalls, 2);
+
+      yield* broadcaster.refreshLocalStatus("/repo");
+      assert.strictEqual(state.localStatusCalls, 3);
+    }).pipe(Effect.provide(layerTestFor(state)), Effect.scoped);
+  });
+
   it.effect("publishes a terminal branch switch without reading remote status", () => {
     const state = {
       currentLocalStatus: baseLocalStatus,
diff --git a/apps/server/src/vcs/VcsStatusBroadcaster.ts b/apps/server/src/vcs/VcsStatusBroadcaster.ts
index 8ce1b225d123d..a8839d0c1cd0c 100644
--- a/apps/server/src/vcs/VcsStatusBroadcaster.ts
+++ b/apps/server/src/vcs/VcsStatusBroadcaster.ts
@@ -359,11 +359,30 @@ export const make = Effect.gen(function* () {
     );
   });
 
+  // A refresh that started after a request saw every change that request could mean, so queued
+  // callers share it instead of each running git status again.
+  const localRefreshLocks = yield* KeyedLock.make<string>();
+  const localRefreshRequests = new Map<string, number>();
+  const localRefreshResults = new Map<
+    string,
+    { readonly startedAt: number; readonly local: VcsStatusLocalResult }
+  >();
   const refreshLocalStatusCore = Effect.fn("VcsStatusBroadcaster.refreshLocalStatusCore")(
     function* (cwd: string) {
-      yield* workflow.invalidateLocalStatus(cwd);
-      const local = yield* workflow.localStatus({ cwd });
-      return yield* updateCachedLocalStatus(cwd, local, { publish: true });
+      const requestedAt = (localRefreshRequests.get(cwd) ?? 0) + 1;
+      localRefreshRequests.set(cwd, requestedAt);
+      return yield* localRefreshLocks.withLock(
+        cwd,
+        Effect.gen(function* () {
+          const shared = localRefreshResults.get(cwd);
+          if (shared !== undefined && shared.startedAt >= requestedAt) return shared.local;
+          const startedAt = localRefreshRequests.get(cwd) ?? requestedAt;
+          yield* workflow.invalidateLocalStatus(cwd);
+          const local = yield* workflow.localStatus({ cwd });
+          localRefreshResults.set(cwd, { startedAt, local });
+          return yield* updateCachedLocalStatus(cwd, local, { publish: true });
+        }),
+      );
     },
   );
 

From 65b0ab8c91c1d2c6495460f13b91166c57068076 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:42:47 -0700
Subject: [PATCH 110/146] fix(client): dead connection routes are probed 30x
 less often (#27101)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../client-runtime/src/connection/driver.ts   |  18 +--
 .../src/connection/registry.test.ts           |   6 +-
 .../src/connection/supervisor.test.ts         | 135 +++++++++++++++++-
 .../src/connection/supervisor.ts              |  66 ++++++++-
 4 files changed, 208 insertions(+), 17 deletions(-)

diff --git a/packages/client-runtime/src/connection/driver.ts b/packages/client-runtime/src/connection/driver.ts
index 0fd08c63364e7..2cdf012187efb 100644
--- a/packages/client-runtime/src/connection/driver.ts
+++ b/packages/client-runtime/src/connection/driver.ts
@@ -40,6 +40,8 @@ export interface EnvironmentConnectionLease {
 }
 
 export type RouteCheck = "answered" | "silent" | "unchecked";
+/** "unprepared" means the route answered its check but could not be prepared. */
+export type RoutePreflight = "ready" | "unprepared" | "silent" | "unchecked";
 
 const ROUTE_CHECK_TIMEOUT_MS = 2_500;
 // Preferred direct routes share one head start, so a relay connection does not
@@ -57,7 +59,7 @@ export class ConnectionDriver extends Context.Service<
     readonly preflight: (
       entry: ConnectionCatalogEntry,
       route: ConnectionRoute,
-    ) => Effect.Effect<boolean>;
+    ) => Effect.Effect<RoutePreflight>;
     /** Asks the host behind a live session to answer a fresh request on the session's own origin. */
     readonly checkHost: (prepared: PreparedConnection) => Effect.Effect<RouteCheck>;
   }
@@ -204,13 +206,13 @@ export const make = Effect.gen(function* () {
       ? Effect.succeed("silent" as const)
       : checkRoute(entry, route)
     ).pipe(
-      Effect.flatMap((check) =>
-        check === "answered"
-          ? resolver.prepare(routeEntry(entry, route)).pipe(
-              Effect.as(true),
-              Effect.orElseSucceed(() => false),
-            )
-          : Effect.succeed(false),
+      Effect.filterOrElse(
+        (check): check is Exclude<RouteCheck, "answered"> => check !== "answered",
+        () =>
+          resolver.prepare(routeEntry(entry, route)).pipe(
+            Effect.as<RoutePreflight>("ready"),
+            Effect.orElseSucceed((): RoutePreflight => "unprepared"),
+          ),
       ),
       Effect.withSpan("ConnectionDriver.preflight"),
     );
diff --git a/packages/client-runtime/src/connection/registry.test.ts b/packages/client-runtime/src/connection/registry.test.ts
index c99e950200b23..ec8863949cef7 100644
--- a/packages/client-runtime/src/connection/registry.test.ts
+++ b/packages/client-runtime/src/connection/registry.test.ts
@@ -431,7 +431,11 @@ const makeHarness = Effect.fn("TestEnvironmentRegistry.makeHarness")(function* (
         ),
       ),
     preflight: (_entry, route) =>
-      checkRoute(route).pipe(Effect.map((check) => check === "answered")),
+      checkRoute(route).pipe(
+        Effect.map((check): ConnectionDriver.RoutePreflight =>
+          check === "answered" ? "ready" : check,
+        ),
+      ),
     checkHost: () => Effect.succeed<ConnectionDriver.RouteCheck>("unchecked"),
   });
 
diff --git a/packages/client-runtime/src/connection/supervisor.test.ts b/packages/client-runtime/src/connection/supervisor.test.ts
index 347bde9cc44c8..66d151043b115 100644
--- a/packages/client-runtime/src/connection/supervisor.test.ts
+++ b/packages/client-runtime/src/connection/supervisor.test.ts
@@ -148,6 +148,7 @@ const makeHarness = Effect.fn("TestConnectionHarness.make")(function* (options?:
   readonly initialConfig?: (attempt: number) => Effect.Effect<ServerConfig, ConnectionAttemptError>;
   readonly checkRoute?: (route: ConnectionRoute) => Effect.Effect<ConnectionDriver.RouteCheck>;
   readonly checkHost?: (prepared: PreparedConnection) => Effect.Effect<ConnectionDriver.RouteCheck>;
+  readonly preflight?: (route: ConnectionRoute) => Effect.Effect<ConnectionDriver.RoutePreflight>;
   readonly inboundFrames?: Effect.Effect<number>;
 }) {
   const networkStatus = yield* SubscriptionRef.make<NetworkStatus>(
@@ -244,7 +245,12 @@ const makeHarness = Effect.fn("TestConnectionHarness.make")(function* (options?:
       ConnectionDriver.ConnectionDriver.of({
         connect,
         preflight: (_entry, route) =>
-          checkRoute(route).pipe(Effect.map((check) => check === "answered")),
+          options?.preflight?.(route) ??
+          checkRoute(route).pipe(
+            Effect.map((check): ConnectionDriver.RoutePreflight =>
+              check === "answered" ? "ready" : check,
+            ),
+          ),
         checkHost: (prepared) =>
           options?.checkHost?.(prepared) ??
           Effect.succeed<ConnectionDriver.RouteCheck>("unchecked"),
@@ -1614,6 +1620,133 @@ describe("EnvironmentSupervisor routes", () => {
     }),
   );
 
+  it.effect("checks a dead LAN route less often until the network changes", () =>
+    Effect.gen(function* () {
+      const lanReachable = yield* Ref.make(false);
+      const lanChecks = yield* Ref.make(0);
+      const harness = yield* makeHarness({
+        checkRoute: (route) =>
+          route.target._tag === "BearerConnectionTarget"
+            ? Ref.update(lanChecks, (count) => count + 1).pipe(
+                Effect.andThen(Ref.get(lanReachable)),
+                Effect.map((reachable) => (reachable ? "answered" : "silent")),
+              )
+            : Effect.succeed("unchecked"),
+        prepare: (_attempt, target) => Effect.succeed(preparedFor(target)),
+      });
+      const supervisor = yield* EnvironmentSupervisor.make(LAN_THEN_RELAY_ENTRY, {
+        initiallyDesired: true,
+      }).pipe(Effect.provide(harness.dependencies));
+
+      yield* awaitState(
+        supervisor.state,
+        (state) => state.phase === "connected" && state.generation === 1,
+      );
+      yield* Ref.set(lanChecks, 0);
+
+      // Checked at 1, 3 and 7 minutes instead of every minute.
+      for (let minute = 0; minute < 10; minute += 1) {
+        yield* TestClock.adjust("60 seconds");
+      }
+      expect(yield* Ref.get(lanChecks)).toBe(3);
+
+      yield* Ref.set(lanReachable, true);
+      yield* harness.wake("network-changed");
+      yield* awaitState(
+        supervisor.state,
+        (state) => state.phase === "connected" && state.generation === 2,
+      );
+      expect(Option.getOrThrow(yield* SubscriptionRef.get(supervisor.prepared)).target._tag).toBe(
+        "BearerConnectionTarget",
+      );
+    }),
+  );
+
+  it.effect("keeps checking a LAN route every minute when it answers but cannot be prepared", () =>
+    Effect.gen(function* () {
+      const lanPreflights = yield* Ref.make(0);
+      const harness = yield* makeHarness({
+        checkRoute: (route) =>
+          Effect.succeed(route.target._tag === "BearerConnectionTarget" ? "silent" : "unchecked"),
+        preflight: (route) =>
+          route.target._tag === "BearerConnectionTarget"
+            ? Ref.update(lanPreflights, (count) => count + 1).pipe(Effect.as("unprepared" as const))
+            : Effect.succeed("unchecked"),
+        prepare: (_attempt, target) => Effect.succeed(preparedFor(target)),
+      });
+      const supervisor = yield* EnvironmentSupervisor.make(LAN_THEN_RELAY_ENTRY, {
+        initiallyDesired: true,
+      }).pipe(Effect.provide(harness.dependencies));
+
+      yield* awaitState(
+        supervisor.state,
+        (state) => state.phase === "connected" && state.generation === 1,
+      );
+      for (let minute = 0; minute < 10; minute += 1) {
+        yield* TestClock.adjust("60 seconds");
+      }
+      expect(yield* Ref.get(lanPreflights)).toBe(10);
+    }),
+  );
+
+  it.effect("ignores a dead LAN check that was running when the network changed", () =>
+    Effect.gen(function* () {
+      const lanChecks = yield* Ref.make(0);
+      const checkStarted = yield* Deferred.make<void>();
+      const finishCheck = yield* Deferred.make<void>();
+      const woke = yield* Ref.make(false);
+      const wakeupHandled = yield* Deferred.make<void>();
+      const harness = yield* makeHarness({
+        checkRoute: (route) =>
+          route.target._tag === "BearerConnectionTarget"
+            ? Ref.updateAndGet(lanChecks, (count) => count + 1).pipe(
+                Effect.flatMap((check) =>
+                  check === 1
+                    ? Effect.succeed("silent" as const)
+                    : check === 2
+                      ? Deferred.succeed(checkStarted, undefined).pipe(
+                          Effect.andThen(Deferred.await(finishCheck)),
+                          Effect.as("silent" as const),
+                        )
+                      : Effect.succeed("answered" as const),
+                ),
+              )
+            : Effect.succeed("unchecked"),
+        prepare: (_attempt, target) => Effect.succeed(preparedFor(target)),
+        // The wakeup probes the session only after it forgets the silent routes.
+        probe: () =>
+          Ref.get(woke).pipe(
+            Effect.flatMap((afterWake) =>
+              afterWake ? Deferred.succeed(wakeupHandled, undefined) : Effect.void,
+            ),
+            Effect.asVoid,
+          ),
+      });
+      const supervisor = yield* EnvironmentSupervisor.make(LAN_THEN_RELAY_ENTRY, {
+        initiallyDesired: true,
+      }).pipe(Effect.provide(harness.dependencies));
+
+      yield* awaitState(
+        supervisor.state,
+        (state) => state.phase === "connected" && state.generation === 1,
+      );
+      yield* TestClock.adjust("60 seconds");
+      yield* Deferred.await(checkStarted);
+      yield* Ref.set(woke, true);
+      yield* harness.wake("network-changed");
+      yield* Deferred.await(wakeupHandled);
+      yield* Deferred.succeed(finishCheck, undefined);
+
+      yield* awaitState(
+        supervisor.state,
+        (state) => state.phase === "connected" && state.generation === 2,
+      );
+      expect(Option.getOrThrow(yield* SubscriptionRef.get(supervisor.prepared)).target._tag).toBe(
+        "BearerConnectionTarget",
+      );
+    }),
+  );
+
   it.effect("moves off a dead LAN socket when the phone switches to cellular", () =>
     Effect.gen(function* () {
       const lanReachable = yield* Ref.make(true);
diff --git a/packages/client-runtime/src/connection/supervisor.ts b/packages/client-runtime/src/connection/supervisor.ts
index ce7632df0f52b..212381921961b 100644
--- a/packages/client-runtime/src/connection/supervisor.ts
+++ b/packages/client-runtime/src/connection/supervisor.ts
@@ -58,7 +58,11 @@ const SILENT_SOCKET_RECHECK_EVERY = "1 second";
 // instead of timing out.
 const REMOTE_SILENT_SOCKET_AFTER = "2500 millis";
 const BACKOFF_RESET_AFTER_MS = 30_000;
-const BETTER_ROUTE_CHECK_INTERVAL = "60 seconds";
+const BETTER_ROUTE_CHECK_INTERVAL_MS = 60_000;
+// Each check of a dead route can wait out the full probe timeout, so a route
+// that keeps failing is checked half as often each time, until the network
+// changes and it may answer again.
+const SILENT_ROUTE_BACKOFF_MAX_MS = 1_800_000;
 // A better route that answered the check but then failed to connect is not
 // tried again for this long, so a flaky LAN cannot bounce the connection.
 const BETTER_ROUTE_COOLDOWN_MS = 300_000;
@@ -139,6 +143,20 @@ function retryDelayMs(failureCount: number, random: number): number {
   return Math.round(ceiling / 2 + (ceiling / 2) * random);
 }
 
+interface SilentRoute {
+  readonly failures: number;
+  readonly until: bigint;
+}
+
+function backOffSilentRoute(previous: SilentRoute | undefined, now: bigint): SilentRoute {
+  const failures = (previous?.failures ?? 0) + 1;
+  const delayMs = Math.min(
+    SILENT_ROUTE_BACKOFF_MAX_MS,
+    BETTER_ROUTE_CHECK_INTERVAL_MS * 2 ** failures,
+  );
+  return { failures, until: now + BigInt(delayMs) * 1_000_000n };
+}
+
 function annotateTarget(target: ConnectionTarget) {
   return Effect.annotateCurrentSpan({
     "environment.id": target.environmentId,
@@ -288,6 +306,16 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
   const currentRoutes = Ref.get(currentEntry).pipe(Effect.map(connectionRoutes));
   const preferredRouteId = yield* Ref.make(Option.none<string>());
   const routeCooldowns = yield* Ref.make<ReadonlyMap<string, bigint>>(new Map());
+  // The generation keeps a check that started before a reset from recording
+  // its stale failures after it.
+  const silentRoutes = yield* Ref.make({
+    generation: 0,
+    routes: new Map<string, SilentRoute>() as ReadonlyMap<string, SilentRoute>,
+  });
+  const forgetSilentRoutes = Ref.update(silentRoutes, ({ generation }) => ({
+    generation: generation + 1,
+    routes: new Map(),
+  }));
 
   const attemptEntry = Effect.gen(function* () {
     const latest = yield* Ref.get(currentEntry);
@@ -338,15 +366,29 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
     if (current <= 0) return;
     const now = yield* Clock.monotonicTimeNanos;
     const cooldowns = yield* Ref.get(routeCooldowns);
+    const silent = yield* Ref.get(silentRoutes);
     const better = connectionRoutes(latest)
       .slice(0, current)
-      .filter((route) => (cooldowns.get(connectionRouteId(route.target)) ?? 0n) <= now);
-    const passed = yield* Effect.forEach(
+      .filter((route) => {
+        const id = connectionRouteId(route.target);
+        return (cooldowns.get(id) ?? 0n) <= now && (silent.routes.get(id)?.until ?? 0n) <= now;
+      });
+    const results = yield* Effect.forEach(
       better,
       (route: ConnectionRoute) => driver.preflight(latest, route),
       { concurrency: "unbounded" },
     );
-    const index = passed.indexOf(true);
+    yield* Ref.update(silentRoutes, (previous) => {
+      if (previous.generation !== silent.generation) return previous;
+      const routes = new Map(previous.routes);
+      for (const [position, route] of better.entries()) {
+        const id = connectionRouteId(route.target);
+        if (results[position] !== "silent") routes.delete(id);
+        else routes.set(id, backOffSilentRoute(previous.routes.get(id), now));
+      }
+      return { generation: previous.generation, routes };
+    });
+    const index = results.indexOf("ready");
     if (index === -1) return;
     const live = yield* SubscriptionRef.get(session);
     if (Option.isNone(live) || live.value !== lease.session) return;
@@ -668,7 +710,7 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
     );
     // Ticks always run: the check skips the preferred route itself, and the
     // route list can grow while connected (learned routes).
-    yield* Stream.tick(BETTER_ROUTE_CHECK_INTERVAL).pipe(
+    yield* Stream.tick(Duration.millis(BETTER_ROUTE_CHECK_INTERVAL_MS)).pipe(
       Stream.drop(1),
       Stream.runForEach(() => requestBetterRouteCheck(lease)),
       Effect.forkScoped,
@@ -1114,14 +1156,24 @@ export const make = Effect.fn("EnvironmentSupervisor.make")(function* (
         current.network === network ? [false, current] : ([true, { ...current, network }] as const),
       ).pipe(
         Effect.flatMap((changed) =>
-          changed ? signal({ _tag: "NetworkChanged", network }) : Effect.void,
+          changed
+            ? (network === "offline" ? Effect.void : forgetSilentRoutes).pipe(
+                Effect.andThen(signal({ _tag: "NetworkChanged", network })),
+              )
+            : Effect.void,
         ),
       ),
     ),
     Effect.forkScoped,
   );
   yield* wakeups.changes.pipe(
-    Stream.runForEach((reason) => signal({ _tag: "Wakeup", reason })),
+    Stream.runForEach((reason) =>
+      // A long suspension can hide a network change the platform never reported.
+      (reason === "network-changed" || reason === "application-active-long"
+        ? forgetSilentRoutes
+        : Effect.void
+      ).pipe(Effect.andThen(signal({ _tag: "Wakeup", reason }))),
+    ),
     Effect.forkScoped,
   );
   yield* Queue.take(betterRouteChecks).pipe(

From dd148481531a0a090780a2ade20588566db099a2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 13:43:23 -0700
Subject: [PATCH 111/146] perf(server): idle servers run 100x fewer background
 queries and 4.8M fewer spans a day (#27098)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ThreadSettlementService.test.ts           | 23 ++++++
 .../ThreadSettlementService.ts                |  9 ++-
 .../server/src/persistence/DatabaseStorage.ts | 24 +++++--
 .../ScheduledTaskService.schedule.test.ts     | 62 ++++++++++++++++
 .../scheduledTasks/ScheduledTaskService.ts    | 70 ++++++++++++++++++-
 apps/server/src/serverSettings.test.ts        | 52 +++++++++++++-
 apps/server/src/serverSettings.ts             | 47 +++++++++----
 7 files changed, 262 insertions(+), 25 deletions(-)

diff --git a/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts b/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
index 012e3d2f234ca..0a0996c0ede0c 100644
--- a/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadSettlementService.test.ts
@@ -842,6 +842,29 @@ describe("ThreadSettlementServiceV2 worker", () => {
     ),
   );
 
+  it.effect("stops settling the rest of a sweep once auto-settlement is turned off", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        yield* TestClock.setTime(Date.parse(NOW));
+        // Sweeps settle 8 threads at a time, so the ninth starts after a dispatch turned it off.
+        const threads = Array.from({ length: 9 }, (_, index) => makeThread(`idle-${index}`));
+        let disable: Effect.Effect<unknown> = Effect.void;
+        const fixture = yield* makeHarness({
+          snapshot: makeSnapshot(threads),
+          settings: { ...DEFAULT_SERVER_SETTINGS, sidebarAutoSettleAfterDays: 3 },
+          onDispatch: () => disable,
+        });
+        disable = fixture.updateSettings({ sidebarAutoSettleAfterDays: null });
+        yield* Effect.gen(function* () {
+          const service = yield* ThreadSettlementService.ThreadSettlementServiceV2;
+          yield* startHarness(service, fixture.activation, fixture.snapshotReads);
+          const settled = (yield* Ref.get(fixture.commands)).map((command) => command.threadId);
+          expect(settled).not.toContain(threads[8]!.id);
+        }).pipe(Effect.provide(fixture.layer));
+      }),
+    ),
+  );
+
   it.effect("reevaluates immediately after a pull request merge", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/apps/server/src/orchestration-v2/ThreadSettlementService.ts b/apps/server/src/orchestration-v2/ThreadSettlementService.ts
index 509dcd0307dc2..6a3d4fffb0399 100644
--- a/apps/server/src/orchestration-v2/ThreadSettlementService.ts
+++ b/apps/server/src/orchestration-v2/ThreadSettlementService.ts
@@ -321,8 +321,10 @@ export const make = Effect.gen(function* () {
     // Merge events resweep all candidates because unlinked threads settle through branch lookup.
     const candidates = threads.filter((thread) => isAutoSettlementCandidate(thread, nowMs));
 
-    const settleThread = Effect.fn("ThreadSettlementServiceV2.settleThread")(
+    // Runs per candidate thread, thousands per sweep on busy servers; the sweep owns the span.
+    const settleThread = Effect.fnUntraced(
       function* (thread: (typeof candidates)[number], pullRequest: SettlementPullRequest | null) {
+        // thread.auto-settle does not recheck settings, so read them per decision; reads are cached.
         const currentSettings = resolveProjectSettings(
           yield* settingsService.getSettings,
           thread.projectId,
@@ -414,7 +416,8 @@ export const make = Effect.gen(function* () {
     };
     const groups = Map.groupBy(lookupCandidates, lookupKey);
 
-    const wouldSettle = Effect.fn("ThreadSettlementServiceV2.wouldSettle")(function* (
+    // wouldSettle and pullRequestFor run per lookup group; the git and pull request reads they make carry the spans.
+    const wouldSettle = Effect.fnUntraced(function* (
       group: ReadonlyArray<(typeof lookupCandidates)[number]>,
       pullRequest: SettlementPullRequest,
     ) {
@@ -435,7 +438,7 @@ export const make = Effect.gen(function* () {
       });
     });
 
-    const pullRequestFor = Effect.fn("ThreadSettlementServiceV2.pullRequestFor")(function* (
+    const pullRequestFor = Effect.fnUntraced(function* (
       group: ReadonlyArray<(typeof lookupCandidates)[number]>,
     ) {
       const thread = group[0]!;
diff --git a/apps/server/src/persistence/DatabaseStorage.ts b/apps/server/src/persistence/DatabaseStorage.ts
index 4907bc20f15b0..bbb4dd1399efd 100644
--- a/apps/server/src/persistence/DatabaseStorage.ts
+++ b/apps/server/src/persistence/DatabaseStorage.ts
@@ -49,17 +49,30 @@ const make = Effect.gen(function* () {
   const doctorTargetsThisDatabase =
     path.resolve(config.dbPath) ===
     path.resolve(config.baseDir, "userdata", path.basename(config.dbPath));
+  // Only VACUUM changes these, and doctor refuses to VACUUM while a server has the database open.
+  let layout: { readonly pageSize: number; readonly incrementalVacuum: boolean } | undefined;
+  const readLayout = Effect.suspend(() =>
+    layout !== undefined
+      ? Effect.succeed(layout)
+      : Effect.gen(function* () {
+          const size = yield* sql<{ readonly page_size: number }>`PRAGMA page_size`;
+          const mode = yield* sql<{ readonly auto_vacuum: number }>`PRAGMA auto_vacuum`;
+          layout = {
+            pageSize: size[0]?.page_size ?? 0,
+            incrementalVacuum: mode[0]?.auto_vacuum === 2,
+          };
+          return layout;
+        }),
+  );
   const publishStatus = Effect.gen(function* () {
     if (!doctorTargetsThisDatabase) return;
+    const { pageSize, incrementalVacuum } = yield* readLayout;
     const pages = yield* sql<{ readonly page_count: number }>`PRAGMA page_count`;
     const free = yield* sql<{ readonly freelist_count: number }>`PRAGMA freelist_count`;
-    const size = yield* sql<{ readonly page_size: number }>`PRAGMA page_size`;
-    const mode = yield* sql<{ readonly auto_vacuum: number }>`PRAGMA auto_vacuum`;
-    const pageSize = size[0]?.page_size ?? 0;
     const next: DatabaseStorageStatus = {
       databaseBytes: (pages[0]?.page_count ?? 0) * pageSize,
       reclaimableBytes: (free[0]?.freelist_count ?? 0) * pageSize,
-      incrementalVacuumEnabled: mode[0]?.auto_vacuum === 2,
+      incrementalVacuumEnabled: incrementalVacuum,
       compactCommand,
     };
     // Every set reaches each open Storage page; most passes change nothing.
@@ -71,8 +84,7 @@ const make = Effect.gen(function* () {
   );
 
   const reclaim = Effect.gen(function* () {
-    const mode = yield* sql<{ readonly auto_vacuum: number }>`PRAGMA auto_vacuum`;
-    if (mode[0]?.auto_vacuum !== 2) return;
+    if (!(yield* readLayout).incrementalVacuum) return;
     // The driver steps once per statement; incremental_vacuum frees one page per step. Yield between pages.
     for (let page = 0; page < RECLAIM_PAGES_PER_PASS; page++) {
       const free = yield* sql<{ readonly freelist_count: number }>`PRAGMA freelist_count`;
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.schedule.test.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.schedule.test.ts
index 09e1d7674044f..1070b49a0dcf2 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.schedule.test.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.schedule.test.ts
@@ -3,6 +3,7 @@ import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import { expect, it } from "@effect/vitest";
 import { ScheduledTaskUpsertInput } from "@t3tools/contracts";
 import * as DateTime from "effect/DateTime";
+import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
@@ -167,3 +168,64 @@ it.effect("keeps the task list order when a toggle or edit rewrites updated_at",
     }).pipe(Effect.provide(ScheduledTaskService.layer.pipe(Layer.provide(layerDependencies))));
   }).pipe(Effect.provide(SqlitePersistence.layerMemory)),
 );
+
+it.effect(
+  "idle polls still wake for tasks saved later, recorded due times, and beside far-future tasks",
+  () =>
+    Effect.gen(function* () {
+      yield* TestClock.setTime(Date.parse("2026-07-01T09:00:00.000Z"));
+      const launched = yield* Deferred.make<string>();
+      const layerDependencies = Layer.mergeAll(
+        NodeCrypto.layer,
+        Scheduler.layer,
+        Layer.mock(ThreadLaunchService.ThreadLaunchService)({
+          launch: (input) =>
+            Deferred.succeed(launched, input.title).pipe(
+              Effect.as({ threadId: "thread-idle-poll", resumed: false } as never),
+            ),
+        }),
+        Layer.mock(ManagedProjectFolders.ManagedProjectFolders)({
+          namedProjectsRoot: "/projects",
+          isScratchProject: () => Effect.succeed(false),
+        }),
+        Layer.mock(ThreadManagementService.ThreadManagementService)({}),
+        Layer.mock(SecretRequests.SecretRequests)({}),
+      );
+      yield* Effect.gen(function* () {
+        const service = yield* ScheduledTaskService.ScheduledTaskService;
+        // The first poll finds no tasks and remembers that nothing is due.
+        yield* TestClock.adjust("6 seconds");
+        // Its year-10000+ next run sorts first as text; it must not hide the task below.
+        yield* service.upsert(
+          yield* decodeUpsertInput({
+            title: "Far future",
+            prompt: "Review the open pull requests.",
+            enabled: true,
+            schedule: { type: "interval", everyMs: 3e14 },
+            projectId: "project-idle-poll",
+            workspaceStrategy: { type: "root" },
+            modelSelection: { instanceId: "codex", model: "gpt-5.4" },
+            runtimeMode: "full-access",
+            interactionMode: "default",
+          }),
+        );
+        const created = yield* service.upsert(
+          yield* decodeUpsertInput({
+            title: "Idle poll",
+            prompt: "Review the open pull requests.",
+            enabled: true,
+            schedule: { type: "interval", everyMs: 60_000 },
+            projectId: "project-idle-poll",
+            workspaceStrategy: { type: "root" },
+            modelSelection: { instanceId: "codex", model: "gpt-5.4" },
+            runtimeMode: "full-access",
+            interactionMode: "default",
+          }),
+        );
+        // This poll records the new task's due time; the later ones must still fire it.
+        yield* TestClock.adjust("6 seconds");
+        yield* TestClock.adjust("60 seconds");
+        expect(yield* Deferred.await(launched)).toBe(created.task.title);
+      }).pipe(Effect.provide(ScheduledTaskService.layer.pipe(Layer.provide(layerDependencies))));
+    }).pipe(Effect.provide(SqlitePersistence.layerMemory)),
+);
diff --git a/apps/server/src/scheduledTasks/ScheduledTaskService.ts b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
index b3aa9440944bd..f05811ed65110 100644
--- a/apps/server/src/scheduledTasks/ScheduledTaskService.ts
+++ b/apps/server/src/scheduledTasks/ScheduledTaskService.ts
@@ -396,6 +396,35 @@ export const listDueTasks = Effect.fn("ScheduledTaskService.listDueTasks")(funct
   return tasks;
 });
 
+// Backstop for a write path that forgets to invalidate; the tick still runs every few seconds.
+const DUE_HINT_MAX_AGE_MS = 10 * 60 * 1_000;
+
+/**
+ * Remembers when a poller next has work so idle scheduler ticks skip SQL.
+ * `invalidate` after every write that can move work earlier; a tick records
+ * only if no write happened since it read `version`.
+ */
+const makeDueHint = () => {
+  let version = 0;
+  let hint: { readonly dueAtMs: number; readonly checkedAtMs: number } | null = null;
+  return {
+    invalidate: Effect.sync(() => {
+      version++;
+      hint = null;
+    }),
+    version: Effect.sync(() => version),
+    isIdle: (nowMs: number) =>
+      Effect.sync(
+        () =>
+          hint !== null && hint.dueAtMs > nowMs && nowMs - hint.checkedAtMs < DUE_HINT_MAX_AGE_MS,
+      ),
+    record: (readVersion: number, dueAtMs: number, nowMs: number) =>
+      Effect.sync(() => {
+        if (readVersion === version) hint = { dueAtMs, checkedAtMs: nowMs };
+      }),
+  };
+};
+
 export const layer = Layer.effect(
   ScheduledTaskService,
   Effect.gen(function* () {
@@ -426,7 +455,13 @@ export const layer = Layer.effect(
     const activeRuns = yield* Ref.make<ReadonlySet<ScheduledTaskId>>(new Set());
     // Notifications re-emit the full list; slow subscribers need only the newest dirty signal.
     const changesPubSub = yield* PubSub.sliding<void>(1);
-    const notifyChanged = PubSub.publish(changesPubSub, undefined).pipe(Effect.asVoid);
+    const dueTasks = makeDueHint();
+    const pendingWebhooks = makeDueHint();
+    // Every scheduled_tasks write that can change next_run_at, enabled or run state notifies.
+    const notifyChanged = dueTasks.invalidate.pipe(
+      Effect.andThen(PubSub.publish(changesPubSub, undefined)),
+      Effect.asVoid,
+    );
 
     const selectAllRows = () =>
       sql<ScheduledTaskRow>`
@@ -972,6 +1007,28 @@ export const layer = Layer.effect(
 
     const runDueTasks = Effect.fn("ScheduledTaskService.runDueTasks")(function* () {
       const now = yield* localNow;
+      const nowMs = DateTime.toEpochMillis(now);
+      if (yield* dueTasks.isIdle(nowMs)) return;
+      const readVersion = yield* dueTasks.version;
+      const [next] = yield* sql<{ next_run_at: string | null }>`
+        SELECT MIN(next_run_at) AS next_run_at FROM scheduled_tasks
+        WHERE enabled = 1 AND next_run_at IS NOT NULL AND last_run_status <> 'running'
+      `.pipe(
+        NodeSqliteClient.readOnly,
+        Effect.mapError((cause) => taskError("Could not list schedule tasks.", { cause })),
+      );
+      // Compare as text like listDueTasks: expanded years (`+011533-…`) sort first but parse far ahead.
+      const nextRunAt = next?.next_run_at ?? null;
+      if (nextRunAt === null || nextRunAt > iso(now)) {
+        const nextDueAt =
+          nextRunAt === null
+            ? Option.some(Infinity)
+            : DateTime.make(nextRunAt).pipe(Option.map(DateTime.toEpochMillis));
+        if (Option.isSome(nextDueAt) && nextDueAt.value > nowMs) {
+          yield* dueTasks.record(readVersion, nextDueAt.value, nowMs);
+        }
+        return;
+      }
       const tasks = yield* listDueTasks(now).pipe(
         Effect.mapError((cause) => taskError("Could not list schedule tasks.", { cause })),
       );
@@ -1695,6 +1752,8 @@ export const layer = Layer.effect(
 
     const triggerWebhook: ScheduledTaskService["Service"]["triggerWebhook"] = (request) =>
       triggerWebhookUnobserved(request).pipe(
+        // Accepted deliveries may have queued a coalescing window.
+        Effect.ensuring(pendingWebhooks.invalidate),
         Effect.tapError(() => observeDelivery(request, "error", undefined, undefined)),
         Metrics.withMetrics({ timer: Metrics.webhookDeliveryDuration }),
         Effect.withSpan("ScheduledTaskService.triggerWebhook", {
@@ -2090,10 +2149,19 @@ export const layer = Layer.effect(
 
     const dispatchPending = Effect.fn("ScheduledTaskService.dispatchPendingWebhooks")(function* () {
       const now = DateTime.toEpochMillis(yield* localNow);
+      if (yield* pendingWebhooks.isIdle(now)) return;
+      const readVersion = yield* pendingWebhooks.version;
       yield* sql`UPDATE scheduled_task_webhook_pending SET state = 'dispatching' WHERE state = 'pending' AND due_at <= ${now}`;
       const tasks = yield* sql<{ task_id: ScheduledTaskId }>`
         SELECT DISTINCT task_id FROM scheduled_task_webhook_pending WHERE state IN ('dispatching', 'running', 'completed', 'failed')
       `.pipe(NodeSqliteClient.readOnly);
+      // Workers can leave rows behind to retry, so keep polling while any are claimed.
+      if (tasks.length === 0) {
+        const [next] = yield* sql<{ due_at: number | null }>`
+          SELECT MIN(due_at) AS due_at FROM scheduled_task_webhook_pending WHERE state = 'pending'
+        `.pipe(NodeSqliteClient.readOnly);
+        yield* pendingWebhooks.record(readVersion, next?.due_at ?? Infinity, now);
+      }
       yield* Effect.forEach(
         tasks,
         ({ task_id: taskId }) =>
diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index f34b653c8cbc8..8b7d81859b70d 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -1047,6 +1047,54 @@ it.layer(NodeServices.layer)("server settings", (it) => {
     }).pipe(Effect.provide(layerServerSettings())),
   );
 
+  it.effect("reads settings secrets once per settings change", () => {
+    let reads = 0;
+    const layerSecret = Layer.effect(
+      ServerSecretStore.ServerSecretStore,
+      Effect.map(ServerSecretStore.ServerSecretStore, (store) => ({
+        ...store,
+        get: (name: string) =>
+          Effect.suspend(() => {
+            reads++;
+            return store.get(name);
+          }),
+      })),
+    ).pipe(Layer.provide(ServerSecretStore.layer));
+    const layerSettings = ServerSettingsModule.layer.pipe(
+      Layer.provide(layerSecret),
+      Layer.provideMerge(Layer.fresh(SqlitePersistence.layerMemory)),
+      Layer.provideMerge(
+        Layer.fresh(
+          ServerConfig.layerTest(process.cwd(), { prefix: "t3code-settings-secret-cache-test-" }),
+        ),
+      ),
+    );
+    return Effect.gen(function* () {
+      const instanceId = ProviderInstanceId.make("codex_cached");
+      const service = yield* ServerSettingsModule.ServerSettingsService;
+      const save = (value: string) =>
+        service.updateSettings({
+          providerInstances: {
+            [instanceId]: {
+              driver: ProviderDriverKind.make("codex"),
+              environment: [{ name: "API_TOKEN", value, sensitive: true }],
+              config: {},
+            },
+          },
+        });
+      const token = service.getSettings.pipe(
+        Effect.map((settings) => settings.providerInstances[instanceId]?.environment?.[0]?.value),
+      );
+      yield* save("sk-first");
+      reads = 0;
+      assert.equal(yield* token, "sk-first");
+      assert.equal(yield* token, "sk-first");
+      assert.equal(reads, 0);
+      yield* save("sk-second");
+      assert.equal(yield* token, "sk-second");
+    }).pipe(Effect.provide(layerSettings));
+  });
+
   it.effect("keeps the inline value on disk when secret migration fails", () => {
     const cause = new ServerSecretStore.SecretStorePersistError({
       resource: "provider environment secret",
@@ -1578,6 +1626,7 @@ it.layer(NodeServices.layer)("server settings", (it) => {
       const fileSystem = yield* FileSystem.FileSystem;
       let failRename = false;
       let settingsPathToFail: string | undefined;
+      let readDuringWrite: Effect.Effect<void> = Effect.void;
       const writeFailure = PlatformError.systemError({
         _tag: "PermissionDenied",
         module: "FileSystem",
@@ -1588,7 +1637,7 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         ...fileSystem,
         rename: (fromPath, toPath) =>
           failRename && toPath === settingsPathToFail
-            ? Effect.fail(writeFailure)
+            ? readDuringWrite.pipe(Effect.andThen(Effect.fail(writeFailure)))
             : fileSystem.rename(fromPath, toPath),
       });
       const instanceId = ProviderInstanceId.make("antigravity_write_failure");
@@ -1610,6 +1659,7 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         });
 
         failRename = true;
+        readDuringWrite = Effect.ignore(serverSettings.getSettings);
         const failedUpdate = yield* serverSettings
           .updateProviderInstance({
             operation: "upsert",
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index 6f6a1db5a292a..48839bb8535d9 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -851,6 +851,31 @@ const make = Effect.gen(function* () {
     },
   );
 
+  // Background sweeps read settings every few seconds; reading secret files each time is wasted.
+  // Every secret write rewrites the settings file, so a new cached object implies fresh secrets.
+  // A read that overlaps a secret write may see files a rollback then restores, so it is not kept.
+  let materialized: { readonly source: ServerSettings; readonly value: ServerSettings } | null =
+    null;
+  let secretWriteGeneration = 0;
+  const invalidateMaterialized = Effect.sync(() => {
+    secretWriteGeneration++;
+    materialized = null;
+  });
+  const getMaterializedSettings = getSettingsFromCache.pipe(
+    Effect.flatMap((source) => {
+      if (materialized?.source === source) return Effect.succeed(materialized.value);
+      const generation = secretWriteGeneration;
+      return materializeSettingsSecrets(source).pipe(
+        Effect.map(resolveTextGenerationProvider),
+        Effect.tap((value) =>
+          Effect.sync(() => {
+            if (generation === secretWriteGeneration) materialized = { source, value };
+          }),
+        ),
+      );
+    }),
+  );
+
   const materializeChanges = (changes: Stream.Stream<ServerSettings>) =>
     changes.pipe(
       Stream.mapEffect((settings) =>
@@ -1026,8 +1051,9 @@ const make = Effect.gen(function* () {
         const updated = yield* update(current);
         const persisted = yield* persistSettingsSecrets(current, updated);
         const next = yield* normalizeServerSettings(persisted.settings);
-        const materialized = yield* Effect.uninterruptibleMask(() =>
+        const materializedNext = yield* Effect.uninterruptibleMask(() =>
           Effect.gen(function* () {
+            yield* invalidateMaterialized;
             const rollbackSecretChanges = yield* applySettingsSecretChanges(persisted.changes);
             const materializedExit = yield* Effect.exit(materializeSettingsSecrets(next));
             if (Exit.isFailure(materializedExit)) {
@@ -1040,22 +1066,18 @@ const make = Effect.gen(function* () {
               return yield* Effect.failCause(writeExit.cause);
             }
             return materializedExit.value;
-          }),
+          }).pipe(Effect.ensuring(invalidateMaterialized)),
         );
         yield* Cache.set(settingsCache, cacheKey, { settings: next, parseFailure: Option.none() });
+        const resolved = resolveTextGenerationProvider(materializedNext);
+        materialized = { source: next, value: resolved };
         yield* emitChange(next);
-        return resolveTextGenerationProvider(materialized);
+        return resolved;
       }),
     );
 
   const withSettingsSnapshot: ServerSettingsService["Service"]["withSettingsSnapshot"] = (use) =>
-    writeSemaphore.withPermits(1)(
-      getSettingsFromCache.pipe(
-        Effect.flatMap(materializeSettingsSecrets),
-        Effect.map(resolveTextGenerationProvider),
-        Effect.flatMap(use),
-      ),
-    );
+    writeSemaphore.withPermits(1)(getMaterializedSettings.pipe(Effect.flatMap(use)));
 
   const revalidateAndEmit = writeSemaphore.withPermits(1)(
     Effect.gen(function* () {
@@ -1160,10 +1182,7 @@ const make = Effect.gen(function* () {
   return {
     start,
     ready: Deferred.await(startedDeferred),
-    getSettings: getSettingsFromCache.pipe(
-      Effect.flatMap(materializeSettingsSecrets),
-      Effect.map(resolveTextGenerationProvider),
-    ),
+    getSettings: getMaterializedSettings,
     updateSettings: (patch) =>
       updateAndPersistSettings((current) =>
         Effect.succeed(applyServerSettingsPatch(current, patch)),

From 812c0a71c785c69c34a0111c3ce6976f64cd5bfe Mon Sep 17 00:00:00 2001
From: Nathan Schroeder <49214985+SchroederNathan@users.noreply.github.com>
Date: Thu, 29 Oct 2026 19:36:08 -0400
Subject: [PATCH 112/146] feat(devices): support Android EAS Simulator sessions
 (#26797)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/device/DeviceHubProxy.test.ts |  26 ++++
 apps/server/src/device/DeviceHubProxy.ts      |  12 +-
 apps/server/src/device/EasDeviceHost.test.ts  |  87 ++++++++++-
 apps/server/src/device/EasDeviceHost.ts       | 120 +++++++++------
 .../components/device/DeviceControlsRail.tsx  |  20 +--
 .../web/src/components/device/DevicePanel.tsx |   2 +-
 .../web/src/components/device/DeviceSetup.tsx |   2 +-
 .../src/components/device/DeviceWorkspace.tsx |  17 ++-
 docs/internals/devices.md                     |  17 ++-
 docs/user/devices.md                          |   2 +-
 .../client-runtime/src/device/stream.test.ts  | 138 +++++++++++++++++-
 packages/client-runtime/src/device/stream.ts  |  62 +++++---
 12 files changed, 405 insertions(+), 100 deletions(-)

diff --git a/apps/server/src/device/DeviceHubProxy.test.ts b/apps/server/src/device/DeviceHubProxy.test.ts
index 07b45737f6730..72c8f9e0e5d56 100644
--- a/apps/server/src/device/DeviceHubProxy.test.ts
+++ b/apps/server/src/device/DeviceHubProxy.test.ts
@@ -169,6 +169,32 @@ describe("device hub proxy", () => {
     expect(headers[0]?.["content-type"]).toBe("application/json");
   });
 
+  it("lets a viewer read Android stream capabilities and signal WebRTC with read scope", async () => {
+    const { handler, requests } = fixture([AuthOrchestrationReadScope]);
+    const hub = "http://t3.test/api/device-hub/vendor/serve-emu";
+    const api = await handler(new Request(`${hub}/api?device=session-1`));
+    expect(api.status).toBe(200);
+    await api.text();
+    for (const action of ["offer", "close"]) {
+      const signal = await handler(
+        new Request(`${hub}/webrtc/${action}?device=session-1`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: '{"sessionId":"viewer"}',
+        }),
+      );
+      expect(signal.status).toBe(200);
+      await signal.text();
+    }
+    expect(requests).toEqual([
+      "http://hub.test/vendor/serve-emu/api?device=session-1",
+      "http://hub.test/vendor/serve-emu/webrtc/offer?device=session-1",
+      "http://hub.test/vendor/serve-emu/webrtc/close?device=session-1",
+    ]);
+    expect((await handler(new Request(`${hub}/api`, { method: "POST" }))).status).toBe(405);
+    expect((await handler(new Request(`${hub}/webrtc/offer`))).status).toBe(405);
+  });
+
   it("sends requests a host routes itself to its upstream with its credentials", async () => {
     const { handler, requests, headers } = fixture(
       [AuthOrchestrationReadScope],
diff --git a/apps/server/src/device/DeviceHubProxy.ts b/apps/server/src/device/DeviceHubProxy.ts
index 89cad0d7206e2..c1aaab3c61219 100644
--- a/apps/server/src/device/DeviceHubProxy.ts
+++ b/apps/server/src/device/DeviceHubProxy.ts
@@ -27,14 +27,17 @@ const ALLOWED_PATHS: ReadonlyArray<RegExp> = [
   /^\/vendor\/serve-sim\/helper\/[^/]+\/panel\/(1|3)\/stream\.avcc$/,
   /^\/vendor\/serve-sim\/helper\/[^/]+\/webrtc\/(offer|close)$/,
   /^\/vendor\/serve-sim\/appstate$/,
+  /^\/vendor\/serve-emu\/api$/,
   /^\/vendor\/serve-emu\/api\/(devices|screenshot|stream-mode|stream-settings|accessibility|fold)$/,
   /^\/vendor\/serve-emu\/health$/,
 ];
 
+// Paths that take methods besides GET; one missing from ALLOWED_PATHS takes no GET.
 const MUTABLE_PATHS: ReadonlyArray<RegExp> = [
   /^\/vendor\/serve-sim\/api\/screenshot$/,
   // WebRTC signalling: opening and closing a view of the stream, so read scope.
   /^\/vendor\/serve-sim\/helper\/[^/]+\/webrtc\/(offer|close)$/,
+  /^\/vendor\/serve-emu\/webrtc\/(offer|close)$/,
   /^\/vendor\/serve-emu\/api\/(screenshot|stream-mode|stream-settings)$/,
   /^\/vendor\/serve-emu\/api\/fold$/,
 ];
@@ -178,14 +181,15 @@ const handler = Effect.gen(function* () {
   }
   const hubPath = url.value.pathname.slice(DeviceService.DEVICE_HUB_ROUTE_PREFIX.length) || "/";
   const upgrade = isWebSocketUpgrade(request);
-  const allowed = (upgrade ? ALLOWED_WS_PATHS : ALLOWED_PATHS).some((pattern) =>
-    pattern.test(hubPath),
-  );
+  const matches = (paths: ReadonlyArray<RegExp>) => paths.some((pattern) => pattern.test(hubPath));
+  const allowed = upgrade
+    ? matches(ALLOWED_WS_PATHS)
+    : matches(ALLOWED_PATHS) || matches(MUTABLE_PATHS);
   if (!allowed) {
     return HttpServerResponse.text("Not Found", { status: 404 });
   }
   const readOnly = request.method === "GET" || request.method === "HEAD";
-  if (!upgrade && !readOnly && !MUTABLE_PATHS.some((pattern) => pattern.test(hubPath))) {
+  if (!upgrade && !matches(readOnly ? ALLOWED_PATHS : MUTABLE_PATHS)) {
     return HttpServerResponse.text("Method Not Allowed", { status: 405 });
   }
   const controlsDevice =
diff --git a/apps/server/src/device/EasDeviceHost.test.ts b/apps/server/src/device/EasDeviceHost.test.ts
index 5802956e699b7..62a6a0c247a45 100644
--- a/apps/server/src/device/EasDeviceHost.test.ts
+++ b/apps/server/src/device/EasDeviceHost.test.ts
@@ -62,6 +62,7 @@ const fakeExpo = (
   const calls: Array<{ operation: string; variables: Record<string, unknown> }> = [];
   let created = 0;
   let createdName = "";
+  const previews: string[] = [];
   let previewFails = options.failPreview ?? false;
   let createFails = options.failCreate ?? false;
   let sessionGated = false;
@@ -69,6 +70,7 @@ const fakeExpo = (
     Effect.gen(function* () {
       const url = new URL(request.url);
       if (url.origin === "https://preview.test") {
+        previews.push(`${url.pathname}${url.search}`);
         expect(request.headers.authorization).toBe("Bearer preview-token");
         if (options.previewGate) {
           yield* Deferred.succeed(options.previewGate.requested, undefined);
@@ -77,7 +79,17 @@ const fakeExpo = (
         if (previewFails) {
           return HttpClientResponse.fromWeb(request, new Response("bad gateway", { status: 502 }));
         }
-        return HttpClientResponse.fromWeb(request, Response.json({ device: "UDID-1" }));
+        if (url.pathname.endsWith("/api/screenshot")) {
+          return HttpClientResponse.fromWeb(request, new Response(Uint8Array.of(137, 80, 78, 71)));
+        }
+        return HttpClientResponse.fromWeb(
+          request,
+          Response.json(
+            url.pathname === "/vendor/serve-emu/api"
+              ? { serial: "emulator-5554" }
+              : { device: "UDID-1" },
+          ),
+        );
       }
       const body =
         request.body._tag === "Uint8Array"
@@ -195,7 +207,7 @@ const fakeExpo = (
   const allowCreate = () => {
     createFails = false;
   };
-  return { http, named, stopped, allowPreview, allowCreate };
+  return { http, named, stopped, allowPreview, allowCreate, previews };
 };
 
 const layer = Layer.mergeAll(
@@ -221,7 +233,10 @@ describe("EAS Simulator host", () => {
       const host = yield* makeHost(expo, config(), scope);
       const ready = yield* host.ensureReady(() => Effect.void);
       const catalog = (yield* ready.devices.list).devices;
-      expect(catalog.map((device) => [device.id, device.booted])).toEqual([["eas-ios", false]]);
+      expect(catalog.map((device) => [device.id, device.booted])).toEqual([
+        ["eas-ios", false],
+        ["eas-android", false],
+      ]);
 
       expect(yield* ready.devices.boot(catalog[0]!)).toBe("session-1");
       expect(expo.named("T3CreateEasSimulatorSession")[0]?.variables.input).toMatchObject({
@@ -266,6 +281,55 @@ describe("EAS Simulator host", () => {
     }).pipe(Effect.scoped, Effect.provide(layer)),
   );
 
+  it.effect("runs an Android session through serve-emu beside an iOS one", () =>
+    Effect.gen(function* () {
+      const expo = fakeExpo();
+      const scope = yield* Scope.make();
+      const host = yield* makeHost(expo, config(), scope);
+      expect(yield* host.platformAvailability("android")).toEqual({
+        platform: "android",
+        available: true,
+      });
+      const ready = yield* host.ensureReady(() => Effect.void);
+      const [ios, android] = (yield* ready.devices.list).devices;
+      expect(yield* ready.devices.boot(ios!)).toBe("session-1");
+      expect(yield* ready.devices.boot(android!)).toBe("session-2");
+      expect(expo.named("T3CreateEasSimulatorSession")[1]?.variables.input).toMatchObject({
+        platform: "ANDROID",
+      });
+      const running = (yield* ready.devices.list).devices.find(
+        (device) => device.id === "session-2",
+      );
+      expect(running).toMatchObject({ platform: "android", booted: true });
+
+      expect(yield* ready.devices.agentEndpoint!("session-2")).toMatchObject({
+        agentDeviceId: "emulator-5554",
+      });
+      expect(Array.from(yield* ready.devices.screenshot(running!))).toEqual([137, 80, 78, 71]);
+      expect(expo.previews.slice(-2)).toEqual([
+        "/vendor/serve-emu/api",
+        "/vendor/serve-emu/api/screenshot?device=emulator-5554",
+      ]);
+      expect(
+        yield* ready.upstream!(
+          "/vendor/serve-emu/webrtc/offer",
+          new URLSearchParams("device=session-2&hostId=eas"),
+        ),
+      ).toEqual({
+        url: "https://preview.test/vendor/serve-emu/webrtc/offer?device=emulator-5554&hostId=eas",
+        headers: { authorization: "Bearer preview-token" },
+        protocols: ["serve-emu.token.preview-token"],
+      });
+      // Each session answers only on its own platform's stream.
+      expect(
+        yield* ready.upstream!("/vendor/serve-emu/api", new URLSearchParams("device=session-1")),
+      ).toBeNull();
+      expect(
+        yield* ready.upstream!("/vendor/serve-sim/api", new URLSearchParams("device=session-2")),
+      ).toBeNull();
+    }).pipe(Effect.scoped, Effect.provide(layer)),
+  );
+
   it.effect("refuses to start past its session limit", () =>
     Effect.gen(function* () {
       const expo = fakeExpo();
@@ -292,6 +356,7 @@ describe("EAS Simulator host", () => {
       expect(yield* ready.devices.boot(catalogDevice!)).toBe("session-2");
       expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual([
         "eas-ios",
+        "eas-android",
         "session-1",
         "session-2",
       ]);
@@ -306,6 +371,7 @@ describe("EAS Simulator host", () => {
       expect(expo.stopped()).toEqual(["session-1"]);
       expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual([
         "eas-ios",
+        "eas-android",
         "session-2",
       ]);
       yield* Scope.close(scope, Exit.void);
@@ -421,7 +487,10 @@ describe("EAS Simulator host", () => {
       expect(refused.message).toContain("limited to 1 running session");
       stopFails = false;
       yield* ready.devices.list;
-      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual(["eas-ios"]);
+      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual([
+        "eas-ios",
+        "eas-android",
+      ]);
       expect(expo.stopped().filter((id) => id === "session-1").length).toBeGreaterThanOrEqual(2);
     }).pipe(Effect.scoped, Effect.provide(layer)),
   );
@@ -438,7 +507,10 @@ describe("EAS Simulator host", () => {
       expect((yield* ready.devices.list).devices.map((device) => device.id)).toContain("session-1");
       // Expo ended it by itself: the stop keeps failing, but the status says so.
       status = "STOPPED";
-      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual(["eas-ios"]);
+      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual([
+        "eas-ios",
+        "eas-android",
+      ]);
       status = "IN_PROGRESS";
       expect(yield* ready.devices.boot(catalogDevice!)).toBe("session-2");
     }).pipe(Effect.scoped, Effect.provide(layer)),
@@ -488,7 +560,10 @@ describe("EAS Simulator host", () => {
       expect(expo.stopped()).toEqual(["session-1"]);
       const failure = yield* Fiber.join(booting).pipe(Effect.flip);
       expect(failure.message).toContain("was stopped while the session started");
-      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual(["eas-ios"]);
+      expect((yield* ready.devices.list).devices.map((device) => device.id)).toEqual([
+        "eas-ios",
+        "eas-android",
+      ]);
     }).pipe(Effect.scoped, Effect.provide(layer)),
   );
 });
diff --git a/apps/server/src/device/EasDeviceHost.ts b/apps/server/src/device/EasDeviceHost.ts
index da8a665d4b4ed..a1137fe5156a0 100644
--- a/apps/server/src/device/EasDeviceHost.ts
+++ b/apps/server/src/device/EasDeviceHost.ts
@@ -42,14 +42,48 @@ const STATUS_TTL_MS = 15_000;
 // Expo's own CLI waits this long once a worker picks the session up.
 const START_TIMEOUT = Duration.minutes(15);
 const PREVIEW_TIMEOUT = Duration.seconds(20);
-const SERVE_SIM_PREFIX = "/vendor/serve-sim";
+const decodeServeSimApi = Schema.decodeUnknownEffect(
+  Schema.Struct({ device: Schema.NonEmptyString }),
+);
+const decodeServeEmuApi = Schema.decodeUnknownEffect(
+  Schema.Struct({ serial: Schema.NonEmptyString }),
+);
+/**
+ * Each session's preview host serves serve-sim at its root and serve-emu under
+ * its vendor prefix, and names its device by an id of its own that agent-device
+ * also selects it by.
+ */
+const PLATFORMS = {
+  ios: {
+    name: "iPhone (EAS Simulator)",
+    hubPrefix: "/vendor/serve-sim",
+    previewPrefix: "",
+    protocol: "serve-sim",
+    remoteDeviceId: (api: unknown) => decodeServeSimApi(api).pipe(Effect.map((api) => api.device)),
+  },
+  android: {
+    name: "Android (EAS Simulator)",
+    hubPrefix: "/vendor/serve-emu",
+    previewPrefix: "/vendor/serve-emu",
+    protocol: "serve-emu",
+    remoteDeviceId: (api: unknown) => decodeServeEmuApi(api).pipe(Effect.map((api) => api.serial)),
+  },
+} as const;
 
 /** EAS picks the simulator model; one entry starts a session. */
 const CATALOG: ReadonlyArray<DeviceHost.HostDevice> = [
   {
     id: "eas-ios",
     platform: "ios",
-    name: "iPhone (EAS Simulator)",
+    name: PLATFORMS.ios.name,
+    version: "Cloud",
+    booted: false,
+    physical: false,
+  },
+  {
+    id: "eas-android",
+    platform: "android",
+    name: PLATFORMS.android.name,
     version: "Cloud",
     booted: false,
     physical: false,
@@ -59,7 +93,8 @@ const CATALOG: ReadonlyArray<DeviceHost.HostDevice> = [
 interface RunningSession {
   readonly sessionId: string;
   readonly name: string;
-  readonly udid: string;
+  readonly platform: DevicePlatform;
+  readonly remoteDeviceId: string;
   readonly preview: { readonly origin: string; readonly token: Redacted.Redacted<string> };
   readonly agent: DeviceHost.AgentDaemonEndpoint;
   /** Set once a stop has been asked for but Expo has not confirmed it. */
@@ -94,7 +129,6 @@ const RECORD_MAX_AGE_MS = 24 * 60 * 60_000;
 const UNCERTAIN_CREATE_MS = 5 * 60_000;
 // One failed request to Expo during a minutes-long start does not end the start.
 const TRANSIENT_RETRY = { times: 3, schedule: Schedule.spaced("2 seconds") } as const;
-const decodePreviewApi = Schema.decodeUnknownEffect(Schema.Struct({ device: Schema.String }));
 
 /** A malformed escape names no device, so the proxy answers 404 instead of failing. */
 const decodePathSegment = (segment: string): string | null => {
@@ -116,7 +150,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
   const hostId = config.id;
   const ledgerPath = path.join(server.stateDir, "device", "eas", `${hostId}.json`);
   // Keyed by Expo's session id, which is also the device id: every EAS
-  // simulator reports the same UDID, so the UDID cannot tell sessions apart.
+  // simulator reports the same remote device id, so that id cannot tell sessions apart.
   const sessions = new Map<string, RunningSession>();
   const checkedAt = new Map<string, number>();
   const startLock = yield* Semaphore.make(1);
@@ -348,18 +382,21 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     ),
   );
 
-  const previewDevice = (origin: string, token: Redacted.Redacted<string>) =>
+  const previewDevice = (
+    origin: string,
+    token: Redacted.Redacted<string>,
+    platform: DevicePlatform,
+  ) =>
     http
       .execute(
-        HttpClientRequest.get(`${origin}/api`).pipe(
+        HttpClientRequest.get(`${origin}${PLATFORMS[platform].previewPrefix}/api`).pipe(
           HttpClientRequest.bearerToken(Redacted.value(token)),
         ),
       )
       .pipe(
         Effect.flatMap(HttpClientResponse.filterStatusOk),
         Effect.flatMap((response) => response.json),
-        Effect.flatMap(decodePreviewApi),
-        Effect.map((api) => api.device),
+        Effect.flatMap(PLATFORMS[platform].remoteDeviceId),
         Effect.scoped,
         Effect.timeout(PREVIEW_TIMEOUT),
         Effect.retry(TRANSIENT_RETRY),
@@ -500,7 +537,9 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
                   ),
                   Effect.mapError((error) => unavailable(error.message, error)),
                 );
-              return yield* restore(trackSession(expo, sessionId, name, startedIn)).pipe(
+              return yield* restore(
+                trackSession(expo, sessionId, name, device.platform, startedIn),
+              ).pipe(
                 Effect.onError(() =>
                   stopSession(expo, sessionId, name).pipe(
                     // Still running and billed: owned, counted, and retried by listing.
@@ -520,6 +559,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     expo: ExpoApi,
     sessionId: string,
     name: string,
+    platform: DevicePlatform,
     startedIn: number,
   ) {
     const endpoints = yield* awaitRunning(expo, sessionId);
@@ -532,7 +572,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
       });
     }
     const origin = new URL(endpoints.preview.url).origin;
-    const udid = yield* previewDevice(origin, endpoints.preview.token).pipe(
+    const remoteDeviceId = yield* previewDevice(origin, endpoints.preview.token, platform).pipe(
       Effect.mapError(
         (cause) =>
           new DeviceBootError({
@@ -549,7 +589,8 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     sessions.set(sessionId, {
       sessionId,
       name,
-      udid,
+      platform,
+      remoteDeviceId,
       preview: { origin, token: endpoints.preview.token },
       agent: {
         baseUrl: endpoints.agentDevice.url,
@@ -650,8 +691,8 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
             ...CATALOG,
             ...[...sessions.values()].map((session): DeviceHost.HostDevice => ({
               id: session.sessionId,
-              platform: "ios",
-              name: "iPhone (EAS Simulator)",
+              platform: session.platform,
+              name: PLATFORMS[session.platform].name,
               version: "Cloud",
               booted: true,
               physical: false,
@@ -708,7 +749,7 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
           http
             .execute(
               HttpClientRequest.post(
-                `${session.preview.origin}/api/screenshot?device=${encodeURIComponent(session.udid)}`,
+                `${session.preview.origin}${PLATFORMS[session.platform].previewPrefix}/api/screenshot?device=${encodeURIComponent(session.remoteDeviceId)}`,
               ).pipe(HttpClientRequest.bearerToken(Redacted.value(session.preview.token))),
             )
             .pipe(
@@ -730,42 +771,45 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
     agentEndpoint: (deviceId) =>
       Option.match(sessionFor(deviceId), {
         onNone: () => Effect.fail(unavailable("This EAS Simulator device is no longer running.")),
-        // agent-device selects the simulator by its UDID, not the session id T3 shows.
-        onSome: (session) => Effect.succeed({ ...session.agent, agentDeviceId: session.udid }),
+        onSome: (session) =>
+          Effect.succeed({ ...session.agent, agentDeviceId: session.remoteDeviceId }),
       }),
     endsDevices: true,
   };
 
   /**
-   * serve-sim runs at the root of each session's preview host and wants its
-   * token on every request. Clients name the device by its session id; serve-sim
-   * knows it by its UDID, so the id is swapped for the UDID in the path and in
-   * the `device` parameter.
+   * Clients name the device by its session id; the preview host knows it by its
+   * own id, so the session id is swapped for that in the path and in the
+   * `device` parameter. A session answers only on its own platform's server.
    */
   const upstream: NonNullable<DeviceHost.DeviceHostReady["upstream"]> = (hubPath, search) =>
     Effect.sync(() => {
-      if (!hubPath.startsWith(`${SERVE_SIM_PREFIX}/`)) return null;
+      const platform = (["ios", "android"] as const).find((candidate) =>
+        hubPath.startsWith(`${PLATFORMS[candidate].hubPrefix}/`),
+      );
+      if (!platform) return null;
       const helper = /^\/vendor\/serve-sim\/helper\/([^/]+)\//.exec(hubPath);
       const deviceId = helper ? decodePathSegment(helper[1]!) : search.get("device");
       if (helper && deviceId === null) return null;
       const session =
-        deviceId !== null && deviceId !== undefined
+        deviceId !== null
           ? sessions.get(deviceId)
           : sessions.size === 1
             ? [...sessions.values()][0]
             : undefined;
-      if (!session) return null;
+      if (session?.platform !== platform) return null;
+      const { hubPrefix, previewPrefix, protocol } = PLATFORMS[platform];
       const path = helper
-        ? `/helper/${encodeURIComponent(session.udid)}${hubPath.slice(helper[0].length - 1)}`
-        : hubPath.slice(SERVE_SIM_PREFIX.length);
+        ? `/helper/${encodeURIComponent(session.remoteDeviceId)}${hubPath.slice(helper[0].length - 1)}`
+        : `${previewPrefix}${hubPath.slice(hubPrefix.length)}`;
       const params = new URLSearchParams(search);
-      if (params.has("device")) params.set("device", session.udid);
+      if (params.has("device")) params.set("device", session.remoteDeviceId);
       const query = params.size > 0 ? `?${params.toString()}` : "";
       const token = Redacted.value(session.preview.token);
       return {
         url: `${session.preview.origin}${path}${query}`,
         headers: { authorization: `Bearer ${token}` },
-        protocols: [`serve-sim.token.${token}`],
+        protocols: [`${protocol}.token.${token}`],
       };
     });
 
@@ -833,19 +877,13 @@ export const make = Effect.fn("EasDeviceHost.make")(function* (config: EasDevice
   // Each server signs in on its own, so one with no Expo credential answers for itself. Reading
   // the credential is local; whether Expo accepts it is only known once a session starts.
   const platformAvailability = (platform: DevicePlatform) =>
-    platform === "ios"
-      ? resolveExpoCredential(config.accessToken).pipe(
-          Effect.provide(services),
-          Effect.as({ platform, available: true }),
-          Effect.catch((error) =>
-            Effect.succeed({ platform, available: false, reason: error.message }),
-          ),
-        )
-      : Effect.succeed({
-          platform,
-          available: false,
-          reason: "EAS Simulator Android emulators are not supported yet.",
-        });
+    resolveExpoCredential(config.accessToken).pipe(
+      Effect.provide(services),
+      Effect.as({ platform, available: true }),
+      Effect.catch((error) =>
+        Effect.succeed({ platform, available: false, reason: error.message }),
+      ),
+    );
 
   const summary: Effect.Effect<DeviceHostSummary> = Effect.all([
     platformAvailability("ios"),
diff --git a/apps/web/src/components/device/DeviceControlsRail.tsx b/apps/web/src/components/device/DeviceControlsRail.tsx
index 3ed2b3a4fa544..740c342b2cf9f 100644
--- a/apps/web/src/components/device/DeviceControlsRail.tsx
+++ b/apps/web/src/components/device/DeviceControlsRail.tsx
@@ -1,4 +1,4 @@
-import type { DevicePlatform } from "@t3tools/contracts";
+import type { DeviceHostSummary, DevicePlatform } from "@t3tools/contracts";
 import {
   Camera,
   ChevronLeft,
@@ -36,6 +36,7 @@ import type { DeviceControls } from "./useDeviceControls";
 
 export function DeviceControlsRail(props: {
   platform: DevicePlatform;
+  hostKind: DeviceHostSummary["kind"] | undefined;
   handle: DeviceStreamHandle | null;
   view: DeviceViewControls;
   controls: DeviceControls;
@@ -46,13 +47,12 @@ export function DeviceControlsRail(props: {
   onFloat: () => void;
   onClose: () => void;
   onPowerOff: () => void;
-  /** The host takes input but runs no device commands (Simlock): no rotation, settings, tools, or screenshots. */
-  inputOnly?: boolean;
 }) {
   const { view, handle, controls } = props;
   const popupSide = "left";
   const settings = controls.detail?.settings;
   const inputDisabled = !handle?.inputConnected;
+  const runsHostCommands = props.hostKind === "local" || props.hostKind === "ssh";
   const nextAppearance = settings?.appearance === "dark" ? "light" : "dark";
   return (
     <aside
@@ -87,7 +87,7 @@ export function DeviceControlsRail(props: {
             >
               <Square />
             </RailButton>
-            {props.inputOnly ? null : (
+            {runsHostCommands ? (
               <Menu>
                 <MenuTrigger
                   render={
@@ -116,9 +116,9 @@ export function DeviceControlsRail(props: {
                   </MenuItem>
                 </MenuPopup>
               </Menu>
-            )}
+            ) : null}
           </>
-        ) : props.inputOnly ? null : (
+        ) : props.hostKind === "simlock" ? null : (
           <RailButton
             tooltipSide={popupSide}
             label="Rotate device"
@@ -128,7 +128,7 @@ export function DeviceControlsRail(props: {
             <RotateCcw />
           </RailButton>
         )}
-        {props.inputOnly ? null : (
+        {runsHostCommands ? (
           <>
             <RailDivider />
             <RailButton
@@ -193,8 +193,8 @@ export function DeviceControlsRail(props: {
               <SlidersHorizontal />
             </RailButton>
           </>
-        )}
-        {props.inputOnly ? null : (
+        ) : null}
+        {props.hostKind === "simlock" ? null : (
           <RailButton
             tooltipSide={popupSide}
             label={props.screenshotPending ? "Capturing screenshot" : "Save screenshot"}
@@ -229,7 +229,7 @@ export function DeviceControlsRail(props: {
             <MenuSeparator />
             <MenuItem variant="destructive" onClick={props.onPowerOff}>
               <Power />
-              {props.inputOnly ? "Return device to the pool" : "Power off device"}
+              {props.hostKind === "simlock" ? "Return device to the pool" : "Power off device"}
             </MenuItem>
           </MenuPopup>
         </Menu>
diff --git a/apps/web/src/components/device/DevicePanel.tsx b/apps/web/src/components/device/DevicePanel.tsx
index c8f55665113ac..90cc7533c0b51 100644
--- a/apps/web/src/components/device/DevicePanel.tsx
+++ b/apps/web/src/components/device/DevicePanel.tsx
@@ -238,7 +238,7 @@ export function DevicePanel(props: {
               environmentId={environmentId}
               device={activeDevice}
               hostLabel={activeHost?.label ?? "Device host"}
-              simlock={activeHost?.kind === "simlock"}
+              hostKind={activeHost?.kind}
               hostDiagnostics={
                 diagnostics.find(({ hostId }) => hostId === activeDevice.hostId)?.detail
               }
diff --git a/apps/web/src/components/device/DeviceSetup.tsx b/apps/web/src/components/device/DeviceSetup.tsx
index 9d7b30c0456a7..29b46e99319a4 100644
--- a/apps/web/src/components/device/DeviceSetup.tsx
+++ b/apps/web/src/components/device/DeviceSetup.tsx
@@ -119,7 +119,7 @@ export function platformSetupStatus(state: DeviceServiceState, platform: DeviceP
     ready: true,
     message:
       remoteHost?.kind === "eas"
-        ? `${remoteHost.label} starts iOS Simulators in the cloud with EAS Simulator.`
+        ? `${remoteHost.label} starts ${platform === "ios" ? "iOS Simulators" : "Android emulators"} in the cloud with EAS Simulator.`
         : platform === "ios"
           ? `Xcode and iOS Simulator are available${location}.`
           : `The Android SDK and Emulator are available${location}.`,
diff --git a/apps/web/src/components/device/DeviceWorkspace.tsx b/apps/web/src/components/device/DeviceWorkspace.tsx
index b57adae023269..08ce51c1c548c 100644
--- a/apps/web/src/components/device/DeviceWorkspace.tsx
+++ b/apps/web/src/components/device/DeviceWorkspace.tsx
@@ -1,4 +1,4 @@
-import type { DeviceSummary, EnvironmentId } from "@t3tools/contracts";
+import type { DeviceHostSummary, DeviceSummary, EnvironmentId } from "@t3tools/contracts";
 import { useRef, useState } from "react";
 import {
   captureDeviceScreenshot,
@@ -16,8 +16,7 @@ export function DeviceWorkspace(props: {
   environmentId: EnvironmentId;
   device: DeviceSummary;
   hostLabel: string;
-  /** Leased from a Simlock pool: serve-sim input, no host commands. */
-  simlock?: boolean;
+  hostKind: DeviceHostSummary["kind"] | undefined;
   hostDiagnostics: string | undefined;
   visible: boolean;
   onFloat: () => void;
@@ -31,7 +30,13 @@ export function DeviceWorkspace(props: {
   // A capture always finishes, even if the panel hides or closes meanwhile; the user asked for it.
   const capturing = useRef(false);
   const access = useDeviceHubAccess(props.environmentId, props.device.hostId);
-  const controls = useDeviceControls({ ...props, access });
+  // Settings and tools run commands on the device's own machine, which EAS and Simlock do not expose.
+  const runsHostCommands = props.hostKind === "local" || props.hostKind === "ssh";
+  const controls = useDeviceControls({
+    ...props,
+    access,
+    visible: props.visible && runsHostCommands,
+  });
   const saveScreenshot = () => {
     if (!access || capturing.current || !props.visible) return;
     capturing.current = true;
@@ -82,12 +87,13 @@ export function DeviceWorkspace(props: {
             deviceId={props.device.id}
             hostId={props.device.hostId}
             visible={props.visible}
-            serveSimOnly={props.simlock === true}
+            serveSimOnly={props.hostKind === "simlock"}
             axOverlay={axOverlay}
             allowPhoneView
             renderControls={(view) => (
               <DeviceControlsRail
                 platform={props.device.platform}
+                hostKind={props.hostKind}
                 handle={view.handle}
                 view={view}
                 controls={controls}
@@ -98,7 +104,6 @@ export function DeviceWorkspace(props: {
                 onFloat={props.onFloat}
                 onClose={props.onClose}
                 onPowerOff={props.onPowerOff}
-                inputOnly={props.simlock === true}
               />
             )}
           />
diff --git a/docs/internals/devices.md b/docs/internals/devices.md
index 5273f7942e9e0..28fa103feb5cb 100644
--- a/docs/internals/devices.md
+++ b/docs/internals/devices.md
@@ -36,13 +36,13 @@ its sessions. Sessions it starts are recorded under the state directory and
 stopped by the next server if this one dies; sessions other tools started on
 the same account are never touched.
 
-Each session brings its own serve-sim preview host and agent-device daemon,
-with their own tokens. The proxy asks the host to route each request
-(`DeviceHostReady.upstream`) and adds the session token server-side, so
+Each session brings its own preview host (serve-sim, or serve-emu for Android)
+and agent-device daemon, with their own tokens. The proxy asks the host to
+route each request (`DeviceHostReady.upstream`) and adds the session token server-side, so
 clients never hold it. Agent config files are written per device
 (`DeviceOperations.agentEndpoint`), which is why `device_open` opens the
-device before targeting it. Device settings run `simctl` on the simulator's
-machine, which EAS does not expose, so they are unavailable there.
+device before targeting it. Device settings and tools run `simctl` or `adb` on
+the device's machine, which EAS does not expose, so they are unavailable there.
 
 ## Simlock hosts lease through the agent-device front
 
@@ -147,8 +147,8 @@ decoder then retains frames for seconds despite `optimizeForLatency` and an empt
 `decodeQueueSize`. The iOS AVCC viewer restores the missing metadata before
 configuring the decoder so hardware decoding can remain enabled. WebCodecs is
 secure-context only, so the viewer probes `isConfigSupported` and falls back to
-MJPEG on iOS when decoding is unavailable. Android has no MJPEG; there the panel
-reports that it cannot decode.
+MJPEG on iOS when decoding is unavailable. Android's SEMU socket has no MJPEG;
+there the panel reports that it cannot decode.
 
 serve-sim can also be locked to WebRTC, as on EAS Simulator, and then refuses
 AVCC with a 409 naming the transport. The viewer still asks for AVCC first, so
@@ -156,3 +156,6 @@ hubs that serve it pay nothing, and switches on that 409, or when its MJPEG
 image fails in a browser that has `RTCPeerConnection`. Offers are not trickled:
 serve-sim takes one offer with every candidate. The video element only feeds
 the same canvas sink, so the panel and the mobile WebView keep one surface.
+Android asks serve-emu's `/api` before opening its video socket and streams
+WebRTC when it is advertised (EAS Simulator), keeping a separate `video=0`
+socket for input so input can reconnect without restarting video.
diff --git a/docs/user/devices.md b/docs/user/devices.md
index ce5a7d8d06d05..46a5a427cc87c 100644
--- a/docs/user/devices.md
+++ b/docs/user/devices.md
@@ -94,7 +94,7 @@ started from then on; your own Device panel is unaffected.
 The device stream goes through the environment server, so it works over the
 local network, Tailscale, and T3 Connect. Live video needs a secure page
 (HTTPS or localhost); on a plain-HTTP remote origin iOS falls back to a slower
-still-image stream and Android cannot show video.
+still-image stream and Android cannot show video, except on EAS Simulator.
 
 ## SSH device hosts
 
diff --git a/packages/client-runtime/src/device/stream.test.ts b/packages/client-runtime/src/device/stream.test.ts
index 737daf5158c04..09f04c52780e2 100644
--- a/packages/client-runtime/src/device/stream.test.ts
+++ b/packages/client-runtime/src/device/stream.test.ts
@@ -75,7 +75,7 @@ describe("native device stream transport", () => {
       }
     }
     vi.stubGlobal("WebSocket", FakeSocket);
-    const fetch = vi.fn(() => Promise.resolve(new Response("frame")));
+    const fetch = vi.fn(() => Promise.resolve(Response.json({})));
     vi.stubGlobal("fetch", fetch);
     const events = {
       onStatus: vi.fn(),
@@ -251,6 +251,7 @@ function recoveryFixture(
   const fetch = vi.fn((url: string, init: RequestInit) => {
     const signal = init.signal!;
     signals.push(signal);
+    if (url.includes("/api?")) return Promise.resolve(Response.json({}));
     if (!url.includes("stream.avcc")) return Promise.resolve(new Response("prime"));
     return Promise.resolve(
       new Response(
@@ -450,9 +451,11 @@ describe("shared device stream readiness and recovery", () => {
         }),
     );
     client.start();
+    await vi.advanceTimersByTimeAsync(0);
     sockets[0]!.onmessage?.({ data: sps });
     client.stop();
     client.start();
+    await vi.advanceTimersByTimeAsync(0);
     resolveSupport({ supported: true });
     await vi.advanceTimersByTimeAsync(0);
     expect(decoders).toHaveLength(0);
@@ -491,3 +494,136 @@ describe("shared device stream readiness and recovery", () => {
     expect(vi.getTimerCount()).toBe(0);
   });
 });
+
+describe("Android WebRTC device streams", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+  });
+
+  function setup() {
+    vi.useFakeTimers();
+    const sockets: Socket[] = [];
+    class Socket {
+      static OPEN = 1;
+      readyState = 1;
+      binaryType = "";
+      onopen: (() => void) | null = null;
+      onmessage: ((event: { data: string }) => void) | null = null;
+      onclose: ((event: { code: number; reason: string }) => void) | null = null;
+      send = vi.fn();
+      close = vi.fn();
+      readonly url: string;
+      constructor(url: string) {
+        this.url = url;
+        sockets.push(this);
+      }
+    }
+    const videos: Video[] = [];
+    class Video {
+      muted = false;
+      playsInline = false;
+      style = { cssText: "" };
+      srcObject: unknown = null;
+      videoWidth = 400;
+      videoHeight = 800;
+      setAttribute = vi.fn();
+      remove = vi.fn();
+      play = vi.fn(async () => {});
+      callback: (() => void) | null = null;
+      requestVideoFrameCallback(callback: () => void) {
+        this.callback = callback;
+        return 0;
+      }
+      constructor() {
+        videos.push(this);
+      }
+    }
+    const peers: Peer[] = [];
+    class Peer {
+      iceGatheringState = "complete";
+      connectionState = "connected";
+      localDescription = { type: "offer", sdp: "offer-sdp" };
+      ontrack: ((event: { streams: unknown[]; track: unknown }) => void) | null = null;
+      onconnectionstatechange: (() => void) | null = null;
+      close = vi.fn();
+      createOffer = vi.fn(async () => this.localDescription);
+      setLocalDescription = vi.fn(async () => {});
+      setRemoteDescription = vi.fn(async () => {});
+      addTransceiver = vi.fn(() => ({ setCodecPreferences: vi.fn() }));
+      addEventListener = vi.fn();
+      removeEventListener = vi.fn();
+      constructor() {
+        peers.push(this);
+      }
+    }
+    vi.stubGlobal("WebSocket", Socket);
+    vi.stubGlobal("RTCPeerConnection", Peer);
+    vi.stubGlobal("RTCRtpReceiver", { getCapabilities: () => ({ codecs: [] }) });
+    vi.stubGlobal("document", { createElement: () => new Video(), body: { append: vi.fn() } });
+    const fetch = vi.fn((url: string, _init?: RequestInit) =>
+      Promise.resolve(
+        url.includes("/api?")
+          ? Response.json({ serial: "emulator-5554", stream: { transport: "webrtc" } })
+          : Response.json({ type: "answer", sdp: "answer-sdp" }),
+      ),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const events = {
+      onStatus: vi.fn(),
+      onScreen: vi.fn(),
+      onUnauthorized: vi.fn(),
+      onMjpegFallback: vi.fn(),
+      onInputConnected: vi.fn(),
+    };
+    const present = vi.fn(() => true);
+    const client = createDeviceStreamClient(
+      {
+        platform: "android",
+        deviceId: "session-1",
+        access: {
+          httpBase: "https://test/api/device-hub",
+          wsBase: "wss://test/api/device-hub",
+          credentials: true,
+          query: { hostId: "eas" },
+        },
+      },
+      { present },
+      events,
+    );
+    return { client, events, fetch, peers, videos, sockets, present };
+  }
+
+  it("streams over WebRTC when serve-emu advertises it, with input that reconnects on its own", async () => {
+    const { client, events, fetch, peers, videos, sockets, present } = setup();
+    client.start();
+    await vi.advanceTimersByTimeAsync(0);
+    expect(fetch.mock.calls.map(([url]) => url)).toEqual([
+      "https://test/api/device-hub/vendor/serve-emu/api?device=session-1&hostId=eas",
+      "https://test/api/device-hub/vendor/serve-emu/webrtc/offer?device=session-1&hostId=eas",
+    ]);
+    expect(peers[0]?.setRemoteDescription).toHaveBeenCalledWith({
+      type: "answer",
+      sdp: "answer-sdp",
+    });
+    peers[0]?.ontrack?.({ streams: [{}], track: {} });
+    videos[0]?.callback?.();
+    expect(present).toHaveBeenCalledWith(videos[0], 400, 800);
+    expect(events.onStatus).toHaveBeenLastCalledWith("streaming", undefined);
+
+    expect(sockets.map((socket) => socket.url)).toEqual([
+      "wss://test/api/device-hub/vendor/serve-emu/ws?device=session-1&video=0&hostId=eas",
+    ]);
+    sockets[0]!.onopen?.();
+    client.pressButton("back");
+    expect(sockets[0]!.send).toHaveBeenCalledWith(JSON.stringify({ type: "back" }));
+    events.onStatus.mockClear();
+    sockets[0]!.onclose?.({ code: 1001, reason: "going away" });
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(sockets[1]?.url).toContain("video=0");
+    expect(peers).toHaveLength(1);
+    expect(peers[0]?.close).not.toHaveBeenCalled();
+    expect(events.onStatus).not.toHaveBeenCalled();
+    client.stop();
+  });
+});
diff --git a/packages/client-runtime/src/device/stream.ts b/packages/client-runtime/src/device/stream.ts
index c4b8078597245..a8913d5a41037 100644
--- a/packages/client-runtime/src/device/stream.ts
+++ b/packages/client-runtime/src/device/stream.ts
@@ -836,9 +836,10 @@ export function createDeviceStreamClient(
 
   /**
    * serve-sim can be locked to WebRTC (EAS Simulator always is), and then
-   * refuses AVCC and MJPEG. An unreadable answer keeps the AVCC path.
+   * refuses AVCC and MJPEG; serve-emu advertises WebRTC the same way. An
+   * unreadable answer keeps the default path.
    */
-  const probeIosTransport = async (): Promise<WebRtcSettings | null> => {
+  const probeWebRtc = async (): Promise<WebRtcSettings | null> => {
     const probe = new AbortController();
     const timeout = setTimeout(() => probe.abort(), TRANSPORT_PROBE_TIMEOUT_MS);
     try {
@@ -858,6 +859,9 @@ export function createDeviceStreamClient(
     }
   };
 
+  const webRtcUrl = (action: "offer" | "close") =>
+    httpUrl(avcc ? `/helper/${device}/webrtc/${action}` : `/webrtc/${action}?device=${device}`);
+
   const closePeer = () => {
     const current = peer;
     if (!current) return;
@@ -865,8 +869,8 @@ export function createDeviceStreamClient(
     current.connection.close();
     current.video.srcObject = null;
     current.video.remove();
-    // Releases serve-sim's capture session; best effort because the page may be unloading.
-    void fetch(httpUrl(`/helper/${device}/webrtc/close`), {
+    // Releases the capture session; best effort because the page may be unloading.
+    void fetch(webRtcUrl("close"), {
       method: "POST",
       keepalive: true,
       headers: { "content-type": "application/json" },
@@ -875,7 +879,7 @@ export function createDeviceStreamClient(
     }).catch(() => {});
   };
 
-  const readIosWebRtc = async (settings: WebRtcSettings) => {
+  const readWebRtc = async (settings: WebRtcSettings) => {
     const lifecycle = generation;
     const feedGeneration = ++videoGeneration;
     closePeer();
@@ -920,7 +924,7 @@ export function createDeviceStreamClient(
       if (!isCurrent()) return;
       closePeer();
       connecting(detail);
-      scheduleRetry("video", () => void readIosWebRtc(settings));
+      scheduleRetry("video", () => void readWebRtc(settings));
     };
     const presentFrame = () => {
       if (!isCurrent()) {
@@ -988,7 +992,7 @@ export function createDeviceStreamClient(
         iceGatheringDeadlineMs = Math.min(iceGatheringDeadlineMs * 2, ICE_GATHERING_MAX_TIMEOUT_MS);
         return retry("Device stream found no network candidates yet. Retrying…");
       }
-      const response = await fetch(httpUrl(`/helper/${device}/webrtc/offer`), {
+      const response = await fetch(webRtcUrl("offer"), {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
@@ -1023,8 +1027,7 @@ export function createDeviceStreamClient(
   const switchToWebRtc = async (failure: string, locked: boolean) => {
     const session = generation;
     if (typeof RTCPeerConnection === "undefined") return fail(failure);
-    const settings =
-      (await probeIosTransport()) ?? (locked ? { transport: "webrtc" as const } : null);
+    const settings = (await probeWebRtc()) ?? (locked ? { transport: "webrtc" as const } : null);
     if (stopped || generation !== session) return;
     if (!settings) return fail(failure);
     if (mjpeg) {
@@ -1036,7 +1039,7 @@ export function createDeviceStreamClient(
     // MJPEG may have shown frames already: say the stream is connecting again
     // rather than leave a blank canvas until the first WebRTC frame.
     connecting("Switching to WebRTC.");
-    void readIosWebRtc(settings);
+    void readWebRtc(settings);
   };
 
   const startDuoVideo = (panels: DuoPanelSinks) => {
@@ -1161,18 +1164,21 @@ export function createDeviceStreamClient(
     ws.onerror = () => ws.close();
   };
 
-  const connectAndroid = () => {
+  /** `inputOnly` keeps a socket for input beside a WebRTC feed, so its reconnects leave video alone. */
+  const connectAndroid = (inputOnly = false) => {
     if (stopped) return;
-    const ws = new WebSocket(wsUrl(`/ws?device=${device}&frame-meta=1`));
+    const ws = new WebSocket(
+      wsUrl(`/ws?device=${device}&${inputOnly ? "video=0" : "frame-meta=1"}`),
+    );
     ws.binaryType = "arraybuffer";
     socket = ws;
     ws.onopen = () => {
       if (stopped || socket !== ws) return;
-      connecting();
+      if (!inputOnly) connecting();
       events.onInputConnected(true);
     };
     ws.onmessage = (event) => {
-      if (stopped || socket !== ws) return;
+      if (stopped || socket !== ws || inputOnly) return;
       if (typeof event.data === "string") {
         // The encoder restarts at a new size when the device rotates; the
         // next keyframe carries a fresh SPS, so the decoder is rebuilt from it.
@@ -1224,13 +1230,29 @@ export function createDeviceStreamClient(
         (event.code === 1006 && access.query.wsTicket)
       )
         return handleUnauthorized();
-      configuring = false;
-      connecting(event.reason || undefined);
-      scheduleRetry("input", connectAndroid);
+      if (!inputOnly) {
+        configuring = false;
+        connecting(event.reason || undefined);
+      }
+      // A full socket re-probes, so one failed /api read does not pin SEMU on a WebRTC host.
+      scheduleRetry("input", () => (inputOnly ? connectAndroid(true) : void startAndroid()));
     };
     ws.onerror = () => ws.close();
   };
 
+  const startAndroid = async () => {
+    const session = generation;
+    const settings = await probeWebRtc();
+    if (stopped || generation !== session) return;
+    if (settings) {
+      if (typeof RTCPeerConnection === "undefined")
+        return fail("This browser cannot receive the device's WebRTC stream.");
+      if (!target.videoOnly) connectAndroid(true);
+      void readWebRtc(settings);
+    } else if (useWebCodecs) connectAndroid();
+    else fail("This browser cannot decode the Android stream (WebCodecs unavailable).");
+  };
+
   const start = () => {
     if (!stopped) return;
     stopped = false;
@@ -1247,11 +1269,7 @@ export function createDeviceStreamClient(
       if (!target.videoOnly) void connectIosInput();
       if (useWebCodecs) void readIosVideo();
       else fallBackToMjpeg();
-    } else if (useWebCodecs) {
-      connectAndroid();
-    } else {
-      fail("This browser cannot decode the Android stream (WebCodecs unavailable).");
-    }
+    } else void startAndroid();
   };
 
   const stop = () => {

From cba30591f95859bc76154e5be97891ea4ae1b85a Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Fri, 30 Oct 2026 00:02:56 +0000
Subject: [PATCH 113/146] fix(web,mobile): image-only messages show the image,
 not the placeholder prompt (#26769)

---
 .../src/features/threads/ThreadFeed.tsx       | 37 ++++++--
 .../threads/threadQueueControlPresentation.ts |  5 +-
 .../src/components/chat/QueuedRunsControl.tsx | 17 ++--
 .../chat/TimelineUserMessageRow.tsx           | 87 ++++++++++++++++---
 .../client-runtime/src/userMessage.test.ts    | 14 +++
 packages/client-runtime/src/userMessage.ts    |  4 +-
 .../shared/src/composerContextReferences.ts   |  5 ++
 packages/shared/src/threadFindText.test.ts    | 11 +++
 packages/shared/src/threadFindText.ts         |  7 +-
 9 files changed, 161 insertions(+), 26 deletions(-)

diff --git a/apps/mobile/src/features/threads/ThreadFeed.tsx b/apps/mobile/src/features/threads/ThreadFeed.tsx
index da127a29ef9bf..33a57859ff8b3 100644
--- a/apps/mobile/src/features/threads/ThreadFeed.tsx
+++ b/apps/mobile/src/features/threads/ThreadFeed.tsx
@@ -1596,6 +1596,16 @@ function renderFeedEntry(
       const visibleAttachments = attachments.filter(
         (attachment) => isImageAttachment(attachment) || !inlineAttachmentIds.has(attachment.id),
       );
+      // Images sent without words show as images, not as a bubble around them.
+      const mediaOnly =
+        foldRowId === null &&
+        presentation.attribution !== "guest" &&
+        presentation.text.trim() === "" &&
+        visibleAttachments.length + (entry.pendingMessage?.attachments.length ?? 0) > 0 &&
+        visibleAttachments.every(isImageAttachment) &&
+        (entry.pendingMessage?.attachments ?? []).every(
+          (attachment) => attachment.type === "image",
+        );
       return (
         <Animated.View
           className="mb-5 items-end"
@@ -1612,13 +1622,13 @@ function renderFeedEntry(
           <View
             className="min-w-0 rounded-[20px]"
             style={{
-              backgroundColor: userBubbleColor,
+              backgroundColor: mediaOnly ? undefined : userBubbleColor,
               maxWidth: props.duoColumns ? "85%" : props.userBubbleMaxWidth,
               ...(!bubbleBodyVisible
                 ? null
                 : hasReviewCommentContext
                   ? { width: props.reviewCommentBubbleWidth }
-                  : hasWideBlock || foldExpanded
+                  : hasWideBlock || foldExpanded || (mediaOnly && visibleAttachments.length > 0)
                     ? { width: props.duoColumns ? "85%" : props.userBubbleMaxWidth }
                     : null),
             }}
@@ -1640,7 +1650,13 @@ function renderFeedEntry(
               />
             ) : null}
             {bubbleBodyVisible ? (
-              <View className={cn("gap-2 px-3.5 pb-2.5", foldRowId === null && "pt-2.5")}>
+              <View
+                className={cn(
+                  "gap-2",
+                  !mediaOnly && "px-3.5 pb-2.5",
+                  !mediaOnly && foldRowId === null && "pt-2.5",
+                )}
+              >
                 {entry.pendingMessage?.attachments.map((attachment) =>
                   attachment.type === "image" && attachment.uploadedAttachmentId ? (
                     <MessageAttachmentImage
@@ -1649,7 +1665,11 @@ function renderFeedEntry(
                       attachmentId={attachment.uploadedAttachmentId}
                       name={attachment.name}
                       mimeType={attachment.mimeType}
-                      className="h-[140px] w-[180px] rounded-[14px]"
+                      className={
+                        mediaOnly
+                          ? "h-[140px] w-[180px] rounded-[20px]"
+                          : "h-[140px] w-[180px] rounded-[14px]"
+                      }
                       onPressPreview={props.onPressPreview}
                     />
                   ) : attachment.type === "image" ? (
@@ -1668,7 +1688,7 @@ function renderFeedEntry(
                     >
                       <Image
                         source={{ uri: attachment.previewUri }}
-                        style={{ width: 180, height: 140, borderRadius: 14 }}
+                        style={{ width: 180, height: 140, borderRadius: mediaOnly ? 20 : 14 }}
                       />
                     </Pressable>
                   ) : (
@@ -1689,7 +1709,10 @@ function renderFeedEntry(
                           className={
                             inlineAttachmentIds.size
                               ? "h-24 w-24 rounded-[14px] bg-user-bubble-foreground/15"
-                              : "aspect-[1.3] w-full rounded-[14px] bg-user-bubble-foreground/15"
+                              : mediaOnly
+                                ? // Matches the bubble's corners; native borders sit inside, so the edge adds no size.
+                                  "aspect-[1.3] w-full rounded-[20px] border border-border bg-user-bubble-foreground/15"
+                                : "aspect-[1.3] w-full rounded-[14px] bg-user-bubble-foreground/15"
                           }
                           onPressPreview={props.onPressPreview}
                         />
@@ -1707,7 +1730,7 @@ function renderFeedEntry(
                     })}
                   </View>
                 ) : null}
-                {message.text.trim().length > 0 ? (
+                {presentation.text.trim().length > 0 ? (
                   <MarkdownImageAvailableWidthContext
                     value={props.userBubbleMaxWidth - USER_BUBBLE_HORIZONTAL_PADDING * 2}
                   >
diff --git a/apps/mobile/src/features/threads/threadQueueControlPresentation.ts b/apps/mobile/src/features/threads/threadQueueControlPresentation.ts
index 444d969176ba2..a62e29e14795d 100644
--- a/apps/mobile/src/features/threads/threadQueueControlPresentation.ts
+++ b/apps/mobile/src/features/threads/threadQueueControlPresentation.ts
@@ -1,5 +1,6 @@
 import type { EnvironmentId, RunId, ThreadId } from "@t3tools/contracts";
 import { assistantCitationsToPlainText } from "@t3tools/shared/assistantCitations";
+import { isAttachmentOnlyBootstrapPrompt } from "@t3tools/shared/composerContextReferences";
 
 export const REMOVE_QUEUED_MESSAGE_ACCESSIBILITY_LABEL = "Remove queued message";
 
@@ -35,7 +36,9 @@ export function resolveThreadQueueRowControls(input: {
     canSend: mutationEnabled && (input.canPromoteToSteer || input.canSendNow) && !isEditing,
     dismissAccessibilityLabel: REMOVE_QUEUED_MESSAGE_ACCESSIBILITY_LABEL,
     // Editing and sending keep the original text so quoted citations stay linked.
-    displayText: assistantCitationsToPlainText(input.text),
+    displayText: isAttachmentOnlyBootstrapPrompt(input.text)
+      ? ""
+      : assistantCitationsToPlainText(input.text),
     isEditing,
   };
 }
diff --git a/apps/web/src/components/chat/QueuedRunsControl.tsx b/apps/web/src/components/chat/QueuedRunsControl.tsx
index 866612bc11009..ca98e919ff93d 100644
--- a/apps/web/src/components/chat/QueuedRunsControl.tsx
+++ b/apps/web/src/components/chat/QueuedRunsControl.tsx
@@ -1,7 +1,10 @@
 import { scopeThreadRef } from "@t3tools/client-runtime/environment";
 import { deriveThreadQueueWorkflowState } from "@t3tools/client-runtime/state/thread-workflows";
 import { assistantCitationsToPlainText } from "@t3tools/shared/assistantCitations";
-import { replaceComposerContextReferences } from "@t3tools/shared/composerContextReferences";
+import {
+  isAttachmentOnlyBootstrapPrompt,
+  replaceComposerContextReferences,
+} from "@t3tools/shared/composerContextReferences";
 import type {
   ChatAttachment as ContractChatAttachment,
   EnvironmentId,
@@ -237,11 +240,13 @@ export function QueuedRunsControl({
       </span>
       <ol className="flex flex-col items-end gap-3" id={queueListId}>
         {visibleItems.map((item, position) => {
-          const previewText = assistantCitationsToPlainText(
-            replaceComposerContextReferences(item.text, (reference) =>
-              reference.kind === "image" && item.thumbnails.length > 0 ? "" : reference.label,
-            ),
-          ).trim();
+          const previewText = isAttachmentOnlyBootstrapPrompt(item.text)
+            ? ""
+            : assistantCitationsToPlainText(
+                replaceComposerContextReferences(item.text, (reference) =>
+                  reference.kind === "image" && item.thumbnails.length > 0 ? "" : reference.label,
+                ),
+              ).trim();
           const isEditing = item.runId !== null && item.runId === props.editingRunId;
           return (
             <li
diff --git a/apps/web/src/components/chat/TimelineUserMessageRow.tsx b/apps/web/src/components/chat/TimelineUserMessageRow.tsx
index 66cbb0bcc5ed4..c4363a1b45983 100644
--- a/apps/web/src/components/chat/TimelineUserMessageRow.tsx
+++ b/apps/web/src/components/chat/TimelineUserMessageRow.tsx
@@ -81,6 +81,10 @@ import {
 import { UserMessageContextReferenceChip } from "./UserMessageContextChips";
 import { resolvePreviewAnnotationImage } from "./TimelineUserMessageRow.logic";
 
+// Drawn inside the media so dark screenshots keep an edge on the dark background.
+const MEDIA_EDGE_CLASS_NAME =
+  "relative after:pointer-events-none after:absolute after:inset-0 after:z-10 after:rounded-[inherit] after:ring-1 after:ring-inset after:ring-black/9 dark:after:ring-white/12";
+
 const BUBBLE_CHIP_CLASS_NAME =
   "[&_[data-slot=context-chip]]:[--context-chip-ink:var(--context-chip-message,var(--context-chip-accent))]";
 
@@ -327,9 +331,7 @@ function UserTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message"
       : null,
   );
   const senderLabel = senderShell?.title.trim() || "Agent";
-  const resolvedContext = resolveUserMessageContext(
-    userMessage.attribution === "guest" ? { ...row.message, text: userMessage.text } : row.message,
-  );
+  const resolvedContext = resolveUserMessageContext({ ...row.message, text: userMessage.text });
   const previewImages = userImages.filter((image) => image.name.startsWith("preview-annotation-"));
   const revertTurnCount = row.revertTurnCount;
   const chippedAttachmentIds = new Set(
@@ -340,6 +342,27 @@ function UserTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message"
   );
   const regularImages = userImages.filter((image) => !image.name.startsWith("preview-annotation-"));
   const unchippedFiles = otherUserFiles.filter((file) => !chippedAttachmentIds.has(file.id));
+  // Images or videos sent without words show as media, not as a bubble around them.
+  const mediaOnly =
+    !folded &&
+    userMessage.attribution !== "guest" &&
+    resolvedContext.text.trim() === "" &&
+    userAudio.length === 0 &&
+    unchippedFiles.length === 0 &&
+    unknownAttachments.length === 0 &&
+    regularImages.length + userVideos.length > 0;
+  // A lone image keeps its own shape; a 4:3 crop hides most of a wide screenshot.
+  const loneImage =
+    mediaOnly &&
+    userVideos.length === 0 &&
+    regularImages.length === 1 &&
+    regularImages[0]!.source?.kind !== "snap-shot";
+  // Several images sent without words share one rounded shape, split by hairlines.
+  const collage =
+    mediaOnly &&
+    userVideos.length === 0 &&
+    regularImages.length > 1 &&
+    regularImages.every((image) => image.source?.kind !== "snap-shot");
   const annotationRecordIds = resolvedContext.records
     .filter((record) => record.kind === "preview-annotation")
     .map((record) => record.contextId);
@@ -469,8 +492,10 @@ function UserTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message"
         className={cn(
           "relative min-w-0 max-w-[80%] rounded-2xl text-message-foreground",
           BUBBLE_CHIP_CLASS_NAME,
-          userMessage.attribution === "guest" ? guestBubbleClassName(false) : "bg-message",
-          !folded && "p-3",
+          userMessage.attribution === "guest"
+            ? guestBubbleClassName(false)
+            : !mediaOnly && "bg-message",
+          !folded && !mediaOnly && "p-3",
           folded && expanded && "w-full",
         )}
       >
@@ -502,15 +527,45 @@ function UserTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message"
             )}
           >
             {(regularImages.length > 0 || userVideos.length > 0) && (
-              <div className="mb-2 grid max-w-[210px] grid-cols-2 gap-2">
-                {regularImages.map((image) => (
+              <div
+                className={cn(
+                  "grid",
+                  !mediaOnly
+                    ? "mb-2 max-w-[210px] grid-cols-2 gap-2"
+                    : loneImage
+                      ? "max-w-full"
+                      : collage
+                        ? cn(
+                            MEDIA_EDGE_CLASS_NAME,
+                            "w-80 max-w-full gap-px overflow-hidden rounded-2xl bg-black/9 dark:bg-white/12",
+                            regularImages.length === 2
+                              ? "auto-rows-[12rem] grid-cols-2"
+                              : regularImages.length === 3
+                                ? "auto-rows-[calc(6rem-0.5px)] grid-cols-[3fr_2fr]"
+                                : "auto-rows-[6rem] grid-cols-2",
+                          )
+                        : "w-80 max-w-full grid-cols-2 gap-2",
+                )}
+              >
+                {regularImages.map((image, index) => (
                   <div
                     key={image.id}
                     className={cn(
                       "bg-background/70",
                       image.source?.kind === "snap-shot" && image.previewUrl
                         ? cn(SNAP_SHOT_ATTACHMENT_FRAME_CLASS, "col-span-2")
-                        : "aspect-[4/3] overflow-hidden rounded-lg border border-border/80",
+                        : loneImage
+                          ? cn(MEDIA_EDGE_CLASS_NAME, "overflow-hidden rounded-2xl")
+                          : collage
+                            ? cn(
+                                "overflow-hidden bg-background",
+                                regularImages.length === 3 && index === 0 && "row-span-2",
+                                regularImages.length > 3 &&
+                                  regularImages.length % 2 === 1 &&
+                                  index === regularImages.length - 1 &&
+                                  "col-span-2",
+                              )
+                            : "aspect-[4/3] overflow-hidden rounded-lg border border-border/80",
                     )}
                   >
                     {image.previewUrl ? (
@@ -532,11 +587,23 @@ function UserTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message"
                           alt={image.name}
                           decoding="async"
                           loading="lazy"
-                          className="block size-full transform-gpu object-cover"
+                          className={cn(
+                            "block transform-gpu",
+                            // A fixed height keeps the row from growing when the image loads.
+                            loneImage
+                              ? "h-48 w-auto min-w-24 max-w-full object-cover"
+                              : "size-full object-cover",
+                          )}
                         />
                       </button>
                     ) : (
-                      <div className="flex min-h-[72px] items-center justify-center px-2 py-3 text-center text-2xs text-muted-foreground/70">
+                      <div
+                        className={cn(
+                          "flex min-h-[72px] items-center justify-center px-2 py-3 text-center text-2xs text-muted-foreground/70",
+                          loneImage && "h-48 w-64 max-w-full",
+                          collage && "h-full",
+                        )}
+                      >
                         {image.name}
                       </div>
                     )}
diff --git a/packages/client-runtime/src/userMessage.test.ts b/packages/client-runtime/src/userMessage.test.ts
index 0447dc54d1b26..207939cf2f39d 100644
--- a/packages/client-runtime/src/userMessage.test.ts
+++ b/packages/client-runtime/src/userMessage.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vite-plus/test";
 
 import { GuestMessageId } from "@t3tools/contracts";
+import { ATTACHMENT_ONLY_BOOTSTRAP_PROMPT } from "@t3tools/shared/composerContextReferences";
 
 import { resolveUserMessagePresentation } from "./userMessage.ts";
 
@@ -21,6 +22,19 @@ describe("resolveUserMessagePresentation", () => {
     }
   });
 
+  it("hides the prompt that stands in for an attachment-only message", () => {
+    for (const text of [
+      ATTACHMENT_ONLY_BOOTSTRAP_PROMPT,
+      `Ultrathink:\n${ATTACHMENT_ONLY_BOOTSTRAP_PROMPT}`,
+    ]) {
+      expect(resolveUserMessagePresentation({ role: "user", text })).toEqual({
+        text: "",
+        attribution: null,
+        scheduledTaskId: undefined,
+      });
+    }
+  });
+
   it("shows a guest's own words and name, not the attributed text the agent reads", () => {
     expect(
       resolveUserMessagePresentation({
diff --git a/packages/client-runtime/src/userMessage.ts b/packages/client-runtime/src/userMessage.ts
index d5d7c5ac08956..8a80f31b155d0 100644
--- a/packages/client-runtime/src/userMessage.ts
+++ b/packages/client-runtime/src/userMessage.ts
@@ -5,6 +5,7 @@ import {
   type OrchestrationV2IdleCompaction,
   ScheduledTaskId,
 } from "@t3tools/contracts";
+import { isAttachmentOnlyBootstrapPrompt } from "@t3tools/shared/composerContextReferences";
 
 /** The working row while T3 Code's own compaction runs. */
 export const IDLE_COMPACTING_LABELS = {
@@ -68,7 +69,8 @@ export function resolveUserMessagePresentation(message: {
     };
   }
   return {
-    text: message.text,
+    // The agent needs words to start a turn; people sent only the attachments.
+    text: isAttachmentOnlyBootstrapPrompt(message.text) ? "" : message.text,
     attribution:
       message.createdBy !== "agent"
         ? null
diff --git a/packages/shared/src/composerContextReferences.ts b/packages/shared/src/composerContextReferences.ts
index e1b25bc094a66..88361606a9a64 100644
--- a/packages/shared/src/composerContextReferences.ts
+++ b/packages/shared/src/composerContextReferences.ts
@@ -132,6 +132,11 @@ export function collectComposerContextReferences(
 export const ATTACHMENT_ONLY_BOOTSTRAP_PROMPT =
   "[User attached one or more files without additional text. Respond using the conversation context and the attached files.]";
 
+/** Claude's ultrathink effort sends the prompt as `Ultrathink:\n<prompt>`. */
+export function isAttachmentOnlyBootstrapPrompt(text: string): boolean {
+  return text.replace(/^Ultrathink:\s*/i, "") === ATTACHMENT_ONLY_BOOTSTRAP_PROMPT;
+}
+
 export function isImageReferencesOnly(text: string): boolean {
   const references = collectComposerContextReferences(text);
   return (
diff --git a/packages/shared/src/threadFindText.test.ts b/packages/shared/src/threadFindText.test.ts
index 0dd6a87ae1dea..77a0874c21336 100644
--- a/packages/shared/src/threadFindText.test.ts
+++ b/packages/shared/src/threadFindText.test.ts
@@ -1,6 +1,7 @@
 import { EnvironmentId, MessageId, ThreadId } from "@t3tools/contracts";
 import { expect, it } from "vite-plus/test";
 import { serializeAssistantCitation } from "./assistantCitations.ts";
+import { ATTACHMENT_ONLY_BOOTSTRAP_PROMPT } from "./composerContextReferences.ts";
 import { searchableMessageSegments } from "./threadFindText.ts";
 
 it("excludes review attachments rendered as context chips", () => {
@@ -31,6 +32,16 @@ it("excludes structured context chips without joining text across them", () => {
   ).toEqual(["before", "after"]);
 });
 
+it("excludes the hidden prompt of an attachment-only message", () => {
+  expect(
+    searchableMessageSegments({
+      role: "user",
+      streaming: false,
+      text: ATTACHMENT_ONLY_BOOTSTRAP_PROMPT,
+    }),
+  ).toEqual([]);
+});
+
 it("does not upgrade literal legacy tags in messages with structured context", () => {
   const text =
     "<terminal_context>\n- Terminal 1 line 12:\n  12 | visible output\n</terminal_context>";
diff --git a/packages/shared/src/threadFindText.ts b/packages/shared/src/threadFindText.ts
index a2e5b4dbb982d..3afec6e04729e 100644
--- a/packages/shared/src/threadFindText.ts
+++ b/packages/shared/src/threadFindText.ts
@@ -21,7 +21,10 @@ import {
   resolveMarkdownFileLinkTarget,
 } from "./markdownLinks.ts";
 import { upgradeLegacyContextMessage } from "./composerContextLegacy.ts";
-import { parseComposerContextHref } from "./composerContextReferences.ts";
+import {
+  isAttachmentOnlyBootstrapPrompt,
+  parseComposerContextHref,
+} from "./composerContextReferences.ts";
 import { assistantCitationLabel, parseAssistantCitationHref } from "./assistantCitations.ts";
 import type { OrchestrationV2ConversationMessage } from "@t3tools/contracts";
 import { proposedPlanTitle, stripDisplayedPlanMarkdown } from "./proposedPlanText.ts";
@@ -216,6 +219,8 @@ export function searchableMessageSegments(
   skills: readonly InlineSkill[] = [],
 ): readonly string[] | null {
   if (message.role === "user") {
+    // Clients hide this prompt, so find must not match text nobody can see.
+    if (isAttachmentOnlyBootstrapPrompt(message.text)) return [];
     const text = message.context ? message.text : upgradeLegacyContextMessage(message.text).text;
     return markdownThreadFindText(text, true, cwd, skills);
   }

From b42adff3d77f01f5e0f5edfb5a071dabb535710b Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 17:25:39 -0700
Subject: [PATCH 114/146] ci(mobile): production deploys use a Release Manager
 Expo token (#27285)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/mobile-eas-production.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/mobile-eas-production.yml b/.github/workflows/mobile-eas-production.yml
index b2c03c04ab11c..507e013bf1c2a 100644
--- a/.github/workflows/mobile-eas-production.yml
+++ b/.github/workflows/mobile-eas-production.yml
@@ -97,13 +97,13 @@ jobs:
       - id: expo-token
         name: Check for EXPO_TOKEN
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
         run: |
           if [ -n "$EXPO_TOKEN" ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"
           else
             echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "EXPO_TOKEN is not available; skipping EAS production job."
+            echo "EXPO_PRODUCTION_TOKEN is not available; skipping EAS production job."
           fi
 
       - id: version_app_token
@@ -149,7 +149,7 @@ jobs:
         uses: expo/expo-github-action@v8
         with:
           eas-version: latest
-          token: ${{ secrets.EXPO_TOKEN }}
+          token: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
           # npm, not pnpm: this only installs eas-cli into the action's own
           # tool dir, and pnpm 11 hard-fails that install on dtrace-provider's
           # ignored build script (no allowBuilds config outside the repo).
@@ -159,7 +159,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
         run: |
           eas env:pull production --non-interactive
           # EAS commands skip dotenv, and the Android fingerprint hashes this
@@ -244,7 +244,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true' && github.event_name == 'workflow_dispatch' && inputs.mode == 'build'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
           MOBILE_BUILD_PROFILE: ${{ inputs.profile || 'production' }}
         run: eas build --platform ${{ inputs.platform }} --profile "$MOBILE_BUILD_PROFILE" --auto-submit --non-interactive --no-wait
 
@@ -255,7 +255,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true' && (github.event_name == 'push' || inputs.mode == 'update')
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
           PLATFORM: ${{ inputs.platform || 'all' }}
         run: |
           if [ "$PLATFORM" = "all" ]; then platforms="ios android"; else platforms="$PLATFORM"; fi
@@ -275,7 +275,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true' && github.event_name == 'workflow_dispatch' && inputs.mode == 'update'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
           MOBILE_BUILD_PROFILE: ${{ inputs.profile || 'production' }}
           OTA_MESSAGE: ${{ inputs.message || format('Production OTA ({0})', github.sha) }}
         run: |
@@ -299,7 +299,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true' && github.event_name == 'push'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
         run: |
           failed=0
           message="$(git log -1 --pretty=%s | head -c 120) ($(git rev-parse --short=9 HEAD))"

From f58fad04162165653bf06f0c987bbfb0074a8a4b Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 17:37:57 -0700
Subject: [PATCH 115/146] ci(mobile): maintainers can deploy EAS previews for
 reviewed fork commits (#27292)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/mobile-eas-preview-fork.yml | 145 ++++++++++++++++++
 .github/workflows/mobile-eas-preview.yml      |  14 +-
 2 files changed, 153 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/mobile-eas-preview-fork.yml

diff --git a/.github/workflows/mobile-eas-preview-fork.yml b/.github/workflows/mobile-eas-preview-fork.yml
new file mode 100644
index 0000000000000..e7615d46011bd
--- /dev/null
+++ b/.github/workflows/mobile-eas-preview-fork.yml
@@ -0,0 +1,145 @@
+name: Mobile EAS Preview (Fork)
+
+# EAS previews for fork PRs. This runs the PR's code with an Expo token: the
+# app config and plugins run on this runner, and native builds run on EAS
+# with preview signing credentials. The label is the maintainer's sign-off
+# that they reviewed that code, so it covers exactly the commit it was applied
+# to: this pins that commit and consumes the label before running anything. A
+# later push deploys nothing until the label is applied again.
+#
+# Same-repo PRs deploy on every push while labeled, via mobile-eas-preview.yml.
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  preview:
+    name: EAS Preview
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      github.event.label.name == '🚀 Mobile Continuous Deployment'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    concurrency:
+      group: mobile-eas-preview-fork-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      APP_VARIANT: preview
+      NODE_OPTIONS: --max-old-space-size=8192
+      MOBILE_VERSION_POLICY: fingerprint
+    steps:
+      # If a maintainer removed the label first, that removal wins.
+      - id: consume
+        name: Consume the deployment label
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            try {
+              await github.rest.issues.removeLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                name: context.payload.label.name,
+              });
+              core.setOutput("consumed", "true");
+            } catch (error) {
+              if (error.status !== 404) throw error;
+              core.info("The label was removed before this run could consume it. Skipping.");
+              core.setOutput("consumed", "false");
+            }
+
+      - id: expo-token
+        name: Check for EXPO_PREVIEW_TOKEN
+        if: steps.consume.outputs.consumed == 'true'
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+        run: |
+          if [ -n "$EXPO_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "EXPO_PREVIEW_TOKEN is not set; skipping EAS preview."
+          fi
+
+      # The head SHA from the label event, not the branch, so a push after the
+      # label cannot swap in unreviewed code. No credentials stay in .git for
+      # the PR's scripts to read.
+      - name: Checkout reviewed commit
+        if: steps.expo-token.outputs.present == 'true'
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+          # No sparse-checkout: see mobile-eas-preview.yml.
+
+      # No caches: pull_request_target saves them under main's scope, where
+      # trusted workflows with other secrets would restore what PR code wrote.
+      - name: Setup Vite+
+        if: steps.expo-token.outputs.present == 'true'
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: false
+          run-install: |
+            args:
+              - --filter=@t3tools/mobile...
+
+      - name: Expose pnpm
+        if: steps.expo-token.outputs.present == 'true'
+        run: |
+          pnpm_version="$(node --print "require('./package.json').packageManager.split('@').pop()")"
+          vp_pnpm_bin="$HOME/.vite-plus/package_manager/pnpm/$pnpm_version/pnpm/bin"
+          echo "$vp_pnpm_bin" >> "$GITHUB_PATH"
+          "$vp_pnpm_bin/pnpm" --version
+
+      - name: Setup EAS
+        if: steps.expo-token.outputs.present == 'true'
+        uses: expo/expo-github-action@v8
+        with:
+          # Pinned and installed with npm for the same reasons as mobile-eas-preview.yml.
+          eas-version: 21.8.0
+          eas-cache: false
+          token: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+          packager: npm
+
+      - name: Pull preview environment variables
+        if: steps.expo-token.outputs.present == 'true'
+        working-directory: apps/mobile
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+        run: |
+          eas env:pull preview --non-interactive
+          # See mobile-eas-preview.yml: keeps Android build and OTA fingerprints matching.
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs";
+          import { parseEnv } from "node:util";
+          const env = parseEnv(readFileSync(".env.local", "utf8"));
+          const googleServicesFile = env.T3CODE_ANDROID_GOOGLE_SERVICES_FILE;
+          if (googleServicesFile) {
+            appendFileSync(process.env.GITHUB_ENV, `T3CODE_ANDROID_GOOGLE_SERVICES_FILE=${googleServicesFile}\n`);
+          }
+          NODE
+
+      - name: Deploy with fingerprint check
+        if: steps.expo-token.outputs.present == 'true'
+        uses: expo/expo-github-action/continuous-deploy-fingerprint@main
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+          RUNNER_DEBUG: "1"
+          # The action only comments for pull_request events; this hook gives
+          # it the PR under pull_request_target. Without it, it skips the comment.
+          EXPO_TEST_GITHUB_PULL: ${{ github.event.pull_request.number }}
+        with:
+          profile: preview:dev
+          branch: pr-${{ github.event.pull_request.number }}
+          platform: all
+          environment: preview
+          working-directory: apps/mobile
+          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/mobile-eas-preview.yml b/.github/workflows/mobile-eas-preview.yml
index 107c741424b08..08183d0385811 100644
--- a/.github/workflows/mobile-eas-preview.yml
+++ b/.github/workflows/mobile-eas-preview.yml
@@ -7,7 +7,9 @@ on:
 jobs:
   preview:
     name: EAS Preview
+    # Fork PRs deploy one reviewed commit per label through mobile-eas-preview-fork.yml.
     if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
       contains(github.event.pull_request.labels.*.name, '🚀 Mobile Continuous Deployment') &&
       (github.event.action != 'labeled' || github.event.label.name == '🚀 Mobile Continuous Deployment')
     runs-on: blacksmith-8vcpu-ubuntu-2404
@@ -23,15 +25,15 @@ jobs:
       MOBILE_VERSION_POLICY: fingerprint
     steps:
       - id: expo-token
-        name: Check for EXPO_TOKEN
+        name: Check for EXPO_PREVIEW_TOKEN
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
         run: |
           if [ -n "$EXPO_TOKEN" ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"
           else
             echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "EXPO_TOKEN is not available; skipping EAS preview."
+            echo "EXPO_PREVIEW_TOKEN is not available; skipping EAS preview."
           fi
 
       - name: Checkout
@@ -70,7 +72,7 @@ jobs:
           # continuous-deploy-fingerprint still reads `build.project.ownerAccount`.
           # Unpin once https://github.com/expo/expo-github-action/issues/358 is fixed.
           eas-version: 21.8.0
-          token: ${{ secrets.EXPO_TOKEN }}
+          token: ${{ secrets.EXPO_PREVIEW_TOKEN }}
           # npm, not pnpm: this only installs eas-cli into the action's own
           # tool dir, and pnpm 11 hard-fails that install on dtrace-provider's
           # ignored build script (no allowBuilds config outside the repo).
@@ -80,7 +82,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
         run: |
           eas env:pull preview --non-interactive
           # EAS Update disables dotenv loading. Keep the downloaded native config
@@ -99,7 +101,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         uses: expo/expo-github-action/continuous-deploy-fingerprint@main
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
           # The Expo action otherwise suppresses the EAS command's failure output.
           RUNNER_DEBUG: "1"
         with:

From d7b6cf7884029b20baf5b2adbfe5271490faecf8 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 18:04:16 -0700
Subject: [PATCH 116/146] fix(server): agents yield CPU, tasks, and reclaim to
 the server under pressure (#27176)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cloud/bootService.test.ts  | 13 +++++++
 apps/server/src/cloud/bootService.ts       |  5 ++-
 apps/server/src/process/agentScope.test.ts | 28 +++++++++++++++
 apps/server/src/process/agentScope.ts      | 40 +++++++++++++++-------
 4 files changed, 72 insertions(+), 14 deletions(-)

diff --git a/apps/server/src/cloud/bootService.test.ts b/apps/server/src/cloud/bootService.test.ts
index fca51dcac1e09..5491328a3040a 100644
--- a/apps/server/src/cloud/bootService.test.ts
+++ b/apps/server/src/cloud/bootService.test.ts
@@ -48,6 +48,19 @@ it("reads the served T3 home back out of a rendered unit or plist", () => {
   expect(BootService.bootServiceBaseDirOf("[Service]\nExecStart=/x\n")).toBeUndefined();
 });
 
+it("protects the server unit from agents under CPU and memory pressure", () => {
+  const unit = BootService.renderBootServiceUnit({
+    program: ["/home/theo/.t3/runtime/versions/1.2.3/t3", "__service-launcher"],
+    baseDir: "/home/theo/.t3",
+    logPath: "/home/theo/.t3/userdata/logs/boot-service.log",
+    unitPath: "/home/theo/.config/systemd/user/t3code.service",
+  });
+  const service = unit.slice(unit.indexOf("[Service]"), unit.indexOf("[Install]"));
+  for (const line of ["CPUWeight=1000", "IOWeight=1000", "MemoryLow=1536M", "OOMPolicy=continue"]) {
+    expect(service.split("\n")).toContain(line);
+  }
+});
+
 it.each([
   ["a unit", '/home/theo/T3 "Data"/100%\\x', BootService.renderBootServiceUnit],
   [
diff --git a/apps/server/src/cloud/bootService.ts b/apps/server/src/cloud/bootService.ts
index 15b3b16a7bc0f..5206992f2693f 100644
--- a/apps/server/src/cloud/bootService.ts
+++ b/apps/server/src/cloud/bootService.ts
@@ -110,9 +110,12 @@ export function renderBootServiceUnit(plan: BootServicePlan): string {
     "OOMPolicy=continue",
     "Restart=always",
     "RestartSec=5",
-    // Weights favor the server over the sibling agents slice during CPU or disk saturation.
+    // Weights favor the server over the sibling agents slice; IOWeight needs a delegated io controller.
     "CPUWeight=1000",
     "IOWeight=1000",
+    // Reclaim takes the agents' unprotected pages first. The kernel caps this at the
+    // protection of user.slice and user@.service, which only root can grant.
+    "MemoryLow=1536M",
     // systemd-oomd ignores this preference when the watched cgroup is root-owned, as user-1000.slice usually is.
     "ManagedOOMPreference=avoid",
     `StandardOutput=append:${escapeSystemdSpecifiers(plan.logPath)}`,
diff --git a/apps/server/src/process/agentScope.test.ts b/apps/server/src/process/agentScope.test.ts
index 94ca314ac1f33..286452a5c5781 100644
--- a/apps/server/src/process/agentScope.test.ts
+++ b/apps/server/src/process/agentScope.test.ts
@@ -245,6 +245,34 @@ describe("AgentScope service", () => {
     ),
   );
 
+  it.effect("caps agent memory and yields CPU, disk, and tasks to the server", () =>
+    withFakeSystemd(({ scope, calls }) =>
+      Effect.gen(function* () {
+        yield* scope.wrap({ command: "agent", args: [], name: "t", threadId: "a" });
+        const setProperties = calls.filter(([, verb]) => verb === "set-property");
+        expect(setProperties).toEqual([
+          [
+            "--user",
+            "set-property",
+            "--runtime",
+            "app-t3code-agents.slice",
+            expect.stringMatching(/^MemoryHigh=\d+$/),
+            expect.stringMatching(/^MemoryMax=\d+$/),
+          ],
+          [
+            "--user",
+            "set-property",
+            "--runtime",
+            "app-t3code.slice",
+            "CPUWeight=10",
+            "IOWeight=10",
+            "TasksMax=25%",
+          ],
+        ]);
+      }),
+    ),
+  );
+
   it.effect("stops agents a killed server left before the first launch", () =>
     withFakeSystemd(({ scope, units, calls, stateDir }) =>
       Effect.gen(function* () {
diff --git a/apps/server/src/process/agentScope.ts b/apps/server/src/process/agentScope.ts
index cc6d3a04121f6..c72e4eed88a9c 100644
--- a/apps/server/src/process/agentScope.ts
+++ b/apps/server/src/process/agentScope.ts
@@ -19,6 +19,12 @@ import * as ServerConfig from "../config.ts";
 import * as ProcessRunner from "../processRunner.ts";
 
 const AGENT_SLICE = "app-t3code-agents.slice";
+// Owns every agent slice and competes with the server's unit or scope under app.slice.
+const AGENTS_PARENT_SLICE = "app-t3code.slice";
+// Low weights yield CPU and disk to the server under contention, where the user manager
+// has those controllers: current systemd delegates cpu, rarely io. TasksMax keeps agents
+// below logind's 33% per-user task limit, leaving forks for the server.
+const AGENTS_PARENT_PROPERTIES = ["CPUWeight=10", "IOWeight=10", "TasksMax=25%"];
 
 export function ownedAgentSlice(stateDir: string): string {
   const hash = NodeCrypto.createHash("sha256").update(stateDir).digest("hex").slice(0, 12);
@@ -173,20 +179,28 @@ export const make = Effect.gen(function* () {
         yield* Effect.logInfo("Agent scopes are off: no systemd user manager");
         return undefined;
       }
+      const setProperties = Effect.fn("agentScope.setProperties")(function* (
+        slice: string,
+        properties: ReadonlyArray<string>,
+      ) {
+        const result = yield* run(systemctl, [
+          "--user",
+          "set-property",
+          "--runtime",
+          slice,
+          ...properties,
+        ]);
+        if (result._tag === "None" || result.value.code !== 0) {
+          yield* Effect.logWarning("Could not set resource limits on an agents slice", {
+            slice,
+            properties,
+            stderr: result._tag === "Some" ? result.value.stderr.trim() : undefined,
+          });
+        }
+      });
       const limits = agentSliceMemoryLimits(NodeOS.totalmem());
-      const limited = yield* run(systemctl, [
-        "--user",
-        "set-property",
-        "--runtime",
-        AGENT_SLICE,
-        `MemoryHigh=${limits.high}`,
-        `MemoryMax=${limits.max}`,
-      ]);
-      if (limited._tag === "None" || limited.value.code !== 0) {
-        yield* Effect.logWarning("Could not set memory limits on the agents slice", {
-          stderr: limited._tag === "Some" ? limited.value.stderr.trim() : undefined,
-        });
-      }
+      yield* setProperties(AGENT_SLICE, [`MemoryHigh=${limits.high}`, `MemoryMax=${limits.max}`]);
+      yield* setProperties(AGENTS_PARENT_SLICE, AGENTS_PARENT_PROPERTIES);
       yield* Effect.logInfo("Agent scopes are on", {
         slice: AGENT_SLICE,
         ...limits,

From 44d508fd8b44794e51d82480052f5a041640e411 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 18:04:16 -0700
Subject: [PATCH 117/146] feat(server): `t3 service protect` keeps the server
 alive when agents fill memory (#27239)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/service.test.ts           |  31 ++
 apps/server/src/cli/service.ts                | 134 ++++++-
 apps/server/src/cloud/bootService.test.ts     |   8 +-
 apps/server/src/cloud/bootService.ts          |   3 +
 .../src/cloud/serviceProtection.test.ts       | 265 ++++++++++++++
 apps/server/src/cloud/serviceProtection.ts    | 342 ++++++++++++++++++
 apps/server/src/preview/ServerBrowser.ts      |  14 +
 .../src/preview/ServerBrowserContexts.test.ts |  56 ++-
 .../src/preview/ServerBrowserContexts.ts      |  40 +-
 docs/user/background-service.md               |  18 +
 packages/shared/src/AgentScope.test.ts        |  20 +-
 packages/shared/src/AgentScope.ts             |   8 +
 12 files changed, 919 insertions(+), 20 deletions(-)
 create mode 100644 apps/server/src/cloud/serviceProtection.test.ts
 create mode 100644 apps/server/src/cloud/serviceProtection.ts

diff --git a/apps/server/src/cli/service.test.ts b/apps/server/src/cli/service.test.ts
index 033a96693ada9..2ea799d9f09e4 100644
--- a/apps/server/src/cli/service.test.ts
+++ b/apps/server/src/cli/service.test.ts
@@ -90,6 +90,37 @@ it.layer(Layer.mergeAll(NodeServices.layer, NetService.layer))("service commands
       }),
   );
 
+  it.effect("protect refuses root before creating any T3 directories", () =>
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const parent = yield* fs.makeTempDirectoryScoped({ prefix: "t3-service-cli-test-" });
+      const baseDir = `${parent}/t3`;
+      vi.spyOn(BootService, "layer").mockReturnValue(
+        Layer.succeed(BootService.BootService, makeTestService(status).service),
+      );
+
+      const output = yield* Command.runWith(serviceCommand, { version: packageJson.version })([
+        "protect",
+        "--base-dir",
+        baseDir,
+      ]).pipe(
+        Effect.andThen(TestConsole.logLines),
+        Effect.map((lines) => lines.join("\n")),
+        Effect.provideService(HostProcess.Environment, {}),
+        Effect.provideService(HostProcess.Platform, "linux"),
+        Effect.provideService(HostProcess.UserId, 0),
+        Effect.provide(
+          Layer.mergeAll(
+            ConfigProvider.layer(ConfigProvider.fromEnv({ env: {} })),
+            Layer.fresh(TestConsole.layer),
+          ),
+        ),
+      );
+      expect(output).toContain("without sudo");
+      expect(yield* fs.exists(baseDir)).toBe(false);
+    }),
+  );
+
   // regression: #13239 a stale nvm-installed CLI reported "already using" its own version
   it.effect.each(["install", "update"] as const)(
     "%s names the CLI that found nothing to change",
diff --git a/apps/server/src/cli/service.ts b/apps/server/src/cli/service.ts
index 97ceafd941f1e..62edb31d14b62 100644
--- a/apps/server/src/cli/service.ts
+++ b/apps/server/src/cli/service.ts
@@ -2,12 +2,14 @@ import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as Console from "effect/Console";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
 import * as Terminal from "effect/Terminal";
 import { Command, Flag, GlobalFlag, Prompt } from "effect/cli";
 import { FetchHttpClient } from "effect/http";
 
 import packageJson from "../../package.json" with { type: "json" };
 import * as BootService from "../cloud/bootService.ts";
+import * as ServiceProtection from "../cloud/serviceProtection.ts";
 import { compareExactServiceVersions } from "../cloud/serviceProtocol.ts";
 import type * as ServerConfig from "../config.ts";
 import * as ProcessRunner from "../processRunner.ts";
@@ -68,7 +70,23 @@ function formatServiceChange(
   return `${result.previouslyInstalled ? "Updated" : "Installed"} T3 Code service with t3@${packageJson.version}.\nLogs: ${result.plan.logPath}`;
 }
 
-function formatServiceStatus(status: BootService.BootServiceStatus, cliVersion: string): string {
+function formatProtection(
+  protection: ServiceProtection.ServiceProtectionState | undefined,
+): ReadonlyArray<string> {
+  if (protection === undefined) return [];
+  return [
+    protection.unprotected === undefined
+      ? `  Memory protection: on${protection.setByProtect ? " (t3 service protect)" : ""}`
+      : `  Memory protection: off, ${protection.unprotected} grants none. Run \`t3 service protect\`.`,
+    ...(protection.oomScoreAdj === undefined ? [] : [`  OOM score: ${protection.oomScoreAdj}`]),
+  ];
+}
+
+function formatServiceStatus(
+  status: BootService.BootServiceStatus,
+  cliVersion: string,
+  protection?: ServiceProtection.ServiceProtectionState,
+): string {
   if (!status.supported) {
     return "T3 Code service\n  Status: unavailable on this machine\n  Supported on: Linux with systemd, macOS with launchd";
   }
@@ -89,6 +107,7 @@ function formatServiceStatus(status: BootService.BootServiceStatus, cliVersion:
       `  Status: installed · t3@${installedVersion} (newer than this t3@${cliVersion} CLI)`,
       `  Unit: ${status.unitPath}`,
       `  Logs: ${status.logPath}`,
+      ...formatProtection(protection),
       ...problems,
       `  Next: Run \`t3 update ${installedVersion}\` to match it, or pass \`--allow-downgrade\` to \`t3 service install\` explicitly.`,
     ].join("\n");
@@ -98,6 +117,7 @@ function formatServiceStatus(status: BootService.BootServiceStatus, cliVersion:
     `  Status: ${status.current ? `installed · t3@${installedVersion}` : "needs an update or repair"}`,
     `  Unit: ${status.unitPath}`,
     `  Logs: ${status.logPath}`,
+    ...formatProtection(protection),
     ...problems,
     ...(status.current ? [] : ["  Next: Run `t3 service install` to repair it."]),
   ].join("\n");
@@ -210,12 +230,121 @@ const serviceStatusCommand = Command.make("status", projectLocationFlags).pipe(
       flags,
       Effect.gen(function* () {
         const service = yield* BootService.BootService;
-        yield* Console.log(formatServiceStatus(yield* service.status, packageJson.version));
+        const path = yield* Path.Path;
+        const status = yield* service.status;
+        const protection =
+          status.installed && (yield* HostProcess.Platform) === "linux"
+            ? yield* ServiceProtection.readProtection(path.dirname(status.unitPath)).pipe(
+                Effect.provide(ProcessRunner.layer),
+              )
+            : undefined;
+        yield* Console.log(formatServiceStatus(status, packageJson.version, protection));
       }),
     ),
   ),
 );
 
+const formatDropIns = (dropIns: ReadonlyArray<ServiceProtection.DropIn>) =>
+  dropIns.map(
+    ({ path, contents }) => `  ${path}: ${contents.trimEnd().split("\n").slice(1).join(" ")}`,
+  );
+
+const confirm = (yes: boolean, message: string) =>
+  yes ? Effect.succeed(true) : Prompt.run(Prompt.Confirm({ message, initial: false }));
+
+const serviceProtectCommand = Command.make("protect", {
+  ...projectLocationFlags,
+  undo: Flag.Boolean("undo").pipe(
+    Flag.withDescription("Remove the protection this command set up."),
+    Flag.withDefault(false),
+  ),
+  yes: Flag.Boolean("yes").pipe(
+    Flag.withDescription("Answer yes to every question, including SSH and Tailscale."),
+    Flag.withDefault(false),
+  ),
+}).pipe(
+  Command.withDescription(
+    "Protect the T3 Code server from agents under memory pressure (Linux with systemd). Asks for sudo.",
+  ),
+  Command.withHandler((flags) =>
+    Effect.gen(function* () {
+      const unsupported = "Service protection needs Linux with systemd.";
+      if ((yield* HostProcess.Platform) !== "linux") return yield* Console.log(unsupported);
+      // Before resolving config, which creates T3 directories that root would then own.
+      if ((yield* HostProcess.UserId) === 0) {
+        return yield* Console.log(
+          "Run `t3 service protect` as the user that runs T3 Code, without sudo. It asks for sudo when it needs root.",
+        );
+      }
+      return yield* runServiceCommand(
+        flags,
+        Effect.gen(function* () {
+          const uid = yield* HostProcess.UserId;
+          const remote = yield* ServiceProtection.detectRemoteAccessUnits;
+          const { unitPath } = yield* (yield* BootService.BootService).status;
+          if (uid === undefined || remote === undefined || unitPath === "") {
+            return yield* Console.log(unsupported);
+          }
+          const userUnitDir = (yield* Path.Path).dirname(unitPath);
+
+          if (flags.undo) {
+            const installed = yield* ServiceProtection.installedProtection(
+              ServiceProtection.protectionPlan({
+                uid,
+                userUnitDir,
+                remoteAccessUnits: ServiceProtection.REMOTE_ACCESS_UNITS,
+              }),
+            );
+            if (installed === undefined) {
+              return yield* Console.log("T3 Code service protection is not set up.");
+            }
+            yield* Console.log(
+              [
+                "Removes:",
+                ...[...installed.system, ...installed.user, installed.managerDefaults].map(
+                  ({ path, shared }) =>
+                    `  ${path}${shared === true ? " (kept while another user is protected)" : ""}`,
+                ),
+              ].join("\n"),
+            );
+            if (!(yield* confirm(flags.yes, "Remove T3 Code service protection?"))) return;
+            yield* ServiceProtection.removeProtection(installed);
+            return yield* Console.log(
+              "Removed T3 Code service protection. The server's OOM score returns to normal after `t3 service restart`.",
+            );
+          }
+
+          const names = remote.map((unit) => unit.replace(/\.service$/, "")).join(" and ");
+          const protectRemote =
+            remote.length > 0 &&
+            (yield* confirm(
+              flags.yes,
+              `Also protect ${names} so you can still reach this machine under memory pressure?`,
+            ));
+          const plan = ServiceProtection.protectionPlan({
+            uid,
+            userUnitDir,
+            remoteAccessUnits: protectRemote ? remote : [],
+          });
+          yield* Console.log(
+            [
+              "As root, through sudo:",
+              ...formatDropIns(plan.system),
+              "As you:",
+              ...formatDropIns([plan.managerDefaults, ...plan.user]),
+            ].join("\n"),
+          );
+          if (!(yield* confirm(flags.yes, "Apply these settings?"))) return;
+          yield* ServiceProtection.applyProtection(plan);
+          yield* Console.log(
+            "Protected T3 Code. Memory protection applies now; the server takes its OOM score after `t3 service restart`. Undo with `t3 service protect --undo`.",
+          );
+        }).pipe(Effect.provide(ProcessRunner.layer)),
+      );
+    }),
+  ),
+);
+
 export type ServiceOnboardingOutcome = "ready" | "pending" | "skipped";
 
 export const offerServiceDuringOnboarding = Effect.gen(function* () {
@@ -305,6 +434,7 @@ export const serviceCommand = Command.make("service").pipe(
     serviceRestartCommand,
     serviceUninstallCommand,
     serviceStatusCommand,
+    serviceProtectCommand,
     serviceUpdateCommand,
   ]),
 );
diff --git a/apps/server/src/cloud/bootService.test.ts b/apps/server/src/cloud/bootService.test.ts
index 5491328a3040a..2edd110648013 100644
--- a/apps/server/src/cloud/bootService.test.ts
+++ b/apps/server/src/cloud/bootService.test.ts
@@ -56,7 +56,13 @@ it("protects the server unit from agents under CPU and memory pressure", () => {
     unitPath: "/home/theo/.config/systemd/user/t3code.service",
   });
   const service = unit.slice(unit.indexOf("[Service]"), unit.indexOf("[Install]"));
-  for (const line of ["CPUWeight=1000", "IOWeight=1000", "MemoryLow=1536M", "OOMPolicy=continue"]) {
+  for (const line of [
+    "CPUWeight=1000",
+    "IOWeight=1000",
+    "MemoryLow=1536M",
+    "OOMScoreAdjust=100",
+    "OOMPolicy=continue",
+  ]) {
     expect(service.split("\n")).toContain(line);
   }
 });
diff --git a/apps/server/src/cloud/bootService.ts b/apps/server/src/cloud/bootService.ts
index 5206992f2693f..948d780c867cc 100644
--- a/apps/server/src/cloud/bootService.ts
+++ b/apps/server/src/cloud/bootService.ts
@@ -116,6 +116,9 @@ export function renderBootServiceUnit(plan: BootServicePlan): string {
     // Reclaim takes the agents' unprotected pages first. The kernel caps this at the
     // protection of user.slice and user@.service, which only root can grant.
     "MemoryLow=1536M",
+    // A user manager's own score, the lowest it may set: below its other services (200) and agents (800).
+    // `t3 service protect` lowers it further through a drop-in.
+    "OOMScoreAdjust=100",
     // systemd-oomd ignores this preference when the watched cgroup is root-owned, as user-1000.slice usually is.
     "ManagedOOMPreference=avoid",
     `StandardOutput=append:${escapeSystemdSpecifiers(plan.logPath)}`,
diff --git a/apps/server/src/cloud/serviceProtection.test.ts b/apps/server/src/cloud/serviceProtection.test.ts
new file mode 100644
index 0000000000000..b2e4a1506cb31
--- /dev/null
+++ b/apps/server/src/cloud/serviceProtection.test.ts
@@ -0,0 +1,265 @@
+// @effect-diagnostics nodeBuiltinImport:off
+import * as NodeChildProcess from "node:child_process";
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
+
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { describe, expect, it } from "@effect/vitest";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+
+import * as ProcessRunner from "../processRunner.ts";
+import * as ServiceProtection from "./serviceProtection.ts";
+
+const temporaryDirectory = () =>
+  NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-service-protection-"));
+
+describe.skipIf(HostProcess.Platform.defaultValue() !== "linux")("renderPrivilegedScript", () => {
+  it("writes and removes only its drop-ins and gives running main processes their score", () => {
+    const root = temporaryDirectory();
+    const target = NodeChildProcess.spawn("sleep", ["60"], { stdio: "ignore" });
+    try {
+      const systemUnitDir = NodePath.join(root, "system");
+      const plan = (uid: number, remoteAccessUnits: ReadonlyArray<string>) =>
+        ServiceProtection.protectionPlan({
+          uid,
+          userUnitDir: "/home/theo/.config/systemd/user",
+          remoteAccessUnits,
+          systemUnitDir,
+        });
+      const theo = plan(1000, ["tailscaled.service", "ssh.service"]);
+      expect(theo.system.find((dropIn) => dropIn.unit === "user@1000.service")?.contents).toBe(
+        "[Service]\nMemoryLow=2G\nOOMScoreAdjust=-900\n",
+      );
+      expect(theo.managerDefaults.path).toBe(
+        "/home/theo/.config/systemd/user.conf.d/90-t3code-protect.conf",
+      );
+      expect(theo.oomUnits).toEqual(["user@1000.service", "tailscaled.service", "ssh.service"]);
+
+      const unrelated = NodePath.join(systemUnitDir, "ssh.service.d", "50-admin.conf");
+      NodeFS.mkdirSync(NodePath.dirname(unrelated), { recursive: true });
+      NodeFS.writeFileSync(unrelated, "[Service]\nNice=1\n");
+      const bin = NodePath.join(root, "bin");
+      NodeFS.mkdirSync(bin);
+      // Raising a score needs no privilege, so the test's own child stands in for a main process.
+      NodeFS.writeFileSync(
+        NodePath.join(bin, "systemctl"),
+        [
+          "#!/bin/sh",
+          'echo "$*" >>"$CALLS"',
+          'case "$*" in',
+          '  *MainPID*) echo "$TARGET_PID" ;;',
+          "  *OOMScoreAdjust*) echo 900 ;;",
+          "esac",
+          "",
+        ].join("\n"),
+        { mode: 0o755 },
+      );
+      const calls = NodePath.join(root, "calls");
+      const runScript = (protection: ServiceProtection.ProtectionPlan, mode: "apply" | "undo") => {
+        const result = NodeChildProcess.spawnSync(
+          "/bin/sh",
+          ["-c", ServiceProtection.renderPrivilegedScript(protection, mode)],
+          {
+            encoding: "utf8",
+            env: {
+              PATH: `${bin}:/usr/bin:/bin`,
+              CALLS: calls,
+              TARGET_PID: String(target.pid),
+            },
+          },
+        );
+        expect(result.stderr).toBe("");
+        expect(result.status).toBe(0);
+      };
+      const exists = (unit: string) =>
+        NodeFS.existsSync(NodePath.join(systemUnitDir, `${unit}.d`, "90-t3code-protect.conf"));
+
+      runScript(theo, "apply");
+      runScript(plan(1001, []), "apply");
+      for (const { path, contents } of theo.system) {
+        expect(NodeFS.readFileSync(path, "utf8")).toBe(contents);
+      }
+      expect(NodeFS.readFileSync(`/proc/${target.pid}/oom_score_adj`, "utf8").trim()).toBe("900");
+      expect(NodeFS.readFileSync(calls, "utf8").split("\n")[0]).toBe("daemon-reload");
+
+      // Undo removes every drop-in a user could own, and keeps shared ones while another user is protected.
+      const undo = (uid: number) => plan(uid, ServiceProtection.REMOTE_ACCESS_UNITS);
+      runScript(undo(1000), "undo");
+      expect(["user-1000.slice", "user@1000.service"].some(exists)).toBe(false);
+      expect(
+        ["user.slice", "system.slice", "tailscaled.service", "ssh.service"].every(exists),
+      ).toBe(true);
+
+      runScript(undo(1001), "undo");
+      for (const { path } of undo(1001).system) expect(NodeFS.existsSync(path)).toBe(false);
+      expect(NodeFS.existsSync(NodePath.join(systemUnitDir, "user.slice.d"))).toBe(false);
+      expect(NodeFS.readFileSync(unrelated, "utf8")).toBe("[Service]\nNice=1\n");
+    } finally {
+      target.kill();
+      NodeFS.rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+it.each([
+  [
+    "Debian, where sshd.service aliases ssh.service",
+    "Id=tailscaled.service\nLoadState=loaded\n\nId=ssh.service\nLoadState=loaded\n\nId=ssh.service\nLoadState=loaded\n",
+    ["tailscaled.service", "ssh.service"],
+  ],
+  [
+    "Fedora without Tailscale",
+    "Id=tailscaled.service\nLoadState=not-found\n\nId=ssh.service\nLoadState=not-found\n\nId=sshd.service\nLoadState=loaded\n",
+    ["sshd.service"],
+  ],
+])("finds remote-access services on %s", (_, shown, expected) => {
+  expect(ServiceProtection.loadedRemoteAccessUnits(shown)).toEqual(expected);
+});
+
+const fakeSudo = (exitCode: number, onRun: () => void) =>
+  ChildProcessSpawner.make((command) =>
+    Effect.gen(function* () {
+      if (command._tag !== "StandardCommand" || command.command !== "sudo") {
+        return yield* Effect.die("Unexpected command");
+      }
+      onRun();
+      return ChildProcessSpawner.makeHandle({
+        pid: ChildProcessSpawner.ProcessId(123),
+        stdout: Stream.empty,
+        stderr: Stream.empty,
+        all: Stream.empty,
+        exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(exitCode)),
+        isRunning: Effect.succeed(false),
+        kill: () => Effect.void,
+        stdin: Sink.drain,
+        getInputFd: () => Sink.drain,
+        getOutputFd: () => Stream.empty,
+        unref: Effect.succeed(Effect.void),
+      });
+    }),
+  );
+
+const runner = (stdout: string) =>
+  ProcessRunner.ProcessRunner.of({
+    run: () =>
+      Effect.succeed({
+        stdout,
+        stderr: "",
+        code: ChildProcessSpawner.ExitCode(0),
+        timedOut: false,
+        stdoutTruncated: false,
+        stderrTruncated: false,
+        stdoutInvalidUtf8: false,
+        stderrInvalidUtf8: false,
+      }),
+  });
+
+it.effect("lowers no score before the manager default is in place, and undoes in reverse", () => {
+  const home = temporaryDirectory();
+  return Effect.gen(function* () {
+    const plan = ServiceProtection.protectionPlan({
+      uid: 1000,
+      userUnitDir: NodePath.join(home, ".config", "systemd", "user"),
+      remoteAccessUnits: [],
+      systemUnitDir: NodePath.join(home, "system"),
+    });
+    const managerDropIn = plan.system.find(({ unit }) => unit === "user@1000.service")!.path;
+    const present = () => ({
+      managerDefaults: NodeFS.existsSync(plan.managerDefaults.path),
+      user: plan.user.filter(({ path }) => NodeFS.existsSync(path)).length,
+    });
+    const withSudo = <A, E, R>(
+      effect: Effect.Effect<A, E, R>,
+      exitCode: number,
+      writesManagerDropIn = false,
+    ) => {
+      let atSudo: ReturnType<typeof present> | undefined;
+      return effect.pipe(
+        Effect.provideService(
+          ChildProcessSpawner.ChildProcessSpawner,
+          fakeSudo(exitCode, () => {
+            atSudo = present();
+            if (writesManagerDropIn) {
+              NodeFS.mkdirSync(NodePath.dirname(managerDropIn), { recursive: true });
+              NodeFS.writeFileSync(managerDropIn, "[Service]\nOOMScoreAdjust=-900\n");
+            }
+          }),
+        ),
+        Effect.exit,
+        Effect.map((exit) => ({ exit, atSudo })),
+      );
+    };
+    const refused = yield* withSudo(ServiceProtection.applyProtection(plan), 1);
+    expect(refused.exit._tag).toBe("Failure");
+    expect(refused.atSudo).toEqual({ managerDefaults: true, user: 0 });
+    expect(present()).toEqual({ managerDefaults: false, user: 0 });
+
+    // Failing after it lowered the manager, sudo must leave the manager default in place.
+    const partial = yield* withSudo(ServiceProtection.applyProtection(plan), 1, true);
+    expect(partial.exit._tag).toBe("Failure");
+    expect(present()).toEqual({ managerDefaults: true, user: 0 });
+    NodeFS.rmSync(plan.managerDefaults.path);
+    NodeFS.rmSync(managerDropIn);
+
+    const applied = yield* withSudo(ServiceProtection.applyProtection(plan), 0);
+    expect(applied.atSudo).toEqual({ managerDefaults: true, user: 0 });
+    expect(present()).toEqual({ managerDefaults: true, user: plan.user.length });
+
+    const removed = yield* withSudo(ServiceProtection.removeProtection(plan), 0);
+    expect(removed.atSudo).toEqual({ managerDefaults: true, user: 0 });
+    expect(present()).toEqual({ managerDefaults: false, user: 0 });
+  }).pipe(
+    Effect.ensuring(Effect.sync(() => NodeFS.rmSync(home, { recursive: true, force: true }))),
+    Effect.provideService(ProcessRunner.ProcessRunner, runner("")),
+    Effect.provide(NodeServices.layer),
+  );
+});
+
+it.effect("counts memory.min as protection and names the first cgroup that grants none", () => {
+  const root = temporaryDirectory();
+  const controlGroup = [
+    "user.slice",
+    "user-1000.slice",
+    "user@1000.service",
+    "app.slice",
+    "t3code.service",
+  ];
+  const write = (depth: number, file: string, value: string) => {
+    const directory = NodePath.join(root, ...controlGroup.slice(0, depth));
+    NodeFS.mkdirSync(directory, { recursive: true });
+    NodeFS.writeFileSync(NodePath.join(directory, file), `${value}\n`);
+  };
+  write(1, "memory.low", "0");
+  write(1, "memory.min", "805306368");
+  write(2, "memory.low", "2147483648");
+  write(3, "memory.low", "2147483648");
+  write(4, "memory.low", "0");
+  write(4, "memory.min", "0");
+  write(5, "memory.low", "1610612736");
+  return Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const read = ServiceProtection.readProtection("/home/theo/.config/systemd/user").pipe(
+      Effect.provideService(FileSystem.FileSystem, {
+        ...fs,
+        readFileString: (path, encoding) =>
+          fs.readFileString(path.replace("/sys/fs/cgroup", root), encoding),
+      }),
+    );
+    expect((yield* read)?.unprotected).toBe("app.slice");
+    write(4, "memory.low", "1610612736");
+    expect((yield* read)?.unprotected).toBeUndefined();
+  }).pipe(
+    Effect.ensuring(Effect.sync(() => NodeFS.rmSync(root, { recursive: true, force: true }))),
+    Effect.provideService(
+      ProcessRunner.ProcessRunner,
+      runner(`ControlGroup=/${controlGroup.join("/")}\nMainPID=0\n`),
+    ),
+    Effect.provide(NodeServices.layer),
+  );
+});
diff --git a/apps/server/src/cloud/serviceProtection.ts b/apps/server/src/cloud/serviceProtection.ts
new file mode 100644
index 0000000000000..b23cd36e3a545
--- /dev/null
+++ b/apps/server/src/cloud/serviceProtection.ts
@@ -0,0 +1,342 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import * as ChildProcess from "effect/process/ChildProcess";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
+
+import * as ProcessRunner from "../processRunner.ts";
+import { BOOT_SERVICE_UNIT_FILE } from "./bootService.ts";
+
+const PROTECT_DROP_IN = "90-t3code-protect.conf";
+const SYSTEM_UNIT_DIR = "/etc/systemd/system";
+export const REMOTE_ACCESS_UNITS = ["tailscaled.service", "ssh.service", "sshd.service"];
+
+// Covers app.slice (the server's 1536M) and init.scope (the user manager's 256M).
+const USER_CHAIN_LOW = "MemoryLow=2G";
+// Near the floor, but unlike -1000 the kernel can still kill it as a last resort.
+const PROTECTED_OOM_SCORE = "OOMScoreAdjust=-900";
+
+export interface DropIn {
+  readonly unit: string;
+  readonly path: string;
+  readonly contents: string;
+  /** Host-wide, so undo keeps it while another user's protection remains. */
+  readonly shared?: boolean;
+}
+
+export interface ProtectionPlan {
+  readonly systemUnitDir: string;
+  /** Written through sudo. */
+  readonly system: ReadonlyArray<DropIn>;
+  /**
+   * Written before the manager's own score drops. Unset, a user manager hands
+   * its services its own score plus 100: -800 once it runs at -900.
+   */
+  readonly managerDefaults: DropIn;
+  readonly user: ReadonlyArray<DropIn>;
+  /** System units whose running main process takes its configured OOM score at once. */
+  readonly oomUnits: ReadonlyArray<string>;
+}
+
+const dropIn = (
+  directory: string,
+  unit: string,
+  section: string,
+  properties: ReadonlyArray<string>,
+  shared = false,
+): DropIn => ({
+  unit,
+  path: `${directory}/${unit}.d/${PROTECT_DROP_IN}`,
+  contents: [`[${section}]`, ...properties, ""].join("\n"),
+  ...(shared ? { shared } : {}),
+});
+
+/**
+ * Memory protection only reaches the server when every ancestor cgroup grants
+ * it, and only root can grant it on user.slice and the user manager.
+ */
+export function protectionPlan(input: {
+  readonly uid: number;
+  readonly userUnitDir: string;
+  readonly remoteAccessUnits: ReadonlyArray<string>;
+  readonly systemUnitDir?: string;
+}): ProtectionPlan {
+  const manager = `user@${input.uid}.service`;
+  const remote = input.remoteAccessUnits;
+  const systemUnitDir = input.systemUnitDir ?? SYSTEM_UNIT_DIR;
+  const system = (unit: string, section: string, properties: ReadonlyArray<string>) =>
+    dropIn(systemUnitDir, unit, section, properties);
+  const shared = (unit: string, section: string, properties: ReadonlyArray<string>) =>
+    dropIn(systemUnitDir, unit, section, properties, true);
+  const user = (unit: string, section: string, properties: ReadonlyArray<string>) =>
+    dropIn(input.userUnitDir, unit, section, properties);
+  return {
+    systemUnitDir,
+    system: [
+      shared("user.slice", "Slice", [USER_CHAIN_LOW]),
+      system(`user-${input.uid}.slice`, "Slice", [USER_CHAIN_LOW]),
+      system(manager, "Service", [USER_CHAIN_LOW, PROTECTED_OOM_SCORE]),
+      ...(remote.length > 0 ? [shared("system.slice", "Slice", ["MemoryLow=512M"])] : []),
+      ...remote.map((unit) => shared(unit, "Service", ["MemoryLow=256M", PROTECTED_OOM_SCORE])),
+    ],
+    managerDefaults: {
+      unit: "user.conf",
+      path: `${input.userUnitDir.replace(/\/user$/, "")}/user.conf.d/${PROTECT_DROP_IN}`,
+      contents: "[Manager]\nDefaultOOMScoreAdjust=200\n",
+    },
+    user: [
+      user("app.slice", "Slice", ["MemoryLow=1536M"]),
+      user("init.scope", "Scope", ["MemoryLow=256M"]),
+      user(BOOT_SERVICE_UNIT_FILE, "Service", [PROTECTED_OOM_SCORE]),
+    ],
+    oomUnits: [manager, ...remote],
+  };
+}
+
+const quoteShell = (value: string) => `'${value.replaceAll("'", `'\\''`)}'`;
+const directoryOf = (file: string) => file.slice(0, file.lastIndexOf("/"));
+
+export function renderPrivilegedScript(plan: ProtectionPlan, mode: "apply" | "undo"): string {
+  const lines = ["set -e"];
+  const remove = (dropIns: ReadonlyArray<DropIn>, indent = "") => {
+    for (const { path } of dropIns) {
+      lines.push(
+        `${indent}rm -f ${quoteShell(path)}`,
+        `${indent}rmdir ${quoteShell(directoryOf(path))} 2>/dev/null || true`,
+      );
+    }
+  };
+  if (mode === "apply") {
+    for (const { path, contents } of plan.system) {
+      lines.push(
+        `mkdir -p ${quoteShell(directoryOf(path))}`,
+        `cat >${quoteShell(path)} <<'T3CODE_PROTECT'`,
+        contents.trimEnd(),
+        "T3CODE_PROTECT",
+      );
+    }
+  } else {
+    remove(plan.system.filter((dropIn) => dropIn.shared !== true));
+    const otherUsers = `${quoteShell(plan.systemUnitDir)}/user@*.service.d/${PROTECT_DROP_IN}`;
+    lines.push(`set -- ${otherUsers}`, 'if [ ! -e "$1" ]; then');
+    remove(
+      plan.system.filter((dropIn) => dropIn.shared === true),
+      "  ",
+    );
+    lines.push("fi");
+  }
+  lines.push(
+    "systemctl daemon-reload",
+    // OOMScoreAdjust applies at exec; this gives running main processes the configured score.
+    `for unit in ${plan.oomUnits.map(quoteShell).join(" ")}; do`,
+    '  pid=$(systemctl show --property=MainPID --value "$unit")',
+    '  if [ "${pid:-0}" -gt 0 ]; then',
+    '    systemctl show --property=OOMScoreAdjust --value "$unit" >"/proc/$pid/oom_score_adj" || true',
+    "  fi",
+    "done",
+    "",
+  );
+  return lines.join("\n");
+}
+
+export class ServiceProtectionError extends Schema.TaggedError<ServiceProtectionError>()(
+  "ServiceProtectionError",
+  {
+    step: Schema.String,
+    exitCode: Schema.optional(Schema.Number),
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return this.exitCode === undefined
+      ? `Could not ${this.step}.`
+      : `Could not ${this.step} (exit code ${this.exitCode}).`;
+  }
+}
+
+function parseUnits(text: string): Array<Map<string, string>> {
+  return text
+    .split(/\n\s*\n/)
+    .map(
+      (block) =>
+        new Map(
+          block
+            .split("\n")
+            .filter((line) => line.includes("="))
+            .map((line) => [line.slice(0, line.indexOf("=")), line.slice(line.indexOf("=") + 1)]),
+        ),
+    )
+    .filter((values) => values.size > 0);
+}
+
+/** Loaded remote-access units by canonical name, so an alias such as sshd.service counts once. */
+export function loadedRemoteAccessUnits(systemctlShow: string): ReadonlyArray<string> {
+  const units = parseUnits(systemctlShow)
+    .filter((values) => values.get("LoadState") === "loaded")
+    .map((values) => values.get("Id") ?? "")
+    .filter((id) => REMOTE_ACCESS_UNITS.includes(id));
+  return [...new Set(units)];
+}
+
+const run = Effect.fn("ServiceProtection.run")(function* (
+  step: string,
+  command: string,
+  args: ReadonlyArray<string>,
+) {
+  const runner = yield* ProcessRunner.ProcessRunner;
+  const result = yield* runner
+    .run({ command, args, timeout: "30 seconds" })
+    .pipe(Effect.mapError((cause) => new ServiceProtectionError({ step, cause })));
+  if (result.code !== 0) {
+    return yield* new ServiceProtectionError({ step, exitCode: Number(result.code) });
+  }
+  return result.stdout;
+});
+
+const userSettingsError = (cause: unknown) =>
+  new ServiceProtectionError({ step: "change systemd user settings", cause });
+
+/** Undefined when there is no systemd system manager to ask. */
+export const detectRemoteAccessUnits = run("list remote-access services", "systemctl", [
+  "show",
+  "--property=Id,LoadState",
+  ...REMOTE_ACCESS_UNITS,
+]).pipe(
+  Effect.map(loadedRemoteAccessUnits),
+  Effect.option,
+  Effect.map(Option.getOrUndefined),
+  Effect.withSpan("ServiceProtection.detectRemoteAccessUnits"),
+);
+
+const reloadUserManager = run("reload systemd user units", "systemctl", [
+  "--user",
+  "daemon-reload",
+]);
+
+const writeDropIns = Effect.fn("ServiceProtection.writeDropIns")(function* (
+  dropIns: ReadonlyArray<DropIn>,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  for (const { path, contents } of dropIns) {
+    yield* fs.makeDirectory(directoryOf(path), { recursive: true });
+    yield* fs.writeFileString(path, contents);
+  }
+}, Effect.mapError(userSettingsError));
+
+const removeDropIns = Effect.fn("ServiceProtection.removeDropIns")(function* (
+  dropIns: ReadonlyArray<DropIn>,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  for (const { path } of dropIns) {
+    yield* fs.remove(path, { force: true });
+    yield* fs.remove(directoryOf(path)).pipe(Effect.ignore);
+  }
+}, Effect.mapError(userSettingsError));
+
+const runPrivileged = Effect.fn("ServiceProtection.runPrivileged")(function* (script: string) {
+  const step = "change the system's service settings";
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const exitCode = yield* spawner
+    .exitCode(
+      ChildProcess.make("sudo", ["/bin/sh", "-c", script], {
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+      }),
+    )
+    .pipe(Effect.mapError((cause) => new ServiceProtectionError({ step, cause })));
+  if (exitCode !== 0) {
+    return yield* new ServiceProtectionError({ step, exitCode: Number(exitCode) });
+  }
+});
+
+export const applyProtection = Effect.fn("ServiceProtection.apply")(function* (
+  plan: ProtectionPlan,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const hadManagerDefaults = yield* fs
+    .exists(plan.managerDefaults.path)
+    .pipe(Effect.orElseSucceed(() => false));
+  yield* writeDropIns([plan.managerDefaults]);
+  // A partial run may already have lowered the manager; its default must then stay.
+  const manager = plan.system.find(({ unit }) => unit.startsWith("user@"));
+  const rollBack = Effect.gen(function* () {
+    if (hadManagerDefaults) return;
+    if (manager !== undefined && (yield* fs.exists(manager.path))) return;
+    yield* removeDropIns([plan.managerDefaults]);
+  }).pipe(Effect.ignore);
+  yield* runPrivileged(renderPrivilegedScript(plan, "apply")).pipe(Effect.tapError(() => rollBack));
+  yield* writeDropIns(plan.user);
+  yield* reloadUserManager;
+});
+
+export const removeProtection = Effect.fn("ServiceProtection.remove")(function* (
+  plan: ProtectionPlan,
+) {
+  yield* removeDropIns(plan.user);
+  yield* reloadUserManager;
+  if (plan.system.length > 0) yield* runPrivileged(renderPrivilegedScript(plan, "undo"));
+  yield* removeDropIns([plan.managerDefaults]);
+  yield* reloadUserManager;
+});
+
+/** The plan narrowed to drop-ins that exist, for undo. */
+export const installedProtection = Effect.fn("ServiceProtection.installed")(function* (
+  plan: ProtectionPlan,
+) {
+  const fs = yield* FileSystem.FileSystem;
+  const exists = (dropIn: DropIn) => fs.exists(dropIn.path).pipe(Effect.orElseSucceed(() => false));
+  const system = yield* Effect.filter(plan.system, exists);
+  const user = yield* Effect.filter(plan.user, exists);
+  const managerDefaults = yield* exists(plan.managerDefaults);
+  return system.length + user.length === 0 && !managerDefaults
+    ? undefined
+    : { ...plan, system, user };
+});
+
+export interface ServiceProtectionState {
+  /** The first cgroup from the top that grants the server no memory protection. */
+  readonly unprotected: string | undefined;
+  readonly oomScoreAdj: number | undefined;
+  readonly setByProtect: boolean;
+}
+
+/** Reads what the kernel applies to the running service, whoever configured it. */
+export const readProtection = Effect.fn("ServiceProtection.read")(function* (userUnitDir: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const shown = yield* run("read the service's cgroup", "systemctl", [
+    "--user",
+    "show",
+    BOOT_SERVICE_UNIT_FILE,
+    "--property=ControlGroup,MainPID",
+  ]).pipe(Effect.option);
+  if (Option.isNone(shown)) return undefined;
+  const values = parseUnits(shown.value)[0] ?? new Map<string, string>();
+  const controlGroup = (values.get("ControlGroup") ?? "").split("/").filter(Boolean);
+  if (controlGroup.length === 0) return undefined;
+  const read = (file: string) =>
+    fs.readFileString(file).pipe(
+      Effect.map((text) => text.trim()),
+      Effect.orElseSucceed(() => ""),
+    );
+  let unprotected: string | undefined;
+  const grants = (value: string) => value !== "" && value !== "0";
+  for (let depth = 1; depth <= controlGroup.length && unprotected === undefined; depth++) {
+    const directory = path.join("/sys/fs/cgroup", ...controlGroup.slice(0, depth));
+    const low = yield* read(path.join(directory, "memory.low"));
+    const min = yield* read(path.join(directory, "memory.min"));
+    if (!grants(low) && !grants(min)) unprotected = controlGroup[depth - 1];
+  }
+  const pid = Number(values.get("MainPID") ?? 0);
+  const score = pid > 0 ? yield* read(`/proc/${pid}/oom_score_adj`) : "";
+  return {
+    unprotected,
+    oomScoreAdj: score === "" ? undefined : Number(score),
+    setByProtect: yield* fs
+      .exists(path.join(userUnitDir, `${BOOT_SERVICE_UNIT_FILE}.d`, PROTECT_DROP_IN))
+      .pipe(Effect.orElseSucceed(() => false)),
+  } satisfies ServiceProtectionState;
+});
diff --git a/apps/server/src/preview/ServerBrowser.ts b/apps/server/src/preview/ServerBrowser.ts
index 78097b761cb74..6f3e86a7501ea 100644
--- a/apps/server/src/preview/ServerBrowser.ts
+++ b/apps/server/src/preview/ServerBrowser.ts
@@ -43,6 +43,7 @@ import {
   SERVER_BROWSER_AUTOMATION_CLIENT_ID,
   type PreviewAppearancePreference,
 } from "@t3tools/contracts";
+import { AgentScope, agentScopeLauncherScript } from "@t3tools/shared/AgentScope";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import { normalizePreviewUrl } from "@t3tools/shared/preview";
 import { resolvePreviewViewport } from "@t3tools/shared/previewViewport";
@@ -460,6 +461,8 @@ const make = Effect.gen(function* () {
   const runPromise = Effect.runPromiseWith(yield* Effect.context<never>());
   const launchServices = yield* Effect.context<ChildProcessSpawner.ChildProcessSpawner>();
   const setupCommand = yield* resolveRootCliCommand(PreviewBrowserHost.SETUP_SUBCOMMAND);
+  const agentScope = yield* AgentScope;
+  const launchersDir = NodePath.join(config.stateDir, "server-browser", "launchers");
 
   const tabs = new Map<string, ServerTab>();
   const pendingTabs = new Map<string, Promise<ServerTab>>();
@@ -473,6 +476,17 @@ const make = Effect.gen(function* () {
   const contexts = new ServerBrowserContexts({
     profilesDir: NodePath.join(config.stateDir, "server-browser", "profiles"),
     executable: () => runPromise(previewBrowser.executable),
+    // An agent scope keeps Chrome out of the server's memory protection and OOM score.
+    launcher: async (executable) => {
+      const launch = await runPromise(
+        agentScope.wrap({ command: executable, args: [], name: "preview-browser" }),
+      );
+      if (launch.command === executable) return undefined;
+      await NodeFSP.mkdir(launchersDir, { recursive: true });
+      const launcher = NodePath.join(launchersDir, NodeCrypto.randomUUID());
+      await NodeFSP.writeFile(launcher, agentScopeLauncherScript(launch), { mode: 0o700 });
+      return { path: launcher, release: () => NodeFSP.rm(launcher, { force: true }) };
+    },
     // Playwright's launch error drops Chrome's own output; its sandbox note survives.
     diagnose: (executable, cause) =>
       Effect.runPromiseWith(launchServices)(
diff --git a/apps/server/src/preview/ServerBrowserContexts.test.ts b/apps/server/src/preview/ServerBrowserContexts.test.ts
index 7a3babd0dcc0a..3cab864de54f2 100644
--- a/apps/server/src/preview/ServerBrowserContexts.test.ts
+++ b/apps/server/src/preview/ServerBrowserContexts.test.ts
@@ -55,6 +55,17 @@ const options = () => ({
   env: {},
 });
 
+const withLauncher = () => {
+  const release = vi.fn(async () => {});
+  return {
+    release,
+    configuration: {
+      ...options(),
+      launcher: vi.fn(async (executable: string) => ({ path: `${executable}-launcher`, release })),
+    },
+  };
+};
+
 beforeEach(() => {
   launches.launch.mockReset();
   launches.persistent.mockReset();
@@ -66,19 +77,29 @@ describe("ServerBrowserContexts", () => {
   it("lazily shares one browser across concurrent isolated sessions and reuses each context", async () => {
     const browser = makeBrowser();
     const launch = Promise.withResolvers<Browser>();
-    launches.launch.mockReturnValue(launch.promise);
-    const configuration = options();
+    const started = Promise.withResolvers<void>();
+    launches.launch.mockImplementation(() => {
+      started.resolve();
+      return launch.promise;
+    });
+    const { configuration, release } = withLauncher();
     const pool = new ServerBrowserContexts(configuration);
     expect(configuration.executable).not.toHaveBeenCalled();
     const first = pool.contextFor("default", "agent-a");
     const again = pool.contextFor("default", "agent-a");
     const second = pool.contextFor("default", "agent-b");
     const incognito = pool.contextFor(INCOGNITO_BROWSER_PROFILE_ID);
+    await started.promise;
+    // Playwright may retry the same path until the launch settles.
+    expect(release).not.toHaveBeenCalled();
     launch.resolve(browser as unknown as Browser);
     const [a, reused, b, privateContext] = await Promise.all([first, again, second, incognito]);
+    expect(release).toHaveBeenCalledTimes(1);
     expect(a).toBe(reused);
     expect(new Set([a, b, privateContext]).size).toBe(3);
-    expect(launches.launch).toHaveBeenCalledTimes(1);
+    expect(launches.launch).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ executablePath: "/test/chromium-launcher" }),
+    );
     expect(launches.persistent).not.toHaveBeenCalled();
     expect(browser.newContext).toHaveBeenCalledWith({
       viewport: { width: 1280, height: 800 },
@@ -94,19 +115,44 @@ describe("ServerBrowserContexts", () => {
     const browser = makeBrowser();
     launches.persistent.mockResolvedValue(human as unknown as BrowserContext);
     launches.launch.mockResolvedValue(browser as unknown as Browser);
-    const pool = new ServerBrowserContexts(options());
+    const { configuration, release } = withLauncher();
+    const pool = new ServerBrowserContexts(configuration);
     const persistent = await pool.contextFor("work/team");
     expect(await pool.contextFor("work/team")).toBe(persistent);
     expect(await pool.contextFor("work/team", "agent")).not.toBe(persistent);
     expect(launches.persistent).toHaveBeenCalledExactlyOnceWith(
       "/test/profiles/work%2Fteam",
-      expect.objectContaining({ chromiumSandbox: true, executablePath: "/test/chromium" }),
+      expect.objectContaining({ chromiumSandbox: true, executablePath: "/test/chromium-launcher" }),
     );
+    expect(release).toHaveBeenCalledTimes(2);
     expect(launches.mkdir).toHaveBeenCalledWith("/test/profiles/work%2Fteam", { recursive: true });
     await pool.close();
     expect(human.close).toHaveBeenCalledTimes(1);
   });
 
+  it("diagnoses a launcher failure against the real executable", async () => {
+    const diagnosed = new Error("diagnosed");
+    const diagnose = vi.fn(async () => diagnosed);
+    const pool = new ServerBrowserContexts({
+      ...options(),
+      diagnose,
+      launcher: vi.fn(async () => {
+        throw new Error("EACCES");
+      }),
+    });
+    await expect(pool.contextFor("default", "agent")).rejects.toBe(diagnosed);
+    expect(diagnose).toHaveBeenCalledExactlyOnceWith("/test/chromium", expect.any(Error));
+    expect(launches.launch).not.toHaveBeenCalled();
+  });
+
+  it("creates no launcher for a profile whose storage cannot be created", async () => {
+    launches.mkdir.mockRejectedValueOnce(new Error("EACCES"));
+    const { configuration } = withLauncher();
+    const pool = new ServerBrowserContexts(configuration);
+    await expect(pool.contextFor("work/team")).rejects.toThrow("EACCES");
+    expect(configuration.launcher).not.toHaveBeenCalled();
+  });
+
   it("clears a profile by closing its open context before deleting its storage", async () => {
     const human = makeContext();
     const browser = makeBrowser();
diff --git a/apps/server/src/preview/ServerBrowserContexts.ts b/apps/server/src/preview/ServerBrowserContexts.ts
index 0e0f71d4e53ca..9f3fd48430752 100644
--- a/apps/server/src/preview/ServerBrowserContexts.ts
+++ b/apps/server/src/preview/ServerBrowserContexts.ts
@@ -17,6 +17,13 @@ const loadPlaywright = () =>
 interface Options {
   readonly profilesDir: string;
   readonly executable: () => Promise<string>;
+  /**
+   * A path that starts `executable`, such as one that moves Chrome out of the server's cgroup.
+   * Released after the whole launch call, since Playwright retries the same path after a glibc race.
+   */
+  readonly launcher?: (
+    executable: string,
+  ) => Promise<{ readonly path: string; readonly release: () => Promise<void> } | undefined>;
   readonly diagnose?: (executable: string, cause: unknown) => Promise<unknown>;
   readonly env?: NodeJS.ProcessEnv;
   readonly onContextClose?: (context: BrowserContext) => void;
@@ -79,10 +86,10 @@ export class ServerBrowserContexts {
   }
 
   private async launchOptions() {
-    const executablePath = await this.options.executable();
+    const executable = await this.options.executable();
     const env = this.options.env ?? process.env;
     return {
-      executablePath,
+      executable,
       env,
       args: [
         "--disable-gpu",
@@ -96,19 +103,26 @@ export class ServerBrowserContexts {
     };
   }
 
-  private async launch<A>(options: { readonly executablePath: string }, start: () => Promise<A>) {
+  private async launch<A>(executable: string, start: (executablePath: string) => Promise<A>) {
+    let release: (() => Promise<void>) | undefined;
     try {
-      return await start();
+      const launcher = await this.options.launcher?.(executable);
+      release = launcher?.release;
+      return await start(launcher?.path ?? executable);
     } catch (cause) {
-      throw (await this.options.diagnose?.(options.executablePath, cause)) ?? cause;
+      throw (await this.options.diagnose?.(executable, cause)) ?? cause;
+    } finally {
+      await release?.().catch(constVoid);
     }
   }
 
   private sharedBrowser() {
     if (!this.browser) {
-      const launched = this.launchOptions().then(async (options) => {
+      const launched = this.launchOptions().then(async ({ executable, ...options }) => {
         const { chromium } = loadPlaywright();
-        const browser = await this.launch(options, () => chromium.launch(options));
+        const browser = await this.launch(executable, (executablePath) =>
+          chromium.launch({ ...options, executablePath }),
+        );
         browser.on("disconnected", () => {
           if (this.browser === launched) this.browser = undefined;
         });
@@ -156,11 +170,15 @@ export class ServerBrowserContexts {
       return browser.newContext(contextOptions);
     }
     const directory = this.profileDirectory(profileId);
-    const options = await this.launchOptions();
-    const { chromium } = loadPlaywright();
     await NodeFSP.mkdir(directory, { recursive: true });
-    return this.launch(options, () =>
-      chromium.launchPersistentContext(directory, { ...options, ...contextOptions }),
+    const { executable, ...options } = await this.launchOptions();
+    const { chromium } = loadPlaywright();
+    return this.launch(executable, (executablePath) =>
+      chromium.launchPersistentContext(directory, {
+        ...options,
+        ...contextOptions,
+        executablePath,
+      }),
     );
   }
 
diff --git a/docs/user/background-service.md b/docs/user/background-service.md
index be4ad66ff3ab4..f9ab85fcac4c3 100644
--- a/docs/user/background-service.md
+++ b/docs/user/background-service.md
@@ -90,6 +90,24 @@ Windows background services are not supported.
 T3 Connect can offer service installation during setup, but the two are managed
 separately. Signing out of T3 Connect does not stop or uninstall the service.
 
+## Keep the server responsive when agents use all memory
+
+On Linux, agents already run with lower priority than the server. When they
+fill the machine's memory, though, the kernel may still slow down or stop the
+server, because only an administrator can reserve memory for it. Run, as your
+normal user:
+
+```sh
+t3 service protect
+```
+
+It shows the system settings it will change, asks before applying them, and
+then asks for your sudo password. If the machine runs Tailscale or SSH, it
+also offers to protect them, so you can still reach the machine. Memory
+protection takes effect at once. The server's protection from the kernel's
+out-of-memory killer takes effect after `t3 service restart`. `t3 service status` reports whether
+the protection is in place, and `t3 service protect --undo` removes it.
+
 ## Troubleshooting
 
 Start with `t3 service status` on the host. It prints the log path and, on Linux,
diff --git a/packages/shared/src/AgentScope.test.ts b/packages/shared/src/AgentScope.test.ts
index cf3ca64acce0a..2d9aca5ac1129 100644
--- a/packages/shared/src/AgentScope.test.ts
+++ b/packages/shared/src/AgentScope.test.ts
@@ -1,9 +1,12 @@
 // @effect-diagnostics nodeBuiltinImport:off
 import * as NodeChildProcess from "node:child_process";
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
 
 import { describe, expect, it } from "@effect/vitest";
 
-import { AGENT_OOM_SCORE_ADJ, agentScopeCommand } from "./AgentScope.ts";
+import { AGENT_OOM_SCORE_ADJ, agentScopeCommand, agentScopeLauncherScript } from "./AgentScope.ts";
 import * as HostProcess from "./HostProcess.ts";
 
 describe.skipIf(HostProcess.Platform.defaultValue() !== "linux")("agentScopeCommand", () => {
@@ -25,5 +28,20 @@ describe.skipIf(HostProcess.Platform.defaultValue() !== "linux")("agentScopeComm
     expect(Number(pid)).toBe(child.pid);
     expect(Number(score)).toBe(AGENT_OOM_SCORE_ADJ);
     expect(args).toEqual(["a b", "$HOME"]);
+
+    const directory = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-agent-launcher-"));
+    try {
+      const launcher = NodePath.join(directory, "launch's");
+      NodeFS.writeFileSync(launcher, agentScopeLauncherScript(launch), { mode: 0o700 });
+      const launched = NodeChildProcess.spawnSync(launcher, ["--flag", "it's"], {
+        encoding: "utf8",
+      });
+      const [launchedPid, launchedScore, ...launchedArgs] = launched.stdout.trimEnd().split("\n");
+      expect(Number(launchedPid)).toBe(launched.pid);
+      expect(Number(launchedScore)).toBe(AGENT_OOM_SCORE_ADJ);
+      expect(launchedArgs).toEqual(["a b", "$HOME", "--flag", "it's"]);
+    } finally {
+      NodeFS.rmSync(directory, { recursive: true, force: true });
+    }
   });
 });
diff --git a/packages/shared/src/AgentScope.ts b/packages/shared/src/AgentScope.ts
index 361bfc49108c6..ce2d58c017b25 100644
--- a/packages/shared/src/AgentScope.ts
+++ b/packages/shared/src/AgentScope.ts
@@ -74,6 +74,14 @@ export interface AgentSystemdScope {
   readonly options: ReadonlyArray<string>;
 }
 
+const quoteShell = (value: string) => `'${value.replaceAll("'", `'\\''`)}'`;
+
+/** An executable file for launchers that take a path, not a command line, such as Playwright. */
+export function agentScopeLauncherScript(launch: AgentScopeCommand): string {
+  const command = [launch.command, ...launch.args].map(quoteShell).join(" ");
+  return `#!/bin/sh\nexec ${command} "$@"\n`;
+}
+
 /** Exec at every step preserves the agent PID, stdio, and signals; systemd-run places it and descendants in the scope. */
 export function agentScopeCommand(input: {
   readonly command: string;

From 8ab098a4a8d62335f43cf61b708c2fbb65d4741c Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 18:12:10 -0700
Subject: [PATCH 118/146] fix(server): held queues release agent and scheduled
 messages once the thread completes a run (#27221)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/orchestration-v2/Orchestrator.ts      |  86 +++++-
 .../src/orchestration-v2/ProjectionStore.ts   |  15 +
 .../ProviderTurnControlService.test.ts        |   1 +
 .../src/orchestration-v2/runtimeLayer.test.ts | 264 +++++++++++++++++-
 4 files changed, 351 insertions(+), 15 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index c464a8743f3c2..05b5601e5a80a 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -741,6 +741,20 @@ function delegatedTaskTerminalStatus(
   }
 }
 
+/** Failed worktree setup keeps the queue held so queued messages cannot start in the project checkout. */
+function worktreeSetupPending(
+  projection: Pick<OrchestrationV2ThreadProjection, "thread" | "runs">,
+): boolean {
+  return (
+    projection.thread.worktreePath === null &&
+    projection.runs.some(
+      (run) =>
+        (run.status === "failed" || run.status === "interrupted") &&
+        run.workspacePreparation?.type === "worktree",
+    )
+  );
+}
+
 function nextQueuedRun(
   projection: Pick<OrchestrationV2ThreadProjection, "runs" | "messages">,
 ): OrchestrationV2Run | undefined {
@@ -2195,6 +2209,52 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       ),
   );
 
+  // A hold waits for a person to review what they queued. Nobody reviews messages from agents,
+  // the server or scheduled tasks, so a later completed run releases those unless it was stopped.
+  const releaseUnattendedHolds = Effect.fn("Orchestrator.releaseUnattendedHolds")(function* (
+    threadId: ThreadId,
+    completedRunId: RunId,
+  ) {
+    const held = yield* projectionStore.getHeldQueuedRuns(threadId);
+    if (held.length === 0) return;
+    const projection = yield* projectionStore.getThreadRecords(
+      threadId,
+      ["runs", "messages", "turnItems"],
+      {
+        messageIds: held.map((run) => run.userMessageId),
+        turnItemTypes: ["run_interrupt_request"],
+        turnItemRunIds: [completedRunId],
+      },
+    );
+    // Only the newest run completing shows the thread moved past the hold; a late or
+    // bookkeeping update to an older run, overtaken by a failure or Stop, does not.
+    if (
+      latestExecutedRun(projection.runs)?.id !== completedRunId ||
+      projection.turnItems.length > 0 ||
+      worktreeSetupPending(projection)
+    )
+      return;
+    const { messages } = projection;
+    const unattended = new Set(
+      messages
+        .filter((message) => message.createdBy !== "user" || message.scheduledTaskId !== undefined)
+        .map((message) => message.id),
+    );
+    const now = yield* DateTime.now;
+    const released = held.filter((run) => unattended.has(run.userMessageId));
+    if (released.length === 0) return;
+    yield* writeSystemEvents(
+      released.map((run) => ({
+        type: "run.updated" as const,
+        threadId,
+        runId: run.id,
+        providerInstanceId: run.providerInstanceId,
+        occurredAt: now,
+        payload: { ...run, queueHeld: false },
+      })),
+    );
+  });
+
   const resumeQueuedRuns = Effect.gen(function* () {
     const threadIds = yield* projectionStore.getRecoveryThreadIds("queued-runs");
     let resumed = 0;
@@ -5539,15 +5599,8 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       dispatchMode.type === "queue_after_active";
     const shouldQueue = queueBehindRun !== undefined && startsOrQueuesRun;
     // Client messages resume held queues; server continuations and scheduled tasks do not.
-    // Provider failure or usage limits re-hold the queue. Failed worktree setup keeps it held
-    // until a worktree exists, so queued messages cannot start in the project checkout.
-    const worktreeSetupUnresolved =
-      projection.thread.worktreePath === null &&
-      projection.runs.some(
-        (run) =>
-          (run.status === "failed" || run.status === "interrupted") &&
-          run.workspacePreparation?.type === "worktree",
-      );
+    // Provider failure or usage limits re-hold the queue.
+    const worktreeSetupUnresolved = worktreeSetupPending(projection);
     const sentByUserFromClient =
       command.createdBy === "user" &&
       (command.creationSource === "web" || command.creationSource === "mobile") &&
@@ -13083,10 +13136,17 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         yield* threadDispatch
           .withLock(
             threadId,
-            startNextQueuedRun(threadId, {
-              endedRunId: run.id,
-              ...(run.status === "failed" ? { failedRunId: run.id } : {}),
-            }),
+            (run.status === "completed"
+              ? releaseUnattendedHolds(threadId, run.id)
+              : Effect.void
+            ).pipe(
+              Effect.andThen(
+                startNextQueuedRun(threadId, {
+                  endedRunId: run.id,
+                  ...(run.status === "failed" ? { failedRunId: run.id } : {}),
+                }),
+              ),
+            ),
           )
           .pipe(
             Effect.catchCause((cause) =>
diff --git a/apps/server/src/orchestration-v2/ProjectionStore.ts b/apps/server/src/orchestration-v2/ProjectionStore.ts
index 6bb04041c75b6..88a9073117dd6 100644
--- a/apps/server/src/orchestration-v2/ProjectionStore.ts
+++ b/apps/server/src/orchestration-v2/ProjectionStore.ts
@@ -612,6 +612,9 @@ export interface ProjectionStoreV2Shape {
   readonly canStartQueuedRun: (
     threadId: ThreadId,
   ) => Effect.Effect<boolean, ProjectionStoreV2Error>;
+  readonly getHeldQueuedRuns: (
+    threadId: ThreadId,
+  ) => Effect.Effect<ReadonlyArray<OrchestrationV2Run>, ProjectionStoreV2Error>;
   readonly getRecoveryThreadIds: (
     kind: ProjectionRecoveryKind,
   ) => Effect.Effect<ReadonlyArray<ThreadId>, ProjectionStoreV2Error>;
@@ -5183,6 +5186,17 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
         )
         .pipe(Effect.mapError(controlReadError(threadId)));
 
+    const getHeldQueuedRuns: ProjectionStoreV2Shape["getHeldQueuedRuns"] = (threadId) =>
+      sql<PayloadRow>`
+        SELECT payload_json FROM orchestration_v2_projection_runs
+        WHERE thread_id = ${threadId} AND status = 'queued'
+          AND json_extract(payload_json, '$.queueHeld') IS 1
+        ORDER BY ordinal ASC
+      `.pipe(
+        Effect.flatMap(decodeRows(decodeRunPayload, threadId)),
+        Effect.mapError(controlReadError(threadId)),
+      );
+
     const getMessageCount: ProjectionStoreV2Shape["getMessageCount"] = (threadId) =>
       sql<{
         count: number;
@@ -6899,6 +6913,7 @@ export const layer: Layer.Layer<ProjectionStoreV2, never, SqlClient.SqlClient> =
       getCheckpointRollbackContext: readOnReader(getCheckpointRollbackContext),
       getRunMessage: readOnReader(getRunMessage),
       canStartQueuedRun: readOnReader(canStartQueuedRun),
+      getHeldQueuedRuns: readOnReader(getHeldQueuedRuns),
       getPendingNativeUserInputs: readOnReader(getPendingNativeUserInputs),
       hasUnpairedRunInterruptRequest: readOnReader(hasUnpairedRunInterruptRequest),
       isNodeStored: readOnReader(isNodeStored),
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
index 1d79e87eb9b91..bab115f6e24cb 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
@@ -263,6 +263,7 @@ it.effect(
           getRunMessage: () => Effect.die("not used"),
           isNodeStored: () => Effect.die("not used"),
           canStartQueuedRun: () => Effect.die("not used"),
+          getHeldQueuedRuns: () => Effect.die("not used"),
           getRecoveryThreadIds: () => Effect.die("unused getRecoveryThreadIds"),
           getUnreadableThreadIds: () => Effect.die("unused getUnreadableThreadIds"),
           getThreadSnapshot: () => Effect.die("unused getThreadSnapshot"),
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index 428202d17b651..11eb866b5fb9c 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -4768,6 +4768,265 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
       }),
   );
 
+  // A thread fed by agent messages, with helpers to end its runs as a provider would.
+  const queueTestThread = (threadId: ThreadId) =>
+    Effect.gen(function* () {
+      const orchestrator = yield* Orchestrator.OrchestratorV2;
+      const eventSink = yield* EventSink.EventSinkV2;
+      yield* orchestrator.dispatch({
+        type: "thread.create",
+        createdBy: "user",
+        creationSource: "web",
+        commandId: CommandId.make(`${threadId}:create`),
+        threadId,
+        projectId: ProjectId.make(`${threadId}:project`),
+        title: "Dispatcher",
+        modelSelection,
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        branch: null,
+        worktreePath: process.cwd(),
+      });
+      const send = (key: string, createdBy: "user" | "agent", start: boolean) =>
+        orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy,
+          creationSource: createdBy === "user" ? "web" : "server",
+          commandId: CommandId.make(`${threadId}:message:${key}`),
+          threadId,
+          messageId: MessageId.make(`${threadId}:message:${key}`),
+          text: key,
+          attachments: [],
+          modelSelection,
+          dispatchMode: { type: start ? "start_immediately" : "queue_after_active" },
+        });
+      const runFor = (key: string) =>
+        Effect.map(orchestrator.getThreadProjection(threadId), ({ runs }) => {
+          const run = runs.find(
+            (candidate) => candidate.userMessageId === MessageId.make(`${threadId}:message:${key}`),
+          );
+          assert.isDefined(run);
+          return run;
+        });
+      const startedRunIds = yield* Queue.unbounded<RunId>();
+      // Run updates in commit order; the run-update listener handles them in this order too.
+      const runUpdates: Array<OrchestrationV2Run> = [];
+      yield* eventSink
+        .stream({ threadId, afterSequence: yield* orchestrator.getThreadEventSequence(threadId) })
+        .pipe(
+          Stream.runForEach((stored) => {
+            if (stored.event.type !== "run.updated") return Effect.void;
+            runUpdates.push(stored.event.payload);
+            return stored.event.payload.status === "starting"
+              ? Queue.offer(startedRunIds, stored.event.payload.id)
+              : Effect.void;
+          }),
+          Effect.forkScoped,
+        );
+      yield* Effect.yieldNow;
+      const releasedAfter = (key: string, completedKey: string) =>
+        Effect.gen(function* () {
+          const [run, completed] = [yield* runFor(key), yield* runFor(completedKey)];
+          const released = runUpdates.findIndex(
+            (update) => update.id === run.id && update.queueHeld === false,
+          );
+          const completion = runUpdates.findIndex(
+            (update) => update.id === completed.id && update.status === "completed",
+          );
+          assert.isAbove(released, completion, `${key} was released before ${completedKey} ended`);
+        });
+      const end = (
+        key: string,
+        status: "completed" | "failed",
+        revision = "",
+        patch: Partial<OrchestrationV2Run> = {},
+      ) =>
+        Effect.gen(function* () {
+          const run = yield* runFor(key);
+          assert.isNotNull(run.rootNodeId);
+          const now = yield* DateTime.now;
+          yield* eventSink.write({
+            events: [
+              ...(status === "failed"
+                ? [
+                    {
+                      id: EventId.make(`${threadId}:${key}:error`),
+                      type: "turn-item.updated" as const,
+                      threadId,
+                      runId: run.id,
+                      nodeId: run.rootNodeId,
+                      providerInstanceId: run.providerInstanceId,
+                      occurredAt: now,
+                      payload: {
+                        id: TurnItemId.make(`${threadId}:${key}:error`),
+                        type: "error" as const,
+                        threadId,
+                        runId: run.id,
+                        nodeId: run.rootNodeId,
+                        providerThreadId: run.providerThreadId,
+                        providerTurnId: null,
+                        nativeItemRef: null,
+                        parentItemId: null,
+                        ordinal: 2,
+                        status: "failed" as const,
+                        title: "Provider failure",
+                        startedAt: now,
+                        completedAt: now,
+                        updatedAt: now,
+                        failure: {
+                          class: "provider_error" as const,
+                          message: "Provider failed.",
+                          code: "provider_failed",
+                          retryable: null,
+                        },
+                      },
+                    },
+                  ]
+                : []),
+              {
+                id: EventId.make(`${threadId}:${key}:${status}${revision}`),
+                type: "run.updated",
+                threadId,
+                runId: run.id,
+                nodeId: run.rootNodeId,
+                providerInstanceId: run.providerInstanceId,
+                occurredAt: now,
+                payload: { ...run, ...patch, status, startedAt: now, completedAt: now },
+              },
+            ],
+          });
+        });
+
+      // The run-update listener places failure holds after the terminal event commits.
+      const awaitHeld = (key: string) =>
+        Effect.gen(function* () {
+          const run = yield* runFor(key);
+          yield* eventSink.stream({ threadId, afterSequence: 0, eventType: "run.updated" }).pipe(
+            Stream.filter(
+              (stored) =>
+                stored.event.type === "run.updated" &&
+                stored.event.payload.id === run.id &&
+                stored.event.payload.queueHeld === true,
+            ),
+            Stream.runHead,
+          );
+        });
+      return { send, runFor, end, startedRunIds, releasedAfter, awaitHeld };
+    });
+
+  it.effect("releases held agent messages once a later run completes, not the user's", () =>
+    Effect.gen(function* () {
+      const eventSink = yield* EventSink.EventSinkV2;
+      const threadId = ThreadId.make("runtime-layer-failed-queue-agent-messages");
+      const { send, runFor, end, startedRunIds, releasedAfter, awaitHeld } =
+        yield* queueTestThread(threadId);
+      yield* send("earlier", "agent", true);
+      yield* end("earlier", "completed");
+      yield* send("active", "agent", true);
+      yield* send("issue", "agent", false);
+      yield* send("user", "user", false);
+      yield* end("active", "failed");
+      yield* awaitHeld("issue");
+      assert.isTrue((yield* runFor("issue")).queueHeld);
+      // Delivery bookkeeping rewrites an older completed run; the thread has not moved on.
+      yield* end("earlier", "completed", ":bookkeeping");
+      // A scheduled tick finds the thread idle and starts past the held queue.
+      yield* send("tick", "agent", true);
+      assert.equal((yield* runFor("tick")).status, "starting");
+      yield* end("tick", "completed");
+      assert.equal(yield* Queue.take(startedRunIds), (yield* runFor("issue")).id);
+      yield* releasedAfter("issue", "tick");
+      const user = yield* runFor("user");
+      assert.equal(user.status, "queued");
+      assert.isTrue(user.queueHeld);
+
+      // A run that finishes despite a stop request does not release what the stop held.
+      yield* send("after-stop", "agent", false);
+      assert.isTrue((yield* runFor("after-stop")).queueHeld);
+      const issue = yield* runFor("issue");
+      assert.isNotNull(issue.rootNodeId);
+      const now = yield* DateTime.now;
+      yield* eventSink.write({
+        events: [
+          {
+            id: EventId.make(`${threadId}:issue:interrupt-request`),
+            type: "turn-item.updated",
+            threadId,
+            runId: issue.id,
+            nodeId: issue.rootNodeId,
+            providerInstanceId: issue.providerInstanceId,
+            occurredAt: now,
+            payload: {
+              id: TurnItemId.make(`${threadId}:issue:interrupt-request`),
+              type: "run_interrupt_request",
+              threadId,
+              runId: issue.id,
+              nodeId: issue.rootNodeId,
+              providerThreadId: issue.providerThreadId,
+              providerTurnId: null,
+              nativeItemRef: null,
+              parentItemId: null,
+              ordinal: 2,
+              status: "completed",
+              title: "Interrupt requested",
+              startedAt: now,
+              completedAt: now,
+              updatedAt: now,
+              message: "Stopped by user",
+            },
+          },
+        ],
+      });
+      yield* end("issue", "completed");
+      // The next completed run releases it, which also shows the listener handled the stopped one.
+      yield* send("probe", "agent", true);
+      assert.equal((yield* runFor("probe")).status, "starting");
+      yield* end("probe", "completed");
+      assert.equal(yield* Queue.take(startedRunIds), (yield* runFor("after-stop")).id);
+      yield* releasedAfter("after-stop", "probe");
+    }),
+  );
+
+  it.effect("keeps held agent messages while the thread's worktree setup is unresolved", () =>
+    Effect.gen(function* () {
+      const orchestrator = yield* Orchestrator.OrchestratorV2;
+      const eventSink = yield* EventSink.EventSinkV2;
+      const dispatcherId = ThreadId.make("runtime-layer-held-queue-worktree");
+      const dispatcher = yield* queueTestThread(dispatcherId);
+      const witness = yield* queueTestThread(ThreadId.make("runtime-layer-held-queue-witness"));
+      yield* dispatcher.send("setup", "agent", true);
+      yield* dispatcher.send("issue", "agent", false);
+      yield* dispatcher.end("setup", "failed", "", {
+        workspacePreparation: { type: "worktree", baseRef: "main" },
+      });
+      yield* dispatcher.awaitHeld("issue");
+      assert.isTrue((yield* dispatcher.runFor("issue")).queueHeld);
+      yield* dispatcher.send("tick", "agent", true);
+      assert.equal((yield* dispatcher.runFor("tick")).status, "starting");
+      yield* witness.send("active", "agent", true);
+      yield* witness.send("queued", "agent", false);
+      // The failed setup never produced the thread's worktree.
+      const { thread } = yield* orchestrator.getThreadProjection(dispatcherId);
+      yield* eventSink.write({
+        events: [
+          {
+            id: EventId.make(`${dispatcherId}:worktree-missing`),
+            type: "thread.metadata-updated",
+            threadId: dispatcherId,
+            occurredAt: yield* DateTime.now,
+            payload: { ...thread, worktreePath: null },
+          },
+        ],
+      });
+      yield* dispatcher.end("tick", "completed");
+      // One listener handles every thread's completions in order, so the witness starting
+      // means the tick's completion was handled too.
+      yield* witness.end("active", "completed");
+      assert.equal(yield* Queue.take(witness.startedRunIds), (yield* witness.runFor("queued")).id);
+      assert.isTrue((yield* dispatcher.runFor("issue")).queueHeld);
+    }),
+  );
+
   it.effect("keeps queued user selections and pauses only the limited provider", () =>
     Effect.gen(function* () {
       const orchestrator = yield* Orchestrator.OrchestratorV2;
@@ -5372,9 +5631,10 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
         after.runs.find((run) => run.id === held.id),
         held,
       );
+      // Nobody will resume a server message, so the completed run released it behind the wake.
       assert.deepEqual(
         after.runs.find((run) => run.id === textContinuation.id),
-        textContinuation,
+        { ...textContinuation, queueHeld: false },
       );
     }),
   );
@@ -5714,7 +5974,7 @@ it.layer(layerTest)("snooze queued runs", (it) => {
             payload:
               run.status === "queued"
                 ? { ...run, queueHeld: true }
-                : { ...run, status: "completed" as const, completedAt: now },
+                : { ...run, status: "cancelled" as const, completedAt: now },
           })),
           effects: [],
         });

From 36dac688a17c6de1c6398e62d01546fb787c185b Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 18:12:11 -0700
Subject: [PATCH 119/146] fix(server): restart continuations retry failed
 starts and respect a parent's stop (#27222)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../DelegatedCompletionDelivery.test.ts       |  59 +++++++
 .../src/orchestration-v2/Orchestrator.ts      |  51 +++++-
 .../orchestration-v2/RestartBackgroundNote.ts |  46 ++++-
 .../RestartContinuation.test.ts               | 122 +++++++++++++-
 .../orchestration-v2/RestartContinuation.ts   |  33 +++-
 .../src/orchestration-v2/runtimeLayer.test.ts | 159 ++++++++++++++++++
 6 files changed, 464 insertions(+), 6 deletions(-)

diff --git a/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts b/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
index 77e4cd11ba071..ad2bc395d083f 100644
--- a/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
+++ b/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts
@@ -2448,6 +2448,65 @@ it.layer(layerTest)("delegated tasks across a server restart", (it) => {
       const task = settled.subagents.find((row) => row.id === child.taskId);
       assert.equal(task?.status, "cancelled");
       assert.equal(task?.completionDelivery?.state, "claimed");
+
+      // The parent's Stop committed, but the restart cut the effect that stops its children.
+      const stoppedChild = yield* seedRestartCancelledChild({
+        parentThreadId: threadId,
+        projectId,
+        parentRunId: runId,
+        rootNodeId,
+        name: "restart-parent-stopped-child",
+        completionWake: "always",
+        continuationPending: true,
+        now,
+      });
+      yield* (yield* EventSink.EventSinkV2).write({
+        commandId: CommandId.make("command:restart-declined-parent:stop"),
+        events: [
+          {
+            id: EventId.make("event:restart-declined-parent:interrupt-request"),
+            type: "turn-item.updated",
+            threadId,
+            runId,
+            nodeId: rootNodeId,
+            providerInstanceId: modelSelection.instanceId,
+            occurredAt: now,
+            payload: {
+              id: TurnItemId.make("turn-item:restart-declined-parent:interrupt-request"),
+              type: "run_interrupt_request",
+              threadId,
+              runId,
+              nodeId: rootNodeId,
+              providerThreadId: null,
+              providerTurnId: null,
+              nativeItemRef: null,
+              parentItemId: null,
+              ordinal: 90,
+              status: "completed",
+              title: "Interrupt requested",
+              startedAt: now,
+              completedAt: now,
+              updatedAt: now,
+              message: "Stopped by user",
+            },
+          },
+        ],
+      });
+      yield* continueRestartedRun({
+        threadId: stoppedChild.childThreadId,
+        sourceRunId: stoppedChild.childRunId,
+      }).pipe(Effect.provide(ServerSettings.layerTest({ continueThreadsAfterServerUpdate: true })));
+      const afterStop = yield* orchestrator.getThreadProjection(threadId);
+      assert.equal(
+        afterStop.subagents.find((row) => row.id === stoppedChild.taskId)?.status,
+        "cancelled",
+      );
+      assert.deepEqual(
+        (yield* orchestrator.getThreadProjection(stoppedChild.childThreadId)).runs.map(
+          (run) => run.id,
+        ),
+        [stoppedChild.childRunId],
+      );
     }),
   );
 
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 05b5601e5a80a..c65005deefb48 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -107,6 +107,8 @@ import { ContextHandoffServiceV2 } from "./ContextHandoffService.ts";
 import { notificationTurnItem } from "@t3tools/provider-core/server/notification";
 import {
   cancelledBeforeStart,
+  continuationFailedBeforePrompt,
+  continuationStartRetryDelayMs,
   isRestartContinuationSource,
   runOutcome,
 } from "./RestartBackgroundNote.ts";
@@ -2209,6 +2211,35 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       ),
   );
 
+  // Under load a resumed provider can time out before taking the prompt; the restart still owes the turn.
+  const retryContinuationStart = Effect.fn("Orchestrator.retryContinuationStart")(function* (
+    threadId: ThreadId,
+    runId: RunId,
+  ) {
+    const projection = yield* projectionStore.getThreadRecords(
+      threadId,
+      ["runs", "providerTurns", "turnItems"],
+      { turnItemTypes: ["error"], turnItemRunIds: [runId] },
+    );
+    const run = projection.runs.find((candidate) => candidate.id === runId);
+    if (run === undefined) return;
+    const delayMs = continuationStartRetryDelayMs(run, projection);
+    if (delayMs === undefined) return;
+    const commandId = CommandId.make(`command:restart-continuation-retry:${run.id}`);
+    yield* writeSystemEvents(
+      [],
+      [
+        {
+          id: `effect:restart-continuation:${run.id}`,
+          commandId,
+          threadId,
+          request: { type: "provider-runtime.continue", sourceRunId: run.id },
+          availableAt: DateTime.add(yield* DateTime.now, { milliseconds: delayMs }),
+        },
+      ],
+    );
+  });
+
   // A hold waits for a person to review what they queued. Nobody reviews messages from agents,
   // the server or scheduled tasks, so a later completed run releases those unless it was stopped.
   const releaseUnattendedHolds = Effect.fn("Orchestrator.releaseUnattendedHolds")(function* (
@@ -5188,7 +5219,10 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       const source = projection.runs.find((run) => run.id === command.restartContinuationOfRunId);
       if (
         !source ||
-        !isRestartContinuationSource(source, projection.providerTurns) ||
+        !(
+          isRestartContinuationSource(source, projection.providerTurns) ||
+          continuationFailedBeforePrompt(source, projection.providerTurns)
+        ) ||
         projection.thread.archivedAt !== null ||
         projection.thread.deletedAt !== null ||
         projection.thread.providerInstanceId !== source.providerInstanceId ||
@@ -10419,7 +10453,8 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       // A resumed queue can have a lower ordinal than a pending continuation source.
       // Stop must reach those sources even when interrupting the resumed run succeeds.
       if (
-        run.status === "cancelled" &&
+        (run.status === "cancelled" ||
+          (run.status === "failed" && run.restartContinuationOfRunId !== undefined)) &&
         (yield* awaitsRestartContinuation(run).pipe(mapDispatchError(input.command)))
       ) {
         yield* markStoppedRun({ ...input, thread, run });
@@ -13129,6 +13164,18 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       // while writing child events, so nesting parent inside child would invert the order.
       // The keyed semaphores are neither reentrant nor deadlock-aware.
       if (delegatedTaskTerminalStatus(run.status) !== null) {
+        // Before the parent hears of the failure: a pending continuation keeps the task open.
+        if (run.status === "failed" && run.restartContinuationOfRunId !== undefined) {
+          yield* threadDispatch.withLock(threadId, retryContinuationStart(threadId, run.id)).pipe(
+            Effect.catchCause((cause) =>
+              Effect.logWarning("Failed to schedule a restart continuation retry", {
+                threadId,
+                runId: run.id,
+                cause,
+              }),
+            ),
+          );
+        }
         yield* threadDispatch.withLock(
           threadId,
           finalizeDelegatedCompletionDelivery(threadId, run.id),
diff --git a/apps/server/src/orchestration-v2/RestartBackgroundNote.ts b/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
index ba3830f65453d..24afd61d6186a 100644
--- a/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
+++ b/apps/server/src/orchestration-v2/RestartBackgroundNote.ts
@@ -6,7 +6,7 @@ import type {
   OrchestrationV2RunAttempt,
   OrchestrationV2TurnItem,
 } from "@t3tools/contracts";
-import { runRanAfter } from "@t3tools/shared/orchestrationV2ThreadError";
+import { latestRootProviderFailure, runRanAfter } from "@t3tools/shared/orchestrationV2ThreadError";
 
 type Work = OrchestrationV2RestartCancelledBackgroundWork;
 type Attempt = Pick<OrchestrationV2RunAttempt, "id" | "runId">;
@@ -181,6 +181,50 @@ export function cancelledBeforeStart(
   return run.status === "cancelled" && neverStarted(run);
 }
 
+/** The provider never accepted this continuation's prompt, so starting it again repeats nothing. */
+export function continuationFailedBeforePrompt(
+  run: Pick<OrchestrationV2Run, "status" | "activeAttemptId" | "restartContinuationOfRunId">,
+  providerTurns: ReadonlyArray<Pick<ProviderTurnState, "runAttemptId">>,
+): boolean {
+  return (
+    run.status === "failed" &&
+    run.restartContinuationOfRunId !== undefined &&
+    !providerTurns.some((turn) => turn.runAttemptId === run.activeAttemptId)
+  );
+}
+
+const CONTINUATION_START_RETRY_DELAYS_MS = [60_000, 180_000];
+
+/** Backoff before restarting a continuation that failed to start, or undefined to let it fail. */
+export function continuationStartRetryDelayMs(
+  run: OrchestrationV2Run,
+  projection: {
+    readonly runs: ReadonlyArray<OrchestrationV2Run>;
+    readonly providerTurns: ReadonlyArray<Pick<ProviderTurnState, "runAttemptId">>;
+    readonly turnItems: Parameters<typeof latestRootProviderFailure>[1];
+  },
+): number | undefined {
+  if (!continuationFailedBeforePrompt(run, projection.providerTurns)) return;
+  // These fail the same way however often they start.
+  const failureClass = latestRootProviderFailure(run, projection.turnItems)?.class;
+  if (
+    failureClass === "usage_limit" ||
+    failureClass === "permission_error" ||
+    failureClass === "validation_error"
+  )
+    return;
+  let failedStarts = 0;
+  for (
+    let current: OrchestrationV2Run | undefined = run;
+    current !== undefined && continuationFailedBeforePrompt(current, projection.providerTurns);
+    current = projection.runs.find(
+      (candidate) => candidate.id === current?.restartContinuationOfRunId,
+    )
+  )
+    failedStarts += 1;
+  return CONTINUATION_START_RETRY_DELAYS_MS[failedStarts - 1];
+}
+
 export function isRestartContinuationSource(
   source: Pick<OrchestrationV2Run, "status" | "activeAttemptId" | "restartCancelledBackgroundWork">,
   providerTurns: ReadonlyArray<Pick<ProviderTurnState, "runAttemptId" | "status">>,
diff --git a/apps/server/src/orchestration-v2/RestartContinuation.test.ts b/apps/server/src/orchestration-v2/RestartContinuation.test.ts
index 061fc54a7f112..d2224720b89f1 100644
--- a/apps/server/src/orchestration-v2/RestartContinuation.test.ts
+++ b/apps/server/src/orchestration-v2/RestartContinuation.test.ts
@@ -20,6 +20,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as ServerSettings from "../serverSettings.ts";
 import { restartContinuationRun, continueRestartedRun } from "./RestartContinuation.ts";
+import { continuationStartRetryDelayMs } from "./RestartBackgroundNote.ts";
 import * as ThreadManagementService from "./ThreadManagementService.ts";
 import * as ProviderRuntimeRecovery from "./ProviderRuntimeRecoveryService.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
@@ -46,6 +47,8 @@ function makeProjection() {
       providerInstanceId: instanceId,
       archivedAt: null,
       deletedAt: null,
+      lineage: { parentThreadId: null, relationshipToParent: null },
+      forkedFrom: null,
     },
     runs: [
       {
@@ -839,10 +842,13 @@ it.effect("does not cancel or resume a run that completes while shutdown intent
   }),
 );
 
-const continuationDispatches = (projection: OrchestrationV2ThreadProjection) =>
+const continuationDispatches = (
+  projection: OrchestrationV2ThreadProjection,
+  sourceRunId: RunId = runId,
+) =>
   Effect.gen(function* () {
     const dispatches: Array<Extract<OrchestrationV2Command, { type: "message.dispatch" }>> = [];
-    yield* continueRestartedRun({ threadId, sourceRunId: runId }).pipe(
+    yield* continueRestartedRun({ threadId, sourceRunId }).pipe(
       Effect.provide(
         Layer.merge(
           Layer.mock(ThreadManagementService.ThreadManagementService)({
@@ -943,6 +949,118 @@ it.effect("continues a resumed queued run that ran after an earlier continuation
   }),
 );
 
+it("backs off twice from a continuation the provider never took, then lets it fail", () => {
+  const base = makeProjection();
+  const failedStart = (id: string, of: RunId) => ({
+    ...base.runs[0]!,
+    id: RunId.make(id),
+    activeAttemptId: RunAttemptId.make(`attempt:${id}`),
+    status: "failed" as const,
+    restartContinuationOfRunId: of,
+  });
+  const first = failedStart("run:retry-1", runId);
+  const second = failedStart("run:retry-2", first.id);
+  const third = failedStart("run:retry-3", second.id);
+  const projection = (failureClass = "provider_error", providerTurns = base.providerTurns) =>
+    ({
+      runs: [{ ...base.runs[0]!, status: "cancelled" }, first, second, third],
+      providerTurns,
+      turnItems: [first, second, third].map((run) => ({
+        id: `error:${run.id}`,
+        type: "error",
+        status: "failed",
+        runId: run.id,
+        nodeId: run.rootNodeId,
+        ordinal: 1,
+        updatedAt: now,
+        failure: { class: failureClass, message: "Failed.", code: null, retryable: null },
+      })),
+    }) as unknown as Parameters<typeof continuationStartRetryDelayMs>[1];
+  assert.deepEqual(
+    [first, second, third].map((run) => continuationStartRetryDelayMs(run, projection())),
+    [60_000, 180_000, undefined],
+  );
+  for (const failureClass of ["usage_limit", "permission_error", "validation_error"])
+    assert.isUndefined(continuationStartRetryDelayMs(first, projection(failureClass)));
+  // Once the provider took the prompt, starting again would repeat the turn.
+  assert.isUndefined(
+    continuationStartRetryDelayMs(
+      first,
+      projection("provider_error", [
+        { ...base.providerTurns[0]!, runAttemptId: first.activeAttemptId, status: "failed" },
+      ] as never),
+    ),
+  );
+});
+
+it.effect("continues again after a continuation fails before its prompt", () =>
+  Effect.gen(function* () {
+    const cut = cutMidTurn();
+    const failedStart = {
+      ...cut.runs[0]!,
+      id: RunId.make("run:failed-start"),
+      ordinal: 2,
+      activeAttemptId: RunAttemptId.make("attempt:failed-start"),
+      status: "failed",
+      restartContinuationOfRunId: runId,
+    };
+    const dispatches = yield* continuationDispatches(
+      { ...cut, runs: [...cut.runs, failedStart] } as unknown as OrchestrationV2ThreadProjection,
+      failedStart.id,
+    );
+    assert.deepEqual(
+      dispatches.map((command) => command.restartContinuationOfRunId),
+      [failedStart.id],
+    );
+  }),
+);
+
+it.effect.each([
+  ["running", null, 0],
+  ["completed", "Done.", 1],
+] as const)(
+  "a parent's Stop on the task's run blocks the child only while the task is %s",
+  ([status, result, expected]) =>
+    Effect.gen(function* () {
+      const parentThreadId = ThreadId.make("thread:parent");
+      const parentRunId = RunId.make("run:parent");
+      const taskId = NodeId.make("node:task");
+      const cut = cutMidTurn();
+      const child = {
+        ...cut,
+        thread: {
+          ...cut.thread,
+          lineage: { parentThreadId, relationshipToParent: "subagent" },
+          forkedFrom: { type: "node", nodeId: taskId },
+        },
+      } as unknown as OrchestrationV2ThreadProjection;
+      const parent = {
+        thread: { id: parentThreadId },
+        subagents: [{ id: taskId, runId: parentRunId, origin: "app_owned", status, result }],
+        turnItems: [{ id: "turn-item:stop", runId: parentRunId, type: "run_interrupt_request" }],
+      };
+      let dispatched = 0;
+      yield* continueRestartedRun({ threadId, sourceRunId: runId }).pipe(
+        Effect.provide(
+          Layer.merge(
+            Layer.mock(ThreadManagementService.ThreadManagementService)({
+              getThreadRecords: (id) =>
+                Effect.succeed((id === parentThreadId ? parent : child) as never),
+              recoverDelegatedTask: () => Effect.void,
+              dispatch: () =>
+                Effect.sync(() => {
+                  dispatched += 1;
+                  return {} as never;
+                }),
+            }),
+            ServerSettings.layerTest({ continueThreadsAfterServerUpdate: true }),
+          ),
+        ),
+      );
+      assert.equal(dispatched, expected);
+    }),
+);
+
 it.effect("does not continue a run the user asked to stop before the restart", () =>
   Effect.gen(function* () {
     const texts = yield* continuationTexts({
diff --git a/apps/server/src/orchestration-v2/RestartContinuation.ts b/apps/server/src/orchestration-v2/RestartContinuation.ts
index c81faa6cf47cb..e4d7ac2b7f900 100644
--- a/apps/server/src/orchestration-v2/RestartContinuation.ts
+++ b/apps/server/src/orchestration-v2/RestartContinuation.ts
@@ -2,6 +2,7 @@ import { runRanAfter } from "@t3tools/shared/orchestrationV2ThreadError";
 import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
 import {
   CommandId,
+  isOrchestrationV2WorkActive,
   latestProviderTurnForAttempt,
   MessageId,
   type OrchestrationV2Run,
@@ -19,6 +20,7 @@ import {
   awaitingProviderThreadId,
   cancelledRosterTaskWork,
   cancelledTurnItemWork,
+  continuationFailedBeforePrompt,
   isAwaitedWork,
   isRestartContinuationSource,
   cancelledBeforeStart,
@@ -200,7 +202,10 @@ export const continueRestartedRun = Effect.fn("RestartContinuation.continueResta
     const source = projection.runs.find((run) => run.id === input.sourceRunId);
     if (
       !source ||
-      !isRestartContinuationSource(source, projection.providerTurns) ||
+      !(
+        isRestartContinuationSource(source, projection.providerTurns) ||
+        continuationFailedBeforePrompt(source, projection.providerTurns)
+      ) ||
       restartContinuationBlocked(
         projection,
         source,
@@ -255,6 +260,32 @@ export const continueRestartedRun = Effect.fn("RestartContinuation.continueResta
       )
     )
       return;
+    // A parent's Stop reaches its open delegated tasks through an effect a restart can cut short.
+    const { lineage, forkedFrom } = projection.thread;
+    const taskId =
+      source.delegatedTaskId ?? (forkedFrom?.type === "node" ? forkedFrom.nodeId : undefined);
+    if (
+      lineage.relationshipToParent === "subagent" &&
+      lineage.parentThreadId !== null &&
+      taskId !== undefined
+    ) {
+      const task = (yield* threads.getThreadRecords(lineage.parentThreadId, ["subagents"], {
+        subagentIds: [taskId],
+      })).subagents.find((candidate) => candidate.id === taskId);
+      // A settled task no longer owns later work in its thread.
+      const parentRunId =
+        task !== undefined && task.result === null && isOrchestrationV2WorkActive(task.status)
+          ? task.runId
+          : null;
+      if (
+        parentRunId !== null &&
+        (yield* threads.getThreadRecords(lineage.parentThreadId, ["turnItems"], {
+          turnItemTypes: ["run_interrupt_request"],
+          turnItemRunIds: [parentRunId],
+        })).turnItems.length > 0
+      )
+        return;
+    }
     const sourceMessage = sourceRecords.messages.find(
       (message) => message.id === source.userMessageId,
     );
diff --git a/apps/server/src/orchestration-v2/runtimeLayer.test.ts b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
index 11eb866b5fb9c..20158a80d3ff6 100644
--- a/apps/server/src/orchestration-v2/runtimeLayer.test.ts
+++ b/apps/server/src/orchestration-v2/runtimeLayer.test.ts
@@ -5465,6 +5465,165 @@ it.layer(layerTest)("OrchestrationV2LayerLive lifecycle", (it) => {
     }),
   );
 
+  it.effect.each([false, true])(
+    "restarts a continuation that failed before its prompt, unless stopped (%s)",
+    (stopped) =>
+      Effect.gen(function* () {
+        const orchestrator = yield* Orchestrator.OrchestratorV2;
+        const eventSink = yield* EventSink.EventSinkV2;
+        const worker = yield* EffectWorker.OrchestrationEffectWorkerV2;
+        const threadId = ThreadId.make(`runtime-layer-continuation-start-retry-${stopped}`);
+        const messageId = (key: string) => MessageId.make(`${threadId}:${key}`);
+        yield* orchestrator.dispatch({
+          type: "thread.create",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make(`${threadId}:create`),
+          threadId,
+          projectId: ProjectId.make(`${threadId}:project`),
+          title: "Continuation start retry",
+          modelSelection,
+          runtimeMode: "full-access",
+          interactionMode: "default",
+          branch: null,
+          worktreePath: process.cwd(),
+        });
+        const runFor = (key: string) =>
+          Effect.map(orchestrator.getThreadProjection(threadId), ({ runs }) =>
+            runs.find((candidate) => candidate.userMessageId === messageId(key)),
+          );
+        const write = (
+          key: string,
+          payload: OrchestrationV2Run,
+          extra: Parameters<typeof eventSink.write>[0]["events"] = [],
+        ) =>
+          Effect.gen(function* () {
+            const now = yield* DateTime.now;
+            yield* eventSink.write({
+              events: [
+                ...extra,
+                {
+                  id: EventId.make(`${threadId}:${key}`),
+                  type: "run.updated",
+                  threadId,
+                  runId: payload.id,
+                  providerInstanceId: payload.providerInstanceId,
+                  occurredAt: now,
+                  payload: { ...payload, startedAt: now, completedAt: now },
+                },
+              ],
+            });
+          });
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make(`${threadId}:message:cut`),
+          threadId,
+          messageId: messageId("cut"),
+          text: "Work that the restart cut",
+          attachments: [],
+          modelSelection,
+          dispatchMode: { type: "start_immediately" },
+        });
+        const cut = (yield* runFor("cut"))!;
+        yield* write("cut:cancelled", { ...cut, status: "cancelled" });
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy: "agent",
+          creationSource: "server",
+          commandId: CommandId.make(`${threadId}:message:continuation`),
+          threadId,
+          messageId: messageId("continuation"),
+          text: "Continue where you left off.",
+          attachments: [],
+          modelSelection,
+          dispatchMode: { type: "start_immediately" },
+          restartContinuationOfRunId: cut.id,
+        });
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make(`${threadId}:message:queued`),
+          threadId,
+          messageId: messageId("queued"),
+          text: "Queued behind the continuation",
+          attachments: [],
+          modelSelection,
+          dispatchMode: { type: "queue_after_active" },
+        });
+        const continuation = (yield* runFor("continuation"))!;
+        assert.isNotNull(continuation.rootNodeId);
+        const queued = (yield* runFor("queued"))!;
+        // The failure holds the queue after the reactor scheduled any retry.
+        const held = yield* eventSink
+          .stream({ threadId, afterSequence: yield* orchestrator.getThreadEventSequence(threadId) })
+          .pipe(
+            Stream.filter(
+              (stored) =>
+                stored.event.type === "run.updated" &&
+                stored.event.payload.id === queued.id &&
+                stored.event.payload.queueHeld === true,
+            ),
+            Stream.runHead,
+            Effect.forkScoped,
+          );
+        yield* Effect.yieldNow;
+        const now = yield* DateTime.now;
+        yield* write("continuation:failed", { ...continuation, status: "failed" }, [
+          {
+            id: EventId.make(`${threadId}:continuation:error`),
+            type: "turn-item.updated",
+            threadId,
+            runId: continuation.id,
+            nodeId: continuation.rootNodeId,
+            providerInstanceId: continuation.providerInstanceId,
+            occurredAt: now,
+            payload: {
+              id: TurnItemId.make(`${threadId}:continuation:error`),
+              type: "error",
+              threadId,
+              runId: continuation.id,
+              nodeId: continuation.rootNodeId,
+              providerThreadId: continuation.providerThreadId,
+              providerTurnId: null,
+              nativeItemRef: null,
+              parentItemId: null,
+              ordinal: 2,
+              status: "failed",
+              title: "Provider failure",
+              startedAt: now,
+              completedAt: now,
+              updatedAt: now,
+              failure: {
+                class: "provider_error",
+                message: "Claude timed out while registering its MCP tools.",
+                code: null,
+                retryable: null,
+              },
+            },
+          },
+        ]);
+        yield* Fiber.join(held);
+        const retriesOf = Effect.map(orchestrator.getThreadProjection(threadId), ({ runs }) =>
+          runs.filter((run) => run.restartContinuationOfRunId === continuation.id),
+        );
+        yield* worker.drain();
+        assert.deepEqual(yield* retriesOf, [], "the retry waits out its backoff");
+        if (stopped) {
+          yield* orchestrator.dispatch({
+            type: "thread.stop",
+            commandId: CommandId.make(`${threadId}:stop`),
+            threadId,
+          });
+        }
+        yield* TestClock.adjust("61 seconds");
+        yield* worker.drain();
+        assert.lengthOf(yield* retriesOf, stopped ? 0 : 1);
+      }),
+  );
+
   it.effect.each(["startup", "shutdown"] as const)(
     "preserves and holds queued messages across %s until explicitly resumed",
     (trigger) =>

From 6d12bb1e9fbdd6186967ae57cd0917c39f7214e4 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Thu, 29 Oct 2026 18:24:10 -0700
Subject: [PATCH 120/146] fix(server): Stop during a restart no longer leaves
 the thread stuck (#27141)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/orchestration-v2/Orchestrator.ts      |  39 ++++++
 .../SelectionRestart.integration.test.ts      | 112 ++++++++++++++++++
 2 files changed, 151 insertions(+)

diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index c65005deefb48..16865229d94f2 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -11062,6 +11062,45 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         occurredAt: now,
         payload: { ...run, status: "interrupted", completedAt: now },
       });
+      // Stop cancels a pending restart, so it must end the turn that restart could not stop.
+      const supersededTurn = projection.providerTurns.findLast(
+        (candidate) =>
+          candidate.status === "running" &&
+          projection.attempts.some(
+            (attempt) => attempt.id === candidate.runAttemptId && attempt.runId === run.id,
+          ),
+      );
+      const supersededOwner =
+        supersededTurn === undefined
+          ? undefined
+          : projection.providerThreads.find(
+              (candidate) => candidate.id === supersededTurn.providerThreadId,
+            );
+      if (
+        supersededTurn !== undefined &&
+        supersededOwner !== undefined &&
+        supersededOwner.providerSessionId !== null &&
+        Option.isSome(
+          yield* providerSessions
+            .get(supersededOwner.providerSessionId)
+            .pipe(Effect.orElseSucceed(() => Option.none())),
+        )
+      ) {
+        const id = `effect:${command.commandId}:provider-turn.interrupt:${supersededTurn.id}`;
+        if (!otherProviderInterrupts.some((effect) => effect.id === id)) {
+          otherProviderInterrupts.push({
+            id,
+            commandId: command.commandId,
+            threadId: command.threadId,
+            request: {
+              type: "provider-turn.interrupt",
+              providerSessionId: supersededOwner.providerSessionId,
+              providerThreadId: supersededOwner.id,
+              providerTurnId: supersededTurn.id,
+            },
+          });
+        }
+      }
       yield* stopRemainingWork();
       yield* Ref.update(effects, (existing) => [...existing, ...otherProviderInterrupts]);
       return {
diff --git a/apps/server/src/orchestration-v2/SelectionRestart.integration.test.ts b/apps/server/src/orchestration-v2/SelectionRestart.integration.test.ts
index 03cdf5e85a642..d059c4c20e9d7 100644
--- a/apps/server/src/orchestration-v2/SelectionRestart.integration.test.ts
+++ b/apps/server/src/orchestration-v2/SelectionRestart.integration.test.ts
@@ -438,6 +438,118 @@ it.live("retries a failed selection restart session open before completing", ()
   ),
 );
 
+it.live("Stop during a restart interrupts the turn the restart could not stop", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const cwd = yield* checkpointWorkspace("selection-restart-stop");
+      const threadId = ThreadId.make("thread:selection-restart-stop");
+      const state = yield* Ref.make<RestartAdapterState>({
+        activeTurn: null,
+        opened: [],
+        started: [],
+        closedSessionCount: 0,
+        failedReplacementOpen: false,
+      });
+      const base = makeRestartAdapter(state);
+      // A wedged provider ignores the restart's soft cancel; only Stop ends its turn.
+      const adapter: ProviderAdapter.ProviderAdapterV2["Service"] = {
+        ...base,
+        openSession: (input) =>
+          base.openSession(input).pipe(
+            Effect.map((session) => ({
+              ...session,
+              interruptTurn: (interrupt: ProviderAdapter.ProviderAdapterV2InterruptInput) =>
+                interrupt.requestRuntimeRestart === true
+                  ? session.interruptTurn(interrupt)
+                  : Effect.never,
+            })),
+          ),
+      };
+
+      const result = yield* Effect.gen(function* () {
+        const orchestrator = yield* Orchestrator.OrchestratorV2;
+        const worker = yield* EffectWorker.OrchestrationEffectWorkerV2;
+        const running = yield* orchestrator.streamDomainEvents.pipe(
+          Stream.filter(
+            (event) => event.type === "provider-turn.updated" && event.payload.status === "running",
+          ),
+          Stream.take(1),
+          Stream.runDrain,
+          Effect.forkScoped({ startImmediately: true }),
+        );
+        yield* orchestrator.dispatch({
+          type: "thread.create",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make("command:selection-restart-stop:create"),
+          threadId,
+          projectId: ProjectId.make("project:selection-restart-stop"),
+          title: "Stop during restart",
+          modelSelection: initialSelection,
+          runtimeMode: "full-access",
+          interactionMode: "default",
+          branch: null,
+          worktreePath: cwd,
+        });
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make("command:selection-restart-stop:first"),
+          threadId,
+          messageId: MessageId.make("message:selection-restart-stop:first"),
+          text: "first",
+          attachments: [],
+          modelSelection: initialSelection,
+          dispatchMode: { type: "start_immediately" },
+        });
+        yield* worker.drain();
+        yield* Fiber.join(running);
+        const runId = (yield* orchestrator.getThreadProjection(threadId)).runs[0]!.id;
+
+        yield* orchestrator.dispatch({
+          type: "message.dispatch",
+          createdBy: "user",
+          creationSource: "web",
+          commandId: CommandId.make("command:selection-restart-stop:steer"),
+          threadId,
+          messageId: MessageId.make("message:selection-restart-stop:steer"),
+          text: "Are you still going?",
+          attachments: [],
+          modelSelection: initialSelection,
+          dispatchMode: { type: "restart_active", targetRunId: runId },
+        });
+        yield* orchestrator.dispatch({
+          type: "run.interrupt",
+          commandId: CommandId.make("command:selection-restart-stop:stop"),
+          threadId,
+          runId,
+        });
+        yield* worker.drain();
+        return {
+          projection: yield* orchestrator.getThreadProjection(threadId),
+          captured: yield* Ref.get(state),
+        };
+      }).pipe(
+        Effect.provide(
+          ProviderReplayHarness.layerWithRegistry(
+            { name: "selection-restart-stop" },
+            ProviderAdapterRegistry.layerSingle(adapter),
+          ),
+        ),
+      );
+
+      assert.isNull(result.captured.activeTurn);
+      assert.lengthOf(result.captured.started, 1);
+      assert.equal(result.projection.runs[0]?.status, "interrupted");
+      assert.deepEqual(
+        result.projection.providerTurns.map((turn) => turn.status),
+        ["interrupted"],
+      );
+    }),
+  ),
+);
+
 it.live(
   "restarts the live session on a model change when a newer stopped session record exists",
   () =>

From 8970a32104e0d37123f33fd122e96826e68b3b4a Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 18:31:45 -0700
Subject: [PATCH 121/146] fix(scripts): bound check:changed concurrency and
 step time (#27227)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/operations/development.md |   8 +-
 scripts/check-changed.test.ts  | 154 ++++++
 scripts/check-changed.ts       | 852 ++++++++++++++++++++-------------
 3 files changed, 677 insertions(+), 337 deletions(-)
 create mode 100644 scripts/check-changed.test.ts

diff --git a/docs/operations/development.md b/docs/operations/development.md
index 3307dbc22b969..0501250c29d16 100644
--- a/docs/operations/development.md
+++ b/docs/operations/development.md
@@ -170,8 +170,12 @@ files to packages with [ci-changes.cjs](../../.github/scripts/ci-changes.cjs), a
 compares against the merge base with `origin/main`, or with a ref you pass. CI still runs the full
 test suites and the jobs the summary lists, so a local pass does not promise a green CI run.
 
-The steps run side by side, so a run takes about as long as its slowest step, usually knip's
-exports pass at about 10 s. When the files are exactly those of the last passing run, it prints that
+The steps run side by side, as many at once as the machine allows: one per two cores and per 6 GiB
+of available memory. On a large machine a run takes about as long as its slowest step, usually
+knip's exports pass at about 10 s. Pass `--concurrency <n>` or set `CHECK_CHANGED_CONCURRENCY` to
+change the limit (`1` runs the steps one by one). A step that runs past `--timeout <seconds>` or
+`CHECK_CHANGED_TIMEOUT` (default 900) is killed with every process it started and reported as
+`TIMEOUT`, not as a failing check. When the files are exactly those of the last passing run, it prints that
 run's summary instead of running again. Any change to a file, the install, or a generated file runs
 the checks again.
 
diff --git a/scripts/check-changed.test.ts b/scripts/check-changed.test.ts
new file mode 100644
index 0000000000000..2bcd623a0b4b6
--- /dev/null
+++ b/scripts/check-changed.test.ts
@@ -0,0 +1,154 @@
+import { assert, describe, it } from "@effect/vitest";
+import * as Clock from "effect/Clock";
+import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import { ChildProcessSpawner } from "effect/process";
+import * as TestClock from "effect/testing/TestClock";
+
+import { defaultConcurrency, gitLines, runSteps, type Step } from "./check-changed.ts";
+
+const GiB = 1024 ** 3;
+
+describe("check:changed", () => {
+  it("bounds the default concurrency by the scarcer of cores and available memory", () => {
+    assert.strictEqual(defaultConcurrency(32, 128 * GiB), 16);
+    assert.strictEqual(defaultConcurrency(32, 20 * GiB), 3);
+    assert.strictEqual(defaultConcurrency(4, 15 * GiB), 2);
+    assert.strictEqual(defaultConcurrency(4, 2 * GiB), 1);
+    assert.strictEqual(defaultConcurrency(1, 64 * GiB), 1);
+  });
+
+  it.effect(
+    "keeps weighted steps within the budget, in order, and serial steps one at a time",
+    () =>
+      Effect.gen(function* () {
+        const startedAt: Record<string, number> = {};
+        let active = 0;
+        let maxActive = 0;
+        let serialActive = 0;
+        let maxSerial = 0;
+        const step = (
+          name: string,
+          options: { weight?: number; serial?: boolean } = {},
+        ): Step<never> => {
+          const slots = Math.min(options.weight ?? 1, 3);
+          return {
+            name,
+            ...options,
+            run: Effect.gen(function* () {
+              startedAt[name] = (yield* Clock.currentTimeMillis) / 1000;
+              active += slots;
+              maxActive = Math.max(maxActive, active);
+              if (options.serial) maxSerial = Math.max(maxSerial, ++serialActive);
+              yield* Effect.sleep("1 second");
+              active -= slots;
+              if (options.serial) serialActive--;
+              return { ok: true, output: "" };
+            }),
+          };
+        };
+        const fiber = yield* runSteps(
+          [
+            step("light 1"),
+            // Above the budget, so it holds every slot rather than never starting.
+            step("heavy", { weight: 5 }),
+            step("pair", { weight: 2 }),
+            step("light 2"),
+            step("test 1", { serial: true }),
+            step("test 2", { serial: true }),
+          ],
+          { concurrency: 3, timeoutSeconds: 60 },
+        ).pipe(Effect.forkChild);
+        yield* TestClock.adjust("10 seconds");
+        const results = yield* Fiber.join(fiber);
+
+        assert.deepStrictEqual(
+          results.map((result) => result.outcome),
+          ["pass", "pass", "pass", "pass", "pass", "pass"],
+        );
+        assert.strictEqual(maxActive, 3);
+        // Lighter steps queued behind the heavy one never start ahead of it.
+        assert.deepStrictEqual(startedAt, {
+          "light 1": 0,
+          heavy: 1,
+          pair: 2,
+          "light 2": 2,
+          "test 1": 3,
+          "test 2": 4,
+        });
+        assert.strictEqual(maxSerial, 1);
+      }),
+  );
+
+  it.effect("interrupts a step at its timeout and reports TIMEOUT, apart from FAIL", () =>
+    Effect.gen(function* () {
+      let interrupted = false;
+      const fiber = yield* runSteps(
+        [
+          {
+            name: "hangs",
+            run: Effect.never.pipe(
+              Effect.onInterrupt(() => Effect.sync(() => (interrupted = true))),
+            ),
+          },
+          { name: "fails", run: Effect.succeed({ ok: false, output: "error" }) },
+          { name: "passes", run: Effect.succeed({ ok: true, output: "" }) },
+        ],
+        { concurrency: 3, timeoutSeconds: 10 },
+      ).pipe(Effect.forkChild);
+      yield* TestClock.adjust("9 seconds");
+      assert.isFalse(interrupted);
+      yield* TestClock.adjust("1 second");
+      const results = yield* Fiber.join(fiber);
+
+      assert.isTrue(interrupted);
+      assert.deepStrictEqual(
+        results.map(({ name, outcome, time }) => [name, outcome, time]),
+        [
+          ["hangs", "TIMEOUT", "killed after 10s"],
+          ["fails", "FAIL", "0.0s"],
+          ["passes", "pass", "0.0s"],
+        ],
+      );
+    }),
+  );
+
+  it.effect("fails instead of returning an empty file list when git exits nonzero", () => {
+    const spawner = (exitCode: number) =>
+      ChildProcessSpawner.make(() =>
+        Effect.succeed(
+          ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(1),
+            exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(exitCode)),
+            isRunning: Effect.succeed(false),
+            kill: () => Effect.void,
+            unref: Effect.succeed(Effect.void),
+            stdin: Sink.drain,
+            stdout: Stream.encodeText(Stream.make(exitCode === 0 ? "a.ts\nb.ts\n" : "")),
+            stderr: Stream.encodeText(
+              Stream.make(exitCode === 0 ? "" : "fatal: index file corrupt"),
+            ),
+            all: Stream.empty,
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+          }),
+        ),
+      );
+    return Effect.gen(function* () {
+      const listed = yield* gitLines("/repo", ["ls-files"]).pipe(
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner(0)),
+      );
+      assert.deepStrictEqual(listed, ["a.ts", "b.ts"]);
+      const error = yield* gitLines("/repo", ["ls-files"]).pipe(
+        Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner(128)),
+        Effect.flip,
+      );
+      assert.strictEqual(
+        error,
+        "check:changed: git ls-files exited with 128: fatal: index file corrupt",
+      );
+    });
+  });
+});
diff --git a/scripts/check-changed.ts b/scripts/check-changed.ts
index b854cf0a4e539..dfa4f3a833bbe 100644
--- a/scripts/check-changed.ts
+++ b/scripts/check-changed.ts
@@ -1,4 +1,4 @@
-// @effect-diagnostics nodeBuiltinImport:off globalConsole:off
+// @effect-diagnostics nodeBuiltinImport:off - hashes inputs with node:crypto and sizes the budget with node:os.
 // Runs CI's fast checks for this branch's changes: format and lint of the
 // changed files, knip, generated GraphQL operations, typecheck of the affected
 // packages and their dependents, the test files beside the changed files, and
@@ -7,369 +7,551 @@
 // A dependency change also gets the unused-patch install check below. CI still
 // runs the full test suites and the jobs listed in the summary.
 //
-//   vp run check:changed          compare against the merge base with origin/main
-//   vp run check:changed <ref>    compare against the merge base with <ref>
+//   vp run check:changed                  compare against the merge base with origin/main
+//   vp run check:changed <ref>            compare against the merge base with <ref>
+//   vp run check:changed --concurrency 1  run the steps one at a time
 //
 // Uncommitted and untracked files count. Affected packages come from
 // .github/scripts/ci-changes.cjs, the same mapping CI uses to gate its jobs.
-// The steps run side by side; each prints its output when it finishes. A
-// rerun on exactly the files of the last passing run prints that run's summary.
-import * as NodeChildProcess from "node:child_process";
+// The steps run side by side within a budget derived from the machine's cores
+// and available memory, and each prints its output when it finishes. A step
+// running past the timeout is killed with its process group and reported as
+// TIMEOUT. A rerun on exactly the files of the last passing run prints that
+// run's summary.
 import * as NodeCrypto from "node:crypto";
-import * as NodeFS from "node:fs";
 import * as NodeOS from "node:os";
-import * as NodePath from "node:path";
+
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+import * as Clock from "effect/Clock";
+import * as Config from "effect/Config";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import type * as PlatformError from "effect/PlatformError";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import * as Stream from "effect/Stream";
+import { Argument, Command, Flag } from "effect/cli";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
 import { decide, readWorkspace } from "../.github/scripts/ci-changes.cjs";
 
-const root = NodePath.resolve(import.meta.dirname, "..");
+const GiB = 1024 ** 3;
+
+// A typecheck or test step can take several cores and gigabytes of memory, so
+// allow one step per two cores and per 6 GiB of available memory.
+export const defaultConcurrency = (cores: number, availableBytes: number) =>
+  Math.max(1, Math.min(Math.floor(cores / 2), Math.floor(availableBytes / (6 * GiB))));
+
+export type Outcome = "pass" | "FAIL" | "TIMEOUT";
+
+export interface Step<R> {
+  readonly name: string;
+  readonly run: Effect.Effect<{ readonly ok: boolean; readonly output: string }, never, R>;
+  // Budget slots the step holds: one per worker it runs in parallel.
+  readonly weight?: number;
+  // Vitest runs started together race to rebuild node_modules/.vitest-cache (ENOTEMPTY).
+  readonly serial?: boolean;
+}
+
+// Interrupting a step at its timeout closes the scopes of the processes it
+// spawned, which kills each one's process group.
+export const runSteps = Effect.fn("checkChanged.runSteps")(function* <R>(
+  steps: ReadonlyArray<Step<R>>,
+  options: { readonly concurrency: number; readonly timeoutSeconds: number },
+) {
+  const budget = yield* Semaphore.make(options.concurrency);
+  // Steps claim budget one at a time, in order: Semaphore lets a light request
+  // take free slots ahead of a waiting heavier one, which would delay typecheck.
+  const admission = yield* Semaphore.make(1);
+  const serial = yield* Semaphore.make(1);
+  return yield* Effect.forEach(
+    steps,
+    (step) => {
+      const timed = Effect.gen(function* () {
+        const started = yield* Clock.currentTimeMillis;
+        const result = yield* Effect.timeoutOption(step.run, `${options.timeoutSeconds} seconds`);
+        const seconds = ((yield* Clock.currentTimeMillis) - started) / 1000;
+        const outcome: Outcome = Option.match(result, {
+          onNone: () => "TIMEOUT",
+          onSome: ({ ok }) => (ok ? "pass" : "FAIL"),
+        });
+        const time =
+          outcome === "TIMEOUT"
+            ? `killed after ${options.timeoutSeconds}s`
+            : `${seconds.toFixed(1)}s`;
+        yield* Console.log(`\n> vp ${step.name}  ${outcome}  ${time}`);
+        const output = Option.getOrUndefined(result)?.output.trimEnd();
+        if (output) yield* Console.log(output);
+        return { name: step.name, outcome, time };
+      });
+      const slots = Math.min(step.weight ?? 1, options.concurrency);
+      const limited = Effect.acquireUseRelease(
+        admission.withPermit(budget.take(slots)),
+        () => timed,
+        () => budget.release(slots),
+      );
+      return step.serial ? serial.withPermit(limited) : limited;
+    },
+    { concurrency: "unbounded" },
+  );
+});
+
+const CacheEntry = Schema.fromJsonString(
+  Schema.Struct({ key: Schema.String, summary: Schema.Array(Schema.String) }),
+);
+const decodeCacheEntry = Schema.decodeEffect(CacheEntry);
+const encodeCacheEntry = Schema.encodeEffect(CacheEntry);
+const decodeRootPackageJson = Schema.decodeEffect(
+  Schema.fromJsonString(Schema.Struct({ scripts: Schema.Struct({ "knip:check": Schema.String }) })),
+);
+
+const collectBytes = (stream: Stream.Stream<Uint8Array, PlatformError.PlatformError>) =>
+  Stream.runCollect(stream).pipe(Effect.map((chunks) => Buffer.concat(chunks)));
+
+// Fails on a nonzero exit: an empty file list from a broken index would
+// otherwise pass as "no changes". quotePath=false keeps non-ASCII paths as real
+// paths instead of quoted escapes.
+export const git = Effect.fn("checkChanged.git")(function* (
+  cwd: string,
+  args: ReadonlyArray<string>,
+) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const handle = yield* spawner.spawn(
+        ChildProcess.make("git", ["-c", "core.quotePath=false", ...args], { cwd }),
+      );
+      const [stdout, stderr, exitCode] = yield* Effect.all(
+        [collectBytes(handle.stdout), collectBytes(handle.stderr), handle.exitCode],
+        { concurrency: "unbounded" },
+      );
+      if (exitCode !== 0) {
+        return yield* Effect.fail(
+          `check:changed: git ${args.join(" ")} exited with ${exitCode}: ${stderr.toString().trim()}`,
+        );
+      }
+      return stdout;
+    }),
+  );
+});
+export const gitLines = (cwd: string, args: ReadonlyArray<string>) =>
+  git(cwd, args).pipe(Effect.map((stdout) => stdout.toString().split("\n").filter(Boolean)));
+
 const CODE = /\.[cm]?[jt]sx?$/;
+const TEST = /\.test\.[cm]?[jt]sx?$/;
+const escapeRegExp = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
-// quotePath=false keeps non-ASCII paths as real paths instead of quoted escapes.
-const git = (...args: Array<string>) =>
-  NodeChildProcess.execFileSync("git", ["-c", "core.quotePath=false", ...args], {
-    cwd: root,
-    encoding: "utf8",
-    maxBuffer: 64 * 1024 * 1024,
-  })
-    .split("\n")
-    .filter(Boolean);
-
-const ref = process.argv[2] ?? "origin/main";
-const mergeBase = NodeChildProcess.spawnSync("git", ["merge-base", "HEAD", ref], {
-  cwd: root,
-  encoding: "utf8",
+// A flag wins over its environment variable; either must be a positive integer.
+const override = Effect.fn("checkChanged.override")(function* (
+  flagName: string,
+  flag: Option.Option<number>,
+  envName: string,
+) {
+  const [name, value] = Option.isSome(flag)
+    ? [`--${flagName}`, flag]
+    : [envName, yield* Config.option(Config.Int(envName))];
+  if (Option.isSome(value) && value.value < 1) {
+    return yield* Effect.fail(`check:changed: ${name} must be a positive integer.`);
+  }
+  return value;
 });
-if (mergeBase.status !== 0) {
-  console.error(
-    `check:changed: no merge base with ${ref}. Run \`git fetch origin\` or pass a ref.`,
+
+const checkChanged = Effect.fn("checkChanged")(function* (input: {
+  readonly ref: string;
+  readonly concurrency: Option.Option<number>;
+  readonly timeout: Option.Option<number>;
+}) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const root = yield* path.fromFileUrl(new URL("..", import.meta.url));
+  const inRoot = (file: string) => path.join(root, file);
+
+  // macOS counts its file cache as used, so available memory there would
+  // starve a large Mac. Elsewhere availableMemory() honors a cgroup limit.
+  const platform = yield* HostProcess.Platform;
+  const concurrency = Option.getOrElse(
+    yield* override("concurrency", input.concurrency, "CHECK_CHANGED_CONCURRENCY"),
+    () =>
+      defaultConcurrency(
+        NodeOS.availableParallelism(),
+        platform === "darwin" ? NodeOS.totalmem() : process.availableMemory(),
+      ),
   );
-  process.exit(1);
-}
-const base = mergeBase.stdout.trim();
-// --no-renames lists a rename as its old and new path, as CI does.
-const untracked = git("ls-files", "--others", "--exclude-standard");
-const files = [
-  ...new Set([...git("diff", "--name-only", "--no-renames", base, "--"), ...untracked]),
-].sort();
-
-if (files.length === 0) {
-  console.log(`check:changed: no changes since ${base.slice(0, 12)}.`);
-  process.exit(0);
-}
-console.log(`check:changed: ${files.length} files since ${base.slice(0, 12)}`);
-
-// Ignored generated sources, declarations, env files, and install state affect check results.
-// Include them in the key, but skip large ignored folders that no check reads.
-// Recompute after a passing run so edits made during it are never cached as passing.
-const inputKey = () => {
-  const hash = NodeCrypto.createHash("sha256");
-  // CI changes test behavior (vite.config.ts rejects .only under CI).
-  hash.update(`${process.version}\0${base}\0${process.env.CI ?? ""}\0`);
-  hash.update(
-    NodeChildProcess.execFileSync(
-      "git",
-      ["diff", "--binary", "--no-renames", "--no-ext-diff", "--no-textconv", base, "--"],
-      { cwd: root, maxBuffer: 1024 * 1024 * 1024 },
-    ),
+  const timeoutSeconds = Option.getOrElse(
+    yield* override("timeout", input.timeout, "CHECK_CHANGED_TIMEOUT"),
+    () => 900,
   );
-  const ignored = git(
-    "ls-files",
-    "--others",
-    "--ignored",
-    "--exclude-standard",
-    "--",
-    ":(glob)**/.generated/**",
-    ":(glob)**/.astro/**",
-    ":(glob)**/*.d.ts",
-    ":(glob)**/.env*",
-    ":(exclude,glob)**/node_modules/**",
+
+  const lines = (...args: Array<string>) => gitLines(root, args);
+
+  const base = yield* git(root, ["merge-base", "HEAD", input.ref]).pipe(
+    Effect.map((stdout) => stdout.toString().trim()),
+    Effect.mapError(
+      () =>
+        `check:changed: no merge base with ${input.ref}. Run \`git fetch origin\` or pass a ref.`,
+    ),
   );
-  for (const file of [
-    // Raw bytes of changed files too: .gitattributes normalizes line endings in
-    // the diff, but the formatter reads the file as it is on disk.
-    ...git("diff", "--name-only", "--no-renames", base, "--"),
-    ...git("ls-files", "--others", "--exclude-standard"),
-    ...ignored,
-    "node_modules/.modules.yaml",
-    "node_modules/.pnpm/lock.yaml",
-  ]) {
-    hash.update(`\0${file}\0`);
-    const path = NodePath.join(root, file);
-    // Untracked nested repositories are listed as directories.
-    if (NodeFS.statSync(path, { throwIfNoEntry: false })?.isFile()) {
-      hash.update(NodeFS.readFileSync(path));
-    }
+  // --no-renames lists a rename as its old and new path, as CI does.
+  const changedFiles = lines("diff", "--name-only", "--no-renames", base, "--");
+  const untrackedFiles = lines("ls-files", "--others", "--exclude-standard");
+  const files = [...new Set([...(yield* changedFiles), ...(yield* untrackedFiles)])].sort();
+
+  if (files.length === 0) {
+    yield* Console.log(`check:changed: no changes since ${base.slice(0, 12)}.`);
+    return true;
   }
-  return hash.digest("hex");
-};
-const key = inputKey();
-const cachePath = NodePath.join(root, "node_modules/.cache/check-changed.json");
-// A missing or unreadable cache is a miss, never a failure.
-const readCache = () => {
-  try {
-    return JSON.parse(NodeFS.readFileSync(cachePath, "utf8")) as {
-      key: string;
-      summary: Array<string>;
-    };
-  } catch {
-    return undefined;
+  yield* Console.log(`check:changed: ${files.length} files since ${base.slice(0, 12)}`);
+
+  // Ignored generated sources, declarations, env files, and install state affect check results.
+  // Include them in the key, but skip large ignored folders that no check reads.
+  // Recompute after a passing run so edits made during it are never cached as passing.
+  const ci = Option.getOrElse(yield* Config.option(Config.String("CI")), () => "");
+  const inputKey = Effect.gen(function* () {
+    const hash = NodeCrypto.createHash("sha256");
+    // CI changes test behavior (vite.config.ts rejects .only under CI).
+    hash.update(`${process.version}\0${base}\0${ci}\0`);
+    hash.update(
+      yield* git(root, [
+        "diff",
+        "--binary",
+        "--no-renames",
+        "--no-ext-diff",
+        "--no-textconv",
+        base,
+        "--",
+      ]),
+    );
+    const ignored = yield* lines(
+      "ls-files",
+      "--others",
+      "--ignored",
+      "--exclude-standard",
+      "--",
+      ":(glob)**/.generated/**",
+      ":(glob)**/.astro/**",
+      ":(glob)**/*.d.ts",
+      ":(glob)**/.env*",
+      ":(exclude,glob)**/node_modules/**",
+    );
+    for (const file of [
+      // Raw bytes of changed files too: .gitattributes normalizes line endings in
+      // the diff, but the formatter reads the file as it is on disk.
+      ...(yield* changedFiles),
+      ...(yield* untrackedFiles),
+      ...ignored,
+      "node_modules/.modules.yaml",
+      "node_modules/.pnpm/lock.yaml",
+    ]) {
+      hash.update(`\0${file}\0`);
+      // Untracked nested repositories are listed as directories.
+      const info = yield* Effect.option(fs.stat(inRoot(file)));
+      if (Option.isSome(info) && info.value.type === "File") {
+        hash.update(yield* fs.readFile(inRoot(file)));
+      }
+    }
+    return hash.digest("hex");
+  });
+  const key = yield* inputKey;
+  const cachePath = inRoot("node_modules/.cache/check-changed.json");
+  // A missing or unreadable cache is a miss, never a failure.
+  const cached = yield* fs
+    .readFileString(cachePath)
+    .pipe(Effect.flatMap(decodeCacheEntry), Effect.option);
+  if (Option.isSome(cached) && cached.value.key === key) {
+    yield* Console.log("Nothing changed since the last passing run.\n");
+    for (const line of cached.value.summary) yield* Console.log(line);
+    return true;
   }
-};
-const cached = readCache();
-if (cached?.key === key) {
-  console.log("Nothing changed since the last passing run.\n");
-  for (const line of cached.summary) console.log(line);
-  process.exit(0);
-}
 
-const present = files.filter((file) => NodeFS.existsSync(NodePath.join(root, file)));
-const code = present.filter((file) => CODE.test(file));
-const packages = readWorkspace();
-const { affected, outputs } = decide(files, packages, false);
+  const present = yield* Effect.filter(files, (file) => fs.exists(inRoot(file)));
+  const code = present.filter((file) => CODE.test(file));
+  const packages = readWorkspace();
+  const { affected, outputs } = decide(files, packages, false);
 
-// Changed test files, and the test files beside a changed source file
-// (foo.ts -> foo.test.ts, foo.browser.test.tsx). Vitest's import-graph
-// `related` reaches most of a package: one leaf server file pulled in 252 of
-// 406 server test files and took 7 minutes. CI runs the rest.
-const TEST = /\.test\.[cm]?[jt]sx?$/;
-const tests = new Set(code.filter((file) => TEST.test(file)));
-for (const file of code) {
-  const dir = NodePath.dirname(file);
-  const prefix = `${NodePath.basename(file).replace(CODE, "")}.`;
-  for (const entry of NodeFS.readdirSync(NodePath.join(root, dir))) {
-    if (entry.startsWith(prefix) && TEST.test(entry)) tests.add(NodePath.join(dir, entry));
+  // Changed test files, and the test files beside a changed source file
+  // (foo.ts -> foo.test.ts, foo.browser.test.tsx). Vitest's import-graph
+  // `related` reaches most of a package: one leaf server file pulled in 252 of
+  // 406 server test files and took 7 minutes. CI runs the rest.
+  const tests = new Set(code.filter((file) => TEST.test(file)));
+  for (const file of code) {
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file).replace(CODE, "")}.`;
+    for (const entry of yield* fs.readDirectory(inRoot(dir))) {
+      if (entry.startsWith(prefix) && TEST.test(entry)) tests.add(path.join(dir, entry));
+    }
   }
-}
-// It reads files other than the ones beside it, so no changed file selects it.
-if (affected.includes("t3")) tests.add("apps/server/src/provider/AgentContextBudget.test.ts");
+  // It reads files other than the ones beside it, so no changed file selects it.
+  if (affected.includes("t3")) tests.add("apps/server/src/provider/AgentContextBudget.test.ts");
 
-// React Compiler coverage compiles every client source file, so run only the
-// changed files' cases, in one extra step: a -t filter in the main test step
-// would drop every other test. An app is skipped when the main step already
-// runs its coverage file unfiltered. File filters mirror each coverage test.
-const escapeRegExp = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-const compilerApps = [
-  {
-    test: "apps/web/src/reactCompilerCoverage.test.ts",
-    root: "apps/web/src/",
-    // Test names keep the repo-relative path.
-    name: (file: string) => file,
-    compiled: (file: string) =>
-      /\.tsx?$/.test(file) && !/\.(test|browser)\.tsx?$/.test(file) && !file.endsWith(".gen.ts"),
-    // Web has only per-file cases.
-    always: [],
-  },
-  {
-    test: "apps/mobile/src/reactCompilerCoverage.test.ts",
-    root: "apps/mobile/src/",
-    name: (file: string) => file.slice("apps/mobile/".length),
-    compiled: (file: string) => /\.tsx?$/.test(file) && !/\.(test\.tsx?|d\.ts)$/.test(file),
-    // The Metro, cache, and stale-allowlist cases check more than one file, deletions included.
-    always: ["^(?!.*compiles )"],
-  },
-].flatMap(({ test, root: appRoot, name, compiled, always }) => {
-  const changed = files.filter((file) => file.startsWith(appRoot) && compiled(file));
-  if (changed.length === 0 || tests.has(test)) return [];
-  const names = changed
-    .filter((file) => present.includes(file))
-    .map((file) => `compiles ${escapeRegExp(name(file))}$`);
-  const pattern = [...names, ...always];
-  return pattern.length > 0 ? [{ test, names, pattern }] : [];
-});
-const compilerCoverage = compilerApps.length > 0 && {
-  name: `react compiler (${compilerApps.reduce((count, app) => count + app.names.length, 0)} files)`,
-  args: [
-    "test",
-    "run",
-    ...compilerApps.map((app) => app.test),
-    "-t",
-    compilerApps.flatMap((app) => app.pattern).join("|"),
-  ],
-};
-
-// knip:check cannot be scoped to a package. Any code change can leave a file,
-// export, or dependency unused (removing the last import of a helper does), so
-// it runs whenever code or a manifest changes.
-const runKnip = files.some(
-  (file) => CODE.test(file) || NodePath.basename(file) === "package.json" || file === "knip.jsonc",
-);
-// CI runs knip:check as one script of `knip ... && knip ...` passes. The passes
-// do not depend on each other, so they run side by side here.
-const knipCheck: string = JSON.parse(
-  NodeFS.readFileSync(NodePath.join(root, "package.json"), "utf8"),
-).scripts["knip:check"];
-const knipPasses = knipCheck.split(" && ").map((command, index, all) => {
-  const [bin, ...args] = command.trim().split(/\s+/);
-  if (bin !== "knip" || /["'$\\|;&<>]/.test(command)) {
-    throw new Error(`check:changed cannot split knip:check: ${command}`);
+  // React Compiler coverage compiles every client source file, so run only the
+  // changed files' cases, in one extra step: a -t filter in the main test step
+  // would drop every other test. An app is skipped when the main step already
+  // runs its coverage file unfiltered. File filters mirror each coverage test.
+  const compilerApps = [
+    {
+      test: "apps/web/src/reactCompilerCoverage.test.ts",
+      root: "apps/web/src/",
+      // Test names keep the repo-relative path.
+      name: (file: string) => file,
+      compiled: (file: string) =>
+        /\.tsx?$/.test(file) && !/\.(test|browser)\.tsx?$/.test(file) && !file.endsWith(".gen.ts"),
+      // Web has only per-file cases.
+      always: [],
+    },
+    {
+      test: "apps/mobile/src/reactCompilerCoverage.test.ts",
+      root: "apps/mobile/src/",
+      name: (file: string) => file.slice("apps/mobile/".length),
+      compiled: (file: string) => /\.tsx?$/.test(file) && !/\.(test\.tsx?|d\.ts)$/.test(file),
+      // The Metro, cache, and stale-allowlist cases check more than one file, deletions included.
+      always: ["^(?!.*compiles )"],
+    },
+  ].flatMap(({ test, root: appRoot, name, compiled, always }) => {
+    const changed = files.filter((file) => file.startsWith(appRoot) && compiled(file));
+    if (changed.length === 0 || tests.has(test)) return [];
+    const names = changed
+      .filter((file) => present.includes(file))
+      .map((file) => `compiles ${escapeRegExp(name(file))}$`);
+    const pattern = [...names, ...always];
+    return pattern.length > 0 ? [{ test, names, pattern }] : [];
+  });
+
+  // knip:check cannot be scoped to a package. Any code change can leave a file,
+  // export, or dependency unused (removing the last import of a helper does), so
+  // it runs whenever code or a manifest changes.
+  const runKnip = files.some(
+    (file) => CODE.test(file) || path.basename(file) === "package.json" || file === "knip.jsonc",
+  );
+  // CI runs knip:check as one script of `knip ... && knip ...` passes. The passes
+  // do not depend on each other, so they run side by side here.
+  const rootPackage = yield* fs
+    .readFileString(inRoot("package.json"))
+    .pipe(Effect.flatMap(decodeRootPackageJson), Effect.orDie);
+  const knipCheck = rootPackage.scripts["knip:check"];
+  const knipPasses: Array<Array<string>> = [];
+  for (const command of knipCheck.split(" && ")) {
+    const [bin, ...args] = command.trim().split(/\s+/);
+    if (bin !== "knip" || /["'$\\|;&<>]/.test(command)) {
+      return yield* Effect.fail(`check:changed cannot split knip:check: ${command}`);
+    }
+    knipPasses.push(["exec", "knip", ...args]);
   }
-  return { name: `knip ${index + 1}/${all.length}`, args: ["exec", "knip", ...args] };
-});
 
-// A version bump can leave a patch unused, causing pnpm to reject the install
-// with ERR_PNPM_UNUSED_PATCH. Check it here as Release Smoke does in CI.
-const runPatchCheck = files.some(
-  (file) =>
-    file === "pnpm-workspace.yaml" ||
-    file === "pnpm-lock.yaml" ||
-    file === ".pnpmfile.cjs" ||
-    file.startsWith("patches/") ||
-    file.startsWith("apps/mobile/deps/") ||
-    NodePath.basename(file) === "package.json",
-);
+  // A version bump can leave a patch unused, causing pnpm to reject the install
+  // with ERR_PNPM_UNUSED_PATCH. Check it here as Release Smoke does in CI.
+  const runPatchCheck = files.some(
+    (file) =>
+      file === "pnpm-workspace.yaml" ||
+      file === "pnpm-lock.yaml" ||
+      file === ".pnpmfile.cjs" ||
+      file.startsWith("patches/") ||
+      file.startsWith("apps/mobile/deps/") ||
+      path.basename(file) === "package.json",
+  );
+
+  // Output is piped, so keep the colors a terminal would get.
+  const env = process.stdout.isTTY ? { FORCE_COLOR: "1" } : {};
+  const vp = (args: ReadonlyArray<string>, cwd = root) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const handle = yield* spawner.spawn(
+          ChildProcess.make("vp", args, { cwd, env, extendEnv: true, forceKillAfter: "5 seconds" }),
+        );
+        const [output, exitCode] = yield* Effect.all(
+          [Stream.mkString(Stream.decodeText(handle.all)), handle.exitCode],
+          { concurrency: 2 },
+        );
+        return { ok: exitCode === 0, output };
+      }),
+    ).pipe(Effect.catch((error) => Effect.succeed({ ok: false, output: error.message })));
 
-// Resolve without the lockfile in a temp copy to preserve the working tree and lockfile.
-// Copy mobile modules too: they are file: dependencies, not workspace packages.
-// Cached registry metadata limits this to patches stranded by local changes, not registry drift.
-const checkPatches = (): boolean => {
-  const temp = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-patch-check-"));
-  try {
-    const copy = (relative: string) => {
-      const dest = NodePath.join(temp, relative);
-      NodeFS.mkdirSync(NodePath.dirname(dest), { recursive: true });
-      NodeFS.cpSync(NodePath.join(root, relative), dest, { recursive: true });
-    };
-    copy("package.json");
-    copy("pnpm-workspace.yaml");
-    for (const pkg of packages) copy(`${pkg.dir}/package.json`);
-    const modulesDir = NodePath.join(root, "apps/mobile/modules");
-    if (NodeFS.existsSync(modulesDir)) {
-      for (const entry of NodeFS.readdirSync(modulesDir)) {
-        const manifest = `apps/mobile/modules/${entry}/package.json`;
-        if (NodeFS.existsSync(NodePath.join(root, manifest))) copy(manifest);
+  // Resolve without the lockfile in a temp copy to preserve the working tree and lockfile.
+  // Copy mobile modules too: they are file: dependencies, not workspace packages.
+  // Cached registry metadata limits this to patches stranded by local changes, not registry drift.
+  const checkPatches = Effect.scoped(
+    Effect.gen(function* () {
+      const temp = yield* fs.makeTempDirectoryScoped({ prefix: "t3-patch-check-" });
+      const copy = Effect.fnUntraced(function* (relative: string) {
+        const dest = path.join(temp, relative);
+        yield* fs.makeDirectory(path.dirname(dest), { recursive: true });
+        yield* fs.copy(inRoot(relative), dest);
+      });
+      yield* copy("package.json");
+      yield* copy("pnpm-workspace.yaml");
+      for (const pkg of packages) yield* copy(`${pkg.dir}/package.json`);
+      const modulesDir = "apps/mobile/modules";
+      if (yield* fs.exists(inRoot(modulesDir))) {
+        for (const entry of yield* fs.readDirectory(inRoot(modulesDir))) {
+          const manifest = `${modulesDir}/${entry}/package.json`;
+          if (yield* fs.exists(inRoot(manifest))) yield* copy(manifest);
+        }
       }
-    }
-    for (const extra of ["apps/mobile/deps", "patches", ".pnpmfile.cjs"]) {
-      if (NodeFS.existsSync(NodePath.join(root, extra))) copy(extra);
-    }
-    const { status, stdout, stderr, error } = NodeChildProcess.spawnSync(
-      "vp",
-      ["install", "--lockfile-only", "--ignore-scripts"],
-      { cwd: temp, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },
-    );
-    if (status === 0) return true;
-    if (stdout) console.log(stdout);
-    if (stderr) console.error(stderr);
-    if (error) console.error(error.message);
-    if (`${stdout ?? ""}${stderr ?? ""}`.includes("ERR_PNPM_UNUSED_PATCH")) {
-      console.error(
-        "Unused dependency patches: remove each patch named above from " +
+      for (const extra of ["apps/mobile/deps", "patches", ".pnpmfile.cjs"]) {
+        if (yield* fs.exists(inRoot(extra))) yield* copy(extra);
+      }
+      const result = yield* vp(["install", "--lockfile-only", "--ignore-scripts"], temp);
+      if (result.ok || !result.output.includes("ERR_PNPM_UNUSED_PATCH")) return result;
+      return {
+        ok: false,
+        output:
+          `${result.output}\nUnused dependency patches: remove each patch named above from ` +
           "patchedDependencies in pnpm-workspace.yaml and from patches/, " +
           "update it to the version the install resolves, " +
           "or pin the dependency that pulls it in to the patched version.",
-      );
-    }
-    return false;
-  } finally {
-    NodeFS.rmSync(temp, { recursive: true, force: true });
-  }
-};
+      };
+    }),
+  ).pipe(Effect.catch((error) => Effect.succeed({ ok: false, output: error.message })));
 
-// CI's Lint job checks that generated GraphQL operations match their sources.
-const graphql = ["apps/server", "packages/source-control-github"].filter((dir) =>
-  files.some((file) => file.startsWith(`${dir}/`)),
-);
+  // CI's Lint job checks that generated GraphQL operations match their sources.
+  const graphql = ["apps/server", "packages/source-control-github"].filter((dir) =>
+    files.some((file) => file.startsWith(`${dir}/`)),
+  );
+  const filters = (names: ReadonlyArray<string>) => names.flatMap((name) => ["--filter", name]);
+  const typecheckWorkers = Math.min(concurrency, affected.length);
+  const command = (name: string, args: ReadonlyArray<string>) => ({ name, run: vp(args) });
+  const compilerFiles = compilerApps.reduce((count, app) => count + app.names.length, 0);
 
-const filters = (names: ReadonlyArray<string>) => names.flatMap((name) => ["--filter", name]);
-const steps = [
-  // Runs first; it takes about a second.
-  runPatchCheck && { name: "unused patches", run: checkPatches },
-  present.length > 0 && {
-    name: "format",
-    args: ["fmt", "--check", "--no-error-on-unmatched-pattern", ...present],
-  },
-  code.length > 0 && { name: "lint", args: ["lint", ...code] },
-  ...(runKnip ? knipPasses : []),
-  ...graphql.map((dir) => ({
-    name: `graphql (${dir})`,
-    args: ["run", "--filter", `./${dir}`, "generate", "--check"],
-  })),
-  affected.length > 0 && {
-    name: `typecheck (${affected.length} packages)`,
-    // `tsc --noEmit` writes nothing another package reads, so dependency order
-    // only made dependents wait: --parallel cut a contracts change from 13 s to 9 s.
-    args: [
-      "run",
-      "--cache",
-      "--parallel",
-      "--concurrency-limit",
-      "4",
-      ...filters(affected),
-      "typecheck",
-    ],
-  },
-  // From the repo root, the root vite.config.ts hands each file to its package's config.
-  tests.size > 0 && {
-    name: `test (${tests.size} files)`,
-    args: ["test", "run", "--passWithNoTests", ...tests],
-  },
-  compilerCoverage,
-].filter((step) => step !== false);
-
-// Output is piped, so keep the colors a terminal would get.
-const env = process.stdout.isTTY ? { ...process.env, FORCE_COLOR: "1" } : process.env;
-const runStep = (step: (typeof steps)[number]) =>
-  new Promise<{ name: string; ok: boolean; seconds: string }>((resolve) => {
-    const started = performance.now();
-    const finish = (ok: boolean, output?: Buffer) => {
-      const seconds = ((performance.now() - started) / 1000).toFixed(1);
-      console.log(`\n> vp ${step.name}  ${ok ? "pass" : "FAIL"}  ${seconds}s`);
-      if (output) process.stdout.write(output);
-      resolve({ name: step.name, ok, seconds });
-    };
-    // In-process steps print their own output. The patch check is first and
-    // takes about a second, so the commands start right after it.
-    if ("run" in step) return finish(step.run());
-    const output: Array<Buffer> = [];
-    const child = NodeChildProcess.spawn("vp", step.args, { cwd: root, env });
-    child.stdout.on("data", (chunk: Buffer) => output.push(chunk));
-    child.stderr.on("data", (chunk: Buffer) => output.push(chunk));
-    // A failed spawn emits "error", then "close" with a nonzero code.
-    child.on("error", (error) => output.push(Buffer.from(`${error.message}\n`)));
-    child.on("close", (status) => finish(status === 0, Buffer.concat(output)));
-  });
+  const steps: Array<Step<never>> = [
+    ...(runPatchCheck ? [{ name: "unused patches", run: checkPatches }] : []),
+    ...(present.length > 0
+      ? [command("format", ["fmt", "--check", "--no-error-on-unmatched-pattern", ...present])]
+      : []),
+    ...(code.length > 0 ? [command("lint", ["lint", ...code])] : []),
+    ...(runKnip
+      ? knipPasses.map((args, index) => command(`knip ${index + 1}/${knipPasses.length}`, args))
+      : []),
+    ...graphql.map((dir) =>
+      command(`graphql (${dir})`, ["run", "--filter", `./${dir}`, "generate", "--check"]),
+    ),
+    ...(affected.length > 0
+      ? [
+          {
+            // `tsc --noEmit` writes nothing another package reads, so dependency order
+            // only made dependents wait: --parallel cut a contracts change from 13 s to 9 s.
+            ...command(`typecheck (${affected.length} packages)`, [
+              "run",
+              "--cache",
+              "--parallel",
+              "--concurrency-limit",
+              String(typecheckWorkers),
+              ...filters(affected),
+              "typecheck",
+            ]),
+            weight: typecheckWorkers,
+          },
+        ]
+      : []),
+    // From the repo root, the root vite.config.ts hands each file to its package's config.
+    ...(tests.size > 0
+      ? [
+          {
+            ...command(`test (${tests.size} files)`, [
+              "test",
+              "run",
+              "--passWithNoTests",
+              ...tests,
+            ]),
+            serial: true,
+          },
+        ]
+      : []),
+    ...(compilerApps.length > 0
+      ? [
+          {
+            ...command(`react compiler (${compilerFiles} files)`, [
+              "test",
+              "run",
+              ...compilerApps.map((app) => app.test),
+              "-t",
+              compilerApps.flatMap((app) => app.pattern).join("|"),
+            ]),
+            serial: true,
+          },
+        ]
+      : []),
+  ];
 
-// Vitest runs started together race to rebuild node_modules/.vitest-cache after
-// an install (ENOTEMPTY), so they run one after another.
-let previousVitest: Promise<unknown> = Promise.resolve();
-const results = await Promise.all(
-  steps.map((step) => {
-    if (!("args" in step) || step.args[0] !== "test") return runStep(step);
-    const result = previousVitest.then(() => runStep(step));
-    previousVitest = result;
-    return result;
-  }),
-);
+  const results = yield* runSteps(steps, { concurrency, timeoutSeconds });
 
-const summary = ["check:changed summary"];
-for (const result of results) {
-  summary.push(`  ${result.ok ? "pass" : "FAIL"}  ${result.name}  ${result.seconds}s`);
-}
-const ciOnly = Object.entries({
-  "full test suites": outputs.test || outputs.test_web || outputs.test_server,
-  build: outputs.build,
-  rust: outputs.rust,
-  "mobile native lint": outputs.mobile_native,
-  "release smoke": outputs.release_smoke,
-}).flatMap(([job, runs]) => (runs ? [job] : []));
-if (ciOnly.length > 0) summary.push(`  CI also runs: ${ciOnly.join(", ")}`);
-if (!runPatchCheck) summary.push("  unused patch check skipped: no dependency files changed");
-if (!runKnip) summary.push("  knip skipped: no code or manifest changed");
-console.log(`\n${summary.join("\n")}`);
-// exitCode, not exit(): piped stdout is asynchronous on macOS, and exit()
-// would cut off a failing step's output.
-if (results.some((result) => !result.ok)) {
-  process.exitCode = 1;
-} else if (inputKey() !== key) {
-  console.log("  pass not cached: files changed during the run");
-} else {
-  try {
-    // Write then rename, so a concurrent run never reads half a file.
-    const temp = `${cachePath}.${process.pid}`;
-    NodeFS.mkdirSync(NodePath.dirname(cachePath), { recursive: true });
-    NodeFS.writeFileSync(temp, JSON.stringify({ key, summary }));
-    NodeFS.renameSync(temp, cachePath);
-  } catch (error) {
-    console.warn(`  pass not cached: ${error instanceof Error ? error.message : String(error)}`);
+  const summary = ["check:changed summary"];
+  for (const result of results) {
+    summary.push(`  ${result.outcome}  ${result.name}  ${result.time}`);
+  }
+  if (results.some((result) => result.outcome === "TIMEOUT")) {
+    summary.push(
+      `  TIMEOUT: ran past ${timeoutSeconds}s and was killed; this is not a check failure. ` +
+        "Raise --timeout or lower --concurrency.",
+    );
+  }
+  const ciOnly = Object.entries({
+    "full test suites": outputs.test || outputs.test_web || outputs.test_server,
+    build: outputs.build,
+    rust: outputs.rust,
+    "mobile native lint": outputs.mobile_native,
+    "release smoke": outputs.release_smoke,
+  }).flatMap(([job, runs]) => (runs ? [job] : []));
+  if (ciOnly.length > 0) summary.push(`  CI also runs: ${ciOnly.join(", ")}`);
+  if (!runPatchCheck) summary.push("  unused patch check skipped: no dependency files changed");
+  if (!runKnip) summary.push("  knip skipped: no code or manifest changed");
+  yield* Console.log(`\n${summary.join("\n")}`);
+
+  if (results.some((result) => result.outcome !== "pass")) return false;
+  if ((yield* inputKey) !== key) {
+    yield* Console.log("  pass not cached: files changed during the run");
+    return true;
   }
+  // Write then rename, so a concurrent run never reads half a file.
+  const temp = `${cachePath}.${process.pid}`;
+  yield* Effect.gen(function* () {
+    yield* fs.makeDirectory(path.dirname(cachePath), { recursive: true });
+    yield* fs.writeFileString(temp, yield* encodeCacheEntry({ key, summary }));
+    yield* fs.rename(temp, cachePath);
+  }).pipe(Effect.catch((error) => Console.warn(`  pass not cached: ${error.message}`)));
+  return true;
+});
+
+export const checkChangedCommand = Command.make(
+  "check-changed",
+  {
+    ref: Argument.String("ref").pipe(
+      Argument.withDescription("Compare against the merge base with this ref."),
+      Argument.withDefault("origin/main"),
+    ),
+    concurrency: Flag.Int("concurrency").pipe(
+      Flag.withDescription(
+        "Budget of parallel steps and typecheck workers; also CHECK_CHANGED_CONCURRENCY. Defaults to one per two cores and per 6 GiB of available memory.",
+      ),
+      Flag.optional,
+    ),
+    timeout: Flag.Int("timeout").pipe(
+      Flag.withDescription(
+        "Seconds before a step is killed; also CHECK_CHANGED_TIMEOUT. Defaults to 900.",
+      ),
+      Flag.optional,
+    ),
+  },
+  (input) =>
+    checkChanged(input).pipe(
+      Effect.catch((message) => Console.error(message).pipe(Effect.as(false))),
+      // exitCode, not a failed exit: runMain calls process.exit() on failure, and
+      // piped stdout is asynchronous on macOS, so it would cut off step output.
+      Effect.flatMap((ok) =>
+        Effect.sync(() => {
+          if (!ok) process.exitCode = 1;
+        }),
+      ),
+    ),
+).pipe(Command.withDescription("Run CI's fast checks for this branch's changes."));
+
+if (import.meta.main) {
+  Command.run(checkChangedCommand, { version: "0.0.0" }).pipe(
+    Effect.provide(NodeServices.layer),
+    NodeRuntime.runMain,
+  );
 }

From c8a606c7b73e1e3586d5c06f76c69525f2d4c679 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Fri, 30 Oct 2026 02:36:46 +0000
Subject: [PATCH 122/146] fix(shared): durations under 10s drop a trailing .0
 (#27316)

---
 apps/mobile/src/lib/threadActivity.test.ts           | 12 ++++++------
 apps/server/src/cli/trace.ts                         |  4 ++--
 .../components/chat/MessagesTimeline.logic.test.ts   | 12 ++++++------
 .../chat/WorktreeSetupCard.browser.test.tsx          | 10 +++++-----
 .../src/components/settings/DiagnosticsSettings.tsx  |  8 ++++----
 .../settings/ResourceTelemetryDiagnostics.tsx        | 12 ++++++------
 packages/shared/src/orchestrationTiming.ts           |  5 +----
 7 files changed, 30 insertions(+), 33 deletions(-)

diff --git a/apps/mobile/src/lib/threadActivity.test.ts b/apps/mobile/src/lib/threadActivity.test.ts
index 96626a5caefab..409631131c058 100644
--- a/apps/mobile/src/lib/threadActivity.test.ts
+++ b/apps/mobile/src/lib/threadActivity.test.ts
@@ -846,7 +846,7 @@ describe("buildThreadFeed", () => {
     expect(collapsed[1]).toMatchObject({
       type: "run-fold",
       createdAt: "2026-06-20T00:00:01.500Z",
-      label: "Worked for 2.0s",
+      label: "Worked for 2s",
     });
 
     const expanded = deriveThreadFeedPresentation(feed, latestRun, new Set([runId]));
@@ -1100,10 +1100,10 @@ describe("buildThreadFeed", () => {
     const settled = deriveThreadFeedPresentation(feed(false), null, new Set());
     expect(shape(settled)).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:launch-answer",
       "user:resume",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:resume-answer",
     ]);
     const launchFold = settled.find((entry) => entry.type === "run-fold");
@@ -1112,11 +1112,11 @@ describe("buildThreadFeed", () => {
       shape(deriveThreadFeedPresentation(feed(false), null, new Set([launchFold.runId]))),
     ).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "activity-group",
       "assistant:launch-answer",
       "user:resume",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:resume-answer",
     ]);
 
@@ -1133,7 +1133,7 @@ describe("buildThreadFeed", () => {
       ),
     ).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:launch-answer",
       "user:resume",
       "activity-group",
diff --git a/apps/server/src/cli/trace.ts b/apps/server/src/cli/trace.ts
index 244636c514061..3e94d0d9957f7 100644
--- a/apps/server/src/cli/trace.ts
+++ b/apps/server/src/cli/trace.ts
@@ -100,7 +100,7 @@ export function makeTraceSpanSummary(sinceMs = -Infinity) {
 }
 
 const formatMs = (ms: number) =>
-  ms < 1_000 ? `${Math.round(ms)}ms` : `${(ms / 1_000).toFixed(1)}s`;
+  ms < 1_000 ? `${Math.round(ms)}ms` : `${Math.round(ms / 100) / 10}s`;
 
 function formatTraceSummary(
   summary: ReturnType<ReturnType<typeof makeTraceSpanSummary>["finish"]>,
@@ -127,7 +127,7 @@ function formatTraceSummary(
   const widths = header.map((_, column) => Math.max(...table.map((row) => row[column]!.length)));
   const formatIso = (ms: number) => DateTime.formatIso(DateTime.makeUnsafe(ms));
   return [
-    `${summary.spanCount} spans ended from ${formatIso(summary.firstEndMs)} to ${formatIso(summary.lastEndMs)} (${summary.minutes.toFixed(1)} min).`,
+    `${summary.spanCount} spans ended from ${formatIso(summary.firstEndMs)} to ${formatIso(summary.lastEndMs)} (${summary.minutes.toFixed(1).replace(/\.0+$/, "")} min).`,
     ...(summary.skippedLineCount > 0
       ? [`Skipped ${summary.skippedLineCount} lines that are not spans.`]
       : []),
diff --git a/apps/web/src/components/chat/MessagesTimeline.logic.test.ts b/apps/web/src/components/chat/MessagesTimeline.logic.test.ts
index 8f4b15cc11f91..bd74694dc46af 100644
--- a/apps/web/src/components/chat/MessagesTimeline.logic.test.ts
+++ b/apps/web/src/components/chat/MessagesTimeline.logic.test.ts
@@ -1841,10 +1841,10 @@ describe("deriveMessagesTimelineRows", () => {
     const settled = rows({ resume: "completed", working: false });
     expect(shape(settled)).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:launch-answer",
       "user:resume",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:resume-answer",
     ]);
 
@@ -1857,17 +1857,17 @@ describe("deriveMessagesTimelineRows", () => {
     });
     expect(shape(expanded)).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "work-toggle",
       "assistant:launch-answer",
       "user:resume",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:resume-answer",
     ]);
 
     expect(shape(rows({ resume: "running", working: true }))).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:launch-answer",
       "user:resume",
       "working",
@@ -1876,7 +1876,7 @@ describe("deriveMessagesTimelineRows", () => {
 
     expect(shape(rows({ resume: "failed", working: false }))).toEqual([
       "user:launch",
-      "fold:Worked for 8.0s",
+      "fold:Worked for 8s",
       "assistant:launch-answer",
       "user:resume",
       "work",
diff --git a/apps/web/src/components/chat/WorktreeSetupCard.browser.test.tsx b/apps/web/src/components/chat/WorktreeSetupCard.browser.test.tsx
index 1a34f537efd15..eddd6691884ef 100644
--- a/apps/web/src/components/chat/WorktreeSetupCard.browser.test.tsx
+++ b/apps/web/src/components/chat/WorktreeSetupCard.browser.test.tsx
@@ -53,13 +53,13 @@ it("ticks the running stage while finished stages keep their duration", async ()
   // Assert synchronously: expect.element polls on timers these tests fake.
   const section = screen.getByRole("region", { name: "Worktree setup" });
 
-  expect(section.element().textContent).toContain("Fetch base branch3.0s");
-  expect(section.element().textContent).toContain("Check out files7.0s");
+  expect(section.element().textContent).toContain("Fetch base branch3s");
+  expect(section.element().textContent).toContain("Check out files7s");
 
   await act(async () => {
     await vi.advanceTimersByTimeAsync(5_000);
   });
-  expect(section.element().textContent).toContain("Fetch base branch3.0s");
+  expect(section.element().textContent).toContain("Fetch base branch3s");
   expect(section.element().textContent).toContain("Check out files12s");
 });
 
@@ -70,9 +70,9 @@ it("stops a stage interrupted by the setup ending at the setup's end", async ()
   await using screen = await render(card(failed));
   const section = screen.getByRole("region", { name: "Worktree setup" });
 
-  expect(section.element().textContent).toContain("Check out files2.0s");
+  expect(section.element().textContent).toContain("Check out files2s");
   await act(async () => {
     await vi.advanceTimersByTimeAsync(5_000);
   });
-  expect(section.element().textContent).toContain("Check out files2.0s");
+  expect(section.element().textContent).toContain("Check out files2s");
 });
diff --git a/apps/web/src/components/settings/DiagnosticsSettings.tsx b/apps/web/src/components/settings/DiagnosticsSettings.tsx
index 613074b2d914b..0fcea4fa5de00 100644
--- a/apps/web/src/components/settings/DiagnosticsSettings.tsx
+++ b/apps/web/src/components/settings/DiagnosticsSettings.tsx
@@ -48,7 +48,7 @@ function formatCount(value: number): string {
 
 function formatDuration(value: number): string {
   if (value < 1_000) return `${Math.round(value)} ms`;
-  return `${(value / 1_000).toFixed(value >= 10_000 ? 1 : 2)} s`;
+  return `${(value / 1_000).toFixed(value >= 10_000 ? 1 : 2).replace(/\.0+$/, "")} s`;
 }
 
 function formatBytes(value: number): string {
@@ -438,10 +438,10 @@ const RESOURCE_HISTORY_WINDOWS = [
 ] as const;
 
 function formatCpuTime(seconds: number): string {
-  if (seconds < 60) return `${seconds.toFixed(seconds >= 10 ? 1 : 2)}s`;
+  if (seconds < 60) return `${seconds.toFixed(seconds >= 10 ? 1 : 2).replace(/\.0+$/, "")}s`;
   const minutes = seconds / 60;
-  if (minutes < 60) return `${minutes.toFixed(minutes >= 10 ? 1 : 2)}m`;
-  return `${(minutes / 60).toFixed(2)}h`;
+  if (minutes < 60) return `${minutes.toFixed(minutes >= 10 ? 1 : 2).replace(/\.0+$/, "")}m`;
+  return `${(minutes / 60).toFixed(2).replace(/\.0+$/, "")}h`;
 }
 
 function formatShortProcessName(command: string): string {
diff --git a/apps/web/src/components/settings/ResourceTelemetryDiagnostics.tsx b/apps/web/src/components/settings/ResourceTelemetryDiagnostics.tsx
index 7b67ac7b1949e..74df6a4d6858b 100644
--- a/apps/web/src/components/settings/ResourceTelemetryDiagnostics.tsx
+++ b/apps/web/src/components/settings/ResourceTelemetryDiagnostics.tsx
@@ -74,16 +74,16 @@ function formatRate(value: number): string {
 
 function formatCpuTime(valueMs: number): string {
   const seconds = valueMs / 1_000;
-  if (seconds < 60) return `${seconds.toFixed(seconds >= 10 ? 1 : 2)}s`;
+  if (seconds < 60) return `${seconds.toFixed(seconds >= 10 ? 1 : 2).replace(/\.0+$/, "")}s`;
   const minutes = seconds / 60;
-  if (minutes < 60) return `${minutes.toFixed(minutes >= 10 ? 1 : 2)}m`;
-  return `${(minutes / 60).toFixed(2)}h`;
+  if (minutes < 60) return `${minutes.toFixed(minutes >= 10 ? 1 : 2).replace(/\.0+$/, "")}m`;
+  return `${(minutes / 60).toFixed(2).replace(/\.0+$/, "")}h`;
 }
 
 function formatDurationMicros(value: number): string {
   if (value < 1_000) return `${Math.round(value)} µs`;
-  if (value < 1_000_000) return `${(value / 1_000).toFixed(2)} ms`;
-  return `${(value / 1_000_000).toFixed(2)} s`;
+  if (value < 1_000_000) return `${(value / 1_000).toFixed(2).replace(/\.0+$/, "")} ms`;
+  return `${(value / 1_000_000).toFixed(2).replace(/\.0+$/, "")} s`;
 }
 
 function formatSampleInterval(valueMs: number): string {
@@ -788,7 +788,7 @@ function AttributionTable({ entries }: { entries: ReadonlyArray<ResourceAttribut
               </td>
               <td className="px-3 py-2 text-right font-mono tabular-nums">{entry.count}</td>
               <td className="px-3 py-2 text-right font-mono tabular-nums text-muted-foreground sm:pr-5">
-                {(entry.durationMs / 1_000).toFixed(2)}s
+                {(entry.durationMs / 1_000).toFixed(2).replace(/\.0+$/, "")}s
               </td>
             </tr>
           ))}
diff --git a/packages/shared/src/orchestrationTiming.ts b/packages/shared/src/orchestrationTiming.ts
index 187db6c6d97d4..1f43f99453456 100644
--- a/packages/shared/src/orchestrationTiming.ts
+++ b/packages/shared/src/orchestrationTiming.ts
@@ -22,10 +22,7 @@ export function deriveSubagentElapsedMs(
 export function formatDuration(durationMs: number): string {
   if (!Number.isFinite(durationMs) || durationMs < 0) return "0ms";
   if (durationMs < 1_000) return `${Math.max(1, Math.round(durationMs))}ms`;
-  if (durationMs < 10_000) {
-    const tenths = Math.round(durationMs / 100) / 10;
-    return tenths >= 10 ? "10s" : `${tenths.toFixed(1)}s`;
-  }
+  if (durationMs < 10_000) return `${Math.round(durationMs / 100) / 10}s`;
   const totalSeconds = Math.round(durationMs / 1_000);
   // Choose the unit after rounding so 59.5 seconds never renders as "60s".
   if (totalSeconds < 60) return `${totalSeconds}s`;

From f48fb51fac22c76c0b76f196909acdb395f5832e Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Fri, 30 Oct 2026 03:33:32 +0000
Subject: [PATCH 123/146] feat(web): switch the composer between rich text and
 Markdown source from a button or mod+/ (#26777)

---
 apps/web/src/components/chat/ChatComposer.tsx | 28 ++++++++++++-
 .../chat/ComposerRichTextToggle.tsx           | 41 +++++++++++++++++++
 .../src/components/chat/composerShortcuts.ts  |  6 +++
 apps/web/src/keybindings.test.ts              | 11 ++++-
 docs/user/composer.md                         |  4 +-
 docs/user/keybindings.md                      |  1 +
 packages/contracts/src/keybindings.ts         |  1 +
 packages/shared/src/keybindings.ts            |  1 +
 8 files changed, 90 insertions(+), 3 deletions(-)
 create mode 100644 apps/web/src/components/chat/ComposerRichTextToggle.tsx

diff --git a/apps/web/src/components/chat/ChatComposer.tsx b/apps/web/src/components/chat/ChatComposer.tsx
index d7878cc29a165..56c73bcec16a6 100644
--- a/apps/web/src/components/chat/ChatComposer.tsx
+++ b/apps/web/src/components/chat/ChatComposer.tsx
@@ -133,6 +133,7 @@ import {
 import { attachmentUploadBlockReason } from "../../lib/attachmentUploadState";
 import type { AssistantCitationSourceAnchor } from "~/lib/assistantTextSelection";
 import { shortcutLabelForCommand } from "../../keybindings";
+import { persistClientSettingsUpdate } from "../../hooks/useSettings";
 import {
   type TerminalContextDraft,
   type TerminalContextSelection,
@@ -198,6 +199,7 @@ import {
   ComposerRestingImagePreviews,
 } from "./ComposerAttachmentStrip";
 import { ComposerPrimaryActions } from "./ComposerPrimaryActions";
+import { ComposerRichTextToggle } from "./ComposerRichTextToggle";
 import { ComposerFooterPrimaryActions } from "./ComposerFooterControls";
 import { ComposerPendingUserInputPanel } from "./ComposerPendingUserInputPanel";
 import { ComposerPlanFollowUpBanner } from "./ComposerPlanFollowUpBanner";
@@ -304,6 +306,7 @@ export interface ChatComposerHandle {
   openModelPicker: () => void;
   stepReasoningEffort: (direction: 1 | -1) => void;
   toggleModelPicker: () => void;
+  toggleRichText: () => void;
   openControl: (command: KeybindingCommand) => void;
   isModelPickerOpen: () => boolean;
   isCaretAtStart: () => boolean;
@@ -2852,6 +2855,13 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
           openModelPickerStable();
         }
       },
+      toggleRichText: () => {
+        if (isLiteralPendingAnswer) return;
+        persistClientSettingsUpdate((current) => ({
+          ...current,
+          composerRichTextEnabled: !current.composerRichTextEnabled,
+        })).catch(console.error);
+      },
       openControl: (command) => {
         if (composerBlurFrameRef.current !== null) {
           window.cancelAnimationFrame(composerBlurFrameRef.current);
@@ -3429,7 +3439,23 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
                   showMobilePendingAnswerActions && "hidden sm:flex",
                 )}
               >
-                {composerAttachButton ? <div className="me-2">{composerAttachButton}</div> : null}
+                {composerAttachButton || !isLiteralPendingAnswer ? (
+                  <div className="me-2 flex items-center gap-0.5">
+                    {composerAttachButton}
+                    {isLiteralPendingAnswer ? null : (
+                      <ComposerRichTextToggle
+                        richTextEnabled={settings.composerRichTextEnabled}
+                        shortcutLabel={shortcutLabelForCommand(
+                          keybindings,
+                          "composer.toggleRichText",
+                          {
+                            context: { terminalFocus: false, terminalOpen, modelPickerOpen: false },
+                          },
+                        )}
+                      />
+                    )}
+                  </div>
+                ) : null}
                 <div
                   data-chat-composer-actions="right"
                   data-chat-composer-transition-actions="true"
diff --git a/apps/web/src/components/chat/ComposerRichTextToggle.tsx b/apps/web/src/components/chat/ComposerRichTextToggle.tsx
new file mode 100644
index 0000000000000..b705180c20993
--- /dev/null
+++ b/apps/web/src/components/chat/ComposerRichTextToggle.tsx
@@ -0,0 +1,41 @@
+import { FeatherIcon } from "lucide-react";
+
+import { updateClientSettings } from "../../hooks/useSettings";
+import { Button } from "../ui/button";
+import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
+
+// Same setting as Settings → Chat → Rich text composer. Flipping it remounts the
+// editor; pointer-down is swallowed so a focused editor keeps its caret across that.
+export function ComposerRichTextToggle({
+  richTextEnabled,
+  shortcutLabel,
+}: {
+  readonly richTextEnabled: boolean;
+  readonly shortcutLabel: string | null;
+}) {
+  const showingSource = !richTextEnabled;
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={
+          <Button
+            type="button"
+            variant="ghost"
+            size="icon-sm"
+            aria-label="Markdown source"
+            aria-pressed={showingSource}
+            data-pressed={showingSource ? "" : undefined}
+            onPointerDown={(event) => event.preventDefault()}
+            onClick={() => void updateClientSettings({ composerRichTextEnabled: showingSource })}
+          />
+        }
+      >
+        <FeatherIcon />
+      </TooltipTrigger>
+      <TooltipPopup>
+        {showingSource ? "Show formatting" : "Show Markdown source"}
+        {shortcutLabel ? ` · ${shortcutLabel}` : null}
+      </TooltipPopup>
+    </Tooltip>
+  );
+}
diff --git a/apps/web/src/components/chat/composerShortcuts.ts b/apps/web/src/components/chat/composerShortcuts.ts
index 30beb9771968f..e55398996cea9 100644
--- a/apps/web/src/components/chat/composerShortcuts.ts
+++ b/apps/web/src/components/chat/composerShortcuts.ts
@@ -18,6 +18,12 @@ export function composerShortcutCommands(
     "modelPicker.toggle": ({ event }) => {
       if (!event.repeat) composerRef.current?.toggleModelPicker();
     },
+    "composer.toggleRichText": ({ event }) => {
+      // The flip remounts the editor, which would drop an unsaved citation comment.
+      if (event.target instanceof Element && event.target.closest("[data-citation-comment-editor]"))
+        return false;
+      if (!event.repeat) composerRef.current?.toggleRichText();
+    },
     "composer.increaseEffort": ({ event }) => {
       if (!event.repeat) composerRef.current?.stepReasoningEffort(1);
     },
diff --git a/apps/web/src/keybindings.test.ts b/apps/web/src/keybindings.test.ts
index a0ba7fa7ee043..96ae09296dea5 100644
--- a/apps/web/src/keybindings.test.ts
+++ b/apps/web/src/keybindings.test.ts
@@ -768,12 +768,21 @@ describe("composer and pull request shortcuts", () => {
   });
 
   it.each(["MacIntel", "Win32", "Linux"])(
-    "reserves the alternate send chord for the focused composer on %s",
+    "resolves composer toggle and alternate send chords in their contexts on %s",
     (platform) => {
       const modifier = {
         metaKey: platform === "MacIntel",
         ctrlKey: platform !== "MacIntel",
       };
+      for (const terminalFocus of [false, true]) {
+        assert.strictEqual(
+          resolveShortcutCommand(event({ key: "/", ...modifier }), DEFAULT_RESOLVED_KEYBINDINGS, {
+            platform,
+            context: { terminalFocus },
+          }),
+          terminalFocus ? null : "composer.toggleRichText",
+        );
+      }
       const shiftedEnter = event({ key: "Enter", shiftKey: true, ...modifier });
       for (const composerRequiresModifier of [false, true]) {
         const context = {
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 714572dfd5005..afac8ce64cf3b 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -19,7 +19,9 @@ The composer writes Markdown and shows it styled as you type. Markers such as
 them. Lines starting with `- `, `1. `, `- [ ] `, `> `, `# ` or `---` become lists,
 task lists, quotes, headings and rules; ` ``` ` followed by Enter opens a code
 block. What you typed is what the agent receives, markers and numbering
-included, and `#1234` without a space still looks up a pull request.
+included, and `#1234` without a space still looks up a pull request. To see the
+plain Markdown instead, press the button beside attach; it is the same
+switch as **Settings → Chat → Rich text composer**.
 
 Enter sends. In a list or quote, **Shift+Enter** continues it, and Shift+Enter
 on an empty line moves out one level, then leaves it; **Tab** nests a list item
diff --git a/docs/user/keybindings.md b/docs/user/keybindings.md
index 83989762c5b07..0e8e17744019e 100644
--- a/docs/user/keybindings.md
+++ b/docs/user/keybindings.md
@@ -28,6 +28,7 @@ Use `mod+shift+e` for effort, `mod+shift+a` for permissions, `mod+shift+x` for t
 workspace, and `mod+shift+g` for the Git branch. The workspace menu includes the
 current checkout, a new worktree, and the previous worktree when available.
 Use `mod+shift+l` to reuse the previous worktree directly.
+Use `mod+/` to switch the composer between rich text and its Markdown source.
 
 To change effort one step without opening the picker, bind
 **Composer: Increase Effort** and **Composer: Decrease Effort** in Keybindings.
diff --git a/packages/contracts/src/keybindings.ts b/packages/contracts/src/keybindings.ts
index 714e0a1d486a1..cc55adb9ca81b 100644
--- a/packages/contracts/src/keybindings.ts
+++ b/packages/contracts/src/keybindings.ts
@@ -87,6 +87,7 @@ export const STATIC_KEYBINDING_COMMANDS = [
   "appearance.cycle",
   "themeEditor.toggle",
   "composer.stash",
+  "composer.toggleRichText",
   "composer.sendAlternate",
   "composer.sendBackground",
   "composer.sendAndNewThread",
diff --git a/packages/shared/src/keybindings.ts b/packages/shared/src/keybindings.ts
index 32292c0f9ef21..8ae3f052afede 100644
--- a/packages/shared/src/keybindings.ts
+++ b/packages/shared/src/keybindings.ts
@@ -179,6 +179,7 @@ export const DEFAULT_KEYBINDINGS: ReadonlyArray<KeybindingRule> = [
   { key: "mod+alt+shift+a", command: "appearance.cycle", when: "!terminalFocus" },
   { key: "mod+alt+shift+t", command: "themeEditor.toggle" },
   { key: "mod+s", command: "composer.stash", when: "!terminalFocus" },
+  { key: "mod+/", command: "composer.toggleRichText", when: "!terminalFocus" },
   { key: "mod+shift+enter", command: "thread.steerQueuedMessage", when: "!terminalFocus" },
   { key: "alt+arrowup", command: "thread.editQueuedMessage", when: "composerFocus" },
   { key: "mod+enter", command: "composer.sendAlternate", when: "composerFocus && turnRunning" },

From a773dc38ac75177b6cd133d27df00ca0a83f9480 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 20:43:01 -0700
Subject: [PATCH 124/146] fix(server): t3_thread_organize rejects unknown
 arguments instead of archiving the caller (#26718)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/mcp/toolkits/core.test.ts    | 42 ++++++++++++++++++++
 apps/server/src/mcp/toolkits/thread/tools.ts |  1 +
 2 files changed, 43 insertions(+)

diff --git a/apps/server/src/mcp/toolkits/core.test.ts b/apps/server/src/mcp/toolkits/core.test.ts
index a978dbc4d1ff9..93aee4d52f688 100644
--- a/apps/server/src/mcp/toolkits/core.test.ts
+++ b/apps/server/src/mcp/toolkits/core.test.ts
@@ -350,6 +350,48 @@ it.effect("records only failed calls of tools that hand off no work", () => {
   );
 });
 
+it.effect("rejects an unknown organize target instead of archiving the calling thread", () => {
+  const dispatched: Array<unknown> = [];
+  return Effect.gen(function* () {
+    const server = yield* McpServer.McpServer;
+    const outcome = yield* server
+      .callTool({
+        name: "t3_thread_organize",
+        arguments: { action: "archive", threadIds: ["other-thread"] },
+      })
+      .pipe(
+        Effect.provideService(McpInvocationContext.McpInvocationContext, scope),
+        Effect.provideService(McpSchema.McpServerClient, client),
+        Effect.result,
+      );
+    expect(dispatched).toEqual([]);
+    expect(outcome).toMatchObject({
+      _tag: "Failure",
+      failure: { message: expect.stringContaining("Expected no excess property") },
+    });
+  }).pipe(
+    Effect.provide(
+      layerThreadToolkit.pipe(
+        Layer.provideMerge(McpServer.McpServer.layer),
+        Layer.provide(NodeCrypto.layer),
+        Layer.provide(
+          Layer.mock(ThreadManagement.ThreadManagementService)({
+            getThreadShell: (id) => Effect.succeed(McpToolAccessTestkit.liveThreadShell(id)),
+            getProjectThreadRecords: ({ threadId: id }) =>
+              Effect.succeed(
+                McpToolAccessTestkit.idleThreadProjection(McpToolAccessTestkit.liveThreadShell(id)),
+              ),
+            dispatch: (command) => {
+              dispatched.push(command);
+              return Effect.succeed({ sequence: 1 } as never);
+            },
+          }),
+        ),
+      ),
+    ),
+  );
+});
+
 it.effect("keeps unexpected handler defects private through the production registration", () =>
   Effect.gen(function* () {
     const server = yield* McpServer.McpServer;
diff --git a/apps/server/src/mcp/toolkits/thread/tools.ts b/apps/server/src/mcp/toolkits/thread/tools.ts
index 4b566c44a69d1..018acac5c715f 100644
--- a/apps/server/src/mcp/toolkits/thread/tools.ts
+++ b/apps/server/src/mcp/toolkits/thread/tools.ts
@@ -61,6 +61,7 @@ const ThreadOrganizeTool = Tool.make("t3_thread_organize", {
   ],
 })
   .annotate(Tool.Title, "Organize a thread")
+  .annotate(Tool.Strict, true)
   .annotate(Tool.Destructive, true);
 
 const commandTool = {

From aa11ef6783da81039e6646e2e96941748afb358e Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Fri, 30 Oct 2026 04:26:54 +0000
Subject: [PATCH 125/146] fix(web): composer Markdown source button shows the
 pilcrow again (#27375)

---
 apps/web/src/components/chat/ComposerRichTextToggle.tsx | 4 ++--
 docs/user/composer.md                                   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/components/chat/ComposerRichTextToggle.tsx b/apps/web/src/components/chat/ComposerRichTextToggle.tsx
index b705180c20993..13aebff1984d1 100644
--- a/apps/web/src/components/chat/ComposerRichTextToggle.tsx
+++ b/apps/web/src/components/chat/ComposerRichTextToggle.tsx
@@ -1,4 +1,4 @@
-import { FeatherIcon } from "lucide-react";
+import { PilcrowIcon } from "lucide-react";
 
 import { updateClientSettings } from "../../hooks/useSettings";
 import { Button } from "../ui/button";
@@ -30,7 +30,7 @@ export function ComposerRichTextToggle({
           />
         }
       >
-        <FeatherIcon />
+        <PilcrowIcon />
       </TooltipTrigger>
       <TooltipPopup>
         {showingSource ? "Show formatting" : "Show Markdown source"}
diff --git a/docs/user/composer.md b/docs/user/composer.md
index afac8ce64cf3b..6156a126ca246 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -20,7 +20,7 @@ them. Lines starting with `- `, `1. `, `- [ ] `, `> `, `# ` or `---` become list
 task lists, quotes, headings and rules; ` ``` ` followed by Enter opens a code
 block. What you typed is what the agent receives, markers and numbering
 included, and `#1234` without a space still looks up a pull request. To see the
-plain Markdown instead, press the button beside attach; it is the same
+plain Markdown instead, press the **¶** button beside attach; it is the same
 switch as **Settings → Chat → Rich text composer**.
 
 Enter sends. In a list or quote, **Shift+Enter** continues it, and Shift+Enter

From 3dd62dce70b5ff577099966ba92452603ccc8f89 Mon Sep 17 00:00:00 2001
From: maria <maria@kuuro.net>
Date: Fri, 30 Oct 2026 04:59:35 +0000
Subject: [PATCH 126/146] revert(web): remove the composer rich text toggle
 button and mod+/ shortcut (#27390)

---
 apps/web/src/components/chat/ChatComposer.tsx | 28 +------------
 .../chat/ComposerRichTextToggle.tsx           | 41 -------------------
 .../src/components/chat/composerShortcuts.ts  |  6 ---
 apps/web/src/keybindings.test.ts              | 11 +----
 docs/user/composer.md                         |  4 +-
 docs/user/keybindings.md                      |  1 -
 packages/contracts/src/keybindings.ts         |  1 -
 packages/shared/src/keybindings.ts            |  1 -
 8 files changed, 3 insertions(+), 90 deletions(-)
 delete mode 100644 apps/web/src/components/chat/ComposerRichTextToggle.tsx

diff --git a/apps/web/src/components/chat/ChatComposer.tsx b/apps/web/src/components/chat/ChatComposer.tsx
index 56c73bcec16a6..d7878cc29a165 100644
--- a/apps/web/src/components/chat/ChatComposer.tsx
+++ b/apps/web/src/components/chat/ChatComposer.tsx
@@ -133,7 +133,6 @@ import {
 import { attachmentUploadBlockReason } from "../../lib/attachmentUploadState";
 import type { AssistantCitationSourceAnchor } from "~/lib/assistantTextSelection";
 import { shortcutLabelForCommand } from "../../keybindings";
-import { persistClientSettingsUpdate } from "../../hooks/useSettings";
 import {
   type TerminalContextDraft,
   type TerminalContextSelection,
@@ -199,7 +198,6 @@ import {
   ComposerRestingImagePreviews,
 } from "./ComposerAttachmentStrip";
 import { ComposerPrimaryActions } from "./ComposerPrimaryActions";
-import { ComposerRichTextToggle } from "./ComposerRichTextToggle";
 import { ComposerFooterPrimaryActions } from "./ComposerFooterControls";
 import { ComposerPendingUserInputPanel } from "./ComposerPendingUserInputPanel";
 import { ComposerPlanFollowUpBanner } from "./ComposerPlanFollowUpBanner";
@@ -306,7 +304,6 @@ export interface ChatComposerHandle {
   openModelPicker: () => void;
   stepReasoningEffort: (direction: 1 | -1) => void;
   toggleModelPicker: () => void;
-  toggleRichText: () => void;
   openControl: (command: KeybindingCommand) => void;
   isModelPickerOpen: () => boolean;
   isCaretAtStart: () => boolean;
@@ -2855,13 +2852,6 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
           openModelPickerStable();
         }
       },
-      toggleRichText: () => {
-        if (isLiteralPendingAnswer) return;
-        persistClientSettingsUpdate((current) => ({
-          ...current,
-          composerRichTextEnabled: !current.composerRichTextEnabled,
-        })).catch(console.error);
-      },
       openControl: (command) => {
         if (composerBlurFrameRef.current !== null) {
           window.cancelAnimationFrame(composerBlurFrameRef.current);
@@ -3439,23 +3429,7 @@ export const ChatComposer = memo(function ChatComposer(props: ChatComposerProps)
                   showMobilePendingAnswerActions && "hidden sm:flex",
                 )}
               >
-                {composerAttachButton || !isLiteralPendingAnswer ? (
-                  <div className="me-2 flex items-center gap-0.5">
-                    {composerAttachButton}
-                    {isLiteralPendingAnswer ? null : (
-                      <ComposerRichTextToggle
-                        richTextEnabled={settings.composerRichTextEnabled}
-                        shortcutLabel={shortcutLabelForCommand(
-                          keybindings,
-                          "composer.toggleRichText",
-                          {
-                            context: { terminalFocus: false, terminalOpen, modelPickerOpen: false },
-                          },
-                        )}
-                      />
-                    )}
-                  </div>
-                ) : null}
+                {composerAttachButton ? <div className="me-2">{composerAttachButton}</div> : null}
                 <div
                   data-chat-composer-actions="right"
                   data-chat-composer-transition-actions="true"
diff --git a/apps/web/src/components/chat/ComposerRichTextToggle.tsx b/apps/web/src/components/chat/ComposerRichTextToggle.tsx
deleted file mode 100644
index 13aebff1984d1..0000000000000
--- a/apps/web/src/components/chat/ComposerRichTextToggle.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import { PilcrowIcon } from "lucide-react";
-
-import { updateClientSettings } from "../../hooks/useSettings";
-import { Button } from "../ui/button";
-import { Tooltip, TooltipPopup, TooltipTrigger } from "../ui/tooltip";
-
-// Same setting as Settings → Chat → Rich text composer. Flipping it remounts the
-// editor; pointer-down is swallowed so a focused editor keeps its caret across that.
-export function ComposerRichTextToggle({
-  richTextEnabled,
-  shortcutLabel,
-}: {
-  readonly richTextEnabled: boolean;
-  readonly shortcutLabel: string | null;
-}) {
-  const showingSource = !richTextEnabled;
-  return (
-    <Tooltip>
-      <TooltipTrigger
-        render={
-          <Button
-            type="button"
-            variant="ghost"
-            size="icon-sm"
-            aria-label="Markdown source"
-            aria-pressed={showingSource}
-            data-pressed={showingSource ? "" : undefined}
-            onPointerDown={(event) => event.preventDefault()}
-            onClick={() => void updateClientSettings({ composerRichTextEnabled: showingSource })}
-          />
-        }
-      >
-        <PilcrowIcon />
-      </TooltipTrigger>
-      <TooltipPopup>
-        {showingSource ? "Show formatting" : "Show Markdown source"}
-        {shortcutLabel ? ` · ${shortcutLabel}` : null}
-      </TooltipPopup>
-    </Tooltip>
-  );
-}
diff --git a/apps/web/src/components/chat/composerShortcuts.ts b/apps/web/src/components/chat/composerShortcuts.ts
index e55398996cea9..30beb9771968f 100644
--- a/apps/web/src/components/chat/composerShortcuts.ts
+++ b/apps/web/src/components/chat/composerShortcuts.ts
@@ -18,12 +18,6 @@ export function composerShortcutCommands(
     "modelPicker.toggle": ({ event }) => {
       if (!event.repeat) composerRef.current?.toggleModelPicker();
     },
-    "composer.toggleRichText": ({ event }) => {
-      // The flip remounts the editor, which would drop an unsaved citation comment.
-      if (event.target instanceof Element && event.target.closest("[data-citation-comment-editor]"))
-        return false;
-      if (!event.repeat) composerRef.current?.toggleRichText();
-    },
     "composer.increaseEffort": ({ event }) => {
       if (!event.repeat) composerRef.current?.stepReasoningEffort(1);
     },
diff --git a/apps/web/src/keybindings.test.ts b/apps/web/src/keybindings.test.ts
index 96ae09296dea5..a0ba7fa7ee043 100644
--- a/apps/web/src/keybindings.test.ts
+++ b/apps/web/src/keybindings.test.ts
@@ -768,21 +768,12 @@ describe("composer and pull request shortcuts", () => {
   });
 
   it.each(["MacIntel", "Win32", "Linux"])(
-    "resolves composer toggle and alternate send chords in their contexts on %s",
+    "reserves the alternate send chord for the focused composer on %s",
     (platform) => {
       const modifier = {
         metaKey: platform === "MacIntel",
         ctrlKey: platform !== "MacIntel",
       };
-      for (const terminalFocus of [false, true]) {
-        assert.strictEqual(
-          resolveShortcutCommand(event({ key: "/", ...modifier }), DEFAULT_RESOLVED_KEYBINDINGS, {
-            platform,
-            context: { terminalFocus },
-          }),
-          terminalFocus ? null : "composer.toggleRichText",
-        );
-      }
       const shiftedEnter = event({ key: "Enter", shiftKey: true, ...modifier });
       for (const composerRequiresModifier of [false, true]) {
         const context = {
diff --git a/docs/user/composer.md b/docs/user/composer.md
index 6156a126ca246..714572dfd5005 100644
--- a/docs/user/composer.md
+++ b/docs/user/composer.md
@@ -19,9 +19,7 @@ The composer writes Markdown and shows it styled as you type. Markers such as
 them. Lines starting with `- `, `1. `, `- [ ] `, `> `, `# ` or `---` become lists,
 task lists, quotes, headings and rules; ` ``` ` followed by Enter opens a code
 block. What you typed is what the agent receives, markers and numbering
-included, and `#1234` without a space still looks up a pull request. To see the
-plain Markdown instead, press the **¶** button beside attach; it is the same
-switch as **Settings → Chat → Rich text composer**.
+included, and `#1234` without a space still looks up a pull request.
 
 Enter sends. In a list or quote, **Shift+Enter** continues it, and Shift+Enter
 on an empty line moves out one level, then leaves it; **Tab** nests a list item
diff --git a/docs/user/keybindings.md b/docs/user/keybindings.md
index 0e8e17744019e..83989762c5b07 100644
--- a/docs/user/keybindings.md
+++ b/docs/user/keybindings.md
@@ -28,7 +28,6 @@ Use `mod+shift+e` for effort, `mod+shift+a` for permissions, `mod+shift+x` for t
 workspace, and `mod+shift+g` for the Git branch. The workspace menu includes the
 current checkout, a new worktree, and the previous worktree when available.
 Use `mod+shift+l` to reuse the previous worktree directly.
-Use `mod+/` to switch the composer between rich text and its Markdown source.
 
 To change effort one step without opening the picker, bind
 **Composer: Increase Effort** and **Composer: Decrease Effort** in Keybindings.
diff --git a/packages/contracts/src/keybindings.ts b/packages/contracts/src/keybindings.ts
index cc55adb9ca81b..714e0a1d486a1 100644
--- a/packages/contracts/src/keybindings.ts
+++ b/packages/contracts/src/keybindings.ts
@@ -87,7 +87,6 @@ export const STATIC_KEYBINDING_COMMANDS = [
   "appearance.cycle",
   "themeEditor.toggle",
   "composer.stash",
-  "composer.toggleRichText",
   "composer.sendAlternate",
   "composer.sendBackground",
   "composer.sendAndNewThread",
diff --git a/packages/shared/src/keybindings.ts b/packages/shared/src/keybindings.ts
index 8ae3f052afede..32292c0f9ef21 100644
--- a/packages/shared/src/keybindings.ts
+++ b/packages/shared/src/keybindings.ts
@@ -179,7 +179,6 @@ export const DEFAULT_KEYBINDINGS: ReadonlyArray<KeybindingRule> = [
   { key: "mod+alt+shift+a", command: "appearance.cycle", when: "!terminalFocus" },
   { key: "mod+alt+shift+t", command: "themeEditor.toggle" },
   { key: "mod+s", command: "composer.stash", when: "!terminalFocus" },
-  { key: "mod+/", command: "composer.toggleRichText", when: "!terminalFocus" },
   { key: "mod+shift+enter", command: "thread.steerQueuedMessage", when: "!terminalFocus" },
   { key: "alt+arrowup", command: "thread.editQueuedMessage", when: "composerFocus" },
   { key: "mod+enter", command: "composer.sendAlternate", when: "composerFocus && turnRunning" },

From 2ba2426af640899eee1ca1c544e9321bd2170762 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:07:29 -0700
Subject: [PATCH 127/146] fix(server): HTML preview browsers quit when done
 instead of waiting to be killed (#27224)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/htmlRender/HtmlRender.test.ts | 52 +++++++++++++++++++
 apps/server/src/htmlRender/headlessChrome.ts  | 14 ++++-
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/htmlRender/HtmlRender.test.ts b/apps/server/src/htmlRender/HtmlRender.test.ts
index 80d367b2f8ac9..1916327672516 100644
--- a/apps/server/src/htmlRender/HtmlRender.test.ts
+++ b/apps/server/src/htmlRender/HtmlRender.test.ts
@@ -316,6 +316,58 @@ describe("HtmlRender", () => {
     },
   );
 
+  // The fake browser is a shebang script, which Windows cannot execute.
+  describe.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+    "when the browser cannot be signalled",
+    () => {
+      // A browser T3 cannot signal, as under AppArmor in an LXC container, must still exit.
+      it.live("asks the browser to close when the preview finishes instead of signalling it", () =>
+        Effect.gen(function* () {
+          const fileSystem = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const directory = yield* fileSystem.makeTempDirectoryScoped({
+            prefix: "t3-fake-browser-",
+          });
+          const executable = path.join(directory, "chrome-headless-shell");
+          const exitRecord = path.join(directory, "exited");
+          yield* fileSystem.writeFileString(
+            executable,
+            `#!${process.execPath}
+const fs = require("node:fs");
+process.on("SIGTERM", () => {});
+const quit = () => { fs.writeFileSync(${JSON.stringify(exitRecord)}, "asked to close"); process.exit(0); };
+const reply = (message) => fs.writeSync(4, JSON.stringify(message) + "\\0");
+const results = {
+  "Target.createTarget": { targetId: "page" },
+  "Target.attachToTarget": { sessionId: "session" },
+  "Runtime.evaluate": { result: { value: 100 } },
+  "Page.captureScreenshot": { data: "iVBORw0KGgo=" },
+};
+let buffered = "";
+fs.createReadStream(null, { fd: 3 }).on("end", quit).on("data", (chunk) => {
+  const messages = (buffered + chunk).split("\\0");
+  buffered = messages.pop();
+  for (const { id, method, sessionId } of messages.map((raw) => JSON.parse(raw))) {
+    if (method === "Browser.close") quit();
+    reply({ id, sessionId, result: results[method] ?? {} });
+    if (method === "Page.navigate") reply({ sessionId, method: "Page.loadEventFired", params: {} });
+  }
+});
+`,
+            { mode: 0o755 },
+          );
+
+          yield* HtmlRender.HtmlRender.use((htmlRender) =>
+            htmlRender.preview({ html: "<p>x</p>" }),
+          ).pipe(Effect.provide(layerHtmlRender(executable)));
+
+          const exitedBy = yield* fileSystem.readFileString(exitRecord).pipe(Effect.option);
+          expect(Option.getOrElse(exitedBy, () => "killed by a signal")).toBe("asked to close");
+        }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+      );
+    },
+  );
+
   it.live("matches preview media queries and text colors to the requested appearance", (ctx) =>
     Effect.gen(function* () {
       const executable = (yield* HostProcess.Environment)[TEST_BROWSER_ENV];
diff --git a/apps/server/src/htmlRender/headlessChrome.ts b/apps/server/src/htmlRender/headlessChrome.ts
index aaf64bdcecc36..13ce0c6845740 100644
--- a/apps/server/src/htmlRender/headlessChrome.ts
+++ b/apps/server/src/htmlRender/headlessChrome.ts
@@ -247,7 +247,7 @@ const launchBrowser = Effect.fnUntraced(function* (input: {
   let disconnected: BrowserFailure | undefined;
   let nextId = 0;
 
-  const post = (method: string, params: Record<string, unknown>, sessionId: string) =>
+  const post = (method: string, params: Record<string, unknown>, sessionId?: string) =>
     Queue.offer(
       outgoing,
       new TextEncoder().encode(
@@ -374,6 +374,18 @@ const launchBrowser = Effect.fnUntraced(function* (input: {
     Effect.forkScoped,
   );
 
+  // Signals can miss a confined browser (AppArmor in LXC), so ask it to quit first.
+  // Runs before the spawn's release, which still signals a browser that stays up.
+  yield* Effect.addFinalizer(() =>
+    disconnected
+      ? Effect.void
+      : post("Browser.close", {}).pipe(
+          Effect.andThen(child.exitCode),
+          Effect.timeout("2 seconds"),
+          Effect.ignore,
+        ),
+  );
+
   const send = Effect.fn("headlessChrome.send")(function* <A>(
     method: string,
     params: Record<string, unknown>,

From 05f0d9be28218bdf5e91aa39462e23073379b48a Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:08:11 -0700
Subject: [PATCH 128/146] fix(terminal): retain and pace slow fallback process
 queries (#24640)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/terminal/Manager.test.ts | 153 ++++++++++++++
 apps/server/src/terminal/Manager.ts      | 250 +++++++++++++----------
 2 files changed, 293 insertions(+), 110 deletions(-)

diff --git a/apps/server/src/terminal/Manager.test.ts b/apps/server/src/terminal/Manager.test.ts
index 5b166d8b1452b..7e92567772950 100644
--- a/apps/server/src/terminal/Manager.test.ts
+++ b/apps/server/src/terminal/Manager.test.ts
@@ -10,20 +10,25 @@ import {
   TerminalProviderInstanceNotFoundError,
 } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
+import * as Clock from "effect/Clock";
 import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Base64Url from "effect/encoding/Base64Url";
 import * as Exit from "effect/Exit";
 import * as Fiber from "effect/Fiber";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import * as PlatformError from "effect/PlatformError";
 import * as Path from "effect/Path";
+import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import * as SynchronizedRef from "effect/SynchronizedRef";
+import * as TestClock from "effect/testing/TestClock";
 import { expect, vi } from "vite-plus/test";
 
 import * as ProcessRunner from "../processRunner.ts";
@@ -756,6 +761,154 @@ it.layer(
     }),
   );
 
+  // Answers process-table queries after `queryDuration`, honoring the caller's
+  // timeout the way ProcessRunner's `timedOutResult` mode does.
+  const slowProcessTable = (
+    platform: "linux" | "win32",
+    queryDuration: Duration.Input,
+    queries: Array<{ start: number; end?: number }>,
+    started: ReadonlyArray<Deferred.Deferred<void>>,
+  ): ProcessRunner.ProcessRunner["Service"] => ({
+    run: (input) =>
+      Effect.gen(function* () {
+        const query: { start: number; end?: number } = { start: yield* Clock.currentTimeMillis };
+        queries.push(query);
+        const deferred = started[queries.length - 1];
+        if (deferred) yield* Deferred.succeed(deferred, undefined);
+        const completed = yield* Effect.sleep(queryDuration).pipe(
+          Effect.timeoutOption(input.timeout ?? "1 hour"),
+        );
+        query.end = yield* Clock.currentTimeMillis;
+        return {
+          stdout: Option.isNone(completed)
+            ? ""
+            : platform === "win32"
+              ? "100|9000|node.exe\n"
+              : "  100  9000 node\n",
+          stderr: "",
+          code: Option.isSome(completed) ? ChildProcessSpawner.ExitCode(0) : null,
+          timedOut: Option.isNone(completed),
+          stdoutTruncated: false,
+          stderrTruncated: false,
+          stdoutInvalidUtf8: false,
+          stderrInvalidUtf8: false,
+        };
+      }),
+  });
+
+  const createFallbackManager = (
+    platform: "linux" | "win32",
+    runner: ProcessRunner.ProcessRunner["Service"],
+  ) =>
+    createManager(5, { subprocessPollIntervalMs: 1_000, processKillGraceMs: 0 }).pipe(
+      Effect.provideService(ProcessRunner.ProcessRunner, runner),
+      Effect.provide(layerWithHostPlatform(platform)),
+    );
+
+  it.effect.each(["linux", "win32"] as const)(
+    "reports activity from a slow but successful %s process-table query",
+    (platform) =>
+      Effect.gen(function* () {
+        const started = yield* Deferred.make<void>();
+        const queries: Array<{ start: number; end?: number }> = [];
+        const { manager, getEvents } = yield* createFallbackManager(
+          platform,
+          slowProcessTable(platform, "5 seconds", queries, [started]),
+        );
+
+        yield* manager.open(openInput());
+        yield* TestClock.adjust("1 second");
+        yield* Deferred.await(started);
+        yield* TestClock.adjust("5 seconds");
+
+        expect(
+          (yield* getEvents).some(
+            (event) =>
+              event.type === "activity" && event.hasRunningSubprocess && event.label === "node",
+          ),
+        ).toBe(true);
+        yield* manager.close({ threadId: "thread-1" });
+      }).pipe(Effect.provide(TestClock.layer())),
+  );
+
+  it.effect("idles at least as long as a slow process-table query took before the next", () =>
+    Effect.gen(function* () {
+      const started = yield* Deferred.make<void>();
+      const queries: Array<{ start: number; end?: number }> = [];
+      const { manager } = yield* createFallbackManager(
+        "linux",
+        slowProcessTable("linux", "5 seconds", queries, [started]),
+      );
+
+      yield* manager.open(openInput());
+      yield* TestClock.adjust("1 second");
+      yield* Deferred.await(started);
+      yield* TestClock.adjust("5 seconds");
+      yield* TestClock.adjust(Duration.millis(19_999));
+
+      expect(queries).toHaveLength(1);
+      yield* TestClock.adjust("1 millis");
+      const [slow, next] = queries;
+      expect(next?.start).toBe(slow!.end! + 20_000);
+      yield* manager.close({ threadId: "thread-1" });
+    }).pipe(Effect.provide(TestClock.layer())),
+  );
+
+  it.effect("ends a hung process-table query and paces the retry", () =>
+    Effect.gen(function* () {
+      const started = yield* Deferred.make<void>();
+      const queries: Array<{ start: number; end?: number }> = [];
+      const { manager } = yield* createFallbackManager(
+        "win32",
+        slowProcessTable("win32", "1 day", queries, [started]),
+      );
+
+      yield* manager.open(openInput());
+      yield* TestClock.adjust("1 second");
+      yield* Deferred.await(started);
+      yield* TestClock.adjust("2 minutes");
+      yield* TestClock.adjust("2 minutes");
+
+      const [hung, next] = queries;
+      expect(hung!.end! - hung!.start).toBe(15_000);
+      expect(next!.start - hung!.end!).toBe(60_000);
+      yield* manager.close({ threadId: "thread-1" });
+    }).pipe(Effect.provide(TestClock.layer())),
+  );
+
+  it.effect.each([
+    ["linux", 1_000],
+    ["win32", 1_500],
+  ] as const)(
+    "bounds closeIdle's %s query so other operations on the thread still run",
+    ([platform, budgetMs]) =>
+      Effect.gen(function* () {
+        const started = yield* Deferred.make<void>();
+        const queries: Array<{ start: number; end?: number }> = [];
+        const { manager, ptyAdapter } = yield* createFallbackManager(
+          platform,
+          slowProcessTable(platform, "1 day", queries, [started]),
+        );
+        yield* manager.open(openInput());
+
+        const closing = yield* manager
+          .closeIdle({ threadId: "thread-1" })
+          .pipe(Effect.forkChild({ startImmediately: true }));
+        yield* Deferred.await(started);
+        const resizing = yield* manager
+          .resize({ threadId: "thread-1", terminalId: DEFAULT_TERMINAL_ID, cols: 80, rows: 30 })
+          .pipe(Effect.forkChild({ startImmediately: true }));
+        yield* TestClock.adjust(Duration.millis(budgetMs));
+
+        expect(closing.pollUnsafe()).toBeDefined();
+        expect(resizing.pollUnsafe()).toBeDefined();
+        expect(queries[0]!.end! - queries[0]!.start).toBe(budgetMs);
+        expect(ptyAdapter.processes[0]!.resizeCalls).toEqual([{ cols: 80, rows: 30 }]);
+        expect(ptyAdapter.processes[0]!.killed).toBe(false);
+        yield* manager.close({ threadId: "thread-1" });
+      }).pipe(Effect.provide(TestClock.layer())),
+  );
+
   it.effect("keeps terminals that get input or output while closeIdle checks them", () =>
     Effect.gen(function* () {
       const ptyAdapter = new FakePtyAdapter();
diff --git a/apps/server/src/terminal/Manager.ts b/apps/server/src/terminal/Manager.ts
index a08b3e4afe784..bd7ca2c92e3c2 100644
--- a/apps/server/src/terminal/Manager.ts
+++ b/apps/server/src/terminal/Manager.ts
@@ -46,6 +46,7 @@ import { getTerminalLabel } from "@t3tools/shared/terminalLabels";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
 import * as Context from "effect/Context";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
 import * as Base64Url from "effect/encoding/Base64Url";
 import * as Equal from "effect/Equal";
@@ -55,6 +56,7 @@ import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
+import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
@@ -95,6 +97,12 @@ const MAX_HISTORY_CHUNK_LENGTH = 16 * 1024;
 const DEFAULT_PERSIST_DEBOUNCE_MS = 250;
 const DEFAULT_SUBPROCESS_POLL_INTERVAL_MS = 1_000;
 const MAX_SUBPROCESS_POLL_INTERVAL_MS = 60_000;
+// `ps` and WMI can take seconds on a loaded host and their tables are still
+// valid then; the timeout only ends a query that is truly stuck.
+const PROCESS_TABLE_QUERY_TIMEOUT = "15 seconds";
+// closeIdle queries while holding the thread lock, so it keeps a short budget
+// rather than stalling other operations on that thread behind a slow table.
+const CLOSE_IDLE_QUERY_TIMEOUT = { posix: "1 second", win32: "1500 millis" } as const;
 // Discover children started without terminal input or output.
 const QUIET_SUBPROCESS_SNAPSHOT_EVERY_TICKS = 30;
 const DEFAULT_PROCESS_KILL_GRACE_MS = 1_000;
@@ -675,8 +683,17 @@ interface TerminalProcessTableSnapshot {
   readonly commandById: ReadonlyMap<number, string>;
 }
 
-function subprocessSnapshotPollDelayMs(pollIntervalMs: number, failureCount: number): number {
-  return Math.min(pollIntervalMs * 2 ** failureCount, MAX_SUBPROCESS_POLL_INTERVAL_MS);
+// Idles at least four times as long as the last fallback query took, so a slow
+// process table never keeps the poll loop busy most of the time.
+function subprocessSnapshotPollDelayMs(
+  pollIntervalMs: number,
+  failureCount: number,
+  queryElapsedMs: number,
+): number {
+  return Math.min(
+    Math.max(pollIntervalMs * 2 ** failureCount, queryElapsedMs * 4),
+    MAX_SUBPROCESS_POLL_INTERVAL_MS,
+  );
 }
 
 function parsePosixProcessTable(stdout: string): TerminalProcessTableSnapshot {
@@ -764,6 +781,7 @@ const resolvePosixPsCommand = Effect.fn("terminal.resolvePosixPsCommand")(functi
 
 const posixProcessTableSnapshot = Effect.fn("terminal.posixProcessTableSnapshot")(function* (
   psCommand: string,
+  timeout: Duration.Input,
 ): Effect.fn.Return<
   TerminalProcessTableSnapshot,
   TerminalSubprocessCheckError,
@@ -774,7 +792,7 @@ const posixProcessTableSnapshot = Effect.fn("terminal.posixProcessTableSnapshot"
     .run({
       command: psCommand,
       args: ["-eo", "pid=,ppid=,comm="],
-      timeout: "1 second",
+      timeout,
       maxOutputBytes: 524_288,
       outputMode: "truncate",
       timeoutBehavior: "timedOutResult",
@@ -800,48 +818,46 @@ const posixProcessTableSnapshot = Effect.fn("terminal.posixProcessTableSnapshot"
   return parsePosixProcessTable(result.stdout);
 });
 
-const windowsProcessTableSnapshot = Effect.fn("terminal.windowsProcessTableSnapshot")(
-  function* (): Effect.fn.Return<
-    TerminalProcessTableSnapshot,
-    TerminalSubprocessCheckError,
-    ProcessRunner.ProcessRunner
-  > {
-    const processRunner = yield* ProcessRunner.ProcessRunner;
-    const command =
-      'Get-CimInstance Win32_Process -ErrorAction Stop | ForEach-Object { Write-Output "$($_.ProcessId)|$($_.ParentProcessId)|$($_.Name)" }';
-    const result = yield* processRunner
-      .run({
-        command: "powershell.exe",
-        args: ["-NoProfile", "-NonInteractive", "-Command", command],
-        timeout: "1500 millis",
-        maxOutputBytes: 262_144,
-        outputMode: "truncate",
-        timeoutBehavior: "timedOutResult",
-      })
-      .pipe(
-        Effect.mapError(
-          (cause) => new TerminalSubprocessCheckError({ cause, command: "powershell" }),
-        ),
-      );
-    if (result.code !== 0 || result.timedOut || result.stdoutTruncated) {
-      return yield* new TerminalSubprocessCheckError({
-        command: "powershell",
-        exitCode: result.code,
-        timedOut: result.timedOut,
-        stdoutTruncated: result.stdoutTruncated,
-      });
-    }
-    const processes = result.stdout.split(/\r?\n/g).flatMap((line) => {
-      const [pidRaw, ppidRaw, name = ""] = line.trim().split("|", 3);
-      const pid = Number(pidRaw);
-      const ppid = Number(ppidRaw);
-      return Number.isInteger(pid) && pid > 0 && Number.isInteger(ppid)
-        ? [{ pid, ppid, name }]
-        : [];
+const windowsProcessTableSnapshot = Effect.fn("terminal.windowsProcessTableSnapshot")(function* (
+  timeout: Duration.Input,
+): Effect.fn.Return<
+  TerminalProcessTableSnapshot,
+  TerminalSubprocessCheckError,
+  ProcessRunner.ProcessRunner
+> {
+  const processRunner = yield* ProcessRunner.ProcessRunner;
+  const command =
+    'Get-CimInstance Win32_Process -ErrorAction Stop | ForEach-Object { Write-Output "$($_.ProcessId)|$($_.ParentProcessId)|$($_.Name)" }';
+  const result = yield* processRunner
+    .run({
+      command: "powershell.exe",
+      args: ["-NoProfile", "-NonInteractive", "-Command", command],
+      timeout,
+      maxOutputBytes: 262_144,
+      outputMode: "truncate",
+      timeoutBehavior: "timedOutResult",
+    })
+    .pipe(
+      Effect.mapError(
+        (cause) => new TerminalSubprocessCheckError({ cause, command: "powershell" }),
+      ),
+    );
+  if (result.code !== 0 || result.timedOut || result.stdoutTruncated) {
+    return yield* new TerminalSubprocessCheckError({
+      command: "powershell",
+      exitCode: result.code,
+      timedOut: result.timedOut,
+      stdoutTruncated: result.stdoutTruncated,
     });
-    return processTableSnapshotFromProcesses(processes);
-  },
-);
+  }
+  const processes = result.stdout.split(/\r?\n/g).flatMap((line) => {
+    const [pidRaw, ppidRaw, name = ""] = line.trim().split("|", 3);
+    const pid = Number(pidRaw);
+    const ppid = Number(ppidRaw);
+    return Number.isInteger(pid) && pid > 0 && Number.isInteger(ppid) ? [{ pid, ppid, name }] : [];
+  });
+  return processTableSnapshotFromProcesses(processes);
+});
 
 interface TerminalHistoryChunk {
   data: string;
@@ -1557,54 +1573,74 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
     },
   );
   // Share one process table per poll; per-terminal scans can exhaust PIDs on busy hosts.
-  const fallbackProcessTableSnapshot = (
-    platform === "win32"
-      ? windowsProcessTableSnapshot()
-      : posixProcessTableSnapshot(yield* resolvePosixPsCommand())
-  ).pipe(Effect.provideService(ProcessRunner.ProcessRunner, processRunner));
-  const fetchProcessTableSnapshot: Effect.Effect<
-    {
-      readonly snapshot: TerminalProcessTableSnapshot;
-      readonly snapshotSucceeded: boolean;
-    },
-    TerminalSubprocessCheckError
-  > = options.processTable
-    ? options.processTable.pipe(
-        Effect.map((entries) => ({
-          snapshot: processTableSnapshotFromProcesses(entries),
-          snapshotSucceeded: true,
-        })),
-        Effect.catch(() =>
-          fallbackProcessTableSnapshot.pipe(
-            Effect.map((snapshot) => ({ snapshot, snapshotSucceeded: false })),
+  // Timed on success and failure so the poll loop can pace the next query.
+  const posixPsCommand = platform === "win32" ? undefined : yield* resolvePosixPsCommand();
+  const fallbackProcessTableSnapshot = (timeout: Duration.Input) =>
+    (posixPsCommand === undefined
+      ? windowsProcessTableSnapshot(timeout)
+      : posixProcessTableSnapshot(posixPsCommand, timeout)
+    ).pipe(
+      Effect.provideService(ProcessRunner.ProcessRunner, processRunner),
+      Effect.result,
+      Effect.timed,
+      Effect.map(([elapsed, snapshot]) => ({
+        snapshot,
+        queryElapsedMs: Duration.toMillis(elapsed),
+      })),
+    );
+  // `fallbackTimeout` only bounds the ps/WMI fallback; a native process table
+  // or custom inspector is unaffected.
+  const fetchProcessTableSnapshot = (
+    fallbackTimeout: Duration.Input,
+  ): Effect.Effect<{
+    readonly snapshot: Result.Result<TerminalProcessTableSnapshot, TerminalSubprocessCheckError>;
+    readonly snapshotSucceeded: boolean;
+    readonly queryElapsedMs: number;
+  }> =>
+    options.processTable
+      ? options.processTable.pipe(
+          Effect.map((entries) => ({
+            snapshot: Result.succeed(processTableSnapshotFromProcesses(entries)),
+            snapshotSucceeded: true,
+            queryElapsedMs: 0,
+          })),
+          Effect.catch(() =>
+            fallbackProcessTableSnapshot(fallbackTimeout).pipe(
+              Effect.map((fallback) => ({ ...fallback, snapshotSucceeded: false })),
+            ),
           ),
-        ),
-      )
-    : fallbackProcessTableSnapshot.pipe(
-        Effect.map((snapshot) => ({ snapshot, snapshotSucceeded: true })),
-      );
+        )
+      : fallbackProcessTableSnapshot(fallbackTimeout).pipe(
+          Effect.map((fallback) => ({
+            ...fallback,
+            snapshotSucceeded: Result.isSuccess(fallback.snapshot),
+          })),
+        );
   const customSubprocessInspector = options.subprocessInspector;
-  const acquireSubprocessInspector: Effect.Effect<
-    {
-      readonly inspector: TerminalSubprocessInspector;
-      readonly snapshotSucceeded: boolean;
-    },
-    TerminalSubprocessCheckError
-  > =
+  const acquireSubprocessInspector = (
+    fallbackTimeout: Duration.Input,
+  ): Effect.Effect<{
+    readonly inspector: Result.Result<TerminalSubprocessInspector, TerminalSubprocessCheckError>;
+    readonly snapshotSucceeded: boolean;
+    readonly queryElapsedMs: number;
+  }> =>
     customSubprocessInspector !== undefined
-      ? Effect.succeed({ inspector: customSubprocessInspector, snapshotSucceeded: true })
+      ? Effect.succeed({
+          inspector: Result.succeed(customSubprocessInspector),
+          snapshotSucceeded: true,
+          queryElapsedMs: 0,
+        })
       : Effect.map(
-          fetchProcessTableSnapshot,
-          ({
-            snapshot,
-            snapshotSucceeded,
-          }): {
-            readonly inspector: TerminalSubprocessInspector;
-            readonly snapshotSucceeded: boolean;
-          } => ({
-            inspector: (terminalPid) =>
-              Effect.succeed(deriveSubprocessInspectResult(snapshot, terminalPid, platform)),
+          fetchProcessTableSnapshot(fallbackTimeout),
+          ({ snapshot, snapshotSucceeded, queryElapsedMs }) => ({
+            inspector: Result.map(
+              snapshot,
+              (table): TerminalSubprocessInspector =>
+                (terminalPid) =>
+                  Effect.succeed(deriveSubprocessInspectResult(table, terminalPid, platform)),
+            ),
             snapshotSucceeded,
+            queryElapsedMs,
           }),
         );
   const subprocessPollIntervalMs =
@@ -2632,39 +2668,29 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
       }));
 
     if (runningSessions.length === 0) {
-      return true;
+      return { snapshotSucceeded: true, queryElapsedMs: 0 };
     }
     if (
       runningSessions.every(({ session }) => isQuiet(session)) &&
       skippedQuietTicks < QUIET_SUBPROCESS_SNAPSHOT_EVERY_TICKS - 1
     ) {
       skippedQuietTicks += 1;
-      return true;
+      return { snapshotSucceeded: true, queryElapsedMs: 0 };
     }
     skippedQuietTicks = 0;
 
-    const inspectorOption = yield* acquireSubprocessInspector.pipe(
-      Effect.asSome,
-      Effect.catch((reason) =>
-        Effect.logWarning("failed to snapshot processes for terminal subprocess polling", {
-          reason,
-        }).pipe(
-          Effect.as(
-            Option.none<{
-              readonly inspector: TerminalSubprocessInspector;
-              readonly snapshotSucceeded: boolean;
-            }>(),
-          ),
-        ),
-      ),
+    const { inspector, snapshotSucceeded, queryElapsedMs } = yield* acquireSubprocessInspector(
+      PROCESS_TABLE_QUERY_TIMEOUT,
     );
-
-    if (Option.isNone(inspectorOption)) {
+    if (Result.isFailure(inspector)) {
+      yield* Effect.logWarning("failed to snapshot processes for terminal subprocess polling", {
+        reason: inspector.failure,
+      });
       quietSessions = new WeakMap();
-      return false;
+      return { snapshotSucceeded: false, queryElapsedMs };
     }
 
-    const { inspector: subprocessInspector, snapshotSucceeded } = inspectorOption.value;
+    const subprocessInspector = inspector.success;
     const checkSubprocessActivity = Effect.fn("terminal.checkSubprocessActivity")(function* (
       candidate: (typeof runningSessions)[number],
     ) {
@@ -2760,7 +2786,7 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
       discard: true,
     });
 
-    return snapshotSucceeded;
+    return { snapshotSucceeded, queryElapsedMs };
   });
 
   const hasRunningSessions = readManagerState.pipe(
@@ -2775,13 +2801,14 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
       Effect.flatMap((active) =>
         active
           ? pollSubprocessActivity().pipe(
-              Effect.flatMap((snapshotSucceeded) => {
+              Effect.flatMap(({ snapshotSucceeded, queryElapsedMs }) => {
                 subprocessSnapshotFailureCount = snapshotSucceeded
                   ? 0
                   : Math.min(subprocessSnapshotFailureCount + 1, 30);
                 const delayMs = subprocessSnapshotPollDelayMs(
                   subprocessPollIntervalMs,
                   subprocessSnapshotFailureCount,
+                  queryElapsedMs,
                 );
                 return Effect.sleep(delayMs);
               }),
@@ -3417,7 +3444,10 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
           running.map((session) => [session.terminalId, terminalActivityMark(session)]),
         );
         // Inspect now so commands started after the last poll still protect their terminals.
-        const { inspector } = yield* acquireSubprocessInspector;
+        const { inspector: inspectorResult } = yield* acquireSubprocessInspector(
+          platform === "win32" ? CLOSE_IDLE_QUERY_TIMEOUT.win32 : CLOSE_IDLE_QUERY_TIMEOUT.posix,
+        );
+        const inspector = yield* Effect.fromResult(inspectorResult);
         yield* Effect.forEach(
           running,
           (session) =>

From f3b0194c7b43251791e9732323d5098a5823cd26 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:09:42 -0700
Subject: [PATCH 129/146] fix(server): show readable provider runtime failure
 banners (#24614)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: AdEx-Partners-DE <stark.burns@adexpartners.com>
---
 .../src/orchestration-v2/ProviderSessionManager.test.ts  | 4 ++++
 .../src/orchestration-v2/ProviderSessionManager.ts       | 9 ++++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
index cac8e4fbbb8e0..86b173f80dcba 100644
--- a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
@@ -2551,6 +2551,10 @@ it.effect("ProviderSessionManagerV2 releases sessions when provider event stream
       assert.isTrue(Option.isNone(liveSession));
       assert.equal(runtimeState.closeCount, 1);
       assert.equal(projection.providerSessions.at(-1)?.status, "error");
+      assert.equal(
+        projection.providerSessions.at(-1)?.lastError,
+        "The provider event stream closed unexpectedly. Retry the turn; if it keeps failing, check the provider and server logs.",
+      );
     });
 
     yield* effect.pipe(
diff --git a/apps/server/src/orchestration-v2/ProviderSessionManager.ts b/apps/server/src/orchestration-v2/ProviderSessionManager.ts
index df2ee630df38b..b9887a4844600 100644
--- a/apps/server/src/orchestration-v2/ProviderSessionManager.ts
+++ b/apps/server/src/orchestration-v2/ProviderSessionManager.ts
@@ -50,6 +50,7 @@ import * as CommandOutputHub from "./CommandOutputHub.ts";
 import * as IdAllocator from "@t3tools/provider-core/server/IdAllocator";
 import * as ProviderEventIngestor from "./ProviderEventIngestor.ts";
 import * as ProviderAdapter from "@t3tools/provider-core/server/ProviderAdapter";
+import { makeProviderFailure } from "@t3tools/provider-core/server/failure";
 import * as ProviderAdapterRegistry from "./ProviderAdapterRegistry.ts";
 import * as ProjectionStore from "./ProjectionStore.ts";
 
@@ -1987,10 +1988,16 @@ export const layerWithOptions = (
                 cause,
               });
               yield* Ref.set(entry.eventSubscribers, new Map());
+              // lastError is the thread banner, so it gets the same bounded
+              // message as a failed turn; the raw cause survives only in the log.
+              yield* Effect.logWarning("orchestration-v2.provider-session-runtime-failed", {
+                providerSessionId: entry.runtime.providerSessionId,
+                cause,
+              });
               yield* releaseEntry({
                 providerSessionId: entry.runtime.providerSessionId,
                 reason: "runtime_error",
-                detail: Cause.pretty(cause),
+                detail: makeProviderFailure({ cause }).message,
               }).pipe(logReleaseFailure(entry.runtime.providerSessionId));
             }),
           ),

From 2c119bd975deb06f49505a0af3ec8d272806b923 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:10:42 -0700
Subject: [PATCH 130/146] fix(gitlab): share merge request reads across detail
 and checks (#24392)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../pullRequest/PullRequestService.test.ts    |  92 +++++++++++
 .../src/pullRequest/PullRequestService.ts     |  53 +++---
 .../src/server/PullRequestProvider.ts         |  10 ++
 .../server/GitLabPullRequestProvider.test.ts  | 152 ++++++++++++++++++
 .../src/server/GitLabPullRequestProvider.ts   | 117 ++++++++++++--
 5 files changed, 394 insertions(+), 30 deletions(-)

diff --git a/apps/server/src/pullRequest/PullRequestService.test.ts b/apps/server/src/pullRequest/PullRequestService.test.ts
index 6c6c8215aa315..2b4d2f68c5502 100644
--- a/apps/server/src/pullRequest/PullRequestService.test.ts
+++ b/apps/server/src/pullRequest/PullRequestService.test.ts
@@ -2189,6 +2189,98 @@ it.effect("does not revive old summaries when project epochs are evicted", () =>
   }),
 );
 
+it.effect("a refresh or a finished turn drops the provider's own change request reads", () =>
+  Effect.gen(function* () {
+    const forgotten: Array<{ readonly repository: string; readonly number?: number } | undefined> =
+      [];
+    const service = yield* makeService({
+      projects: [
+        project({
+          id: "p1",
+          title: "web",
+          workspaceRoot: "/a",
+          repository: "acme/web",
+          provider: "gitlab",
+        }),
+      ],
+      providers: [
+        fakeProvider(SourceControlProviderKind.make("gitlab"), {
+          forgetChangeRequestReads: (scope) => Effect.sync(() => void forgotten.push(scope)),
+        }),
+      ],
+    });
+    const reference = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
+
+    yield* service.invalidate({ reference });
+    yield* service.refreshAfterTurn(reference.projectId);
+    yield* service.invalidate({});
+
+    assert.deepStrictEqual(forgotten, [
+      { repository: "acme/web", number: 1 },
+      undefined,
+      undefined,
+    ]);
+  }),
+);
+
+it.effect("a read during a refresh cannot keep the provider's old change request", () =>
+  Effect.gen(function* () {
+    let hostTitle = "old";
+    let held: string | undefined;
+    let gate:
+      | { readonly entered: Deferred.Deferred<void>; readonly release: Deferred.Deferred<void> }
+      | undefined;
+    const service = yield* makeService({
+      projects: [
+        project({
+          id: "p1",
+          title: "web",
+          workspaceRoot: "/a",
+          repository: "acme/web",
+          provider: "gitlab",
+        }),
+      ],
+      providers: [
+        fakeProvider(SourceControlProviderKind.make("gitlab"), {
+          getChangeRequest: () =>
+            Effect.sync(() => {
+              held ??= hostTitle;
+              return { ...hostedChangeRequest("body"), title: held };
+            }),
+          forgetChangeRequestReads: () =>
+            Effect.gen(function* () {
+              if (gate !== undefined) {
+                yield* Deferred.succeed(gate.entered, undefined);
+                yield* Deferred.await(gate.release);
+              }
+              held = undefined;
+            }),
+        }),
+      ],
+    });
+    const reference = { projectId: "p1" as ProjectId, repository: "acme/web", number: 1 };
+    const refreshWithReadInBetween = (refresh: Effect.Effect<void>) =>
+      Effect.gen(function* () {
+        gate = { entered: yield* Deferred.make<void>(), release: yield* Deferred.make<void>() };
+        const running = yield* refresh.pipe(Effect.forkChild());
+        yield* Deferred.await(gate.entered);
+        yield* service.detail(reference);
+        yield* Deferred.succeed(gate.release, undefined);
+        yield* Fiber.join(running);
+        gate = undefined;
+      });
+
+    assert.strictEqual((yield* service.detail(reference)).title, "old");
+    hostTitle = "after turn";
+    yield* refreshWithReadInBetween(service.refreshAfterTurn(reference.projectId));
+    assert.strictEqual((yield* service.detail(reference)).title, "after turn");
+
+    hostTitle = "after refresh";
+    yield* refreshWithReadInBetween(service.invalidate({ reference }));
+    assert.strictEqual((yield* service.detail(reference)).title, "after refresh");
+  }),
+);
+
 it.effect("close and reopen notify subscribed readers after invalidating their cached state", () =>
   Effect.scoped(
     Effect.gen(function* () {
diff --git a/apps/server/src/pullRequest/PullRequestService.ts b/apps/server/src/pullRequest/PullRequestService.ts
index 854d182f155ec..9f18426be198e 100644
--- a/apps/server/src/pullRequest/PullRequestService.ts
+++ b/apps/server/src/pullRequest/PullRequestService.ts
@@ -528,6 +528,9 @@ function withRateLimitBackoff(
           listChangeRequestStats: wrap("listChangeRequestStats", api.listChangeRequestStats),
         }),
     getChangeRequest: wrap("getChangeRequest", api.getChangeRequest),
+    ...(api.forgetChangeRequestReads === undefined
+      ? {}
+      : { forgetChangeRequestReads: api.forgetChangeRequestReads }),
     ...(api.getChangeRequestPreview === undefined
       ? {}
       : { getChangeRequestPreview: wrap("getChangeRequestPreview", api.getChangeRequestPreview) }),
@@ -3423,6 +3426,13 @@ export const make = Effect.gen(function* () {
     return { stats: [...held, ...result.stats] };
   });
 
+  const forgetProviderReads = (scope?: { readonly repository: string; readonly number?: number }) =>
+    Effect.forEach(
+      registry.kinds,
+      (kind) => registry.get(kind)?.forgetChangeRequestReads?.(scope) ?? Effect.void,
+      { discard: true },
+    );
+
   const invalidate: PullRequestService["Service"]["invalidate"] = Effect.fn(
     "PullRequestService.invalidate",
   )(function* (input, options) {
@@ -3438,13 +3448,15 @@ export const make = Effect.gen(function* () {
     if (reference !== undefined) {
       yield* canonicalRef(reference).pipe(
         Effect.flatMap((ref) =>
-          readCache
-            .invalidate(refScope(ref))
-            .pipe(Effect.andThen(Effect.sync(() => bumpRefEpoch(ref)))),
+          forgetProviderReads({ repository: ref.repository, number: ref.number }).pipe(
+            Effect.andThen(readCache.invalidate(refScope(ref))),
+            Effect.andThen(Effect.sync(() => bumpRefEpoch(ref))),
+          ),
         ),
         Effect.ignore,
       );
     } else {
+      yield* forgetProviderReads();
       listingsEpoch = ++epochCounter;
       everyFileRevisionEpoch = ++epochCounter;
       viewersByHost.clear();
@@ -3455,22 +3467,27 @@ export const make = Effect.gen(function* () {
     }
   });
 
-  const refreshAfterTurn: PullRequestService["Service"]["refreshAfterTurn"] = (projectId) =>
-    Effect.suspend(() => {
-      listingsEpoch = ++epochCounter;
-      projectEpochs.delete(projectId);
-      if (projectEpochs.size >= REF_EPOCH_CAPACITY) {
-        const oldest = projectEpochs.keys().next().value;
-        if (oldest !== undefined) {
-          projectEpochFloor = projectEpochs.get(oldest)!;
-          projectEpochs.delete(oldest);
-        }
+  const refreshAfterTurn: PullRequestService["Service"]["refreshAfterTurn"] = Effect.fn(
+    "PullRequestService.refreshAfterTurn",
+  )(function* (projectId) {
+    // Everything the provider holds, not just the project's repository: a turn can touch a
+    // change request reached through another repository, and no epoch may move until those
+    // reads are gone, or a reader in between keeps the old one under the new epoch.
+    yield* forgetProviderReads();
+    listingsEpoch = ++epochCounter;
+    projectEpochs.delete(projectId);
+    if (projectEpochs.size >= REF_EPOCH_CAPACITY) {
+      const oldest = projectEpochs.keys().next().value;
+      if (oldest !== undefined) {
+        projectEpochFloor = projectEpochs.get(oldest)!;
+        projectEpochs.delete(oldest);
       }
-      projectEpochs.set(projectId, listingsEpoch);
-      return readCache
-        .invalidate(`project:${projectId}`)
-        .pipe(Effect.andThen(SubscriptionRef.set(pullRequestRefreshes, listingsEpoch)));
-    });
+    }
+    projectEpochs.set(projectId, listingsEpoch);
+    const epoch = listingsEpoch;
+    yield* readCache.invalidate(`project:${projectId}`);
+    yield* SubscriptionRef.set(pullRequestRefreshes, epoch);
+  });
 
   const invalidatedByMutation =
     <I extends PullRequestRef>(
diff --git a/packages/source-control-core/src/server/PullRequestProvider.ts b/packages/source-control-core/src/server/PullRequestProvider.ts
index 46fc8fd48b0dc..63dfe8db7a85b 100644
--- a/packages/source-control-core/src/server/PullRequestProvider.ts
+++ b/packages/source-control-core/src/server/PullRequestProvider.ts
@@ -353,6 +353,16 @@ export interface PullRequestProviderApi {
     input: ProviderRepositoryRef & { readonly number: number },
   ) => Effect.Effect<ProviderChangeRequestDetail, PullRequestProviderError>;
 
+  /**
+   * For a provider that holds change request reads of its own: called when the service drops its
+   * reads, so a refresh or a finished turn reaches the host. No scope forgets everything; a scope
+   * without a number forgets the repository's change requests.
+   */
+  readonly forgetChangeRequestReads?: (scope?: {
+    readonly repository: string;
+    readonly number?: number;
+  }) => Effect.Effect<void>;
+
   readonly getChangeRequestPreview?: (
     input: ProviderRepositoryRef & { readonly number: number },
   ) => Effect.Effect<
diff --git a/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts b/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
index 6eec9ccd09142..cc6bab6c53f42 100644
--- a/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
+++ b/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.test.ts
@@ -1,6 +1,7 @@
 import { assert, describe, expect, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as TestClock from "effect/testing/TestClock";
 
 import * as GitLabCli from "./GitLabCli.ts";
 import * as GitLabPullRequestCli from "./GitLabPullRequestCli.ts";
@@ -122,6 +123,157 @@ describe("getChangeRequest base freshness", () => {
   );
 });
 
+describe("merge request reads", () => {
+  const reference = { cwd: "/w", repository: "acme/web", host: "gitlab.com", number: 7 };
+  const detail = {
+    number: 7,
+    title: "Merge request 7",
+    url: "https://gitlab.com/acme/web/-/merge_requests/7",
+    author: null,
+    headBranch: "feat/page",
+    baseBranch: "main",
+    state: "open" as const,
+    isDraft: false,
+    mergeability: "mergeable" as const,
+    additions: 0,
+    deletions: 0,
+    createdAt: "2026-07-01T00:00:00Z",
+    updatedAt: "2026-07-02T00:00:00Z",
+    reviewRequestLogins: [],
+    labels: [],
+    body: "",
+    changedFiles: 1,
+    mergedAt: null,
+    closedAt: null,
+    reviewers: [],
+    checks: [],
+    viewerCanMerge: true,
+    reviewerIds: [],
+  };
+
+  const countingProvider = Effect.gen(function* () {
+    const calls = { detail: 0, mergeCapabilities: 0 };
+    const host = { viewerCanMerge: true };
+    const provider = yield* make.pipe(
+      Effect.provide(
+        Layer.mock(GitLabPullRequestCli.GitLabPullRequestCli)({
+          getMergeRequestDetail: (input) =>
+            Effect.sync(() => {
+              calls.detail += 1;
+              return { ...detail, number: input.number, viewerCanMerge: host.viewerCanMerge };
+            }),
+          getProjectMergeCapabilities: () =>
+            Effect.sync(() => {
+              calls.mergeCapabilities += 1;
+              return { merge: true, squash: true, rebase: true };
+            }),
+          runMergeRequestAction: () => Effect.void,
+        }),
+      ),
+    );
+    const checks = provider.getChangeRequestChecks;
+    const forget = provider.forgetChangeRequestReads;
+    if (checks === undefined || forget === undefined) {
+      return yield* Effect.die("GitLab answers checks and forgets its reads");
+    }
+    return { provider, checks, forget, calls, host };
+  });
+
+  it.effect("asks for a project's merge methods once across its merge requests", () =>
+    Effect.gen(function* () {
+      const { provider, calls } = yield* countingProvider;
+
+      yield* provider.getChangeRequest(reference);
+      yield* provider.getChangeRequest(reference);
+      yield* provider.getChangeRequest({ ...reference, number: 8 });
+
+      expect(calls.mergeCapabilities).toBe(1);
+    }),
+  );
+
+  it.effect("answers checks from the merge request the detail just read", () =>
+    Effect.gen(function* () {
+      const { provider, checks, calls } = yield* countingProvider;
+
+      yield* provider.getChangeRequest(reference);
+      yield* checks(reference);
+
+      expect(calls.detail).toBe(1);
+    }),
+  );
+
+  it.effect("reads a merge request again after a write to it", () =>
+    Effect.gen(function* () {
+      const { provider, checks, calls } = yield* countingProvider;
+
+      yield* provider.getChangeRequest(reference);
+      yield* provider.runAction({ ...reference, action: "ready" });
+      yield* checks(reference);
+
+      expect(calls.detail).toBe(2);
+    }),
+  );
+
+  it.effect("does not share reads between checkouts", () =>
+    Effect.gen(function* () {
+      const { provider, calls } = yield* countingProvider;
+
+      yield* provider.getChangeRequest(reference);
+      yield* provider.getChangeRequest({ ...reference, cwd: "/other" });
+
+      expect(calls).toEqual({ detail: 2, mergeCapabilities: 2 });
+    }),
+  );
+
+  it.effect("reads a merge request again once a minute has passed", () =>
+    Effect.gen(function* () {
+      const { provider, calls } = yield* countingProvider;
+
+      yield* provider.getChangeRequest(reference);
+      yield* TestClock.adjust("61 seconds");
+      yield* provider.getChangeRequest(reference);
+
+      expect(calls.detail).toBe(2);
+    }),
+  );
+
+  it.effect("answers viewer permissions from the host, not the page's read", () =>
+    Effect.gen(function* () {
+      const { provider, host } = yield* countingProvider;
+
+      host.viewerCanMerge = false;
+      yield* provider.getChangeRequest(reference);
+      host.viewerCanMerge = true;
+      const granted = yield* provider.getViewerPermissions(reference);
+      host.viewerCanMerge = false;
+      const revoked = yield* provider.getViewerPermissions(reference);
+
+      expect(granted.actions).toContain("merge");
+      expect(revoked.actions).not.toContain("merge");
+    }),
+  );
+
+  it.effect("reads a merge request again once its reads are forgotten", () =>
+    Effect.gen(function* () {
+      const { provider, checks, forget, calls } = yield* countingProvider;
+      const other = { ...reference, repository: "acme/api" };
+
+      yield* provider.getChangeRequest(reference);
+      yield* provider.getChangeRequest(other);
+      yield* forget({ repository: "ACME/web", number: 7 });
+      yield* checks(reference);
+      yield* checks(other);
+      expect(calls.detail).toBe(3);
+
+      yield* forget({ repository: "acme/web" });
+      yield* checks(reference);
+      yield* forget();
+      yield* checks(other);
+      expect(calls.detail).toBe(5);
+    }),
+  );
+});
+
 describe("optional activity reads", () => {
   const reference = { cwd: "/w", repository: "acme/web", host: "gitlab.com", number: 7 };
   const comment = {
diff --git a/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts b/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts
index a9856f907ebb8..79c3d43c01966 100644
--- a/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts
+++ b/packages/source-control-gitlab/src/server/GitLabPullRequestProvider.ts
@@ -1,5 +1,8 @@
 import { SourceControlProviderKind } from "@t3tools/contracts";
+import * as Cache from "effect/Cache";
+import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
 import type {
   PullRequestCapabilities,
   PullRequestReaction,
@@ -72,6 +75,16 @@ export function gitLabViewerPermissions(input: {
   };
 }
 
+/**
+ * One page view asks for the detail and then its checks within a second, and the poll that
+ * follows asks again. A minute keeps those to one `glab` call without hiding a pipeline for long;
+ * a refresh or a finished turn drops it sooner through `forgetChangeRequestReads`.
+ */
+const MERGE_REQUEST_DETAIL_TTL = Duration.minutes(1);
+/** A project's merge methods change in its settings, which nobody does between page views. */
+const PROJECT_MERGE_CAPABILITIES_TTL = Duration.minutes(15);
+const READ_CACHE_CAPACITY = 256;
+
 function gitLabProviderFailure(
   error: GitLabPullRequestCli.GitLabPullRequestCliError,
 ): PullRequestProviderFailure {
@@ -85,6 +98,55 @@ function gitLabProviderFailure(
 export const make = Effect.gen(function* () {
   const cli = yield* GitLabPullRequestCli.GitLabPullRequestCli;
 
+  // Keyed on the checkout as well: `glab` picks the host and the account to answer as from the
+  // checkout's remote and config, so two checkouts may read the same project as different people.
+  const mergeRequestDetails = yield* Cache.makeWith(
+    (key: string) => {
+      const [cwd, repository, number] = JSON.parse(key) as [string, string, number];
+      return cli.getMergeRequestDetail({ cwd, repository, number });
+    },
+    {
+      capacity: READ_CACHE_CAPACITY,
+      timeToLive: (exit) => (Exit.isSuccess(exit) ? MERGE_REQUEST_DETAIL_TTL : Duration.zero),
+    },
+  );
+  const projectMergeCapabilities = yield* Cache.makeWith(
+    (key: string) => {
+      const [cwd, repository] = JSON.parse(key) as [string, string];
+      return cli.getProjectMergeCapabilities({ cwd, repository });
+    },
+    {
+      capacity: READ_CACHE_CAPACITY,
+      timeToLive: (exit) => (Exit.isSuccess(exit) ? PROJECT_MERGE_CAPABILITIES_TTL : Duration.zero),
+    },
+  );
+
+  const detailKey = (input: {
+    readonly cwd: string;
+    readonly repository: string;
+    readonly number: number;
+  }) => JSON.stringify([input.cwd, input.repository, input.number]);
+  const mergeRequestDetail = (input: {
+    readonly cwd: string;
+    readonly repository: string;
+    readonly number: number;
+  }) => Cache.get(mergeRequestDetails, detailKey(input));
+
+  // Dropped on both sides, as the service does with its own reads: a read that starts while the
+  // write is in flight must not outlive it.
+  const writing =
+    <
+      I extends { readonly cwd: string; readonly repository: string; readonly number: number },
+      A,
+      E,
+    >(
+      write: (input: I) => Effect.Effect<A, E>,
+    ) =>
+    (input: I): Effect.Effect<A, E> => {
+      const invalidate = Cache.invalidate(mergeRequestDetails, detailKey(input));
+      return invalidate.pipe(Effect.andThen(write(input)), Effect.ensuring(invalidate));
+    };
+
   const fail = (operation: string) => (error: GitLabPullRequestCli.GitLabPullRequestCliError) =>
     new PullRequestProviderError({
       provider: SourceControlProviderKind.make("gitlab"),
@@ -138,7 +200,7 @@ export const make = Effect.gen(function* () {
         ),
 
     getChangeRequestChecks: (input) =>
-      cli.getMergeRequestDetail(input).pipe(
+      mergeRequestDetail(input).pipe(
         Effect.map(({ state, checks }) => ({ state, checks })),
         Effect.mapError(fail("getChangeRequestChecks")),
       ),
@@ -153,8 +215,8 @@ export const make = Effect.gen(function* () {
     getChangeRequest: (input) =>
       Effect.all(
         [
-          cli.getMergeRequestDetail(input),
-          cli.getProjectMergeCapabilities({ cwd: input.cwd, repository: input.repository }),
+          mergeRequestDetail(input),
+          Cache.get(projectMergeCapabilities, JSON.stringify([input.cwd, input.repository])),
         ],
         { concurrency: 2 },
       ).pipe(
@@ -209,11 +271,31 @@ export const make = Effect.gen(function* () {
         })),
       ),
 
+    // Straight from the host, never the shared read: this is what a write is refused or let
+    // through on, and access granted or withdrawn within the minute must count.
     getViewerPermissions: (input) =>
       cli
         .getMergeRequestDetail(input)
         .pipe(Effect.mapError(fail("getViewerPermissions")), Effect.map(gitLabViewerPermissions)),
 
+    forgetChangeRequestReads: (scope) =>
+      Cache.keys(mergeRequestDetails).pipe(
+        Effect.flatMap((keys) =>
+          Effect.forEach(
+            Array.from(keys).filter((key) => {
+              if (scope === undefined) return true;
+              const [, repository, number] = JSON.parse(key) as [string, string, number];
+              return (
+                repository.toLowerCase() === scope.repository.toLowerCase() &&
+                (scope.number === undefined || number === scope.number)
+              );
+            }),
+            (key) => Cache.invalidate(mergeRequestDetails, key),
+            { discard: true },
+          ),
+        ),
+      ),
+
     getDiff: (input) => cli.getMergeRequestDiff(input).pipe(Effect.mapError(fail("getDiff"))),
 
     getDiffFileContents: (input) =>
@@ -245,7 +327,7 @@ export const make = Effect.gen(function* () {
         .listProjectUsers({ cwd: input.cwd, repository: input.repository, search: input.query })
         .pipe(Effect.mapError(fail("searchRepositoryAuthors"))),
 
-    setReviewerRequest: (input) =>
+    setReviewerRequest: writing((input) =>
       cli
         .setReviewerRequest({
           cwd: input.cwd,
@@ -255,8 +337,9 @@ export const make = Effect.gen(function* () {
           requested: input.requested,
         })
         .pipe(Effect.mapError(fail("setReviewerRequest"))),
+    ),
 
-    runAction: (input) =>
+    runAction: writing((input) =>
       cli
         .runMergeRequestAction({
           cwd: input.cwd,
@@ -266,8 +349,9 @@ export const make = Effect.gen(function* () {
           ...(input.mergeMethod === undefined ? {} : { mergeMethod: input.mergeMethod }),
         })
         .pipe(Effect.mapError(fail("runAction"))),
+    ),
 
-    updateChangeRequest: (input) =>
+    updateChangeRequest: writing((input) =>
       cli
         .updateMergeRequest({
           cwd: input.cwd,
@@ -277,10 +361,13 @@ export const make = Effect.gen(function* () {
           ...(input.body === undefined ? {} : { description: input.body }),
         })
         .pipe(Effect.mapError(fail("updateChangeRequest"))),
+    ),
 
-    comment: (input) => cli.commentOnMergeRequest(input).pipe(Effect.mapError(fail("comment"))),
+    comment: writing((input) =>
+      cli.commentOnMergeRequest(input).pipe(Effect.mapError(fail("comment"))),
+    ),
 
-    updateComment: (input) =>
+    updateComment: writing((input) =>
       cli
         .updateNote({
           cwd: input.cwd,
@@ -290,10 +377,13 @@ export const make = Effect.gen(function* () {
           body: input.body,
         })
         .pipe(Effect.mapError(fail("updateComment"))),
+    ),
 
-    submitReview: (input) => cli.submitReview(input).pipe(Effect.mapError(fail("submitReview"))),
+    submitReview: writing((input) =>
+      cli.submitReview(input).pipe(Effect.mapError(fail("submitReview"))),
+    ),
 
-    replyToThread: (input) =>
+    replyToThread: writing((input) =>
       cli
         .replyToDiscussion({
           cwd: input.cwd,
@@ -303,8 +393,9 @@ export const make = Effect.gen(function* () {
           body: input.body,
         })
         .pipe(Effect.mapError(fail("replyToThread"))),
+    ),
 
-    setReaction: (input) =>
+    setReaction: writing((input) =>
       cli
         .setReaction({
           cwd: input.cwd,
@@ -315,8 +406,9 @@ export const make = Effect.gen(function* () {
           reacted: input.reacted,
         })
         .pipe(Effect.mapError(fail("setReaction"))),
+    ),
 
-    setThreadResolution: (input) =>
+    setThreadResolution: writing((input) =>
       cli
         .setDiscussionResolution({
           cwd: input.cwd,
@@ -326,6 +418,7 @@ export const make = Effect.gen(function* () {
           resolved: input.resolved,
         })
         .pipe(Effect.mapError(fail("setThreadResolution"))),
+    ),
   };
 
   return provider;

From adba9a31d021ed9c9cc3205aa01d7ad670568e86 Mon Sep 17 00:00:00 2001
From: fixfon <12512757+fixfon@users.noreply.github.com>
Date: Fri, 30 Oct 2026 08:12:34 +0300
Subject: [PATCH 131/146] fix(usage): count Claude advisor calls under the
 advisor model (#24139)

---
 .../src/provider/Drivers/claudeUsage.test.ts  | 138 +++++++++++++++++-
 .../src/provider/Drivers/claudeUsage.ts       |  60 ++++++--
 apps/server/src/usage/UsageService.test.ts    |   2 +-
 apps/server/src/usage/usageScanCache.test.ts  |  18 ++-
 apps/server/src/usage/usageScanCache.ts       |  13 +-
 5 files changed, 205 insertions(+), 26 deletions(-)

diff --git a/apps/server/src/provider/Drivers/claudeUsage.test.ts b/apps/server/src/provider/Drivers/claudeUsage.test.ts
index a9ebb05a2e1e7..6f457f4f4cf2f 100644
--- a/apps/server/src/provider/Drivers/claudeUsage.test.ts
+++ b/apps/server/src/provider/Drivers/claudeUsage.test.ts
@@ -32,9 +32,9 @@ function claudeLine(overrides: {
 
 describe("parseClaudeLine", () => {
   it("extracts token totals and a dedupe key", () => {
-    const record = parseClaudeLine(claudeLine({ messageId: "msg_1", contentType: "text" }));
+    const [record] = parseClaudeLine(claudeLine({ messageId: "msg_1", contentType: "text" }));
 
-    expect(record).not.toBeNull();
+    expect(record).toBeDefined();
     expect(record?.provider).toBe("claude");
     expect(record?.model).toBe("claude-fable-5");
     expect(record?.totals).toEqual({
@@ -50,8 +50,8 @@ describe("parseClaudeLine", () => {
 
   it("gives every content block of one message the same dedupe key", () => {
     // Content-block records repeat full parent usage; summing them overcounts.
-    const text = parseClaudeLine(claudeLine({ messageId: "msg_2", contentType: "text" }));
-    const toolUse = parseClaudeLine(claudeLine({ messageId: "msg_2", contentType: "tool_use" }));
+    const [text] = parseClaudeLine(claudeLine({ messageId: "msg_2", contentType: "text" }));
+    const [toolUse] = parseClaudeLine(claudeLine({ messageId: "msg_2", contentType: "tool_use" }));
 
     expect(text?.dedupeKey).toBe(toolUse?.dedupeKey);
     expect(text?.totals).toEqual(toolUse?.totals);
@@ -86,3 +86,133 @@ describe("parseClaudeLine", () => {
     expect(claudeUsageFormat.parseProjected(synthetic, undefined)).toEqual([]);
   });
 });
+
+describe("Claude advisor iterations", () => {
+  const advisorTurn = {
+    type: "assistant",
+    timestamp: "2026-10-22T01:31:11.984Z",
+    sessionId: "5a128faa-8253-489e-b935-6c08e8e670c0",
+    requestId: "req_1",
+    message: {
+      id: "msg_1",
+      model: "claude-opus-5-5",
+      usage: {
+        input_tokens: 4,
+        cache_read_input_tokens: 118320,
+        cache_creation_input_tokens: 2676,
+        output_tokens: 4506,
+        speed: "standard",
+        iterations: [
+          {
+            type: "message",
+            input_tokens: 2,
+            cache_read_input_tokens: 58352,
+            cache_creation_input_tokens: 1616,
+            output_tokens: 141,
+          },
+          {
+            type: "advisor_message",
+            model: "claude-fable-5-1",
+            input_tokens: 54204,
+            cache_read_input_tokens: 0,
+            cache_creation_input_tokens: 0,
+            output_tokens: 4229,
+          },
+          {
+            type: "message",
+            input_tokens: 2,
+            cache_read_input_tokens: 59968,
+            cache_creation_input_tokens: 1060,
+            output_tokens: 4365,
+          },
+        ],
+      },
+    },
+  };
+  const withIterations = (iterations: readonly unknown[]) => ({
+    ...advisorTurn,
+    message: { ...advisorTurn.message, usage: { ...advisorTurn.message.usage, iterations } },
+  });
+  const parse = (turn: unknown) => claudeUsageFormat.parseLine(JSON.stringify(turn), undefined);
+
+  it("reports the advisor model's tokens as their own record beside the unchanged executor record", () => {
+    const executor = {
+      provider: "claude",
+      timestampMs: Date.parse("2026-10-22T01:31:11.984Z"),
+      model: "claude-opus-5-5",
+      sessionId: "5a128faa-8253-489e-b935-6c08e8e670c0",
+      totals: {
+        uncachedInputTokens: 4,
+        cachedInputTokens: 118320,
+        cacheCreationTokens: 2676,
+        outputTokens: 4506,
+        reasoningTokens: 0,
+      },
+      reportedCostUsd: null,
+      speed: "standard",
+      dedupeKey: "msg_1:req_1",
+    };
+    const expected = [
+      executor,
+      {
+        ...executor,
+        model: "claude-fable-5-1",
+        totals: {
+          uncachedInputTokens: 54204,
+          cachedInputTokens: 0,
+          cacheCreationTokens: 0,
+          outputTokens: 4229,
+          reasoningTokens: 0,
+        },
+        dedupeKey: expect.any(String),
+      },
+    ];
+
+    expect(parse(advisorTurn)).toEqual(expected);
+    expect(claudeUsageFormat.parseProjected(advisorTurn, undefined)).toEqual(expected);
+  });
+
+  it("keys the advisor record apart from the executor and the same across a message's content blocks", () => {
+    const block = (type: string) =>
+      parse({ ...advisorTurn, message: { ...advisorTurn.message, content: [{ type }] } });
+    const [executorKey, advisorKey] = block("text").map((record) => record.dedupeKey);
+
+    expect(advisorKey).toEqual(expect.any(String));
+    expect(advisorKey).not.toBe(executorKey);
+    expect(block("tool_use").map((record) => record.dedupeKey)).toEqual([executorKey, advisorKey]);
+
+    const unkeyed = parse({
+      ...advisorTurn,
+      requestId: undefined,
+      message: { ...advisorTurn.message, id: undefined },
+    });
+    expect(unkeyed.map((record) => record.dedupeKey)).toEqual([null, null]);
+  });
+
+  it("emits only the executor record without an advisor iteration", () => {
+    const executorIterations = advisorTurn.message.usage.iterations.filter(
+      (iteration) => iteration.type === "message",
+    );
+
+    expect(parse(withIterations(executorIterations))).toHaveLength(1);
+    expect(claudeUsageFormat.parseProjected(withIterations([]), undefined)).toHaveLength(1);
+    expect(
+      claudeUsageFormat.parseLine(
+        claudeLine({ messageId: "msg_3", contentType: "text" }),
+        undefined,
+      ),
+    ).toHaveLength(1);
+  });
+
+  it("ignores advisor iterations without a usable model and malformed entries", () => {
+    const unusable = withIterations([
+      null,
+      "advisor_message",
+      { type: "advisor_message", input_tokens: 5 },
+      { type: "advisor_message", model: "", input_tokens: 5 },
+      { type: "advisor_message", model: "<synthetic>", input_tokens: 5 },
+    ]);
+
+    expect(parse(unusable).map((record) => record.model)).toEqual(["claude-opus-5-5"]);
+  });
+});
diff --git a/apps/server/src/provider/Drivers/claudeUsage.ts b/apps/server/src/provider/Drivers/claudeUsage.ts
index c5ff71a5c839e..aca7696d31df5 100644
--- a/apps/server/src/provider/Drivers/claudeUsage.ts
+++ b/apps/server/src/provider/Drivers/claudeUsage.ts
@@ -20,35 +20,35 @@ export const CLAUDE_SYNTHETIC_MODEL = "<synthetic>";
  * the same complete `usage` object for the parent message. Summing them overcounts by roughly
  * 2.4x on a real workload, so the caller must drop repeats by `dedupeKey` and keep the first.
  */
-export function parseClaudeLine(line: string): UsageRecord | null {
+export function parseClaudeLine(line: string): readonly UsageRecord[] {
   let parsed: unknown;
   try {
     parsed = JSON.parse(line);
   } catch {
-    return null;
+    return [];
   }
   return parseClaudeRecord(parsed);
 }
 
-function parseClaudeRecord(parsed: unknown): UsageRecord | null {
-  if (typeof parsed !== "object" || parsed === null) return null;
+function parseClaudeRecord(parsed: unknown): readonly UsageRecord[] {
+  if (typeof parsed !== "object" || parsed === null) return [];
 
   const record = parsed as Record<string, unknown>;
-  if (record["type"] !== "assistant") return null;
+  if (record["type"] !== "assistant") return [];
 
   const message = record["message"];
-  if (typeof message !== "object" || message === null) return null;
+  if (typeof message !== "object" || message === null) return [];
   const messageRecord = message as Record<string, unknown>;
 
   const usage = messageRecord["usage"];
-  if (typeof usage !== "object" || usage === null) return null;
+  if (typeof usage !== "object" || usage === null) return [];
   const usageRecord = usage as Record<string, unknown>;
 
   const timestampMs = parseTimestampMs(record["timestamp"]);
-  if (timestampMs === null) return null;
+  if (timestampMs === null) return [];
 
   const model = typeof messageRecord["model"] === "string" ? messageRecord["model"] : "";
-  if (model.length === 0 || model === CLAUDE_SYNTHETIC_MODEL) return null;
+  if (model.length === 0 || model === CLAUDE_SYNTHETIC_MODEL) return [];
 
   const messageId = typeof messageRecord["id"] === "string" ? messageRecord["id"] : null;
   const requestId = typeof record["requestId"] === "string" ? record["requestId"] : null;
@@ -57,7 +57,7 @@ function parseClaudeRecord(parsed: unknown): UsageRecord | null {
 
   const cost = record["costUSD"];
 
-  return {
+  const executor: UsageRecord = {
     provider: "claude",
     timestampMs,
     model,
@@ -74,10 +74,40 @@ function parseClaudeRecord(parsed: unknown): UsageRecord | null {
     speed: usageRecord["speed"] === "fast" ? "fast" : "standard",
     dedupeKey,
   };
-}
 
-const orEmpty = (record: UsageRecord | null): readonly UsageRecord[] =>
-  record === null ? [] : [record];
+  // Top-level `usage` is the executor's alone. Advisor calls run on another model at its own rates
+  // and appear only in `iterations`, so each one is its own record under that model.
+  const records = [executor];
+  const iterations: readonly unknown[] = Array.isArray(usageRecord["iterations"])
+    ? usageRecord["iterations"]
+    : [];
+  for (const [index, iteration] of iterations.entries()) {
+    if (typeof iteration !== "object" || iteration === null) continue;
+    const advisor = iteration as Record<string, unknown>;
+    if (advisor["type"] !== "advisor_message") continue;
+
+    const advisorModel = typeof advisor["model"] === "string" ? advisor["model"] : "";
+    if (advisorModel.length === 0 || advisorModel === CLAUDE_SYNTHETIC_MODEL) continue;
+
+    records.push({
+      provider: "claude",
+      timestampMs,
+      model: advisorModel,
+      sessionId: executor.sessionId,
+      totals: {
+        uncachedInputTokens: tokenCount(advisor["input_tokens"]),
+        cachedInputTokens: tokenCount(advisor["cache_read_input_tokens"]),
+        cacheCreationTokens: tokenCount(advisor["cache_creation_input_tokens"]),
+        outputTokens: tokenCount(advisor["output_tokens"]),
+        reasoningTokens: 0,
+      },
+      reportedCostUsd: null,
+      speed: executor.speed,
+      dedupeKey: dedupeKey === null ? null : `${dedupeKey}:advisor:${index}`,
+    });
+  }
+  return records;
+}
 
 export const claudeUsageFormat: TranscriptUsageFormat<void> = {
   selectFields: {
@@ -89,8 +119,8 @@ export const claudeUsageFormat: TranscriptUsageFormat<void> = {
     message: { id: true, model: true, usage: true },
   },
   usageMarkers: ['"usage"'],
-  parseLine: (line) => orEmpty(parseClaudeLine(line)),
-  parseProjected: (projected) => orEmpty(parseClaudeRecord(projected)),
+  parseLine: (line) => parseClaudeLine(line),
+  parseProjected: (projected) => parseClaudeRecord(projected),
 };
 
 export const claudeUsageReader: ProviderUsageReader<ClaudeSettings, Path.Path> = {
diff --git a/apps/server/src/usage/UsageService.test.ts b/apps/server/src/usage/UsageService.test.ts
index bee7a8a480bc1..33f2332dbd4a5 100644
--- a/apps/server/src/usage/UsageService.test.ts
+++ b/apps/server/src/usage/UsageService.test.ts
@@ -2299,7 +2299,7 @@ describe("UsageService", () => {
             60 + 20 * (version === 4 ? 1 : 2),
           );
           yield* upgraded.awaitPersisted;
-          assert.strictEqual(SCAN_CACHE_FILE_NAME, "usage-scan-cache-v9.json");
+          assert.strictEqual(SCAN_CACHE_FILE_NAME, "usage-scan-cache-v10.json");
           assert.strictEqual(
             yield* Effect.promise(() => NodeFSP.readFile(legacyPath, "utf8")),
             legacy,
diff --git a/apps/server/src/usage/usageScanCache.test.ts b/apps/server/src/usage/usageScanCache.test.ts
index 552c97585b87e..be8ad53c6e45a 100644
--- a/apps/server/src/usage/usageScanCache.test.ts
+++ b/apps/server/src/usage/usageScanCache.test.ts
@@ -218,7 +218,11 @@ describe("scan cache round trip", () => {
       };
 
       const restored = decodeScanCache(JSON.parse(JSON.stringify(legacy)), TEST_FORMAT_MAP);
-      expect(restored.get("/gone.jsonl")).toEqual(original.get("/gone.jsonl"));
+      expect(restored.get("/gone.jsonl")).toEqual({
+        ...original.get("/gone.jsonl"),
+        size: -1,
+        position: { resumeOffset: 0, guardLength: 0, guardHash: 0, state: null },
+      });
       expect(restored.get("/gone-codex.jsonl")).toEqual({
         ...original.get("/gone-codex.jsonl"),
         size: -1,
@@ -245,6 +249,18 @@ describe("scan cache round trip", () => {
     },
   );
 
+  it("re-parses a Claude transcript cached before advisor usage was counted", () => {
+    const original = cacheWith([["/claude.jsonl", 100, [record()]]]);
+    const v9 = { ...encodeScanCache(original), version: 9 };
+
+    const restored = decodeScanCache(JSON.parse(JSON.stringify(v9)), TEST_FORMAT_MAP);
+    expect(restored.get("/claude.jsonl")).toEqual({
+      ...original.get("/claude.jsonl"),
+      size: -1,
+      position: { resumeOffset: 0, guardLength: 0, guardHash: 0, state: null },
+    });
+  });
+
   it("rewrites only changed entries and still restores the whole cache", () => {
     const write = makeScanCacheWriter();
     const cache = cacheWith([
diff --git a/apps/server/src/usage/usageScanCache.ts b/apps/server/src/usage/usageScanCache.ts
index a74bc1840c025..70c0c3df17e3e 100644
--- a/apps/server/src/usage/usageScanCache.ts
+++ b/apps/server/src/usage/usageScanCache.ts
@@ -9,7 +9,7 @@ import * as Schema from "effect/Schema";
 import { CLAUDE_SYNTHETIC_MODEL } from "../provider/Drivers/claudeUsage.ts";
 import { GUARD_LENGTH, type TranscriptParsePosition } from "./usageTranscriptReader.ts";
 
-const USAGE_SCAN_CACHE_VERSION = 9 as const;
+const USAGE_SCAN_CACHE_VERSION = 10 as const;
 const SPEED_COMPATIBLE_SINCE_VERSION = 4;
 
 /**
@@ -17,8 +17,9 @@ const SPEED_COMPATIBLE_SINCE_VERSION = 4;
  * replace it, dropping saved usage for deleted transcripts. Separate files keep
  * both.
  */
-export const SCAN_CACHE_FILE_NAME = "usage-scan-cache-v9.json";
+export const SCAN_CACHE_FILE_NAME = "usage-scan-cache-v10.json";
 export const LEGACY_SCAN_CACHE_FILE_NAMES = [
+  "usage-scan-cache-v9.json",
   "usage-scan-cache-v8.json",
   "usage-scan-cache-v7.json",
   "usage-scan-cache-v6.json",
@@ -291,10 +292,12 @@ export function decodeScanCache(
     }
     // Keep history for deleted rollouts, but re-parse incompatible reducer state.
     // v9 repairs skipped initial Codex requests; clean v8 entries can still resume.
+    // v10 adds Claude advisor calls, which no older Claude entry holds.
     const legacy =
-      format.state !== undefined &&
-      (version < 6 ||
-        (entry.p === "codex" && (version < 8 || (version < 9 && malformedRecords > 0))));
+      (entry.p === "claude" && version < 10) ||
+      (format.state !== undefined &&
+        (version < 6 ||
+          (entry.p === "codex" && (version < 8 || (version < 9 && malformedRecords > 0)))));
     // A corrupt state disqualifies the entry: resuming with it would attach
     // appended usage to the wrong model or replay fork-copied history.
     if (!legacy && !isValidState.get(entry.p)?.(entry.cs)) continue;

From d5536f6052c0027533f40bd9520827b69946d056 Mon Sep 17 00:00:00 2001
From: shivam <91240327+shivamhwp@users.noreply.github.com>
Date: Fri, 30 Oct 2026 10:43:05 +0530
Subject: [PATCH 132/146] fix(web): name the sidebar logo link T3 Code home
 (#24209)

Co-authored-by: PR Batch Tester <agent@local.test>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Julius Marminge <julius0216@outlook.com>
---
 apps/web/src/components/sidebar/SidebarChrome.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/src/components/sidebar/SidebarChrome.tsx b/apps/web/src/components/sidebar/SidebarChrome.tsx
index e233a4144d435..b136d47fd9c40 100644
--- a/apps/web/src/components/sidebar/SidebarChrome.tsx
+++ b/apps/web/src/components/sidebar/SidebarChrome.tsx
@@ -103,7 +103,7 @@ export function SidebarBrandWidthProbe({
 function SidebarBrand({ onBackdrop }: { onBackdrop: boolean }) {
   return (
     <Link
-      aria-label="Go to threads"
+      aria-label="T3 Code home"
       className={cn(
         "relative z-10 ml-[var(--workspace-titlebar-content-left)] hidden h-7 w-fit min-w-0 shrink-0 items-center overflow-hidden rounded-md outline-hidden ring-ring focus-visible:ring-2 focus-visible:ring-inset md:flex",
         onBackdrop ? "text-white" : "text-foreground",

From 0a455d725878f653b3df607eaaff18fbfa90db99 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:14:17 -0700
Subject: [PATCH 133/146] fix(server): fail Claude turns waiting for
 unsupported mod input (#24320)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Adapters/ClaudeAdapterV2.test.ts          | 166 ++++++++++++++++++
 .../Adapters/ClaudeAdapterV2.ts               |  38 ++++
 2 files changed, 204 insertions(+)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index fb17c34713fd8..c38ec736884ea 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -9159,6 +9159,172 @@ describe("ClaudeAdapterV2 background wake turns", () => {
     ),
   );
 
+  // regression: #17531 a mod that holds a tool behind a focused pane must fail the turn, not hang it
+  it.effect.each([
+    { case: "fails a turn whose mod requests focus for a pane T3 cannot show", focus: true },
+    { case: "keeps a turn running beside a passive mod pane", focus: false },
+  ] as const)("$case", ({ focus }) =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const closed = yield* Deferred.make<void>();
+        const harness = yield* makeWakeHarnessWithOptions({
+          close: () => Deferred.succeed(closed, undefined),
+        });
+        const now = yield* DateTime.now;
+        yield* harness.runtime.startTurn(
+          makeClaudeTestTurnInput({
+            threadId: harness.threadId,
+            providerThread: harness.providerThread,
+            now,
+            attemptId: RunAttemptId.make("attempt-claude-mod-pane-focus"),
+            text: "Run rm -r build",
+            attachments: [],
+          }),
+        );
+        // Captured from Claude 2.1.303 with the blast-radius mod holding a Bash
+        // call: the mod waits for keyboard input in its pane and nothing else
+        // arrives until it gives up.
+        yield* Queue.offer(
+          harness.sdkMessages,
+          claudeSdkFrame({
+            type: "system",
+            subtype: "ui_panes",
+            panes: [
+              { id: "blast-radius", title: "Blast Radius", plugin: "blast-radius", rows: 10 },
+            ],
+            shown_id: "blast-radius",
+            focused_id: null,
+            focus_requested_id: focus ? "blast-radius" : null,
+            uuid: "00000000-0000-4000-8000-000000000795",
+            session_id: WAKE_NATIVE_SESSION,
+          }),
+        );
+        yield* Queue.offer(
+          harness.sdkMessages,
+          claudeSdkFrame({
+            type: "system",
+            subtype: "ui_invalidate",
+            event: "ui.render",
+            uuid: "00000000-0000-4000-8000-000000000796",
+            session_id: WAKE_NATIVE_SESSION,
+          }),
+        );
+        // Frames are handled in order, so a later notice proves the pane frame
+        // was handled without the turn ending.
+        yield* Queue.offer(
+          harness.sdkMessages,
+          claudeSdkFrame({
+            type: "system",
+            subtype: "informational",
+            content: "Processing barrier.",
+            level: "warning",
+            uuid: "00000000-0000-4000-8000-000000000797",
+            session_id: WAKE_NATIVE_SESSION,
+          }),
+        );
+        yield* harness.until(
+          () =>
+            harness.terminalEvents().length > 0 ||
+            harness.events.some(
+              (event) =>
+                event.type === "turn_item.updated" && event.turnItem.type === "system_notice",
+            ),
+        );
+        const [terminal] = harness.terminalEvents();
+        if (!focus) {
+          assert.equal(terminal, undefined);
+          return;
+        }
+        assert.equal(terminal?.status, "failed");
+        if (terminal?.status !== "failed") return;
+        assert.include(terminal.failure.message, "blast-radius");
+        // The held tool call is abandoned by closing the query, never answered.
+        yield* Deferred.await(closed);
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(IdAllocator.layer, McpProviderSessions.layer, NodeServices.layer),
+        ),
+      ),
+    ),
+  );
+
+  // regression: #17531 a follow-up sent while the failed mod turn's process closes gets a new process
+  it.effect("runs a follow-up in a fresh query while the mod-blocked query is closing", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const releaseClose = yield* Deferred.make<void>();
+        const replacementClosedOld = yield* Deferred.make<void>();
+        let oldCloses = 0;
+        const harness = yield* makeWakeHarnessWithOptions({
+          // The held CLI never answers an interrupt; closure must not need one.
+          interrupt: Effect.never,
+          close: (sdkMessages) =>
+            Effect.suspend(() =>
+              ++oldCloses === 2 ? Deferred.succeed(replacementClosedOld, undefined) : Effect.void,
+            ).pipe(
+              Effect.andThen(Deferred.await(releaseClose)),
+              Effect.andThen(Queue.shutdown(sdkMessages)),
+            ),
+          freshQueueOnReopen: true,
+        });
+        // Added after the harness so it runs first: a failed assertion must not
+        // leave teardown waiting on the held close.
+        yield* Effect.addFinalizer(() => Deferred.succeed(releaseClose, undefined));
+        const now = yield* DateTime.now;
+        const turnInput = makeClaudeTestTurnInput({
+          threadId: harness.threadId,
+          providerThread: harness.providerThread,
+          now,
+          attemptId: RunAttemptId.make("attempt-claude-mod-pane-blocked"),
+          text: "Run rm -r build",
+          attachments: [],
+        });
+        yield* harness.runtime.startTurn(turnInput);
+        yield* Queue.offer(
+          harness.sdkMessages,
+          claudeSdkFrame({
+            type: "system",
+            subtype: "ui_panes",
+            panes: [
+              { id: "blast-radius", title: "Blast Radius", plugin: "blast-radius", rows: 10 },
+            ],
+            shown_id: "blast-radius",
+            focused_id: null,
+            focus_requested_id: "blast-radius",
+            uuid: "00000000-0000-4000-8000-000000000798",
+            session_id: WAKE_NATIVE_SESSION,
+          }),
+        );
+        assert.equal((yield* Queue.take(harness.terminalReceipts)).status, "failed");
+
+        const followUp = yield* harness.runtime
+          .startTurn({
+            ...turnInput,
+            attemptId: RunAttemptId.make("attempt-claude-after-mod-pane"),
+            providerTurnOrdinal: 2,
+          })
+          .pipe(Effect.forkScoped);
+        // Reusing the closing process would offer the prompt to it instead.
+        yield* Effect.raceFirst(
+          Deferred.await(replacementClosedOld),
+          harness.until(() => harness.offeredMessages.length >= 2),
+        );
+        assert.isTrue(yield* Deferred.isDone(replacementClosedOld));
+        yield* Deferred.succeed(releaseClose, undefined);
+        yield* Fiber.join(followUp);
+        assert.equal(harness.processQueues.length, 2);
+        yield* harness.offerAndWait(
+          makeResultFrame({ uuid: "after-mod-pane-result", result: "Done." }),
+        );
+        assert.equal((yield* Queue.take(harness.terminalReceipts)).status, "completed");
+      }).pipe(
+        Effect.provide(
+          Layer.mergeAll(IdAllocator.layer, McpProviderSessions.layer, NodeServices.layer),
+        ),
+      ),
+    ),
+  );
+
   // regression: #16897 a prompt whose uuid the session already holds must not hang or end early
   it.effect("keeps a started prompt running until its result", () =>
     Effect.scoped(
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index 496a0b2e77d0f..de13c4bb6d106 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -4213,6 +4213,20 @@ function claudeTaskString(value: unknown, key: string): string | undefined {
   return typeof field === "string" && field.trim().length > 0 ? field.trim() : undefined;
 }
 
+// A Claude Code mod can hold a tool call until the user acts in its terminal
+// pane. T3 cannot provide the requested pane interaction (#17531).
+// Passive panes never request focus and keep working.
+function claudeFocusRequestedPanePlugin(message: SDKMessage): string | null {
+  if (message.type !== "system" || claudeTaskField(message, "subtype") !== "ui_panes") return null;
+  const paneId = claudeTaskString(message, "focus_requested_id");
+  if (paneId === undefined) return null;
+  const panes = claudeTaskField(message, "panes");
+  const pane = Array.isArray(panes)
+    ? panes.find((entry) => claudeTaskField(entry, "id") === paneId)
+    : undefined;
+  return claudeTaskString(pane, "plugin") ?? paneId;
+}
+
 function claudeTaskStatus(value: unknown): OrchestrationV2PlanStep["status"] | undefined {
   switch (value) {
     case "pending":
@@ -8182,6 +8196,28 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
             }
             return;
           }
+          const focusedPlugin = claudeFocusRequestedPanePlugin(message);
+          if (focusedPlugin !== null && context === (yield* Ref.get(activeTurn))) {
+            yield* Effect.logWarning("orchestration-v2.claude-mod-pane-focus-unsupported", {
+              providerTurnId: context.providerTurnId,
+              plugin: focusedPlugin,
+            });
+            liveQuery.stopping = true;
+            yield* finalizeActiveTurn({
+              context,
+              status: "failed",
+              completedAt: yield* DateTime.now,
+              failure: makeProviderFailure({
+                class: "provider_error",
+                code: "claude_mod_ui_unsupported",
+                message: `The Claude Code mod "${focusedPlugin}" is waiting for input in its terminal pane, which T3 Code cannot show. Disable the mod for sessions run from T3 Code, or run the task in the Claude Code terminal.`,
+              }),
+            });
+            // Closing ends the CLI process and abandons the held tool call
+            // without answering it. Not interrupt: the held CLI may never ack it.
+            yield* liveQuery.query.close.pipe(Effect.ignore);
+            return;
+          }
           yield* trackClaudeGoal({ nativeThreadId: liveQuery.nativeThreadId, context, message });
 
           if (message.type === "stream_event" && !message.parent_tool_use_id) {
@@ -9817,6 +9853,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
           if (
             existing !== null &&
             existing.nativeThreadId === nativeThreadId &&
+            !existing.stopping &&
             isClaudeProviderContinuationTurn(turnInput)
           ) {
             return existing;
@@ -9848,6 +9885,7 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
             existing !== null &&
             existing.nativeThreadId === nativeThreadId &&
             existing.queryPolicyKey === queryPolicyKey &&
+            !existing.stopping &&
             existing.selection.queryIdentity === compiledSelection.queryIdentity
           ) {
             // A denied ExitPlanMode leaves Claude in plan mode. Restore only from plan:

From 6b1245cceda1d504b6f16b438e16f2a2e08f3388 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:20:05 -0700
Subject: [PATCH 134/146] fix(server): Stop always completes, and an agent that
 ignores it can be force stopped (#27252)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../features/threads/ThreadDetailScreen.tsx   |  76 ++++++++
 .../threads/floating-working-control.tsx      |  28 ++-
 .../threads/floating-working-status.ts        |   6 +
 apps/server/src/auth/RpcAuthorization.ts      |   1 +
 .../src/environment/ServerEnvironment.ts      |   1 +
 .../src/observability/RpcInstrumentation.ts   |   1 +
 .../Adapters/AcpAdapterV2.test.ts             |  90 +++++++++
 .../Adapters/ClaudeAdapterV2.ts               |  46 ++---
 .../src/orchestration-v2/EffectWorker.test.ts |  20 +-
 .../src/orchestration-v2/EffectWorker.ts      |  49 +++--
 .../src/orchestration-v2/Orchestrator.ts      |  59 +++++-
 .../ProviderSessionManager.test.ts            | 158 +++++++++++++++-
 .../ProviderSessionManager.ts                 | 139 ++++++++++++--
 .../ProviderTurnControlService.test.ts        |   2 +
 .../ProviderTurnControlService.ts             |  27 ++-
 .../ThreadManagementService.test.ts           | 173 ++++++++++++++++++
 .../ThreadManagementService.ts                | 166 +++++++++++++++++
 .../src/orchestration-v2/ThreadStop.test.ts   | 112 ++++++++++++
 apps/server/src/process/agentScope.test.ts    |  32 ++++
 apps/server/src/process/agentScope.ts         |  44 ++++-
 .../src/relay/AgentAwarenessRelay.test.ts     |   1 +
 apps/server/src/ws.ts                         |   2 +
 apps/web/src/components/ChatView.tsx          |  12 +-
 .../components/chat/ThreadActivityBanners.tsx |  43 +++++
 .../src/components/chat/useForceStopThread.ts |  59 ++++++
 .../components/chat/useThreadLifecycle.tsx    |  35 +++-
 .../client-runtime/src/state/orchestration.ts |   4 +
 .../client-runtime/src/state/threadDetail.ts  |  28 +++
 .../src/state/threadExecution.test.ts         |  69 +++++++
 .../src/state/threadExecution.ts              |  49 +++++
 .../contracts/src/clientRpcPermissions.ts     |   2 +
 packages/contracts/src/environment.ts         |   2 +
 packages/contracts/src/orchestrationV2.ts     |  53 ++++++
 packages/contracts/src/rpc.ts                 |   8 +
 packages/provider-acp/src/server/adapter.ts   |  61 +++---
 .../src/server/ProviderAdapter.ts             |  16 ++
 packages/shared/src/AgentScope.ts             |   7 +
 37 files changed, 1583 insertions(+), 98 deletions(-)
 create mode 100644 apps/web/src/components/chat/useForceStopThread.ts

diff --git a/apps/mobile/src/features/threads/ThreadDetailScreen.tsx b/apps/mobile/src/features/threads/ThreadDetailScreen.tsx
index 27655f503bd65..6695e7963eff0 100644
--- a/apps/mobile/src/features/threads/ThreadDetailScreen.tsx
+++ b/apps/mobile/src/features/threads/ThreadDetailScreen.tsx
@@ -46,6 +46,7 @@ import type {
   ScopedThreadRef,
   ServerConfig as T3ServerConfig,
   UsageLimitsReport,
+  RunId,
 } from "@t3tools/contracts";
 import {
   appendCodexArtifactTemplateUsePrompt,
@@ -156,8 +157,10 @@ import {
 import { appAtomRegistry } from "../../state/atom-registry";
 import { threadStreamHaptics } from "./threadStreamHaptics";
 import { useAtomCommand } from "../../state/use-atom-command";
+import { orchestrationEnvironment } from "../../state/orchestration";
 import { useDelayedStatus } from "../../lib/useDelayedStatus";
 import type { PendingUserInputDraftAnswer } from "@t3tools/client-runtime/state/pending-user-input";
+import type { RunStopPresentation } from "@t3tools/client-runtime/state/thread-execution";
 import type {
   PendingApproval,
   PendingUserInput,
@@ -339,6 +342,9 @@ const threadVisitTracker = createThreadVisitTracker({
 
 // Past the composer's 180 ms height animation.
 const COMPOSER_HEIGHT_SETTLE_MS = 220;
+const NO_RUN_STOP_ATOM = Atom.make<RunStopPresentation | null>(null).pipe(
+  Atom.withLabel("mobile-thread-run-stop:empty"),
+);
 
 // Anchors, the submitted message, follow state and pending scrolls belong to
 // one thread, so the body remounts when the thread changes.
@@ -528,6 +534,50 @@ function ThreadDetailBody(props: ThreadDetailScreenProps) {
   const unsettleThread = useAtomCommand(threadEnvironment.unsettle, { reportFailure: false });
   const updateMetadata = useAtomCommand(threadEnvironment.updateMetadata, { reportFailure: false });
   const visitThread = useAtomCommand(threadEnvironment.visit, { reportFailure: false });
+  const anyRunStop = useAtomValue(
+    props.selectedThreadDetailRef === null
+      ? NO_RUN_STOP_ATOM
+      : environmentThreadDetails.runStopAtom(props.selectedThreadDetailRef),
+  );
+  // A background Stop matters only while that work is still pending.
+  const runStop =
+    anyRunStop?.background && props.selectedThread.pendingBackgroundTasks.length === 0
+      ? null
+      : anyRunStop;
+  const forceStopThread = useAtomCommand(orchestrationEnvironment.forceStopThread, {
+    reportFailure: false,
+  });
+  const canForceStop =
+    useAtomValue(orchestrationEnvironment.forceStopThread.permissionAtom(props.environmentId)) &&
+    props.serverConfig?.environment.capabilities.threadForceStop === true;
+  const [forceStoppingKey, setForceStoppingKey] = useState<string | null>(null);
+  // The run that ignored Stop, so a confirmation left open cannot hit a newer run.
+  const forceStop = async (runId: RunId | undefined) => {
+    const threadKey = selectedThreadKey;
+    setForceStoppingKey(threadKey);
+    const result = await forceStopThread({
+      environmentId: props.environmentId,
+      input:
+        runId === undefined
+          ? { threadId: props.selectedThread.id }
+          : { threadId: props.selectedThread.id, runId },
+    });
+    setForceStoppingKey((current) => (current === threadKey ? null : current));
+    if (result._tag === "Failure") {
+      if (!isAtomCommandInterrupted(result)) Dialog.alert("Could not force stop the agent");
+      return;
+    }
+    const others = result.value.sharedWithThreadIds.length;
+    if (result.value.outcome === "releasing") {
+      Dialog.alert("Turn stopped; the agent is still shutting down");
+    }
+    if (result.value.outcome === "shared") {
+      Dialog.alert(
+        "Turn stopped; the agent process kept running",
+        `It is shared with ${others === 0 ? "other" : others} working ${others === 1 ? "thread" : "threads"}. Stop those to free it.`,
+      );
+    }
+  };
   const [statusRequest, setStatusRequest] = useState<{ threadKey: string } | null>(null);
   const statusPending = statusRequest?.threadKey === selectedThreadKey;
   const [lifecycleNow, setLifecycleNow] = useState(() => new Date().toISOString());
@@ -619,6 +669,32 @@ function ThreadDetailBody(props: ThreadDetailScreenProps) {
     if (connectionStatus !== null && !props.draftMode) {
       return connectionStatus;
     }
+    // Before the request check: an agent stuck on an approval may also ignore Stop.
+    if (runStop !== null && contentPresentationKind === "ready") {
+      const unresponsive = runStop.state === "unresponsive";
+      return {
+        kind: "stop",
+        unresponsive,
+        label: unresponsive ? "Not responding to Stop" : "Stopping…",
+        action:
+          unresponsive && canForceStop
+            ? {
+                label: forceStoppingKey === selectedThreadKey ? "Force stopping..." : "Force stop",
+                accessibilityLabel: "Force stop the agent",
+                disabled: forceStoppingKey === selectedThreadKey,
+                onPress: () =>
+                  Dialog.confirm({
+                    title: "Force stop the agent?",
+                    message:
+                      "It has not answered Stop. Force stop ends the turn and kills the agent's processes, unless other working threads share them.",
+                    confirmText: "Force stop",
+                    destructive: true,
+                    onConfirm: () => void forceStop(runStop.runId),
+                  }),
+              }
+            : null,
+      };
+    }
     if (props.activePendingApproval !== null || props.activePendingUserInput !== null) {
       return null;
     }
diff --git a/apps/mobile/src/features/threads/floating-working-control.tsx b/apps/mobile/src/features/threads/floating-working-control.tsx
index 3709cf2affa86..c1440535e9cad 100644
--- a/apps/mobile/src/features/threads/floating-working-control.tsx
+++ b/apps/mobile/src/features/threads/floating-working-control.tsx
@@ -83,7 +83,9 @@ export function FloatingWorkingControl(props: {
   const [queueWidth, setQueueWidth] = useState(0);
   const [actionWidth, setActionWidth] = useState(0);
   const action =
-    props.status?.kind === "background" || props.status?.kind === "lifecycle"
+    props.status?.kind === "background" ||
+    props.status?.kind === "lifecycle" ||
+    props.status?.kind === "stop"
       ? props.status.action
       : null;
   const [agentsWidth, setAgentsWidth] = useState(0);
@@ -471,6 +473,30 @@ function FloatingStatusLabel(props: {
       </StatusLabelRow>
     );
   }
+  if (props.status.kind === "stop") {
+    return (
+      <StatusLabelRow
+        key="stop"
+        accessibilityLabel={props.status.label}
+        className="gap-2"
+        onLayout={props.onLayout}
+      >
+        {props.status.unresponsive ? (
+          <SymbolView
+            name="exclamationmark.triangle"
+            size={13}
+            tintColorClassName="accent-warning-foreground"
+            type="monochrome"
+          />
+        ) : (
+          <AppActivityIndicator size="small" colorClassName="accent-icon-muted" />
+        )}
+        <Text className="shrink font-t3-medium text-xs text-foreground" numberOfLines={1}>
+          {props.status.label}
+        </Text>
+      </StatusLabelRow>
+    );
+  }
   if (props.status.kind === "goal") {
     return (
       <StatusLabelRow
diff --git a/apps/mobile/src/features/threads/floating-working-status.ts b/apps/mobile/src/features/threads/floating-working-status.ts
index 264d110f75f74..2892b4aafa51b 100644
--- a/apps/mobile/src/features/threads/floating-working-status.ts
+++ b/apps/mobile/src/features/threads/floating-working-status.ts
@@ -31,6 +31,12 @@ export type FloatingWorkingStatus =
       readonly label: string;
       readonly action: FloatingStatusAction;
     }
+  | {
+      readonly kind: "stop";
+      readonly label: string;
+      readonly unresponsive: boolean;
+      readonly action: FloatingStatusAction | null;
+    }
   | { readonly kind: "goal"; readonly label: string; readonly accessibilityLabel: string }
   | { readonly kind: "preparing"; readonly label: string }
   | {
diff --git a/apps/server/src/auth/RpcAuthorization.ts b/apps/server/src/auth/RpcAuthorization.ts
index a1b05c32a0027..ecda5f8abc61b 100644
--- a/apps/server/src/auth/RpcAuthorization.ts
+++ b/apps/server/src/auth/RpcAuthorization.ts
@@ -42,6 +42,7 @@ export const RPC_REQUIRED_SCOPES = {
   [ORCHESTRATION_V2_WS_METHODS.dispatchCommand]: AuthOrchestrationOperateScope,
   [ORCHESTRATION_V2_WS_METHODS.getWorkflowScript]: AuthOrchestrationReadScope,
   [ORCHESTRATION_V2_WS_METHODS.stopWorkflow]: AuthOrchestrationOperateScope,
+  [ORCHESTRATION_V2_WS_METHODS.forceStopThread]: AuthOrchestrationOperateScope,
   [ORCHESTRATION_V2_WS_METHODS.getTurnDiff]: AuthOrchestrationReadScope,
   [ORCHESTRATION_V2_WS_METHODS.getFullThreadDiff]: AuthOrchestrationReadScope,
   [ORCHESTRATION_V2_WS_METHODS.searchThreads]: AuthOrchestrationReadScope,
diff --git a/apps/server/src/environment/ServerEnvironment.ts b/apps/server/src/environment/ServerEnvironment.ts
index cef18fbe325c3..5e0bcfc742e08 100644
--- a/apps/server/src/environment/ServerEnvironment.ts
+++ b/apps/server/src/environment/ServerEnvironment.ts
@@ -240,6 +240,7 @@ export const make = Effect.gen(function* () {
       projectSettingsOverrides: true,
       projectProviderInstanceOverrides: true,
       threadSnooze: true,
+      threadForceStop: true,
       environmentThemes: true,
       usageLimitSources: true,
       providerWorkspaceSnapshotsOnDemand: true,
diff --git a/apps/server/src/observability/RpcInstrumentation.ts b/apps/server/src/observability/RpcInstrumentation.ts
index 259fa92a66023..028ea5a561d44 100644
--- a/apps/server/src/observability/RpcInstrumentation.ts
+++ b/apps/server/src/observability/RpcInstrumentation.ts
@@ -14,6 +14,7 @@ const RPC_AGGREGATES = {
   [ORCHESTRATION_V2_WS_METHODS.dispatchCommand]: "orchestrationV2",
   [ORCHESTRATION_V2_WS_METHODS.getWorkflowScript]: "orchestration",
   [ORCHESTRATION_V2_WS_METHODS.stopWorkflow]: "orchestration",
+  [ORCHESTRATION_V2_WS_METHODS.forceStopThread]: "orchestration",
   [ORCHESTRATION_V2_WS_METHODS.getTurnItem]: "orchestration",
   [ORCHESTRATION_V2_WS_METHODS.getTurnDiff]: "orchestration",
   [ORCHESTRATION_V2_WS_METHODS.getFullThreadDiff]: "orchestration",
diff --git a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
index 8a68e92b89160..b924f6efb3e70 100644
--- a/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.test.ts
@@ -7498,6 +7498,96 @@ describe("AcpAdapterV2", () => {
     }).pipe(Effect.provide(layerTest), Effect.scoped),
   );
 
+  it.live("lets a caller abandon Stop while hard teardown stalls, and finishes the teardown", () =>
+    Effect.gen(function* () {
+      const childProcessSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const idAllocator = yield* IdAllocator.IdAllocatorV2;
+      const path = yield* Path.Path;
+      const selfInvocation = yield* resolveSelfInvocation();
+      const mockAgentPath = yield* path.fromFileUrl(
+        new URL("../../../scripts/acp-mock-agent.ts", import.meta.url),
+      );
+      const protocolEvents = yield* Queue.bounded<EffectAcpProtocol.AcpProtocolLogEvent>(256);
+      const teardownStarted = yield* Deferred.make<void>();
+      const releaseTeardown = yield* Deferred.make<void>();
+      let runtimeOrdinalSeen = 0;
+      const instanceId = ProviderInstanceId.make("acp-test");
+      const adapter = yield* makeAcpAdapterV2({
+        instanceId,
+        flavor: {
+          driver: ACP_TEST_DRIVER,
+          capabilities: AcpProviderCapabilitiesV2,
+          interruptPromptOnCancel: true,
+          restartRuntimeAfterInterrupt: true,
+          terminateRuntimeProcessGroupOnInterrupt: true,
+          makeRuntime: makeMockRuntime({
+            childProcessSpawner,
+            mockAgentPath,
+            ownDetachedProcessGroup: true,
+            processGroupPlatform: "win32",
+            windowsProcessTreeTerminator: () =>
+              Deferred.succeed(teardownStarted, undefined).pipe(
+                Effect.andThen(Deferred.await(releaseTeardown)),
+              ),
+            environment: (runtimeOrdinal) => {
+              runtimeOrdinalSeen = runtimeOrdinal;
+              return runtimeOrdinal === 1 ? { T3_ACP_HANG_PROMPT_FOREVER: "1" } : {};
+            },
+            protocolEvents,
+          }),
+        },
+        selfInvocation,
+      });
+      const threadId = ThreadId.make("thread-acp-abandoned-hard-teardown");
+      const runtimePolicy = ProviderAdapter.ProviderAdapterV2RuntimePolicy.make({
+        runtimeMode: "full-access",
+        interactionMode: "default",
+        cwd: process.cwd(),
+      });
+      const modelSelection = { instanceId, model: "default" } as const;
+      const runtime = yield* adapter.openSession({
+        threadId,
+        providerSessionId: ProviderSessionId.make("provider-session-acp-abandoned-hard-teardown"),
+        modelSelection,
+        runtimePolicy,
+      });
+      const providerThread = yield* runtime.ensureThread({
+        threadId,
+        modelSelection,
+        runtimePolicy,
+      });
+      const now = yield* DateTime.now;
+      yield* runtime
+        .startTurn(
+          makeTurnInput({ threadId, providerThread, instanceId, runtimePolicy, now, ordinal: 1 }),
+        )
+        .pipe(Effect.forkScoped);
+      const providerTurnId = idAllocator.derive.providerTurn({
+        driver: ACP_TEST_DRIVER,
+        nativeTurnId: acpScopedNativeId(instanceId, "mock-session-1:turn:1"),
+      });
+      yield* pollProtocolMethods(protocolEvents);
+      const interruptFiber = yield* runtime
+        .interruptTurn({ providerThread, providerTurnId, requestRuntimeRestart: true })
+        .pipe(Effect.forkScoped);
+      yield* Deferred.await(teardownStarted);
+
+      // The session manager's Stop timeout interrupts this call; it must not wait for teardown.
+      yield* Fiber.interrupt(interruptFiber);
+
+      const startFiber = yield* runtime
+        .startTurn(
+          makeTurnInput({ threadId, providerThread, instanceId, runtimePolicy, now, ordinal: 2 }),
+        )
+        .pipe(Effect.forkScoped);
+      yield* Deferred.succeed(releaseTeardown, undefined);
+      yield* Fiber.join(startFiber);
+      assert.equal(runtimeOrdinalSeen, 2);
+      const replacementMethods = yield* pollProtocolMethods(protocolEvents);
+      assert.equal(replacementMethods.filter((method) => method === "session/resume").length, 1);
+    }).pipe(Effect.provide(layerTest), Effect.scoped),
+  );
+
   it.effect(
     "direct Stop on a deferred subagent hold terminalizes the subagent and does not carry it forward",
     () =>
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index de13c4bb6d106..a821a4713b292 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -322,6 +322,8 @@ const WORKFLOW_MEMBER_TRANSCRIPT_FLUSH_MS = 500;
 // A steer waits at most this long, from its request, for its foreground
 // subagents to move to the background before it is sent.
 const BACKGROUND_MOVE_TIMEOUT_MS = 5_000;
+// How long a Stop waits for the CLI to exit before the user is offered Force stop.
+const CLAUDE_STOP_CONFIRM_TIMEOUT_MS = 10_000;
 
 const CLAUDE_GROUP_WATCH_SCRIPT = [
   "{ trap '' TERM; read -r _ <&3; kill -TERM 0; sleep 5; kill -KILL 0; } </dev/null >/dev/null 2>&1 &",
@@ -10471,44 +10473,36 @@ export const makeClaudeAdapterV2 = Effect.fn("makeClaudeAdapterV2")(function* (
             yield* existing.query.interrupt;
             yield* existing.query.close.pipe(Effect.ignore);
             const closed = yield* Deferred.await(existing.closed).pipe(
-              Effect.timeoutOption("10 seconds"),
+              Effect.timeoutOption(CLAUDE_STOP_CONFIRM_TIMEOUT_MS),
             );
             if (Option.isSome(closed)) {
               return;
             }
-
-            const completedAt = yield* DateTime.now;
+            // The turn stays open: the CLI may still be working, and the user decides
+            // whether to Force stop it.
             yield* Effect.logWarning("orchestration-v2.claude-query-interrupt-timeout", {
               providerSessionId: input.providerSessionId,
               providerThreadId: turnInput.providerThread.id,
               providerTurnId: turnInput.providerTurnId,
             });
-            const ownedLiveQuery = yield* Ref.modify(queryContext, (current) =>
-              current?.query === existing.query ? [true, null] : [false, current],
-            );
-            if (ownedLiveQuery) {
-              existing.stopping = true;
-              yield* finalizeActiveTurnAfterQueryExit(existing);
-              yield* endSubagentCallsOfClosedQuery(existing.nativeThreadId, "interrupted");
-            } else {
-              yield* finalizeActiveTurn({
-                context: currentTurn,
-                status: "interrupted",
-                completedAt,
-              });
-            }
-            yield* Deferred.succeed(existing.closed, undefined);
+            return yield* new ProviderAdapter.ProviderAdapterInterruptTimeoutError({
+              driver: CLAUDE_PROVIDER,
+              providerThreadId: turnInput.providerThread.id,
+              providerTurnId: turnInput.providerTurnId,
+              timeoutMs: CLAUDE_STOP_CONFIRM_TIMEOUT_MS,
+            });
           },
           (effect, turnInput) =>
             effect.pipe(
-              Effect.mapError(
-                (cause) =>
-                  new ProviderAdapter.ProviderAdapterInterruptError({
-                    driver: CLAUDE_PROVIDER,
-                    providerThreadId: turnInput.providerThread.id,
-                    providerTurnId: turnInput.providerTurnId,
-                    cause,
-                  }),
+              Effect.mapError((cause) =>
+                cause._tag === "ProviderAdapterInterruptTimeoutError"
+                  ? cause
+                  : new ProviderAdapter.ProviderAdapterInterruptError({
+                      driver: CLAUDE_PROVIDER,
+                      providerThreadId: turnInput.providerThread.id,
+                      providerTurnId: turnInput.providerTurnId,
+                      cause,
+                    }),
               ),
             ),
         );
diff --git a/apps/server/src/orchestration-v2/EffectWorker.test.ts b/apps/server/src/orchestration-v2/EffectWorker.test.ts
index cb130930372c8..2329f2aa20cf0 100644
--- a/apps/server/src/orchestration-v2/EffectWorker.test.ts
+++ b/apps/server/src/orchestration-v2/EffectWorker.test.ts
@@ -111,6 +111,8 @@ function layerExecutorFor(input: {
         closeInstance: () => Effect.void,
         release: () => record("release"),
         detach: () => record("detach"),
+        otherWorkingThreads: () => Effect.succeed([]),
+        releaseUnlessBusy: () => Effect.succeed(true),
       }),
     ),
     Layer.succeed(
@@ -167,7 +169,18 @@ function layerExecutorFor(input: {
   );
 }
 
-it.effect("settles a stopped run when its adapter has already lost the native turn", () =>
+it.effect.each([
+  {
+    name: "settles a stopped run when its adapter has already lost the native turn",
+    unresponsive: false,
+    dispatched: ["thread.background-work.settle"],
+  },
+  {
+    name: "leaves the run running and flags the Stop when the provider never confirms it",
+    unresponsive: true,
+    dispatched: ["thread.interrupt.unresponsive"],
+  },
+])("$name", ({ unresponsive, dispatched }) =>
   Effect.gen(function* () {
     const now = yield* DateTime.now;
     const events = yield* Ref.make<ReadonlyArray<string>>([]);
@@ -178,7 +191,8 @@ it.effect("settles a stopped run when its adapter has already lost the native tu
           threadId,
           operation: "interrupt",
           providerTurnId,
-          cause: "Provider turn is not active.",
+          ...(unresponsive ? { unresponsive } : {}),
+          cause: unresponsive ? "Timed out." : "Provider turn is not active.",
         }),
       threads: {
         dispatch: (command) =>
@@ -199,7 +213,7 @@ it.effect("settles a stopped run when its adapter has already lost the native tu
         },
       });
     }).pipe(Effect.provide(layer));
-    assert.deepEqual(yield* Ref.get(events), ["thread.background-work.settle"]);
+    assert.deepEqual(yield* Ref.get(events), dispatched);
   }),
 );
 
diff --git a/apps/server/src/orchestration-v2/EffectWorker.ts b/apps/server/src/orchestration-v2/EffectWorker.ts
index d174db2fb3a29..534043aeb4eb8 100644
--- a/apps/server/src/orchestration-v2/EffectWorker.ts
+++ b/apps/server/src/orchestration-v2/EffectWorker.ts
@@ -177,6 +177,13 @@ export const layerExecutor: Layer.Layer<
                         cause,
                       }),
                 ),
+                Effect.map((outcome) => ({ unresponsive: false, outcome }) as const),
+                // Settling here would end the run while the agent may still be running; the
+                // user decides with Force stop instead.
+                Effect.catchIf(
+                  (cause) => request.subagent === undefined && cause.unresponsive === true,
+                  () => Effect.succeed({ unresponsive: true, outcome: undefined } as const),
+                ),
                 Effect.catchIf(
                   (cause) =>
                     request.subagent === undefined &&
@@ -184,27 +191,35 @@ export const layerExecutor: Layer.Layer<
                       request.type,
                       Cause.pretty(Cause.fail(cause)),
                     ),
-                  () => Effect.void,
+                  () => Effect.succeed({ unresponsive: false, outcome: undefined } as const),
                 ),
-                Effect.andThen((outcome) =>
-                  request.subagent !== undefined && outcome === undefined
-                    ? Effect.void
-                    : threads.dispatch({
-                        type: "thread.background-work.settle",
-                        commandId: CommandId.make(`${effect.id}:background-work-settled`),
-                        ...(request.subagent === undefined || outcome === undefined
-                          ? {}
-                          : {
-                              subagent: {
-                                id: request.subagent.id,
-                                stoppedAt: DateTime.makeUnsafe(effect.createdAt),
-                                outcome,
-                              },
-                            }),
+                Effect.andThen(({ unresponsive, outcome }) =>
+                  unresponsive
+                    ? threads.dispatch({
+                        type: "thread.interrupt.unresponsive",
+                        commandId: CommandId.make(`${effect.id}:unresponsive`),
                         threadId: effect.threadId,
                         providerThreadId: request.providerThreadId,
                         providerTurnId: request.providerTurnId,
-                      }),
+                      })
+                    : request.subagent !== undefined && outcome === undefined
+                      ? Effect.void
+                      : threads.dispatch({
+                          type: "thread.background-work.settle",
+                          commandId: CommandId.make(`${effect.id}:background-work-settled`),
+                          ...(request.subagent === undefined || outcome === undefined
+                            ? {}
+                            : {
+                                subagent: {
+                                  id: request.subagent.id,
+                                  stoppedAt: DateTime.makeUnsafe(effect.createdAt),
+                                  outcome,
+                                },
+                              }),
+                          threadId: effect.threadId,
+                          providerThreadId: request.providerThreadId,
+                          providerTurnId: request.providerTurnId,
+                        }),
                 ),
                 Effect.mapError(
                   (cause) =>
diff --git a/apps/server/src/orchestration-v2/Orchestrator.ts b/apps/server/src/orchestration-v2/Orchestrator.ts
index 16865229d94f2..50f9a2acc0f39 100644
--- a/apps/server/src/orchestration-v2/Orchestrator.ts
+++ b/apps/server/src/orchestration-v2/Orchestrator.ts
@@ -536,6 +536,7 @@ function commandThreadId(command: OrchestrationV2ServerCommand): ThreadId {
     case "checkpoint.rollback":
     case "checkpoint.rollback.fail":
     case "thread.background-work.settle":
+    case "thread.interrupt.unresponsive":
     case "thread.stop":
     case "provider.switch":
       return command.threadId;
@@ -10278,7 +10279,10 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
           run,
           rootNode,
           providerThread,
-          reason: yield* runInterruptReason(input.command, input.events, run.id),
+          reason:
+            (input.command.type === "thread.background-work.settle"
+              ? input.command.reason
+              : undefined) ?? (yield* runInterruptReason(input.command, input.events, run.id)),
           completedAt: input.now,
         }),
       });
@@ -10525,6 +10529,55 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
     yield* closePendingLinkRequests({ ...input, threadId: thread.id });
   });
 
+  const dispatchInterruptUnresponsive = Effect.fn("Orchestrator.dispatchInterruptUnresponsive")(
+    function* (
+      command: Extract<
+        OrchestrationV2InternalCommand,
+        { readonly type: "thread.interrupt.unresponsive" }
+      >,
+      events: Ref.Ref<Array<OrchestrationV2DomainEvent>>,
+    ) {
+      const { providerTurn } = yield* projectionStore
+        .getProviderControlContext(command.threadId, {
+          providerThreadId: command.providerThreadId,
+          providerTurnId: command.providerTurnId,
+        })
+        .pipe(mapDispatchError(command));
+      const { runs } = yield* projectionStore
+        .getThreadRecords(command.threadId, ["runs"])
+        .pipe(mapDispatchError(command));
+      const run = runs.find(
+        (candidate) =>
+          providerTurn !== undefined && candidate.activeAttemptId === providerTurn.runAttemptId,
+      );
+      // A settled run still counts: Stop may have targeted its background work.
+      if (run === undefined) return;
+      const { turnItems } = yield* projectionStore
+        .getThreadRecords(command.threadId, ["turnItems"], {
+          turnItemTypes: ["run_interrupt_request", "run_interrupt_result"],
+          turnItemRunIds: [run.id],
+        })
+        .pipe(mapDispatchError(command));
+      // A provider that stopped late already wrote the result; it needs no Force stop.
+      if (turnItems.some((item) => item.type === "run_interrupt_result")) return;
+      const request = turnItems.find((item) => item.type === "run_interrupt_request");
+      if (request?.type !== "run_interrupt_request" || request.unresponsiveAt !== undefined) return;
+      const now = yield* DateTime.now;
+      yield* emit(
+        events,
+        command,
+      )({
+        type: "turn-item.updated",
+        threadId: command.threadId,
+        runId: run.id,
+        ...(request.nodeId === null ? {} : { nodeId: request.nodeId }),
+        providerInstanceId: run.providerInstanceId,
+        occurredAt: now,
+        payload: { ...request, unresponsiveAt: now, updatedAt: now },
+      });
+    },
+  );
+
   const dispatchBackgroundWorkSettle = Effect.fn("Orchestrator.dispatchBackgroundWorkSettle")(
     function* (
       command: Extract<
@@ -12902,6 +12955,9 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
       case "thread.background-work.settle":
         yield* dispatchBackgroundWorkSettle(command, events, effects);
         break;
+      case "thread.interrupt.unresponsive":
+        yield* dispatchInterruptUnresponsive(command, events);
+        break;
       case "thread.fork":
         yield* dispatchThreadFork(command, events);
         break;
@@ -13032,6 +13088,7 @@ const makeOrchestrator = Effect.fn("orchestrationV2.Orchestrator.layer")(functio
         (planned) =>
           planned.events.length > 0 ||
           command.type === "thread.background-work.settle" ||
+          command.type === "thread.interrupt.unresponsive" ||
           command.type === "thread.stop" ||
           command.type === "subagent.stop" ||
           // Closing a share again, or after it ended, is not an error.
diff --git a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
index 86b173f80dcba..5bbb3926e2b66 100644
--- a/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderSessionManager.test.ts
@@ -338,6 +338,7 @@ const makeProviderAdapter = Effect.fnUntraced(function* (
     readonly backgroundTasksEndWithProcess?: boolean;
     readonly hangSessionScopeClose?: boolean;
     readonly startTurn?: Effect.Effect<void>;
+    readonly interruptTurn?: Effect.Effect<void>;
     readonly beforeUnload?: Effect.Effect<void>;
     readonly spawnBeforeOpen?: boolean;
     readonly scopeCloseReached?: Deferred.Deferred<void>;
@@ -437,7 +438,7 @@ const makeProviderAdapter = Effect.fnUntraced(function* (
             Ref.update(state, (current) => ({
               ...current,
               interruptCount: current.interruptCount + 1,
-            })),
+            })).pipe(Effect.andThen(options.interruptTurn ?? Effect.void)),
           unloadThread: ({ providerThread }) =>
             (options.beforeUnload ?? Effect.void).pipe(
               Effect.andThen(
@@ -485,6 +486,7 @@ function layerTest(input: {
   readonly backgroundTasksEndWithProcess?: boolean;
   readonly hangSessionScopeClose?: boolean;
   readonly startTurn?: Effect.Effect<void>;
+  readonly interruptTurn?: Effect.Effect<void>;
   readonly beforeUnload?: Effect.Effect<void>;
   readonly spawnBeforeOpen?: boolean;
   readonly scopeCloseReached?: Deferred.Deferred<void>;
@@ -520,6 +522,7 @@ function layerTest(input: {
         ? {}
         : { hangSessionScopeClose: input.hangSessionScopeClose }),
       ...(input.startTurn === undefined ? {} : { startTurn: input.startTurn }),
+      ...(input.interruptTurn === undefined ? {} : { interruptTurn: input.interruptTurn }),
       ...(input.beforeUnload === undefined ? {} : { beforeUnload: input.beforeUnload }),
       ...(input.spawnBeforeOpen === undefined ? {} : { spawnBeforeOpen: input.spawnBeforeOpen }),
       ...(input.scopeCloseReached === undefined
@@ -1367,6 +1370,159 @@ it.effect(
     }),
 );
 
+it.effect("ProviderSessionManagerV2 gives up on a provider that never confirms a Stop", () =>
+  Effect.gen(function* () {
+    const state = yield* Ref.make(emptyState);
+    yield* Effect.gen(function* () {
+      const eventSink = yield* EventSink.EventSinkV2;
+      const idAllocator = yield* IdAllocator.IdAllocatorV2;
+      const manager = yield* ProviderSessionManager.ProviderSessionManagerV2;
+      const now = yield* DateTime.now;
+      const threadId = ThreadId.make("thread-provider-session-manager-unresponsive-stop");
+      const providerSessionId = yield* idAllocator.allocate.providerSession({
+        providerInstanceId: modelSelection.instanceId,
+        threadId,
+      });
+      yield* eventSink.write({
+        events: [yield* makeThreadCreatedEvent({ idAllocator, threadId, now })],
+      });
+      const runtime = yield* manager.open({
+        threadId,
+        providerSessionId,
+        modelSelection,
+        runtimePolicy,
+      });
+      const stopping = yield* runtime
+        .interruptTurn({
+          providerThread: makeProviderThread({ idAllocator, threadId, providerSessionId, now }),
+          providerTurnId: idAllocator.derive.providerTurn({
+            driver: CODEX_DRIVER,
+            nativeTurnId: "native-turn-unresponsive",
+          }),
+        })
+        .pipe(Effect.flip, Effect.forkChild);
+      yield* TestClock.adjust(ProviderSessionManager.PROVIDER_INTERRUPT_TIMEOUT_MS);
+      assert.equal((yield* Fiber.join(stopping))._tag, "ProviderAdapterInterruptTimeoutError");
+    }).pipe(
+      Effect.provide(layerTest({ state, idleTimeoutMs: 60_000, interruptTurn: Effect.never })),
+    );
+  }),
+);
+
+it.effect(
+  "ProviderSessionManagerV2 keeps a shared session a sibling is busy on when releasing",
+  () =>
+    Effect.gen(function* () {
+      const state = yield* Ref.make(emptyState);
+      yield* Effect.gen(function* () {
+        const eventSink = yield* EventSink.EventSinkV2;
+        const idAllocator = yield* IdAllocator.IdAllocatorV2;
+        const manager = yield* ProviderSessionManager.ProviderSessionManagerV2;
+        const projectionStore = yield* ProjectionStore.ProjectionStoreV2;
+        const now = yield* DateTime.now;
+        const stopping = ThreadId.make("thread-provider-session-manager-release-stopping");
+        const sibling = ThreadId.make("thread-provider-session-manager-release-sibling");
+        const providerSessionId = idAllocator.derive.providerSession({
+          providerInstanceId: modelSelection.instanceId,
+        });
+        yield* eventSink.write({
+          events: [
+            yield* makeThreadCreatedEvent({ idAllocator, threadId: stopping, now }),
+            yield* makeThreadCreatedEvent({ idAllocator, threadId: sibling, now }),
+          ],
+        });
+        const runtime = yield* manager.open({
+          threadId: stopping,
+          providerSessionId,
+          modelSelection,
+          runtimePolicy,
+        });
+        yield* manager.open({
+          threadId: sibling,
+          providerSessionId,
+          modelSelection,
+          runtimePolicy,
+        });
+        const providerThreadOf = (threadId: ThreadId) =>
+          makeProviderThread({
+            idAllocator,
+            threadId,
+            providerSessionId,
+            now,
+            nativeThreadId: `native-${threadId}`,
+          });
+        const runId = idAllocator.derive.run({ threadId: sibling, ordinal: 1 });
+        yield* runtime.startTurn({
+          appThread: (yield* projectionStore.getThreadProjection(sibling)).thread,
+          threadId: sibling,
+          runId,
+          runOrdinal: 1,
+          providerTurnOrdinal: 1,
+          attemptId: idAllocator.derive.runAttempt({ runId, attemptOrdinal: 1 }),
+          rootNodeId: idAllocator.derive.rootNode({ runId }),
+          providerThread: providerThreadOf(sibling),
+          message: {
+            createdBy: "user",
+            creationSource: "web",
+            messageId: yield* idAllocator.allocate.message({ threadId: sibling, ordinal: 1 }),
+            text: "turn",
+            attachments: [],
+          },
+          modelSelection,
+          runtimePolicy,
+        });
+        const release = (own: ThreadId) =>
+          manager.releaseUnlessBusy({
+            providerSessionId,
+            ownProviderThreadIds: [providerThreadOf(own).id],
+            reason: "manual_shutdown",
+          });
+
+        assert.isFalse(yield* release(stopping));
+        assert.isTrue(yield* manager.isLive(providerSessionId));
+        assert.isTrue(yield* release(sibling));
+        assert.isFalse(yield* manager.isLive(providerSessionId));
+
+        // A turn that starts on a runtime released meanwhile fails instead of running on it.
+        const startOnReleasedRuntime = Effect.gen(function* () {
+          const lateRunId = idAllocator.derive.run({ threadId: stopping, ordinal: 1 });
+          return yield* Effect.flip(
+            runtime.startTurn({
+              appThread: (yield* projectionStore.getThreadProjection(stopping)).thread,
+              threadId: stopping,
+              runId: lateRunId,
+              runOrdinal: 1,
+              providerTurnOrdinal: 1,
+              attemptId: idAllocator.derive.runAttempt({ runId: lateRunId, attemptOrdinal: 1 }),
+              rootNodeId: idAllocator.derive.rootNode({ runId: lateRunId }),
+              providerThread: providerThreadOf(stopping),
+              message: {
+                createdBy: "user",
+                creationSource: "web",
+                messageId: yield* idAllocator.allocate.message({ threadId: stopping, ordinal: 1 }),
+                text: "turn",
+                attachments: [],
+              },
+              modelSelection,
+              runtimePolicy,
+            }),
+          );
+        });
+        assert.equal((yield* startOnReleasedRuntime)._tag, "ProviderAdapterTurnStartError");
+
+        // Nor may it leave its turn busy on a replacement opened under the same id.
+        yield* manager.open({
+          threadId: sibling,
+          providerSessionId,
+          modelSelection,
+          runtimePolicy,
+        });
+        assert.equal((yield* startOnReleasedRuntime)._tag, "ProviderAdapterTurnStartError");
+        assert.isTrue(yield* release(sibling));
+      }).pipe(Effect.provide(layerTest({ state, idleTimeoutMs: 60 * 60_000 })));
+    }),
+);
+
 it.effect("ProviderSessionManagerV2 stops a session still opening when its layer shuts down", () =>
   Effect.gen(function* () {
     const state = yield* Ref.make(emptyState);
diff --git a/apps/server/src/orchestration-v2/ProviderSessionManager.ts b/apps/server/src/orchestration-v2/ProviderSessionManager.ts
index b9887a4844600..03a7278774a64 100644
--- a/apps/server/src/orchestration-v2/ProviderSessionManager.ts
+++ b/apps/server/src/orchestration-v2/ProviderSessionManager.ts
@@ -57,11 +57,19 @@ import * as ProjectionStore from "./ProjectionStore.ts";
 const DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
 const DEFAULT_MAX_IDLE_PIN_MS = 4 * 60 * 60 * 1000;
 const RELEASE_SCOPE_CLOSE_TIMEOUT_MS = 30 * 1000;
+/** Past adapters' own 10 s stop fallbacks, so they settle first when the provider answers at all. */
+export const PROVIDER_INTERRUPT_TIMEOUT_MS = 15 * 1000;
 
 const busyTurnPrefix = (providerThreadId: ProviderThreadId) => `${providerThreadId}#`;
 const busyTurnKey = (providerThreadId: ProviderThreadId, runOrdinal: number) =>
   `${busyTurnPrefix(providerThreadId)}${runOrdinal}`;
 const UNLOAD_THREAD_TIMEOUT_MS = 10 * 1000;
+const WORKING_RUN_STATUSES: ReadonlySet<string> = new Set([
+  "preparing",
+  "starting",
+  "running",
+  "waiting",
+]);
 
 export const ProviderSessionReleaseReason = Schema.Literals([
   "idle_timeout",
@@ -181,6 +189,25 @@ export interface ProviderSessionManagerV2Shape {
     readonly detail?: string;
     readonly revokeMcpCredential?: boolean;
   }) => Effect.Effect<void, ProviderSessionManagerV2Error>;
+  /**
+   * Releases the session unless, at the moment of removal, a turn of a provider thread outside
+   * `ownProviderThreadIds` is busy on it. Checked atomically with turn starts. Succeeds with
+   * whether it was released.
+   */
+  readonly releaseUnlessBusy: (input: {
+    readonly providerSessionId: ProviderSessionId;
+    readonly ownProviderThreadIds: ReadonlyArray<ProviderThreadId>;
+    readonly reason: ProviderSessionReleaseReason;
+    readonly detail?: string;
+  }) => Effect.Effect<boolean, ProviderSessionManagerV2Error>;
+  /**
+   * Other threads with a run or background work on this session's shared process; empty when
+   * it serves one thread.
+   */
+  readonly otherWorkingThreads: (input: {
+    readonly providerSessionId: ProviderSessionId;
+    readonly threadId: ThreadId;
+  }) => Effect.Effect<ReadonlyArray<ThreadId>>;
 }
 
 export class ProviderSessionManagerV2 extends Context.Service<
@@ -895,6 +922,7 @@ export const layerWithOptions = (
         function* (input: {
           readonly providerSessionId: ProviderSessionId;
           readonly onlyIfIdleGeneration?: number;
+          readonly keepIfBusyOtherThan?: ReadonlyArray<ProviderThreadId>;
         }): Effect.fn.Return<readonly [Option.Option<LiveSessionEntry>, DateTime.Utc]> {
           const key = sessionKey(input.providerSessionId);
           const candidate = (yield* Ref.get(sessions)).get(key);
@@ -914,6 +942,15 @@ export const layerWithOptions = (
               ) {
                 return ["kept", current] as const;
               }
+              const own = input.keepIfBusyOtherThan;
+              if (
+                own !== undefined &&
+                [...existing.busyTurns].some(
+                  (turnKey) => !own.some((id) => turnKey.startsWith(busyTurnPrefix(id))),
+                )
+              ) {
+                return ["kept", current] as const;
+              }
               const updated = new Map(current);
               updated.delete(key);
               return ["removed", updated] as const;
@@ -972,6 +1009,7 @@ export const layerWithOptions = (
         readonly detachedThreadId?: ThreadId;
         readonly cancelIdleFiber?: boolean;
         readonly onlyIfIdleGeneration?: number;
+        readonly keepIfBusyOtherThan?: ReadonlyArray<ProviderThreadId>;
         readonly gracefulSubscribers?: boolean;
       }) =>
         Effect.acquireUseRelease(
@@ -1380,15 +1418,21 @@ export const layerWithOptions = (
             .pipe(Effect.ensuring(Effect.sync(dropReservation)));
         });
 
-      const markBusy = (providerSessionId: ProviderSessionId, turnKey: string) =>
+      // Marks only the entry this runtime belongs to: a released or replaced session must not
+      // gain a busy turn that never ends. Succeeds with whether the turn was marked.
+      const markBusy = (
+        providerSessionId: ProviderSessionId,
+        turnKey: string,
+        runtime: ProviderAdapter.ProviderAdapterV2SessionRuntime,
+      ) =>
         withActivityError(
           providerSessionId,
           Effect.gen(function* () {
             const key = sessionKey(providerSessionId);
-            const idleFiber = yield* Ref.modify(sessions, (current) => {
+            const marked = yield* Ref.modify(sessions, (current) => {
               const entry = current.get(key);
-              if (entry === undefined) {
-                return [null, current] as const;
+              if (entry === undefined || entry.runtime !== runtime) {
+                return [undefined, current] as const;
               }
               const updated = new Map(current);
               updated.set(key, {
@@ -1397,9 +1441,11 @@ export const layerWithOptions = (
                 idleFiber: null,
                 pinnedSinceMs: null,
               });
-              return [entry.idleFiber, updated] as const;
+              return [{ idleFiber: entry.idleFiber }, updated] as const;
             });
-            yield* cancelIdleFiber(idleFiber);
+            if (marked === undefined) return false;
+            yield* cancelIdleFiber(marked.idleFiber);
+            return true;
           }),
         );
 
@@ -1785,11 +1831,31 @@ export const layerWithOptions = (
               ),
               Effect.andThen(
                 Effect.acquireUseRelease(
-                  observeActivity(
+                  markBusy(
                     providerSessionId,
-                    markBusy(
-                      providerSessionId,
-                      busyTurnKey(input.providerThread.id, input.runOrdinal),
+                    busyTurnKey(input.providerThread.id, input.runOrdinal),
+                    runtime,
+                  ).pipe(
+                    Effect.catchCause((cause) =>
+                      Effect.logWarning("orchestration-v2.driver-session.activity-failed", {
+                        providerSessionId,
+                        cause,
+                      }).pipe(Effect.as(true)),
+                    ),
+                    // A release between attach and markBusy leaves nothing to mark: fail the
+                    // start instead of running it on a runtime being torn down.
+                    Effect.flatMap((marked) =>
+                      marked
+                        ? Effect.void
+                        : Effect.fail(
+                            new ProviderAdapter.ProviderAdapterTurnStartError({
+                              driver: runtime.driver,
+                              threadId: input.threadId,
+                              providerThreadId: input.providerThread.id,
+                              runId: input.runId,
+                              cause: "The provider session was released while the turn started.",
+                            }),
+                          ),
                     ),
                   ),
                   () =>
@@ -1808,9 +1874,26 @@ export const layerWithOptions = (
             observeActivity(providerSessionId, touchActivity(providerSessionId)).pipe(
               Effect.andThen(runtime.steerTurn(input).pipe(turnMetrics("steer"))),
             ),
+          // A provider starved of memory can stop answering, so no caller may wait on it unbounded.
           interruptTurn: (input) =>
             observeActivity(providerSessionId, touchActivity(providerSessionId)).pipe(
-              Effect.andThen(runtime.interruptTurn(input).pipe(turnMetrics("interrupt"))),
+              Effect.andThen(
+                runtime.interruptTurn(input).pipe(
+                  Effect.timeoutOrElse({
+                    duration: PROVIDER_INTERRUPT_TIMEOUT_MS,
+                    orElse: () =>
+                      Effect.fail(
+                        new ProviderAdapter.ProviderAdapterInterruptTimeoutError({
+                          driver: runtime.driver,
+                          providerThreadId: input.providerThread.id,
+                          providerTurnId: input.providerTurnId,
+                          timeoutMs: PROVIDER_INTERRUPT_TIMEOUT_MS,
+                        }),
+                      ),
+                  }),
+                  turnMetrics("interrupt"),
+                ),
+              ),
             ),
           respondToRuntimeRequest: (input) =>
             observeActivity(providerSessionId, touchActivity(providerSessionId)).pipe(
@@ -2276,6 +2359,40 @@ export const layerWithOptions = (
             ),
         ),
         release: releaseEntry,
+        releaseUnlessBusy: Effect.fn("ProviderSessionManager.releaseUnlessBusy")(function* (input) {
+          const key = sessionKey(input.providerSessionId);
+          const before = (yield* Ref.get(sessions)).get(key);
+          yield* releaseEntry({
+            providerSessionId: input.providerSessionId,
+            reason: input.reason,
+            ...(input.detail === undefined ? {} : { detail: input.detail }),
+            keepIfBusyOtherThan: input.ownProviderThreadIds,
+          });
+          // Identity, not presence: open can install a replacement under the same id meanwhile.
+          return before !== undefined && (yield* Ref.get(sessions)).get(key) !== before;
+        }),
+        otherWorkingThreads: Effect.fn("ProviderSessionManager.otherWorkingThreads")(
+          function* (input) {
+            const entry = (yield* Ref.get(sessions)).get(sessionKey(input.providerSessionId));
+            if (entry === undefined || !entry.supportsMultipleProviderThreads) return [];
+            return yield* Effect.filter(
+              [...entry.attachedThreadIds].filter((threadId) => threadId !== input.threadId),
+              (threadId) =>
+                // Runs, not the shell's activeRunId: the shell omits silent runs such as idle
+                // compaction. Background work outlives its run and still needs the process.
+                Effect.zipWith(
+                  projectionStore.getThreadRecords(threadId, ["runs"]),
+                  projectionStore.getThreadShell(threadId),
+                  ({ runs }, shell) =>
+                    runs.some((run) => WORKING_RUN_STATUSES.has(run.status)) ||
+                    (shell?.pendingBackgroundTasks?.length ?? 0) > 0,
+                ).pipe(
+                  // An unreadable thread may still be working; never kill it unseen.
+                  Effect.orElseSucceed(() => true),
+                ),
+            );
+          },
+        ),
         detach: Effect.fn("ProviderSessionManager.detach")(
           function* (input) {
             const key = sessionKey(input.providerSessionId);
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
index bab115f6e24cb..65da8b23676b0 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts
@@ -284,6 +284,8 @@ it.effect(
           closeInstance: () => Effect.void,
           release: () => Effect.void,
           detach: () => Effect.void,
+          otherWorkingThreads: () => Effect.succeed([]),
+          releaseUnlessBusy: () => Effect.succeed(true),
         }),
       );
       const layerControl = ProviderTurnControlService.layer.pipe(
diff --git a/apps/server/src/orchestration-v2/ProviderTurnControlService.ts b/apps/server/src/orchestration-v2/ProviderTurnControlService.ts
index e1dbac21bc52e..bd225bb41773b 100644
--- a/apps/server/src/orchestration-v2/ProviderTurnControlService.ts
+++ b/apps/server/src/orchestration-v2/ProviderTurnControlService.ts
@@ -38,6 +38,8 @@ export class ProviderTurnControlError extends Schema.TaggedError<ProviderTurnCon
     operation: Schema.Literals(["interrupt", "restart", "steer"]),
     providerTurnId: ProviderTurnId,
     turnCompleted: Schema.optional(Schema.Boolean),
+    /** The provider never confirmed the stop; Force stop is the way out. */
+    unresponsive: Schema.optional(Schema.Boolean),
     cause: Schema.optional(Schema.Defect()),
   },
 ) {}
@@ -218,11 +220,26 @@ export const layer: Layer.Layer<
             });
           }
           // Settled turns still reach adapters, which alone know whether background work remains.
-          yield* session.value.interruptTurn({
-            providerThread: loaded.providerThread,
-            providerTurnId: loaded.providerTurn.id,
-            requestRuntimeRestart: true,
-          });
+          yield* session.value
+            .interruptTurn({
+              providerThread: loaded.providerThread,
+              providerTurnId: loaded.providerTurn.id,
+              requestRuntimeRestart: true,
+            })
+            .pipe(
+              Effect.catchTags({
+                ProviderAdapterInterruptTimeoutError: (cause) =>
+                  Effect.fail(
+                    new ProviderTurnControlError({
+                      threadId: input.threadId,
+                      operation: "interrupt",
+                      providerTurnId: input.providerTurnId,
+                      unresponsive: true,
+                      cause,
+                    }),
+                  ),
+              }),
+            );
           // Use real time; ingestion fibers do not advance TestClock and would leave Stop blocked.
           yield* Effect.gen(function* () {
             const deadline = (yield* Clock.currentTimeMillis) + 2_000;
diff --git a/apps/server/src/orchestration-v2/ThreadManagementService.test.ts b/apps/server/src/orchestration-v2/ThreadManagementService.test.ts
index b2daad62681e9..9285f72d46f56 100644
--- a/apps/server/src/orchestration-v2/ThreadManagementService.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadManagementService.test.ts
@@ -27,6 +27,8 @@ import * as Queue from "effect/Queue";
 import * as Stream from "effect/Stream";
 import * as TestClock from "effect/testing/TestClock";
 
+import { AgentScope } from "@t3tools/shared/AgentScope";
+
 import * as ServerSettings from "../serverSettings.ts";
 import * as SqlitePersistence from "../persistence/Sqlite.ts";
 import * as CommandReceiptStore from "./CommandReceiptStore.ts";
@@ -596,3 +598,174 @@ it.effect.each([
     expect(dispatched).toEqual(settles ? ["thread.settle"] : []);
   }),
 );
+
+it.effect.each([
+  {
+    name: "kills the thread's own agent and ends its turn",
+    others: [] as ReadonlyArray<string>,
+    killed: true,
+    expected: { outcome: "killed", sharedWithThreadIds: [] },
+    teardown: ["release"],
+  },
+  {
+    name: "keeps a process another working thread shares and only ends this turn",
+    others: ["thread:thread-management:force-stop:other"],
+    killed: false,
+    expected: {
+      outcome: "shared",
+      sharedWithThreadIds: ["thread:thread-management:force-stop:other"],
+    },
+    teardown: ["detach"],
+  },
+  {
+    name: "still settles a finished run's background work in a shared process",
+    others: ["thread:thread-management:force-stop:other"],
+    killed: false,
+    settledRun: true,
+    expected: {
+      outcome: "shared",
+      sharedWithThreadIds: ["thread:thread-management:force-stop:other"],
+    },
+    teardown: ["detach"],
+  },
+  {
+    name: "detaches when a sibling starts a turn just before the session is released",
+    others: [] as ReadonlyArray<string>,
+    killed: false,
+    siblingBusy: true,
+    expected: { outcome: "shared", sharedWithThreadIds: [] },
+    teardown: ["release", "detach"],
+  },
+  {
+    name: "reports a teardown that has not finished in time as still releasing",
+    others: [] as ReadonlyArray<string>,
+    killed: false,
+    releaseHangs: true,
+    expected: { outcome: "releasing", sharedWithThreadIds: [] },
+    teardown: ["release"],
+  },
+])("Force stop $name", ({ others, killed, expected, teardown, ...row }) =>
+  Effect.gen(function* () {
+    const threadId = ThreadId.make("thread:thread-management:force-stop");
+    const providerSessionId = ProviderSessionId.make("provider-session:force-stop");
+    const providerThreadId = ProviderThreadId.make("provider-thread:force-stop");
+    const runId = RunId.make("run:thread-management:force-stop");
+    const dispatched: Array<OrchestrationV2Command | { readonly type: string }> = [];
+    const teardowns: Array<string> = [];
+    const tornDown = yield* Deferred.make<void>();
+    const layerTest = ThreadManagementService.layer.pipe(
+      Layer.provide(
+        Layer.mock(ProviderSessionManager.ProviderSessionManagerV2)({
+          isLive: () => Effect.succeed(true),
+          otherWorkingThreads: () => Effect.succeed(others.map((id) => ThreadId.make(id))),
+          releaseUnlessBusy: () =>
+            Effect.sync(() => teardowns.push("release")).pipe(
+              Effect.andThen(
+                "releaseHangs" in row ? Effect.never : Effect.succeed(!("siblingBusy" in row)),
+              ),
+            ),
+          detach: () =>
+            Effect.sync(() => teardowns.push("detach")).pipe(
+              Effect.andThen(Deferred.succeed(tornDown, undefined)),
+              Effect.asVoid,
+            ),
+        }),
+      ),
+      Layer.provide(
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          getThreadRecords: () =>
+            Effect.succeed({
+              thread: { id: threadId, deletedAt: null },
+              runs: [
+                {
+                  id: runId,
+                  ordinal: 1,
+                  status: "settledRun" in row ? "completed" : "running",
+                  activeAttemptId: "attempt",
+                },
+                // A queued follow-up neither supersedes the request nor becomes the target.
+                { id: RunId.make("run:queued-follow-up"), ordinal: 2, status: "queued" },
+              ],
+              providerThreads: [{ id: providerThreadId, appThreadId: threadId, providerSessionId }],
+              providerTurns: [
+                {
+                  id: "provider-turn:force-stop",
+                  providerThreadId,
+                  runAttemptId: "attempt",
+                  status: "settledRun" in row ? "completed" : "running",
+                },
+              ],
+            } as unknown as OrchestrationV2ThreadProjection),
+          dispatch: (command) =>
+            Effect.sync(() => {
+              dispatched.push(command);
+              return { sequence: 1, storedEvents: [] } as never;
+            }),
+        }),
+      ),
+      Layer.provide(
+        Layer.succeed(AgentScope, {
+          ...AgentScope.defaultValue(),
+          kill: () => Effect.succeed(killed),
+        }),
+      ),
+      Layer.provide(ServerSettings.layerTest()),
+      Layer.provide(layerReceiptsTest),
+    );
+    yield* Effect.gen(function* () {
+      const service = yield* ThreadManagementService.ThreadManagementService;
+      const stopping = yield* service.forceStopThread({ threadId, runId }).pipe(Effect.forkChild);
+      yield* TestClock.adjust("10 seconds");
+      expect(yield* Fiber.join(stopping)).toEqual(expected);
+      expect(dispatched).toMatchObject([
+        {
+          type: "thread.background-work.settle",
+          providerThreadId,
+          reason: "Force stopped by user",
+        },
+      ]);
+      if (teardown.at(-1) === "detach") yield* Deferred.await(tornDown);
+      expect(teardowns).toEqual(teardown);
+    }).pipe(Effect.provide(layerTest));
+  }),
+);
+
+it.effect("Force stop refuses once a newer run has started, before killing anything", () =>
+  Effect.gen(function* () {
+    const threadId = ThreadId.make("thread:thread-management:force-stop-superseded");
+    let killed = false;
+    const layerTest = ThreadManagementService.layer.pipe(
+      Layer.provide(Layer.mock(ProviderSessionManager.ProviderSessionManagerV2)({})),
+      Layer.provide(
+        Layer.mock(Orchestrator.OrchestratorV2)({
+          getThreadRecords: () =>
+            Effect.succeed({
+              thread: { id: threadId, deletedAt: null },
+              runs: [
+                { id: RunId.make("run:stopped"), ordinal: 1, status: "running" },
+                { id: RunId.make("run:newer"), ordinal: 2, status: "running" },
+              ],
+              providerThreads: [],
+              providerTurns: [],
+            } as unknown as OrchestrationV2ThreadProjection),
+        }),
+      ),
+      Layer.provide(
+        Layer.succeed(AgentScope, {
+          ...AgentScope.defaultValue(),
+          kill: () => Effect.sync(() => (killed = true)),
+        }),
+      ),
+      Layer.provide(ServerSettings.layerTest()),
+      Layer.provide(layerReceiptsTest),
+    );
+    const error = yield* Effect.gen(function* () {
+      const service = yield* ThreadManagementService.ThreadManagementService;
+      return yield* Effect.flip(
+        service.forceStopThread({ threadId, runId: RunId.make("run:stopped") }),
+      );
+    }).pipe(Effect.provide(layerTest));
+    expect(error.reason).toBe("superseded");
+    expect(killed).toBe(false);
+  }),
+);
diff --git a/apps/server/src/orchestration-v2/ThreadManagementService.ts b/apps/server/src/orchestration-v2/ThreadManagementService.ts
index 7b79b21e88153..192ed4007fc17 100644
--- a/apps/server/src/orchestration-v2/ThreadManagementService.ts
+++ b/apps/server/src/orchestration-v2/ThreadManagementService.ts
@@ -14,6 +14,9 @@ import {
   MessageId,
   OrchestrationV2StopWorkflowError,
   type OrchestrationV2StopWorkflowInput,
+  OrchestrationV2ForceStopThreadError,
+  type OrchestrationV2ForceStopThreadInput,
+  type OrchestrationV2ForceStopThreadResult,
   type ModelSelection,
   type OrchestrationV2Actor,
   type OrchestrationV2Command,
@@ -30,6 +33,7 @@ import {
   ProjectId,
   PROVIDER_SEND_TURN_MAX_FILE_BYTES,
   ProviderInstanceId,
+  type ProviderSessionId,
   resolveProjectProviderInstanceEnabled,
   RunId,
   type ScheduledTaskId,
@@ -38,10 +42,13 @@ import {
 } from "@t3tools/contracts";
 import { delegatedTaskProgress } from "@t3tools/provider-core/server/subagentProjection";
 import { threadTranscriptHeader } from "@t3tools/shared/threadTranscript";
+import { AgentScope } from "@t3tools/shared/AgentScope";
+import * as Clock from "effect/Clock";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
 import * as Duration from "effect/Duration";
 import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
 import * as Layer from "effect/Layer";
 import * as Option from "effect/Option";
 import * as Ref from "effect/Ref";
@@ -454,6 +461,13 @@ export interface ThreadManagementServiceShape {
   readonly stopWorkflow: (
     input: OrchestrationV2StopWorkflowInput,
   ) => Effect.Effect<void, OrchestrationV2StopWorkflowError>;
+  /**
+   * Kills the thread's agent for a provider that no longer responds, then ends
+   * its turn as interrupted. Never kills a process other working threads share.
+   */
+  readonly forceStopThread: (
+    input: OrchestrationV2ForceStopThreadInput,
+  ) => Effect.Effect<OrchestrationV2ForceStopThreadResult, OrchestrationV2ForceStopThreadError>;
   readonly awaitBackgroundTasks: (input: {
     readonly threadId: ThreadId;
     readonly taskIds: ReadonlyArray<string>;
@@ -547,12 +561,16 @@ function latestSteerableRun(
 }
 
 const SETTLE_AFTER_RUN_WAIT_MS = 24 * 60 * 60 * 1_000;
+const FORCE_STOP_REASON = "Force stopped by user";
+const FORCE_STOP_RELEASE_WAIT = "10 seconds";
+const isForceStopThreadError = Schema.is(OrchestrationV2ForceStopThreadError);
 
 const make = Effect.gen(function* () {
   const threadDispatch = yield* ThreadCommandExecutor.ThreadCommandExecutor;
   const orchestrator = yield* Orchestrator.OrchestratorV2;
   const sessions = yield* ProviderSessionManager.ProviderSessionManagerV2;
   const layerScope = yield* Effect.scope;
+  const agentScope = yield* AgentScope;
   const legacyImporter = yield* LegacyV1ThreadImporter.LegacyV1ThreadImporter;
   const serverSettings = yield* ServerSettings.ServerSettingsService;
   const receipts = yield* CommandReceiptStore.CommandReceiptStoreV2;
@@ -1072,6 +1090,153 @@ const make = Effect.gen(function* () {
     return { type: "interrupt_requested", run: interruptibleRun, dispatch } as const;
   });
 
+  const forceStopThread: ThreadManagementServiceShape["forceStopThread"] = Effect.fn(
+    "ThreadManagementService.forceStopThread",
+  )(
+    function* (input) {
+      // Under the thread lock no new run can be created between the check and the kill. The
+      // settlement below dispatches, which takes that lock itself, so it runs after release.
+      const { records, target, killed } = yield* threadDispatch.withLock(
+        input.threadId,
+        Effect.gen(function* () {
+          const records = yield* orchestrator.getThreadRecords(input.threadId, [
+            "runs",
+            "providerThreads",
+            "providerTurns",
+          ]);
+          // The run Force stop acts on: the active one, else the latest that started. Queued
+          // follow-ups never ran, so they neither count as targets nor supersede the request.
+          const target =
+            latestActiveRun(records) ??
+            records.runs
+              .filter((run) => run.status !== "queued")
+              .reduce<OrchestrationV2Run | undefined>(
+                (current, run) =>
+                  current === undefined || run.ordinal > current.ordinal ? run : current,
+                undefined,
+              );
+          if (input.runId !== undefined && input.runId !== target?.id) {
+            return yield* new OrchestrationV2ForceStopThreadError({
+              threadId: input.threadId,
+              reason: "superseded",
+            });
+          }
+          // Shared scopes are never tracked per thread, so this only kills the thread's own agent.
+          const killed = yield* agentScope.kill(input.threadId);
+          return { records, target, killed };
+        }),
+      );
+      const sessionIds = new Set(
+        records.providerThreads.flatMap((providerThread) =>
+          providerThread.appThreadId === input.threadId && providerThread.providerSessionId !== null
+            ? [providerThread.providerSessionId]
+            : [],
+        ),
+      );
+      // A run that already ended may still hold background work; settling it is a no-op otherwise.
+      const run = target;
+      if (run !== undefined) {
+        const active = isActiveRun(run);
+        const providerTurn = records.providerTurns.findLast(
+          (turn) =>
+            turn.runAttemptId === run.activeAttemptId && (!active || turn.status === "running"),
+        );
+        const commandId = CommandId.make(
+          `server:force-stop:${run.id}:${yield* Clock.currentTimeMillis}`,
+        );
+        yield* providerTurn === undefined && !active
+          ? Effect.void
+          : providerTurn === undefined
+            ? orchestrator.dispatch({
+                type: "run.interrupt",
+                commandId,
+                threadId: input.threadId,
+                runId: run.id,
+                reason: FORCE_STOP_REASON,
+              })
+            : orchestrator.dispatch({
+                type: "thread.background-work.settle",
+                commandId,
+                threadId: input.threadId,
+                providerThreadId: providerTurn.providerThreadId,
+                providerTurnId: providerTurn.id,
+                reason: FORCE_STOP_REASON,
+              });
+      }
+      const ownProviderThreadIds = records.providerThreads.flatMap((providerThread) =>
+        providerThread.appThreadId === input.threadId ? [providerThread.id] : [],
+      );
+      const detach = (providerSessionId: ProviderSessionId) =>
+        sessions
+          .detach({ providerSessionId, threadId: input.threadId, detail: FORCE_STOP_REASON })
+          .pipe(
+            Effect.catchCause((cause) =>
+              Effect.logWarning("orchestration-v2.force-stop-detach-failed", {
+                threadId: input.threadId,
+                cause,
+              }),
+            ),
+            Effect.forkIn(layerScope),
+          );
+      let shared = false;
+      const sharedWith = new Set<ThreadId>();
+      const releases: Array<{
+        readonly providerSessionId: ProviderSessionId;
+        readonly fiber: Fiber.Fiber<boolean, ProviderSessionManager.ProviderSessionManagerV2Error>;
+      }> = [];
+      for (const providerSessionId of sessionIds) {
+        if (!(yield* sessions.isLive(providerSessionId))) continue;
+        // Decided just before teardown, so the reply matches what happens to the process.
+        const others = yield* sessions.otherWorkingThreads({
+          providerSessionId,
+          threadId: input.threadId,
+        });
+        for (const threadId of others) sharedWith.add(threadId);
+        if (others.length > 0) {
+          shared = true;
+          yield* detach(providerSessionId);
+          continue;
+        }
+        // The session manager re-checks atomically with turn starts and keeps a session a
+        // sibling began using in the meantime.
+        const fiber = yield* sessions
+          .releaseUnlessBusy({
+            providerSessionId,
+            ownProviderThreadIds,
+            reason: "manual_shutdown",
+            detail: FORCE_STOP_REASON,
+          })
+          .pipe(Effect.forkIn(layerScope));
+        releases.push({ providerSessionId, fiber });
+      }
+      // Teardown waits on the provider's own exit paths; past this bound it keeps going on its own.
+      let releasing = false;
+      for (const release of releases) {
+        const released = yield* Fiber.join(release.fiber).pipe(
+          Effect.timeoutOption(FORCE_STOP_RELEASE_WAIT),
+        );
+        if (Option.isNone(released)) {
+          releasing = true;
+        } else if (!released.value) {
+          shared = true;
+          yield* detach(release.providerSessionId);
+        }
+      }
+      return {
+        outcome: killed ? "killed" : shared ? "shared" : releasing ? "releasing" : "released",
+        sharedWithThreadIds: [...sharedWith],
+      } as const;
+    },
+    (effect, input) =>
+      effect.pipe(
+        Effect.mapError((cause) =>
+          isForceStopThreadError(cause)
+            ? cause
+            : new OrchestrationV2ForceStopThreadError({ threadId: input.threadId, cause }),
+        ),
+      ),
+  );
+
   const stopWorkflow: ThreadManagementServiceShape["stopWorkflow"] = Effect.fn(
     "ThreadManagementService.stopWorkflow",
   )(
@@ -1354,6 +1519,7 @@ const make = Effect.gen(function* () {
     interruptThread,
     stopDelegatedTasks,
     stopWorkflow,
+    forceStopThread,
     awaitBackgroundTasks,
     getThreadEventSequence: orchestrator.getThreadEventSequence,
     recoverDelegatedTask: orchestrator.recoverDelegatedTask,
diff --git a/apps/server/src/orchestration-v2/ThreadStop.test.ts b/apps/server/src/orchestration-v2/ThreadStop.test.ts
index 23a52f39d33d3..16dcedaf8ac9c 100644
--- a/apps/server/src/orchestration-v2/ThreadStop.test.ts
+++ b/apps/server/src/orchestration-v2/ThreadStop.test.ts
@@ -1552,3 +1552,115 @@ it.effect.each(["missing session", "completed", "failed", "cancelled"] as const)
       );
     }).pipe(Effect.provide(layerTest)),
 );
+
+it.effect("an unanswered Stop is flagged until Force stop ends the run with its own reason", () =>
+  Effect.gen(function* () {
+    const orchestrator = yield* Orchestrator.OrchestratorV2;
+    const projections = yield* ProjectionStore.ProjectionStoreV2;
+    const threadId = ThreadId.make("thread:force-stop");
+    yield* createWatchingThread(threadId, 6);
+    yield* send(threadId, "work", "start_immediately");
+    const now = yield* DateTime.now;
+    const started = yield* orchestrator.getThreadProjection(threadId);
+    const run = started.runs[0]!;
+    const providerThreadId = run.providerThreadId!;
+    const providerTurnId = ProviderTurnId.make("provider-turn:force-stop");
+    const apply = (event: Omit<OrchestrationV2DomainEvent, "id" | "threadId">) =>
+      projections.apply({
+        ...event,
+        id: EventId.make(`event:force-stop:${event.type}`),
+        threadId,
+      } as OrchestrationV2DomainEvent);
+    const attempt = started.attempts[0]!;
+    const attemptId = attempt.id;
+    yield* apply({
+      type: "run.updated",
+      runId: run.id,
+      occurredAt: now,
+      payload: { ...run, status: "running", startedAt: now, activeAttemptId: attemptId },
+    });
+    yield* apply({
+      type: "run-attempt.updated",
+      occurredAt: now,
+      payload: { ...attempt, status: "running", startedAt: now },
+    });
+    yield* apply({
+      type: "provider-turn.updated",
+      occurredAt: now,
+      payload: {
+        id: providerTurnId,
+        providerThreadId,
+        nodeId: run.rootNodeId!,
+        runAttemptId: attemptId,
+        nativeTurnRef: null,
+        ordinal: 1,
+        status: "running",
+        startedAt: now,
+        completedAt: null,
+      },
+    });
+    yield* apply({
+      type: "turn-item.updated",
+      runId: run.id,
+      occurredAt: now,
+      payload: {
+        id: TurnItemId.make("turn-item:force-stop:interrupt-request"),
+        threadId,
+        runId: run.id,
+        nodeId: run.rootNodeId!,
+        providerThreadId,
+        providerTurnId,
+        nativeItemRef: null,
+        parentItemId: null,
+        ordinal: 1_000,
+        status: "completed",
+        title: "Interrupt requested",
+        startedAt: now,
+        completedAt: now,
+        updatedAt: now,
+        type: "run_interrupt_request",
+        message: "Stopped by user",
+      },
+    });
+    const target = { threadId, providerThreadId, providerTurnId };
+    const request = Effect.map(orchestrator.getThreadProjection(threadId), (projection) =>
+      projection.turnItems.find((item) => item.type === "run_interrupt_request"),
+    );
+
+    yield* orchestrator.dispatch({
+      ...target,
+      type: "thread.interrupt.unresponsive",
+      commandId: CommandId.make("force-stop:unresponsive"),
+    });
+    const flagged = yield* request;
+    assert.isTrue(
+      flagged?.type === "run_interrupt_request" && flagged.unresponsiveAt !== undefined,
+    );
+    assert.deepEqual((yield* threadState(threadId)).runs, ["running"]);
+
+    yield* orchestrator.dispatch({
+      ...target,
+      type: "thread.background-work.settle",
+      commandId: CommandId.make("force-stop:settle"),
+      reason: "Force stopped by user",
+    });
+    const settled = yield* orchestrator.getThreadProjection(threadId);
+    assert.deepEqual(
+      settled.runs.map((candidate) => candidate.status),
+      ["interrupted"],
+    );
+    const result = settled.turnItems.find((item) => item.type === "run_interrupt_result");
+    assert.equal(
+      result?.type === "run_interrupt_result" ? result.message : undefined,
+      "Force stopped by user",
+    );
+
+    // A provider confirming late changes nothing once the run has ended.
+    const late = yield* orchestrator.dispatch({
+      ...target,
+      type: "thread.interrupt.unresponsive",
+      commandId: CommandId.make("force-stop:late-unresponsive"),
+    });
+    assert.lengthOf(late.storedEvents, 0);
+  }).pipe(Effect.provide(layerTest)),
+);
diff --git a/apps/server/src/process/agentScope.test.ts b/apps/server/src/process/agentScope.test.ts
index 286452a5c5781..2a9998f4cfbf6 100644
--- a/apps/server/src/process/agentScope.test.ts
+++ b/apps/server/src/process/agentScope.test.ts
@@ -110,6 +110,8 @@ const withFakeSystemd = <A, E>(
         ...fileSystem,
         readFileString: (path, encoding) =>
           fileSystem.readFileString(path.replace("/sys/fs/cgroup", cgroupRoot), encoding),
+        writeFileString: (path, data, options) =>
+          fileSystem.writeFileString(path.replace("/sys/fs/cgroup", cgroupRoot), data, options),
       }),
     );
     const { stateDir } = yield* ServerConfig.ServerConfig;
@@ -213,6 +215,36 @@ describe("AgentScope service", () => {
       ),
   );
 
+  it.effect.each([{ oomPolicy: true }, { oomPolicy: false }])(
+    "Force stop kills a thread's own scope but never a shared Codex scope (OOM policy $oomPolicy)",
+    ({ oomPolicy }) =>
+      withFakeSystemd(
+        ({ scope, units, calls, cgroupRoot }) =>
+          Effect.gen(function* () {
+            const agent = yield* scope.wrap({
+              command: "agent",
+              args: [],
+              name: "t",
+              threadId: "a",
+            });
+            exitedAgent(units, cgroupRoot, unitOf(agent), { populated: true, oomKills: 0 });
+            const codex = yield* launchCodex(scope, "b");
+            exitedAgent(units, cgroupRoot, unitOf(codex), { populated: true, oomKills: 0 });
+
+            expect(yield* scope.kill("a")).toBe(true);
+            expect(
+              NodeFS.readFileSync(NodePath.join(cgroupRoot, unitOf(agent), "cgroup.kill"), "utf8"),
+            ).toBe("1");
+            expect(yield* scope.kill("b")).toBe(false);
+            expect(NodeFS.existsSync(NodePath.join(cgroupRoot, unitOf(codex), "cgroup.kill"))).toBe(
+              false,
+            );
+            expect(calls.filter(([, verb]) => verb === "kill")).toEqual([]);
+          }),
+        { oomPolicy },
+      ),
+  );
+
   it.effect("keeps a running scope while hundreds of other threads launch", () =>
     withFakeSystemd(({ scope, units }) =>
       Effect.gen(function* () {
diff --git a/apps/server/src/process/agentScope.ts b/apps/server/src/process/agentScope.ts
index c72e4eed88a9c..b9b6b56acb140 100644
--- a/apps/server/src/process/agentScope.ts
+++ b/apps/server/src/process/agentScope.ts
@@ -215,7 +215,8 @@ export const make = Effect.gen(function* () {
     }),
   );
 
-  const scopeByThread = new Map<string, { unit: string; oomKilled: boolean }>();
+  // `shared` scopes serve other threads too: tracked only for OOM diagnosis on old systemd.
+  const scopeByThread = new Map<string, { unit: string; oomKilled: boolean; shared: boolean }>();
 
   const readScope = Effect.fn("agentScope.readScope")(function* (systemctl: string, unit: string) {
     const shown = yield* run(systemctl, [
@@ -277,10 +278,11 @@ export const make = Effect.gen(function* () {
     systemctl: string,
     threadId: string,
     unit: string | undefined,
+    shared = false,
   ) {
     const previous = scopeByThread.get(threadId);
     scopeByThread.delete(threadId);
-    if (unit !== undefined) scopeByThread.set(threadId, { unit, oomKilled: false });
+    if (unit !== undefined) scopeByThread.set(threadId, { unit, oomKilled: false, shared });
     if (previous !== undefined) yield* forget(systemctl, previous.unit);
     if (scopeByThread.size > MAX_TRACKED_THREADS) yield* evictOldest(systemctl);
   });
@@ -340,6 +342,40 @@ export const make = Effect.gen(function* () {
     }
   });
 
+  const kill: AgentScopeShape["kill"] = Effect.fn("AgentScope.kill")(function* (threadId) {
+    const tracked = scopeByThread.get(threadId);
+    if (tracked === undefined || tracked.shared) return false;
+    const scope = yield* systemd;
+    if (scope === undefined) return false;
+    const shown = yield* run(scope.systemctl, [
+      "--user",
+      "show",
+      tracked.unit,
+      "--property=ActiveState,ControlGroup",
+    ]);
+    if (shown._tag === "None" || shown.value.code !== 0) return false;
+    const values = parseKeyValues(shown.value.stdout);
+    if (values.get("ActiveState") !== "active") return false;
+    const controlGroup = values.get("ControlGroup") ?? "";
+    // cgroup.kill (Linux 5.14+) kills the whole tree at once; systemd's kill is the fallback.
+    const killedByCgroup =
+      controlGroup.length > 0 &&
+      (yield* fileSystem
+        .writeFileString(path.join("/sys/fs/cgroup", controlGroup, "cgroup.kill"), "1")
+        .pipe(
+          Effect.as(true),
+          Effect.orElseSucceed(() => false),
+        ));
+    if (killedByCgroup) return true;
+    const killed = yield* run(scope.systemctl, [
+      "--user",
+      "kill",
+      "--signal=SIGKILL",
+      tracked.unit,
+    ]);
+    return killed._tag === "Some" && killed.value.code === 0;
+  });
+
   const clear: AgentScopeShape["clear"] = Effect.fn("agentScope.clear")(function* (threadId) {
     if (!scopeByThread.has(threadId)) return;
     const scope = yield* systemd;
@@ -365,7 +401,8 @@ export const make = Effect.gen(function* () {
       // Clear the launch thread's previous scope instead.
       const continuing = shared === true && scope.supportsOomPolicy;
       const owned = threadId !== undefined && !continuing;
-      if (threadId !== undefined) yield* track(scope.systemctl, threadId, owned ? unit : undefined);
+      if (threadId !== undefined)
+        yield* track(scope.systemctl, threadId, owned ? unit : undefined, shared === true);
       const systemdScope: AgentSystemdScope = {
         systemdRun: scope.systemdRun,
         runtimeDir: scope.runtimeDir,
@@ -385,6 +422,7 @@ export const make = Effect.gen(function* () {
     }),
     oomKilled,
     stop,
+    kill,
     clear,
   } satisfies AgentScopeShape;
 });
diff --git a/apps/server/src/relay/AgentAwarenessRelay.test.ts b/apps/server/src/relay/AgentAwarenessRelay.test.ts
index 48c4a5c240ea9..40c741fdd68ac 100644
--- a/apps/server/src/relay/AgentAwarenessRelay.test.ts
+++ b/apps/server/src/relay/AgentAwarenessRelay.test.ts
@@ -219,6 +219,7 @@ const makeTestRelay = Effect.fnUntraced(function* (
     settleThread: unused,
     interruptThread: unused,
     stopWorkflow: () => Effect.die("unused stopWorkflow"),
+    forceStopThread: () => Effect.die("unused forceStopThread"),
     awaitBackgroundTasks: unused,
     stopDelegatedTasks: unused,
     getThreadEventSequence: unused,
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index a7ef5dedf24fb..622279d16a409 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -1914,6 +1914,8 @@ export const layerWsRpc = (
             ),
           ),
         [ORCHESTRATION_V2_WS_METHODS.stopWorkflow]: (input) => threadManagement.stopWorkflow(input),
+        [ORCHESTRATION_V2_WS_METHODS.forceStopThread]: (input) =>
+          threadManagement.forceStopThread(input),
         [ORCHESTRATION_V2_WS_METHODS.getWorkflowScript]: (input) =>
           readWorkflowScript({ scriptPath: input.scriptPath }),
         [ORCHESTRATION_V2_WS_METHODS.getTurnItem]: (input) =>
diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index 1bf6f9b0fc0e8..fa3e7e23dae6e 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -2349,7 +2349,8 @@ export default function ChatView(props: ChatViewProps) {
   const {
     acknowledgeActiveThreadWoke,
     activeBranchMismatchKey,
-    backgroundWorkNow,
+    attentionNow,
+    workNow,
     childInputNow,
     goalNow,
     handleSwitchCheckoutToThread,
@@ -2993,10 +2994,7 @@ export default function ChatView(props: ChatViewProps) {
   const onExpandTimelineImageStable = useStableCallback(onExpandTimelineImage);
   const shownThreadSyncPhase = activeEnvironmentUnavailable ? null : delayedThreadSyncPhase;
   const hasThreadNow =
-    childInputNow !== null ||
-    backgroundWorkNow !== null ||
-    goalNow !== null ||
-    shownThreadSyncPhase !== null;
+    attentionNow !== null || workNow !== null || goalNow !== null || shownThreadSyncPhase !== null;
   const queuedRunCount = serverProjection ? getUserQueuedThreadRuns(serverProjection).length : 0;
   // The queue control is mounted for every server thread but joins the footer only while it shows
   // something, by its own rule: an optimistic message stops counting once the server has it.
@@ -3035,8 +3033,8 @@ export default function ChatView(props: ChatViewProps) {
         )}
         <ThreadNow
           key={routeThreadKey}
-          attention={childInputNow}
-          work={backgroundWorkNow}
+          attention={attentionNow}
+          work={workNow}
           syncPhase={shownThreadSyncPhase}
           goal={goalNow}
         />
diff --git a/apps/web/src/components/chat/ThreadActivityBanners.tsx b/apps/web/src/components/chat/ThreadActivityBanners.tsx
index 168b674d26c92..8bd26e21a04dc 100644
--- a/apps/web/src/components/chat/ThreadActivityBanners.tsx
+++ b/apps/web/src/components/chat/ThreadActivityBanners.tsx
@@ -7,17 +7,20 @@ import type { EnvironmentThreadShell, ThreadStructure } from "@t3tools/client-ru
 import {
   presentPendingBackgroundWork,
   presentProviderGoal,
+  type RunStopPresentation,
 } from "@t3tools/client-runtime/state/thread-execution";
 import { childThreadInputsTitle } from "@t3tools/client-runtime/state/threads";
 import { formatDuration } from "@t3tools/shared/orchestrationTiming";
 import * as DateTime from "effect/DateTime";
 import {
   CircleDashedIcon,
+  CircleStopIcon,
   GitBranchIcon,
   MessageCircleIcon,
   ShieldQuestionIcon,
   TargetIcon,
   TerminalIcon,
+  TriangleAlertIcon,
 } from "lucide-react";
 import { Fragment } from "react";
 import { tickTextContent } from "~/lib/tickTextContent";
@@ -105,6 +108,46 @@ export function goalNowItem(input: {
   };
 }
 
+/** A Stop the provider has not finished; Force stop once it stops answering. */
+export function runStopNowItem(input: {
+  readonly threadId: ThreadId;
+  readonly stop: RunStopPresentation;
+  readonly canForceStop: boolean;
+  readonly forceStopping: boolean;
+  readonly onForceStop: () => void;
+}): ThreadNowItem {
+  const unresponsive = input.stop.state === "unresponsive";
+  const requestedAtMs = Date.parse(input.stop.requestedAt);
+  return {
+    id: `run-stop:${input.threadId}`,
+    icon: unresponsive ? (
+      <TriangleAlertIcon className="text-warning-foreground" />
+    ) : (
+      <CircleStopIcon />
+    ),
+    title: unresponsive ? "Agent not responding to Stop" : "Stopping",
+    description: unresponsive
+      ? "It may be short on memory. Force stop kills its processes."
+      : undefined,
+    actions: (
+      <>
+        <span
+          ref={tickTextContent(
+            (nowMs) => formatDuration(Math.max(1_000, nowMs - requestedAtMs)),
+            true,
+          )}
+          className="tabular-nums"
+        />
+        {unresponsive && input.canForceStop ? (
+          <InlineButton disabled={input.forceStopping} onClick={input.onForceStop}>
+            {input.forceStopping ? "Force stopping..." : "Force stop"}
+          </InlineButton>
+        ) : null}
+      </>
+    ),
+  };
+}
+
 /** Background commands and subagents, for the end of the timeline. */
 export function backgroundWorkNowItem(input: {
   readonly threadId: ThreadId;
diff --git a/apps/web/src/components/chat/useForceStopThread.ts b/apps/web/src/components/chat/useForceStopThread.ts
new file mode 100644
index 0000000000000..00876c758a8b6
--- /dev/null
+++ b/apps/web/src/components/chat/useForceStopThread.ts
@@ -0,0 +1,59 @@
+import { useAtomValue } from "@effect/atom-react";
+import type { EnvironmentId, RunId, ThreadId } from "@t3tools/contracts";
+import { useState } from "react";
+
+import { useServerConfigs } from "../../state/entities";
+import { orchestrationEnvironment } from "../../state/orchestration";
+import {
+  isAtomCommandInterrupted,
+  squashAtomCommandFailure,
+} from "@t3tools/client-runtime/state/runtime";
+import { useAtomCommand } from "../../state/use-atom-command";
+import { toastManager } from "../ui/toast";
+
+/** Force stop for an agent that no longer answers Stop; shared by every place that offers it. */
+export function useForceStopThread(environmentId: EnvironmentId) {
+  const forceStop = useAtomCommand(orchestrationEnvironment.forceStopThread);
+  const permitted = useAtomValue(
+    orchestrationEnvironment.forceStopThread.permissionAtom(environmentId),
+  );
+  const supported =
+    useServerConfigs().get(environmentId)?.environment.capabilities.threadForceStop === true;
+  const canForceStop = permitted && supported;
+  const [stoppingThreadId, setStoppingThreadId] = useState<ThreadId | null>(null);
+  /** Pass the run that ignored Stop, so a Force stop left open cannot hit a newer run. */
+  const forceStopThread = async (threadId: ThreadId, runId?: RunId) => {
+    if (!canForceStop || stoppingThreadId !== null) return;
+    setStoppingThreadId(threadId);
+    const result = await forceStop({
+      environmentId,
+      input: runId === undefined ? { threadId } : { threadId, runId },
+    });
+    setStoppingThreadId(null);
+    if (result._tag === "Failure") {
+      if (isAtomCommandInterrupted(result)) return;
+      const error = squashAtomCommandFailure(result);
+      toastManager.add({
+        type: "error",
+        title: "Could not force stop the agent",
+        description: error instanceof Error ? error.message : undefined,
+      });
+      return;
+    }
+    const others = result.value.sharedWithThreadIds.length;
+    if (result.value.outcome === "releasing") {
+      toastManager.add({
+        type: "info",
+        title: "Turn stopped; the agent is still shutting down",
+      });
+    }
+    if (result.value.outcome === "shared") {
+      toastManager.add({
+        type: "info",
+        title: "Turn stopped; the agent process kept running",
+        description: `It is shared with ${others === 0 ? "other" : others} working ${others === 1 ? "thread" : "threads"}. Stop those to free it.`,
+      });
+    }
+  };
+  return { canForceStop, stoppingThreadId, forceStopThread };
+}
diff --git a/apps/web/src/components/chat/useThreadLifecycle.tsx b/apps/web/src/components/chat/useThreadLifecycle.tsx
index b1cf8a4a6af4c..0ad8acacf71ce 100644
--- a/apps/web/src/components/chat/useThreadLifecycle.tsx
+++ b/apps/web/src/components/chat/useThreadLifecycle.tsx
@@ -58,9 +58,22 @@ import { appAtomRegistry } from "../../rpc/atomRegistry";
 import { readEnvironmentScope } from "../../state/session";
 import { useAtomCommand } from "../../state/use-atom-command";
 import { useOrchestrationCommand } from "../../state/use-orchestration-command";
-import { backgroundWorkNowItem, childInputNowItem, goalNowItem } from "./ThreadActivityBanners";
+import {
+  backgroundWorkNowItem,
+  childInputNowItem,
+  goalNowItem,
+  runStopNowItem,
+} from "./ThreadActivityBanners";
+import { useForceStopThread } from "./useForceStopThread";
+import { useAtomValue } from "@effect/atom-react";
+import type { RunStopPresentation } from "@t3tools/client-runtime/state/thread-execution";
+import { Atom } from "effect/reactivity";
+import { environmentThreadDetails } from "../../state/threads";
 import type { useLocalDispatchState } from "./useLocalDispatchState";
 const RELATED_THREAD_SHELL_WAIT_MS = 1_000;
+const NO_RUN_STOP_ATOM = Atom.make<RunStopPresentation | null>(null).pipe(
+  Atom.withLabel("web-thread-run-stop:empty"),
+);
 
 type PendingThreadRequests = ReturnType<typeof usePendingThreadRequests>;
 type LocalDispatchState = ReturnType<typeof useLocalDispatchState>;
@@ -509,6 +522,22 @@ export function useThreadLifecycle(input: ThreadLifecycleInput) {
         })
       : null;
 
+  const forceStop = useForceStopThread(environmentId);
+  const anyRunStop = useAtomValue(
+    activeThreadRef ? environmentThreadDetails.runStopAtom(activeThreadRef) : NO_RUN_STOP_ATOM,
+  );
+  // A background Stop matters only while that work is still pending.
+  const runStop = anyRunStop?.background && activeBackgroundTasks.length === 0 ? null : anyRunStop;
+  const runStopNow =
+    activeThread && runStop !== null
+      ? runStopNowItem({
+          threadId: activeThread.id,
+          stop: runStop,
+          canForceStop: forceStop.canForceStop,
+          forceStopping: forceStop.stoppingThreadId === activeThread.id,
+          onForceStop: () => void forceStop.forceStopThread(activeThread.id, runStop.runId),
+        })
+      : null;
   const backgroundWorkNow = activeThread
     ? backgroundWorkNowItem({
         threadId: activeThread.id,
@@ -592,7 +621,9 @@ export function useThreadLifecycle(input: ThreadLifecycleInput) {
     shortcuts,
     acknowledgeActiveThreadWoke,
     activeBranchMismatchKey,
-    backgroundWorkNow,
+    // A Stop that went unanswered needs the user; one in progress is the thread's work.
+    attentionNow: runStop?.state === "unresponsive" ? runStopNow : childInputNow,
+    workNow: runStop?.state === "stopping" ? runStopNow : backgroundWorkNow,
     childInputNow,
     goalNow,
     handleSwitchCheckoutToThread,
diff --git a/packages/client-runtime/src/state/orchestration.ts b/packages/client-runtime/src/state/orchestration.ts
index 4e6d3022b4812..5f5c2ce3020ac 100644
--- a/packages/client-runtime/src/state/orchestration.ts
+++ b/packages/client-runtime/src/state/orchestration.ts
@@ -107,6 +107,10 @@ export function createOrchestrationEnvironmentAtoms<R, E>(
       label: "environment-data:orchestration:stop-workflow",
       tag: ORCHESTRATION_V2_WS_METHODS.stopWorkflow,
     }),
+    forceStopThread: createEnvironmentRpcCommand(runtime, {
+      label: "environment-data:orchestration:force-stop-thread",
+      tag: ORCHESTRATION_V2_WS_METHODS.forceStopThread,
+    }),
     turnItem: createEnvironmentRpcQueryAtomFamily(runtime, {
       label: "environment-data:orchestration:turn-item",
       tag: ORCHESTRATION_V2_WS_METHODS.getTurnItem,
diff --git a/packages/client-runtime/src/state/threadDetail.ts b/packages/client-runtime/src/state/threadDetail.ts
index e1f30998caefb..3819c5d92ba5e 100644
--- a/packages/client-runtime/src/state/threadDetail.ts
+++ b/packages/client-runtime/src/state/threadDetail.ts
@@ -14,6 +14,7 @@ import {
   type ThreadQueueWorkflowState,
 } from "./threadWorkflows.ts";
 import { deriveThreadTurnSubagents, type ThreadTurnSubagents } from "./threadSubagents.ts";
+import { presentRunStop, type RunStopPresentation } from "./threadExecution.ts";
 import {
   deriveThreadCheckpointSummaries,
   type ThreadCheckpointSummary,
@@ -294,6 +295,32 @@ export function createEnvironmentThreadDetailAtoms<E>(
       return value;
     }).pipe(Atom.setIdleTTL(0), Atom.withLabel(`environment-thread-queue:${key}`));
   });
+  const runStopAtomFamily = Atom.family((key: string) => {
+    let previous: Pick<OrchestrationV2ThreadProjection, "runs" | "turnItems"> | null = null;
+    let stop: RunStopPresentation | null = null;
+    return Atom.make((get) => {
+      const projection = Option.getOrNull(get(threadStateValueAtomFamily(key)).data);
+      if (projection === null) {
+        previous = null;
+        stop = null;
+      } else if (
+        projection.runs !== previous?.runs ||
+        projection.turnItems !== previous?.turnItems
+      ) {
+        const { runs, turnItems } = projection;
+        previous = { runs, turnItems };
+        const next = presentRunStop(previous);
+        if (
+          next?.state !== stop?.state ||
+          next?.runId !== stop?.runId ||
+          next?.requestedAt !== stop?.requestedAt ||
+          next?.background !== stop?.background
+        )
+          stop = next;
+      }
+      return stop;
+    }).pipe(Atom.setIdleTTL(0), Atom.withLabel(`environment-thread-run-stop:${key}`));
+  });
   const queuedCountAtomFamily = Atom.family((key: string) => {
     let previous: Pick<OrchestrationV2ThreadProjection, "runs" | "messages"> | null = null;
     let count = 0;
@@ -435,6 +462,7 @@ export function createEnvironmentThreadDetailAtoms<E>(
     pendingRequestsAtom: (ref: ScopedThreadRef) => pendingRequestsAtomFamily(threadKey(ref)),
     queueWorkflowAtom: (ref: ScopedThreadRef) => queueWorkflowAtomFamily(threadKey(ref)),
     queuedCountAtom: (ref: ScopedThreadRef) => queuedCountAtomFamily(threadKey(ref)),
+    runStopAtom: (ref: ScopedThreadRef) => runStopAtomFamily(threadKey(ref)),
     turnSubagentsAtom: (ref: ScopedThreadRef) => turnSubagentsAtomFamily(threadKey(ref)),
     checkpointSummariesAtom: (ref: ScopedThreadRef) =>
       checkpointSummariesAtomFamily(threadKey(ref)),
diff --git a/packages/client-runtime/src/state/threadExecution.test.ts b/packages/client-runtime/src/state/threadExecution.test.ts
index 8ef37f959cd40..3f8ef2a7f9d31 100644
--- a/packages/client-runtime/src/state/threadExecution.test.ts
+++ b/packages/client-runtime/src/state/threadExecution.test.ts
@@ -25,6 +25,7 @@ import {
   deriveRunlessWorkStartedAt,
   deriveThreadActivityRun,
   deriveThreadRuntime,
+  presentRunStop,
   threadRuntimeHasInterruptibleRun,
 } from "./threadExecution.ts";
 
@@ -259,6 +260,74 @@ describe("thread execution presentation", () => {
   });
 });
 
+describe("presentRunStop", () => {
+  const signal = (type: "run_interrupt_request" | "run_interrupt_result", runId: RunId) => ({
+    id: TurnItemId.make(`${type}:${runId}`),
+    threadId: v2Projection.thread.id,
+    runId,
+    nodeId: null,
+    providerThreadId: null,
+    providerTurnId: null,
+    nativeItemRef: null,
+    parentItemId: null,
+    ordinal: 1,
+    status: type === "run_interrupt_result" ? ("interrupted" as const) : ("completed" as const),
+    title: "Interrupt",
+    startedAt: now,
+    completedAt: now,
+    updatedAt: now,
+    type,
+    message: "Stopped by user",
+  });
+  const running = run("run-stopping", 1, "running");
+  const request = signal("run_interrupt_request", running.id);
+
+  it.each([
+    { name: "no Stop", runs: [running], turnItems: [], state: null },
+    {
+      name: "a Stop the agent is winding down",
+      runs: [running],
+      turnItems: [request],
+      state: "stopping",
+    },
+    {
+      name: "a Stop the provider never confirmed",
+      runs: [running],
+      turnItems: [{ ...request, unresponsiveAt: now }],
+      state: "unresponsive",
+    },
+    {
+      name: "a Stop that ended the run",
+      runs: [running],
+      turnItems: [request, signal("run_interrupt_result", running.id)],
+      state: null,
+    },
+    {
+      name: "a settled run's background work still stopping",
+      runs: [{ ...running, status: "completed" as const, completedAt: now }],
+      turnItems: [request],
+      state: null,
+    },
+    {
+      name: "a settled run whose background work ignored Stop",
+      runs: [{ ...running, status: "completed" as const, completedAt: now }],
+      turnItems: [{ ...request, unresponsiveAt: now }],
+      state: "unresponsive",
+    },
+    {
+      name: "a settled run whose background work ignored Stop, with a queued follow-up",
+      runs: [
+        { ...running, status: "completed" as const, completedAt: now },
+        run("run-queued", 2, "queued"),
+      ],
+      turnItems: [{ ...request, unresponsiveAt: now }],
+      state: "unresponsive",
+    },
+  ])("presents $name", ({ runs, turnItems, state }) => {
+    expect(presentRunStop({ runs, turnItems })?.state ?? null).toBe(state);
+  });
+});
+
 describe("deriveRunlessWorkStartedAt", () => {
   const later = DateTime.makeUnsafe("2026-07-28T10:05:00.000Z");
   const rootTurn = (
diff --git a/packages/client-runtime/src/state/threadExecution.ts b/packages/client-runtime/src/state/threadExecution.ts
index ba87930bebbd5..52d07babfbb61 100644
--- a/packages/client-runtime/src/state/threadExecution.ts
+++ b/packages/client-runtime/src/state/threadExecution.ts
@@ -294,6 +294,55 @@ const BACKGROUND_WORK_KINDS: Record<
   background_task: { order: 3, singular: "background task", plural: "background tasks" },
 };
 
+export interface RunStopPresentation {
+  /** `unresponsive`: the provider did not confirm the stop in time, so Force stop is offered. */
+  readonly state: "stopping" | "unresponsive";
+  readonly runId: ThreadStructure["runs"][number]["id"];
+  readonly requestedAt: string;
+  /** The run already ended; the Stop targeted its background work. */
+  readonly background: boolean;
+}
+
+/**
+ * A Stop the provider has not finished yet. It stays `stopping` while the agent winds down,
+ * since some providers confirm the request before the turn actually ends. On a run that
+ * already ended, only an unanswered Stop of its background work counts.
+ */
+export function presentRunStop(
+  projection: Pick<ThreadStructure, "runs" | "turnItems">,
+): RunStopPresentation | null {
+  let active: ThreadStructure["runs"][number] | null = null;
+  let latest: ThreadStructure["runs"][number] | null = null;
+  for (const candidate of projection.runs) {
+    // Queued follow-ups never ran, so they hold no Stop of their own.
+    if (candidate.status !== "queued" && candidate.ordinal > (latest?.ordinal ?? -1))
+      latest = candidate;
+    if (
+      INTERRUPTIBLE_RUN_STATUSES.has(candidate.status) &&
+      candidate.ordinal > (active?.ordinal ?? -1)
+    )
+      active = candidate;
+  }
+  const run = active ?? latest;
+  if (run === null) return null;
+  let request:
+    | Extract<ThreadStructure["turnItems"][number], { type: "run_interrupt_request" }>
+    | undefined;
+  for (const item of projection.turnItems) {
+    if (item.runId !== run.id) continue;
+    if (item.type === "run_interrupt_result") return null;
+    if (item.type === "run_interrupt_request") request = item;
+  }
+  if (request === undefined || (active === null && request.unresponsiveAt === undefined))
+    return null;
+  return {
+    state: request.unresponsiveAt === undefined ? "stopping" : "unresponsive",
+    runId: run.id,
+    requestedAt: DateTime.formatIso(request.startedAt ?? request.updatedAt),
+    background: active === null,
+  };
+}
+
 export interface PendingBackgroundWorkItem {
   readonly taskId: string;
   readonly kind: BackgroundWorkKind;
diff --git a/packages/contracts/src/clientRpcPermissions.ts b/packages/contracts/src/clientRpcPermissions.ts
index f9564b2e2441c..d3139f2eeff24 100644
--- a/packages/contracts/src/clientRpcPermissions.ts
+++ b/packages/contracts/src/clientRpcPermissions.ts
@@ -60,6 +60,8 @@ export const CLIENT_GUARDED_RPC_SCOPES = {
   [WS_METHODS.scheduledTasksRunNow]: AuthOrchestrationOperateScope,
   [WS_METHODS.scheduledTasksRotateWebhookToken]: AuthOrchestrationOperateScope,
   [ORCHESTRATION_V2_WS_METHODS.stopWorkflow]: AuthOrchestrationOperateScope,
+  // Force stop kills agent processes, as Stop on a terminal does.
+  [ORCHESTRATION_V2_WS_METHODS.forceStopThread]: AuthOrchestrationOperateScope,
   // A guest link hands thread access to someone outside, like a pairing link.
   [WS_METHODS.guestShareCreate]: AuthAccessWriteScope,
   [WS_METHODS.peerLinksLink]: AuthAccessWriteScope,
diff --git a/packages/contracts/src/environment.ts b/packages/contracts/src/environment.ts
index 75a546bed875f..a10c6c2a6bce7 100644
--- a/packages/contracts/src/environment.ts
+++ b/packages/contracts/src/environment.ts
@@ -99,6 +99,8 @@ export const ExecutionEnvironmentCapabilities = Schema.Struct({
   /** Hide the switch when absent; older servers silently drop per-project provider patches. */
   projectProviderInstanceOverrides: Schema.optionalKey(Schema.Boolean),
   threadSnooze: Schema.optionalKey(Schema.Boolean),
+  /** Serves `orchestration.forceStopThread`; hide Force stop where it is absent. */
+  threadForceStop: Schema.optionalKey(Schema.Boolean),
   /** Every protocol-2 server sends this; older mobile builds still read it. */
   environmentThemes: Schema.optionalKey(Schema.Boolean),
   usageLimitSources: Schema.optionalKey(Schema.Boolean),
diff --git a/packages/contracts/src/orchestrationV2.ts b/packages/contracts/src/orchestrationV2.ts
index 026e74831233d..d20da5780255b 100644
--- a/packages/contracts/src/orchestrationV2.ts
+++ b/packages/contracts/src/orchestrationV2.ts
@@ -1676,6 +1676,8 @@ export const OrchestrationV2TurnItem = Schema.Union([
     ...OrchestrationV2TurnItemBaseFields,
     type: Schema.Literal("run_interrupt_request"),
     message: Schema.String,
+    /** Set when the provider did not confirm the stop in time; clients then offer Force stop. */
+    unresponsiveAt: Schema.optionalKey(Schema.DateTimeUtc),
   }),
   Schema.Struct({
     ...OrchestrationV2TurnItemBaseFields,
@@ -2500,6 +2502,7 @@ export const OrchestrationV2TurnItemJson = Schema.Union([
     ...OrchestrationV2TurnItemJsonBaseFields,
     type: Schema.Literal("run_interrupt_request"),
     message: Schema.String,
+    unresponsiveAt: Schema.optionalKey(Schema.DateTimeUtcFromString),
   }),
   Schema.Struct({
     ...OrchestrationV2TurnItemJsonBaseFields,
@@ -3436,12 +3439,22 @@ const OrchestrationV2InternalCommand = Schema.Union([
     threadId: ThreadId,
     requestId: RuntimeRequestId,
   }),
+  /** The provider did not confirm a Stop of this turn in time. */
+  Schema.Struct({
+    type: Schema.Literal("thread.interrupt.unresponsive"),
+    commandId: CommandId,
+    threadId: ThreadId,
+    providerThreadId: ProviderThreadId,
+    providerTurnId: ProviderTurnId,
+  }),
   Schema.Struct({
     type: Schema.Literal("thread.background-work.settle"),
     commandId: CommandId,
     threadId: ThreadId,
     providerThreadId: ProviderThreadId,
     providerTurnId: ProviderTurnId,
+    /** Replaces the Stop's own reason on the result, as Force stop does. */
+    reason: Schema.optional(Schema.String),
     subagent: Schema.optional(
       Schema.Struct({
         id: NodeId,
@@ -3521,6 +3534,7 @@ export const ORCHESTRATION_V2_WS_METHODS = {
   getThreadProjection: "orchestration.getThreadProjection",
   getWorkflowScript: "orchestration.getWorkflowScript",
   stopWorkflow: "orchestration.stopWorkflow",
+  forceStopThread: "orchestration.forceStopThread",
   getTurnItem: "orchestration.getTurnItem",
   launchThread: "orchestration.launchThread",
   subscribeShell: "orchestration.subscribeShell",
@@ -3908,6 +3922,41 @@ export class OrchestrationV2StopWorkflowError extends Schema.TaggedError<Orchest
   }
 }
 
+export const OrchestrationV2ForceStopThreadInput = Schema.Struct({
+  threadId: ThreadId,
+  /** The run the user saw ignore Stop; Force stop refuses once a newer run has started. */
+  runId: Schema.optionalKey(RunId),
+});
+export type OrchestrationV2ForceStopThreadInput = typeof OrchestrationV2ForceStopThreadInput.Type;
+
+export const OrchestrationV2ForceStopThreadResult = Schema.Struct({
+  /**
+   * `killed`: the thread's own agent processes were killed. `released`: its provider session
+   * was torn down, which kills the agent's process group. `releasing`: that teardown has not
+   * finished yet and continues on the server. `shared`: the agent process also works for
+   * `sharedWithThreadIds`, so only this thread's turn was ended.
+   */
+  outcome: Schema.Literals(["killed", "released", "releasing", "shared"]),
+  sharedWithThreadIds: Schema.Array(ThreadId),
+});
+export type OrchestrationV2ForceStopThreadResult = typeof OrchestrationV2ForceStopThreadResult.Type;
+
+export class OrchestrationV2ForceStopThreadError extends Schema.TaggedError<OrchestrationV2ForceStopThreadError>()(
+  "OrchestrationV2ForceStopThreadError",
+  {
+    threadId: ThreadId,
+    /** `superseded`: a newer run started since the user asked; nothing was stopped. */
+    reason: Schema.optional(Schema.Literal("superseded")),
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return this.reason === "superseded"
+      ? "A new turn started, so nothing was force stopped."
+      : "Failed to force stop the agent.";
+  }
+}
+
 export const OrchestrationV2GetWorkflowScriptInput = Schema.Struct({
   threadId: ThreadId,
   scriptPath: TrimmedNonEmptyString,
@@ -4094,6 +4143,10 @@ export const OrchestrationV2RpcSchemas = {
     input: OrchestrationV2StopWorkflowInput,
     output: Schema.Void,
   },
+  forceStopThread: {
+    input: OrchestrationV2ForceStopThreadInput,
+    output: OrchestrationV2ForceStopThreadResult,
+  },
   getWorkflowScript: {
     input: OrchestrationV2GetWorkflowScriptInput,
     output: OrchestrationV2GetWorkflowScriptResult,
diff --git a/packages/contracts/src/rpc.ts b/packages/contracts/src/rpc.ts
index aae86bd9db465..145fe5e06087c 100644
--- a/packages/contracts/src/rpc.ts
+++ b/packages/contracts/src/rpc.ts
@@ -220,6 +220,7 @@ import {
   ORCHESTRATION_V2_WS_METHODS,
   OrchestrationGetWorkflowScriptError,
   OrchestrationV2StopWorkflowError,
+  OrchestrationV2ForceStopThreadError,
   OrchestrationV2DispatchCommandError,
   OrchestrationV2GetShellSnapshotError,
   OrchestrationV2CommandOutputError,
@@ -1770,6 +1771,12 @@ const WsOrchestrationV2StopWorkflowRpc = Rpc.make(ORCHESTRATION_V2_WS_METHODS.st
   error: Schema.Union([OrchestrationV2StopWorkflowError, EnvironmentAuthorizationError]),
 });
 
+const WsOrchestrationV2ForceStopThreadRpc = Rpc.make(ORCHESTRATION_V2_WS_METHODS.forceStopThread, {
+  payload: OrchestrationV2RpcSchemas.forceStopThread.input,
+  success: OrchestrationV2RpcSchemas.forceStopThread.output,
+  error: Schema.Union([OrchestrationV2ForceStopThreadError, EnvironmentAuthorizationError]),
+});
+
 const WsOrchestrationV2GetWorkflowScriptRpc = Rpc.make(
   ORCHESTRATION_V2_WS_METHODS.getWorkflowScript,
   {
@@ -2122,6 +2129,7 @@ export const WsRpcGroup = RpcGroup.make(
   WsOrchestrationV2DispatchCommandRpc,
   WsOrchestrationV2GetWorkflowScriptRpc,
   WsOrchestrationV2StopWorkflowRpc,
+  WsOrchestrationV2ForceStopThreadRpc,
   WsOrchestrationV2GetTurnItemRpc,
   WsOrchestrationV2GetTurnDiffRpc,
   WsOrchestrationV2GetFullThreadDiffRpc,
diff --git a/packages/provider-acp/src/server/adapter.ts b/packages/provider-acp/src/server/adapter.ts
index 13f0cbbc240d5..c895abe3f5ef8 100644
--- a/packages/provider-acp/src/server/adapter.ts
+++ b/packages/provider-acp/src/server/adapter.ts
@@ -1324,6 +1324,8 @@ interface SnapshotMessageState {
   loadingIndex: number;
 }
 
+/** How long a Stop waits for the agent to confirm before the user is offered Force stop. */
+const ACP_STOP_CONFIRM_TIMEOUT_MS = 10_000;
 const TOOL_UPDATE_PERSIST_EVERY = 10;
 
 // Agents can resend whole calls while streaming arguments.
@@ -7989,7 +7991,9 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
               return yield* Effect.uninterruptibleMask((restore) =>
                 Effect.gen(function* () {
                   yield* restore(runtimeTransitionPermit.take(1));
-                  return yield* Effect.gen(function* () {
+                  // Stop's caller times out on this call. The transition runs in its own fiber so
+                  // a stalled hard teardown keeps its state and permit without holding the caller.
+                  const transitionFiber = yield* Effect.gen(function* () {
                     const transition = yield* Effect.gen(function* () {
                       const interruptContext = yield* Ref.get(activeTurn);
                       if (
@@ -8000,8 +8004,12 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                       ) {
                         // ACP cancel leaves native children alive; close confirms session-wide Stop.
                         pendingStopCloseTurn = interruptContext;
-                        const closed = yield* runtime.closeSession().pipe(
-                          Effect.timeoutOption("10 seconds"),
+                        // Interruptible, or neither this timeout nor the caller's could end a hung close.
+                        const closed = yield* restore(
+                          runtime
+                            .closeSession()
+                            .pipe(Effect.timeoutOption(ACP_STOP_CONFIRM_TIMEOUT_MS)),
+                        ).pipe(
                           Effect.mapError(
                             (cause) =>
                               new ProviderAdapter.ProviderAdapterProtocolError({
@@ -8013,10 +8021,11 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                           ),
                         );
                         if (Option.isNone(closed)) {
-                          return yield* new ProviderAdapter.ProviderAdapterProtocolError({
+                          return yield* new ProviderAdapter.ProviderAdapterInterruptTimeoutError({
                             driver,
-                            detail:
-                              "The agent did not confirm session close; background work may still run",
+                            providerThreadId: turnInput.providerThread.id,
+                            providerTurnId: turnInput.providerTurnId,
+                            timeoutMs: ACP_STOP_CONFIRM_TIMEOUT_MS,
                           });
                         }
                         yield* runtimeCallbackPermit.withPermit(
@@ -8246,15 +8255,16 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                         }
                       }
                       const stopped = yield* Deferred.await(context.completed).pipe(
-                        Effect.timeoutOption("10 seconds"),
+                        Effect.timeoutOption(ACP_STOP_CONFIRM_TIMEOUT_MS),
                       );
+                      // The turn stays open: the agent may still be working, and the user
+                      // decides whether to Force stop it.
                       if (Option.isNone(stopped)) {
-                        if (!context.finalized) {
-                          yield* finalizeTurn(context, "interrupted");
-                        }
-                        return yield* new ProviderAdapter.ProviderAdapterProtocolError({
+                        return yield* new ProviderAdapter.ProviderAdapterInterruptTimeoutError({
                           driver,
-                          detail: `ACP provider turn ${turnInput.providerTurnId} did not acknowledge cancellation before the interrupt timeout`,
+                          providerThreadId: turnInput.providerThread.id,
+                          providerTurnId: turnInput.providerTurnId,
+                          timeoutMs: ACP_STOP_CONFIRM_TIMEOUT_MS,
                         });
                       }
                     });
@@ -8275,20 +8285,29 @@ export const makeAcpAdapterV2 = Effect.fn("makeAcpAdapterV2")(function* (
                         }),
                       ),
                     );
-                  }).pipe(Effect.ensuring(runtimeTransitionPermit.release(1)));
+                  }).pipe(
+                    Effect.ensuring(runtimeTransitionPermit.release(1)),
+                    Effect.forkIn(sessionScope, { startImmediately: true, uninterruptible: true }),
+                  );
+                  return yield* restore(Fiber.join(transitionFiber)).pipe(
+                    Effect.onInterrupt(() =>
+                      Fiber.interrupt(transitionFiber).pipe(Effect.forkDetach, Effect.asVoid),
+                    ),
+                  );
                 }),
               );
             },
             (effect, turnInput) =>
               effect.pipe(
-                Effect.mapError(
-                  (cause) =>
-                    new ProviderAdapter.ProviderAdapterInterruptError({
-                      driver,
-                      providerThreadId: turnInput.providerThread.id,
-                      providerTurnId: turnInput.providerTurnId,
-                      cause,
-                    }),
+                Effect.mapError((cause) =>
+                  cause._tag === "ProviderAdapterInterruptTimeoutError"
+                    ? cause
+                    : new ProviderAdapter.ProviderAdapterInterruptError({
+                        driver,
+                        providerThreadId: turnInput.providerThread.id,
+                        providerTurnId: turnInput.providerTurnId,
+                        cause,
+                      }),
                 ),
               ),
           ),
diff --git a/packages/provider-core/src/server/ProviderAdapter.ts b/packages/provider-core/src/server/ProviderAdapter.ts
index e168512736c7c..0b5459f647f8d 100644
--- a/packages/provider-core/src/server/ProviderAdapter.ts
+++ b/packages/provider-core/src/server/ProviderAdapter.ts
@@ -327,6 +327,21 @@ export class ProviderAdapterInterruptError extends Schema.TaggedError<ProviderAd
   }
 }
 
+/** The provider did not confirm a stop in time; its processes may still be running. */
+export class ProviderAdapterInterruptTimeoutError extends Schema.TaggedError<ProviderAdapterInterruptTimeoutError>()(
+  "ProviderAdapterInterruptTimeoutError",
+  {
+    driver: ProviderDriverKind,
+    providerThreadId: ProviderThreadId,
+    providerTurnId: ProviderTurnId,
+    timeoutMs: Schema.Number,
+  },
+) {
+  override get message(): string {
+    return `The ${this.driver} provider did not confirm stopping turn ${this.providerTurnId} within ${this.timeoutMs} ms.`;
+  }
+}
+
 export class ProviderAdapterRuntimeRequestResponseError extends Schema.TaggedError<ProviderAdapterRuntimeRequestResponseError>()(
   "ProviderAdapterRuntimeRequestResponseError",
   {
@@ -388,6 +403,7 @@ export const ProviderAdapterV2Error = Schema.Union([
   ProviderAdapterSteerRunUnsupportedError,
   ProviderAdapterSteerRunError,
   ProviderAdapterInterruptError,
+  ProviderAdapterInterruptTimeoutError,
   ProviderAdapterRuntimeRequestResponseError,
   ProviderAdapterEventStreamError,
   ProviderAdapterProtocolError,
diff --git a/packages/shared/src/AgentScope.ts b/packages/shared/src/AgentScope.ts
index ce2d58c017b25..5f0ffca217172 100644
--- a/packages/shared/src/AgentScope.ts
+++ b/packages/shared/src/AgentScope.ts
@@ -22,6 +22,12 @@ export interface AgentScopeShape {
    * descendants outside its process group. Preserves systemd OOM diagnosis.
    */
   readonly stop: (unit: string) => Effect.Effect<void>;
+  /**
+   * SIGKILLs every process in the thread's own scope, which works even while
+   * the kernel throttles them. Shared scopes serve other threads and are never
+   * killed here. Succeeds with whether a scope was killed.
+   */
+  readonly kill: (threadId: string) => Effect.Effect<boolean>;
   /**
    * Forgets the thread's scope. The session manager calls it before it opens
    * a provider session, so a scope only answers for the session that launched
@@ -42,6 +48,7 @@ export const AgentScope = Context.Reference<AgentScopeShape>("@t3tools/shared/Ag
     wrap: ({ command, args }) => Effect.succeed({ command, args }),
     oomKilled: () => Effect.succeed(false),
     stop: () => Effect.void,
+    kill: () => Effect.succeed(false),
     clear: () => Effect.void,
   }),
 });

From 35c1210331a70fd3f460f9ad3425aed7d9a263cf Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 22:23:04 -0700
Subject: [PATCH 135/146] fix: guest links can load earlier turns (#27354)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/guest/GuestShareService.test.ts       | 85 +++++++++++++++++++
 apps/server/src/guest/GuestShareService.ts    | 22 +++++
 apps/server/src/guest/http.ts                 | 24 ++++++
 apps/web/src/components/guest/GuestPage.tsx   | 60 ++++++++++++-
 .../guest/guestStream.logic.test.ts           | 39 +++++++++
 .../src/components/guest/guestStream.logic.ts | 26 +++++-
 packages/client-runtime/package.json          |  4 +
 packages/contracts/src/guestShare.ts          |  5 ++
 8 files changed, 262 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/guest/GuestShareService.test.ts b/apps/server/src/guest/GuestShareService.test.ts
index 1ef25744c8c55..ac5ffc76aae77 100644
--- a/apps/server/src/guest/GuestShareService.test.ts
+++ b/apps/server/src/guest/GuestShareService.test.ts
@@ -7,6 +7,7 @@ import {
   GuestShareId,
   type GuestStreamEvent,
   MessageId,
+  type OrchestrationV2ThreadHistoryPage,
   type OrchestrationV2TurnItem,
   ProjectId,
   ProviderDriverKind,
@@ -529,6 +530,90 @@ it.effect("gives the guest a command's detail and output, but no file diffs", ()
   }).pipe(Effect.provide(layerTest)),
 );
 
+it.effect("pages the guest back through turns older than the stream's snapshot", () =>
+  Effect.gen(function* () {
+    const { guestShares, credential } = yield* shareThread;
+    const { token: session } = yield* guestShares.redeem({ credential, name: "Sam" });
+    const runId = yield* ownerRun;
+    const fileSystem = yield* FileSystem.FileSystem;
+    const directory = yield* fileSystem.makeTempDirectoryScoped();
+    const shot = `${directory}/old.png`;
+    yield* fileSystem.writeFile(shot, PNG);
+    const eventSink = yield* EventSink.EventSinkV2;
+    const now = yield* DateTime.now;
+    const base = { threadId, runId, nodeId: null, providerThreadId: null, providerTurnId: null };
+    const turnItem = (id: string, ordinal: number, payload: object) => ({
+      id: EventId.make(`event:${id}`),
+      type: "turn-item.updated" as const,
+      threadId,
+      driver: ProviderDriverKind.make("codex"),
+      providerInstanceId: instanceId,
+      occurredAt: now,
+      payload: {
+        ...base,
+        id: TurnItemId.make(id),
+        nativeItemRef: null,
+        parentItemId: null,
+        ordinal,
+        title: null,
+        status: "completed" as const,
+        startedAt: now,
+        completedAt: now,
+        updatedAt: now,
+        messageId: MessageId.make(id),
+        ...payload,
+      } as OrchestrationV2TurnItem,
+    });
+    yield* eventSink.write({
+      events: [
+        turnItem("item:old-image", 1, {
+          type: "assistant_message",
+          text: `![Old](${shot})`,
+          streaming: false,
+        }),
+        ...Array.from({ length: 30 }, (_, index) =>
+          turnItem(`item:ask-${index}`, index + 2, {
+            type: "user_message",
+            text: `Ask ${index}`,
+            createdBy: "user",
+            creationSource: "web",
+            inputIntent: "turn_start",
+            attachments: [],
+          }),
+        ),
+      ],
+    });
+
+    const [, opening] = Array.from(
+      yield* Stream.runCollect(Stream.take(yield* guestShares.stream(session), 2)),
+    );
+    if (opening?.type !== "thread" || opening.item.kind !== "snapshot") {
+      return assert.fail("Expected the thread snapshot second.");
+    }
+    const ids = (rows: ReadonlyArray<{ readonly sourceItemId: string }>) =>
+      rows.map((row) => row.sourceItemId);
+    assert.notInclude(ids(opening.item.projection.visibleTurnItems), "item:old-image");
+    let cursor = opening.item.historyCursor ?? null;
+    assert.isNotNull(cursor);
+    // The page has not shown the old reply yet, so its image does not load.
+    assert.equal((yield* Effect.flip(guestShares.media(session, shot))).reason, "unavailable");
+    // Only a session pages.
+    assert.isTrue(Exit.isFailure(yield* Effect.exit(guestShares.history(credential, cursor!))));
+
+    const older: Array<string> = [];
+    while (cursor !== null) {
+      const page: OrchestrationV2ThreadHistoryPage = yield* guestShares.history(session, cursor);
+      older.push(...ids(page.items));
+      cursor = page.hasMoreHistory ? page.nextCursor : null;
+    }
+    assert.include(older, "item:old-image");
+    assert.deepStrictEqual(yield* guestShares.media(session, shot), {
+      path: shot,
+      mimeType: "image/png",
+    });
+  }).pipe(Effect.scoped, Effect.provide(layerTest)),
+);
+
 it.effect("ends a running command's output once the owner stops sharing", () =>
   Effect.gen(function* () {
     const { orchestrator, guestShares, credential } = yield* shareThread;
diff --git a/apps/server/src/guest/GuestShareService.ts b/apps/server/src/guest/GuestShareService.ts
index 347bdc11ece5b..2a1bf853507ba 100644
--- a/apps/server/src/guest/GuestShareService.ts
+++ b/apps/server/src/guest/GuestShareService.ts
@@ -15,6 +15,7 @@ import {
   type OrchestrationV2CommandOutputFrame,
   type OrchestrationV2DomainEvent,
   type OrchestrationV2GetTurnItemResult,
+  type OrchestrationV2ThreadHistoryPage,
   type OrchestrationV2TurnItem,
   ThreadId,
   TurnItemId,
@@ -185,6 +186,11 @@ export class GuestShareService extends Context.Service<
       session: string,
       itemId: string,
     ) => Effect.Effect<OrchestrationV2GetTurnItemResult, GuestShareAccessError>;
+    /** Older turns of the shared thread, as the owner's client pages them. */
+    readonly history: (
+      session: string,
+      cursor: string,
+    ) => Effect.Effect<OrchestrationV2ThreadHistoryPage, GuestShareAccessError>;
     /** A command's output frames, as the owner's expanded row gets them, until the link ends. */
     readonly commandOutput: (
       session: string,
@@ -665,6 +671,21 @@ const make = Effect.gen(function* () {
     };
   });
 
+  const history = Effect.fn("GuestShareService.history")(function* (
+    session: string,
+    cursor: string,
+  ) {
+    const { thread, share } = yield* authorize(session, "session");
+    const page = yield* orchestrator
+      .getThreadHistoryPage(thread.id, cursor)
+      .pipe(Effect.mapError(() => unavailable));
+    rememberSent(
+      share.id,
+      page.items.map((row) => row.item),
+    );
+    return page;
+  });
+
   const commandOutput = Effect.fn("GuestShareService.commandOutput")(function* (
     session: string,
     itemId: string,
@@ -739,6 +760,7 @@ const make = Effect.gen(function* () {
     stream,
     render,
     item,
+    history,
     commandOutput,
     attachment,
     media,
diff --git a/apps/server/src/guest/http.ts b/apps/server/src/guest/http.ts
index bf368ac884d92..b3e856200c845 100644
--- a/apps/server/src/guest/http.ts
+++ b/apps/server/src/guest/http.ts
@@ -1,6 +1,7 @@
 import {
   GUEST_ATTACHMENT_ROUTE,
   GUEST_COMMAND_OUTPUT_ROUTE,
+  GUEST_HISTORY_ROUTE,
   GUEST_ITEM_ROUTE,
   GUEST_MEDIA_ROUTE,
   GUEST_RENDER_ROUTE,
@@ -16,6 +17,7 @@ import {
   isProviderSendTurnSupportedImageMimeType,
   OrchestrationV2CommandOutputFrame,
   OrchestrationV2GetTurnItemResult,
+  OrchestrationV2ThreadHistoryPage,
 } from "@t3tools/contracts";
 import * as ByteSize from "effect/ByteSize";
 import * as Duration from "effect/Duration";
@@ -52,6 +54,7 @@ const encodeOutputFrame = Schema.encodeEffect(
   Schema.fromJsonString(OrchestrationV2CommandOutputFrame),
 );
 const encodeItem = Schema.encodeEffect(Schema.toCodecJson(OrchestrationV2GetTurnItemResult));
+const encodeHistoryPage = Schema.encodeEffect(Schema.toCodecJson(OrchestrationV2ThreadHistoryPage));
 
 const errorResponse = (error: GuestShareAccessError) =>
   HttpServerResponse.json(
@@ -292,6 +295,26 @@ const itemRoute = HttpRouter.add(
   }),
 );
 
+const historyRoute = HttpRouter.add(
+  "GET",
+  GUEST_HISTORY_ROUTE,
+  Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest;
+    const cursor = new URLSearchParams(request.url.split("?", 2)[1] ?? "").get("cursor");
+    if (!cursor) return yield* badRequest;
+    const guestShares = yield* GuestShareService;
+    return yield* guestShares.history(yield* sessionToken, cursor).pipe(
+      Effect.flatMap((page) =>
+        encodeHistoryPage(page).pipe(
+          Effect.mapError(() => new GuestShareAccessError({ reason: "unavailable" })),
+        ),
+      ),
+      Effect.map((body) => HttpServerResponse.jsonUnsafe(body, { headers: NO_STORE })),
+      Effect.catchTags({ GuestShareAccessError: errorResponse }),
+    );
+  }),
+);
+
 // Ends when the command settles; the page closes its EventSource on that last frame, so the
 // browser does not reconnect.
 const commandOutputRoute = HttpRouter.add(
@@ -365,6 +388,7 @@ export const layer = Layer.mergeAll(
   streamRoute,
   renderRoute,
   itemRoute,
+  historyRoute,
   commandOutputRoute,
   attachmentRoute,
   mediaRoute,
diff --git a/apps/web/src/components/guest/GuestPage.tsx b/apps/web/src/components/guest/GuestPage.tsx
index 21c35447ddf8c..7e41e9a8ca297 100644
--- a/apps/web/src/components/guest/GuestPage.tsx
+++ b/apps/web/src/components/guest/GuestPage.tsx
@@ -1,6 +1,7 @@
 import {
   EnvironmentId,
   GUEST_MESSAGE_MAX_LENGTH,
+  GUEST_HISTORY_ROUTE,
   GUEST_NAME_MAX_LENGTH,
   GUEST_ROUTE_PREFIX,
   GUEST_SHARE_PARAM,
@@ -8,6 +9,7 @@ import {
   type GuestRedeemRequest,
   type GuestShareView,
   type GuestThreadModel,
+  OrchestrationV2ThreadHistoryPage,
   type OrchestrationV2ThreadProjection,
   type ThreadGuestMessage,
   type ThreadGuestMessageStatus,
@@ -46,7 +48,7 @@ import { GuestMessageAttachments } from "../chat/GuestMessageAttachments";
 import { HostImageUrlContext } from "../chat/hostImageUrl";
 import { PierreEntryIcon } from "../chat/PierreEntryIcon";
 import { GuestMessageName, guestBubbleClassName } from "../chat/guestMessageStyle";
-import { MessagesTimeline } from "../chat/MessagesTimeline";
+import { MessagesTimeline, type MessagesTimelineHistoryControls } from "../chat/MessagesTimeline";
 import { ProviderInstanceIcon } from "../chat/ProviderInstanceIcon";
 import { getDisplayModelName, getTriggerDisplayModelName } from "../chat/providerIconUtils";
 import { ScrollToEndButton } from "../chat/TimelineOverlays";
@@ -131,6 +133,32 @@ function takeGuestEntry(): GuestEntry {
 }
 
 const decodeErrorBody = Schema.decodeUnknownOption(Schema.Struct({ message: Schema.String }));
+const decodeHistoryPage = Schema.decodeUnknownOption(
+  Schema.toCodecJson(OrchestrationV2ThreadHistoryPage),
+);
+
+/** Resolves to the page, or to a message the guest can read. */
+async function fetchGuestHistoryPage(
+  shareId: string,
+  cursor: string,
+): Promise<OrchestrationV2ThreadHistoryPage | string> {
+  const failed = "Could not load earlier turns. Try again.";
+  try {
+    const response = await fetch(
+      `${GUEST_HISTORY_ROUTE}?${GUEST_SHARE_PARAM}=${encodeURIComponent(shareId)}&cursor=${encodeURIComponent(cursor)}`,
+    );
+    const json: unknown = await response.json().catch(() => null);
+    if (!response.ok) {
+      return Option.match(decodeErrorBody(json), {
+        onNone: () => failed,
+        onSome: ({ message }) => message,
+      });
+    }
+    return Option.getOrElse(decodeHistoryPage(json), () => failed);
+  } catch {
+    return "Could not reach the server.";
+  }
+}
 
 /** Resolves to null on success, or to a message the guest can read. */
 async function postGuest(
@@ -241,6 +269,32 @@ function GuestSession({ shareId }: { readonly shareId: string }) {
   // missing, invalid, or ended session. Network drops reconnect on their own.
   const [rejected, setRejected] = useState(false);
 
+  const [historyLoad, setHistoryLoad] = useState<{
+    readonly cursor: string;
+    readonly error: string | null;
+  } | null>(null);
+  const historyCursor = stream.historyCursor;
+  // A load for an older cursor is stale: a page or a reconnect snapshot moved the cursor on.
+  const currentLoad = historyLoad?.cursor === historyCursor ? historyLoad : null;
+  const loadingHistory = currentLoad !== null && currentLoad.error === null;
+  const historyError = currentLoad?.error ?? null;
+  const loadEarlier = async () => {
+    if (historyCursor === null || loadingHistory) return;
+    setHistoryLoad({ cursor: historyCursor, error: null });
+    const result = await fetchGuestHistoryPage(shareId, historyCursor);
+    if (typeof result === "string") setHistoryLoad({ cursor: historyCursor, error: result });
+    else dispatch({ type: "history-page", cursor: historyCursor, page: result });
+  };
+  const historyControls: MessagesTimelineHistoryControls | undefined =
+    historyCursor === null
+      ? undefined
+      : {
+          hasMoreHistory: true,
+          loading: loadingHistory,
+          error: historyError,
+          onLoadEarlier: () => void loadEarlier(),
+        };
+
   // oxlint-disable-next-line t3code/no-unreasoned-state-sync -- sets document.title to the shared thread's title
   useEffect(() => {
     if (stream.view) document.title = stream.view.title;
@@ -273,6 +327,7 @@ function GuestSession({ shareId }: { readonly shareId: string }) {
         view={stream.view}
         projection={stream.projection}
         awaitingRowIds={stream.awaitingRowIds}
+        historyControls={historyControls}
       />
     );
   }
@@ -358,10 +413,12 @@ function GuestThread({
   view: { shareId, title, expiresAt, messages, model },
   projection,
   awaitingRowIds,
+  historyControls,
 }: {
   readonly view: GuestShareView;
   readonly projection: OrchestrationV2ThreadProjection;
   readonly awaitingRowIds: GuestStreamState["awaitingRowIds"];
+  readonly historyControls: MessagesTimelineHistoryControls | undefined;
 }) {
   // No ":" so the timeline finds no environment thread behind the key.
   const threadKey = `guest-${shareId}`;
@@ -467,6 +524,7 @@ function GuestThread({
             onFileDownload={openFile}
             renderHtmlRender={renderHtmlRender}
             turnItemSource={turnItemSource}
+            historyControls={historyControls}
             activeThreadEnvironmentId={GUEST_ENVIRONMENT_ID}
             markdownCwd={undefined}
             resolvedTheme={resolvedTheme}
diff --git a/apps/web/src/components/guest/guestStream.logic.test.ts b/apps/web/src/components/guest/guestStream.logic.test.ts
index fbdf9ce1927c2..674227dc171ff 100644
--- a/apps/web/src/components/guest/guestStream.logic.test.ts
+++ b/apps/web/src/components/guest/guestStream.logic.test.ts
@@ -112,6 +112,45 @@ describe("applyGuestStreamEvent", () => {
     expect(apply([itemEvent(2, reply("a1", "Changed"))], once)).toBe(once);
   });
 
+  it("merges older pages in front, only for the cursor the thread is at", () => {
+    const windowed: GuestStreamEvent = {
+      type: "thread",
+      item: {
+        kind: "snapshot",
+        snapshotSequence: 1,
+        projection,
+        historyCursor: "cursor-1",
+        hasMoreHistory: true,
+      },
+    };
+    const page = (id: string, nextCursor: string | null) => ({
+      snapshotSequence: 1,
+      items: [
+        {
+          position: 0,
+          visibility: "local" as const,
+          sourceThreadId: projection.thread.id,
+          sourceItemId: TurnItemId.make(id),
+          item: reply(id, "Earlier"),
+        },
+      ],
+      nextCursor,
+      hasMoreHistory: nextCursor !== null,
+    });
+    const live = apply([windowed, itemEvent(2, reply("a1", "Hi"))]);
+    expect(live.historyCursor).toBe("cursor-1");
+    // A page fetched before a reconnect moved the cursor changes nothing.
+    const stale = { type: "history-page" as const, cursor: "cursor-0", page: page("old", null) };
+    expect(applyGuestStreamEvent(live, stale)).toBe(live);
+    const merged = applyGuestStreamEvent(live, {
+      type: "history-page",
+      cursor: "cursor-1",
+      page: page("o1", null),
+    });
+    expect(itemIds(merged)).toEqual(["o1", "a1"]);
+    expect(merged.historyCursor).toBeNull();
+  });
+
   it("replaces the thread on a new snapshot, as after a reconnect", () => {
     const before = apply([snapshot(1), itemEvent(2, reply("a1", "Hi")), { type: "ended" }]);
     const after = apply([snapshot(1)], { ...before, ended: false });
diff --git a/apps/web/src/components/guest/guestStream.logic.ts b/apps/web/src/components/guest/guestStream.logic.ts
index 0b37d66eeec84..03eafb6d348ee 100644
--- a/apps/web/src/components/guest/guestStream.logic.ts
+++ b/apps/web/src/components/guest/guestStream.logic.ts
@@ -9,11 +9,13 @@ import {
   type GuestMessageId,
   type GuestShareView,
   type OrchestrationV2ProjectedTurnItem,
+  type OrchestrationV2ThreadHistoryPage,
   type OrchestrationV2ThreadProjection,
   type OrchestrationV2TurnItem,
   type ThreadGuestMessage,
 } from "@t3tools/contracts";
 import { applyOrchestrationV2ProjectionEvent } from "@t3tools/client-runtime/state/orchestration-v2-projection";
+import { mergeOlderHistoryIntoProjection } from "@t3tools/client-runtime/state/thread-history-merge";
 import { boundedSnapshotProjection } from "@t3tools/shared/orchestrationV2BoundedSnapshot";
 import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
@@ -25,6 +27,8 @@ export interface GuestStreamState {
   readonly sequence: number;
   /** Set while the snapshot is a window of a longer history, as the owner's client tracks it. */
   readonly partial: { readonly latestLocalTurnOrdinal: number | null } | null;
+  /** Where "Load earlier turns" continues, or null once the whole thread is loaded. */
+  readonly historyCursor: string | null;
   readonly ended: boolean;
   /**
    * Messages this page saw waiting that have no transcript row yet. Survives reconnects, and a
@@ -38,6 +42,7 @@ export const initialGuestStreamState: GuestStreamState = {
   projection: null,
   sequence: 0,
   partial: null,
+  historyCursor: null,
   ended: false,
   awaitingRowIds: new Set(),
 };
@@ -76,16 +81,32 @@ const decodeGuestStreamEvent = Schema.decodeUnknownOption(
 export const parseGuestStreamEvent = (data: string): GuestStreamEvent | null =>
   Option.getOrNull(decodeGuestStreamEvent(data));
 
+/** A page of older turns, fetched from `cursor`. */
+export type GuestHistoryPageLoaded = {
+  readonly type: "history-page";
+  readonly cursor: string;
+  readonly page: OrchestrationV2ThreadHistoryPage;
+};
+
 /**
  * Applies the owner's thread stream the way the owner's client does (see
  * EnvironmentThreadState in client-runtime): a snapshot replaces the thread, and later events
- * pass through the same projection reducer, once each.
+ * pass through the same projection reducer, once each. Older pages merge in front, as they do in
+ * the owner's view.
  */
 export function applyGuestStreamEvent(
   state: GuestStreamState,
-  event: GuestStreamEvent,
+  event: GuestStreamEvent | GuestHistoryPageLoaded,
 ): GuestStreamState {
   switch (event.type) {
+    case "history-page":
+      // A snapshot since the request replaced the thread and its cursor.
+      if (state.projection === null || state.historyCursor !== event.cursor) return state;
+      return {
+        ...state,
+        projection: mergeOlderHistoryIntoProjection(state.projection, event.page.items),
+        historyCursor: event.page.hasMoreHistory ? event.page.nextCursor : null,
+      };
     case "view":
       // The page follows the share it names; a view of another one means the link changed.
       if (state.view !== null && state.view.shareId !== event.view.shareId) {
@@ -108,6 +129,7 @@ export function applyGuestStreamEvent(
             item.hasMoreHistory === true || (item.historyCursor ?? null) !== null
               ? { latestLocalTurnOrdinal: item.latestLocalTurnOrdinal ?? null }
               : null,
+          historyCursor: item.hasMoreHistory === true ? (item.historyCursor ?? null) : null,
           awaitingRowIds: withoutPlaced(
             state.awaitingRowIds,
             projection.visibleTurnItems.map((row) => row.item),
diff --git a/packages/client-runtime/package.json b/packages/client-runtime/package.json
index e1f81638ea3d4..9600ad7ad356d 100644
--- a/packages/client-runtime/package.json
+++ b/packages/client-runtime/package.json
@@ -203,6 +203,10 @@
       "types": "./src/state/orchestration.ts",
       "default": "./src/state/orchestration.ts"
     },
+    "./state/thread-history-merge": {
+      "types": "./src/state/threadHistoryMerge.ts",
+      "default": "./src/state/threadHistoryMerge.ts"
+    },
     "./state/orchestration-v2-projection": {
       "types": "./src/state/orchestrationV2Projection.ts",
       "default": "./src/state/orchestrationV2Projection.ts"
diff --git a/packages/contracts/src/guestShare.ts b/packages/contracts/src/guestShare.ts
index fd991fe1e4c3b..715a837daeae3 100644
--- a/packages/contracts/src/guestShare.ts
+++ b/packages/contracts/src/guestShare.ts
@@ -129,6 +129,11 @@ export const guestSessionCookieName = (shareId: string) => `t3_guest_${shareId}`
 export const GUEST_RENDER_ROUTE = `${GUEST_ROUTE_PREFIX}/render`;
 /** One item of the shared thread, as an expanded row loads it: `?share=<share id>&item=<id>`. */
 export const GUEST_ITEM_ROUTE = `${GUEST_ROUTE_PREFIX}/item`;
+/**
+ * Older turns of the shared thread, as the owner's "Load earlier turns" pages them:
+ * `?share=<share id>&cursor=<history cursor>`.
+ */
+export const GUEST_HISTORY_ROUTE = `${GUEST_ROUTE_PREFIX}/history`;
 /** Server-sent output frames of one command in the shared thread: `?share=<share id>&item=<id>`. */
 export const GUEST_COMMAND_OUTPUT_ROUTE = `${GUEST_ROUTE_PREFIX}/command-output`;
 /**

From da8cc591dadd75819ae62961da4a882767efb145 Mon Sep 17 00:00:00 2001
From: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Date: Thu, 29 Oct 2026 22:34:35 -0700
Subject: [PATCH 136/146] fix(ci): repair main after merge burst

Rename leftover fakeProvider to fakePullRequestProvider, replace the removed
encodeScanCache in the advisor usage test, and drop an issue number from a
ClaudeAdapterV2 comment that lint rejects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts | 2 +-
 apps/server/src/pullRequest/PullRequestService.test.ts       | 4 ++--
 apps/server/src/usage/usageScanCache.test.ts                 | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
index a821a4713b292..428e44e19020c 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.ts
@@ -4216,7 +4216,7 @@ function claudeTaskString(value: unknown, key: string): string | undefined {
 }
 
 // A Claude Code mod can hold a tool call until the user acts in its terminal
-// pane. T3 cannot provide the requested pane interaction (#17531).
+// pane. T3 cannot provide the requested pane interaction.
 // Passive panes never request focus and keep working.
 function claudeFocusRequestedPanePlugin(message: SDKMessage): string | null {
   if (message.type !== "system" || claudeTaskField(message, "subtype") !== "ui_panes") return null;
diff --git a/apps/server/src/pullRequest/PullRequestService.test.ts b/apps/server/src/pullRequest/PullRequestService.test.ts
index 2b4d2f68c5502..3c511b292afb8 100644
--- a/apps/server/src/pullRequest/PullRequestService.test.ts
+++ b/apps/server/src/pullRequest/PullRequestService.test.ts
@@ -2204,7 +2204,7 @@ it.effect("a refresh or a finished turn drops the provider's own change request
         }),
       ],
       providers: [
-        fakeProvider(SourceControlProviderKind.make("gitlab"), {
+        fakePullRequestProvider(SourceControlProviderKind.make("gitlab"), {
           forgetChangeRequestReads: (scope) => Effect.sync(() => void forgotten.push(scope)),
         }),
       ],
@@ -2241,7 +2241,7 @@ it.effect("a read during a refresh cannot keep the provider's old change request
         }),
       ],
       providers: [
-        fakeProvider(SourceControlProviderKind.make("gitlab"), {
+        fakePullRequestProvider(SourceControlProviderKind.make("gitlab"), {
           getChangeRequest: () =>
             Effect.sync(() => {
               held ??= hostTitle;
diff --git a/apps/server/src/usage/usageScanCache.test.ts b/apps/server/src/usage/usageScanCache.test.ts
index be8ad53c6e45a..477b8bb6fc4f6 100644
--- a/apps/server/src/usage/usageScanCache.test.ts
+++ b/apps/server/src/usage/usageScanCache.test.ts
@@ -251,7 +251,7 @@ describe("scan cache round trip", () => {
 
   it("re-parses a Claude transcript cached before advisor usage was counted", () => {
     const original = cacheWith([["/claude.jsonl", 100, [record()]]]);
-    const v9 = { ...encodeScanCache(original), version: 9 };
+    const v9 = { ...JSON.parse(makeScanCacheWriter()(original, {})), version: 9 };
 
     const restored = decodeScanCache(JSON.parse(JSON.stringify(v9)), TEST_FORMAT_MAP);
     expect(restored.get("/claude.jsonl")).toEqual({

From fa4e4677c0ecc437aece2dcea39f76ef31414152 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Thu, 29 Oct 2026 23:04:17 -0700
Subject: [PATCH 137/146] fix(server): let slow worktree checkouts finish
 (#23802)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 48 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      |  5 +-
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index cbc3efcc3b4e7..d05a41a6f3824 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -920,6 +920,54 @@ it.effect("retries a fetch that lost a ref update to another Git process", () =>
   }).pipe(Effect.provide(layerServerConfig.pipe(Layer.provideMerge(NodeServices.layer)))),
 );
 
+it.effect("lets a worktree checkout that is still working run past five minutes", () =>
+  Effect.gen(function* () {
+    const checkoutStarted = yield* Deferred.make<void>();
+    const checkoutFinished = yield* Deferred.make<void>();
+    const spawner = ChildProcessSpawner.make((command) =>
+      Effect.gen(function* () {
+        if (!ChildProcess.isStandardCommand(command))
+          return yield* Effect.die("expected Git command");
+        if (!command.args.includes("worktree")) return makeSuccessfulHandle("");
+        yield* Deferred.succeed(checkoutStarted, undefined);
+        return ChildProcessSpawner.makeHandle({
+          ...makeSuccessfulHandle(""),
+          exitCode: Deferred.await(checkoutFinished).pipe(
+            Effect.as(ChildProcessSpawner.ExitCode(0)),
+          ),
+          stderr: Stream.encodeText(
+            Stream.concat(
+              Stream.make("Updating files:  40% (49052/122629)\n"),
+              Stream.fromEffect(
+                Deferred.await(checkoutFinished).pipe(
+                  Effect.as("Updating files: 100% (122629/122629), done.\n"),
+                ),
+              ),
+            ),
+          ),
+        });
+      }),
+    );
+    const driver = yield* makeGitVcsDriverCore().pipe(
+      Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, spawner),
+    );
+    const path = yield* Path.Path;
+    const cwd = yield* makeTmpDir();
+    const worktreePath = path.join(cwd, "worktree");
+
+    const creation = yield* driver
+      .createWorktree({ cwd, refName: "main", newRefName: "t3/slow-checkout", path: worktreePath })
+      .pipe(Effect.forkChild);
+    yield* Deferred.await(checkoutStarted);
+    yield* TestClock.adjust("6 minutes");
+    yield* Deferred.succeed(checkoutFinished, undefined);
+
+    const result = yield* Fiber.join(creation);
+    assert.equal(result.worktree.path, worktreePath);
+    assert.equal(result.worktree.refName, "t3/slow-checkout");
+  }).pipe(Effect.provide(layerServerConfig.pipe(Layer.provideMerge(NodeServices.layer)))),
+);
+
 describe("rejected git refs", () => {
   const remoteUrl = "https://user:token-123@git.example.invalid/org/secret-repo.git";
   const failedPush = `error: failed to push some refs to '${remoteUrl}'`;
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 03f0286ce50d7..3a7c99fbc3d31 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -62,7 +62,6 @@ const branchBaseConfigKey = (branch: string) => `branch.${branch}.t3-merge-base`
  */
 const legacyBranchBaseConfigKey = (branch: string) => `branch.${branch}.gh-merge-base`;
 const gitProcesses = Semaphore.makeUnsafe(8);
-const WORKTREE_ADD_TIMEOUT_MS = 300_000;
 const WORKTREE_REMOVE_TIMEOUT_MS = Duration.toMillis(Duration.minutes(5));
 const DEFAULT_MAX_OUTPUT_BYTES = 1_000_000;
 const OUTPUT_TRUNCATED_MARKER = "\n\n[truncated]";
@@ -3877,7 +3876,9 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       ["-c", `checkout.workers=${checkoutWorkers}`, ...args],
       {
         fallbackErrorDetail: "git worktree add failed",
-        timeoutMs: WORKTREE_ADD_TIMEOUT_MS,
+        // Large checkouts and post-checkout hooks can legitimately run for many
+        // minutes; a fixed deadline kills them and leaves an orphaned worktree.
+        timeoutMs: null,
         ...(onCheckoutProgress
           ? {
               // Git only prints checkout progress when stderr is a tty or the

From 97e35bcf23e4dcf34c2dcffadd37c08db0e01e52 Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Fri, 30 Oct 2026 02:51:36 -0400
Subject: [PATCH 138/146] feat(settings): point provider environment variables
 at a secret provider (#27115)

Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../SettingsEnvironmentDetailRouteScreen.tsx  |   5 +-
 apps/server/package.json                      |   3 +
 apps/server/src/auth/RpcAuthorization.test.ts |  24 +-
 apps/server/src/auth/RpcAuthorization.ts      |   3 +-
 .../Adapters/ClaudeAdapterV2.test.ts          |   4 +-
 .../Adapters/PiAdapterV2.testkit.ts           |   4 +-
 .../server/src/project/AgentSessionScanner.ts |   6 +-
 .../provider/ProviderInstanceRegistry.test.ts | 175 ++++++++++++++
 .../src/provider/ProviderInstanceRegistry.ts  | 201 ++++++++++++++--
 .../ProviderInstanceRegistryHydration.ts      |  11 +-
 .../ProviderInstanceRegistryMutator.ts        |   4 +-
 .../src/provider/ProviderRegistry.test.ts     |  27 ++-
 apps/server/src/provider/ProviderRegistry.ts  |  24 +-
 .../provider/providerCompatibility.test.ts    |  12 +-
 .../providerMaintenanceRunner.test.ts         |   1 +
 .../testUtils/providerRegistryMock.ts         |   1 +
 apps/server/src/secrets/SecretResolver.ts     |  20 ++
 .../secrets/secretProviderDefinitions.test.ts |  12 +
 .../src/secrets/secretProviderDefinitions.ts  |   7 +
 apps/server/src/serverSettings.test.ts        |  43 ++++
 apps/server/src/serverSettings.ts             |  43 +++-
 apps/server/src/settingsSecrets.ts            |   9 +-
 apps/server/src/ws.ts                         |   9 +-
 apps/web/package.json                         |   2 +
 .../settings/AddProviderInstanceDialog.tsx    |   3 +
 .../settings/ProviderInstanceCard.test.ts     |  17 +-
 .../settings/ProviderInstanceCard.tsx         | 221 ++++++++++++------
 .../settings/ProviderSettingsPanel.tsx        |   5 +-
 .../settings/SecretProviderDialog.logic.ts    |   6 +-
 .../SecretSourceInput.browser.test.tsx        |  82 +++++++
 .../components/settings/SecretSourceInput.tsx | 185 +++++++++++++++
 package.json                                  |   2 +-
 packages/contracts/src/index.ts               |   1 +
 packages/contracts/src/providerInstance.ts    |  35 ++-
 packages/contracts/src/rpc.ts                 |   2 +
 packages/contracts/src/secretReference.ts     |  27 +++
 packages/contracts/src/server.ts              |   2 +
 packages/contracts/src/settings.test.ts       |  59 ++++-
 packages/contracts/src/settings.ts            |  58 +----
 packages/provider-core/src/server/driver.ts   |   4 +-
 .../src/server/instanceEnvironment.test.ts    |  12 +-
 .../src/server/instanceEnvironment.ts         |   2 +
 packages/secret-provider-core/package.json    |  33 +++
 .../src/server/SecretResolver.test.ts         | 170 ++++++++++++++
 .../src/server/SecretResolver.ts              | 125 ++++++++++
 .../secret-provider-core/src/server/driver.ts |  46 ++++
 .../src/shared/definition.ts                  |  35 +++
 packages/secret-provider-core/tsconfig.json   |   7 +
 .../secret-provider-definitions/package.json  |  18 ++
 .../src/registry.ts                           |   6 +
 .../secret-provider-definitions/tsconfig.json |   4 +
 .../secret-provider-onepassword/package.json  |  32 +++
 .../src/server/driver.test.ts                 | 155 ++++++++++++
 .../src/server/driver.ts                      | 112 +++++++++
 .../src/shared/definition.test.ts             |  28 +++
 .../src/shared/definition.ts                  |  41 ++++
 .../secret-provider-onepassword/tsconfig.json |   7 +
 packages/shared/src/serverSettings.test.ts    |   3 +-
 pnpm-lock.yaml                                |  77 ++++++
 scripts/release-smoke.ts                      |   3 +
 60 files changed, 2094 insertions(+), 181 deletions(-)
 create mode 100644 apps/server/src/secrets/SecretResolver.ts
 create mode 100644 apps/server/src/secrets/secretProviderDefinitions.test.ts
 create mode 100644 apps/server/src/secrets/secretProviderDefinitions.ts
 create mode 100644 apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
 create mode 100644 apps/web/src/components/settings/SecretSourceInput.tsx
 create mode 100644 packages/contracts/src/secretReference.ts
 create mode 100644 packages/secret-provider-core/package.json
 create mode 100644 packages/secret-provider-core/src/server/SecretResolver.test.ts
 create mode 100644 packages/secret-provider-core/src/server/SecretResolver.ts
 create mode 100644 packages/secret-provider-core/src/server/driver.ts
 create mode 100644 packages/secret-provider-core/src/shared/definition.ts
 create mode 100644 packages/secret-provider-core/tsconfig.json
 create mode 100644 packages/secret-provider-definitions/package.json
 create mode 100644 packages/secret-provider-definitions/src/registry.ts
 create mode 100644 packages/secret-provider-definitions/tsconfig.json
 create mode 100644 packages/secret-provider-onepassword/package.json
 create mode 100644 packages/secret-provider-onepassword/src/server/driver.test.ts
 create mode 100644 packages/secret-provider-onepassword/src/server/driver.ts
 create mode 100644 packages/secret-provider-onepassword/src/shared/definition.test.ts
 create mode 100644 packages/secret-provider-onepassword/src/shared/definition.ts
 create mode 100644 packages/secret-provider-onepassword/tsconfig.json

diff --git a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
index c581cbc688142..5f83979197bbc 100644
--- a/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
+++ b/apps/mobile/src/features/settings/SettingsEnvironmentDetailRouteScreen.tsx
@@ -294,7 +294,10 @@ function EnvironmentDetail({ environmentId }: { readonly environmentId: Environm
                       void run("refresh", async () => {
                         if (!readEnvironmentScope(environmentId, AuthOrchestrationReadScope))
                           return;
-                        const result = await refreshProviders({ environmentId, input: {} });
+                        const result = await refreshProviders({
+                          environmentId,
+                          input: { reloadSecrets: true },
+                        });
                         if (AsyncResult.isFailure(result)) throw squashAtomCommandFailure(result);
                         setNotice("Provider status refreshed.");
                       });
diff --git a/apps/server/package.json b/apps/server/package.json
index 9ee890670abbf..789d612e6fe3b 100644
--- a/apps/server/package.json
+++ b/apps/server/package.json
@@ -78,6 +78,9 @@
     "@opencode-ai/sdk": "^1.3.15",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/provider-testing": "workspace:*",
+    "@t3tools/secret-provider-core": "workspace:*",
+    "@t3tools/secret-provider-definitions": "workspace:*",
+    "@t3tools/secret-provider-onepassword": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@t3tools/source-control-testing": "workspace:*",
     "@t3tools/ssh": "workspace:*",
diff --git a/apps/server/src/auth/RpcAuthorization.test.ts b/apps/server/src/auth/RpcAuthorization.test.ts
index 24c22280175cc..8044740a7e2ee 100644
--- a/apps/server/src/auth/RpcAuthorization.test.ts
+++ b/apps/server/src/auth/RpcAuthorization.test.ts
@@ -5,6 +5,7 @@ import {
   AuthProvidersManageScope,
   AuthSettingsWriteScope,
   DEFAULT_SERVER_SETTINGS,
+  ProviderDriverKind,
   ProviderInstanceId,
   SecretProviderId,
   ThreadId,
@@ -164,13 +165,34 @@ describe("settings mutation authorization", () => {
       );
       yield* client[WS_METHODS.serverUpdateSettings]({ patch: {}, providerInstanceMutation });
       expect(handled).toBe(1);
+      yield* client[WS_METHODS.serverUpdateSettings]({
+        patch: {},
+        providerInstanceMutation: {
+          operation: "upsert",
+          instanceId: ProviderInstanceId.make("codex_work"),
+          instance: {
+            driver: ProviderDriverKind.make("codex"),
+            environment: [
+              {
+                name: "OPENAI_API_KEY",
+                sensitive: true,
+                value: {
+                  provider: SecretProviderId.make("personal"),
+                  reference: "op://Private/OpenAI/credential",
+                },
+              },
+            ],
+          },
+        },
+      });
+      expect(handled).toBe(2);
       expect(
         yield* client[WS_METHODS.serverUpdateSettings]({
           patch: { defaultRuntimeMode: "full-access" },
           providerInstanceMutation,
         }).pipe(Effect.flip),
       ).toMatchObject({ requiredPermission: AuthSettingsWriteScope });
-      expect(handled).toBe(1);
+      expect(handled).toBe(2);
     }).pipe(Effect.scoped),
   );
 
diff --git a/apps/server/src/auth/RpcAuthorization.ts b/apps/server/src/auth/RpcAuthorization.ts
index ecda5f8abc61b..3806262cced53 100644
--- a/apps/server/src/auth/RpcAuthorization.ts
+++ b/apps/server/src/auth/RpcAuthorization.ts
@@ -228,7 +228,8 @@ const SettingsUpdate = Schema.Struct({
   patch: ServerSettingsPatch,
   providerInstanceMutation: Schema.optionalKey(ProviderInstanceMutation),
 });
-const decodeSettingsUpdate = Schema.decodeUnknownSync(SettingsUpdate);
+// Middleware receives the payload already decoded, so it is checked against the decoded shape.
+const decodeSettingsUpdate = Schema.decodeUnknownSync(Schema.toType(SettingsUpdate));
 
 const requiredScopesForSettingsUpdate = (payload: unknown) => {
   const input = decodeSettingsUpdate(payload);
diff --git a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
index c38ec736884ea..40f33b3a1a309 100644
--- a/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
+++ b/apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts
@@ -40,7 +40,7 @@ import {
   OrchestrationV2ProviderThread,
   ProjectId,
   ProviderInstanceId,
-  type ProviderInstanceEnvironment,
+  type ResolvedProviderInstanceEnvironment,
   ProviderDriverKind,
   type ProviderReplayTranscript,
   type ProviderApprovalDecision,
@@ -1189,7 +1189,7 @@ describe("ClaudeAdapterV2 approval cancellation", () => {
 
 const captureSdkExecutablePaths = Effect.fn("captureSdkExecutablePaths")(function* (
   binaryPath: string,
-  environment: ProviderInstanceEnvironment = [],
+  environment: ResolvedProviderInstanceEnvironment = [],
 ) {
   const executablePaths: Array<string | undefined> = [];
   const taskToolEnvironment: Array<string | undefined> = [];
diff --git a/apps/server/src/orchestration-v2/Adapters/PiAdapterV2.testkit.ts b/apps/server/src/orchestration-v2/Adapters/PiAdapterV2.testkit.ts
index c894442409921..49eb6c9b3b999 100644
--- a/apps/server/src/orchestration-v2/Adapters/PiAdapterV2.testkit.ts
+++ b/apps/server/src/orchestration-v2/Adapters/PiAdapterV2.testkit.ts
@@ -2,7 +2,7 @@ import * as NodeServices from "@effect/platform-node/NodeServices";
 import {
   ProviderReplayEntry,
   ProviderInstanceId,
-  type ProviderInstanceEnvironment,
+  type ResolvedProviderInstanceEnvironment,
   type ProviderReplayTranscript,
   type ProviderReplayEntry as ProviderReplayEntryType,
 } from "@t3tools/contracts";
@@ -363,7 +363,7 @@ export function layer<E, R>(input: {
   readonly spawner: Layer.Layer<ChildProcessSpawner.ChildProcessSpawner, E, R>;
   readonly binaryPath: string;
   readonly launchArgs: string;
-  readonly environment?: ProviderInstanceEnvironment;
+  readonly environment?: ResolvedProviderInstanceEnvironment;
 }) {
   return ProviderAdapterRegistry.layerFromAdaptersEffect(
     PiAdapterV2Driver.create({
diff --git a/apps/server/src/project/AgentSessionScanner.ts b/apps/server/src/project/AgentSessionScanner.ts
index 9c26b187a55bf..7ec79c38a38a9 100644
--- a/apps/server/src/project/AgentSessionScanner.ts
+++ b/apps/server/src/project/AgentSessionScanner.ts
@@ -1112,9 +1112,11 @@ export const make = Effect.gen(function* () {
       const seenHomes = new Set<string>();
       for (const { instanceId, config: instance } of instances) {
         const homeVariable = source === "claudeAgent" ? "CLAUDE_CONFIG_DIR" : "CODEX_HOME";
+        const configuredHome = instance.environment?.findLast(
+          (variable) => variable.name === homeVariable,
+        )?.value;
         const environmentHome =
-          instance.environment?.findLast((variable) => variable.name === homeVariable)?.value ??
-          hostEnvironment[homeVariable];
+          typeof configuredHome === "string" ? configuredHome : hostEnvironment[homeVariable];
 
         let homePath: string;
         if (source === "claudeAgent") {
diff --git a/apps/server/src/provider/ProviderInstanceRegistry.test.ts b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
index de8fc1deae452..dc9c94e854f68 100644
--- a/apps/server/src/provider/ProviderInstanceRegistry.test.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistry.test.ts
@@ -12,16 +12,22 @@ import {
   type CodexSettings,
   ProviderDriverKind,
   type ProviderInstanceConfigMap,
+  type ResolvedProviderInstanceEnvironment,
   ProviderInstanceId,
+  SecretProviderId,
+  type SecretReference,
 } from "@t3tools/contracts";
 import * as ProviderLatestVersions from "@t3tools/provider-core/server/ProviderLatestVersions";
 import * as McpProviderSessions from "@t3tools/provider-core/server/McpProviderSessions";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import * as DateTime from "effect/DateTime";
+import * as Deferred from "effect/Deferred";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
+import * as PubSub from "effect/PubSub";
+import * as Schema from "effect/Schema";
 import * as TestClock from "effect/testing/TestClock";
 import { HttpClient, HttpClientResponse } from "effect/http";
 
@@ -37,6 +43,8 @@ import { makeProviderInstanceRegistry } from "./ProviderInstanceRegistry.ts";
 import * as ProviderOrchestrationAdapterInfrastructure from "./ProviderOrchestrationAdapterInfrastructure.ts";
 import * as PortScanner from "../preview/PortScanner.ts";
 import * as ProviderHostLive from "./ProviderHostLive.ts";
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+import type { AnyProviderDriver, ProviderInstance } from "@t3tools/provider-core/server/driver";
 
 vi.mock("@anthropic-ai/claude-agent-sdk", { spy: true });
 
@@ -164,6 +172,7 @@ describe("ProviderInstanceRegistry — multi-instance codex slice", () => {
       }),
     ),
     Layer.provideMerge(Layer.mock(ServerSecretStore.ServerSecretStore)({})),
+    Layer.provideMerge(Layer.mock(SecretResolver.SecretResolver)({})),
     Layer.provideMerge(
       Layer.succeed(ServerEnvironment.ServerEnvironmentIdentity, {
         getEnvironmentId: Effect.succeed(
@@ -643,3 +652,169 @@ describe("ProviderInstanceRegistry — multi-instance codex slice", () => {
       }).pipe(Effect.provide(layerTest)),
   );
 });
+
+const DisabledByDefaultConfig = Schema.Struct({
+  enabled: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
+});
+
+describe("ProviderInstanceRegistry secret environment", () => {
+  const driverKind = ProviderDriverKind.make("fake");
+  const instanceId = ProviderInstanceId.make("fake_main");
+  const secret: SecretReference = {
+    provider: SecretProviderId.make("personal"),
+    reference: "op://Private/OpenAI/credential",
+  };
+
+  function setup(
+    initial: Record<string, string>,
+    configSchema: AnyProviderDriver["configSchema"] = Schema.Unknown,
+  ) {
+    const vault = new Map(Object.entries(initial));
+    const reads: Array<ReadonlyArray<string>> = [];
+    const invalidated: Array<ReadonlyArray<string>> = [];
+    const created: Array<ResolvedProviderInstanceEnvironment> = [];
+    const driver: AnyProviderDriver = {
+      driverKind,
+      metadata: { displayName: "Fake" },
+      configSchema,
+      defaultConfig: () => ({}),
+      create: (input) =>
+        Effect.sync(() => {
+          created.push(input.environment);
+          return { instanceId: input.instanceId, enabled: input.enabled } as ProviderInstance;
+        }),
+    };
+    const gate = Deferred.makeUnsafe<void>();
+    const resolver = Layer.succeed(SecretResolver.SecretResolver, {
+      read: (references) =>
+        Deferred.await(gate).pipe(
+          Effect.andThen(
+            Effect.sync(() => {
+              reads.push(references.map((reference) => reference.reference));
+              return references.map((reference) => vault.get(reference.reference));
+            }),
+          ),
+        ),
+      invalidate: (references = []) =>
+        Effect.sync(() => {
+          invalidated.push(references.map((reference) => reference.reference));
+        }),
+    });
+    const configMap: ProviderInstanceConfigMap = {
+      [instanceId]: {
+        driver: driverKind,
+        config: {},
+        environment: [
+          { name: "OPENAI_API_KEY", value: secret, sensitive: true },
+          { name: "BASE_URL", value: "https://example.test", sensitive: false },
+        ],
+      },
+    };
+    const makeGated = makeProviderInstanceRegistry({ drivers: [driver], configMap }).pipe(
+      Effect.provide(resolver),
+    );
+    // Secrets are read after startup, so wait for the change that applies them.
+    const make = Effect.gen(function* () {
+      const built = yield* makeGated;
+      const changes = yield* built.registry.subscribeChanges;
+      yield* Deferred.succeed(gate, undefined);
+      yield* PubSub.take(changes);
+      return built;
+    });
+    return { vault, reads, invalidated, created, make, makeGated, gate };
+  }
+
+  it.effect("starts an instance with the secret its environment points at", () => {
+    const fixture = setup({ [secret.reference]: "sk-live" });
+    return Effect.gen(function* () {
+      const { registry } = yield* fixture.make;
+
+      expect(yield* registry.getInstance(instanceId)).toBeDefined();
+      expect(fixture.created).toEqual([
+        [
+          { name: "OPENAI_API_KEY", value: "sk-live", sensitive: true },
+          { name: "BASE_URL", value: "https://example.test", sensitive: false },
+        ],
+      ]);
+    }).pipe(Effect.scoped);
+  });
+
+  it.effect("marks an instance unavailable and names the variable it could not read", () => {
+    const fixture = setup({});
+    return Effect.gen(function* () {
+      const { registry } = yield* fixture.make;
+
+      expect(yield* registry.getInstance(instanceId)).toBeUndefined();
+      expect(fixture.created).toEqual([]);
+      const [unavailable] = yield* registry.listUnavailable;
+      expect(unavailable?.instanceId).toBe(instanceId);
+      expect(unavailable?.unavailableReason).toContain("OPENAI_API_KEY");
+    }).pipe(Effect.scoped);
+  });
+
+  it.effect("does not read the secrets of an instance its config decodes as disabled", () => {
+    const fixture = setup({ [secret.reference]: "sk-live" }, DisabledByDefaultConfig);
+    return Effect.gen(function* () {
+      const { mutator } = yield* fixture.makeGated;
+      yield* mutator.reloadSecrets();
+
+      expect(fixture.reads).toEqual([]);
+      expect(fixture.invalidated).toEqual([]);
+      expect(fixture.created).toHaveLength(1);
+    }).pipe(Effect.scoped);
+  });
+
+  it.effect("re-reads secrets on reload and rebuilds only when they changed", () => {
+    const fixture = setup({});
+    return Effect.gen(function* () {
+      const { registry, mutator } = yield* fixture.make;
+
+      fixture.vault.set(secret.reference, "sk-live");
+      yield* mutator.reloadSecrets();
+      expect(fixture.invalidated).toEqual([[secret.reference]]);
+      expect(yield* registry.getInstance(instanceId)).toBeDefined();
+      expect(yield* registry.listUnavailable).toEqual([]);
+
+      yield* mutator.reloadSecrets(instanceId);
+      expect(fixture.created).toHaveLength(1);
+
+      fixture.vault.set(secret.reference, "sk-rotated");
+      yield* mutator.reloadSecrets(instanceId);
+      expect(fixture.created.map((environment) => environment[0]?.value)).toEqual([
+        "sk-live",
+        "sk-rotated",
+      ]);
+    }).pipe(Effect.scoped);
+  });
+
+  it.effect("keeps a working instance live when a reload cannot read its secret", () => {
+    const fixture = setup({ [secret.reference]: "sk-live" });
+    return Effect.gen(function* () {
+      const { registry, mutator } = yield* fixture.make;
+
+      fixture.vault.delete(secret.reference);
+      yield* mutator.reloadSecrets();
+
+      expect(yield* registry.getInstance(instanceId)).toBeDefined();
+      expect(yield* registry.listUnavailable).toEqual([]);
+      expect(fixture.created).toHaveLength(1);
+    }).pipe(Effect.scoped);
+  });
+
+  it.effect("starts without waiting for secrets to be read", () => {
+    const fixture = setup({ [secret.reference]: "sk-live" });
+    return Effect.gen(function* () {
+      const { registry } = yield* fixture.makeGated;
+      const changes = yield* registry.subscribeChanges;
+
+      expect(yield* registry.getInstance(instanceId)).toBeUndefined();
+      const [pending] = yield* registry.listUnavailable;
+      expect(pending?.unavailableReason).toBe("Reading secrets…");
+
+      yield* Deferred.succeed(fixture.gate, undefined);
+      yield* PubSub.take(changes);
+      expect(yield* registry.getInstance(instanceId)).toBeDefined();
+      expect(yield* registry.listUnavailable).toEqual([]);
+    }).pipe(Effect.scoped);
+  });
+});
diff --git a/apps/server/src/provider/ProviderInstanceRegistry.ts b/apps/server/src/provider/ProviderInstanceRegistry.ts
index 3bbbe2900b9f2..70352c5ef8593 100644
--- a/apps/server/src/provider/ProviderInstanceRegistry.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistry.ts
@@ -3,7 +3,10 @@ import {
   ProviderInstanceId,
   type ProviderInstanceConfig,
   type ProviderInstanceConfigMap,
+  type ProviderInstanceEnvironment,
   type ProviderDriverKind,
+  type ResolvedProviderInstanceEnvironment,
+  type SecretReference,
   type ServerProvider,
 } from "@t3tools/contracts";
 import * as Context from "effect/Context";
@@ -11,12 +14,16 @@ import * as Effect from "effect/Effect";
 import * as Equal from "effect/Equal";
 import * as Exit from "effect/Exit";
 import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
 import * as PubSub from "effect/PubSub";
 import * as Ref from "effect/Ref";
 import * as Schema from "effect/Schema";
 import * as Scope from "effect/Scope";
+import * as Semaphore from "effect/Semaphore";
 import * as Stream from "effect/Stream";
 
+import * as SecretResolver from "@t3tools/secret-provider-core/server/SecretResolver";
+
 import { buildUnavailableProviderSnapshot } from "./unavailableProviderSnapshot.ts";
 import * as ProviderInstanceRegistryMutator from "./ProviderInstanceRegistryMutator.ts";
 import type { AnyProviderDriver, ProviderInstance } from "@t3tools/provider-core/server/driver";
@@ -39,6 +46,7 @@ interface LiveEntry {
   readonly instance: ProviderInstance;
   readonly scope: Scope.Closeable;
   readonly entry: ProviderInstanceConfig;
+  readonly environment: ResolvedProviderInstanceEnvironment;
 }
 
 interface RegistryState {
@@ -50,6 +58,39 @@ interface RegistryState {
 const entryEqual = (a: ProviderInstanceConfig, b: ProviderInstanceConfig): boolean =>
   Equal.equals(a, b);
 
+const secretReferencesIn = (environment: ProviderInstanceEnvironment): Array<SecretReference> =>
+  environment.flatMap((variable) => (typeof variable.value === "string" ? [] : [variable.value]));
+
+const secretReferencesOf = (entry: ProviderInstanceConfig): ReadonlyArray<SecretReference> =>
+  secretReferencesIn(entry.environment ?? []);
+
+const withoutSecretReferences = (
+  environment: ProviderInstanceEnvironment,
+): ResolvedProviderInstanceEnvironment =>
+  environment.flatMap((variable) =>
+    typeof variable.value === "string" ? [{ ...variable, value: variable.value }] : [],
+  );
+
+const readSecretEnvironment = Effect.fn("ProviderInstanceRegistry.readSecretEnvironment")(
+  function* (environment: ProviderInstanceEnvironment) {
+    const references = secretReferencesIn(environment);
+    const values =
+      references.length === 0 ? [] : yield* (yield* SecretResolver.SecretResolver).read(references);
+    const unreadable: Array<string> = [];
+    let index = 0;
+    const resolved: ResolvedProviderInstanceEnvironment = environment.flatMap((variable) => {
+      if (typeof variable.value === "string") return [{ ...variable, value: variable.value }];
+      const secret = values[index++];
+      if (secret === undefined) {
+        unreadable.push(variable.name);
+        return [];
+      }
+      return [{ ...variable, value: secret, sensitive: true }];
+    });
+    return { environment: resolved, unreadable };
+  },
+);
+
 /** Conflicting saved flags must preserve any explicit disable. */
 const resolveEntryEnabled = (entry: ProviderInstanceConfig, typedConfig: unknown): boolean => {
   const rawConfigEnabled = providerInstanceConfigEnabledFlag(entry.config);
@@ -59,19 +100,32 @@ const resolveEntryEnabled = (entry: ProviderInstanceConfig, typedConfig: unknown
   return entry.enabled ?? providerInstanceConfigEnabledFlag(typedConfig) ?? true;
 };
 
+// The enabled state `buildEntry` decodes, so a disabled instance never reads its secrets.
+const isEntryEnabled = Effect.fn("ProviderInstanceRegistry.isEntryEnabled")(function* <R>(
+  driversById: ReadonlyMap<ProviderDriverKind, AnyProviderDriver<R>>,
+  entry: ProviderInstanceConfig,
+) {
+  const driver = driversById.get(entry.driver);
+  if (!driver) return false;
+  const decoder = Schema.decodeUnknownEffect(driver.configSchema);
+  const decoded = yield* decoder(entry.config ?? driver.defaultConfig()).pipe(Effect.option);
+  return Option.isSome(decoded) && resolveEntryEnabled(entry, decoded.value);
+});
+
 const buildEntry = Effect.fn("ProviderInstanceRegistry.buildEntry")(function* <R>(input: {
   readonly driversById: ReadonlyMap<ProviderDriverKind, AnyProviderDriver<R>>;
   readonly parentScope: Scope.Scope;
   readonly instanceId: ProviderInstanceId;
   readonly rawInstanceId: string;
   readonly entry: ProviderInstanceConfig;
+  readonly deferSecrets: boolean;
 }): Effect.fn.Return<
   | { readonly kind: "live"; readonly live: LiveEntry }
   | { readonly kind: "unavailable"; readonly snapshot: ServerProvider },
   never,
-  R
+  R | SecretResolver.SecretResolver
 > {
-  const { driversById, parentScope, instanceId, rawInstanceId, entry } = input;
+  const { driversById, parentScope, instanceId, rawInstanceId, entry, deferSecrets } = input;
   const driver = driversById.get(entry.driver);
   if (!driver) {
     return {
@@ -109,6 +163,37 @@ const buildEntry = Effect.fn("ProviderInstanceRegistry.buildEntry")(function* <R
   }
 
   const typedConfig = decodeResult.success;
+  const enabled = resolveEntryEnabled(entry, typedConfig);
+  if (deferSecrets && enabled && secretReferencesOf(entry).length > 0) {
+    return {
+      kind: "unavailable" as const,
+      snapshot: yield* buildUnavailableProviderSnapshot({
+        driverKind: entry.driver,
+        instanceId,
+        displayName: entry.displayName,
+        accentColor: entry.accentColor,
+        reason: "Reading secrets…",
+      }),
+    };
+  }
+  const { environment, unreadable } = enabled
+    ? yield* readSecretEnvironment(entry.environment ?? [])
+    : { environment: withoutSecretReferences(entry.environment ?? []), unreadable: [] };
+  // Starting with a blank credential would fail later with a less useful error, or fall back to
+  // whatever the server inherited.
+  if (unreadable.length > 0) {
+    return {
+      kind: "unavailable" as const,
+      snapshot: yield* buildUnavailableProviderSnapshot({
+        driverKind: entry.driver,
+        instanceId,
+        displayName: entry.displayName,
+        accentColor: entry.accentColor,
+        reason: `Could not read ${unreadable.join(", ")} from its secret provider. Unlock it, then refresh.`,
+      }),
+    };
+  }
+
   const childScope = yield* Scope.make();
   yield* Scope.addFinalizer(parentScope, Scope.close(childScope, Exit.void).pipe(Effect.ignore));
 
@@ -117,8 +202,8 @@ const buildEntry = Effect.fn("ProviderInstanceRegistry.buildEntry")(function* <R
       instanceId,
       displayName: entry.displayName,
       accentColor: entry.accentColor,
-      environment: entry.environment ?? [],
-      enabled: resolveEntryEnabled(entry, typedConfig),
+      environment,
+      enabled,
       config: typedConfig,
     })
     .pipe(Effect.provideService(Scope.Scope, childScope), Effect.result);
@@ -147,6 +232,7 @@ const buildEntry = Effect.fn("ProviderInstanceRegistry.buildEntry")(function* <R
       instance: createResult.success,
       scope: childScope,
       entry,
+      environment,
     },
   };
 });
@@ -155,9 +241,13 @@ const makeReconcile = <R>(input: {
   readonly state: RegistryState;
   readonly driversById: ReadonlyMap<ProviderDriverKind, AnyProviderDriver<R>>;
   readonly parentScope: Scope.Scope;
-}): ((configMap: ProviderInstanceConfigMap) => Effect.Effect<void, never, R>) => {
+}): ((
+  configMap: ProviderInstanceConfigMap,
+  rebuild?: ReadonlySet<ProviderInstanceId>,
+  deferSecrets?: boolean,
+) => Effect.Effect<void, never, R | SecretResolver.SecretResolver>) => {
   const { state, driversById, parentScope } = input;
-  return (configMap: ProviderInstanceConfigMap) =>
+  return (configMap, rebuild = new Set(), deferSecrets = false) =>
     Effect.gen(function* () {
       const previousEntries = yield* Ref.get(state.entries);
       const previousUnavailable = yield* Ref.get(state.unavailable);
@@ -175,7 +265,10 @@ const makeReconcile = <R>(input: {
           continue;
         }
         const nextEntry = configMap[instanceId];
-        if (nextEntry !== undefined && !entryEqual(live.entry, nextEntry)) {
+        if (
+          rebuild.has(instanceId) ||
+          (nextEntry !== undefined && !entryEqual(live.entry, nextEntry))
+        ) {
           replacedIds.add(instanceId);
         }
       }
@@ -186,6 +279,20 @@ const makeReconcile = <R>(input: {
         }
       }
 
+      // Read every secret the builds below need in one go, so a vault unlocks once.
+      const references = yield* Effect.forEach(nextRaw, ([rawInstanceId, entry]) =>
+        Effect.gen(function* () {
+          const instanceId = ProviderInstanceId.make(rawInstanceId);
+          const kept = previousEntries.has(instanceId) && !replacedIds.has(instanceId);
+          return kept || !(yield* isEntryEnabled(driversById, entry))
+            ? []
+            : secretReferencesOf(entry);
+        }),
+      ).pipe(Effect.map((perEntry) => perEntry.flat()));
+      if (references.length > 0 && !deferSecrets) {
+        yield* (yield* SecretResolver.SecretResolver).read(references);
+      }
+
       const builtEntries = new Map<ProviderInstanceId, LiveEntry>();
       const builtUnavailable = new Map<ProviderInstanceId, ServerProvider>();
       let orderChanged = false;
@@ -208,6 +315,7 @@ const makeReconcile = <R>(input: {
           instanceId,
           rawInstanceId,
           entry,
+          deferSecrets,
         });
         if (result.kind === "live") {
           builtEntries.set(instanceId, result.live);
@@ -260,7 +368,7 @@ export const makeProviderInstanceRegistry = Effect.fn(
     readonly mutator: ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutatorShape;
   },
   never,
-  R | Scope.Scope
+  R | SecretResolver.SecretResolver | Scope.Scope
 > {
   const driversById = new Map<ProviderDriverKind, AnyProviderDriver<R>>(
     input.drivers.map((driver) => [driver.driverKind, driver]),
@@ -272,7 +380,7 @@ export const makeProviderInstanceRegistry = Effect.fn(
   // scopes to the *caller's* scope instead of the registry's.
   const parentScope = yield* Scope.Scope;
 
-  const driverContext = yield* Effect.context<R>();
+  const driverContext = yield* Effect.context<R | SecretResolver.SecretResolver>();
 
   const entries = yield* Ref.make<ReadonlyMap<ProviderInstanceId, LiveEntry>>(new Map());
   const unavailable = yield* Ref.make<ReadonlyMap<ProviderInstanceId, ServerProvider>>(new Map());
@@ -281,10 +389,76 @@ export const makeProviderInstanceRegistry = Effect.fn(
 
   const state: RegistryState = { entries, unavailable, changes };
   const reconcileWithR = makeReconcile({ state, driversById, parentScope });
+  const configMapRef = yield* Ref.make(input.configMap);
+  const semaphore = yield* Semaphore.make(1);
   const reconcile: ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutatorShape["reconcile"] =
-    (configMap) => reconcileWithR(configMap).pipe(Effect.provideContext(driverContext));
+    (configMap) =>
+      semaphore.withPermits(1)(
+        Ref.set(configMapRef, configMap).pipe(
+          Effect.andThen(reconcileWithR(configMap)),
+          Effect.provideContext(driverContext),
+        ),
+      );
 
-  yield* reconcile(input.configMap);
+  // Rebuilds an instance only when it was unavailable or its secrets changed, so a refresh does
+  // not restart providers whose credentials are the same.
+  const reloadSecrets: ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutatorShape["reloadSecrets"] =
+    Effect.fn("ProviderInstanceRegistry.reloadSecrets")(
+      function* (instanceId) {
+        const configMap = yield* Ref.get(configMapRef);
+        const targets = yield* Effect.filter(Object.entries(configMap), ([rawInstanceId, entry]) =>
+          (instanceId === undefined || rawInstanceId === instanceId) &&
+          secretReferencesOf(entry).length > 0
+            ? isEntryEnabled(driversById, entry)
+            : Effect.succeed(false),
+        );
+        if (targets.length === 0) return;
+        const resolver = yield* SecretResolver.SecretResolver;
+        const references = targets.flatMap(([, entry]) => secretReferencesOf(entry));
+        yield* resolver.invalidate(references);
+        yield* resolver.read(references);
+        const live = yield* Ref.get(entries);
+        const rebuild = new Set<ProviderInstanceId>();
+        for (const [rawInstanceId, entry] of targets) {
+          const current = live.get(ProviderInstanceId.make(rawInstanceId));
+          if (current === undefined) continue;
+          const { environment, unreadable } = yield* readSecretEnvironment(entry.environment ?? []);
+          // A failed re-read keeps the working instance and the value it already holds.
+          if (unreadable.length === 0 && !Equal.equals(environment, current.environment)) {
+            rebuild.add(current.instance.instanceId);
+          }
+        }
+        yield* reconcileWithR(configMap, rebuild);
+      },
+      (effect) => semaphore.withPermits(1)(effect),
+      Effect.provideContext(driverContext),
+    );
+
+  // Reading secrets can wait on a vault unlock, so the server does not wait for it to start.
+  yield* semaphore.withPermits(1)(
+    Ref.set(configMapRef, input.configMap).pipe(
+      Effect.andThen(reconcileWithR(input.configMap, new Set(), true)),
+      Effect.provideContext(driverContext),
+    ),
+  );
+  const startupReferences = yield* Effect.filter(Object.entries(input.configMap), ([, entry]) =>
+    secretReferencesOf(entry).length > 0
+      ? isEntryEnabled(driversById, entry)
+      : Effect.succeed(false),
+  ).pipe(Effect.map((targets) => targets.flatMap(([, entry]) => secretReferencesOf(entry))));
+  if (startupReferences.length > 0) {
+    // The read waits outside the lock so other mutations are not held for a vault prompt; a
+    // configuration saved meanwhile has already reconciled itself.
+    yield* Effect.gen(function* () {
+      yield* (yield* SecretResolver.SecretResolver).read(startupReferences);
+      yield* semaphore.withPermits(1)(
+        Effect.gen(function* () {
+          const current = yield* Ref.get(configMapRef);
+          if (current === input.configMap) yield* reconcileWithR(current);
+        }),
+      );
+    }).pipe(Effect.provideContext(driverContext), Effect.forkScoped);
+  }
 
   const registry: ProviderInstanceRegistry["Service"] = {
     getInstance: (id) => Ref.get(entries).pipe(Effect.map((map) => map.get(id)?.instance)),
@@ -307,6 +481,7 @@ export const makeProviderInstanceRegistry = Effect.fn(
 
   const mutator: ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutatorShape = {
     reconcile,
+    reloadSecrets,
   };
 
   return { registry, mutator };
@@ -318,7 +493,7 @@ export const layer = <R>(input: {
 }): Layer.Layer<
   ProviderInstanceRegistry | ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator,
   never,
-  R
+  R | SecretResolver.SecretResolver
 > =>
   Layer.effectContext(
     makeProviderInstanceRegistry(input).pipe(
@@ -331,5 +506,5 @@ export const layer = <R>(input: {
   ) as Layer.Layer<
     ProviderInstanceRegistry | ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator,
     never,
-    R
+    R | SecretResolver.SecretResolver
   >;
diff --git a/apps/server/src/provider/ProviderInstanceRegistryHydration.ts b/apps/server/src/provider/ProviderInstanceRegistryHydration.ts
index cb778f1638a22..c8f2fb9b33e05 100644
--- a/apps/server/src/provider/ProviderInstanceRegistryHydration.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistryHydration.ts
@@ -9,6 +9,7 @@ import {
   ServerSettings,
 } from "@t3tools/contracts";
 import * as HostProcess from "@t3tools/shared/HostProcess";
+import type * as Crypto from "effect/Crypto";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
@@ -16,6 +17,7 @@ import * as Path from "effect/Path";
 import * as Stream from "effect/Stream";
 
 import * as Settings from "../serverSettings.ts";
+import * as SecretResolver from "../secrets/SecretResolver.ts";
 import { BUILT_IN_DRIVERS, type BuiltInDriversEnv } from "./builtInDrivers.ts";
 import * as ProviderInstanceRegistry from "./ProviderInstanceRegistry.ts";
 import * as ProviderInstanceRegistryMutator from "./ProviderInstanceRegistryMutator.ts";
@@ -39,6 +41,8 @@ type ProviderInstanceRegistryHydrationEnv =
   | ServerConfig.ServerConfig
   | Path.Path
   | FileSystem.FileSystem
+  // Secret provider reads.
+  | Crypto.Crypto
   // The Claude runner counts its CLIs as running agents for port discovery.
   | PortScanner.PortDiscovery;
 
@@ -141,7 +145,8 @@ const layerSettingsWatcher = (settingsChanges: Stream.Stream<ServerSettings>) =>
   );
 
 export const layer: Layer.Layer<
-  ProviderInstanceRegistry.ProviderInstanceRegistry,
+  | ProviderInstanceRegistry.ProviderInstanceRegistry
+  | ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator,
   never,
   ProviderInstanceRegistryHydrationEnv
 > = Layer.unwrap(
@@ -167,12 +172,14 @@ export const layer: Layer.Layer<
       Layer.provide(ProviderOrchestrationAdapterInfrastructure.layer),
       Layer.provide(AcpRegistrySupport.layerFromHost),
       Layer.provide(ProviderHostLive.layer),
+      Layer.provide(SecretResolver.layer),
     );
 
     return layerSettingsWatcher(settingsChanges).pipe(Layer.provideMerge(layerMutable));
   }),
 ) as Layer.Layer<
-  ProviderInstanceRegistry.ProviderInstanceRegistry,
+  | ProviderInstanceRegistry.ProviderInstanceRegistry
+  | ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator,
   never,
   ProviderInstanceRegistryHydrationEnv
 >;
diff --git a/apps/server/src/provider/ProviderInstanceRegistryMutator.ts b/apps/server/src/provider/ProviderInstanceRegistryMutator.ts
index 51322826230d8..35eb52d3f2906 100644
--- a/apps/server/src/provider/ProviderInstanceRegistryMutator.ts
+++ b/apps/server/src/provider/ProviderInstanceRegistryMutator.ts
@@ -1,10 +1,12 @@
 /** Reconcile closes removed/replaced scopes before creating replacements: at most one live instance per id. */
-import type { ProviderInstanceConfigMap } from "@t3tools/contracts";
+import type { ProviderInstanceConfigMap, ProviderInstanceId } from "@t3tools/contracts";
 import * as Context from "effect/Context";
 import type * as Effect from "effect/Effect";
 
 export interface ProviderInstanceRegistryMutatorShape {
   readonly reconcile: (configMap: ProviderInstanceConfigMap) => Effect.Effect<void>;
+  /** Re-reads the secrets of every instance, or one, and rebuilds those whose secrets changed. */
+  readonly reloadSecrets: (instanceId?: ProviderInstanceId) => Effect.Effect<void>;
 }
 
 export class ProviderInstanceRegistryMutator extends Context.Service<
diff --git a/apps/server/src/provider/ProviderRegistry.test.ts b/apps/server/src/provider/ProviderRegistry.test.ts
index 14b8dfb2ca150..5e356c84516a8 100644
--- a/apps/server/src/provider/ProviderRegistry.test.ts
+++ b/apps/server/src/provider/ProviderRegistry.test.ts
@@ -65,6 +65,7 @@ import type {
   ProviderWorkspaceSnapshot,
 } from "@t3tools/provider-core/server/driver";
 import * as ProviderInstanceRegistry from "./ProviderInstanceRegistry.ts";
+import * as ProviderInstanceRegistryMutator from "./ProviderInstanceRegistryMutator.ts";
 import * as ProviderRegistry from "./ProviderRegistry.ts";
 import { mergeProviderInstanceEnvironment } from "@t3tools/provider-core/server/instanceEnvironment";
 import { makeManualOnlyProviderMaintenanceCapabilities } from "@t3tools/provider-core/server/maintenanceResolver";
@@ -100,6 +101,10 @@ const withBundledCompatibility = (snapshot: ServerProvider) =>
     ModelManifest.BUNDLED_MODEL_MANIFEST.compatibility,
   );
 
+const layerUnusedMutator = Layer.mock(
+  ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator,
+)({});
+
 const layerTestHttpClient = Layer.succeed(
   HttpClient.HttpClient,
   HttpClient.make((request) =>
@@ -944,7 +949,12 @@ it.layer(
                   retainedModels,
                 );
               }).pipe(
-                Effect.provide(ProviderRegistry.layer.pipe(Layer.provide(layerInstanceRegistry))),
+                Effect.provide(
+                  ProviderRegistry.layer.pipe(
+                    Layer.provide(layerInstanceRegistry),
+                    Layer.provide(layerUnusedMutator),
+                  ),
+                ),
                 Effect.scoped,
               );
             }
@@ -1075,7 +1085,12 @@ it.layer(
                 retainedModels,
               );
             }).pipe(
-              Effect.provide(ProviderRegistry.layer.pipe(Layer.provide(layerInstanceRegistry))),
+              Effect.provide(
+                ProviderRegistry.layer.pipe(
+                  Layer.provide(layerInstanceRegistry),
+                  Layer.provide(layerUnusedMutator),
+                ),
+              ),
               Effect.scoped,
             );
           }
@@ -1347,6 +1362,7 @@ it.layer(
           yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
           const runtimeServices = yield* Layer.build(
             ProviderRegistry.layer.pipe(
+              Layer.provide(layerUnusedMutator),
               Layer.provideMerge(layerInstanceRegistry),
               Layer.provideMerge(
                 ServerConfig.layerTest(process.cwd(), {
@@ -1442,6 +1458,7 @@ it.layer(
         yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
         const runtimeServices = yield* Layer.build(
           ProviderRegistry.layer.pipe(
+            Layer.provide(layerUnusedMutator),
             Layer.provideMerge(layerInstanceRegistry),
             Layer.provideMerge(
               ServerConfig.layerTest(process.cwd(), {
@@ -1562,6 +1579,7 @@ it.layer(
         yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
         const runtimeServices = yield* Layer.build(
           ProviderRegistry.layer.pipe(
+            Layer.provide(layerUnusedMutator),
             Layer.provideMerge(instanceRegistryLayer),
             Layer.provideMerge(
               ServerConfig.layerTest(process.cwd(), {
@@ -1668,6 +1686,7 @@ it.layer(
         yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
         const runtimeServices = yield* Layer.build(
           ProviderRegistry.layer.pipe(
+            Layer.provide(layerUnusedMutator),
             Layer.provideMerge(layerInstanceRegistry),
             Layer.provideMerge(
               ServerConfig.layerTest(process.cwd(), {
@@ -1796,6 +1815,7 @@ it.layer(
           yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
           const runtimeServices = yield* Layer.build(
             ProviderRegistry.layer.pipe(
+              Layer.provide(layerUnusedMutator),
               Layer.provideMerge(layerInstanceRegistry),
               Layer.provideMerge(
                 ServerConfig.layerTest(process.cwd(), {
@@ -1899,6 +1919,7 @@ it.layer(
         yield* Effect.addFinalizer(() => Scope.close(scope, Exit.void));
         const runtimeServices = yield* Layer.build(
           ProviderRegistry.layer.pipe(
+            Layer.provide(layerUnusedMutator),
             Layer.provideMerge(layerInstanceRegistry),
             Layer.provideMerge(
               ServerConfig.layerTest(process.cwd(), {
@@ -2070,7 +2091,7 @@ it.layer(
                   enabled: false,
                   config: { arbitrary: "payload" },
                 },
-              } as unknown as ContractServerSettings["providerInstances"],
+              } as unknown as (typeof ServerSettings.Encoded)["providerInstances"],
             }),
           ),
         );
diff --git a/apps/server/src/provider/ProviderRegistry.ts b/apps/server/src/provider/ProviderRegistry.ts
index 78b11306c5b6d..efa3385d1927e 100644
--- a/apps/server/src/provider/ProviderRegistry.ts
+++ b/apps/server/src/provider/ProviderRegistry.ts
@@ -19,6 +19,7 @@ import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as PubSub from "effect/PubSub";
 import * as Ref from "effect/Ref";
+import * as Scope from "effect/Scope";
 import * as Stream from "effect/Stream";
 import * as Semaphore from "effect/Semaphore";
 
@@ -27,6 +28,7 @@ import * as ModelManifest from "./ModelManifest.ts";
 import { applyProviderCompatibility } from "./providerCompatibility.ts";
 import * as ServerConfig from "../config.ts";
 import * as ProviderInstanceRegistry from "./ProviderInstanceRegistry.ts";
+import * as ProviderInstanceRegistryMutator from "./ProviderInstanceRegistryMutator.ts";
 import {
   hydrateCachedProvider,
   isCachedProviderCorrelated,
@@ -61,6 +63,11 @@ export class ProviderRegistry extends Context.Service<
       instanceId: ProviderInstanceId,
     ) => Effect.Effect<ReadonlyArray<ServerProvider>>;
 
+    /** Re-reads secret-backed environments first, so a fixed secret applies without a restart. */
+    readonly reloadSecretsAndRefresh: (
+      instanceId?: ProviderInstanceId,
+    ) => Effect.Effect<ReadonlyArray<ServerProvider>>;
+
     /** Only refreshed instances can verify an update; the published list still includes every row. */
     readonly refreshAfterUpdate: (
       provider: ProviderDriverKind,
@@ -330,6 +337,8 @@ export const layer = Layer.effect(
   ProviderRegistry,
   Effect.gen(function* () {
     const instanceRegistry = yield* ProviderInstanceRegistry.ProviderInstanceRegistry;
+    const instanceRegistryMutator =
+      yield* ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator;
     const manifestService = yield* ModelManifest.ModelManifest;
     const latestVersions = yield* ProviderLatestVersions.ProviderLatestVersions;
     const serviceScope = yield* Effect.scope;
@@ -614,7 +623,9 @@ export const layer = Layer.effect(
       );
       if (claimed.owner) {
         // Detach shared passes so the first caller's interruption cannot cancel other callers' work.
-        yield* getLiveSources.pipe(
+        // Syncing first keeps a refresh right after a rebuild from probing the replaced instance.
+        yield* syncLiveSourcesAndContinue.pipe(
+          Effect.andThen(getLiveSources),
           Effect.flatMap((sources) =>
             Effect.forEach(sources, (source) => refreshOneSource(source), {
               concurrency: "unbounded",
@@ -651,6 +662,7 @@ export const layer = Layer.effect(
     const refreshInstance = Effect.fn("refreshInstance")(function* (
       instanceId: ProviderInstanceId,
     ) {
+      yield* syncLiveSourcesAndContinue;
       const sources = yield* getLiveSources;
       const providerSource = sources.find((candidate) => candidate.instanceId === instanceId);
       if (!providerSource) {
@@ -659,6 +671,13 @@ export const layer = Layer.effect(
       return yield* refreshOneSource(providerSource);
     });
 
+    const reloadSecretsAndRefresh = Effect.fn("reloadSecretsAndRefresh")(function* (
+      instanceId?: ProviderInstanceId,
+    ) {
+      yield* instanceRegistryMutator.reloadSecrets(instanceId);
+      return yield* instanceId === undefined ? refresh() : refreshInstance(instanceId);
+    });
+
     const refreshAfterUpdate = Effect.fn("refreshAfterUpdate")(function* (
       provider: ProviderDriverKind,
       selectedInstanceId: ProviderInstanceId,
@@ -858,6 +877,7 @@ export const layer = Layer.effect(
           },
         );
       }),
+      Scope.provide(serviceScope),
     );
 
     yield* upsertProviders(fallbackProviders, { publish: false });
@@ -1008,6 +1028,8 @@ export const layer = Layer.effect(
         refresh(provider).pipe(Effect.catchCause(recoverRefreshFailure)),
       refreshInstance: (instanceId: ProviderInstanceId) =>
         refreshInstance(instanceId).pipe(Effect.catchCause(recoverRefreshFailure)),
+      reloadSecretsAndRefresh: (instanceId?: ProviderInstanceId) =>
+        reloadSecretsAndRefresh(instanceId).pipe(Effect.catchCause(recoverRefreshFailure)),
       refreshWorkspaceSnapshot: (input) =>
         refreshWorkspaceSnapshot(input).pipe(Effect.catchCause(recoverRefreshFailure)),
       refreshAfterUpdate,
diff --git a/apps/server/src/provider/providerCompatibility.test.ts b/apps/server/src/provider/providerCompatibility.test.ts
index 12c541fbd776d..8575a73230f85 100644
--- a/apps/server/src/provider/providerCompatibility.test.ts
+++ b/apps/server/src/provider/providerCompatibility.test.ts
@@ -13,6 +13,7 @@ import * as ModelManifest from "./ModelManifest.ts";
 import * as ProviderRegistry from "./ProviderRegistry.ts";
 import * as ProviderLatestVersions from "@t3tools/provider-core/server/ProviderLatestVersions";
 import * as ProviderInstanceRegistry from "./ProviderInstanceRegistry.ts";
+import * as ProviderInstanceRegistryMutator from "./ProviderInstanceRegistryMutator.ts";
 import type { ProviderInstance } from "@t3tools/provider-core/server/driver";
 import { makeManualOnlyProviderMaintenanceCapabilities } from "@t3tools/provider-core/server/maintenanceResolver";
 import * as Schema from "effect/Schema";
@@ -312,6 +313,15 @@ it.effect("a remote policy refresh preserves a newer health result on the regist
       assert.strictEqual(updated?.compatibilityAdvisory?.status, "supported");
       assert.strictEqual(updated?.status, "error");
       assert.strictEqual(updated?.message, "Authentication failed");
-    }).pipe(Effect.provide(ProviderRegistry.layer.pipe(Layer.provide(layerDependencies))));
+    }).pipe(
+      Effect.provide(
+        ProviderRegistry.layer.pipe(
+          Layer.provide(layerDependencies),
+          Layer.provide(
+            Layer.mock(ProviderInstanceRegistryMutator.ProviderInstanceRegistryMutator)({}),
+          ),
+        ),
+      ),
+    );
   }).pipe(Effect.scoped),
 );
diff --git a/apps/server/src/provider/providerMaintenanceRunner.test.ts b/apps/server/src/provider/providerMaintenanceRunner.test.ts
index 75c592b7811a1..943928c4e18cf 100644
--- a/apps/server/src/provider/providerMaintenanceRunner.test.ts
+++ b/apps/server/src/provider/providerMaintenanceRunner.test.ts
@@ -192,6 +192,7 @@ function makeRegistry(
       getProviders: Ref.get(providersRef),
       refresh: () => Ref.get(providersRef),
       refreshInstance: () => Ref.get(providersRef),
+      reloadSecretsAndRefresh: () => Ref.get(providersRef),
       refreshAfterUpdate: () => Ref.get(providersRef),
       refreshWorkspaceSnapshot: () => Ref.get(providersRef),
       getProviderMaintenanceCapabilitiesForInstance: (_instanceId, provider) =>
diff --git a/apps/server/src/provider/testUtils/providerRegistryMock.ts b/apps/server/src/provider/testUtils/providerRegistryMock.ts
index 358d49afe45c2..a4008acc18efb 100644
--- a/apps/server/src/provider/testUtils/providerRegistryMock.ts
+++ b/apps/server/src/provider/testUtils/providerRegistryMock.ts
@@ -11,6 +11,7 @@ const makeProviderRegistryMock = (
   getProviders: Effect.succeed(providers),
   refresh: () => Effect.succeed(providers),
   refreshInstance: () => Effect.succeed(providers),
+  reloadSecretsAndRefresh: () => Effect.succeed(providers),
   refreshAfterUpdate: () => Effect.succeed(providers),
   refreshWorkspaceSnapshot: () => Effect.succeed(providers),
   getProviderMaintenanceCapabilitiesForInstance: (_instanceId, provider) =>
diff --git a/apps/server/src/secrets/SecretResolver.ts b/apps/server/src/secrets/SecretResolver.ts
new file mode 100644
index 0000000000000..076e4a0780793
--- /dev/null
+++ b/apps/server/src/secrets/SecretResolver.ts
@@ -0,0 +1,20 @@
+import * as SecretResolverCore from "@t3tools/secret-provider-core/server/SecretResolver";
+import type { ServerSettings } from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { BUILT_IN_SECRET_PROVIDER_DRIVER_LIST } from "./secretProviderDefinitions.ts";
+import * as Settings from "../serverSettings.ts";
+
+export const layer = Layer.unwrap(
+  Effect.gen(function* () {
+    const serverSettings = yield* Settings.ServerSettingsService;
+    return SecretResolverCore.layer({
+      drivers: BUILT_IN_SECRET_PROVIDER_DRIVER_LIST,
+      secretProviders: serverSettings.getSettings.pipe(
+        Effect.map((settings) => settings.secretProviders),
+        Effect.orElseSucceed((): ServerSettings["secretProviders"] => ({})),
+      ),
+    });
+  }),
+);
diff --git a/apps/server/src/secrets/secretProviderDefinitions.test.ts b/apps/server/src/secrets/secretProviderDefinitions.test.ts
new file mode 100644
index 0000000000000..b958a480693e1
--- /dev/null
+++ b/apps/server/src/secrets/secretProviderDefinitions.test.ts
@@ -0,0 +1,12 @@
+import { expect, it } from "@effect/vitest";
+
+import {
+  BUILT_IN_SECRET_PROVIDER_DRIVER_LIST,
+  secretProviderDefinitions,
+} from "./secretProviderDefinitions.ts";
+
+it("runs a driver for every secret provider the server and clients read, in their order", () => {
+  expect(BUILT_IN_SECRET_PROVIDER_DRIVER_LIST.map((driver) => driver.definition)).toEqual(
+    secretProviderDefinitions.definitions,
+  );
+});
diff --git a/apps/server/src/secrets/secretProviderDefinitions.ts b/apps/server/src/secrets/secretProviderDefinitions.ts
new file mode 100644
index 0000000000000..409df40bf16cf
--- /dev/null
+++ b/apps/server/src/secrets/secretProviderDefinitions.ts
@@ -0,0 +1,7 @@
+import { builtInSecretProviderDefinitions } from "@t3tools/secret-provider-definitions/registry";
+import * as OnePasswordDriver from "@t3tools/secret-provider-onepassword/server/driver";
+
+/** In the shared registry's order. */
+export const BUILT_IN_SECRET_PROVIDER_DRIVER_LIST = [OnePasswordDriver.driver] as const;
+
+export const secretProviderDefinitions = builtInSecretProviderDefinitions;
diff --git a/apps/server/src/serverSettings.test.ts b/apps/server/src/serverSettings.test.ts
index 8b7d81859b70d..0ae14fae5da7a 100644
--- a/apps/server/src/serverSettings.test.ts
+++ b/apps/server/src/serverSettings.test.ts
@@ -7,7 +7,9 @@ import {
   ProviderDriverKind,
   ProviderInstanceId,
   resolveProviderInstanceEnabled,
+  SecretProviderId,
   ServerSettings,
+  ServerSettingsPatch,
   UsageLimitSourceId,
 } from "@t3tools/contracts";
 import { createModelSelection } from "@t3tools/shared/model";
@@ -33,6 +35,7 @@ import { resolveProviderInstanceTerminalEnvironment } from "./terminal/Manager.t
 
 const decodeServerSettings = Schema.decodeUnknownEffect(ServerSettings);
 const decodeServerSettingsJson = Schema.decodeUnknownEffect(Schema.fromJsonString(ServerSettings));
+const decodeServerSettingsPatch = Schema.decodeUnknownEffect(ServerSettingsPatch);
 
 const layerServerSettings = () =>
   ServerSettingsModule.layer.pipe(
@@ -278,6 +281,25 @@ it.layer(NodeServices.layer)("server settings", (it) => {
     }),
   );
 
+  it.effect("stores no secret provider of an unloaded kind or with a config its kind rejects", () =>
+    Effect.gen(function* () {
+      const service = yield* ServerSettingsModule.ServerSettingsService;
+      const write = (entry: unknown) =>
+        decodeServerSettingsPatch({ secretProviders: { personal: entry } }).pipe(
+          Effect.flatMap(service.updateSettings),
+          Effect.flip,
+        );
+      for (const entry of [
+        { kind: "one_password", label: "Personal", config: { account: "--help" } },
+        { kind: "one_password", label: "Personal" },
+        { kind: "openbao", label: "Vault", config: { address: "https://x" } },
+      ]) {
+        assert.deepInclude(yield* write(entry), { operation: "write-secret-provider" });
+      }
+      assert.deepStrictEqual((yield* service.getSettings).secretProviders, {});
+    }).pipe(Effect.provide(layerServerSettings())),
+  );
+
   it.effect("saves through a symlinked settings file without replacing the link", () =>
     Effect.gen(function* () {
       const config = yield* ServerConfig.ServerConfig;
@@ -1366,6 +1388,27 @@ it.layer(NodeServices.layer)("server settings", (it) => {
         for (const name of secretNames) {
           assert.isTrue(Option.isSome(yield* store.get(name)), name);
         }
+        const secret = {
+          provider: SecretProviderId.make("personal"),
+          reference: "op://Private/Antigravity/token",
+        };
+        const referenced = yield* service.updateProviderInstance({
+          operation: "upsert",
+          instanceId,
+          instance: {
+            ...client.providerInstances[instanceId]!,
+            environment: [
+              { name: "API_TOKEN", value: secret, sensitive: true, valueRedacted: true },
+            ],
+          },
+        });
+        assert.isTrue(Option.isNone(yield* store.get(secretNames[1]!)));
+        assert.deepEqual(
+          ServerSettingsModule.redactServerSettingsForClient(referenced).providerInstances[
+            instanceId
+          ]?.environment,
+          [{ name: "API_TOKEN", value: secret, sensitive: true }],
+        );
         yield* service.updateSettings({
           providerInstances: {},
           sourceControlHosts: {
diff --git a/apps/server/src/serverSettings.ts b/apps/server/src/serverSettings.ts
index 48839bb8535d9..67a1c3c3414f3 100644
--- a/apps/server/src/serverSettings.ts
+++ b/apps/server/src/serverSettings.ts
@@ -8,7 +8,6 @@ import {
   type ProviderInstanceConfig,
   type ProviderInstanceMutation,
   defaultInstanceIdForDriver,
-  isKnownSecretProviderKind,
   isProviderDriverKind,
   ProviderDriverKind,
   ProviderInstanceId,
@@ -53,6 +52,7 @@ import {
   isModelSelectionProviderEnabled,
 } from "@t3tools/shared/serverSettings";
 import * as ServerSecretStore from "./auth/ServerSecretStore.ts";
+import { secretProviderDefinitions } from "./secrets/secretProviderDefinitions.ts";
 import {
   readSecretFieldValues,
   sourceControlHostSecretName,
@@ -144,7 +144,7 @@ function withoutUnknownSecretProviderConfigs(
 ): ServerSettings["secretProviders"] {
   return Object.fromEntries(
     Object.entries(settings.secretProviders).map(([id, entry]) => {
-      if (isKnownSecretProviderKind(entry.kind)) return [id, entry];
+      if (secretProviderConfigGuards.has(entry.kind)) return [id, entry];
       const { config: _config, ...envelope } = entry;
       return [id, envelope];
     }),
@@ -164,6 +164,40 @@ export function applyProviderInstanceMutation(
   return { ...settings, providerInstances };
 }
 
+const secretProviderConfigGuards = new Map(
+  secretProviderDefinitions.definitions.map((definition) => [
+    definition.kind as string,
+    Schema.is(definition.configSchema),
+  ]),
+);
+
+// Rejects a kind this server has not loaded rather than storing a config it cannot check.
+function ensureSecretProviderWritesAllowed(
+  patch: ServerSettingsPatch,
+  settingsPath: string,
+): Effect.Effect<void, ServerSettingsError> {
+  for (const [id, entry] of Object.entries(patch.secretProviders ?? {})) {
+    if (entry === null) continue;
+    const isConfig = secretProviderConfigGuards.get(entry.kind);
+    const problem =
+      isConfig === undefined
+        ? `Unsupported secret provider kind: ${entry.kind}.`
+        : isConfig(entry.config)
+          ? undefined
+          : `Invalid ${entry.kind} config for secret provider ${id}.`;
+    if (problem !== undefined) {
+      return Effect.fail(
+        new ServerSettingsError({
+          settingsPath,
+          operation: "write-secret-provider",
+          cause: new Error(problem),
+        }),
+      );
+    }
+  }
+  return Effect.void;
+}
+
 function ensureProviderInstanceMutationAllowed(
   settings: ServerSettings,
   mutation: ProviderInstanceMutation,
@@ -1185,11 +1219,14 @@ const make = Effect.gen(function* () {
     getSettings: getMaterializedSettings,
     updateSettings: (patch) =>
       updateAndPersistSettings((current) =>
-        Effect.succeed(applyServerSettingsPatch(current, patch)),
+        ensureSecretProviderWritesAllowed(patch, settingsPath).pipe(
+          Effect.as(applyServerSettingsPatch(current, patch)),
+        ),
       ),
     updateProviderInstance: (mutation, patch = {}) =>
       updateAndPersistSettings((current) =>
         Effect.gen(function* () {
+          yield* ensureSecretProviderWritesAllowed(patch, settingsPath);
           yield* ensureProviderInstanceMutationAllowed(current, mutation, settingsPath);
           const patched = applyServerSettingsPatch(current, patch);
           return applyProviderInstanceMutation(patched, mutation);
diff --git a/apps/server/src/settingsSecrets.ts b/apps/server/src/settingsSecrets.ts
index dff6b96f52a1b..3697c877edc22 100644
--- a/apps/server/src/settingsSecrets.ts
+++ b/apps/server/src/settingsSecrets.ts
@@ -99,16 +99,19 @@ export function mapSettingsSecrets(
           ...(instance.environment
             ? {
                 environment: instance.environment.map((variable) => {
+                  const { valueRedacted: _omit, ...rest } = variable;
+                  // A secret reference is not itself secret; storage sees the value cleared.
+                  const reference = typeof variable.value === "string" ? undefined : variable.value;
                   const result = map({
                     secretName: `provider-env-${encode(instanceId)}-${encode(variable.name)}`,
                     kind: "environment",
-                    value: variable.value,
-                    redacted: variable.valueRedacted === true,
+                    value: typeof variable.value === "string" ? variable.value : "",
+                    redacted: reference === undefined && variable.valueRedacted === true,
                     sensitive: variable.sensitive,
                     providerInstanceId: instanceId,
                     environmentVariable: variable.name,
                   });
-                  const { valueRedacted: _omit, ...rest } = variable;
+                  if (reference !== undefined) return { ...rest, value: reference };
                   return {
                     ...rest,
                     value: result.value,
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 622279d16a409..32737aa771df6 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -1793,6 +1793,7 @@ export const layerWsRpc = (
           threadFind: true,
           threadFindProgressive: true,
           secretProviderSettings: true,
+          secretReferences: true,
           ...Option.match(scratchWorkspaceRoot, {
             onNone: () => ({}),
             onSome: (root) => ({ scratchWorkspaceRoot: root }),
@@ -2314,9 +2315,11 @@ export const layerWsRpc = (
                   cwd: input.cwd,
                   fresh: input.fresh === true,
                 })
-              : input.instanceId !== undefined
-                ? providerRegistry.refreshInstance(input.instanceId)
-                : providerRegistry.refresh();
+              : input.reloadSecrets === true
+                ? providerRegistry.reloadSecretsAndRefresh(input.instanceId)
+                : input.instanceId !== undefined
+                  ? providerRegistry.refreshInstance(input.instanceId)
+                  : providerRegistry.refresh();
             if (input.refreshModels) {
               const instances = yield* providerInstances.listInstances;
               for (const instance of instances) {
diff --git a/apps/web/package.json b/apps/web/package.json
index 2ee8fe51a06a3..630020758e8c0 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -34,6 +34,8 @@
     "@t3tools/client-runtime": "workspace:*",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/provider-core": "workspace:*",
+    "@t3tools/secret-provider-definitions": "workspace:*",
+    "@t3tools/secret-provider-onepassword": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@tanstack/react-pacer": "^0.19.4",
     "@tanstack/react-router": "^1.160.2",
diff --git a/apps/web/src/components/settings/AddProviderInstanceDialog.tsx b/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
index 6e245af143dd8..3097cb70a9fbf 100644
--- a/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
+++ b/apps/web/src/components/settings/AddProviderInstanceDialog.tsx
@@ -55,6 +55,7 @@ import { resolveOfficialAcpRegistryIconUrl } from "./AcpRegistryIcon";
 import { AddManagedCodexAccountDialog } from "./CodexSetupSection";
 import { MultipleAccountsNote } from "./MultipleAccountsNote";
 import { ProviderEnvironmentSection } from "./ProviderInstanceCard";
+import { useSecretSources } from "./SecretSourceInput";
 
 /** Limit the slug to 48 chars so the composed ProviderInstanceId fits its 64-char cap. */
 function slugifyLabel(value: string): string {
@@ -160,6 +161,7 @@ export function AddProviderInstanceDialog({
   onCreated,
 }: AddProviderInstanceDialogProps) {
   const settings = useEnvironmentSettings(environmentId);
+  const secretSources = useSecretSources(environmentId);
   const persistProviderInstance = usePersistEnvironmentProviderInstanceMutation(environmentId);
   const canManageProviders = useEnvironmentScope(environmentId, AuthProvidersManageScope);
 
@@ -536,6 +538,7 @@ export function AddProviderInstanceDialog({
                               <ProviderEnvironmentSection
                                 environment={localEnvironment}
                                 onChange={setLocalEnvironment}
+                                secretSources={secretSources}
                               />
                             ) : null}
                           </SettingsGroup>
diff --git a/apps/web/src/components/settings/ProviderInstanceCard.test.ts b/apps/web/src/components/settings/ProviderInstanceCard.test.ts
index c681f78765178..143d64d5c1bdf 100644
--- a/apps/web/src/components/settings/ProviderInstanceCard.test.ts
+++ b/apps/web/src/components/settings/ProviderInstanceCard.test.ts
@@ -1,8 +1,9 @@
 import { describe, expect, it } from "vite-plus/test";
-import type { ServerProviderModel } from "@t3tools/contracts";
+import { SecretProviderId, type ServerProviderModel } from "@t3tools/contracts";
 
 import {
   deriveProviderModelsForDisplay,
+  nextProviderEnvironmentWithFieldSecret,
   nextProviderEnvironmentWithFieldValue,
 } from "./ProviderInstanceCard";
 
@@ -75,6 +76,20 @@ describe("provider environment helpers", () => {
     ).toEqual([{ name: "CURSOR_API_KEY", value: "new-key", sensitive: true }]);
   });
 
+  it("points a stored provider secret at a secret provider and drops the stored value", () => {
+    const secret = {
+      provider: SecretProviderId.make("personal"),
+      reference: "op://Private/Cursor/credential",
+    };
+    const stored = [{ name: "CURSOR_API_KEY", value: "", sensitive: true, valueRedacted: true }];
+    const referenced = nextProviderEnvironmentWithFieldSecret(stored, cursorApiKeyField, secret);
+
+    expect(referenced).toEqual([{ name: "CURSOR_API_KEY", value: secret, sensitive: true }]);
+    expect(
+      nextProviderEnvironmentWithFieldSecret(referenced, cursorApiKeyField, undefined),
+    ).toEqual([]);
+  });
+
   it("applies the secure field default when replacing an existing non-sensitive value", () => {
     expect(
       nextProviderEnvironmentWithFieldValue(
diff --git a/apps/web/src/components/settings/ProviderInstanceCard.tsx b/apps/web/src/components/settings/ProviderInstanceCard.tsx
index 88361eac68bc8..d8b5c71fc0f98 100644
--- a/apps/web/src/components/settings/ProviderInstanceCard.tsx
+++ b/apps/web/src/components/settings/ProviderInstanceCard.tsx
@@ -15,7 +15,7 @@ import {
 import { Lock as LockGlyph, LockOpen } from "lucide";
 import * as Arr from "effect/Array";
 import * as Result from "effect/Result";
-import { useState, type ReactElement, type ReactNode } from "react";
+import { Fragment, useState, type ReactElement, type ReactNode } from "react";
 import {
   isProviderDriverKind,
   resolveProviderInstanceEnabled,
@@ -26,6 +26,7 @@ import {
   type EnvironmentId,
   type ProjectId,
   type ProviderDriverKind,
+  type SecretReference,
   type ServerProvider,
   type ServerProviderModel,
 } from "@t3tools/contracts";
@@ -43,7 +44,7 @@ import { Badge } from "../ui/badge";
 import { Button } from "../ui/button";
 import { MorphIcon } from "~/components/MorphIcon";
 import { DraftInput } from "../ui/draft-input";
-import { SecretInput } from "./SecretInput";
+import { SecretSourceInput, type SecretSource } from "./SecretSourceInput";
 import { Popover, PopoverPopup, PopoverTrigger } from "../ui/popover";
 import { Switch } from "../ui/switch";
 import { stackedThreadToast, toastManager } from "../ui/toast";
@@ -98,7 +99,7 @@ const nextEnvironmentVariableDraftId = () => `provider-env-${environmentVariable
 type EnvironmentDraftRow = {
   readonly id: string;
   readonly name: string;
-  readonly value: string;
+  readonly value: ProviderInstanceEnvironmentVariable["value"];
   readonly sensitive: boolean;
   readonly valueRedacted?: boolean;
 };
@@ -119,6 +120,14 @@ function makeEnvironmentDraftRow(
 const toEnvironmentDraftRows = (environment: ReadonlyArray<ProviderInstanceEnvironmentVariable>) =>
   environment.map(makeEnvironmentDraftRow);
 
+function environmentValuesEqual(
+  left: ProviderInstanceEnvironmentVariable["value"],
+  right: ProviderInstanceEnvironmentVariable["value"],
+): boolean {
+  if (typeof left === "string" || typeof right === "string") return left === right;
+  return left.provider === right.provider && left.reference === right.reference;
+}
+
 function providerEnvironmentsEqual(
   left: ReadonlyArray<ProviderInstanceEnvironmentVariable>,
   right: ReadonlyArray<ProviderInstanceEnvironmentVariable>,
@@ -130,7 +139,7 @@ function providerEnvironmentsEqual(
       return (
         other !== undefined &&
         variable.name === other.name &&
-        variable.value === other.value &&
+        environmentValuesEqual(variable.value, other.value) &&
         variable.sensitive === other.sensitive &&
         variable.valueRedacted === other.valueRedacted
       );
@@ -247,12 +256,28 @@ export function nextProviderEnvironmentWithFieldValue(
   return next;
 }
 
+export function nextProviderEnvironmentWithFieldSecret(
+  environment: ReadonlyArray<ProviderInstanceEnvironmentVariable> | undefined,
+  field: ProviderEnvironmentField,
+  secret: SecretReference | undefined,
+): ReadonlyArray<ProviderInstanceEnvironmentVariable> {
+  const others = providerEnvironmentWithoutNames(environment, new Set([field.name]));
+  return secret === undefined
+    ? others
+    : [...others, { name: field.name, value: secret, sensitive: true }];
+}
+
 function ProviderEnvironmentFieldRow(props: {
   readonly field: ProviderEnvironmentField;
   readonly variable: ProviderInstanceEnvironmentVariable | undefined;
   readonly idPrefix: string;
   readonly onCommit: (field: ProviderEnvironmentField, value: string) => void;
+  readonly onSecretChange: (
+    field: ProviderEnvironmentField,
+    secret: SecretReference | undefined,
+  ) => void;
   readonly onRemove: (field: ProviderEnvironmentField) => void;
+  readonly secretSources: ReadonlyArray<SecretSource>;
 }) {
   const inputId = `${props.idPrefix}-environment-${props.field.name}`;
   const value = props.variable?.valueRedacted ? "" : (props.variable?.value ?? "");
@@ -269,13 +294,13 @@ function ProviderEnvironmentFieldRow(props: {
               size="sm"
               className="min-w-0 flex-1"
               autoComplete="off"
-              value={value}
+              value={typeof value === "string" ? value : ""}
               onCommit={(next) => props.onCommit(props.field, next)}
               placeholder={props.field.placeholder}
               spellCheck={false}
             />
           ) : (
-            <SecretInput
+            <SecretSourceInput
               id={inputId}
               size="sm"
               className="min-w-0 flex-1"
@@ -284,6 +309,9 @@ function ProviderEnvironmentFieldRow(props: {
               placeholder={props.field.placeholder}
               configured={props.variable?.valueRedacted === true}
               spellCheck={false}
+              aria-label={props.field.label}
+              sources={props.secretSources}
+              onSecretChange={(secret) => props.onSecretChange(props.field, secret)}
             />
           )}
           {props.variable ? (
@@ -306,6 +334,7 @@ function ProviderEnvironmentFieldRow(props: {
 export function ProviderEnvironmentSection(props: {
   readonly environment: ReadonlyArray<ProviderInstanceEnvironmentVariable>;
   readonly onChange: (environment: ReadonlyArray<ProviderInstanceEnvironmentVariable>) => void;
+  readonly secretSources?: ReadonlyArray<SecretSource>;
 }) {
   const [storedDraft, setDraft] = useState(() =>
     seedRowsDraft(props.environment, toEnvironmentDraftRows),
@@ -328,7 +357,7 @@ export function ProviderEnvironmentSection(props: {
       if (!ENVIRONMENT_VARIABLE_NAME_PATTERN.test(name)) {
         if (
           name.length > 0 ||
-          row.value.length > 0 ||
+          row.value !== "" ||
           row.sensitive !== true ||
           row.valueRedacted !== undefined
         ) {
@@ -357,6 +386,16 @@ export function ProviderEnvironmentSection(props: {
     publishRows(nextRows);
   };
 
+  const setVariableSecret = (id: string, secret: SecretReference | undefined) => {
+    const nextRows = rows.map((row) => {
+      if (row.id !== id) return row;
+      const { valueRedacted: _valueRedacted, ...rest } = row;
+      return { ...rest, value: secret ?? "" };
+    });
+    setRows(nextRows);
+    publishRows(nextRows);
+  };
+
   const removeVariable = (id: string) => {
     const nextRows = rows.filter((row) => row.id !== id);
     setRows(nextRows);
@@ -387,76 +426,20 @@ export function ProviderEnvironmentSection(props: {
     >
       {rows.length > 0 ? (
         <div className="mt-3 min-w-0 space-y-2 pb-2">
-          {rows.map((variable, index) => (
-            <div key={variable.id} className="flex min-w-0 flex-wrap items-center gap-1.5">
+          {rows.map((variable, index) => {
+            const nameInput = (
               <DraftInput
                 size="sm"
                 font="mono"
-                className="w-full min-w-0 sm:w-44 sm:shrink-0"
+                className="min-w-0 flex-1"
                 value={variable.name}
                 onCommit={(name) => updateVariable(variable.id, { name: name.trim() })}
                 placeholder="VARIABLE_NAME"
                 spellCheck={false}
                 aria-label={`Environment variable name ${index + 1}`}
               />
-              <span className="hidden text-xs text-muted-foreground sm:inline" aria-hidden>
-                =
-              </span>
-              {variable.sensitive ? (
-                <SecretInput
-                  size="sm"
-                  font="mono"
-                  className="min-w-0 flex-1"
-                  value={variable.valueRedacted ? "" : variable.value}
-                  onCommit={(value) => updateVariable(variable.id, { value })}
-                  placeholder="value"
-                  configured={variable.valueRedacted === true}
-                  spellCheck={false}
-                  aria-label={`Environment variable value ${index + 1}`}
-                />
-              ) : (
-                <DraftInput
-                  size="sm"
-                  font="mono"
-                  className="min-w-0 flex-1"
-                  value={variable.valueRedacted ? "" : variable.value}
-                  onCommit={(value) => updateVariable(variable.id, { value })}
-                  autoComplete="off"
-                  placeholder="value"
-                  spellCheck={false}
-                  aria-label={`Environment variable value ${index + 1}`}
-                />
-              )}
-              <Tooltip>
-                <TooltipTrigger
-                  render={
-                    <Button
-                      type="button"
-                      size="icon-micro"
-                      variant="ghost-muted"
-                      onClick={() => {
-                        const sensitive = !variable.sensitive;
-                        updateVariable(variable.id, {
-                          sensitive,
-                          ...(sensitive && variable.valueRedacted === undefined
-                            ? {}
-                            : { valueRedacted: sensitive ? variable.valueRedacted : false }),
-                        });
-                      }}
-                      aria-pressed={variable.sensitive}
-                      aria-label={`Mark environment variable ${variable.name || index + 1} as sensitive`}
-                    >
-                      <MorphIcon
-                        className="size-3"
-                        icon={variable.sensitive ? LockGlyph : LockOpen}
-                      />
-                    </Button>
-                  }
-                />
-                <TooltipPopup side="top">
-                  {variable.sensitive ? "Sensitive, stored separately" : "Plain text"}
-                </TooltipPopup>
-              </Tooltip>
+            );
+            const removeButton = (
               <Button
                 type="button"
                 size="icon-micro"
@@ -466,8 +449,94 @@ export function ProviderEnvironmentSection(props: {
               >
                 <XIcon className="size-3" />
               </Button>
-            </div>
-          ))}
+            );
+            const sensitiveToggle =
+              typeof variable.value === "string" ? (
+                <Tooltip>
+                  <TooltipTrigger
+                    render={
+                      <Button
+                        type="button"
+                        size="icon-micro"
+                        variant="ghost-muted"
+                        onClick={() => {
+                          const sensitive = !variable.sensitive;
+                          updateVariable(variable.id, {
+                            sensitive,
+                            ...(sensitive && variable.valueRedacted === undefined
+                              ? {}
+                              : { valueRedacted: sensitive ? variable.valueRedacted : false }),
+                          });
+                        }}
+                        aria-pressed={variable.sensitive}
+                        aria-label={`Mark environment variable ${variable.name || index + 1} as sensitive`}
+                      >
+                        <MorphIcon
+                          className="size-3"
+                          icon={variable.sensitive ? LockGlyph : LockOpen}
+                        />
+                      </Button>
+                    }
+                  />
+                  <TooltipPopup side="top">
+                    {variable.sensitive ? "Sensitive, stored separately" : "Plain text"}
+                  </TooltipPopup>
+                </Tooltip>
+              ) : null;
+            const layout = (source: ReactNode, value: ReactNode) => (
+              <div className="flex min-w-0 flex-col gap-1.5 rounded-lg border p-2">
+                <div className="flex min-w-0 items-center gap-1.5">
+                  {nameInput}
+                  {source === null ? null : <div className="w-48 shrink-0">{source}</div>}
+                  {removeButton}
+                </div>
+                <div className="flex min-w-0 items-start gap-1.5">
+                  {value}
+                  {sensitiveToggle}
+                </div>
+              </div>
+            );
+            return (
+              <Fragment key={variable.id}>
+                {variable.sensitive ? (
+                  <SecretSourceInput
+                    size="sm"
+                    font="mono"
+                    className="min-w-0 flex-1"
+                    value={variable.valueRedacted ? "" : variable.value}
+                    onCommit={(value) => updateVariable(variable.id, { value })}
+                    placeholder="value"
+                    configured={variable.valueRedacted === true}
+                    spellCheck={false}
+                    aria-label={`Environment variable value ${index + 1}`}
+                    sources={props.secretSources ?? []}
+                    onSecretChange={(secret) => setVariableSecret(variable.id, secret)}
+                  >
+                    {(parts) => layout(parts.source, parts.value)}
+                  </SecretSourceInput>
+                ) : (
+                  layout(
+                    null,
+                    <DraftInput
+                      size="sm"
+                      font="mono"
+                      className="min-w-0 flex-1"
+                      value={
+                        variable.valueRedacted || typeof variable.value !== "string"
+                          ? ""
+                          : variable.value
+                      }
+                      onCommit={(value) => updateVariable(variable.id, { value })}
+                      autoComplete="off"
+                      placeholder="value"
+                      spellCheck={false}
+                      aria-label={`Environment variable value ${index + 1}`}
+                    />,
+                  )
+                )}
+              </Fragment>
+            );
+          })}
           <p className="text-xs text-muted-foreground">
             Sensitive values are stored separately and never returned to the app.
           </p>
@@ -584,6 +653,7 @@ interface ProviderInstanceCardProps {
   readonly isUpdating?: boolean | undefined;
   readonly onAcceptUrlAuth?: ((action: AcpRegistryUrlAuthAction) => void) | undefined;
   readonly environmentId?: EnvironmentId | undefined;
+  readonly secretSources?: ReadonlyArray<SecretSource>;
   readonly projectOverride?: ProjectOverrideControl | undefined;
   readonly acpProjects?:
     | ReadonlyArray<{
@@ -595,6 +665,7 @@ interface ProviderInstanceCardProps {
 }
 
 const EMPTY_ACP_PROJECTS: NonNullable<ProviderInstanceCardProps["acpProjects"]> = [];
+const NO_SECRET_SOURCES: ReadonlyArray<SecretSource> = [];
 const NO_CUSTOM_MODELS: ReadonlyArray<CustomModelDefinition> = [];
 
 /** Unknown drivers stay read-only to preserve fork config. projectOverride switches affect only the
@@ -627,6 +698,7 @@ export function ProviderInstanceCard({
   onAcceptUrlAuth,
   environmentId,
   acpProjects = EMPTY_ACP_PROJECTS,
+  secretSources = NO_SECRET_SOURCES,
   projectOverride,
 }: ProviderInstanceCardProps) {
   const enabled = projectOverride?.effectiveEnabled ?? resolveProviderInstanceEnabled(instance);
@@ -781,6 +853,12 @@ export function ProviderInstanceCard({
   const updateEnvironmentField = (field: ProviderEnvironmentField, value: string) => {
     updateEnvironment(nextProviderEnvironmentWithFieldValue(instance.environment, field, value));
   };
+  const updateEnvironmentFieldSecret = (
+    field: ProviderEnvironmentField,
+    secret: SecretReference | undefined,
+  ) => {
+    updateEnvironment(nextProviderEnvironmentWithFieldSecret(instance.environment, field, secret));
+  };
   const removeEnvironmentField = (field: ProviderEnvironmentField) => {
     updateEnvironment(providerEnvironmentWithoutNames(instance.environment, new Set([field.name])));
   };
@@ -1182,7 +1260,9 @@ export function ProviderInstanceCard({
                   variable={readProviderEnvironmentVariable(instance.environment, field.name)}
                   idPrefix={`provider-instance-${instanceId}`}
                   onCommit={updateEnvironmentField}
+                  onSecretChange={updateEnvironmentFieldSecret}
                   onRemove={removeEnvironmentField}
+                  secretSources={secretSources}
                 />
               ))}
             </div>
@@ -1225,6 +1305,7 @@ export function ProviderInstanceCard({
         <ProviderEnvironmentSection
           environment={genericEnvironment}
           onChange={updateGenericEnvironment}
+          secretSources={secretSources}
         />
       </SettingsSection>
       {environmentId !== undefined && liveProvider?.driver === "acpRegistry" ? (
diff --git a/apps/web/src/components/settings/ProviderSettingsPanel.tsx b/apps/web/src/components/settings/ProviderSettingsPanel.tsx
index 9dae72e98ff50..b5fb648ff97c2 100644
--- a/apps/web/src/components/settings/ProviderSettingsPanel.tsx
+++ b/apps/web/src/components/settings/ProviderSettingsPanel.tsx
@@ -98,6 +98,7 @@ import { stackedThreadToast, toastManager } from "../ui/toast";
 import { AddProviderInstanceDialog } from "./AddProviderInstanceDialog";
 import { ExpandableText } from "./ExpandableText";
 import { ProviderInstanceCard } from "./ProviderInstanceCard";
+import { useSecretSources } from "./SecretSourceInput";
 import { UsageProviderSettings } from "./UsageProviderSettings";
 import { ProviderSetupSection, readAntigravityAuthMethod } from "./ProviderSetupSection";
 import { ProviderAuthenticationSection } from "./ProviderAuthenticationSection";
@@ -635,7 +636,7 @@ export function EnvironmentProviderSettings({
     void (async () => {
       const result = await refreshServerProviders({
         environmentId,
-        input: { refreshModels: true },
+        input: { refreshModels: true, reloadSecrets: true },
       });
       refreshingRef.current = false;
       setIsRefreshingProviders(false);
@@ -1247,6 +1248,7 @@ function ProviderInstanceRow({
   readonly actions: ProviderInstanceRowActions;
 }) {
   const allProjects = useProjects();
+  const secretSources = useSecretSources(environmentId);
   const acpProjects =
     mode === "editor" && liveProvider?.driver === "acpRegistry"
       ? allProjects.filter((project) => project.environmentId === environmentId)
@@ -1285,6 +1287,7 @@ function ProviderInstanceRow({
   return (
     <ProviderInstanceCard
       environmentId={environmentId}
+      secretSources={secretSources}
       acpProjects={acpProjects}
       projectOverride={projectOverride}
       onAcceptUrlAuth={
diff --git a/apps/web/src/components/settings/SecretProviderDialog.logic.ts b/apps/web/src/components/settings/SecretProviderDialog.logic.ts
index 11139d9c7aa67..ab5872955def8 100644
--- a/apps/web/src/components/settings/SecretProviderDialog.logic.ts
+++ b/apps/web/src/components/settings/SecretProviderDialog.logic.ts
@@ -1,11 +1,13 @@
 import {
-  OnePasswordSecretProviderConfig,
   SecretProviderId,
   SecretProviderKind,
   SecretProviderLabel,
-  type OnePasswordAccount,
   type SecretProviderConfig,
 } from "@t3tools/contracts";
+import {
+  OnePasswordSecretProviderConfig,
+  type OnePasswordAccount,
+} from "@t3tools/secret-provider-onepassword/shared/definition";
 import * as Option from "effect/Option";
 import * as Result from "effect/Result";
 import * as Schema from "effect/Schema";
diff --git a/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
new file mode 100644
index 0000000000000..e1b67465c2168
--- /dev/null
+++ b/apps/web/src/components/settings/SecretSourceInput.browser.test.tsx
@@ -0,0 +1,82 @@
+import { SecretProviderId, SecretProviderKind } from "@t3tools/contracts";
+import { describe, expect, it, vi } from "vite-plus/test";
+import { userEvent } from "vite-plus/test/browser";
+
+import { render, type Screen } from "../../../test/render";
+import { SecretSourceInput } from "./SecretSourceInput";
+
+const personal = SecretProviderId.make("personal");
+const work = SecretProviderId.make("work");
+const sources = [
+  { id: personal, kind: SecretProviderKind.make("one_password"), label: "Personal" },
+  { id: work, kind: SecretProviderKind.make("one_password"), label: "Work" },
+];
+
+const reference = (screen: Screen) => screen.getByRole("textbox", { name: "API key reference" });
+
+async function commitReference(screen: Screen, value: string) {
+  await userEvent.clear(reference(screen));
+  await userEvent.type(reference(screen), value);
+  await userEvent.keyboard("{Enter}");
+}
+
+describe("SecretSourceInput", () => {
+  it("moves a reference to another provider only once one is committed for it", async () => {
+    const onSecretChange = vi.fn();
+    await using screen = await render(
+      <SecretSourceInput
+        aria-label="API key"
+        value={{ provider: personal, reference: "op://Private/OpenAI/credential" }}
+        sources={sources}
+        onCommit={() => {}}
+        onSecretChange={onSecretChange}
+      />,
+    );
+
+    await userEvent.click(screen.getByRole("combobox", { name: "API key source" }));
+    await userEvent.click(screen.getByRole("option", { name: "Work" }));
+    expect(onSecretChange).not.toHaveBeenCalled();
+    await expect.element(reference(screen)).toHaveValue("");
+
+    await commitReference(screen, "op://Shared/OpenAI/credential");
+    expect(onSecretChange).toHaveBeenCalledExactlyOnceWith({
+      provider: work,
+      reference: "op://Shared/OpenAI/credential",
+    });
+  });
+
+  it("removes the reference when its field is cleared", async () => {
+    const onSecretChange = vi.fn();
+    await using screen = await render(
+      <SecretSourceInput
+        aria-label="API key"
+        value={{ provider: personal, reference: "op://Private/OpenAI/credential" }}
+        sources={sources}
+        onCommit={() => {}}
+        onSecretChange={onSecretChange}
+      />,
+    );
+
+    await userEvent.clear(reference(screen));
+    await userEvent.keyboard("{Enter}");
+    expect(onSecretChange).toHaveBeenCalledExactlyOnceWith(undefined);
+  });
+
+  it("rejects a reference 1Password cannot read", async () => {
+    const onSecretChange = vi.fn();
+    await using screen = await render(
+      <SecretSourceInput
+        aria-label="API key"
+        value={{ provider: personal, reference: "op://Private/OpenAI/credential" }}
+        sources={sources}
+        onCommit={() => {}}
+        onSecretChange={onSecretChange}
+      />,
+    );
+
+    await commitReference(screen, "Private/OpenAI/credential");
+    expect(onSecretChange).not.toHaveBeenCalled();
+    await expect.element(reference(screen)).toHaveAttribute("aria-invalid", "true");
+    await expect.element(reference(screen)).toHaveValue("Private/OpenAI/credential");
+  });
+});
diff --git a/apps/web/src/components/settings/SecretSourceInput.tsx b/apps/web/src/components/settings/SecretSourceInput.tsx
new file mode 100644
index 0000000000000..092e59b9dcd0f
--- /dev/null
+++ b/apps/web/src/components/settings/SecretSourceInput.tsx
@@ -0,0 +1,185 @@
+import {
+  SecretReference,
+  type EnvironmentId,
+  type SecretProviderConfig,
+  type SecretProviderId,
+  type SecretProviderKind,
+} from "@t3tools/contracts";
+import { builtInSecretProviderDefinitions } from "@t3tools/secret-provider-definitions/registry";
+import { useAtomValue } from "@effect/atom-react";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { KeyRoundIcon, TypeIcon } from "lucide-react";
+import { useState, type ComponentProps, type ComponentType, type ReactNode } from "react";
+
+import { isSecretsFeatureEnabled } from "../../env";
+import { useEnvironmentSettings } from "../../hooks/useSettings";
+import { OnePasswordIcon } from "../Icons";
+import { serverEnvironment } from "../../state/server";
+import { DraftInput } from "../ui/draft-input";
+import { Select, SelectItem, SelectPopup, SelectTrigger, SelectValue } from "../ui/select";
+import { SecretInput } from "./SecretInput";
+import { classifySecretProvider } from "./SecretProviderDialog.logic";
+
+export interface SecretSource {
+  readonly id: SecretProviderId;
+  readonly kind: SecretProviderKind;
+  readonly label: string;
+}
+
+const NO_SECRET_SOURCES: ReadonlyArray<SecretSource> = [];
+const STORED_VALUE = "__stored__";
+const decodeSecretReference = Schema.decodeUnknownOption(SecretReference);
+
+/** Secret providers a setting can point at; empty when the environment cannot read references. */
+export function useSecretSources(environmentId: EnvironmentId): ReadonlyArray<SecretSource> {
+  const providers = useEnvironmentSettings(environmentId, (settings) => settings.secretProviders);
+  const supported = useAtomValue(
+    serverEnvironment.configValueAtom(environmentId),
+    (config) => config?.secretReferences === true,
+  );
+  if (!isSecretsFeatureEnabled || !supported) return NO_SECRET_SOURCES;
+  return (Object.entries(providers) as Array<[SecretProviderId, SecretProviderConfig]>)
+    .filter(([, config]) => classifySecretProvider(config).kind !== "unsupported")
+    .map(([id, config]) => ({ id, kind: config.kind, label: config.label }));
+}
+
+function SourceLabel(props: {
+  readonly icon: ComponentType<{ readonly className?: string }>;
+  readonly label: string;
+}) {
+  return (
+    <span className="flex min-w-0 items-center gap-1.5">
+      <props.icon className="size-3.5 shrink-0" />
+      <span className="truncate">{props.label}</span>
+    </span>
+  );
+}
+
+type SecretSourceInputProps = Omit<ComponentProps<typeof SecretInput>, "value" | "children"> & {
+  readonly value: string | SecretReference;
+  readonly sources: ReadonlyArray<SecretSource>;
+  readonly onSecretChange: (secret: SecretReference | undefined) => void;
+  /** Places the parts in the caller's layout; `source` is null when there is nothing to pick. */
+  readonly children?: (parts: {
+    readonly source: ReactNode;
+    readonly value: ReactNode;
+  }) => ReactNode;
+};
+
+/** A secret entered here, or read from a secret provider when one is configured. */
+export function SecretSourceInput({
+  value,
+  sources,
+  onSecretChange,
+  children,
+  ...rest
+}: SecretSourceInputProps) {
+  // A provider picked here applies once a reference for it is committed.
+  const [pendingProvider, setPendingProvider] = useState<SecretProviderId | null>(null);
+  const [rejectedReference, setRejectedReference] = useState<string | null>(null);
+  const secret = typeof value === "string" ? undefined : value;
+  const input = { ...rest, value: typeof value === "string" ? value : "" };
+  const provider = pendingProvider ?? secret?.provider ?? null;
+  const reference = secret !== undefined && secret.provider === provider ? secret.reference : "";
+  const providerSource = sources.find((source) => source.id === provider);
+  const definition = providerSource && builtInSecretProviderDefinitions.find(providerSource.kind);
+  const label = input["aria-label"] ?? "Secret";
+  const providerLabel = (id: SecretProviderId) =>
+    sources.find((source) => source.id === id)?.label ?? id;
+  const providerIcon = (id: SecretProviderId) =>
+    sources.some((source) => source.id === id) ? OnePasswordIcon : KeyRoundIcon;
+
+  const source =
+    sources.length === 0 && provider === null ? null : (
+      <Select
+        value={provider ?? STORED_VALUE}
+        onValueChange={(value) => {
+          setRejectedReference(null);
+          if (value === STORED_VALUE || value === null) {
+            setPendingProvider(null);
+            if (secret !== undefined) onSecretChange(undefined);
+            return;
+          }
+          const next = value as SecretProviderId;
+          setPendingProvider(next === secret?.provider ? null : next);
+        }}
+      >
+        <SelectTrigger size="sm" className="w-full min-w-0" aria-label={`${label} source`}>
+          <SelectValue>
+            {provider === null ? (
+              <SourceLabel icon={TypeIcon} label="Value" />
+            ) : (
+              <SourceLabel icon={providerIcon(provider)} label={providerLabel(provider)} />
+            )}
+          </SelectValue>
+        </SelectTrigger>
+        <SelectPopup align="start" alignItemWithTrigger={false}>
+          <SelectItem value={STORED_VALUE}>
+            <SourceLabel icon={TypeIcon} label="Value" />
+          </SelectItem>
+          {sources.map((source) => (
+            <SelectItem key={source.id} value={source.id}>
+              <SourceLabel icon={OnePasswordIcon} label={source.label} />
+            </SelectItem>
+          ))}
+          {provider !== null && !sources.some((source) => source.id === provider) ? (
+            <SelectItem value={provider}>
+              <SourceLabel icon={KeyRoundIcon} label={provider} />
+            </SelectItem>
+          ) : null}
+        </SelectPopup>
+      </Select>
+    );
+
+  const valueField =
+    provider === null ? (
+      <SecretInput {...input} />
+    ) : (
+      <div className="flex min-w-0 flex-1 flex-col gap-1">
+        <DraftInput
+          {...(input.id !== undefined ? { id: input.id } : {})}
+          size="sm"
+          font="mono"
+          value={rejectedReference ?? reference}
+          onCommit={(next) => {
+            if (next.trim().length === 0) {
+              setRejectedReference(null);
+              if (pendingProvider === null && secret !== undefined) onSecretChange(undefined);
+              return;
+            }
+            const decoded = decodeSecretReference({ provider, reference: next });
+            if (
+              Option.isNone(decoded) ||
+              definition?.isReference(decoded.value.reference) === false
+            ) {
+              setRejectedReference(next);
+              return;
+            }
+            setRejectedReference(null);
+            setPendingProvider(null);
+            onSecretChange(decoded.value);
+          }}
+          autoComplete="off"
+          placeholder={definition?.referencePlaceholder}
+          spellCheck={false}
+          aria-label={`${label} reference`}
+          aria-invalid={rejectedReference !== null}
+        />
+        {rejectedReference !== null ? (
+          <p className="text-2xs text-destructive">
+            {definition?.invalidReferenceMessage ?? "Enter a valid secret reference."}
+          </p>
+        ) : null}
+      </div>
+    );
+
+  if (children !== undefined) return children({ source, value: valueField });
+  if (source === null) return valueField;
+  return (
+    <div className="flex min-w-0 flex-1 items-start gap-1.5">
+      <div className="w-28 shrink-0">{source}</div>
+      {valueField}
+    </div>
+  );
+}
diff --git a/package.json b/package.json
index 1c4ffa679029c..c78b879301b9e 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "report:renders": "node scripts/render-metrics.ts",
     "lint": "vp lint --report-unused-disable-directives",
     "knip": "knip --preprocessor ./scripts/knip-schemas.ts",
-    "knip:check": "knip --include files,dependencies --no-config-hints && knip --workspace apps/server --workspace apps/desktop --workspace apps/web --workspace packages/client-runtime --workspace packages/contracts --workspace packages/effect-acp --workspace packages/effect-codex-app-server --workspace packages/shared --workspace packages/ssh --workspace packages/tailscale --workspace packages/provider-core --workspace packages/provider-acp --workspace packages/provider-acp-registry --workspace packages/provider-testing --workspace packages/provider-pi --workspace packages/provider-muse --workspace packages/provider-opencode --workspace packages/provider-cursor --workspace packages/provider-fx --workspace packages/provider-grok --workspace packages/source-control-core --workspace packages/source-control-definitions --workspace packages/source-control-azure-devops --workspace packages/source-control-bitbucket --workspace packages/source-control-forgejo --workspace packages/source-control-gitcafe --workspace packages/source-control-github --workspace packages/source-control-gitlab --workspace packages/source-control-testing --exports --preprocessor ./scripts/knip-schemas.ts --no-config-hints",
+    "knip:check": "knip --include files,dependencies --no-config-hints && knip --workspace apps/server --workspace apps/desktop --workspace apps/web --workspace packages/client-runtime --workspace packages/contracts --workspace packages/effect-acp --workspace packages/effect-codex-app-server --workspace packages/shared --workspace packages/ssh --workspace packages/tailscale --workspace packages/provider-core --workspace packages/provider-acp --workspace packages/provider-acp-registry --workspace packages/provider-testing --workspace packages/provider-pi --workspace packages/provider-muse --workspace packages/provider-opencode --workspace packages/provider-cursor --workspace packages/provider-fx --workspace packages/provider-grok --workspace packages/secret-provider-core --workspace packages/secret-provider-definitions --workspace packages/secret-provider-onepassword --workspace packages/source-control-core --workspace packages/source-control-definitions --workspace packages/source-control-azure-devops --workspace packages/source-control-bitbucket --workspace packages/source-control-forgejo --workspace packages/source-control-gitcafe --workspace packages/source-control-github --workspace packages/source-control-gitlab --workspace packages/source-control-testing --exports --preprocessor ./scripts/knip-schemas.ts --no-config-hints",
     "knip:production": "knip --production --preprocessor ./scripts/knip-schemas.ts",
     "lint:mobile": "node scripts/mobile-native-static-check.ts",
     "mobile:install": "node scripts/mobile-native-client.ts ensure",
diff --git a/packages/contracts/src/index.ts b/packages/contracts/src/index.ts
index e61597e52ecdb..30bf25598d55d 100644
--- a/packages/contracts/src/index.ts
+++ b/packages/contracts/src/index.ts
@@ -67,4 +67,5 @@ export * from "./resourceTelemetry.ts";
 export * from "./rpc.ts";
 export * from "./worktreeSetup.ts";
 export * from "./secretRequest.ts";
+export * from "./secretReference.ts";
 export * from "./clientRpcPermissions.ts";
diff --git a/packages/contracts/src/providerInstance.ts b/packages/contracts/src/providerInstance.ts
index 9cc0a3f52375d..61fee930c3193 100644
--- a/packages/contracts/src/providerInstance.ts
+++ b/packages/contracts/src/providerInstance.ts
@@ -1,6 +1,8 @@
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
+import * as SchemaTransformation from "effect/SchemaTransformation";
 import { TrimmedNonEmptyString } from "./baseSchemas.ts";
+import { SecretReference } from "./secretReference.ts";
 
 const PROVIDER_SLUG_MAX_CHARS = 64;
 const PROVIDER_SLUG_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
@@ -27,17 +29,48 @@ export const ProviderInstanceEnvironmentVariableName = TrimmedNonEmptyString.che
 export type ProviderInstanceEnvironmentVariableName =
   typeof ProviderInstanceEnvironmentVariableName.Type;
 
-export const ProviderInstanceEnvironmentVariable = Schema.Struct({
+const ProviderInstanceEnvironmentVariableValue = Schema.Struct({
+  name: ProviderInstanceEnvironmentVariableName,
+  value: Schema.Union([Schema.String, SecretReference]),
+  sensitive: Schema.Boolean,
+  valueRedacted: Schema.optionalKey(Schema.Boolean),
+});
+
+// A reference is encoded beside an empty value so older servers and clients still decode it.
+const StoredProviderInstanceEnvironmentVariable = Schema.Struct({
   name: ProviderInstanceEnvironmentVariableName,
   value: Schema.String.pipe(Schema.withDecodingDefault(Effect.succeed(""))),
   sensitive: Schema.Boolean.pipe(Schema.withDecodingDefault(Effect.succeed(false))),
   valueRedacted: Schema.optionalKey(Schema.Boolean),
+  secret: Schema.optionalKey(SecretReference),
 });
+
+export const ProviderInstanceEnvironmentVariable = StoredProviderInstanceEnvironmentVariable.pipe(
+  Schema.decodeTo(
+    Schema.toType(ProviderInstanceEnvironmentVariableValue),
+    SchemaTransformation.transform<
+      typeof ProviderInstanceEnvironmentVariableValue.Type,
+      typeof StoredProviderInstanceEnvironmentVariable.Type
+    >({
+      decode: ({ secret, ...variable }) =>
+        secret === undefined ? variable : { ...variable, value: secret },
+      encode: ({ value, ...variable }) =>
+        typeof value === "string"
+          ? { ...variable, value }
+          : { ...variable, value: "", secret: value },
+    }),
+  ),
+);
 export type ProviderInstanceEnvironmentVariable = typeof ProviderInstanceEnvironmentVariable.Type;
 
 export const ProviderInstanceEnvironment = Schema.Array(ProviderInstanceEnvironmentVariable);
 export type ProviderInstanceEnvironment = typeof ProviderInstanceEnvironment.Type;
 
+/** What drivers receive: every secret reference has been read into a plain value. */
+export type ResolvedProviderInstanceEnvironment = ReadonlyArray<
+  Omit<ProviderInstanceEnvironmentVariable, "value"> & { readonly value: string }
+>;
+
 /** Drivers decode their own config; unknown-driver envelopes round-trip verbatim across versions. */
 export const ProviderInstanceConfig = Schema.Struct({
   driver: ProviderDriverKind,
diff --git a/packages/contracts/src/rpc.ts b/packages/contracts/src/rpc.ts
index 145fe5e06087c..445048eb2685d 100644
--- a/packages/contracts/src/rpc.ts
+++ b/packages/contracts/src/rpc.ts
@@ -634,6 +634,8 @@ export const WsServerRefreshProvidersRpc = Rpc.make(WS_METHODS.serverRefreshProv
     fresh: Schema.optional(Schema.Boolean),
     /** Bypass model caches; explicit rediscovery may open sessions, background refreshes must not. */
     refreshModels: Schema.optional(Schema.Boolean),
+    /** Read secret references again; unlocking a vault can prompt on the host, so only explicit user refreshes ask. */
+    reloadSecrets: Schema.optional(Schema.Boolean),
     /**
      * Reply without snapshots, or with only the requested instance's cwd snapshot. Snapshots then
      * reach the client only through these replies, so another client's scan shows on its next
diff --git a/packages/contracts/src/secretReference.ts b/packages/contracts/src/secretReference.ts
new file mode 100644
index 0000000000000..4e03f8a675688
--- /dev/null
+++ b/packages/contracts/src/secretReference.ts
@@ -0,0 +1,27 @@
+import * as Schema from "effect/Schema";
+
+import { TrimmedNonEmptyString } from "./baseSchemas.ts";
+
+// Separate module avoids an import cycle between settings and provider instance contracts.
+// Final once shipped: older builds drop entries whose key fails here, and erase them on their next save.
+// Unlike provider slugs it may start with a digit, so a provider named "1Password" fits.
+export const SecretProviderSlug = TrimmedNonEmptyString.check(
+  Schema.isMaxLength(64),
+  Schema.isPattern(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/),
+);
+
+export const SecretProviderId = SecretProviderSlug.pipe(Schema.brand("SecretProviderId"));
+export type SecretProviderId = typeof SecretProviderId.Type;
+
+// Provider-specific syntax is the secret provider driver's to check.
+export const SecretReferencePath = TrimmedNonEmptyString.check(
+  Schema.isMaxLength(1024),
+  Schema.isPattern(/^[^\r\n]+$/),
+);
+
+/** Points at a secret held by a configured secret provider; the secret itself is never stored. */
+export const SecretReference = Schema.Struct({
+  provider: SecretProviderId,
+  reference: SecretReferencePath,
+});
+export type SecretReference = typeof SecretReference.Type;
diff --git a/packages/contracts/src/server.ts b/packages/contracts/src/server.ts
index 9fd3813abf5fa..ab79a9dea60f5 100644
--- a/packages/contracts/src/server.ts
+++ b/packages/contracts/src/server.ts
@@ -640,6 +640,8 @@ export const ServerConfig = Schema.Struct({
   threadFindProgressive: Schema.optionalKey(Schema.Boolean),
   /** Settings patches may carry `secretProviders`; older servers drop the key without an error. */
   secretProviderSettings: Schema.optionalKey(Schema.Boolean),
+  /** Secret settings may point at a secret provider; older servers drop the reference. */
+  secretReferences: Schema.optionalKey(Schema.Boolean),
   scratchWorkspaceRoot: Schema.optionalKey(TrimmedNonEmptyString),
   newProjectsRoot: Schema.optionalKey(TrimmedNonEmptyString),
   /**
diff --git a/packages/contracts/src/settings.test.ts b/packages/contracts/src/settings.test.ts
index 9d765ccee92c6..859644a54c72f 100644
--- a/packages/contracts/src/settings.test.ts
+++ b/packages/contracts/src/settings.test.ts
@@ -2,7 +2,11 @@ import { describe, expect, it } from "vite-plus/test";
 import * as Schema from "effect/Schema";
 
 import { type CommandId, ProjectId } from "./baseSchemas.ts";
-import { ProviderDriverKind, ProviderInstanceId } from "./providerInstance.ts";
+import {
+  ProviderDriverKind,
+  ProviderInstanceEnvironment,
+  ProviderInstanceId,
+} from "./providerInstance.ts";
 import {
   ClientSettingsSchema,
   ClientSettingsPatch,
@@ -23,6 +27,14 @@ const decodeClientSettings = Schema.decodeUnknownSync(ClientSettingsSchema);
 const decodeClientSettingsPatch = Schema.decodeUnknownSync(ClientSettingsPatch);
 const encodeClientSettings = Schema.encodeSync(ClientSettingsSchema);
 const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
+const encodeProviderInstanceEnvironment = Schema.encodeSync(ProviderInstanceEnvironment);
+const decodeProviderInstanceEnvironment = Schema.decodeSync(ProviderInstanceEnvironment);
+// The environment variable shape builds released before secret references decode.
+const decodeStringOnlyEnvironment = Schema.decodeUnknownSync(
+  Schema.Array(
+    Schema.Struct({ name: Schema.String, value: Schema.String, sensitive: Schema.Boolean }),
+  ),
+);
 const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 const encodeServerSettings = Schema.encodeSync(ServerSettings);
 const encodeServerSettingsPatch = Schema.encodeSync(ServerSettingsPatch);
@@ -154,14 +166,45 @@ describe("ServerSettings secret providers", () => {
     ).toThrow();
   });
 
-  it("rejects writes of an unknown kind or an account op could misread", () => {
-    const write = (entry: unknown) => () =>
-      decodeServerSettingsPatch({ secretProviders: { personal: entry } });
-    for (const account of ["", "my account", "--help"]) {
-      expect(write(onePassword(account))).toThrow();
+  it("stores a provider environment secret reference in a layout older builds still decode", () => {
+    const providerInstances = (secret: unknown) => ({
+      codex: {
+        driver: "codex",
+        environment: [
+          { name: "OPENAI_API_KEY", sensitive: true, value: "", secret },
+          { name: "BASE_URL", value: "https://example.test" },
+        ],
+      },
+    });
+    const secret = { provider: "personal", reference: "op://Private/OpenAI/credential" };
+    const environment = decodeServerSettings({ providerInstances: providerInstances(secret) })
+      .providerInstances[ProviderInstanceId.make("codex")]?.environment;
+    expect(environment).toEqual([
+      { name: "OPENAI_API_KEY", value: secret, sensitive: true },
+      { name: "BASE_URL", value: "https://example.test", sensitive: false },
+    ]);
+
+    const encoded = encodeProviderInstanceEnvironment(environment ?? []);
+    expect(encoded).toEqual([
+      { name: "OPENAI_API_KEY", value: "", sensitive: true, secret },
+      { name: "BASE_URL", value: "https://example.test", sensitive: false },
+    ]);
+    expect(decodeProviderInstanceEnvironment(encoded)).toEqual(environment);
+    expect(decodeStringOnlyEnvironment(encoded)).toEqual([
+      { name: "OPENAI_API_KEY", value: "", sensitive: true },
+      { name: "BASE_URL", value: "https://example.test", sensitive: false },
+    ]);
+
+    for (const invalid of [
+      { provider: "My Vault", reference: "op://a/b/c" },
+      { provider: "personal", reference: " " },
+      { provider: "personal", reference: "op://Private/OpenAI\n/credential" },
+      { provider: "personal", reference: "x".repeat(1025) },
+    ]) {
+      expect(() =>
+        decodeServerSettings({ providerInstances: providerInstances(invalid) }),
+      ).toThrow();
     }
-    expect(write({ kind: "one_password", label: "Personal" })).toThrow();
-    expect(write({ kind: "openbao", label: "Vault", config: { address: "https://x" } })).toThrow();
   });
 });
 
diff --git a/packages/contracts/src/settings.ts b/packages/contracts/src/settings.ts
index 179e58b7a0b56..643d27296f34b 100644
--- a/packages/contracts/src/settings.ts
+++ b/packages/contracts/src/settings.ts
@@ -20,6 +20,7 @@ import {
   TrimmedString,
 } from "./baseSchemas.ts";
 import { UsageLimitSourceId } from "./usageLimitSourceId.ts";
+import { SecretProviderId, SecretProviderSlug } from "./secretReference.ts";
 import { EnvironmentMachineKind, ThreadEnvMode, WorktreeSubmodules } from "./environment.ts";
 import { KeybindingShortcut } from "./keybindings.ts";
 import {
@@ -859,42 +860,11 @@ export const UsageLimitSourceConfig = Schema.Struct({
 });
 export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;
 
-// Final once shipped: older builds drop entries whose key fails here, and erase them on their next save.
-// Unlike provider slugs it may start with a digit, so a provider named "1Password" fits.
-const SecretProviderSlug = TrimmedNonEmptyString.check(
-  Schema.isMaxLength(64),
-  Schema.isPattern(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/),
-);
-
-export const SecretProviderId = SecretProviderSlug.pipe(Schema.brand("SecretProviderId"));
-export type SecretProviderId = typeof SecretProviderId.Type;
-
 export const SecretProviderKind = SecretProviderSlug.pipe(Schema.brand("SecretProviderKind"));
 export type SecretProviderKind = typeof SecretProviderKind.Type;
 
-const ONE_PASSWORD_ACCOUNT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-
-/**
- * Any value `op --account` accepts: shorthand, sign-in address, account ID, or user ID.
- * It is passed to the CLI as an argument, so it can never start with `-`.
- */
-export const OnePasswordAccount = Schema.String.check(
-  Schema.isMaxLength(253),
-  Schema.makeFilter((value: string) =>
-    ONE_PASSWORD_ACCOUNT_PATTERN.test(value)
-      ? true
-      : "1Password account must be a shorthand, sign-in address, or ID with no spaces.",
-  ),
-).pipe(Schema.brand("OnePasswordAccount"));
-export type OnePasswordAccount = typeof OnePasswordAccount.Type;
-
 export const SecretProviderLabel = TrimmedNonEmptyString.check(Schema.isMaxLength(64));
 
-export const OnePasswordSecretProviderConfig = Schema.Struct({
-  account: OnePasswordAccount,
-});
-export type OnePasswordSecretProviderConfig = typeof OnePasswordSecretProviderConfig.Type;
-
 /** Kinds decode their own config; unknown-kind envelopes round-trip verbatim across versions. */
 export const SecretProviderConfig = Schema.Struct({
   kind: SecretProviderKind,
@@ -903,31 +873,12 @@ export const SecretProviderConfig = Schema.Struct({
 });
 export type SecretProviderConfig = typeof SecretProviderConfig.Type;
 
-/** Kinds this build can resolve. Their `config` holds no credentials, so clients may read it. */
-const SECRET_PROVIDER_KIND_CONFIG_GUARDS: Readonly<Record<string, (config: unknown) => boolean>> = {
-  one_password: Schema.is(OnePasswordSecretProviderConfig),
-};
-
-export function isKnownSecretProviderKind(kind: string): boolean {
-  return Object.hasOwn(SECRET_PROVIDER_KIND_CONFIG_GUARDS, kind);
-}
-
-// Limits that may change later are enforced on writes only, never on the stored envelope.
-// Writes must be a kind this build knows with a config it accepts, so an older server
-// rejects a newer kind instead of storing what it cannot check.
+// Limits that may change later are enforced on writes only, never on the stored envelope. The
+// server also checks the kind and its config against the secret providers it has loaded.
 const SecretProviderConfigWrite = Schema.Struct({
   ...SecretProviderConfig.fields,
   label: SecretProviderLabel,
-}).check(
-  Schema.makeFilter((entry) => {
-    if (!isKnownSecretProviderKind(entry.kind)) {
-      return `Unsupported secret provider kind: ${entry.kind}.`;
-    }
-    return SECRET_PROVIDER_KIND_CONFIG_GUARDS[entry.kind]!(entry.config)
-      ? true
-      : `Invalid ${entry.kind} secret provider config.`;
-  }),
-);
+});
 
 export const SourceControlHostSettings = Schema.Record(Schema.String, Schema.Unknown);
 export type SourceControlHostSettings = typeof SourceControlHostSettings.Type;
@@ -1526,6 +1477,7 @@ export const ServerSettingsOperation = Schema.Literals([
   "remove-secret",
   "remove-stale-secret",
   "write-secret",
+  "write-secret-provider",
   "write-file",
   "prepare-directory",
 ]);
diff --git a/packages/provider-core/src/server/driver.ts b/packages/provider-core/src/server/driver.ts
index d236a98fdcba2..a1771e2e748e9 100644
--- a/packages/provider-core/src/server/driver.ts
+++ b/packages/provider-core/src/server/driver.ts
@@ -6,7 +6,7 @@ import type {
   AcpRegistryOperationError,
   AcpRegistrySetProviderInput,
   ProviderDriverKind,
-  ProviderInstanceEnvironment,
+  ResolvedProviderInstanceEnvironment,
   ProviderInstanceId,
   ServerProvider,
   ServerProviderWorkspaceSnapshot,
@@ -96,7 +96,7 @@ export interface ProviderDriverCreateInput<Config> {
   readonly instanceId: ProviderInstanceId;
   readonly displayName: string | undefined;
   readonly accentColor?: string | undefined;
-  readonly environment: ProviderInstanceEnvironment;
+  readonly environment: ResolvedProviderInstanceEnvironment;
   readonly enabled: boolean;
   readonly config: Config;
 }
diff --git a/packages/provider-core/src/server/instanceEnvironment.test.ts b/packages/provider-core/src/server/instanceEnvironment.test.ts
index 1899d1f9d5c3f..7f70cdddad573 100644
--- a/packages/provider-core/src/server/instanceEnvironment.test.ts
+++ b/packages/provider-core/src/server/instanceEnvironment.test.ts
@@ -1,5 +1,6 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { describe, expect, it } from "@effect/vitest";
+import { SecretProviderId } from "@t3tools/contracts";
 import * as Effect from "effect/Effect";
 import * as Path from "effect/Path";
 import * as HostProcess from "@t3tools/shared/HostProcess";
@@ -61,12 +62,21 @@ describe("mergeProviderInstanceEnvironment", () => {
           [
             { name: "OPENROUTER_API_KEY", value: "sk-or-test", sensitive: true },
             { name: "ANTHROPIC_API_KEY", value: "", sensitive: false },
+            {
+              name: "OPENAI_API_KEY",
+              value: {
+                provider: SecretProviderId.make("personal"),
+                reference: "op://Private/OpenAI/credential",
+              },
+              sensitive: true,
+            },
           ],
-          { ANTHROPIC_API_KEY: "inherited", PATH: "/bin" },
+          { ANTHROPIC_API_KEY: "inherited", OPENAI_API_KEY: "inherited", PATH: "/bin" },
         ),
       ).toMatchObject({
         OPENROUTER_API_KEY: "sk-or-test",
         ANTHROPIC_API_KEY: "",
+        OPENAI_API_KEY: "inherited",
         PATH: "/bin",
       });
     }),
diff --git a/packages/provider-core/src/server/instanceEnvironment.ts b/packages/provider-core/src/server/instanceEnvironment.ts
index d0cddd119a13f..4a73f678da0c0 100644
--- a/packages/provider-core/src/server/instanceEnvironment.ts
+++ b/packages/provider-core/src/server/instanceEnvironment.ts
@@ -15,6 +15,8 @@ export const mergeProviderInstanceEnvironment = Effect.fn(function* (
   const home = yield* HostProcess.HomeDirectory;
   const next: NodeJS.ProcessEnv = { ...baseEnv };
   for (const variable of environment) {
+    // An unresolved secret reference carries no value; the registry resolves it for the provider.
+    if (typeof variable.value !== "string") continue;
     next[variable.name] =
       variable.name === "CODEX_HOME" || variable.name === "CLAUDE_CONFIG_DIR"
         ? expandHomePath(variable.value, home)
diff --git a/packages/secret-provider-core/package.json b/packages/secret-provider-core/package.json
new file mode 100644
index 0000000000000..3edea7a879b97
--- /dev/null
+++ b/packages/secret-provider-core/package.json
@@ -0,0 +1,33 @@
+{
+  "name": "@t3tools/secret-provider-core",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./shared/definition": {
+      "types": "./src/shared/definition.ts",
+      "import": "./src/shared/definition.ts"
+    },
+    "./server/driver": {
+      "types": "./src/server/driver.ts",
+      "import": "./src/server/driver.ts"
+    },
+    "./server/SecretResolver": {
+      "types": "./src/server/SecretResolver.ts",
+      "import": "./src/server/SecretResolver.ts"
+    }
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vp test run --config ../../vite.config.ts --dir ."
+  },
+  "dependencies": {
+    "@t3tools/contracts": "workspace:*",
+    "effect": "catalog:"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "catalog:",
+    "@effect/vitest": "catalog:",
+    "@types/node": "catalog:",
+    "vite-plus": "catalog:"
+  }
+}
diff --git a/packages/secret-provider-core/src/server/SecretResolver.test.ts b/packages/secret-provider-core/src/server/SecretResolver.test.ts
new file mode 100644
index 0000000000000..d3c44aa14eaf7
--- /dev/null
+++ b/packages/secret-provider-core/src/server/SecretResolver.test.ts
@@ -0,0 +1,170 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, describe, it } from "@effect/vitest";
+import {
+  SecretProviderId,
+  SecretProviderKind,
+  type SecretReference,
+  type ServerSettings,
+} from "@t3tools/contracts";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+
+import { defineSecretProviderDriver } from "./driver.ts";
+import * as SecretResolver from "./SecretResolver.ts";
+import { defineSecretProvider } from "../shared/definition.ts";
+
+const FAKE_KIND = SecretProviderKind.make("fake");
+const FakeConfig = Schema.Struct({ account: Schema.String });
+
+const personal = SecretProviderId.make("personal");
+const work = SecretProviderId.make("work");
+const fake = (account: string) => ({
+  kind: FAKE_KIND,
+  label: account,
+  config: { account },
+});
+const ref = (reference: string, provider = personal): SecretReference => ({ provider, reference });
+
+function fakeDriver(answer: (account: string, reference: string) => string | undefined) {
+  const reads: Array<{ readonly account: string; readonly references: ReadonlyArray<string> }> = [];
+  const driver = defineSecretProviderDriver({
+    kind: FAKE_KIND,
+    definition: defineSecretProvider({
+      kind: FAKE_KIND,
+      label: "Fake",
+      configSchema: FakeConfig,
+      isReference: (reference) => reference.startsWith("fake://"),
+      referencePlaceholder: "fake://item",
+      invalidReferenceMessage: "Use fake://item.",
+    }),
+    read: ({ account }, references) =>
+      Effect.sync(() => {
+        reads.push({ account, references });
+        return references.map((reference) => answer(account, reference));
+      }),
+  });
+  return { driver, reads };
+}
+
+const resolverLayer = (
+  driver: ReturnType<typeof fakeDriver>["driver"],
+  secretProviders: () => ServerSettings["secretProviders"] = () => ({ [personal]: fake("a") }),
+) =>
+  SecretResolver.layer({
+    drivers: [driver],
+    secretProviders: Effect.sync(secretProviders),
+  }).pipe(Layer.provide(NodeServices.layer));
+
+describe("SecretResolver", () => {
+  it.effect("reads a reference once and holds it", () => {
+    const { driver, reads } = fakeDriver(() => "sk-live");
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+      const token = ref("fake://openai");
+
+      assert.deepStrictEqual(yield* resolver.read([token]), ["sk-live"]);
+      assert.deepStrictEqual(yield* resolver.read([token]), ["sk-live"]);
+      assert.deepStrictEqual(reads, [{ account: "a", references: ["fake://openai"] }]);
+    }).pipe(Effect.provide(resolverLayer(driver)));
+  });
+
+  it.effect("holds a failed read until invalidated, then reads again", () => {
+    let locked = true;
+    const { driver, reads } = fakeDriver(() => (locked ? undefined : "sk-live"));
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+      const token = ref("fake://openai");
+
+      assert.deepStrictEqual(yield* resolver.read([token]), [undefined]);
+      locked = false;
+      assert.deepStrictEqual(yield* resolver.read([token]), [undefined]);
+      assert.strictEqual(reads.length, 1);
+
+      yield* resolver.invalidate([token]);
+      assert.deepStrictEqual(yield* resolver.read([token]), ["sk-live"]);
+      assert.strictEqual(reads.length, 2);
+    }).pipe(Effect.provide(resolverLayer(driver)));
+  });
+
+  it.effect("invalidates every reference when none are named", () => {
+    const { driver, reads } = fakeDriver(() => "sk-live");
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+      const token = ref("fake://openai");
+
+      yield* resolver.read([token]);
+      yield* resolver.invalidate();
+      yield* resolver.read([token]);
+      assert.strictEqual(reads.length, 2);
+    }).pipe(Effect.provide(resolverLayer(driver)));
+  });
+
+  it.effect("reads each distinct reference of a provider in one call, in input order", () => {
+    const { driver, reads } = fakeDriver((_, reference) => reference.toUpperCase());
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+
+      const values = yield* resolver.read([ref("fake://a"), ref("fake://b"), ref("fake://a")]);
+
+      assert.deepStrictEqual(values, ["FAKE://A", "FAKE://B", "FAKE://A"]);
+      assert.deepStrictEqual(reads, [{ account: "a", references: ["fake://a", "fake://b"] }]);
+    }).pipe(Effect.provide(resolverLayer(driver)));
+  });
+
+  it.effect("reads each provider separately", () => {
+    const { driver, reads } = fakeDriver((account, reference) => `${account}:${reference}`);
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+
+      const values = yield* resolver.read([ref("fake://a"), ref("fake://a", work)]);
+
+      assert.deepStrictEqual(values, ["a:fake://a", "b:fake://a"]);
+      assert.strictEqual(reads.length, 2);
+    }).pipe(
+      Effect.provide(resolverLayer(driver, () => ({ [personal]: fake("a"), [work]: fake("b") }))),
+    );
+  });
+
+  it.effect("reads again when the provider's config changes", () => {
+    let account = "a";
+    const { driver, reads } = fakeDriver((account, reference) => `${account}:${reference}`);
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+      const token = ref("fake://openai");
+
+      assert.deepStrictEqual(yield* resolver.read([token]), ["a:fake://openai"]);
+      account = "b";
+      assert.deepStrictEqual(yield* resolver.read([token]), ["b:fake://openai"]);
+      assert.deepStrictEqual(
+        reads.map((read) => read.account),
+        ["a", "b"],
+      );
+    }).pipe(Effect.provide(resolverLayer(driver, () => ({ [personal]: fake(account) }))));
+  });
+
+  it.effect("does not call a driver for what it cannot read, and reads it later", () => {
+    const { driver, reads } = fakeDriver(() => "sk-live");
+    const providers: ServerSettings["secretProviders"] = {
+      [personal]: fake("a"),
+      [SecretProviderId.make("vault")]: {
+        kind: SecretProviderKind.make("openbao"),
+        label: "Vault",
+      },
+      [SecretProviderId.make("broken")]: { kind: FAKE_KIND, label: "Broken", config: {} },
+    };
+    return Effect.gen(function* () {
+      const resolver = yield* SecretResolver.SecretResolver;
+
+      const values = yield* resolver.read([
+        ref("fake://openai", SecretProviderId.make("missing")),
+        ref("fake://openai", SecretProviderId.make("vault")),
+        ref("fake://openai", SecretProviderId.make("broken")),
+        ref("openai"),
+      ]);
+
+      assert.deepStrictEqual(values, [undefined, undefined, undefined, undefined]);
+      assert.strictEqual(reads.length, 0);
+    }).pipe(Effect.provide(resolverLayer(driver, () => providers)));
+  });
+});
diff --git a/packages/secret-provider-core/src/server/SecretResolver.ts b/packages/secret-provider-core/src/server/SecretResolver.ts
new file mode 100644
index 0000000000000..28f5816f953b9
--- /dev/null
+++ b/packages/secret-provider-core/src/server/SecretResolver.ts
@@ -0,0 +1,125 @@
+// Reads secrets that settings point at through a configured secret provider. Each read, including
+// a failed one, is held for the server's life so rebuilds never re-prompt an unlock; `invalidate`
+// (the Settings refresh) is the only way to read again.
+import type { SecretReference, ServerSettings } from "@t3tools/contracts";
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+
+import type { SecretProviderDriver, SecretProviderDriverServices } from "./driver.ts";
+
+export class SecretResolver extends Context.Service<
+  SecretResolver,
+  {
+    /** Values in input order; `undefined` marks a reference that could not be read. */
+    readonly read: (
+      references: ReadonlyArray<SecretReference>,
+    ) => Effect.Effect<ReadonlyArray<string | undefined>>;
+    /** Forgets the given references, or every reference, so the next read asks the provider again. */
+    readonly invalidate: (references?: ReadonlyArray<SecretReference>) => Effect.Effect<void>;
+  }
+>()("@t3tools/secret-provider-core/server/SecretResolver") {}
+
+const cacheKey = (reference: SecretReference) =>
+  `${reference.provider}\u0000${reference.reference}`;
+
+interface CachedSecret {
+  // A provider whose config changed, such as another account, reads again.
+  readonly config: string;
+  readonly value: string | undefined;
+}
+
+const decodeConfigWith = Schema.decodeUnknownOption<Schema.Codec<unknown, unknown>>;
+
+interface ReadablePlan {
+  readonly driver: SecretProviderDriver;
+  readonly config: unknown;
+  readonly configKey: string;
+}
+
+export const make = Effect.fn("SecretResolver.make")(function* (options: {
+  readonly drivers: ReadonlyArray<SecretProviderDriver>;
+  readonly secretProviders: Effect.Effect<ServerSettings["secretProviders"]>;
+}) {
+  const context = yield* Effect.context<SecretProviderDriverServices>();
+  const driversByKind = new Map(
+    options.drivers.map((driver) => [
+      driver.kind,
+      { driver, decodeConfig: decodeConfigWith(driver.definition.configSchema) },
+    ]),
+  );
+  const cache = new Map<string, CachedSecret>();
+  const semaphore = yield* Semaphore.make(1);
+
+  // Only a provider this build can read is cached; anything else fails fast and is checked again
+  // on the next read.
+  const planFor = (
+    providers: ServerSettings["secretProviders"],
+    reference: SecretReference,
+  ): ReadablePlan | undefined => {
+    const provider = providers[reference.provider];
+    const entry = provider === undefined ? undefined : driversByKind.get(provider.kind);
+    if (provider === undefined || entry === undefined) return undefined;
+    const { driver, decodeConfig } = entry;
+    if (!driver.definition.isReference(reference.reference)) return undefined;
+    const config = decodeConfig(provider.config);
+    return Option.isNone(config)
+      ? undefined
+      : { driver, config: config.value, configKey: JSON.stringify(config.value) };
+  };
+
+  const read: SecretResolver["Service"]["read"] = Effect.fn("SecretResolver.read")(
+    function* (references) {
+      const providers = yield* options.secretProviders;
+      const plans = references.map((reference) => planFor(providers, reference));
+
+      const wanted = new Map<
+        string,
+        { readonly plan: ReadablePlan; readonly byReference: Map<string, Array<SecretReference>> }
+      >();
+      references.forEach((reference, index) => {
+        const plan = plans[index];
+        if (plan === undefined || cache.get(cacheKey(reference))?.config === plan.configKey) return;
+        const group = wanted.get(reference.provider) ?? { plan, byReference: new Map() };
+        group.byReference.set(reference.reference, [
+          ...(group.byReference.get(reference.reference) ?? []),
+          reference,
+        ]);
+        wanted.set(reference.provider, group);
+      });
+      for (const { plan, byReference } of wanted.values()) {
+        const values = yield* plan.driver.read(plan.config, [...byReference.keys()]);
+        [...byReference.values()].forEach((sameReference, index) => {
+          for (const reference of sameReference) {
+            cache.set(cacheKey(reference), { config: plan.configKey, value: values[index] });
+          }
+        });
+      }
+
+      return references.map((reference, index) => {
+        const cached = cache.get(cacheKey(reference));
+        return plans[index] !== undefined && cached?.config === plans[index].configKey
+          ? cached.value
+          : undefined;
+      });
+    },
+    (effect) => semaphore.withPermits(1)(effect),
+    Effect.provideContext(context),
+  );
+
+  const invalidate: SecretResolver["Service"]["invalidate"] = (references) =>
+    semaphore.withPermits(1)(
+      Effect.sync(() => {
+        if (references === undefined) cache.clear();
+        else for (const reference of references) cache.delete(cacheKey(reference));
+      }),
+    );
+
+  return SecretResolver.of({ read, invalidate });
+});
+
+export const layer = (options: Parameters<typeof make>[0]) =>
+  Layer.effect(SecretResolver, make(options));
diff --git a/packages/secret-provider-core/src/server/driver.ts b/packages/secret-provider-core/src/server/driver.ts
new file mode 100644
index 0000000000000..85deb93d8938b
--- /dev/null
+++ b/packages/secret-provider-core/src/server/driver.ts
@@ -0,0 +1,46 @@
+import type { SecretProviderKind } from "@t3tools/contracts";
+import type * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import type * as FileSystem from "effect/FileSystem";
+import * as Schema from "effect/Schema";
+import type { ChildProcessSpawner } from "effect/process";
+
+import type { SecretProviderDefinition } from "../shared/definition.ts";
+
+/** What the server gives every driver. A driver builds anything else it needs itself. */
+export type SecretProviderDriverServices =
+  | ChildProcessSpawner.ChildProcessSpawner
+  | FileSystem.FileSystem
+  | Crypto.Crypto;
+
+export interface SecretProviderDriver {
+  readonly kind: SecretProviderKind;
+  readonly definition: SecretProviderDefinition;
+  /**
+   * Values in input order; `undefined` marks a reference that could not be read. `config` has
+   * decoded with the definition's `configSchema` and every reference passed its `isReference`.
+   */
+  readonly read: (
+    config: unknown,
+    references: ReadonlyArray<string>,
+  ) => Effect.Effect<ReadonlyArray<string | undefined>, never, SecretProviderDriverServices>;
+}
+
+export const defineSecretProviderDriver = <Config>(driver: {
+  readonly kind: SecretProviderKind;
+  readonly definition: SecretProviderDefinition<Config>;
+  readonly read: (
+    config: Config,
+    references: ReadonlyArray<string>,
+  ) => Effect.Effect<ReadonlyArray<string | undefined>, never, SecretProviderDriverServices>;
+}): SecretProviderDriver => {
+  const isConfig = Schema.is(driver.definition.configSchema);
+  return {
+    kind: driver.kind,
+    definition: driver.definition,
+    read: (config, references) =>
+      isConfig(config)
+        ? driver.read(config, references)
+        : Effect.succeed(references.map(() => undefined)),
+  };
+};
diff --git a/packages/secret-provider-core/src/shared/definition.ts b/packages/secret-provider-core/src/shared/definition.ts
new file mode 100644
index 0000000000000..7f4320dd0c3ea
--- /dev/null
+++ b/packages/secret-provider-core/src/shared/definition.ts
@@ -0,0 +1,35 @@
+import type { SecretProviderKind } from "@t3tools/contracts";
+import type * as Schema from "effect/Schema";
+
+/** What clients and the server both need to know about one kind of secret provider. */
+export interface SecretProviderDefinition<Config = unknown> {
+  readonly kind: SecretProviderKind;
+  readonly label: string;
+  readonly configSchema: Schema.Codec<Config, unknown>;
+  /** Whether `reference` is syntax this kind can read. */
+  readonly isReference: (reference: string) => boolean;
+  readonly referencePlaceholder: string;
+  readonly invalidReferenceMessage: string;
+}
+
+export const defineSecretProvider = <Config>(
+  definition: SecretProviderDefinition<Config>,
+): SecretProviderDefinition<Config> => definition;
+
+export interface SecretProviderDefinitionRegistry {
+  readonly definitions: ReadonlyArray<SecretProviderDefinition>;
+  readonly find: (kind: string) => SecretProviderDefinition | undefined;
+}
+
+export function makeSecretProviderDefinitionRegistry(
+  definitions: ReadonlyArray<SecretProviderDefinition>,
+): SecretProviderDefinitionRegistry {
+  const byKind = new Map<string, SecretProviderDefinition>();
+  for (const definition of definitions) {
+    if (byKind.has(definition.kind)) {
+      throw new Error(`Secret provider '${definition.kind}' is defined more than once.`);
+    }
+    byKind.set(definition.kind, definition);
+  }
+  return { definitions, find: (kind) => byKind.get(kind) };
+}
diff --git a/packages/secret-provider-core/tsconfig.json b/packages/secret-provider-core/tsconfig.json
new file mode 100644
index 0000000000000..374bac55202dd
--- /dev/null
+++ b/packages/secret-provider-core/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "types": ["node"]
+  },
+  "include": ["src"]
+}
diff --git a/packages/secret-provider-definitions/package.json b/packages/secret-provider-definitions/package.json
new file mode 100644
index 0000000000000..5e3592a276030
--- /dev/null
+++ b/packages/secret-provider-definitions/package.json
@@ -0,0 +1,18 @@
+{
+  "name": "@t3tools/secret-provider-definitions",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./registry": {
+      "types": "./src/registry.ts",
+      "import": "./src/registry.ts"
+    }
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@t3tools/secret-provider-core": "workspace:*",
+    "@t3tools/secret-provider-onepassword": "workspace:*"
+  }
+}
diff --git a/packages/secret-provider-definitions/src/registry.ts b/packages/secret-provider-definitions/src/registry.ts
new file mode 100644
index 0000000000000..70df74e113810
--- /dev/null
+++ b/packages/secret-provider-definitions/src/registry.ts
@@ -0,0 +1,6 @@
+import { makeSecretProviderDefinitionRegistry } from "@t3tools/secret-provider-core/shared/definition";
+import * as OnePassword from "@t3tools/secret-provider-onepassword/shared/definition";
+
+export const builtInSecretProviderDefinitions = makeSecretProviderDefinitionRegistry([
+  OnePassword.definition,
+]);
diff --git a/packages/secret-provider-definitions/tsconfig.json b/packages/secret-provider-definitions/tsconfig.json
new file mode 100644
index 0000000000000..564a5990051fd
--- /dev/null
+++ b/packages/secret-provider-definitions/tsconfig.json
@@ -0,0 +1,4 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "include": ["src"]
+}
diff --git a/packages/secret-provider-onepassword/package.json b/packages/secret-provider-onepassword/package.json
new file mode 100644
index 0000000000000..062495c90895f
--- /dev/null
+++ b/packages/secret-provider-onepassword/package.json
@@ -0,0 +1,32 @@
+{
+  "name": "@t3tools/secret-provider-onepassword",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./shared/definition": {
+      "types": "./src/shared/definition.ts",
+      "import": "./src/shared/definition.ts"
+    },
+    "./server/driver": {
+      "types": "./src/server/driver.ts",
+      "import": "./src/server/driver.ts"
+    }
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vp test run --config ../../vite.config.ts --dir ."
+  },
+  "dependencies": {
+    "@t3tools/contracts": "workspace:*",
+    "@t3tools/provider-core": "workspace:*",
+    "@t3tools/secret-provider-core": "workspace:*",
+    "@t3tools/shared": "workspace:*",
+    "effect": "catalog:"
+  },
+  "devDependencies": {
+    "@effect/platform-node": "catalog:",
+    "@effect/vitest": "catalog:",
+    "@types/node": "catalog:",
+    "vite-plus": "catalog:"
+  }
+}
diff --git a/packages/secret-provider-onepassword/src/server/driver.test.ts b/packages/secret-provider-onepassword/src/server/driver.test.ts
new file mode 100644
index 0000000000000..62675b1d0cbfb
--- /dev/null
+++ b/packages/secret-provider-onepassword/src/server/driver.test.ts
@@ -0,0 +1,155 @@
+// @effect-diagnostics nodeBuiltinImport:off -- the fake `op` reads the template the driver wrote.
+import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
+import * as NodeFileSystem from "@effect/platform-node/NodeFileSystem";
+import { assert, describe, it } from "@effect/vitest";
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as Layer from "effect/Layer";
+import * as Sink from "effect/Sink";
+import * as Stream from "effect/Stream";
+import * as TestClock from "effect/testing/TestClock";
+import { ChildProcessSpawner } from "effect/process";
+import * as NodeFS from "node:fs";
+
+import { OnePasswordAccount } from "../shared/definition.ts";
+import { driver } from "./driver.ts";
+
+const encoder = new TextEncoder();
+const account = OnePasswordAccount.make("my.1password.com");
+
+type OpResult = {
+  readonly stdout?: string;
+  readonly stderr?: string;
+  readonly code?: number;
+  readonly hang?: boolean;
+};
+
+function fakeOp(answer: (args: ReadonlyArray<string>) => OpResult) {
+  const invocations: Array<ReadonlyArray<string>> = [];
+  const spawned = Deferred.makeUnsafe<void>();
+  const layer = Layer.mergeAll(
+    Layer.succeed(
+      ChildProcessSpawner.ChildProcessSpawner,
+      ChildProcessSpawner.make((command) =>
+        Effect.sync(() => {
+          const { args } = command as unknown as { readonly args: ReadonlyArray<string> };
+          invocations.push(args);
+          Deferred.doneUnsafe(spawned, Effect.void);
+          const result = answer(args);
+          return ChildProcessSpawner.makeHandle({
+            pid: ChildProcessSpawner.ProcessId(1),
+            exitCode: result.hang
+              ? Effect.never
+              : Effect.succeed(ChildProcessSpawner.ExitCode(result.code ?? 0)),
+            isRunning: Effect.succeed(false),
+            kill: () => Effect.void,
+            unref: Effect.succeed(Effect.void),
+            stdin: Sink.drain,
+            stdout: Stream.make(encoder.encode(result.stdout ?? "")),
+            stderr: Stream.make(encoder.encode(result.stderr ?? "")),
+            all: Stream.empty,
+            getInputFd: () => Sink.drain,
+            getOutputFd: () => Stream.empty,
+          });
+        }),
+      ),
+    ),
+    NodeFileSystem.layer,
+    NodeCrypto.layer,
+  );
+  return { layer, invocations, spawned };
+}
+
+// Answers `op inject` by substituting each `{{ reference }}` in the template file it was handed.
+const injectFrom =
+  (secrets: Readonly<Record<string, string>>) =>
+  (args: ReadonlyArray<string>): OpResult => {
+    const template = NodeFS.readFileSync(args[args.indexOf("-i") + 1]!, "utf8");
+    return { stdout: template.replace(/\{\{ (\S+) \}\}/g, (_, reference) => secrets[reference]!) };
+  };
+
+describe("1Password driver", () => {
+  it.effect("reads one reference from the account", () => {
+    const op = fakeOp(() => ({ stdout: "sk-live" }));
+    return Effect.gen(function* () {
+      assert.deepStrictEqual(yield* driver.read({ account }, ["op://Private/OpenAI/credential"]), [
+        "sk-live",
+      ]);
+      assert.deepStrictEqual(op.invocations, [
+        [
+          "--cache=false",
+          "read",
+          "--account=my.1password.com",
+          "--no-newline",
+          "op://Private/OpenAI/credential",
+        ],
+      ]);
+    }).pipe(Effect.provide(op.layer));
+  });
+
+  it.effect("reads a failed reference as undefined", () => {
+    const op = fakeOp(() => ({ code: 1, stderr: "[ERROR] account is locked" }));
+    return Effect.gen(function* () {
+      assert.deepStrictEqual(yield* driver.read({ account }, ["op://Private/OpenAI/credential"]), [
+        undefined,
+      ]);
+    }).pipe(Effect.provide(op.layer));
+  });
+
+  it.effect("reads every reference in a single call", () => {
+    const op = fakeOp(
+      injectFrom({
+        "op://Private/OpenAI/credential": "sk-a",
+        "op://Private/Anthropic/key": " sk-b\n",
+      }),
+    );
+    return Effect.gen(function* () {
+      const values = yield* driver.read({ account }, [
+        "op://Private/OpenAI/credential",
+        "op://Private/Anthropic/key",
+      ]);
+
+      assert.deepStrictEqual(values, ["sk-a", " sk-b\n"]);
+      assert.strictEqual(op.invocations.length, 1);
+      assert.deepStrictEqual(op.invocations[0]?.slice(0, 3), [
+        "--cache=false",
+        "inject",
+        "--account=my.1password.com",
+      ]);
+    }).pipe(Effect.provide(op.layer));
+  });
+
+  it.effect("falls back to one read at a time when the batch fails", () => {
+    const op = fakeOp((args) =>
+      args.includes("inject")
+        ? { code: 1, stderr: '[ERROR] could not resolve "op://Private/Gone/key"' }
+        : args.at(-1) === "op://Private/Gone/key"
+          ? { code: 1, stderr: "[ERROR] item not found" }
+          : { stdout: "sk-a" },
+    );
+    return Effect.gen(function* () {
+      const values = yield* driver.read({ account }, [
+        "op://Private/OpenAI/credential",
+        "op://Private/Gone/key",
+      ]);
+
+      assert.deepStrictEqual(values, ["sk-a", undefined]);
+      assert.strictEqual(op.invocations.length, 3);
+    }).pipe(Effect.provide(op.layer));
+  });
+
+  it.effect("does not read one at a time after the batch times out", () => {
+    const op = fakeOp(() => ({ hang: true }));
+    return Effect.gen(function* () {
+      const reading = yield* driver
+        .read({ account }, ["op://Private/OpenAI/credential", "op://Private/Anthropic/key"])
+        .pipe(Effect.forkChild);
+      yield* Deferred.await(op.spawned);
+      yield* TestClock.adjust("1 minute");
+
+      assert.deepStrictEqual(yield* Fiber.join(reading), [undefined, undefined]);
+      assert.strictEqual(op.invocations.length, 1);
+    }).pipe(Effect.provide(op.layer));
+  });
+});
diff --git a/packages/secret-provider-onepassword/src/server/driver.ts b/packages/secret-provider-onepassword/src/server/driver.ts
new file mode 100644
index 0000000000000..abf9d6da5ed88
--- /dev/null
+++ b/packages/secret-provider-onepassword/src/server/driver.ts
@@ -0,0 +1,112 @@
+import { spawnAndCollect } from "@t3tools/provider-core/server/snapshotProbe";
+import { defineSecretProviderDriver } from "@t3tools/secret-provider-core/server/driver";
+import { resolveSpawnCommand } from "@t3tools/shared/shell";
+import * as Crypto from "effect/Crypto";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import { ChildProcess } from "effect/process";
+
+import { definition, type OnePasswordAccount } from "../shared/definition.ts";
+
+const ONE_PASSWORD_BINARY = "op";
+// Bounds a read long enough to reach for a fingerprint reader, short enough not to wedge a rebuild.
+const READ_TIMEOUT = Duration.seconds(45);
+
+// `--cache=false` skips the `op daemon`, which hangs on prompts a background server cannot show.
+const runOnePassword = Effect.fn("OnePasswordDriver.runOnePassword")(function* (
+  args: ReadonlyArray<string>,
+) {
+  const spawnCommand = yield* resolveSpawnCommand(ONE_PASSWORD_BINARY, ["--cache=false", ...args]);
+  return yield* spawnAndCollect(
+    ONE_PASSWORD_BINARY,
+    ChildProcess.make(spawnCommand.command, spawnCommand.args, { shell: spawnCommand.shell }),
+  );
+});
+
+// A secret is passed on verbatim; surrounding whitespace can be part of it.
+const nonEmpty = (value: string) => (value.trim().length > 0 ? value : undefined);
+
+const readOne = Effect.fn("OnePasswordDriver.readOne")(function* (
+  account: OnePasswordAccount,
+  reference: string,
+) {
+  const result = yield* runOnePassword(["read", `--account=${account}`, "--no-newline", reference]);
+  if (result.code !== 0) {
+    yield* Effect.logWarning("Could not read secret from 1Password", {
+      stage: "read",
+      exitCode: result.code,
+    });
+    return undefined;
+  }
+  return nonEmpty(result.stdout);
+});
+
+// One `op inject` costs one unlock for every reference in the template. `op` ignores piped stdin
+// from Node, so the template goes through a temp file. A random separator after every reference
+// keeps one secret from shifting the others, and leaves any trailing newline outside the values.
+const readTogether = Effect.fn("OnePasswordDriver.readTogether")(function* (
+  account: OnePasswordAccount,
+  references: ReadonlyArray<string>,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const separator = `__t3-secret-${yield* (yield* Crypto.Crypto).randomUUIDv4()}__`;
+  const templatePath = yield* fileSystem.makeTempFileScoped({ prefix: "t3code-op-inject-" });
+  yield* fileSystem.writeFileString(
+    templatePath,
+    references.map((reference) => `{{ ${reference} }}${separator}`).join(""),
+  );
+  const result = yield* runOnePassword(["inject", `--account=${account}`, "-i", templatePath]);
+  const values = result.stdout.split(separator);
+  const trailing = values.pop();
+  if (
+    result.code !== 0 ||
+    values.length !== references.length ||
+    trailing === undefined ||
+    trailing.trim().length > 0
+  ) {
+    yield* Effect.logWarning("Could not batch-read secrets from 1Password", {
+      stage: "inject",
+      exitCode: result.code,
+      references: references.length,
+    });
+    return undefined;
+  }
+  return values.map(nonEmpty);
+}, Effect.scoped);
+
+/** `None` when 1Password did not answer in time; a failed run reads as `Some(undefined)`. */
+const bounded = <A, E extends { readonly _tag: string }, R>(
+  stage: "read" | "inject",
+  effect: Effect.Effect<A | undefined, E, R>,
+) =>
+  effect.pipe(
+    Effect.timeoutOption(READ_TIMEOUT),
+    Effect.tap((outcome) =>
+      Option.isNone(outcome)
+        ? Effect.logWarning("1Password did not answer in time", { stage })
+        : Effect.void,
+    ),
+    Effect.catch((error) =>
+      Effect.logWarning("Could not run 1Password", { stage, error: error._tag }).pipe(
+        Effect.as(Option.some(undefined)),
+      ),
+    ),
+  );
+
+export const driver = defineSecretProviderDriver({
+  kind: definition.kind,
+  definition,
+  read: Effect.fn("OnePasswordDriver.read")(function* ({ account }, references) {
+    if (references.length > 1) {
+      const together = yield* bounded("inject", readTogether(account, references));
+      // Reading one by one after a timeout would only wait that long again for each reference.
+      if (Option.isNone(together)) return references.map(() => undefined);
+      if (together.value !== undefined) return together.value;
+    }
+    return yield* Effect.forEach(references, (reference) =>
+      bounded("read", readOne(account, reference)).pipe(Effect.map(Option.getOrUndefined)),
+    );
+  }),
+});
diff --git a/packages/secret-provider-onepassword/src/shared/definition.test.ts b/packages/secret-provider-onepassword/src/shared/definition.test.ts
new file mode 100644
index 0000000000000..0daefcf6acca1
--- /dev/null
+++ b/packages/secret-provider-onepassword/src/shared/definition.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "@effect/vitest";
+
+import { definition } from "./definition.ts";
+
+describe("1Password definition", () => {
+  it("accepts vault, item, optional section, and field references", () => {
+    for (const reference of [
+      "op://Private/OpenAI/credential",
+      "op://Private/OpenAI/Section 1/credential",
+      "op://Private/OpenAI/credential?attribute=otp",
+    ]) {
+      expect(definition.isReference(reference), reference).toBe(true);
+    }
+  });
+
+  it("rejects anything that is not a plain reference", () => {
+    for (const reference of [
+      "--help",
+      "Private/OpenAI/credential",
+      "op://Private/OpenAI",
+      "op://Private/OpenAI/credential }} {{ op://Private/B/c",
+      "op://Private/OpenAI\n/credential",
+      `op://Private/OpenAI/${"x".repeat(1024)}`,
+    ]) {
+      expect(definition.isReference(reference), reference).toBe(false);
+    }
+  });
+});
diff --git a/packages/secret-provider-onepassword/src/shared/definition.ts b/packages/secret-provider-onepassword/src/shared/definition.ts
new file mode 100644
index 0000000000000..ff5164b1e00b2
--- /dev/null
+++ b/packages/secret-provider-onepassword/src/shared/definition.ts
@@ -0,0 +1,41 @@
+import { SecretProviderKind } from "@t3tools/contracts";
+import { defineSecretProvider } from "@t3tools/secret-provider-core/shared/definition";
+import * as Schema from "effect/Schema";
+
+const ACCOUNT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+/**
+ * Any value `op --account` accepts: shorthand, sign-in address, account ID, or user ID.
+ * It is passed to the CLI as an argument, so it can never start with `-`.
+ */
+export const OnePasswordAccount = Schema.String.check(
+  Schema.isMaxLength(253),
+  Schema.makeFilter((value: string) =>
+    ACCOUNT_PATTERN.test(value)
+      ? true
+      : "1Password account must be a shorthand, sign-in address, or ID with no spaces.",
+  ),
+).pipe(Schema.brand("OnePasswordAccount"));
+export type OnePasswordAccount = typeof OnePasswordAccount.Type;
+
+export const OnePasswordSecretProviderConfig = Schema.Struct({
+  account: OnePasswordAccount,
+});
+export type OnePasswordSecretProviderConfig = typeof OnePasswordSecretProviderConfig.Type;
+
+// 1Password secret reference syntax: names outside this charset must be written as item ids.
+// It also keeps `{{`, `}}`, and line breaks out of the `op inject` template the server builds.
+const NAME = String.raw`[A-Za-z0-9._-](?:[A-Za-z0-9 ._-]*[A-Za-z0-9._-])?`;
+const REFERENCE = new RegExp(
+  String.raw`^op://${NAME}(?:/${NAME}){2,3}(?:\?[a-z-]+=[A-Za-z0-9_-]+)?$`,
+);
+const MAX_REFERENCE_LENGTH = 1024;
+
+export const definition = defineSecretProvider({
+  kind: SecretProviderKind.make("one_password"),
+  label: "1Password",
+  configSchema: OnePasswordSecretProviderConfig,
+  isReference: (reference) => reference.length <= MAX_REFERENCE_LENGTH && REFERENCE.test(reference),
+  referencePlaceholder: "op://vault/item/field",
+  invalidReferenceMessage: "Use a 1Password reference like op://vault/item/field.",
+});
diff --git a/packages/secret-provider-onepassword/tsconfig.json b/packages/secret-provider-onepassword/tsconfig.json
new file mode 100644
index 0000000000000..374bac55202dd
--- /dev/null
+++ b/packages/secret-provider-onepassword/tsconfig.json
@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "types": ["node"]
+  },
+  "include": ["src"]
+}
diff --git a/packages/shared/src/serverSettings.test.ts b/packages/shared/src/serverSettings.test.ts
index 5a02f302826de..26cbfb3df9d59 100644
--- a/packages/shared/src/serverSettings.test.ts
+++ b/packages/shared/src/serverSettings.test.ts
@@ -1,6 +1,5 @@
 import {
   DEFAULT_SERVER_SETTINGS,
-  OnePasswordAccount,
   ProjectId,
   ProviderDriverKind,
   ProviderInstanceId,
@@ -590,7 +589,7 @@ describe("serverSettings helpers", () => {
     const onePassword = (label: string, account: string) => ({
       kind: SecretProviderKind.make("one_password"),
       label,
-      config: { account: OnePasswordAccount.make(account) },
+      config: { account },
     });
     const current = {
       ...DEFAULT_SERVER_SETTINGS,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 196781c388b03..381ff78688eb0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -955,6 +955,15 @@ importers:
       '@t3tools/provider-testing':
         specifier: workspace:*
         version: link:../../packages/provider-testing
+      '@t3tools/secret-provider-core':
+        specifier: workspace:*
+        version: link:../../packages/secret-provider-core
+      '@t3tools/secret-provider-definitions':
+        specifier: workspace:*
+        version: link:../../packages/secret-provider-definitions
+      '@t3tools/secret-provider-onepassword':
+        specifier: workspace:*
+        version: link:../../packages/secret-provider-onepassword
       '@t3tools/shared':
         specifier: workspace:*
         version: link:../../packages/shared
@@ -1060,6 +1069,12 @@ importers:
       '@t3tools/provider-core':
         specifier: workspace:*
         version: link:../../packages/provider-core
+      '@t3tools/secret-provider-definitions':
+        specifier: workspace:*
+        version: link:../../packages/secret-provider-definitions
+      '@t3tools/secret-provider-onepassword':
+        specifier: workspace:*
+        version: link:../../packages/secret-provider-onepassword
       '@t3tools/shared':
         specifier: workspace:*
         version: link:../../packages/shared
@@ -1890,6 +1905,68 @@ importers:
         specifier: 24.12.4
         version: 24.12.4
 
+  packages/secret-provider-core:
+    dependencies:
+      '@t3tools/contracts':
+        specifier: workspace:*
+        version: link:../contracts
+      effect:
+        specifier: 4.0.5
+        version: 4.0.5
+    devDependencies:
+      '@effect/platform-node':
+        specifier: 4.0.5
+        version: 4.0.5(bufferutil@4.1.0)(effect@4.0.5)(redis@6.2.1)(utf-8-validate@6.0.6)
+      '@effect/vitest':
+        specifier: 4.0.5
+        version: 4.0.5(patch_hash=2731c9c3761c595f25ddc625a7d61ca376b389d5b3049ecb837c8940f21cfa02)(@astrojs/compiler-rs@0.5.1)(@tsc-rs/typescript@0.8.0)(@types/node@24.12.4)(@vitest/browser-playwright@5.0.5)(@vitest/ui@5.0.5)(@volar/typescript@2.4.28(@tsc-rs/typescript@0.8.0))(bufferutil@4.1.0)(effect@4.0.5)(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(playwright@1.60.0)(terser@5.48.0)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
+      '@types/node':
+        specifier: 24.12.4
+        version: 24.12.4
+      vite-plus:
+        specifier: 1.4.0
+        version: 1.4.0(@astrojs/compiler-rs@0.5.1)(@tsc-rs/typescript@0.8.0)(@types/node@24.12.4)(@vitest/browser-playwright@5.0.5)(@vitest/ui@5.0.5)(@volar/typescript@2.4.28(@tsc-rs/typescript@0.8.0))(bufferutil@4.1.0)(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(playwright@1.60.0)(terser@5.48.0)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
+
+  packages/secret-provider-definitions:
+    dependencies:
+      '@t3tools/secret-provider-core':
+        specifier: workspace:*
+        version: link:../secret-provider-core
+      '@t3tools/secret-provider-onepassword':
+        specifier: workspace:*
+        version: link:../secret-provider-onepassword
+
+  packages/secret-provider-onepassword:
+    dependencies:
+      '@t3tools/contracts':
+        specifier: workspace:*
+        version: link:../contracts
+      '@t3tools/provider-core':
+        specifier: workspace:*
+        version: link:../provider-core
+      '@t3tools/secret-provider-core':
+        specifier: workspace:*
+        version: link:../secret-provider-core
+      '@t3tools/shared':
+        specifier: workspace:*
+        version: link:../shared
+      effect:
+        specifier: 4.0.5
+        version: 4.0.5
+    devDependencies:
+      '@effect/platform-node':
+        specifier: 4.0.5
+        version: 4.0.5(bufferutil@4.1.0)(effect@4.0.5)(redis@6.2.1)(utf-8-validate@6.0.6)
+      '@effect/vitest':
+        specifier: 4.0.5
+        version: 4.0.5(patch_hash=2731c9c3761c595f25ddc625a7d61ca376b389d5b3049ecb837c8940f21cfa02)(@astrojs/compiler-rs@0.5.1)(@tsc-rs/typescript@0.8.0)(@types/node@24.12.4)(@vitest/browser-playwright@5.0.5)(@vitest/ui@5.0.5)(@volar/typescript@2.4.28(@tsc-rs/typescript@0.8.0))(bufferutil@4.1.0)(effect@4.0.5)(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(playwright@1.60.0)(terser@5.48.0)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
+      '@types/node':
+        specifier: 24.12.4
+        version: 24.12.4
+      vite-plus:
+        specifier: 1.4.0
+        version: 1.4.0(@astrojs/compiler-rs@0.5.1)(@tsc-rs/typescript@0.8.0)(@types/node@24.12.4)(@vitest/browser-playwright@5.0.5)(@vitest/ui@5.0.5)(@volar/typescript@2.4.28(@tsc-rs/typescript@0.8.0))(bufferutil@4.1.0)(esbuild@0.28.2)(jiti@2.7.0)(jsdom@30.1.0(@noble/hashes@1.8.0))(playwright@1.60.0)(terser@5.48.0)(unrun@0.2.39)(utf-8-validate@6.0.6)(yaml@2.9.0)
+
   packages/shared:
     dependencies:
       '@noble/curves':
diff --git a/scripts/release-smoke.ts b/scripts/release-smoke.ts
index 12ef21824014d..8f300533523ae 100644
--- a/scripts/release-smoke.ts
+++ b/scripts/release-smoke.ts
@@ -39,6 +39,9 @@ const workspaceFiles = [
   "packages/provider-grok/package.json",
   "packages/provider-muse/package.json",
   "packages/provider-opencode/package.json",
+  "packages/secret-provider-core/package.json",
+  "packages/secret-provider-definitions/package.json",
+  "packages/secret-provider-onepassword/package.json",
   "packages/source-control-azure-devops/package.json",
   "packages/source-control-bitbucket/package.json",
   "packages/source-control-core/package.json",

From 476590d0adede15a4eec0d05b8adac8c63736452 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 00:50:23 -0700
Subject: [PATCH 139/146] feat(desktop): back/forward buttons and trackpad
 swipe navigation (#27430)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/desktop/src/ipc/channels.ts              |   1 +
 apps/desktop/src/preload.ts                   |   5 +
 apps/desktop/src/window/DesktopWindow.ts      |   7 +-
 apps/web/src/components/AppSidebarLayout.tsx  |   4 +-
 .../components/HistorySwipeNavigation.test.ts |  15 ++
 .../src/components/HistorySwipeNavigation.tsx | 189 ++++++++++++++++++
 .../src/components/sidebar/SidebarChrome.tsx  |  68 ++++++-
 apps/web/src/navigationHistory.ts             |  22 ++
 packages/contracts/src/ipc.ts                 |   1 +
 9 files changed, 307 insertions(+), 5 deletions(-)
 create mode 100644 apps/web/src/components/HistorySwipeNavigation.test.ts
 create mode 100644 apps/web/src/components/HistorySwipeNavigation.tsx
 create mode 100644 apps/web/src/navigationHistory.ts

diff --git a/apps/desktop/src/ipc/channels.ts b/apps/desktop/src/ipc/channels.ts
index bba4f6449b8c1..538dd06b0b42a 100644
--- a/apps/desktop/src/ipc/channels.ts
+++ b/apps/desktop/src/ipc/channels.ts
@@ -14,6 +14,7 @@ export const SNAP_SHOT_EVENT_CHANNEL = "desktop:snap-shot-event";
 export const WEB_LINK_OPEN_CHANNEL = "desktop:web-link-open";
 export const WEB_LINK_READY_CHANNEL = "desktop:web-link-ready";
 export const QUIT_SHORTCUT_CHANNEL = "desktop:quit-shortcut";
+export const TRACKPAD_SCROLL_BEGIN_CHANNEL = "desktop:trackpad-scroll-begin";
 export const TRACKPAD_SCROLL_END_CHANNEL = "desktop:trackpad-scroll-end";
 export const GET_WINDOW_FULLSCREEN_STATE_CHANNEL = "desktop:get-window-fullscreen-state";
 export const WINDOW_FULLSCREEN_STATE_CHANNEL = "desktop:window-fullscreen-state";
diff --git a/apps/desktop/src/preload.ts b/apps/desktop/src/preload.ts
index 965b7db5d6d40..950ed972c6453 100644
--- a/apps/desktop/src/preload.ts
+++ b/apps/desktop/src/preload.ts
@@ -91,6 +91,11 @@ contextBridge.exposeInMainWorld("desktopBridge", {
     ipcRenderer.on(IpcChannels.SET_NOTIFICATION_BADGE_CHANNEL, handler);
     return () => ipcRenderer.removeListener(IpcChannels.SET_NOTIFICATION_BADGE_CHANNEL, handler);
   },
+  onTrackpadScrollBegin: (listener) => {
+    const handler = () => listener();
+    ipcRenderer.on(IpcChannels.TRACKPAD_SCROLL_BEGIN_CHANNEL, handler);
+    return () => ipcRenderer.removeListener(IpcChannels.TRACKPAD_SCROLL_BEGIN_CHANNEL, handler);
+  },
   onTrackpadScrollEnd: (listener) => {
     const handler = () => listener();
     ipcRenderer.on(IpcChannels.TRACKPAD_SCROLL_END_CHANNEL, handler);
diff --git a/apps/desktop/src/window/DesktopWindow.ts b/apps/desktop/src/window/DesktopWindow.ts
index ab5fc8be26a92..c1c0cf5446cd2 100644
--- a/apps/desktop/src/window/DesktopWindow.ts
+++ b/apps/desktop/src/window/DesktopWindow.ts
@@ -23,6 +23,7 @@ import {
   MENU_ACTION_CHANNEL,
   QUIT_SHORTCUT_CHANNEL,
   SNAP_SHOT_EVENT_CHANNEL,
+  TRACKPAD_SCROLL_BEGIN_CHANNEL,
   TRACKPAD_SCROLL_END_CHANNEL,
   WINDOW_FULLSCREEN_STATE_CHANNEL,
 } from "../ipc/channels.ts";
@@ -652,7 +653,11 @@ export const make = Effect.gen(function* () {
       }
     });
     window.webContents.on("input-event", (_event, input) => {
-      if (input.type === "gestureScrollEnd") window.webContents.send(TRACKPAD_SCROLL_END_CHANNEL);
+      if (input.type === "gestureScrollBegin") {
+        window.webContents.send(TRACKPAD_SCROLL_BEGIN_CHANNEL);
+      } else if (input.type === "gestureScrollEnd") {
+        window.webContents.send(TRACKPAD_SCROLL_END_CHANNEL);
+      }
     });
     // Ctrl+wheel bypasses menus; guest contents emit their own zoom-changed event.
     window.webContents.on("zoom-changed", (_event, direction) => {
diff --git a/apps/web/src/components/AppSidebarLayout.tsx b/apps/web/src/components/AppSidebarLayout.tsx
index 6c8837e63f40a..91df5616f7f50 100644
--- a/apps/web/src/components/AppSidebarLayout.tsx
+++ b/apps/web/src/components/AppSidebarLayout.tsx
@@ -38,6 +38,7 @@ import {
   usePanelNavigationSuppression,
 } from "../panelAnimations";
 import { BackgroundThreadAnnouncer } from "./BackgroundThreadAnnouncer";
+import { HistorySwipeNavigation } from "./HistorySwipeNavigation";
 import ThreadSidebar from "./Sidebar";
 import { SidebarBrandWidthProbe } from "./sidebar/SidebarChrome";
 import { isAppModalPage } from "./sidebar/mainAppLocation";
@@ -449,7 +450,7 @@ export function AppSidebarLayout({ children }: { children: ReactNode }) {
         defaultOpen
         style={sidebarProviderStyle}
       >
-        <SidebarBrandWidthProbe onWidthChange={setBrandWidth} />
+        <SidebarBrandWidthProbe isElectron={isElectron} onWidthChange={setBrandWidth} />
         <Sidebar
           side="left"
           collapsible="offcanvas"
@@ -474,6 +475,7 @@ export function AppSidebarLayout({ children }: { children: ReactNode }) {
         {children}
         <BackgroundThreadAnnouncer />
         <SidebarControl />
+        {isElectron ? <HistorySwipeNavigation /> : null}
       </SidebarProvider>
     </PanelAnimationSuppressionProvider>
   );
diff --git a/apps/web/src/components/HistorySwipeNavigation.test.ts b/apps/web/src/components/HistorySwipeNavigation.test.ts
new file mode 100644
index 0000000000000..9eef35f0dc61e
--- /dev/null
+++ b/apps/web/src/components/HistorySwipeNavigation.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { isMomentumTail } from "./HistorySwipeNavigation";
+
+describe("isMomentumTail", () => {
+  it.each([
+    ["steady momentum decay", [40, 37, 34, 31.3, 28.8], true],
+    ["fingers still moving", [12, 18, 9, 15, 11], false],
+    ["fingers slowing unevenly", [30, 22, 20, 12, 11], false],
+    ["reversing", [10, 8, 6, 4, -2], false],
+    ["too few samples", [40, 37, 34], false],
+  ])("%s", (_name, deltas, expected) => {
+    expect(isMomentumTail(deltas)).toBe(expected);
+  });
+});
diff --git a/apps/web/src/components/HistorySwipeNavigation.tsx b/apps/web/src/components/HistorySwipeNavigation.tsx
new file mode 100644
index 0000000000000..c020878b25363
--- /dev/null
+++ b/apps/web/src/components/HistorySwipeNavigation.tsx
@@ -0,0 +1,189 @@
+import { ArrowLeftIcon, ArrowRightIcon } from "lucide-react";
+import { useEffect, useState } from "react";
+
+import { cn } from "../lib/utils";
+import { canNavigateHistory, navigateHistory, type HistoryDirection } from "../navigationHistory";
+
+const SWIPE_TRIGGER_DISTANCE = 120;
+// Movement needed before the gesture picks an axis; first events are often diagonal.
+const SWIPE_AXIS_LOCK_DISTANCE = 8;
+const MOMENTUM_SAMPLE_SIZE = 5;
+
+type SwipeBounds = { left: number; top: number; width: number; height: number };
+type SwipeGesture =
+  | { kind: "pending"; target: EventTarget | null; y: number; sumX: number; sumY: number }
+  | {
+      kind: "tracking";
+      direction: HistoryDirection;
+      distance: number;
+      deltas: number[];
+      y: number;
+      bounds: SwipeBounds;
+    }
+  // Not a swipe, or one already decided: the rest of its events are ignored.
+  | { kind: "ignored" };
+type SwipeIndicatorState = {
+  direction: HistoryDirection;
+  progress: number;
+  y: number;
+  bounds: SwipeBounds;
+  tracking: boolean;
+};
+
+function readMainContentBounds(): SwipeBounds {
+  const main = document.querySelector('[data-slot="sidebar-inset"]');
+  if (!main) return { left: 0, top: 0, width: window.innerWidth, height: window.innerHeight };
+  const { left, top, width, height } = main.getBoundingClientRect();
+  return { left, top, width, height };
+}
+
+function canScrollHorizontally(target: EventTarget | null, deltaX: number): boolean {
+  for (
+    let element = target instanceof Element ? target : null;
+    element;
+    element = element.parentElement
+  ) {
+    if (element.scrollWidth <= element.clientWidth) continue;
+    const { overflowX } = getComputedStyle(element);
+    if (overflowX !== "auto" && overflowX !== "scroll") continue;
+    const canScroll =
+      deltaX < 0
+        ? element.scrollLeft > 0
+        : element.scrollLeft + element.clientWidth < element.scrollWidth - 1;
+    if (canScroll) return true;
+  }
+  return false;
+}
+
+function lockSwipeAxis(
+  pending: Extract<SwipeGesture, { kind: "pending" }>,
+): Exclude<SwipeGesture, { kind: "pending" }> {
+  const { target, sumX, sumY } = pending;
+  if (Math.abs(sumX) <= Math.abs(sumY)) return { kind: "ignored" };
+  if (target instanceof Element && target.closest('[role="dialog"]')) return { kind: "ignored" };
+  if (canScrollHorizontally(target, sumX)) return { kind: "ignored" };
+  const direction = sumX < 0 ? "back" : "forward";
+  if (!canNavigateHistory(direction)) return { kind: "ignored" };
+  return {
+    kind: "tracking",
+    direction,
+    distance: Math.abs(sumX),
+    deltas: [],
+    y: pending.y,
+    bounds: readMainContentBounds(),
+  };
+}
+
+/**
+ * macOS momentum after the fingers lift decays by a near-constant ratio per
+ * event; finger movement is noisier. Deltas are signed along the swipe.
+ */
+export function isMomentumTail(deltas: readonly number[]): boolean {
+  if (deltas.length < MOMENTUM_SAMPLE_SIZE) return false;
+  const recent = deltas.slice(-MOMENTUM_SAMPLE_SIZE);
+  if (recent.some((delta) => delta <= 0)) return false;
+  const ratios = recent.slice(1).map((delta, index) => delta / recent[index]!);
+  return (
+    ratios.every((ratio) => ratio >= 0.7 && ratio < 1) &&
+    Math.max(...ratios) - Math.min(...ratios) < 0.1
+  );
+}
+
+/** Two-finger horizontal trackpad swipes go back and forward, like a browser. */
+export function HistorySwipeNavigation() {
+  const [swipe, setSwipe] = useState<SwipeIndicatorState | null>(null);
+
+  // oxlint-disable-next-line t3code/no-unreasoned-state-sync -- window wheel and desktop gesture listeners track trackpad swipes
+  useEffect(() => {
+    let gesture: SwipeGesture | null = null;
+    const hideIndicator = () =>
+      setSwipe((current) => (current === null ? null : { ...current, tracking: false }));
+    // The fingers lifted: navigate if the swipe went far enough, then ignore its momentum.
+    const release = () => {
+      if (gesture?.kind === "tracking" && gesture.distance >= SWIPE_TRIGGER_DISTANCE) {
+        navigateHistory(gesture.direction);
+      }
+      gesture = { kind: "ignored" };
+      hideIndicator();
+    };
+    // Chromium brackets each trackpad scroll, momentum included, with these.
+    const unsubscribeScrollBegin = window.desktopBridge?.onTrackpadScrollBegin(() => {
+      if (gesture?.kind === "ignored") gesture = null;
+    });
+    const unsubscribeScrollEnd = window.desktopBridge?.onTrackpadScrollEnd(() => {
+      if (gesture?.kind === "tracking") release();
+      gesture = null;
+    });
+    const onWheel = (event: WheelEvent) => {
+      if (gesture === null) {
+        gesture =
+          event.ctrlKey || event.deltaMode !== WheelEvent.DOM_DELTA_PIXEL
+            ? { kind: "ignored" }
+            : { kind: "pending", target: event.target, y: event.clientY, sumX: 0, sumY: 0 };
+      }
+      if (gesture.kind === "ignored") return;
+      if (gesture.kind === "pending") {
+        gesture.sumX += event.deltaX;
+        gesture.sumY += event.deltaY;
+        if (Math.abs(gesture.sumX) + Math.abs(gesture.sumY) < SWIPE_AXIS_LOCK_DISTANCE) return;
+        gesture = lockSwipeAxis(gesture);
+        if (gesture.kind === "ignored") return;
+      } else {
+        const delta = gesture.direction === "back" ? -event.deltaX : event.deltaX;
+        if (event.deltaX === 0 && event.deltaY === 0) return release();
+        gesture.deltas = [...gesture.deltas.slice(1 - MOMENTUM_SAMPLE_SIZE), delta];
+        if (isMomentumTail(gesture.deltas)) return release();
+        gesture.distance = Math.max(0, gesture.distance + delta);
+      }
+      setSwipe({
+        direction: gesture.direction,
+        progress: Math.min(1, gesture.distance / SWIPE_TRIGGER_DISTANCE),
+        y: gesture.y,
+        bounds: gesture.bounds,
+        tracking: true,
+      });
+    };
+    window.addEventListener("wheel", onWheel, { capture: true, passive: true });
+    return () => {
+      unsubscribeScrollBegin?.();
+      unsubscribeScrollEnd?.();
+      window.removeEventListener("wheel", onWheel, { capture: true });
+    };
+  }, []);
+
+  return swipe === null ? null : <SwipeIndicator {...swipe} />;
+}
+
+// A circle pinned to the edge of the main content that peeks in up to half its width.
+function SwipeIndicator({ direction, progress, y, bounds, tracking }: SwipeIndicatorState) {
+  const armed = progress >= 1;
+  const Icon = direction === "back" ? ArrowLeftIcon : ArrowRightIcon;
+  const hidden = 100 - progress * 50;
+  return (
+    <div
+      aria-hidden="true"
+      className="pointer-events-none fixed z-100 overflow-hidden"
+      style={bounds}
+    >
+      <div
+        className={cn(
+          "absolute flex size-14 items-center rounded-full bg-muted text-foreground dark:bg-black dark:text-white",
+          direction === "back" ? "left-0 justify-end pr-2" : "right-0 justify-start pl-2",
+          !tracking && "transition-[opacity,transform] duration-200 ease-out",
+        )}
+        style={{
+          top: `clamp(0px, calc(${y - bounds.top}px - 1.75rem), calc(100% - 3.5rem))`,
+          opacity: tracking ? 1 : 0,
+          transform: `translateX(${direction === "back" ? -hidden : hidden}%)`,
+        }}
+      >
+        <Icon
+          className={cn(
+            "size-4 transition-opacity duration-100",
+            armed ? "opacity-100" : "opacity-40",
+          )}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/apps/web/src/components/sidebar/SidebarChrome.tsx b/apps/web/src/components/sidebar/SidebarChrome.tsx
index b136d47fd9c40..dd41ddd2a0213 100644
--- a/apps/web/src/components/sidebar/SidebarChrome.tsx
+++ b/apps/web/src/components/sidebar/SidebarChrome.tsx
@@ -1,9 +1,17 @@
-import { ArrowLeftIcon, ChartNoAxesColumnIcon, SettingsIcon } from "lucide-react";
+import { ArrowLeftIcon, ArrowRightIcon, ChartNoAxesColumnIcon, SettingsIcon } from "lucide-react";
 import type { ReactNode } from "react";
 import { memo } from "react";
 import { Link, useLocation, useNavigate } from "@tanstack/react-router";
 
+import { useAtomValue } from "@effect/atom-react";
 import { useEnvironmentIdentificationMode } from "../../hooks/useSettings";
+import { shortcutLabelForCommand } from "../../keybindings";
+import {
+  navigateHistory,
+  useCanNavigateHistory,
+  type HistoryDirection,
+} from "../../navigationHistory";
+import { primaryServerKeybindingsAtom } from "../../state/server";
 import { cn } from "../../lib/utils";
 import { usePullRequestsSupported } from "../../state/environments";
 import { T3Wordmark } from "../T3Wordmark";
@@ -14,6 +22,7 @@ import {
   useEnvironmentStageLabel,
 } from "../SidebarStageBackdrop";
 import { Badge } from "../ui/badge";
+import { Button } from "../ui/button";
 import {
   SidebarFooter,
   SidebarMenu,
@@ -63,7 +72,15 @@ export const SidebarChromeHeader = memo(function SidebarChromeHeader({
         />
       </div>
       <div className="relative z-10 flex h-8 min-w-0 flex-1 flex-wrap content-start items-center gap-x-2 overflow-hidden py-0.5">
-        <SidebarBrand onBackdrop={backdropVariant !== null} />
+        <div className="flex shrink-0 items-center gap-1">
+          <SidebarBrand onBackdrop={backdropVariant !== null} />
+          {isElectron ? (
+            <div className="hidden items-center md:flex">
+              <HistoryNavigationButton direction="back" onBackdrop={backdropVariant !== null} />
+              <HistoryNavigationButton direction="forward" onBackdrop={backdropVariant !== null} />
+            </div>
+          ) : null}
+        </div>
         {pillLabel ? (
           <div className="ml-1 flex h-7 items-center">
             <Badge data-environment-identification="pill" size="sm" variant="secondary">
@@ -77,8 +94,10 @@ export const SidebarChromeHeader = memo(function SidebarChromeHeader({
 });
 
 export function SidebarBrandWidthProbe({
+  isElectron,
   onWidthChange,
 }: {
+  isElectron: boolean;
   onWidthChange: (width: number) => void;
 }) {
   const observeWidth = (probe: HTMLDivElement) => {
@@ -93,13 +112,56 @@ export function SidebarBrandWidthProbe({
       className="pointer-events-none invisible fixed top-0 left-0 flex w-max border-r border-transparent pr-3"
       ref={observeWidth}
     >
-      <div className="ml-[var(--workspace-titlebar-content-left)] flex">
+      <div className="ml-[var(--workspace-titlebar-content-left)] flex gap-1">
         <SidebarBrandMark onBackdrop={false} />
+        {isElectron ? <div className="w-[calc(2*var(--workspace-titlebar-control-size))]" /> : null}
       </div>
     </div>
   );
 }
 
+function HistoryNavigationButton({
+  direction,
+  onBackdrop,
+}: {
+  direction: HistoryDirection;
+  onBackdrop: boolean;
+}) {
+  const keybindings = useAtomValue(primaryServerKeybindingsAtom);
+  const enabled = useCanNavigateHistory(direction);
+  const label = direction === "back" ? "Go back" : "Go forward";
+  const shortcutLabel = shortcutLabelForCommand(
+    keybindings,
+    direction === "back" ? "navigation.back" : "navigation.forward",
+  );
+  const Icon = direction === "back" ? ArrowLeftIcon : ArrowRightIcon;
+  return (
+    <Tooltip>
+      <TooltipTrigger
+        render={
+          <Button
+            aria-label={label}
+            className={cn(
+              "[-webkit-app-region:no-drag]",
+              onBackdrop && "relative top-auto translate-y-0",
+            )}
+            disabled={!enabled}
+            onClick={() => navigateHistory(direction)}
+            size="icon-sm"
+            variant={onBackdrop ? "media-navigation" : "ghost"}
+          />
+        }
+      >
+        <Icon className="size-3.5" />
+      </TooltipTrigger>
+      <TooltipPopup side="bottom">
+        {label}
+        {shortcutLabel ? ` (${shortcutLabel})` : ""}
+      </TooltipPopup>
+    </Tooltip>
+  );
+}
+
 function SidebarBrand({ onBackdrop }: { onBackdrop: boolean }) {
   return (
     <Link
diff --git a/apps/web/src/navigationHistory.ts b/apps/web/src/navigationHistory.ts
new file mode 100644
index 0000000000000..e062bb8fd7618
--- /dev/null
+++ b/apps/web/src/navigationHistory.ts
@@ -0,0 +1,22 @@
+import { useSyncExternalStore } from "react";
+
+export type HistoryDirection = "back" | "forward";
+
+function subscribeToNavigationHistory(onChange: () => void): () => void {
+  window.navigation.addEventListener("currententrychange", onChange);
+  return () => window.navigation.removeEventListener("currententrychange", onChange);
+}
+
+export function canNavigateHistory(direction: HistoryDirection): boolean {
+  return direction === "back" ? window.navigation.canGoBack : window.navigation.canGoForward;
+}
+
+export function navigateHistory(direction: HistoryDirection) {
+  if (direction === "back") window.history.back();
+  else window.history.forward();
+}
+
+/** Only for Electron: the Navigation API is Chromium-only. */
+export function useCanNavigateHistory(direction: HistoryDirection): boolean {
+  return useSyncExternalStore(subscribeToNavigationHistory, () => canNavigateHistory(direction));
+}
diff --git a/packages/contracts/src/ipc.ts b/packages/contracts/src/ipc.ts
index f460619f11355..f14452fec5a92 100644
--- a/packages/contracts/src/ipc.ts
+++ b/packages/contracts/src/ipc.ts
@@ -1018,6 +1018,7 @@ export interface DesktopBridge {
   getClientPlatform: () => string;
   setNotificationBadge: (badge: { count: number; image: string | null }) => Promise<void>;
   onNotificationBadgeClear: (listener: () => void) => () => void;
+  onTrackpadScrollBegin: (listener: () => void) => () => void;
   onTrackpadScrollEnd: (listener: () => void) => () => void;
   /**
    * Renderer `window.focus()` cannot raise an Electron window, and on Wayland

From 5ef56853ef1854da50bc1909c6c0a32700f2cb13 Mon Sep 17 00:00:00 2001
From: Bilal Bakr <62337003+Bil0000@users.noreply.github.com>
Date: Fri, 30 Oct 2026 11:00:33 +0300
Subject: [PATCH 140/146] feat(web): review local commits in the Diff pane
 (#19941)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../mobile/src/features/review/reviewModel.ts |  27 +-
 apps/server/src/auth/RpcAuthorization.ts      |   1 +
 .../src/observability/RpcInstrumentation.ts   |   1 +
 apps/server/src/review/ReviewService.ts       |  36 ++-
 apps/server/src/vcs/GitVcsDriver.ts           |   5 +
 apps/server/src/vcs/GitVcsDriverCore.test.ts  | 136 ++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts       | 236 +++++++++++++++-
 apps/server/src/ws.ts                         |   1 +
 apps/web/src/browser/browserLinkTarget.ts     |  13 +-
 apps/web/src/browser/useOpenLink.ts           |   8 +-
 apps/web/src/components/ChatView.tsx          |   7 +-
 apps/web/src/components/DiffPanel.tsx         | 252 ++++++++++++++++--
 ...DesktopWebLinkCoordinator.browser.test.tsx | 117 +++++++-
 .../desktop/DesktopWebLinkCoordinator.tsx     |  58 ++--
 .../components/diffs/useReviewFilePatches.ts  |   1 +
 .../src/components/settings/settingsSearch.ts |   2 +-
 apps/web/src/diffPanelStore.ts                |  52 +++-
 .../lib/openPullRequestLink.browser.test.tsx  | 160 +++++++++++
 apps/web/src/lib/openPullRequestLink.ts       | 219 +++++++++++----
 apps/web/src/rightPanelStore.ts               |  11 +
 docs/user/source-control.md                   |  10 +
 .../client-runtime/src/changeRequestLinks.ts  |  18 ++
 packages/client-runtime/src/state/review.ts   |   5 +
 packages/contracts/src/review.ts              |  28 +-
 packages/contracts/src/rpc.ts                 |  10 +
 .../src/shared/definition.ts                  |   9 +
 .../src/shared/definition.ts                  |   6 +
 .../src/shared/definition.ts                  |  74 ++++-
 .../src/registry.ts                           |   2 +-
 .../src/shared/definition.ts                  |   5 +
 .../src/shared/definition.ts                  |   6 +
 .../src/shared/definition.ts                  |  16 +-
 .../src/shared/definition.ts                  |   5 +
 33 files changed, 1375 insertions(+), 162 deletions(-)
 create mode 100644 apps/web/src/lib/openPullRequestLink.browser.test.tsx

diff --git a/apps/mobile/src/features/review/reviewModel.ts b/apps/mobile/src/features/review/reviewModel.ts
index 1b2131c73e0c1..21b57322da1cd 100644
--- a/apps/mobile/src/features/review/reviewModel.ts
+++ b/apps/mobile/src/features/review/reviewModel.ts
@@ -534,17 +534,22 @@ export function buildReviewSectionItems(input: {
     },
   );
 
-  const gitItems = input.gitSections.map<ReviewSectionItem>((section) => ({
-    id: `git:${section.kind}`,
-    kind: section.kind,
-    title: section.title,
-    subtitle: gitSubtitle(section),
-    diff: section.diff,
-    source: section,
-    ...(section.files ? { files: section.files } : {}),
-    truncated: section.truncated,
-    isLoading: false,
-  }));
+  const gitItems = input.gitSections
+    .filter(
+      (section): section is typeof section & { kind: ReviewSectionKind } =>
+        section.kind !== "commit",
+    )
+    .map<ReviewSectionItem>((section) => ({
+      id: `git:${section.kind}`,
+      kind: section.kind,
+      title: section.title,
+      subtitle: gitSubtitle(section),
+      diff: section.diff,
+      source: section,
+      ...(section.files ? { files: section.files } : {}),
+      truncated: section.truncated,
+      isLoading: false,
+    }));
   const hasChangesItem = gitItems.some((item) => item.id === CHANGES_SECTION_ID);
   const visibleGitItems =
     input.loadingGitSections && !hasChangesItem
diff --git a/apps/server/src/auth/RpcAuthorization.ts b/apps/server/src/auth/RpcAuthorization.ts
index 3806262cced53..bf2b8d49daf8d 100644
--- a/apps/server/src/auth/RpcAuthorization.ts
+++ b/apps/server/src/auth/RpcAuthorization.ts
@@ -170,6 +170,7 @@ export const RPC_REQUIRED_SCOPES = {
   [WS_METHODS.vcsRefreshStatus]: AuthOrchestrationReadScope,
   [WS_METHODS.gitResolvePullRequest]: AuthOrchestrationReadScope,
   [WS_METHODS.vcsListRefs]: AuthOrchestrationReadScope,
+  [WS_METHODS.reviewGetBranchCommits]: AuthFilesystemReadScope,
   [WS_METHODS.reviewGetDiffPreview]: AuthFilesystemReadScope,
   [WS_METHODS.reviewGetDiffFileContents]: AuthFilesystemReadScope,
   [WS_METHODS.terminalOpen]: AuthTerminalOperateScope,
diff --git a/apps/server/src/observability/RpcInstrumentation.ts b/apps/server/src/observability/RpcInstrumentation.ts
index 028ea5a561d44..cb8b0b6a86cf3 100644
--- a/apps/server/src/observability/RpcInstrumentation.ts
+++ b/apps/server/src/observability/RpcInstrumentation.ts
@@ -181,6 +181,7 @@ const RPC_AGGREGATES = {
   [WS_METHODS.vcsCreateRef]: "vcs",
   [WS_METHODS.vcsSwitchRef]: "vcs",
   [WS_METHODS.vcsInit]: "vcs",
+  [WS_METHODS.reviewGetBranchCommits]: "review",
   [WS_METHODS.reviewGetDiffPreview]: "review",
   [WS_METHODS.reviewGetDiffFileContents]: "review",
   [WS_METHODS.terminalOpen]: "terminal",
diff --git a/apps/server/src/review/ReviewService.ts b/apps/server/src/review/ReviewService.ts
index 8f88b387bd454..39ce1554cea61 100644
--- a/apps/server/src/review/ReviewService.ts
+++ b/apps/server/src/review/ReviewService.ts
@@ -8,6 +8,8 @@ import * as Path from "effect/Path";
 import {
   VcsRepositoryDetectionError,
   VcsUnsupportedOperationError,
+  type ReviewBranchCommitsInput,
+  type ReviewBranchCommitsResult,
   type ReviewDiffFileContentsInput,
   type ReviewDiffFileContentsResult,
   type ReviewDiffPreviewError,
@@ -20,9 +22,18 @@ import * as GitVcsDriver from "../vcs/GitVcsDriver.ts";
 import * as VcsDriverRegistry from "../vcs/VcsDriverRegistry.ts";
 import * as KnownWorkspaces from "../workspace/KnownWorkspaces.ts";
 
+const WORKSPACE_BOUND_SUBJECTS = {
+  "ReviewService.getBranchCommits": "commit list",
+  "ReviewService.getDiffPreview": "diff preview",
+  "ReviewService.getDiffFileContents": "diff file contents",
+} as const;
+
 export class ReviewService extends Context.Service<
   ReviewService,
   {
+    readonly getBranchCommits: (
+      input: ReviewBranchCommitsInput,
+    ) => Effect.Effect<ReviewBranchCommitsResult, ReviewDiffPreviewError>;
     readonly getDiffPreview: (
       input: ReviewDiffPreviewInput,
     ) => Effect.Effect<ReviewDiffPreviewResult, ReviewDiffPreviewError>;
@@ -61,7 +72,7 @@ export const make = Effect.gen(function* () {
   };
 
   const assertWorkspaceBoundCwd = Effect.fn("ReviewService.assertWorkspaceBoundCwd")(function* (
-    operation: "ReviewService.getDiffPreview" | "ReviewService.getDiffFileContents",
+    operation: keyof typeof WORKSPACE_BOUND_SUBJECTS,
     cwd: string,
   ) {
     const [candidate, workspaceRoot] = yield* Effect.all([
@@ -78,13 +89,27 @@ export const make = Effect.gen(function* () {
     return yield* new VcsRepositoryDetectionError({
       operation,
       cwd,
-      detail:
-        operation === "ReviewService.getDiffPreview"
-          ? "Review diff preview cwd must stay within the configured workspace root."
-          : "Review diff file contents cwd must stay within the configured workspace root.",
+      detail: `Review ${WORKSPACE_BOUND_SUBJECTS[operation]} cwd must stay within the configured workspace root.`,
     });
   });
 
+  const getBranchCommits: ReviewService["Service"]["getBranchCommits"] = Effect.fn(
+    "ReviewService.getBranchCommits",
+  )(function* (input) {
+    yield* assertWorkspaceBoundCwd("ReviewService.getBranchCommits", input.cwd);
+
+    const handle = yield* vcsRegistry.detect({ cwd: input.cwd, requestedKind: "auto" });
+    if (!handle) return { commits: [], truncated: false };
+    if (handle.kind !== "git") {
+      return yield* new VcsUnsupportedOperationError({
+        operation: "ReviewService.getBranchCommits",
+        kind: handle.kind,
+        detail: "Review commit lists require a Git repository.",
+      });
+    }
+    return yield* git.getReviewBranchCommits(input);
+  });
+
   const getDiffPreview: ReviewService["Service"]["getDiffPreview"] = Effect.fn(
     "ReviewService.getDiffPreview",
   )(function* (input) {
@@ -120,6 +145,7 @@ export const make = Effect.gen(function* () {
   });
 
   return ReviewService.of({
+    getBranchCommits,
     getDiffPreview,
     getDiffFileContents,
   });
diff --git a/apps/server/src/vcs/GitVcsDriver.ts b/apps/server/src/vcs/GitVcsDriver.ts
index 95833200a1b5f..74e409a8bc184 100644
--- a/apps/server/src/vcs/GitVcsDriver.ts
+++ b/apps/server/src/vcs/GitVcsDriver.ts
@@ -20,6 +20,8 @@ import {
   type VcsCreateRefResult,
   type VcsCreateWorktreeInput,
   type VcsCreateWorktreeResult,
+  type ReviewBranchCommitsInput,
+  type ReviewBranchCommitsResult,
   type ReviewDiffPreviewInput,
   type ReviewDiffPreviewResult,
   type ReviewDiffFileContentsInput,
@@ -328,6 +330,9 @@ export class GitVcsDriver extends Context.Service<
       cwd: string,
       baseRef: string,
     ) => Effect.Effect<GitRangeContext, GitCommandError>;
+    readonly getReviewBranchCommits: (
+      input: ReviewBranchCommitsInput,
+    ) => Effect.Effect<ReviewBranchCommitsResult, GitCommandError>;
     readonly getReviewDiffPreview: (
       input: ReviewDiffPreviewInput,
     ) => Effect.Effect<ReviewDiffPreviewResult, GitCommandError>;
diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index d05a41a6f3824..cd4b6949fad86 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -1,5 +1,7 @@
 // @effect-diagnostics nodeBuiltinImport:off - realpathSync.native resolves Windows 8.3 short names, which the Effect realPath does not.
 import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodeURL from "node:url";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import * as HostProcess from "@t3tools/shared/HostProcess";
 import { assert, it, describe } from "@effect/vitest";
@@ -1466,6 +1468,140 @@ it.layer(layerTest)("GitVcsDriver core integration", (it) => {
   });
 
   describe("review diff previews", () => {
+    it.effect("diffs a root commit against the empty tree but rejects a shallow boundary", () =>
+      Effect.gen(function* () {
+        const upstream = yield* makeTmpDir();
+        yield* initRepoWithCommit(upstream);
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+        const emptyTree = yield* git(upstream, ["hash-object", "-t", "tree", NodeOS.devNull]);
+        const root = yield* git(upstream, ["rev-parse", "HEAD"]);
+        const rootSource = (yield* driver.getReviewDiffPreview({ cwd: upstream, commitSha: root }))
+          .sources[0]!;
+        assert.equal(rootSource.baseRef, emptyTree);
+        assert.include(rootSource.diff, "+# test");
+
+        yield* writeTextFile(upstream, "README.md", "# boundary\n");
+        yield* git(upstream, ["commit", "-am", "boundary"]);
+        const sha = yield* git(upstream, ["rev-parse", "HEAD"]);
+        const cwd = yield* makeTmpDir();
+        yield* git(upstream, ["clone", "--depth=1", NodeURL.pathToFileURL(upstream).href, cwd], {
+          GIT_CONFIG_GLOBAL: NodeOS.devNull,
+          GIT_CONFIG_NOSYSTEM: "1",
+        });
+        assert.equal(yield* git(cwd, ["rev-parse", "--is-shallow-repository"]), "true");
+        for (const request of [
+          driver.getReviewDiffPreview({ cwd, commitSha: sha }),
+          driver.getReviewDiffFileContents(
+            makeReviewDiffFileContentsInput(cwd, {
+              sourceKind: "commit",
+              changeType: "new",
+              headRef: sha,
+              baseRef: emptyTree,
+            }),
+          ),
+        ]) {
+          const error = yield* Effect.asVoid<unknown, GitCommandError, never>(request).pipe(
+            Effect.flip,
+          );
+          assert.include(error.detail, "parent");
+        }
+      }),
+    );
+
+    it.effect("lists the branch's commits newest first, at most 100, and flags the rest", () =>
+      Effect.gen(function* () {
+        const cwd = yield* makeTmpDir();
+        const { initialBranch } = yield* initRepoWithCommit(cwd);
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+        yield* git(cwd, ["checkout", "-b", "feature/commits"]);
+        for (let index = 0; index < 102; index++) {
+          yield* git(cwd, ["commit", "--allow-empty", "-m", `feature ${index}`]);
+        }
+
+        const result = yield* driver.getReviewBranchCommits({ cwd, baseRef: initialBranch });
+        assert.strictEqual(result.truncated, true);
+        assert.strictEqual(result.commits.length, 100);
+        assert.strictEqual(result.commits[0]?.sha, yield* git(cwd, ["rev-parse", "HEAD"]));
+        assert.deepStrictEqual(
+          [result.commits[0]?.subject, result.commits[99]?.subject],
+          ["feature 101", "feature 2"],
+        );
+      }),
+    );
+
+    it.effect("previews one selected commit, a merge against its first parent", () =>
+      Effect.gen(function* () {
+        const cwd = yield* makeTmpDir();
+        const { initialBranch } = yield* initRepoWithCommit(cwd);
+        const driver = yield* GitVcsDriver.GitVcsDriver;
+        yield* git(cwd, ["checkout", "-b", "feature/merge-preview"]);
+        yield* git(cwd, ["checkout", "-b", "feature/side"]);
+        yield* writeTextFile(cwd, "README.md", "# side commit\n");
+        yield* git(cwd, ["add", "README.md"]);
+        yield* git(cwd, ["commit", "-m", "side change"]);
+        yield* git(cwd, ["checkout", "feature/merge-preview"]);
+        yield* writeTextFile(cwd, "feature.txt", "feature commit\n");
+        yield* git(cwd, ["add", "feature.txt"]);
+        yield* git(cwd, ["commit", "-m", "feature change"]);
+        const firstParent = yield* git(cwd, ["rev-parse", "HEAD"]);
+        yield* git(cwd, ["merge", "--no-ff", "--no-edit", "feature/side"]);
+        const mergeSha = yield* git(cwd, ["rev-parse", "HEAD"]);
+        yield* git(cwd, ["checkout", "-b", "feature/elsewhere", initialBranch]);
+        yield* writeTextFile(cwd, "elsewhere.txt", "elsewhere\n");
+        yield* git(cwd, ["add", "elsewhere.txt"]);
+        yield* git(cwd, ["commit", "-m", "elsewhere change"]);
+        const elsewhereSha = yield* git(cwd, ["rev-parse", "HEAD"]);
+        yield* git(cwd, ["checkout", "feature/merge-preview"]);
+        yield* writeTextFile(cwd, "README.md", "# dirty tree\n");
+
+        const elsewhere = yield* driver.getReviewDiffPreview({ cwd, commitSha: elsewhereSha });
+        assert.deepStrictEqual(
+          elsewhere.sources
+            .find((candidate) => candidate.kind === "commit")
+            ?.files?.map((file) => file.path),
+          ["elsewhere.txt"],
+        );
+
+        const preview = yield* driver.getReviewDiffPreview({
+          cwd,
+          baseRef: initialBranch,
+          commitSha: mergeSha,
+        });
+        const source = preview.sources.find((candidate) => candidate.kind === "commit")!;
+        assert.strictEqual(source.baseRef, firstParent);
+        assert.strictEqual(source.headRef, mergeSha);
+        assert.deepStrictEqual(
+          source.files?.map((file) => file.path),
+          ["README.md"],
+        );
+        assert.include(source.diff, "+# side commit");
+        assert.notInclude(source.diff, "dirty tree");
+        assert.notInclude(source.diff, "feature.txt");
+
+        const patch = yield* driver.getReviewDiffPreview({
+          cwd,
+          baseRef: initialBranch,
+          commitSha: mergeSha,
+          file: { path: "README.md", previousPath: null, sourceKind: "commit" },
+        });
+        assert.include(
+          patch.sources.find((candidate) => candidate.kind === "commit")!.diff,
+          "+# side commit",
+        );
+        const contents = yield* driver.getReviewDiffFileContents(
+          makeReviewDiffFileContentsInput(cwd, {
+            sourceKind: "commit",
+            baseRef: source.baseRef,
+            headRef: source.headRef,
+          }),
+        );
+        assert.deepStrictEqual(contents, {
+          oldContents: "# test\n",
+          newContents: "# side commit\n",
+        });
+      }),
+    );
+
     it.effect("loads repository-relative files from a nested project directory", () =>
       Effect.gen(function* () {
         const cwd = yield* makeTmpDir();
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index 3a7c99fbc3d31..c5bdf3d068ef9 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -26,6 +26,7 @@ import {
   GitCommandError,
   type GitCommandFailureReason,
   T3_PROJECT_FILE_NAME,
+  type ReviewBranchCommitsInput,
   type ReviewDiffFileContentsInput,
   type ReviewDiffPreviewInput,
   type ReviewDiffFileStat,
@@ -74,6 +75,9 @@ const REVIEW_METADATA_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 // Temporary-index git add scales poorly (50k files took ~30 s); report incomplete totals above this cap.
 const REVIEW_UNTRACKED_MAX_FILES = 5_000;
 const REVIEW_DIFF_FILE_MAX_OUTPUT_BYTES = 1024 * 1024;
+const REVIEW_BRANCH_COMMIT_LIMIT = 100;
+const REVIEW_BRANCH_SUBJECT_LIMIT = 300;
+const REVIEW_BRANCH_COMMIT_MAX_OUTPUT_BYTES = 128 * 1024;
 // Client patch parsers require a/ and b/ prefixes; override user diff prefix settings.
 export const PATCH_RENDER_PREFIX_ARGS = ["--src-prefix=a/", "--dst-prefix=b/"] as const;
 const REVIEW_DIFF_ARGS = [
@@ -3115,6 +3119,141 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     return { baseRef, insertions, deletions };
   }, Effect.scoped);
 
+  const reviewCommitError = (cwd: string, detail: string) =>
+    new GitCommandError({
+      operation: "GitVcsDriver.reviewCommit",
+      command: "git cat-file",
+      cwd,
+      detail,
+    });
+
+  const resolveReviewCommit = Effect.fn("resolveReviewCommit")(function* (
+    cwd: string,
+    sha: string,
+  ) {
+    if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha)) {
+      return yield* reviewCommitError(cwd, "Selected commit is invalid or no longer available.");
+    }
+    const present = yield* executeGit(
+      "GitVcsDriver.reviewCommit.present",
+      cwd,
+      ["cat-file", "-e", `${sha}^{commit}`],
+      { allowNonZeroExit: true, env: { GIT_NO_LAZY_FETCH: "1" } },
+    );
+    if (present.exitCode !== 0) {
+      return yield* reviewCommitError(cwd, "Selected commit is invalid or no longer available.");
+    }
+    // The raw object keeps the parents a shallow clone grafts away, so a boundary is not a root.
+    const object = yield* runGitStdout("GitVcsDriver.reviewCommit.parents", cwd, [
+      "cat-file",
+      "commit",
+      sha,
+    ]);
+    const secondLine = object.split("\n", 2)[1];
+    const firstParent = secondLine?.startsWith("parent ") ? secondLine.slice(7) : undefined;
+    if (firstParent !== undefined) {
+      const parent = yield* executeGit(
+        "GitVcsDriver.reviewCommit.parent",
+        cwd,
+        ["cat-file", "-e", `${firstParent}^{commit}`],
+        { allowNonZeroExit: true, env: { GIT_NO_LAZY_FETCH: "1" } },
+      );
+      if (parent.exitCode !== 0) {
+        return yield* reviewCommitError(cwd, "Selected commit's parent is not available locally.");
+      }
+    }
+    return { sha: sha.toLowerCase(), parent: firstParent ?? (yield* readEmptyTreeHash(cwd)) };
+  });
+
+  const readReviewCommitMessage = Effect.fn("GitVcsDriver.readReviewCommitMessage")(function* (
+    cwd: string,
+    sha: string,
+  ) {
+    const result = yield* executeGit(
+      "GitVcsDriver.readReviewCommitMessage",
+      cwd,
+      ["show", "-s", "--no-notes", "--no-show-signature", "--format=%B", sha],
+      { maxOutputBytes: 8_192, appendTruncationMarker: true },
+    );
+    const endOfSubject = result.stdout.indexOf("\n");
+    return {
+      subject: result.stdout.slice(0, endOfSubject < 0 ? undefined : endOfSubject).slice(0, 300),
+    };
+  });
+
+  const getReviewBranchCommits = Effect.fn("getReviewBranchCommits")(function* (
+    input: ReviewBranchCommitsInput,
+  ) {
+    const repository = yield* resolveRepositoryPathsUncached(input.cwd);
+    if (!repository?.worktreeRoot) return { commits: [], truncated: false };
+    const cwd = repository.worktreeRoot;
+    const head = yield* executeGit(
+      "GitVcsDriver.getReviewBranchCommits.head",
+      cwd,
+      ["rev-parse", "--verify", "--quiet", "HEAD"],
+      { allowNonZeroExit: true },
+    );
+    if (head.exitCode !== 0) {
+      if (head.exitCode === 1 && head.stderr.trim() === "") {
+        return { commits: [], truncated: false };
+      }
+      return yield* reviewCommitError(cwd, "Could not resolve the current branch commit.");
+    }
+    const { mergeBase } = yield* resolveReviewMergeBase(
+      cwd,
+      repository.currentBranch,
+      input.baseRef,
+    );
+    const result = yield* executeGit(
+      "GitVcsDriver.getReviewBranchCommits",
+      cwd,
+      [
+        "log",
+        "-z",
+        "--no-notes",
+        "--no-show-signature",
+        "--format=%H%x00%s%x00%cI",
+        `--max-count=${REVIEW_BRANCH_COMMIT_LIMIT + 1}`,
+        `${mergeBase}..HEAD`,
+      ],
+      {
+        maxOutputBytes: REVIEW_BRANCH_COMMIT_MAX_OUTPUT_BYTES,
+        appendTruncationMarker: true,
+      },
+    );
+    if (!result.stdoutTruncated && result.stdout.length > 0 && !result.stdout.endsWith("\0")) {
+      return yield* reviewCommitError(cwd, "Could not read branch commit metadata.");
+    }
+    const fields = result.stdout.split("\0");
+    const completeFieldCount = fields.length - 1;
+    const commits: Array<{ sha: string; subject: string; committedAt: string }> = [];
+    for (
+      let index = 0;
+      index + 2 < completeFieldCount && commits.length <= REVIEW_BRANCH_COMMIT_LIMIT;
+      index += 3
+    ) {
+      const sha = fields[index];
+      const subject = fields[index + 1];
+      const committedAt = fields[index + 2];
+      if (
+        !sha ||
+        subject === undefined ||
+        !committedAt ||
+        !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(sha)
+      ) {
+        return yield* reviewCommitError(cwd, "Could not read branch commit metadata.");
+      }
+      commits.push({ sha, subject: subject.slice(0, REVIEW_BRANCH_SUBJECT_LIMIT), committedAt });
+    }
+    if (result.stdoutTruncated && commits.length === 0) {
+      return yield* reviewCommitError(cwd, "Branch commit metadata exceeds the response limit.");
+    }
+    return {
+      commits: commits.slice(0, REVIEW_BRANCH_COMMIT_LIMIT),
+      truncated: result.stdoutTruncated || commits.length > REVIEW_BRANCH_COMMIT_LIMIT,
+    };
+  });
+
   const getReviewDiffPreview = Effect.fn("getReviewDiffPreview")(function* (
     input: ReviewDiffPreviewInput,
   ) {
@@ -3141,6 +3280,64 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     }
 
     const cwd = repository.worktreeRoot;
+    const hashDiff = (diff: string, files: ReadonlyArray<ReviewDiffFileStat>) =>
+      crypto.digest("SHA-256", new TextEncoder().encode(JSON.stringify([diff, files]))).pipe(
+        Effect.map(Hex.encode),
+        Effect.mapError(
+          (cause) =>
+            new GitCommandError({
+              operation: "GitVcsDriver.getReviewDiffPreview.hash",
+              command: "crypto.digest SHA-256",
+              cwd,
+              detail: "Failed to hash review diff.",
+              cause,
+            }),
+        ),
+      );
+    if (input.commitSha !== undefined || input.file?.sourceKind === "commit") {
+      if (!input.commitSha || (input.file && input.file.sourceKind !== "commit")) {
+        return yield* reviewCommitError(cwd, "Selected commit request is invalid.");
+      }
+      const commit = yield* resolveReviewCommit(cwd, input.commitSha);
+      const { subject } = yield* readReviewCommitMessage(cwd, commit.sha);
+      const diffArgs = [
+        ...REVIEW_DIFF_ARGS,
+        ...(input.ignoreWhitespace ? ["--ignore-all-space"] : []),
+      ];
+      const stat = yield* executeGit(
+        "GitVcsDriver.getReviewDiffPreview.commitStat",
+        cwd,
+        [...diffArgs, "--numstat", "-z", commit.parent, commit.sha, "--", ...pathArgs],
+        { maxOutputBytes: REVIEW_METADATA_MAX_OUTPUT_BYTES },
+      );
+      const files = parseReviewNumstat(stat.stdout);
+      const patch = yield* executeGit(
+        "GitVcsDriver.getReviewDiffPreview.commitPatch",
+        cwd,
+        [...diffArgs, "--patch", commit.parent, commit.sha, "--", ...pathArgs],
+        { maxOutputBytes: patchLimit, appendTruncationMarker: true },
+      );
+      const diffHash = yield* hashDiff(patch.stdout, files);
+      return {
+        cwd: input.cwd,
+        generatedAt: yield* DateTime.now,
+        sources: [
+          {
+            id: commit.sha,
+            kind: "commit" as const,
+            title: `Commit ${commit.sha.slice(0, 7)}`,
+            ...(subject.trim() ? { commitSubject: subject.trim() } : {}),
+            baseRef: commit.parent,
+            headRef: commit.sha,
+            diff: patch.stdout,
+            files,
+            diffHash,
+            truncated: patch.stdoutTruncated,
+          },
+        ],
+      };
+    }
+
     const dirtyRef = input.file?.sourceKind === "branch-range" ? null : "HEAD";
     const review =
       input.file?.sourceKind === "working-tree"
@@ -3220,20 +3417,6 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     const baseFiles = baseResult.files;
     const dirtyDiff = dirtyTrackedResult.stdout;
     const baseDiff = baseResult.stdout;
-    const hashDiff = (diff: string, files: ReadonlyArray<ReviewDiffFileStat>) =>
-      crypto.digest("SHA-256", new TextEncoder().encode(JSON.stringify([diff, files]))).pipe(
-        Effect.map(Hex.encode),
-        Effect.mapError(
-          (cause) =>
-            new GitCommandError({
-              operation: "GitVcsDriver.getReviewDiffPreview.hash",
-              command: "crypto.digest SHA-256",
-              cwd,
-              detail: "Failed to hash review diff.",
-              cause,
-            }),
-        ),
-      );
     const [dirtyDiffHash, baseDiffHash] = yield* Effect.all([
       hashDiff(dirtyDiff, dirtyFiles ?? []),
       hashDiff(baseDiff, baseFiles ?? []),
@@ -3385,6 +3568,30 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     if (repositoryRoot.length === 0) {
       return yield* reviewDiffFileError(input, "Could not resolve the Git repository root.");
     }
+    if (input.sourceKind === "commit") {
+      if (!input.headRef) {
+        return yield* reviewDiffFileError(input, "Selected commit is no longer available.");
+      }
+      const commit = yield* resolveReviewCommit(input.cwd, input.headRef);
+      if (input.baseRef !== commit.parent) {
+        return yield* reviewDiffFileError(
+          input,
+          "Selected commit changed. Refresh the comparison.",
+        );
+      }
+      const [oldContents, newContents] = yield* Effect.all(
+        [
+          input.changeType === "new"
+            ? Effect.succeed("")
+            : readReviewFileAtRevision(input, commit.parent, input.oldPath),
+          input.changeType === "deleted"
+            ? Effect.succeed("")
+            : readReviewFileAtRevision(input, commit.sha, input.newPath),
+        ],
+        { concurrency: 2 },
+      );
+      return { oldContents, newContents };
+    }
     const oldRevision =
       input.sourceKind === "working-tree"
         ? (input.baseRef ?? "HEAD")
@@ -4649,6 +4856,7 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
       return yield* withListRefsInvalidation(cwd, pullCurrentBranch(cwd));
     }),
     readRangeContext,
+    getReviewBranchCommits,
     getReviewDiffPreview,
     getReviewDiffFileContents,
     readConfigValue,
diff --git a/apps/server/src/ws.ts b/apps/server/src/ws.ts
index 32737aa771df6..befad768da3e5 100644
--- a/apps/server/src/ws.ts
+++ b/apps/server/src/ws.ts
@@ -3001,6 +3001,7 @@ export const layerWsRpc = (
           gitWorkflow.switchRef(input).pipe(Effect.tap(() => refreshGitStatus(input.cwd))),
         [WS_METHODS.vcsInit]: (input) =>
           vcsProvisioning.initRepository(input).pipe(Effect.tap(() => refreshGitStatus(input.cwd))),
+        [WS_METHODS.reviewGetBranchCommits]: (input) => review.getBranchCommits(input),
         [WS_METHODS.reviewGetDiffPreview]: (input) => review.getDiffPreview(input),
         [WS_METHODS.reviewGetDiffFileContents]: (input) => review.getDiffFileContents(input),
         [WS_METHODS.terminalOpen]: (input) => terminalManager.open(input),
diff --git a/apps/web/src/browser/browserLinkTarget.ts b/apps/web/src/browser/browserLinkTarget.ts
index 50ff1a4e351fc..f1c4e65a99913 100644
--- a/apps/web/src/browser/browserLinkTarget.ts
+++ b/apps/web/src/browser/browserLinkTarget.ts
@@ -1,6 +1,11 @@
-import type { BrowserLinkTarget, ScopedThreadRef } from "@t3tools/contracts";
+import {
+  AuthPreviewOperateScope,
+  type BrowserLinkTarget,
+  type ScopedThreadRef,
+} from "@t3tools/contracts";
 
 import { ensureClientSettingsHydrated, getClientSettings } from "~/hooks/useSettings";
+import { readEnvironmentScope } from "~/state/session";
 import { isPreviewAvailableFor } from "./previewRuntime";
 
 export interface ResolveLinkTargetInput {
@@ -38,5 +43,9 @@ export async function resolveBrowserLinkTargetPreference(): Promise<BrowserLinkT
 }
 
 export function canOpenLinksInApp(threadRef: ScopedThreadRef | null | undefined): boolean {
-  return threadRef != null && isPreviewAvailableFor(threadRef.environmentId);
+  return (
+    threadRef != null &&
+    readEnvironmentScope(threadRef.environmentId, AuthPreviewOperateScope) &&
+    isPreviewAvailableFor(threadRef.environmentId)
+  );
 }
diff --git a/apps/web/src/browser/useOpenLink.ts b/apps/web/src/browser/useOpenLink.ts
index cace0da62a1e6..6a60fcbfed54f 100644
--- a/apps/web/src/browser/useOpenLink.ts
+++ b/apps/web/src/browser/useOpenLink.ts
@@ -1,4 +1,4 @@
-import { AuthPreviewOperateScope, type ScopedThreadRef } from "@t3tools/contracts";
+import type { ScopedThreadRef } from "@t3tools/contracts";
 import {
   isAtomCommandInterrupted,
   squashAtomCommandFailure,
@@ -6,7 +6,6 @@ import {
 import { recordVisitForThread } from "~/browserHistoryStore";
 import { readLocalApi } from "~/localApi";
 import { previewEnvironment } from "~/state/preview";
-import { readEnvironmentScope } from "~/state/session";
 import { useAtomCommand } from "~/state/use-atom-command";
 
 import {
@@ -37,10 +36,7 @@ export function useOpenLink(threadRef: ScopedThreadRef | null | undefined): (
       url,
       event: options.event ?? NO_MODIFIER,
       preference: await resolveBrowserLinkTargetPreference(),
-      canOpenInApp:
-        targetThreadRef != null &&
-        readEnvironmentScope(targetThreadRef.environmentId, AuthPreviewOperateScope) &&
-        canOpenLinksInApp(targetThreadRef),
+      canOpenInApp: canOpenLinksInApp(targetThreadRef),
     });
     if (target === "app" && targetThreadRef) {
       const result = await openUrlInPreview({ threadRef: targetThreadRef, url, openPreview });
diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index fa3e7e23dae6e..cf48ddcb842dd 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -1010,7 +1010,12 @@ export default function ChatView(props: ChatViewProps) {
   useLayoutEffect(() => {
     const explicitThreadRef = explicitDiffOpenRef.current;
     explicitDiffOpenRef.current = null;
-    if (diffOpen && activeThreadRef && explicitThreadRef !== activeThreadRef) {
+    if (
+      diffOpen &&
+      activeThreadRef &&
+      explicitThreadRef !== activeThreadRef &&
+      !useDiffPanelStore.getState().consumeKeepSelectionOnOpen(activeThreadRef)
+    ) {
       useDiffPanelStore.getState().selectGitScope(activeThreadRef, "branch");
     }
   }, [activeThreadRef, diffOpen]);
diff --git a/apps/web/src/components/DiffPanel.tsx b/apps/web/src/components/DiffPanel.tsx
index ddce50db3cfe3..ef95c24d578a2 100644
--- a/apps/web/src/components/DiffPanel.tsx
+++ b/apps/web/src/components/DiffPanel.tsx
@@ -6,7 +6,7 @@ import {
   squashAtomCommandFailure,
 } from "@t3tools/client-runtime/state/runtime";
 import { safeErrorLogAttributes } from "@t3tools/client-runtime/errors";
-import type { ScopedThreadRef, RunId } from "@t3tools/contracts";
+import type { ReviewBranchCommitsResult, ScopedThreadRef, RunId } from "@t3tools/contracts";
 import {
   ArrowRightIcon,
   CheckIcon,
@@ -20,7 +20,7 @@ import {
 } from "lucide-react";
 import { ChevronDown, ChevronRight, ChevronsDownUp, ChevronsUpDown } from "lucide";
 import * as Schema from "effect/Schema";
-import { useEffect, useRef, useState } from "react";
+import { type MouseEvent, useEffect, useRef, useState } from "react";
 import { useCodeViewFileReveal } from "./diffs/useCodeViewFileReveal";
 import { useFilesystemReadAccess } from "~/state/filesystem";
 import { useOpenInPreferredEditor } from "../editorPreferences";
@@ -33,6 +33,7 @@ import { revisionedQuery } from "~/state/revisionedQuery";
 import { cn } from "~/lib/utils";
 import {
   resolveToolCallDiffTarget,
+  selectThreadBranchBaseRef,
   selectThreadDiffPanelSelection,
   useDiffPanelSessionStore,
   useDiffPanelStore,
@@ -60,7 +61,7 @@ import {
   useQuietThreadVisibleTurnItems,
 } from "../state/entities";
 import { useClientSettings, updateClientSettings } from "../hooks/useSettings";
-import { formatShortTimestamp } from "../timestampFormat";
+import { formatRelativeTimeLabel, formatShortTimestamp } from "../timestampFormat";
 import { DiffFilePathCopyButton } from "./DiffFilePathCopyButton";
 import { DiffPanelLoadingState, DiffPanelShell, type DiffPanelMode } from "./DiffPanelShell";
 import { DiffStatLabel } from "./chat/DiffStatLabel";
@@ -83,6 +84,7 @@ import {
 import {
   DropdownMenu,
   DropdownMenuContent,
+  DropdownMenuItem,
   DropdownMenuRadioGroup,
   DropdownMenuRadioItem,
   DropdownMenuSub,
@@ -103,6 +105,8 @@ import { useReviewFilePatches } from "./diffs/useReviewFilePatches";
 import { DiffFileLoadingBoundary } from "./diffs/DiffFileLoadingBoundary";
 import { DiffFileStatus } from "./diffs/DiffFileStatus";
 import { useThreadRouteRef } from "../hooks/useThreadRouteTarget";
+import { projectCommitUrl } from "@t3tools/client-runtime/change-request-links";
+import { useOpenLink } from "../browser/useOpenLink";
 
 type DiffThemeType = "light" | "dark";
 const AUTOMATIC_BASE_REF = "__automatic_base_ref__";
@@ -223,6 +227,8 @@ export default function DiffPanel({
   );
   const [hideTestFiles, setHideTestFiles] = useHideTestFiles();
   const [baseRefQuery, setBaseRefQuery] = useState("");
+  // The open commit menu keeps the list it opened with, so rows do not move under the pointer.
+  const [openCommitMenu, setOpenCommitMenu] = useState<ReviewBranchCommitsResult | null>(null);
   const [codeViewRevision, setCodeViewRevision] = useState(0);
 
   const routeThreadRef = useThreadRouteRef();
@@ -263,8 +269,14 @@ export default function DiffPanel({
   const diffSelection = useDiffPanelStore((state) =>
     selectThreadDiffPanelSelection(state.byThreadKey, routeThreadRef),
   );
+  const rememberedBaseRef = useDiffPanelStore((state) =>
+    selectThreadBranchBaseRef(state, routeThreadRef),
+  );
   const toolCallSelection = diffSelection.kind === "tool-call" ? diffSelection : null;
-  const isGitSelection = diffSelection.kind === "branch" || diffSelection.kind === "unstaged";
+  const isGitSelection =
+    diffSelection.kind === "branch" ||
+    diffSelection.kind === "unstaged" ||
+    diffSelection.kind === "commit";
   const toolCallItems = useQuietThreadVisibleTurnItems(toolCallSelection ? routeThreadRef : null);
   const toolCallDetail = useTurnItemDetail(
     toolCallSelection && routeThreadRef
@@ -294,8 +306,15 @@ export default function DiffPanel({
   }, [diffSelection, orderedTurnDiffSummaries, routeThreadRef]);
 
   const selectedRunId = diffSelection.kind === "turn" ? diffSelection.turnId : null;
-  const selectedGitScope = diffSelection.kind === "unstaged" ? "unstaged" : "branch";
-  const selectedBaseRef = diffSelection.kind === "branch" ? diffSelection.baseRef : null;
+  const selectedGitScope =
+    diffSelection.kind === "unstaged" || diffSelection.kind === "commit"
+      ? diffSelection.kind
+      : "branch";
+  const selectedCommitSha = diffSelection.kind === "commit" ? diffSelection.sha : null;
+  const selectedBaseRef =
+    diffSelection.kind === "branch" || diffSelection.kind === "commit"
+      ? diffSelection.baseRef
+      : null;
   const selectedFilePath = diffSelection.kind === "turn" ? diffSelection.filePath : null;
   const selectedFileRevealRequestId =
     diffSelection.kind === "turn" ? diffSelection.revealRequestId : 0;
@@ -306,31 +325,17 @@ export default function DiffPanel({
         orderedTurnDiffSummaries[0]);
   const selectedCheckpointTurnCount = selectedTurn?.checkpointTurnCount;
   const latestTurn = orderedTurnDiffSummaries[0];
-  const selectedScopeLabel = toolCallSelection
-    ? "Tool call"
-    : selectedRunId === null
-      ? selectedGitScope === "unstaged"
-        ? "Uncommitted"
-        : "Changes"
-      : selectedTurn?.runId === latestTurn?.runId
-        ? "Latest turn"
-        : `Turn ${selectedCheckpointTurnCount ?? "?"}`;
   const reviewSectionId = toolCallSelection
     ? `tool-call:${toolCallSelection.threadId}:${toolCallSelection.itemId}`
     : selectedTurn
       ? `turn:${selectedTurn.runId}`
-      : selectedGitScope;
+      : selectedCommitSha !== null
+        ? `commit:${selectedCommitSha}`
+        : selectedGitScope;
   const collapseScopeKey = routeThreadRef
     ? `${routeThreadRef.environmentId}:${routeThreadRef.threadId}:${reviewSectionId}`
     : null;
   const codeViewMountKey = `${collapseScopeKey ?? reviewSectionId}:${codeViewRevision}`;
-  const reviewSectionTitle = toolCallSelection
-    ? "Tool call"
-    : selectedTurn
-      ? `Turn ${selectedCheckpointTurnCount ?? "?"}`
-      : selectedGitScope === "unstaged"
-        ? "Uncommitted"
-        : "Changes";
   const selectedCheckpointRange =
     typeof selectedCheckpointTurnCount === "number"
       ? {
@@ -354,6 +359,7 @@ export default function DiffPanel({
       ? {
           cwd: activeCwd,
           ...(selectedBaseRef ? { baseRef: selectedBaseRef } : {}),
+          ...(selectedCommitSha !== null ? { commitSha: selectedCommitSha } : {}),
           ignoreWhitespace: diffIgnoreWhitespace,
         }
       : undefined;
@@ -372,13 +378,69 @@ export default function DiffPanel({
         )
       : null,
   );
+  const branchCommitsQuery = useEnvironmentQuery(
+    visible && isGitRepo && canReadFiles && activeThread && activeCwd
+      ? reviewEnvironment.branchCommits({
+          environmentId: activeThread.environmentId,
+          input: {
+            cwd: activeCwd,
+            ...(rememberedBaseRef ? { baseRef: rememberedBaseRef } : {}),
+          },
+        })
+      : null,
+  );
+  const branchCommits = openCommitMenu ?? branchCommitsQuery.data;
   const activeThreadRefreshKey = routeThreadRef
     ? `${routeThreadRef.environmentId}:${routeThreadRef.threadId}`
     : null;
 
   const selectedGitSource = branchDiffPreview.data?.sources.find(
-    (source) => source.kind === (selectedGitScope === "unstaged" ? "working-tree" : "branch-range"),
+    (source) =>
+      source.kind ===
+      (selectedGitScope === "unstaged"
+        ? "working-tree"
+        : selectedGitScope === "commit"
+          ? "commit"
+          : "branch-range"),
   );
+  const selectedCommitSubject =
+    selectedCommitSha !== null && selectedGitSource?.headRef === selectedCommitSha
+      ? selectedGitSource.commitSubject
+      : undefined;
+  const selectedGitScopeLabel =
+    selectedCommitSha !== null
+      ? (selectedCommitSubject ?? `Commit ${selectedCommitSha.slice(0, 7)}`)
+      : selectedGitScope === "unstaged"
+        ? "Uncommitted"
+        : "Changes";
+  const selectedScopeLabel = toolCallSelection
+    ? "Tool call"
+    : selectedRunId === null
+      ? selectedCommitSha !== null
+        ? (selectedCommitSubject ?? "Commit")
+        : selectedGitScopeLabel
+      : selectedTurn?.runId === latestTurn?.runId
+        ? "Latest turn"
+        : `Turn ${selectedCheckpointTurnCount ?? "?"}`;
+  const reviewSectionTitle = toolCallSelection
+    ? "Tool call"
+    : selectedTurn
+      ? `Turn ${selectedCheckpointTurnCount ?? "?"}`
+      : selectedGitScopeLabel;
+  const headerCommitSha = selectedRunId === null ? selectedCommitSha : null;
+  const selectedCommitUrl =
+    headerCommitSha !== null
+      ? projectCommitUrl(activeProject?.repositoryIdentity, headerCommitSha)
+      : null;
+  const openLink = useOpenLink(routeThreadRef);
+  // A SHA link goes to the code host; it must not route back into this pane's commit selection.
+  const openCommitUrl = (event: MouseEvent<HTMLElement>, url: string) => {
+    event.stopPropagation();
+    if (event.metaKey || event.ctrlKey || event.shiftKey || event.altKey || event.button === 1)
+      return;
+    event.preventDefault();
+    void openLink(url, { event });
+  };
   const refreshPreviewQuery = branchDiffPreview.refresh;
   const refreshDiffFromUserAction = refreshPreviewQuery;
 
@@ -512,7 +574,8 @@ export default function DiffPanel({
     environmentId: activeThread?.environmentId,
     cwd: branchDiffPreview.data?.cwd,
     source: lazySource,
-    baseRef: lazySource?.baseRef ?? selectedBaseRef,
+    baseRef:
+      selectedCommitSha !== null ? selectedBaseRef : (lazySource?.baseRef ?? selectedBaseRef),
     ignoreWhitespace: diffIgnoreWhitespace,
     theme: resolvedTheme,
     previewInput: branchDiffPreviewInput,
@@ -693,16 +756,23 @@ export default function DiffPanel({
     useDiffPanelStore.getState().selectBranchBaseRef(routeThreadRef, baseRef);
   };
   const selectedTurnValue = selectedTurn ? `turn:${selectedTurn.runId}` : "";
+  const selectedCommitValue = selectedCommitSha !== null ? `commit:${selectedCommitSha}` : "";
   const selectedScopeValue = toolCallSelection
     ? ""
     : selectedRunId === null
-      ? selectedGitScope
+      ? selectedCommitValue || selectedGitScope
       : selectedTurn?.runId === latestTurn?.runId
         ? "latest"
         : selectedTurnValue;
   const selectScopeValue = (value: string) => {
     if (value === "unstaged" || value === "branch") {
       selectGitScope(value);
+    } else if (value === selectedCommitValue) {
+      selectGitScope("branch");
+    } else if (value.startsWith("commit:")) {
+      if (routeThreadRef) {
+        useDiffPanelStore.getState().selectCommit(routeThreadRef, value.slice("commit:".length));
+      }
     } else if (value === "latest") {
       if (latestTurn) selectTurn(latestTurn.runId);
     } else {
@@ -717,13 +787,37 @@ export default function DiffPanel({
         <DropdownMenu>
           <DropdownMenuTrigger
             render={<Button size="xs" variant="secondary" />}
-            className="max-w-full"
+            className={cn("max-w-full", headerCommitSha !== null && "min-w-0 shrink")}
             aria-label={`Diff scope: ${selectedScopeLabel}`}
             data-workspace-focus-default
           >
             <span className="truncate">{selectedScopeLabel}</span>
             <ChevronDownIcon className="size-3.5 shrink-0 opacity-70" />
           </DropdownMenuTrigger>
+          {headerCommitSha !== null ? (
+            selectedCommitUrl ? (
+              <Tooltip>
+                <TooltipTrigger
+                  render={
+                    <a
+                      href={selectedCommitUrl}
+                      target="_blank"
+                      rel="noopener noreferrer"
+                      className="shrink-0 font-mono text-xs text-muted-foreground underline underline-offset-4"
+                      onClick={(event) => openCommitUrl(event, selectedCommitUrl)}
+                    />
+                  }
+                >
+                  {headerCommitSha.slice(0, 7)}
+                </TooltipTrigger>
+                <TooltipPopup side="top">{selectedCommitUrl}</TooltipPopup>
+              </Tooltip>
+            ) : (
+              <span className="shrink-0 font-mono text-xs text-muted-foreground">
+                {headerCommitSha.slice(0, 7)}
+              </span>
+            )
+          ) : null}
           <DropdownMenuContent align="start">
             <DropdownMenuRadioGroup value={selectedScopeValue} onValueChange={selectScopeValue}>
               <DropdownMenuRadioItem value="branch" closeOnClick>
@@ -760,6 +854,99 @@ export default function DiffPanel({
                 </DropdownMenuRadioGroup>
               </DropdownMenuSubContent>
             </DropdownMenuSub>
+            <DropdownMenuSub
+              onOpenChange={(open) => {
+                setOpenCommitMenu(open ? (branchCommitsQuery.data ?? null) : null);
+                if (!open) return;
+                // The menu keeps the list it opened with; the refreshed one shows next time.
+                branchCommitsQuery.refresh();
+              }}
+            >
+              <DropdownMenuSubTrigger>Commits</DropdownMenuSubTrigger>
+              <DropdownMenuSubContent className="max-h-80 max-w-96">
+                <DropdownMenuRadioGroup
+                  value={selectedCommitValue}
+                  onValueChange={selectScopeValue}
+                >
+                  {branchCommits?.commits.map((commit) => {
+                    const commitUrl = projectCommitUrl(
+                      activeProject?.repositoryIdentity,
+                      commit.sha,
+                    );
+                    return (
+                      <div
+                        key={commit.sha}
+                        className={cn(
+                          "flex items-center rounded-sm hover:bg-accent has-data-highlighted:bg-accent has-focus-visible:bg-accent [&_[data-checked]]:bg-transparent [&_[data-highlighted]]:bg-transparent",
+                          selectedCommitSha === commit.sha && "bg-foreground/[0.08]",
+                        )}
+                      >
+                        <Tooltip>
+                          <TooltipTrigger
+                            render={
+                              <DropdownMenuRadioItem
+                                className="min-w-0 flex-1"
+                                value={`commit:${commit.sha}`}
+                                closeOnClick
+                              />
+                            }
+                          >
+                            <span className="flex items-center gap-3">
+                              <span className="min-w-0 flex-1 truncate">{commit.subject}</span>
+                              <span className="shrink-0 text-xs tabular-nums text-muted-foreground">
+                                {formatRelativeTimeLabel(commit.committedAt)}
+                              </span>
+                            </span>
+                          </TooltipTrigger>
+                          <TooltipPopup side="right" className="max-w-80">
+                            {commit.subject}
+                          </TooltipPopup>
+                        </Tooltip>
+                        {commitUrl ? (
+                          <DropdownMenuItem
+                            className="shrink-0"
+                            render={
+                              <a
+                                href={commitUrl}
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                aria-label={`Open commit ${commit.sha.slice(0, 7)}`}
+                              />
+                            }
+                            onClick={(event) => openCommitUrl(event, commitUrl)}
+                          >
+                            <span className="font-mono text-xs text-muted-foreground underline underline-offset-4">
+                              {commit.sha.slice(0, 7)}
+                            </span>
+                          </DropdownMenuItem>
+                        ) : (
+                          <span className="shrink-0 px-2 font-mono text-xs text-muted-foreground">
+                            {commit.sha.slice(0, 7)}
+                          </span>
+                        )}
+                      </div>
+                    );
+                  })}
+                </DropdownMenuRadioGroup>
+                {branchCommitsQuery.error ? (
+                  <DropdownMenuItem disabled>{branchCommitsQuery.error}</DropdownMenuItem>
+                ) : !canReadFiles ? (
+                  <DropdownMenuItem disabled>
+                    {fileAccess.isPending
+                      ? "Checking file access..."
+                      : (fileAccess.error ?? "This connection cannot read local diffs.")}
+                  </DropdownMenuItem>
+                ) : branchCommits === null ? (
+                  <DropdownMenuItem disabled>Loading commits...</DropdownMenuItem>
+                ) : branchCommits.commits.length === 0 ? (
+                  <DropdownMenuItem disabled>No commits on this branch.</DropdownMenuItem>
+                ) : branchCommits.truncated ? (
+                  <DropdownMenuItem disabled>
+                    {`Showing latest ${branchCommits.commits.length} commits`}
+                  </DropdownMenuItem>
+                ) : null}
+              </DropdownMenuSubContent>
+            </DropdownMenuSub>
           </DropdownMenuContent>
         </DropdownMenu>
         {isGitSelection && selectedGitScope === "branch" && selectedGitSource?.baseRef && (
@@ -894,7 +1081,12 @@ export default function DiffPanel({
           </div>
         )}
       </div>
-      <div className="flex shrink-0 items-center gap-1 [-webkit-app-region:no-drag]">
+      <div
+        className={cn(
+          "flex shrink-0 items-center gap-1 [-webkit-app-region:no-drag]",
+          headerCommitSha !== null && "gap-0",
+        )}
+      >
         {codeViewFiles.length > 0 || (isGitSelection && selectedGitSource?.files?.length) ? (
           <DiffStatLabel
             additions={diffLineStat.additions}
@@ -1124,7 +1316,9 @@ export default function DiffPanel({
                         ? "Loading checkpoint diff..."
                         : selectedGitScope === "unstaged"
                           ? "Loading uncommitted changes..."
-                          : "Loading changes..."
+                          : selectedGitScope === "commit"
+                            ? "Loading commit..."
+                            : "Loading changes..."
                   }
                 />
               ) : (
diff --git a/apps/web/src/components/desktop/DesktopWebLinkCoordinator.browser.test.tsx b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.browser.test.tsx
index a2a0f874d6e90..31ad2028c5f51 100644
--- a/apps/web/src/components/desktop/DesktopWebLinkCoordinator.browser.test.tsx
+++ b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.browser.test.tsx
@@ -1,11 +1,16 @@
-import { EnvironmentId, ProjectId } from "@t3tools/contracts";
-import type { Atom } from "effect/reactivity";
+import { EnvironmentId, ProjectId, ThreadId } from "@t3tools/contracts";
+import { scopeThreadRef } from "@t3tools/client-runtime/environment";
+import type { EnvironmentProject } from "@t3tools/client-runtime/state/shell";
+import { AsyncResult, type Atom } from "effect/reactivity";
 import { expect, it, vi } from "vite-plus/test";
 
 import { act, render, stubGlobal } from "../../../test/render";
 
 const state = vi.hoisted(() => ({
-  projects: [] as never[],
+  projects: [] as EnvironmentProject[],
+  routeParams: {} as Record<string, string>,
+  preview: vi.fn(),
+  openLink: vi.fn(async () => undefined),
   navigate: vi.fn(async (): Promise<void> => undefined),
   openScratchProject: vi.fn(async () => null),
   confirm: vi.fn(async (_message: string) => true),
@@ -18,7 +23,10 @@ const state = vi.hoisted(() => ({
 vi.mock(import("@tanstack/react-router"), async (original) => ({
   ...(await original()),
   useNavigate: (() => state.navigate) as never,
-  useRouter: (() => ({ navigate: state.navigate, state: { matches: [] } })) as never,
+  useRouter: (() => ({
+    navigate: state.navigate,
+    state: { matches: [{ params: state.routeParams }] },
+  })) as never,
 }));
 vi.mock(import("../../state/environments"), async (original) => ({
   ...(await original()),
@@ -47,11 +55,17 @@ vi.mock(import("../../state/server"), async (original) => {
 });
 vi.mock(import("../../state/shell"), async (original) => {
   const { Atom } = await import("effect/reactivity");
-  return { ...(await original()), allReachableShellsLiveAtom: Atom.make(false) };
+  return {
+    ...(await original()),
+    allReachableShellsLiveAtom: Atom.make(false).pipe(Atom.keepAlive),
+  };
 });
 vi.mock(import("../../state/entities"), async (original) => ({
   ...(await original()),
   readProjects: () => state.projects,
+  readThreadShell: (ref: { threadId: string }) =>
+    ref.threadId === "thread" ? ({ projectId: "effect", worktreePath: null } as never) : null,
+  readProject: () => state.projects[0] ?? null,
 }));
 vi.mock(import("../../hooks/useScratchProject"), async (original) => ({
   ...(await original()),
@@ -61,6 +75,10 @@ vi.mock(import("../../hooks/useScratchProject"), async (original) => ({
   })) as never,
 }));
 
+vi.mock("../../state/use-atom-query-runner", () => ({
+  useAtomQueryRunner: () => state.preview,
+}));
+vi.mock("../../browser/useOpenLink", () => ({ useOpenLink: () => state.openLink }));
 vi.mock(import("../../confirmDialog"), async (original) => ({
   ...(await original()),
   requestConfirmDialog: state.confirm,
@@ -82,6 +100,12 @@ vi.mock(import("../../state/use-atom-command"), async (original) => {
 
 import { AppAtomRegistryProvider, appAtomRegistry } from "../../rpc/atomRegistry";
 import { allReachableShellsLiveAtom } from "../../state/shell";
+import { selectThreadDiffPanelSelection, useDiffPanelStore } from "../../diffPanelStore";
+import {
+  selectActiveRightPanel,
+  selectActiveRightPanelSurface,
+  useRightPanelStore,
+} from "../../rightPanelStore";
 import { DesktopWebLinkCoordinator } from "./DesktopWebLinkCoordinator";
 
 const discoverySettled = allReachableShellsLiveAtom as Atom.Writable<boolean>;
@@ -89,6 +113,7 @@ const environmentId = EnvironmentId.make("local");
 const projectId = ProjectId.make("effect");
 const project = {
   id: projectId,
+  workspaceRoot: "/workspace/effect",
   environmentId,
   repositoryIdentity: {
     provider: "github",
@@ -100,7 +125,7 @@ const project = {
       remoteUrl: "https://github.com/Effect-TS/effect.git",
     },
   },
-} as never;
+} as EnvironmentProject;
 const pullRequestUrl = "https://github.com/Effect-TS/effect/pull/9339";
 const pullRequestView = {
   to: "/pull-requests",
@@ -123,6 +148,12 @@ function setup() {
   state.confirm.mockResolvedValue(true);
   state.localEnvironmentDisabled = false;
   state.projects = [];
+  state.routeParams = {};
+  state.preview
+    .mockReset()
+    .mockResolvedValue(AsyncResult.success({ sources: [{ kind: "commit", headRef: sha }] }));
+  useDiffPanelStore.setState({ byThreadKey: {}, branchBaseRefByThreadKey: {} });
+  useRightPanelStore.setState({ byThreadKey: {}, userActionRevisionByThreadKey: {} });
   appAtomRegistry.set(discoverySettled, false);
 }
 
@@ -172,6 +203,80 @@ it("holds a launch PR link until project discovery settles, then opens the PR vi
   expect(state.openScratchProject).not.toHaveBeenCalled();
 });
 
+const sha = "a".repeat(40);
+const commitUrl = `https://github.com/Effect-TS/effect/pull/9339/commits/${sha}`;
+const threadRef = scopeThreadRef(environmentId, ThreadId.make("thread"));
+
+it.each([
+  ["github.com", "pull/9339/commits"],
+  ["code.example.com:8443", "commit"],
+])("opens a %s/%s commit in the active thread's Diff pane after discovery", async (host, path) => {
+  setup();
+  state.routeParams = { environmentId: "local", threadId: "thread" };
+  await using _coordinator = await mount(`https://${host}/Effect-TS/effect/${path}/${sha}`);
+  expect(state.preview).not.toHaveBeenCalled();
+
+  state.projects = [
+    {
+      ...project,
+      repositoryIdentity: {
+        ...project.repositoryIdentity,
+        canonicalKey: `${host}/effect-ts/effect`,
+        locator: {
+          ...project.repositoryIdentity?.locator,
+          remoteUrl: `https://${host}/Effect-TS/effect.git`,
+        },
+      },
+    } as EnvironmentProject,
+  ];
+  await act(async () => appAtomRegistry.set(discoverySettled, true));
+  await vi.waitFor(() => {
+    expect(selectActiveRightPanel(useRightPanelStore.getState().byThreadKey, threadRef)).toBe(
+      "diff",
+    );
+  });
+  expect(
+    selectThreadDiffPanelSelection(useDiffPanelStore.getState().byThreadKey, threadRef),
+  ).toMatchObject({ kind: "commit", sha });
+  expect(state.preview).toHaveBeenCalledExactlyOnceWith({
+    environmentId,
+    input: expect.objectContaining({ cwd: "/workspace/effect", commitSha: sha }),
+  });
+  expect(state.navigate).not.toHaveBeenCalled();
+  expect(state.openLink).not.toHaveBeenCalled();
+});
+
+it("opens a PR commit the workspace lacks in the thread's PR panel", async () => {
+  setup();
+  state.routeParams = { environmentId: "local", threadId: "thread" };
+  state.projects = [project];
+  state.preview.mockResolvedValueOnce(AsyncResult.success({ sources: [] }));
+  appAtomRegistry.set(discoverySettled, true);
+  await using _coordinator = await mount(commitUrl);
+  await vi.waitFor(() =>
+    expect(
+      selectActiveRightPanelSurface(useRightPanelStore.getState().byThreadKey, threadRef),
+    ).toMatchObject({ kind: "pull-request", repository: "effect-ts/effect", number: 9339 }),
+  );
+  expect(useDiffPanelStore.getState().byThreadKey).toEqual({});
+  expect(state.openLink).not.toHaveBeenCalled();
+});
+
+it("opens a plain commit the workspace lacks like any other delivered link", async () => {
+  setup();
+  state.routeParams = { environmentId: "local", threadId: "thread" };
+  state.projects = [project];
+  state.preview.mockResolvedValueOnce(AsyncResult.success({ sources: [] }));
+  appAtomRegistry.set(discoverySettled, true);
+  const plainCommitUrl = `https://github.com/Effect-TS/effect/commit/${sha}`;
+  await using _coordinator = await mount(plainCommitUrl);
+  await vi.waitFor(() => expect(state.openScratchProject).toHaveBeenCalledOnce());
+  // Handing it to the OS browser would loop when T3 Code is the default browser.
+  expect(state.openLink).not.toHaveBeenCalled();
+  expect(useDiffPanelStore.getState().byThreadKey).toEqual({});
+  expect(useRightPanelStore.getState().byThreadKey).toEqual({});
+});
+
 it("adds the backend from a pairing link after the user confirms its host", async () => {
   setup();
   await using _coordinator = await mount(pairLink);
diff --git a/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx
index 4ae0b6cdb25b4..ddd892d02bd12 100644
--- a/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx
+++ b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx
@@ -27,6 +27,7 @@ import { selectActiveRightPanelSurface, useRightPanelStore } from "../../rightPa
 import { appAtomRegistry } from "../../rpc/atomRegistry";
 import { resolveThreadRouteTarget } from "../../threadRoutes";
 import { assetEnvironment } from "../../state/assets";
+import { readProject, readThreadShell } from "../../state/entities";
 import { useEnvironmentHttpBaseUrl, usePrimaryEnvironment } from "../../state/environments";
 import { previewEnvironment } from "../../state/preview";
 import { allReachableShellsLiveAtom } from "../../state/shell";
@@ -163,25 +164,14 @@ export function DesktopWebLinkCoordinator() {
     return threadRef;
   };
 
-  const openLink = useEffectEvent(async (url: string) => {
-    const pairingUrl = readPairingAppLink(url);
-    if (pairingUrl !== null) {
-      await pairFromLink(pairingUrl);
-      return;
-    }
-    const appPath = promptLinkAppPath(url);
-    if (appPath !== null) {
-      await router.navigate({ href: appPath });
-      return;
-    }
-    if (openChangeRequest(externalClick, url)) return;
+  const openInBrowser = useEffectEvent(async (url: string) => {
+    const routeParams = router.state.matches.at(-1)?.params ?? {};
     const isFile = url.startsWith("file:");
     // Only this machine's environment serves files, so fail before starting a thread.
     if (isFile && httpBaseUrl === null) {
       reportFailure(url);
       return;
     }
-    const routeParams = router.state.matches.at(-1)?.params ?? {};
     const threadRef =
       threadShowingBrowser(
         routeParams,
@@ -210,15 +200,49 @@ export function DesktopWebLinkCoordinator() {
     }
   });
 
+  const openLink = useEffectEvent(async (url: string) => {
+    const pairingUrl = readPairingAppLink(url);
+    if (pairingUrl !== null) {
+      await pairFromLink(pairingUrl);
+      return;
+    }
+    const appPath = promptLinkAppPath(url);
+    if (appPath !== null) {
+      await router.navigate({ href: appPath });
+      return;
+    }
+    const routeParams = router.state.matches.at(-1)?.params ?? {};
+    const routeTarget = resolveThreadRouteTarget(routeParams);
+    const activeThreadRef = routeTarget?.kind === "server" ? routeTarget.threadRef : undefined;
+    const activeThread = activeThreadRef ? readThreadShell(activeThreadRef) : null;
+    const activeProject =
+      activeThread && activeThreadRef
+        ? readProject(scopeProjectRef(activeThreadRef.environmentId, activeThread.projectId))
+        : null;
+    const commitThreadRef =
+      activeThread &&
+      sourceControlClients.parseCommitUrl(url, activeProject?.repositoryIdentity?.provider) !== null
+        ? activeThreadRef
+        : undefined;
+    // A commit the thread's workspace lacks continues here, after its lookup.
+    const openUnavailableCommit = () => {
+      queueRef.current = queueRef.current.then(() => openInBrowser(url)).catch(() => undefined);
+    };
+    if (openChangeRequest(externalClick, url, commitThreadRef, undefined, openUnavailableCommit))
+      return;
+    await openInBrowser(url);
+  });
+
   const receiveLink = useEffectEvent((url: string) => {
-    // A connected server publishes its config before its project snapshot, so a PR link
-    // delivered at launch would miss its project and fall through to the browser. Hold PR
-    // links, and only those, until discovery settles; an ordinary link never waits for it.
+    // A connected server publishes its config before its project snapshot, so a source control
+    // link delivered at launch would miss its project and fall through to the browser. Hold
+    // those links until discovery settles; an ordinary link never waits for it.
     // Discovery never settles without the local environment, so those links do not wait.
     const hold =
       openPullRequestsInApp &&
       !localEnvironmentDisabled &&
-      sourceControlClients.parseChangeRequestUrl(url) !== null
+      (sourceControlClients.parseChangeRequestUrl(url) !== null ||
+        sourceControlClients.parseCommitUrl(url) !== null)
         ? projectsSettled()
         : Promise.resolve();
     void hold.then(() => {
diff --git a/apps/web/src/components/diffs/useReviewFilePatches.ts b/apps/web/src/components/diffs/useReviewFilePatches.ts
index b683e13a8f6ee..69dafc2dd7823 100644
--- a/apps/web/src/components/diffs/useReviewFilePatches.ts
+++ b/apps/web/src/components/diffs/useReviewFilePatches.ts
@@ -193,6 +193,7 @@ function reviewFileQueries({
                 request: {
                   cwd,
                   ...(baseRef ? { baseRef } : {}),
+                  ...(source.kind === "commit" ? { commitSha: source.id } : {}),
                   ignoreWhitespace,
                   file: {
                     path: file.path,
diff --git a/apps/web/src/components/settings/settingsSearch.ts b/apps/web/src/components/settings/settingsSearch.ts
index dc494caf5344d..aabfd0300eda5 100644
--- a/apps/web/src/components/settings/settingsSearch.ts
+++ b/apps/web/src/components/settings/settingsSearch.ts
@@ -923,7 +923,7 @@ export const SETTINGS_SEARCH_ITEMS = [
     title: "Open pull requests in T3 Code",
     to: "/settings/diffs",
     searchTerms: [
-      `pr links ${SOURCE_CONTROL_HOST_LABELS} browser external click default pull request view panel`,
+      `pr commit links ${SOURCE_CONTROL_HOST_LABELS} browser external click default pull request view panel`,
     ],
   },
   {
diff --git a/apps/web/src/diffPanelStore.ts b/apps/web/src/diffPanelStore.ts
index 11d96a3909ce7..6bd7eb0e01bdd 100644
--- a/apps/web/src/diffPanelStore.ts
+++ b/apps/web/src/diffPanelStore.ts
@@ -17,6 +17,7 @@ export type DiffPanelSelection =
   | ({ kind: "tool-call" } & ToolCallDiffTarget)
   | { kind: "branch"; baseRef: string | null }
   | { kind: "unstaged" }
+  | { kind: "commit"; sha: string; baseRef: string | null }
   | { kind: "turn"; turnId: RunId; filePath: string | null; revealRequestId: number };
 
 const DEFAULT_SELECTION: DiffPanelSelection = { kind: "branch", baseRef: null };
@@ -24,10 +25,14 @@ const DEFAULT_SELECTION: DiffPanelSelection = { kind: "branch", baseRef: null };
 interface DiffPanelStoreState {
   byThreadKey: Record<string, DiffPanelSelection>;
   branchBaseRefByThreadKey: Record<string, string | null>;
+  /** A link that selected a commit before opening the closed pane; opening keeps that selection. */
+  keepSelectionOnOpenThreadKey: string | null;
   selectGitScope: (ref: ScopedThreadRef, scope: "branch" | "unstaged") => void;
   selectBranchBaseRef: (ref: ScopedThreadRef, baseRef: string | null) => void;
   selectToolCall: (ref: ScopedThreadRef, target: ToolCallDiffTarget) => void;
   selectTurn: (ref: ScopedThreadRef, turnId: RunId, filePath?: string) => void;
+  selectCommit: (ref: ScopedThreadRef, sha: string, keepOnOpen?: boolean) => void;
+  consumeKeepSelectionOnOpen: (ref: ScopedThreadRef) => boolean;
   reconcileTurnSelection: (ref: ScopedThreadRef, availableTurnIds: ReadonlyArray<RunId>) => void;
   removeThread: (ref: ScopedThreadRef) => void;
 }
@@ -37,19 +42,27 @@ function normalizeBaseRef(baseRef: string | null): string | null {
   return normalized ? normalized : null;
 }
 
+function branchBaseRef(
+  state: Pick<DiffPanelStoreState, "byThreadKey" | "branchBaseRefByThreadKey">,
+  threadKey: string,
+): string | null {
+  const previous = state.byThreadKey[threadKey];
+  return previous?.kind === "branch" || previous?.kind === "commit"
+    ? previous.baseRef
+    : (state.branchBaseRefByThreadKey[threadKey] ?? null);
+}
+
 export const useDiffPanelStore = create<DiffPanelStoreState>()(
   persist(
-    (set) => ({
+    (set, get) => ({
       byThreadKey: {},
       branchBaseRefByThreadKey: {},
+      keepSelectionOnOpenThreadKey: null,
       selectGitScope: (ref, scope) =>
         set((state) => {
           const threadKey = scopedThreadKey(ref);
           const previous = state.byThreadKey[threadKey];
-          const previousBaseRef =
-            previous?.kind === "branch"
-              ? previous.baseRef
-              : (state.branchBaseRefByThreadKey[threadKey] ?? null);
+          const previousBaseRef = branchBaseRef(state, threadKey);
           return {
             byThreadKey: {
               ...state.byThreadKey,
@@ -59,7 +72,7 @@ export const useDiffPanelStore = create<DiffPanelStoreState>()(
                   : { kind: "unstaged" },
             },
             branchBaseRefByThreadKey:
-              previous?.kind === "branch"
+              previous?.kind === "branch" || previous?.kind === "commit"
                 ? { ...state.branchBaseRefByThreadKey, [threadKey]: previous.baseRef }
                 : state.branchBaseRefByThreadKey,
           };
@@ -102,6 +115,26 @@ export const useDiffPanelStore = create<DiffPanelStoreState>()(
             },
           };
         }),
+      selectCommit: (ref, sha, keepOnOpen = false) =>
+        set((state) => {
+          const threadKey = scopedThreadKey(ref);
+          const baseRef = branchBaseRef(state, threadKey);
+          return {
+            byThreadKey: {
+              ...state.byThreadKey,
+              [threadKey]: { kind: "commit", sha, baseRef },
+            },
+            branchBaseRefByThreadKey: { ...state.branchBaseRefByThreadKey, [threadKey]: baseRef },
+            keepSelectionOnOpenThreadKey: keepOnOpen
+              ? threadKey
+              : state.keepSelectionOnOpenThreadKey,
+          };
+        }),
+      consumeKeepSelectionOnOpen: (ref) => {
+        if (get().keepSelectionOnOpenThreadKey !== scopedThreadKey(ref)) return false;
+        set({ keepSelectionOnOpenThreadKey: null });
+        return true;
+      },
       reconcileTurnSelection: (ref, availableTurnIds) =>
         set((state) => {
           const threadKey = scopedThreadKey(ref);
@@ -178,6 +211,13 @@ export function selectThreadDiffPanelSelection(
   return byThreadKey[scopedThreadKey(ref)] ?? DEFAULT_SELECTION;
 }
 
+export function selectThreadBranchBaseRef(
+  state: Pick<DiffPanelStoreState, "byThreadKey" | "branchBaseRefByThreadKey">,
+  ref: ScopedThreadRef | null | undefined,
+): string | null {
+  return ref ? branchBaseRef(state, scopedThreadKey(ref)) : null;
+}
+
 export function resolveToolCallDiffTarget(
   target: ToolCallDiffTarget,
   items: ReadonlyArray<ThreadStructureVisibleTurnItem>,
diff --git a/apps/web/src/lib/openPullRequestLink.browser.test.tsx b/apps/web/src/lib/openPullRequestLink.browser.test.tsx
new file mode 100644
index 0000000000000..a93f32a8902f7
--- /dev/null
+++ b/apps/web/src/lib/openPullRequestLink.browser.test.tsx
@@ -0,0 +1,160 @@
+import { EnvironmentId, ThreadId } from "@t3tools/contracts";
+import { scopeThreadRef, scopedThreadKey } from "@t3tools/client-runtime/environment";
+import { AsyncResult } from "effect/reactivity";
+import { expect, it, vi } from "vite-plus/test";
+import { page } from "vite-plus/test/browser";
+
+import { act, render, stubGlobal } from "../../test/render";
+
+const state = vi.hoisted(() => ({ preview: vi.fn(), openLink: vi.fn() }));
+vi.mock("../state/use-atom-query-runner", () => ({ useAtomQueryRunner: () => state.preview }));
+vi.mock("../browser/useOpenLink", () => ({ useOpenLink: () => state.openLink }));
+vi.mock(import("../state/environments"), async (original) => ({
+  ...(await original()),
+  usePrimaryEnvironmentId: () => EnvironmentId.make("local"),
+}));
+vi.mock("../state/entities", async (original) => ({
+  ...(await original<typeof import("../state/entities")>()),
+  readProjects: () => [project],
+  useProjects: () => [project],
+  readProject: () => project,
+  readThreadShell: () => ({ projectId: "project", worktreePath: null }),
+}));
+vi.mock("../state/server", async (original) => {
+  const { Atom } = await import("effect/reactivity");
+  return {
+    ...(await original<typeof import("../state/server")>()),
+    environmentServerConfigsAtom: Atom.make(new Map([["local", {}]])),
+  };
+});
+
+import { DEFAULT_CLIENT_SETTINGS } from "@t3tools/contracts/settings";
+import { __setClientSettingsForTests } from "../hooks/useSettings";
+import { ToastProvider } from "../components/ui/toast";
+import { AppAtomRegistryProvider } from "../rpc/atomRegistry";
+import { useRightPanelStore } from "../rightPanelStore";
+import { useDiffPanelStore } from "../diffPanelStore";
+import { useOpenChangeRequestLink } from "./openPullRequestLink";
+
+const environmentId = EnvironmentId.make("local");
+const threadRef = scopeThreadRef(environmentId, ThreadId.make("thread"));
+const project = {
+  id: "project",
+  environmentId,
+  workspaceRoot: "/repo",
+  repositoryIdentity: {
+    provider: "github",
+    canonicalKey: "github.com/effect-ts/effect",
+    displayName: "Effect-TS/effect",
+    locator: {
+      source: "git-remote",
+      remoteName: "origin",
+      remoteUrl: "https://github.com/Effect-TS/effect.git",
+    },
+  },
+};
+const commitUrl = `https://github.com/Effect-TS/effect/commit/${"a".repeat(40)}?plain=1#diff-original`;
+const pullRequestCommitUrl = `https://github.com/Effect-TS/effect/pull/1/commits/${"a".repeat(40)}`;
+
+function CommitLink({ url = commitUrl }: { url?: string }) {
+  const open = useOpenChangeRequestLink(threadRef);
+  return (
+    <a href={url} onClick={(event) => open(event, url)}>
+      Commit
+    </a>
+  );
+}
+
+function setup() {
+  state.preview.mockReset().mockResolvedValue(AsyncResult.success({ sources: [] }));
+  state.openLink.mockReset().mockResolvedValue(undefined);
+  __setClientSettingsForTests({
+    ...DEFAULT_CLIENT_SETTINGS,
+    pullRequestLinksOpenInApp: true,
+    browserLinkTarget: "system",
+  });
+  useDiffPanelStore.setState({
+    byThreadKey: {},
+    branchBaseRefByThreadKey: {},
+    keepSelectionOnOpenThreadKey: null,
+  });
+  useRightPanelStore.setState({ byThreadKey: {}, userActionRevisionByThreadKey: {} });
+}
+
+it.each([
+  ["shiftKey", commitUrl],
+  ["altKey", commitUrl],
+  ["shiftKey", pullRequestCommitUrl],
+] as const)("keeps %s clicks on %s native", async (modifier, url) => {
+  setup();
+  await using screen = await render(
+    <AppAtomRegistryProvider>
+      <CommitLink url={url} />
+    </AppAtomRegistryProvider>,
+  );
+  const event = new MouseEvent("click", { bubbles: true, cancelable: true, [modifier]: true });
+  const defaults: boolean[] = [];
+  screen.container.addEventListener(
+    "click",
+    (nativeEvent) => {
+      defaults.push(nativeEvent.defaultPrevented);
+      nativeEvent.preventDefault();
+    },
+    { once: true },
+  );
+  await act(() => screen.getByRole("link", { name: "Commit" }).element().dispatchEvent(event));
+  expect(defaults).toEqual([false]);
+  expect(state.preview).not.toHaveBeenCalled();
+  expect(useRightPanelStore.getState().byThreadKey).toEqual({});
+});
+
+it.each(["system", "app"] as const)(
+  "offers the original unavailable commit URL when web popups are blocked (%s)",
+  async (browserLinkTarget) => {
+    setup();
+    // Without preview access, the "app" preference opens a popup too.
+    __setClientSettingsForTests({
+      ...DEFAULT_CLIENT_SETTINGS,
+      pullRequestLinksOpenInApp: true,
+      browserLinkTarget,
+    });
+    using _desktop = stubGlobal("desktopBridge", undefined);
+    await using screen = await render(
+      <AppAtomRegistryProvider>
+        <ToastProvider>
+          <CommitLink />
+        </ToastProvider>
+      </AppAtomRegistryProvider>,
+    );
+    using open = vi.spyOn(window, "open").mockReturnValue(null);
+    await screen.getByRole("link", { name: "Commit" }).click();
+    await expect
+      .element(page.getByRole("button", { name: "Open link", exact: true }))
+      .toBeVisible();
+    expect(open).not.toHaveBeenCalled();
+    await page.getByRole("button", { name: "Open link", exact: true }).click();
+    expect(open).toHaveBeenCalledExactlyOnceWith(commitUrl, "_blank", "noopener,noreferrer");
+    expect(state.openLink).not.toHaveBeenCalled();
+  },
+);
+
+it("opens an available commit in the closed Diff pane without the pane resetting it", async () => {
+  setup();
+  const sha = "a".repeat(40);
+  state.preview.mockResolvedValue(
+    AsyncResult.success({ sources: [{ kind: "commit", headRef: sha }] }),
+  );
+  await using screen = await render(
+    <AppAtomRegistryProvider>
+      <CommitLink />
+    </AppAtomRegistryProvider>,
+  );
+  await screen.getByRole("link", { name: "Commit" }).click();
+  await vi.waitFor(() =>
+    expect(useDiffPanelStore.getState().byThreadKey).toEqual({
+      [scopedThreadKey(threadRef)]: { kind: "commit", sha, baseRef: null },
+    }),
+  );
+  // ChatView resets a pane opened without an explicit request to Changes unless this is set.
+  expect(useDiffPanelStore.getState().consumeKeepSelectionOnOpen(threadRef)).toBe(true);
+});
diff --git a/apps/web/src/lib/openPullRequestLink.ts b/apps/web/src/lib/openPullRequestLink.ts
index 014728f058a43..31c04b6263e5f 100644
--- a/apps/web/src/lib/openPullRequestLink.ts
+++ b/apps/web/src/lib/openPullRequestLink.ts
@@ -8,15 +8,25 @@ import {
   resolvePullRequestPreviewTarget,
 } from "@t3tools/client-runtime/change-request-links";
 
+import { sourceControlClients } from "@t3tools/client-runtime/source-control-clients";
+
+import { canOpenLinksInApp } from "../browser/browserLinkTarget";
 import { useOpenLink } from "../browser/useOpenLink";
 import { useClientSettings } from "../hooks/useSettings";
 import { stackedThreadToast, toastManager } from "../components/ui/toast";
-import { useRightPanelStore } from "../rightPanelStore";
+import { selectActiveRightPanel, useRightPanelStore } from "../rightPanelStore";
+import {
+  selectThreadBranchBaseRef,
+  selectThreadDiffPanelSelection,
+  useDiffPanelStore,
+} from "../diffPanelStore";
 
 import { appAtomRegistry } from "../rpc/atomRegistry";
-import { readProjects, useProjects } from "../state/entities";
+import { readProject, readProjects, readThreadShell, useProjects } from "../state/entities";
 import { environmentServerConfigsAtom, serverEnvironment } from "../state/server";
 import { usePrimaryEnvironmentId } from "../state/environments";
+import { reviewEnvironment } from "../state/review";
+import { useAtomQueryRunner } from "../state/use-atom-query-runner";
 
 export function usePullRequestPreviewTarget(environmentId: EnvironmentId | null, url: string) {
   const projects = useProjects();
@@ -43,71 +53,178 @@ export function useOpenChangeRequestLink(
   event: Pick<
     MouseEvent<HTMLElement>,
     "preventDefault" | "stopPropagation" | "metaKey" | "ctrlKey"
-  >,
+  > &
+    Partial<Pick<MouseEvent<HTMLElement>, "button" | "shiftKey" | "altKey">>,
   targetUrl: string,
   targetThreadRef?: ScopedThreadRef,
   targetEnvironmentId?: EnvironmentId,
+  onCommitUnavailable?: () => void,
 ) => boolean {
   const navigate = useNavigate();
   const primaryEnvironmentId = usePrimaryEnvironmentId();
   const openInApp = useClientSettings((settings) => settings.pullRequestLinksOpenInApp);
-  return (event, targetUrl, targetThreadRef, targetEnvironmentId) => {
+  const ignoreWhitespace = useClientSettings((settings) => settings.diffIgnoreWhitespace);
+  const browserLinkTarget = useClientSettings((settings) => settings.browserLinkTarget);
+  const readDiffPreview = useAtomQueryRunner(reviewEnvironment.diffPreview, {
+    reportFailure: false,
+    refresh: true,
+  });
+  const openLink = useOpenLink(threadRef);
+  return (event, targetUrl, targetThreadRef, targetEnvironmentId, onCommitUnavailable) => {
     if (!openInApp || shouldOpenPullRequestExternally(event)) return false;
-    // Read at click time: every provider status push replaces the config map, and
-    // subscribing would hand every rendered link a new handler. Projects likewise, so a
-    // link can resolve against a snapshot that arrived after this handler was built.
-    const serverConfigs = appAtomRegistry.get(environmentServerConfigsAtom);
     const resolvedThreadRef = targetThreadRef ?? threadRef;
     const resolvedPanelRef = panelRef ?? resolvedThreadRef;
-    const target = resolveChangeRequestLinkTarget({
-      url: targetUrl,
-      projects: readProjects(),
-      configLoaded: (environmentId) => serverConfigs.has(environmentId),
-      environmentId: resolvedThreadRef?.environmentId ?? targetEnvironmentId,
-      primaryEnvironmentId,
-      lendHostProject: resolvedPanelRef !== undefined,
-    });
-    if (target === null) return false;
-    const { project, repository, number, host } = target;
-    event.preventDefault();
-    event.stopPropagation();
-    const pullRequestsSearch = {
-      repository,
-      number,
-      ...(host === undefined ? {} : { selectedHost: host }),
-      selectedProjectId: project.id,
-      selectedEnvironmentId: project.environmentId,
-    };
-    if (resolvedPanelRef) {
-      useRightPanelStore.getState().openPullRequest(resolvedPanelRef, {
-        // The standalone PR panel has a synthetic ref; each tab keeps its real environment.
-        ...(resolvedPanelRef.environmentId === project.environmentId
-          ? {}
-          : { environmentId: project.environmentId }),
-        projectId: project.id,
-        ...(host === undefined ? {} : { host }),
-        repository,
+    const openPullRequest = () => {
+      // Read at click time: every provider status push replaces the config map, and
+      // subscribing would hand every rendered link a new handler. Projects likewise, so a
+      // link can resolve against a snapshot that arrived after this handler was built.
+      const serverConfigs = appAtomRegistry.get(environmentServerConfigsAtom);
+      const target = resolveChangeRequestLinkTarget({
         url: targetUrl,
-        number,
+        projects: readProjects(),
+        configLoaded: (environmentId) => serverConfigs.has(environmentId),
+        environmentId: resolvedThreadRef?.environmentId ?? targetEnvironmentId,
+        primaryEnvironmentId,
+        lendHostProject: resolvedPanelRef !== undefined,
       });
-      if (!resolvedThreadRef) {
-        void navigate({
-          to: "/pull-requests",
-          search: (previous) => ({
-            ...previous,
-            involvement: previous.involvement ?? "all",
-            state: previous.state ?? "all",
-            ...pullRequestsSearch,
-          }),
-          replace: true,
+      if (target === null) return false;
+      const { project, repository, number, host } = target;
+      const pullRequestsSearch = {
+        repository,
+        number,
+        ...(host === undefined ? {} : { selectedHost: host }),
+        selectedProjectId: project.id,
+        selectedEnvironmentId: project.environmentId,
+      };
+      if (resolvedPanelRef) {
+        useRightPanelStore.getState().openPullRequest(resolvedPanelRef, {
+          // The standalone PR panel has a synthetic ref; each tab keeps its real environment.
+          ...(resolvedPanelRef.environmentId === project.environmentId
+            ? {}
+            : { environmentId: project.environmentId }),
+          projectId: project.id,
+          ...(host === undefined ? {} : { host }),
+          repository,
+          url: targetUrl,
+          number,
         });
+        if (!resolvedThreadRef) {
+          void navigate({
+            to: "/pull-requests",
+            search: (previous) => ({
+              ...previous,
+              involvement: previous.involvement ?? "all",
+              state: previous.state ?? "all",
+              ...pullRequestsSearch,
+            }),
+            replace: true,
+          });
+        }
+        return true;
       }
+      void navigate({
+        to: "/pull-requests",
+        search: { involvement: "all", state: "all", ...pullRequestsSearch },
+      });
+      return true;
+    };
+    const commitThread = resolvedThreadRef ? readThreadShell(resolvedThreadRef) : null;
+    const commitProject =
+      commitThread && resolvedThreadRef
+        ? readProject({
+            environmentId: resolvedThreadRef.environmentId,
+            projectId: commitThread.projectId,
+          })
+        : null;
+    const identity = commitProject?.repositoryIdentity;
+    const parsedCommit = sourceControlClients.parseCommitUrl(targetUrl, identity?.provider);
+    // Shift and Alt keep their browser meaning (new window, download) on commit links.
+    if (parsedCommit !== null && (event.shiftKey || event.altKey)) return false;
+    if (
+      parsedCommit !== null &&
+      commitThread &&
+      resolvedThreadRef &&
+      commitProject?.environmentId === resolvedThreadRef.environmentId &&
+      identity &&
+      identity.provider === parsedCommit.definition.kind &&
+      parsedCommit.definition.isChangeRequestInRepository(identity, parsedCommit.link)
+    ) {
+      const commit = parsedCommit.link;
+      event.preventDefault();
+      event.stopPropagation();
+      const userActionRevision = useRightPanelStore.getState().markUserAction(resolvedThreadRef);
+      const baseRef = selectThreadBranchBaseRef(useDiffPanelStore.getState(), resolvedThreadRef);
+      const selection = selectThreadDiffPanelSelection(
+        useDiffPanelStore.getState().byThreadKey,
+        resolvedThreadRef,
+      );
+      void readDiffPreview({
+        environmentId: resolvedThreadRef.environmentId,
+        input: {
+          cwd: commitThread.worktreePath ?? commitProject.workspaceRoot,
+          ...(baseRef ? { baseRef } : {}),
+          commitSha: commit.sha,
+          ignoreWhitespace,
+        },
+      })
+        .then((result) => {
+          if (
+            useRightPanelStore.getState().getUserActionRevision(resolvedThreadRef) !==
+              userActionRevision ||
+            selectThreadDiffPanelSelection(
+              useDiffPanelStore.getState().byThreadKey,
+              resolvedThreadRef,
+            ) !== selection
+          )
+            return;
+          if (
+            result._tag === "Success" &&
+            result.value.sources.some(
+              (source) => source.kind === "commit" && source.headRef === commit.sha,
+            )
+          ) {
+            const diffOpen =
+              selectActiveRightPanel(
+                useRightPanelStore.getState().byThreadKey,
+                resolvedThreadRef,
+              ) === "diff";
+            useDiffPanelStore.getState().selectCommit(resolvedThreadRef, commit.sha, !diffOpen);
+            useRightPanelStore.getState().open(resolvedThreadRef, "diff");
+            return;
+          }
+          if (openPullRequest()) return;
+          if (onCommitUnavailable) return onCommitUnavailable();
+          // A popup opened after the lookup has lost the click's activation, so browsers block it.
+          if (
+            window.desktopBridge === undefined &&
+            (browserLinkTarget !== "app" || !canOpenLinksInApp(resolvedThreadRef))
+          ) {
+            const toastId = toastManager.add(
+              stackedThreadToast({
+                type: "info",
+                title: "This commit is not in the thread's workspace",
+                actionProps: {
+                  children: "Open link",
+                  onClick: () => {
+                    toastManager.close(toastId);
+                    window.open(targetUrl, "_blank", "noopener,noreferrer");
+                  },
+                },
+              }),
+            );
+            return;
+          }
+          return openLink(targetUrl, {
+            event: { metaKey: event.metaKey, ctrlKey: event.ctrlKey, button: event.button },
+            threadRef: resolvedThreadRef,
+          });
+        })
+        .catch((error: unknown) => console.error(error));
       return true;
     }
-    void navigate({
-      to: "/pull-requests",
-      search: { involvement: "all", state: "all", ...pullRequestsSearch },
-    });
+    if (!openPullRequest()) return false;
+    event.preventDefault();
+    event.stopPropagation();
     return true;
   };
 }
diff --git a/apps/web/src/rightPanelStore.ts b/apps/web/src/rightPanelStore.ts
index 33c537a3cf942..ea043c0298bdb 100644
--- a/apps/web/src/rightPanelStore.ts
+++ b/apps/web/src/rightPanelStore.ts
@@ -109,6 +109,7 @@ interface RightPanelStoreState {
   userActionRevisionByThreadKey: Record<string, number>;
   closeRevisionByThreadKey: Record<string, number>;
   getUserActionRevision: (ref: ScopedThreadRef) => number;
+  markUserAction: (ref: ScopedThreadRef) => number;
   /** Refused if the user chose a panel after expectedUserActionRevision was read. */
   openProactive: (
     ref: ScopedThreadRef,
@@ -598,6 +599,16 @@ export const useRightPanelStore = create<RightPanelStoreState>()(
       closeRevisionByThreadKey: {},
       getUserActionRevision: (ref) =>
         get().userActionRevisionByThreadKey[scopedThreadKey(ref)] ?? 0,
+      markUserAction: (ref) => {
+        const revision = get().getUserActionRevision(ref) + 1;
+        set((state) => ({
+          userActionRevisionByThreadKey: {
+            ...state.userActionRevisionByThreadKey,
+            [scopedThreadKey(ref)]: revision,
+          },
+        }));
+        return revision;
+      },
       openProactive: (ref, request, expectedUserActionRevision, activateExisting = false) => {
         let opened = false;
         set((state) => {
diff --git a/docs/user/source-control.md b/docs/user/source-control.md
index 815e5dd0668fa..9eb2751f9315f 100644
--- a/docs/user/source-control.md
+++ b/docs/user/source-control.md
@@ -10,6 +10,16 @@ rebases, the files Git brought in are left out. A file stays in the list when th
 committed it, or fixed a conflict in it. Use the branch comparison to review everything that changed
 against your base branch. Restore still returns the complete saved workspace.
 
+On web and desktop, open the Diff pane source picker and choose **Commits** to review one local
+commit at a time. The list shows the newest 100 commits in the branch comparison. A merge commit
+shows its changes against its first parent.
+
+A commit link from a supported code host opens in the Diff pane when the thread's repository has
+that commit locally, on any branch. Otherwise a pull request commit link opens the pull request. Other
+commit links follow your **Open links in** setting; on web, when that opens a new tab, T3 Code first
+shows an **Open link** button. Command/Ctrl+Click always opens the link in your browser. Commit links follow the **Open pull requests in T3 Code**
+setting in **Settings → Diffs**.
+
 ## Connect an account
 
 Install Git and configure authentication on the machine running your T3 Code server. For a remote
diff --git a/packages/client-runtime/src/changeRequestLinks.ts b/packages/client-runtime/src/changeRequestLinks.ts
index 2983647f3e26f..76f60a5953f2b 100644
--- a/packages/client-runtime/src/changeRequestLinks.ts
+++ b/packages/client-runtime/src/changeRequestLinks.ts
@@ -150,3 +150,21 @@ export function projectChangeRequestUrl(
     ...(ownRepository && identity.webUrl !== undefined ? { webUrl: identity.webUrl } : {}),
   });
 }
+
+export function projectCommitUrl(
+  identity: RepositoryIdentity | null | undefined,
+  sha: string,
+): string | null {
+  if (identity?.provider === undefined) return null;
+  const [host, ...path] = identity.canonicalKey.split("/");
+  if (!host) return null;
+  return (
+    sourceControlClients.get(identity.provider).commitUrl?.({
+      host,
+      repository: path.join("/"),
+      sha,
+      remoteUrl: identity.locator.remoteUrl.trim(),
+      ...(identity.webUrl !== undefined ? { webUrl: identity.webUrl } : {}),
+    }) ?? null
+  );
+}
diff --git a/packages/client-runtime/src/state/review.ts b/packages/client-runtime/src/state/review.ts
index 691212aedd501..6700be9af657a 100644
--- a/packages/client-runtime/src/state/review.ts
+++ b/packages/client-runtime/src/state/review.ts
@@ -51,6 +51,11 @@ export function createReviewEnvironmentAtoms<R, E>(
     });
   });
   return {
+    branchCommits: createEnvironmentRpcQueryAtomFamily(runtime, {
+      label: "environment-data:review:branch-commits",
+      tag: WS_METHODS.reviewGetBranchCommits,
+      staleTimeMs: 5_000,
+    }),
     diffPreview,
     diffFilePatch: createEnvironmentQueryAtomFamily(runtime, {
       label: "environment-data:review:diff-file-patch",
diff --git a/packages/contracts/src/review.ts b/packages/contracts/src/review.ts
index 5a95442917c9a..a40bddfc1e33e 100644
--- a/packages/contracts/src/review.ts
+++ b/packages/contracts/src/review.ts
@@ -6,18 +6,41 @@ import { VcsError } from "./vcs.ts";
 export const ReviewDiffPreviewInput = Schema.Struct({
   cwd: TrimmedNonEmptyString,
   baseRef: Schema.optional(TrimmedNonEmptyString),
+  commitSha: Schema.optional(TrimmedNonEmptyString),
   ignoreWhitespace: Schema.optionalKey(Schema.Boolean),
   file: Schema.optionalKey(
     Schema.Struct({
       path: Schema.NonEmptyString,
       previousPath: Schema.NullOr(Schema.NonEmptyString),
-      sourceKind: Schema.Literals(["working-tree", "branch-range"]),
+      sourceKind: Schema.Literals(["working-tree", "branch-range", "commit"]),
     }),
   ),
 });
 export type ReviewDiffPreviewInput = typeof ReviewDiffPreviewInput.Type;
 
-export const ReviewDiffPreviewSourceKind = Schema.Literals(["working-tree", "branch-range"]);
+export const ReviewBranchCommitsInput = Schema.Struct({
+  cwd: TrimmedNonEmptyString,
+  baseRef: Schema.optional(TrimmedNonEmptyString),
+});
+export type ReviewBranchCommitsInput = typeof ReviewBranchCommitsInput.Type;
+
+export const ReviewBranchCommitsResult = Schema.Struct({
+  commits: Schema.Array(
+    Schema.Struct({
+      sha: Schema.String,
+      subject: Schema.String,
+      committedAt: Schema.String,
+    }),
+  ),
+  truncated: Schema.Boolean,
+});
+export type ReviewBranchCommitsResult = typeof ReviewBranchCommitsResult.Type;
+
+export const ReviewDiffPreviewSourceKind = Schema.Literals([
+  "working-tree",
+  "branch-range",
+  "commit",
+]);
 export type ReviewDiffPreviewSourceKind = typeof ReviewDiffPreviewSourceKind.Type;
 
 export const ReviewDiffFileStat = Schema.Struct({
@@ -32,6 +55,7 @@ export const ReviewDiffPreviewSource = Schema.Struct({
   id: TrimmedNonEmptyString,
   kind: ReviewDiffPreviewSourceKind,
   title: TrimmedNonEmptyString,
+  commitSubject: Schema.optionalKey(TrimmedNonEmptyString),
   baseRef: Schema.NullOr(TrimmedNonEmptyString),
   headRef: Schema.NullOr(TrimmedNonEmptyString),
   diff: Schema.String,
diff --git a/packages/contracts/src/rpc.ts b/packages/contracts/src/rpc.ts
index 445048eb2685d..edc7a9ab852a4 100644
--- a/packages/contracts/src/rpc.ts
+++ b/packages/contracts/src/rpc.ts
@@ -149,6 +149,8 @@ import {
   VcsStatusStreamEvent,
 } from "./git.ts";
 import {
+  ReviewBranchCommitsInput,
+  ReviewBranchCommitsResult,
   ReviewDiffFileContentsInput,
   ReviewDiffFileContentsResult,
   ReviewDiffPreviewError,
@@ -455,6 +457,7 @@ export const WS_METHODS = {
   gitResolvePullRequest: "git.resolvePullRequest",
   gitPreparePullRequestThread: "git.preparePullRequestThread",
 
+  reviewGetBranchCommits: "review.getBranchCommits",
   reviewGetDiffPreview: "review.getDiffPreview",
   reviewGetDiffFileContents: "review.getDiffFileContents",
 
@@ -1500,6 +1503,12 @@ const WsVcsInitRpc = Rpc.make(WS_METHODS.vcsInit, {
   error: Schema.Union([VcsError, EnvironmentAuthorizationError]),
 });
 
+const WsReviewGetBranchCommitsRpc = Rpc.make(WS_METHODS.reviewGetBranchCommits, {
+  payload: ReviewBranchCommitsInput,
+  success: ReviewBranchCommitsResult,
+  error: Schema.Union([ReviewDiffPreviewError, EnvironmentAuthorizationError]),
+});
+
 const WsReviewGetDiffPreviewRpc = Rpc.make(WS_METHODS.reviewGetDiffPreview, {
   payload: ReviewDiffPreviewInput,
   success: ReviewDiffPreviewResult,
@@ -2092,6 +2101,7 @@ export const WsRpcGroup = RpcGroup.make(
   WsVcsCreateRefRpc,
   WsVcsSwitchRefRpc,
   WsVcsInitRpc,
+  WsReviewGetBranchCommitsRpc,
   WsReviewGetDiffPreviewRpc,
   WsReviewGetDiffFileContentsRpc,
   WsTerminalOpenRpc,
diff --git a/packages/source-control-azure-devops/src/shared/definition.ts b/packages/source-control-azure-devops/src/shared/definition.ts
index b43adccedc846..2dd036674747b 100644
--- a/packages/source-control-azure-devops/src/shared/definition.ts
+++ b/packages/source-control-azure-devops/src/shared/definition.ts
@@ -1,15 +1,18 @@
 import { SourceControlProviderKind } from "@t3tools/contracts";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   defineSourceControl,
   isChangeRequestAuthorityOfProject,
   parseChangeRequestPath,
+  parseCommitPath,
   remoteWebOrigin,
 } from "@t3tools/source-control-core/shared/definition";
 import { icon } from "./icon.ts";
 
 // Azure DevOps Server runs on any hostname; its `_git` route identifies it.
 const CHANGE_REQUEST_PATH = /^\/((?:[^/]+\/)*_git\/[^/]+)\/pullrequest\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/((?:[^/]+\/)*_git\/[^/]+)\/commit\/([0-9a-f]+)\/?$/iu;
 const CHECKOUT_COMMAND = /^az\s+repos\s+pr\s+checkout\s+(.+)$/i;
 const CHANGE_REQUEST_REFERENCE =
   /^https:\/\/(?:dev\.azure\.com\/[^/\s]+\/[^/\s]+|[^/\s]+\.visualstudio\.com\/[^/\s]+)\/_git\/[^/\s]+\/pullrequest\/(\d+)(?:[/?#].*)?$/i;
@@ -88,6 +91,12 @@ export const definition = defineSourceControl({
     const [canonicalHost = host, ...path] = (canonicalRepositoryKey(key) ?? key).split("/");
     return `${remoteWebOrigin(canonicalHost, remoteUrl)}/${path.join("/")}/pullrequest/${number}`;
   },
+  commitUrl: (input) => {
+    const key = `${input.host}/${input.repository}`.toLowerCase();
+    const [host = input.host, ...path] = (canonicalRepositoryKey(key) ?? key).split("/");
+    return buildCommitUrl({ ...input, host, repository: path.join("/") }, "commit");
+  },
+  parseCommitUrl: (url) => parseCommitPath(url, COMMIT_PATH),
   // Servers on different ports are different servers, so a port stays in the link.
   parseChangeRequestUrl: (url) => {
     const link = parseChangeRequestPath(url, CHANGE_REQUEST_PATH);
diff --git a/packages/source-control-bitbucket/src/shared/definition.ts b/packages/source-control-bitbucket/src/shared/definition.ts
index 946098b166d34..a8e786cb0ba6e 100644
--- a/packages/source-control-bitbucket/src/shared/definition.ts
+++ b/packages/source-control-bitbucket/src/shared/definition.ts
@@ -6,11 +6,13 @@ import {
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   defineSourceControl,
   isChangeRequestInProjectRepository,
   isChangeRequestOnProjectHost,
   parseChangeRequestPath,
+  parseCommitPath,
   projectChangeRequestHost,
 } from "@t3tools/source-control-core/shared/definition";
 import { icon } from "./icon.ts";
@@ -19,6 +21,7 @@ const safeShellArgument = /^[A-Za-z0-9._/@+=,-]+$/;
 const repositoryName = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
 
 const CHANGE_REQUEST_PATH = /^\/([^/]+\/[^/]+)\/pull-requests\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/([^/]+\/[^/]+)\/commits\/([0-9a-f]+)\/?$/iu;
 
 const KIND = SourceControlProviderKind.make("bitbucket");
 
@@ -87,6 +90,9 @@ export const definition = defineSourceControl({
       : `https://${host}/${repository}/pull-requests/${number}`,
   parseChangeRequestUrl: (url) =>
     isBitbucketHost(url.hostname) ? parseChangeRequestPath(url, CHANGE_REQUEST_PATH) : null,
+  commitUrl: (input) => buildCommitUrl(input, "commits"),
+  parseCommitUrl: (url) =>
+    isBitbucketHost(url.hostname) ? parseCommitPath(url, COMMIT_PATH) : null,
   changeRequestUrlFromReferenceAutolink: () => null,
   // No endpoint reopens a declined pull request, and nothing documented moves one in or out of
   // draft, so neither is offered rather than failing when pressed.
diff --git a/packages/source-control-core/src/shared/definition.ts b/packages/source-control-core/src/shared/definition.ts
index 6f99525260129..e9e68325b7418 100644
--- a/packages/source-control-core/src/shared/definition.ts
+++ b/packages/source-control-core/src/shared/definition.ts
@@ -30,6 +30,17 @@ export interface ParsedChangeRequestUrl extends ChangeRequestLink {
   readonly repositoryUrl: string;
 }
 
+export interface CommitLink {
+  readonly host: string;
+  readonly repository: string;
+  readonly sha: string;
+  readonly authority?: string;
+}
+
+export interface CommitUrlInput extends Omit<ChangeRequestUrlInput, "number"> {
+  readonly sha: string;
+}
+
 export interface ChangeRequestTerminology {
   readonly shortLabel: string;
   /** Spelled out because the article follows how the label is said: "an MR". */
@@ -238,6 +249,9 @@ export interface SourceControlDefinition {
   readonly newRepositoryOwner: (account: string | null) => { readonly owner: string | null } | null;
   readonly defaultCloneTransport: "https" | "ssh";
   readonly changeRequestUrl: (input: ChangeRequestUrlInput) => string | null;
+  readonly commitUrl?: (input: CommitUrlInput) => string | null;
+  /** `known` is set when the caller already knows this host serves the URL's repository. */
+  readonly parseCommitUrl?: (url: URL, known: boolean) => CommitLink | null;
   /** Null when the URL is not one of this host's change requests. */
   readonly parseChangeRequestUrl: (url: URL) => ParsedChangeRequestUrl | null;
   /**
@@ -290,7 +304,7 @@ export interface SourceControlDefinition {
   readonly isChangeRequestReference: (url: string) => boolean;
   readonly isChangeRequestInRepository: (
     identity: ChangeRequestProjectIdentity,
-    link: ChangeRequestLink,
+    link: ChangeRequestLink | CommitLink,
   ) => boolean;
   readonly canReadChangeRequestOnHost: (
     identity: ChangeRequestProjectIdentity,
@@ -335,6 +349,42 @@ export type SourceControlHostSettingsSchema = {
   readonly fields: Readonly<Record<string, Schema.Top>>;
 } & Schema.Decoder<object>;
 
+const FULL_COMMIT_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu;
+
+export function parseCommitPath(url: URL, route: RegExp): CommitLink | null {
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  const match = route.exec(url.pathname);
+  const repository = match?.[1];
+  const sha = match?.[2];
+  return repository && sha && FULL_COMMIT_SHA.test(sha)
+    ? {
+        host: url.hostname.toLowerCase(),
+        repository: repository.toLowerCase(),
+        sha: sha.toLowerCase(),
+        ...(url.port ? { authority: url.host.toLowerCase() } : {}),
+      }
+    : null;
+}
+
+export function buildCommitUrl(
+  { host, repository, sha, remoteUrl, webUrl }: CommitUrlInput,
+  route: string,
+): string | null {
+  if (!repository || !FULL_COMMIT_SHA.test(sha)) return null;
+  try {
+    const url = new URL(webUrl || `${remoteWebOrigin(host, remoteUrl)}/${repository}`);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.pathname = changeRequestUrlBelow(url.pathname, `${route}/${sha.toLowerCase()}`);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Reads a change request from `url` with `route`, whose first group is the repository path and
  * second the number.
@@ -383,7 +433,7 @@ export function defineSourceControl<const Definition extends SourceControlDefini
 
 export function isChangeRequestAuthorityOfProject(
   identity: ChangeRequestProjectIdentity,
-  link: ChangeRequestLink,
+  link: ChangeRequestLink | CommitLink,
 ): boolean {
   if (link.authority === undefined) return true;
   try {
@@ -410,7 +460,7 @@ export function projectChangeRequestHost<const Kind extends string | undefined>(
 export function isChangeRequestOnProjectHost(
   projectHost: string,
   identity: ChangeRequestProjectIdentity,
-  link: ChangeRequestLink,
+  link: ChangeRequestLink | CommitLink,
 ): boolean {
   if (!isChangeRequestAuthorityOfProject(identity, link)) return false;
   return projectHost === link.host.toLowerCase() || projectHost === link.authority;
@@ -426,7 +476,7 @@ function projectRepositoryPath(identity: ChangeRequestProjectIdentity): string |
 export function isChangeRequestInProjectRepository(
   projectHost: string,
   identity: ChangeRequestProjectIdentity,
-  link: ChangeRequestLink,
+  link: ChangeRequestLink | CommitLink,
 ): boolean {
   const repository = projectRepositoryPath(identity);
   return (
@@ -533,6 +583,11 @@ export interface ParsedChangeRequest {
   readonly link: ParsedChangeRequestUrl;
 }
 
+export interface ParsedCommit {
+  readonly definition: SourceControlDefinition;
+  readonly link: CommitLink;
+}
+
 export interface SourceControlMedia extends SourceControlMediaUrl {
   readonly definition: SourceControlDefinition;
 }
@@ -549,6 +604,7 @@ export interface SourceControlDefinitionRegistry {
   readonly findByPublicDomain: (hostname: string) => SourceControlDefinition | undefined;
   /** The first host, in registry order, that reads `url` as one of its change requests. */
   readonly parseChangeRequestUrl: (url: string) => ParsedChangeRequest | null;
+  readonly parseCommitUrl: (url: string, kind?: SourceControlProviderKind) => ParsedCommit | null;
   readonly findByChangeRequestUrl: (url: string) => SourceControlDefinition | undefined;
   readonly hostLabelForChangeRequestUrl: (url: string) => string;
   readonly isSameChangeRequest: (left: string, right: string) => boolean;
@@ -648,6 +704,16 @@ export function makeSourceControlDefinitionRegistry(
       );
     },
     parseChangeRequestUrl,
+    parseCommitUrl: (value, kind) => {
+      const url = httpUrl(value);
+      if (url === null) return null;
+      const preferred = kind === undefined ? undefined : byKind.get(kind);
+      for (const definition of kind === undefined ? claimOrder : preferred ? [preferred] : []) {
+        const link = definition.parseCommitUrl?.(url, preferred !== undefined);
+        if (link != null) return { definition, link };
+      }
+      return null;
+    },
     findByChangeRequestUrl: (url) => parseChangeRequestUrl(url)?.definition,
     hostLabelForChangeRequestUrl: (url) =>
       parseChangeRequestUrl(url)?.definition.label ?? "the host",
diff --git a/packages/source-control-definitions/src/registry.ts b/packages/source-control-definitions/src/registry.ts
index 0e42360855350..e44a6bb281717 100644
--- a/packages/source-control-definitions/src/registry.ts
+++ b/packages/source-control-definitions/src/registry.ts
@@ -23,7 +23,7 @@ export const builtInSourceControlDefinitions = makeSourceControlDefinitionRegist
     AzureDevOps.definition,
   ],
   {
-    claimChangeRequestUrlsFirst: [GitCafe.definition.kind],
+    claimChangeRequestUrlsFirst: [GitCafe.definition.kind, AzureDevOps.definition.kind],
     recognizeRemotesIn: [
       GitCafe.definition.kind,
       Forgejo.definition.kind,
diff --git a/packages/source-control-forgejo/src/shared/definition.ts b/packages/source-control-forgejo/src/shared/definition.ts
index 32258854c79da..2cf8ac5bb5838 100644
--- a/packages/source-control-forgejo/src/shared/definition.ts
+++ b/packages/source-control-forgejo/src/shared/definition.ts
@@ -1,5 +1,6 @@
 import { SourceControlProviderKind } from "@t3tools/contracts";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   type ChangeRequestHostIdentity,
   type ChangeRequestProjectIdentity,
@@ -8,6 +9,7 @@ import {
   isChangeRequestInProjectRepository,
   isChangeRequestOnProjectHost,
   parseChangeRequestPath,
+  parseCommitPath,
   projectChangeRequestHost,
   remoteWebOrigin,
 } from "@t3tools/source-control-core/shared/definition";
@@ -19,6 +21,7 @@ const CHANGE_REQUEST_REFERENCE =
 
 // Forgejo and Gitea run on any hostname, possibly mounted below a path.
 const CHANGE_REQUEST_PATH = /^\/([^/]+(?:\/[^/]+)+)\/pulls\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/([^/]+(?:\/[^/]+)+)\/commit\/([0-9a-f]+)\/?$/iu;
 
 const KIND = SourceControlProviderKind.make("forgejo");
 
@@ -82,6 +85,8 @@ export const definition = defineSourceControl({
     return link === null ? null : { ...link, authority: url.host.toLowerCase() };
   },
   changeRequestUrlFromReferenceAutolink: () => null,
+  commitUrl: (input) => buildCommitUrl(input, "commit"),
+  parseCommitUrl: (url) => parseCommitPath(url, COMMIT_PATH),
   changeRequestActions: new Set(["merge", "close", "reopen", "update-branch"] as const),
   // Neither `fj` nor `tea` checks out by number.
   checkoutCommand: ({ number, repositoryUrl }) =>
diff --git a/packages/source-control-gitcafe/src/shared/definition.ts b/packages/source-control-gitcafe/src/shared/definition.ts
index dc352be748dc2..a7b22261b2b4b 100644
--- a/packages/source-control-gitcafe/src/shared/definition.ts
+++ b/packages/source-control-gitcafe/src/shared/definition.ts
@@ -7,11 +7,13 @@ import {
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   defineSourceControl,
   isChangeRequestInProjectRepository,
   isChangeRequestOnProjectHost,
   parseChangeRequestPath,
+  parseCommitPath,
   projectChangeRequestHost,
 } from "@t3tools/source-control-core/shared/definition";
 import { icon } from "./icon.ts";
@@ -21,6 +23,7 @@ const GITCAFE_HOSTS = new Set(["git.cafe", "staging.git.cafe"]);
 
 /** GitCafe serves pull requests at `/pull/<n>` and redirects the older `/pulls/<n>` there. */
 const CHANGE_REQUEST_PATH = /^\/([^/]+\/[^/]+)\/pulls?\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/([^/]+\/[^/]+)\/commit\/([0-9a-f]+)\/?$/iu;
 
 function parseChangeRequestUrl(url: URL) {
   return GITCAFE_HOSTS.has(url.hostname.toLowerCase())
@@ -68,6 +71,9 @@ export const definition = defineSourceControl({
   // `/pull/` and `/pulls/` are GitHub's and Forgejo's shapes too, so only GitCafe's own hosts
   // claim them.
   parseChangeRequestUrl,
+  commitUrl: (input) => buildCommitUrl(input, "commit"),
+  parseCommitUrl: (url) =>
+    GITCAFE_HOSTS.has(url.hostname.toLowerCase()) ? parseCommitPath(url, COMMIT_PATH) : null,
   changeRequestUrlFromReferenceAutolink: () => null,
   changeRequestActions: new Set([
     "ready",
diff --git a/packages/source-control-github/src/shared/definition.ts b/packages/source-control-github/src/shared/definition.ts
index 965ed42814c19..6ac8aa305f3cd 100644
--- a/packages/source-control-github/src/shared/definition.ts
+++ b/packages/source-control-github/src/shared/definition.ts
@@ -1,11 +1,13 @@
 import { makeProviderSettingsSchema, SourceControlProviderKind } from "@t3tools/contracts";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   defineSourceControl,
   hostCredentialSettingsFields,
   isChangeRequestInProjectRepository,
   isChangeRequestOnProjectHost,
   parseChangeRequestPath,
+  parseCommitPath,
   projectChangeRequestHost,
   remoteWebOrigin,
   type SourceControlAppSignIn,
@@ -22,15 +24,14 @@ const CHANGE_REQUEST_REFERENCE =
 // GitHub Enterprise Server runs on any hostname, so the `<owner>/<repo>/pull/<n>` route alone
 // identifies a GitHub pull request.
 const CHANGE_REQUEST_PATH = /^\/([^/]+\/[^/]+)\/pull\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/([^/]+\/[^/]+)\/(?:commit|pull\/\d+\/commits)\/([0-9a-f]+)\/?$/iu;
 const ISSUE_PATH = /^\/([^/]+\/[^/]+)\/issues\/(\d+)(?:\/|$)/u;
 
 const KIND = SourceControlProviderKind.make("github");
 
 function isGitHubHost(hostname: string): boolean {
   const host = hostname.toLowerCase();
-  return (
-    host === "github.com" || host.endsWith(".github.com") || host.split(".").includes("github")
-  );
+  return host === "github.com" || host.endsWith(".ghe.com") || host.split(".").includes("github");
 }
 
 function isRepositoryPath(repository: string): boolean {
@@ -91,6 +92,11 @@ export const definition = defineSourceControl({
       return null;
     }
   },
+  commitUrl: (input) =>
+    isRepositoryPath(input.repository) ? buildCommitUrl(input, "commit") : null,
+  // A known project's host can be any GitHub Enterprise Server name.
+  parseCommitUrl: (url, known) =>
+    known || isGitHubHost(url.hostname) ? parseCommitPath(url, COMMIT_PATH) : null,
   parseChangeRequestUrl: (url) => parseChangeRequestPath(url, CHANGE_REQUEST_PATH),
   // GitHub writes every bare reference through `/issues/`, including pull requests.
   changeRequestUrlFromReferenceAutolink: (url) => {
@@ -133,9 +139,7 @@ export const definition = defineSourceControl({
   changeRequestHeadRef: (number) => `refs/pull/${number}/head`,
   // `*.ghe.com` is GitHub Enterprise Cloud with data residency, one subdomain per enterprise.
   recognizeRemote: ({ host, hostname }) =>
-    hostname === "github.com" ||
-    hostname.endsWith(".ghe.com") ||
-    hostname.split(".").includes("github")
+    isGitHubHost(hostname)
       ? {
           kind: KIND,
           name: hostname === "github.com" ? "GitHub" : "GitHub Self-Hosted",
diff --git a/packages/source-control-gitlab/src/shared/definition.ts b/packages/source-control-gitlab/src/shared/definition.ts
index 437320c0d0419..2d280f01c62f2 100644
--- a/packages/source-control-gitlab/src/shared/definition.ts
+++ b/packages/source-control-gitlab/src/shared/definition.ts
@@ -1,10 +1,12 @@
 import { SourceControlProviderKind } from "@t3tools/contracts";
 import {
+  buildCommitUrl,
   changeRequestUrlBelow,
   defineSourceControl,
   isChangeRequestInProjectRepository,
   isChangeRequestOnProjectHost,
   parseChangeRequestPath,
+  parseCommitPath,
   projectChangeRequestHost,
 } from "@t3tools/source-control-core/shared/definition";
 import { icon } from "./icon.ts";
@@ -15,6 +17,7 @@ const CHANGE_REQUEST_REFERENCE =
 
 // Self-managed GitLab runs on any hostname and nests projects in groups.
 const CHANGE_REQUEST_PATH = /^\/([^/]+(?:\/[^/]+)+)\/-\/merge_requests\/(\d+)(?:\/|$)/u;
+const COMMIT_PATH = /^\/([^/]+(?:\/[^/]+)+)\/-\/commit\/([0-9a-f]+)\/?$/iu;
 
 const KIND = SourceControlProviderKind.make("gitlab");
 
@@ -40,6 +43,8 @@ export const definition = defineSourceControl({
       ? changeRequestUrlBelow(webUrl, `-/merge_requests/${number}`)
       : `https://${host}/${repository}/-/merge_requests/${number}`,
   parseChangeRequestUrl: (url) => parseChangeRequestPath(url, CHANGE_REQUEST_PATH),
+  commitUrl: (input) => buildCommitUrl(input, "-/commit"),
+  parseCommitUrl: (url) => parseCommitPath(url, COMMIT_PATH),
   changeRequestUrlFromReferenceAutolink: () => null,
   changeRequestActions: new Set([
     "merge",

From 305a90dce44b8b7813d951662f13ce8510a3c669 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 01:47:04 -0700
Subject: [PATCH 141/146] fix(relay): show the account's real tunnel cap in T3
 Connect settings (#27442)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/cloud/managedRelayState.ts       |  5 ++-
 .../ManagedEndpointProvider.test.ts           |  1 +
 .../environments/ManagedTunnelLimits.test.ts  | 23 +++++++++++
 .../src/environments/ManagedTunnelLimits.ts   | 41 +++++++++++--------
 infra/relay/src/http/Api.test.ts              |  4 ++
 infra/relay/src/http/Api.ts                   | 20 ++++++---
 packages/contracts/src/relay.ts               |  2 +
 7 files changed, 73 insertions(+), 23 deletions(-)

diff --git a/apps/web/src/cloud/managedRelayState.ts b/apps/web/src/cloud/managedRelayState.ts
index c5f7536305337..679f362fdf5a0 100644
--- a/apps/web/src/cloud/managedRelayState.ts
+++ b/apps/web/src/cloud/managedRelayState.ts
@@ -150,11 +150,14 @@ export function useManagedRelayDevices() {
 /** How this account can raise its tunnel cap: link T3 Chat, or upgrade the linked plan. */
 export type ManagedTunnelUpgrade = "link" | "pro" | "premier" | null;
 
-// Mirrors the relay's cap without manual overrides, which the relay does not expose.
+// Mirrors the relay's cap: a manual override is exact, otherwise the T3 Chat plan raises the default.
 function managedTunnelCap(t3Chat: RelayT3ChatLinkResponse): {
   readonly limit: number;
   readonly upgrade: ManagedTunnelUpgrade;
 } {
+  if (t3Chat.maxTunnelsOverride !== undefined) {
+    return { limit: t3Chat.maxTunnelsOverride, upgrade: null };
+  }
   if (!t3Chat.available) return { limit: DEFAULT_MANAGED_TUNNEL_LIMIT, upgrade: null };
   switch (t3Chat.link?.plan) {
     case "premier":
diff --git a/infra/relay/src/environments/ManagedEndpointProvider.test.ts b/infra/relay/src/environments/ManagedEndpointProvider.test.ts
index 01230171be9ba..96661fad42a61 100644
--- a/infra/relay/src/environments/ManagedEndpointProvider.test.ts
+++ b/infra/relay/src/environments/ManagedEndpointProvider.test.ts
@@ -343,6 +343,7 @@ function makeTunnelLimits(
         }
         return yield* reserve;
       }),
+    getOverride: () => Effect.die("unused"),
   });
 }
 
diff --git a/infra/relay/src/environments/ManagedTunnelLimits.test.ts b/infra/relay/src/environments/ManagedTunnelLimits.test.ts
index 6aca885b85b87..6b8dd817ee01c 100644
--- a/infra/relay/src/environments/ManagedTunnelLimits.test.ts
+++ b/infra/relay/src/environments/ManagedTunnelLimits.test.ts
@@ -121,6 +121,27 @@ const reserve = (
     ),
   );
 
+const getOverride = (override?: number) =>
+  Effect.gen(function* () {
+    const limits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
+    return yield* limits.getOverride({ userId: "user-1" });
+  }).pipe(
+    Effect.provide(
+      ManagedTunnelLimits.layer.pipe(
+        Layer.provide(
+          Layer.succeed(
+            RelayDb.RelayDb,
+            makeFakeDb({
+              otherSlots: () => 0,
+              ...(override === undefined ? {} : { override }),
+            }),
+          ),
+        ),
+        Layer.provide(t3ChatLayer("free")),
+      ),
+    ),
+  );
+
 describe("ManagedTunnelLimits", () => {
   it.effect("rejects concurrent reservations past the limit", () => {
     const reserved: Array<string> = [];
@@ -383,7 +404,9 @@ describe("ManagedTunnelLimits", () => {
           reserve({ override, activeTunnels: override, plan: "premier", lookups }),
         );
         expect(error).toMatchObject({ _tag: "ManagedTunnelLimitExceeded", maxTunnels: override });
+        expect(yield* getOverride(override)).toBe(override);
       }
+      expect(yield* getOverride()).toBeNull();
       expect(lookups).toEqual([]);
     }),
   );
diff --git a/infra/relay/src/environments/ManagedTunnelLimits.ts b/infra/relay/src/environments/ManagedTunnelLimits.ts
index aa373ad27ffb2..3af90f86c4163 100644
--- a/infra/relay/src/environments/ManagedTunnelLimits.ts
+++ b/infra/relay/src/environments/ManagedTunnelLimits.ts
@@ -106,6 +106,10 @@ export class ManagedTunnelLimits extends Context.Service<
       input: { readonly userId: string; readonly environmentId: string },
       reserve: Effect.Effect<A, E, R>,
     ) => Effect.Effect<A, E | ManagedTunnelLimitExceeded | ManagedTunnelLimitPersistenceError, R>;
+    /** The user's manual cap, which replaces the default and any T3 Chat plan cap. */
+    readonly getOverride: (input: {
+      readonly userId: string;
+    }) => Effect.Effect<number | null, ManagedTunnelLimitPersistenceError>;
   }
 >()("t3code-relay/environments/ManagedTunnelLimits") {}
 
@@ -126,7 +130,24 @@ const make = Effect.gen(function* () {
       ),
     );
 
+  const loadOverride = (userId: string) =>
+    db
+      .select({ maxTunnels: relayManagedTunnelLimits.maxTunnels })
+      .from(relayManagedTunnelLimits)
+      .where(eq(relayManagedTunnelLimits.userId, userId))
+      .limit(1)
+      .pipe(
+        Effect.map((rows) => rows[0]?.maxTunnels ?? null),
+        Effect.mapError(
+          (cause) =>
+            new ManagedTunnelLimitPersistenceError({ operation: "load-limit", userId, cause }),
+        ),
+      );
+
   return ManagedTunnelLimits.of({
+    getOverride: Effect.fn("relay.managed_tunnel_limits.get_override")(function* (input) {
+      return yield* loadOverride(input.userId);
+    }),
     withCapacity: Effect.fn("relay.managed_tunnel_limits.with_capacity")(function* <A, E, R>(
       input: { readonly userId: string; readonly environmentId: string },
       reserve: Effect.Effect<A, E, R>,
@@ -148,22 +169,8 @@ const make = Effect.gen(function* () {
             ),
           );
 
-        const overrides = yield* db
-          .select({ maxTunnels: relayManagedTunnelLimits.maxTunnels })
-          .from(relayManagedTunnelLimits)
-          .where(eq(relayManagedTunnelLimits.userId, input.userId))
-          .limit(1)
-          .pipe(
-            Effect.mapError(
-              (cause) =>
-                new ManagedTunnelLimitPersistenceError({
-                  operation: "load-limit",
-                  userId: input.userId,
-                  cause,
-                }),
-            ),
-          );
-        const baseMaxTunnels = overrides[0]?.maxTunnels ?? DEFAULT_MANAGED_TUNNEL_LIMIT;
+        const override = yield* loadOverride(input.userId);
+        const baseMaxTunnels = override ?? DEFAULT_MANAGED_TUNNEL_LIMIT;
 
         const pendingCutoff = DateTime.formatIso(
           DateTime.subtract(yield* DateTime.now, {
@@ -196,7 +203,7 @@ const make = Effect.gen(function* () {
         // A manual override is the exact cap; a T3 Chat plan raises only the default.
         // Runs under the user lock, bounded by the T3 Chat request timeout.
         const maxTunnels =
-          t3Chat.available && overrides.length === 0
+          t3Chat.available && override === null
             ? Math.max(baseMaxTunnels, yield* t3ChatTunnelLimit(input.userId))
             : baseMaxTunnels;
         if (activeTunnels >= maxTunnels) {
diff --git a/infra/relay/src/http/Api.test.ts b/infra/relay/src/http/Api.test.ts
index a20989cd3c025..e6db7fc8b7aa0 100644
--- a/infra/relay/src/http/Api.test.ts
+++ b/infra/relay/src/http/Api.test.ts
@@ -64,6 +64,7 @@ import * as HookInbox from "../hooks/HookInbox.ts";
 import * as EnvironmentLinks from "../environments/EnvironmentLinks.ts";
 import * as ManagedEndpointAllocations from "../environments/ManagedEndpointAllocations.ts";
 import * as ManagedEndpointProvider from "../environments/ManagedEndpointProvider.ts";
+import * as ManagedTunnelLimits from "../environments/ManagedTunnelLimits.ts";
 import * as AgentActivityPublisher from "../agentActivity/AgentActivityPublisher.ts";
 import * as EnvironmentPublishSignatures from "../environments/EnvironmentPublishSignatures.ts";
 import * as T3ChatAccounts from "../t3chat/T3ChatAccounts.ts";
@@ -130,6 +131,7 @@ describe("managed endpoint provisioning errors", () => {
           Layer.mock(ManagedEndpointProvider.ManagedEndpointProvider, {}),
           Layer.mock(Devices.Devices, {}),
           Layer.mock(T3ChatAccounts.T3ChatAccounts, { available: false }),
+          Layer.mock(ManagedTunnelLimits.ManagedTunnelLimits, {}),
         ),
       ),
       Layer.provideMerge(
@@ -241,6 +243,7 @@ describe("device listing compatibility", () => {
             },
           }),
           Layer.mock(T3ChatAccounts.T3ChatAccounts, { available: false }),
+          Layer.mock(ManagedTunnelLimits.ManagedTunnelLimits, {}),
         ),
       ),
       Layer.provideMerge(
@@ -322,6 +325,7 @@ describe("Cloudflare rate-limit retry hint", () => {
           Layer.mock(ManagedEndpointProvider.ManagedEndpointProvider, {}),
           Layer.mock(Devices.Devices, {}),
           Layer.mock(T3ChatAccounts.T3ChatAccounts, { available: false }),
+          Layer.mock(ManagedTunnelLimits.ManagedTunnelLimits, {}),
         ),
       ),
       Layer.provideMerge(
diff --git a/infra/relay/src/http/Api.ts b/infra/relay/src/http/Api.ts
index 5a4d77c28d3c2..390f3c18f785f 100644
--- a/infra/relay/src/http/Api.ts
+++ b/infra/relay/src/http/Api.ts
@@ -74,6 +74,7 @@ import * as AgentActivityPublisher from "../agentActivity/AgentActivityPublisher
 import * as EnvironmentConnector from "../environments/EnvironmentConnector.ts";
 import * as EnvironmentLinker from "../environments/EnvironmentLinker.ts";
 import * as ManagedEndpointProvider from "../environments/ManagedEndpointProvider.ts";
+import * as ManagedTunnelLimits from "../environments/ManagedTunnelLimits.ts";
 import * as ManagedEndpointAllocations from "../environments/ManagedEndpointAllocations.ts";
 import * as EnvironmentPublishSignatures from "../environments/EnvironmentPublishSignatures.ts";
 import * as MobileRegistrations from "../agentActivity/MobileRegistrations.ts";
@@ -825,6 +826,7 @@ export const layerClientApi = HttpApiBuilder.group(
     const managedEndpointProvider = yield* ManagedEndpointProvider.ManagedEndpointProvider;
     const devices = yield* Devices.Devices;
     const t3Chat = yield* T3ChatAccounts.T3ChatAccounts;
+    const tunnelLimits = yield* ManagedTunnelLimits.ManagedTunnelLimits;
     return handlers
       .handle(
         "listEnvironments",
@@ -996,12 +998,20 @@ export const layerClientApi = HttpApiBuilder.group(
         "getT3ChatLink",
         Effect.fn("relay.api.client.getT3ChatLink")(function* () {
           yield* appendRelayCredentialResponseHeaders;
-          if (!t3Chat.available) return { available: false, link: null };
           const { userId } = yield* RelayClientPrincipal;
-          const link = yield* t3Chat
-            .getLink({ userId })
-            .pipe(Effect.catch(() => relayInternalErrorResponse("upstream_unavailable")));
-          return { available: true, link };
+          const link = t3Chat.available
+            ? yield* t3Chat
+                .getLink({ userId })
+                .pipe(Effect.catch(() => relayInternalErrorResponse("upstream_unavailable")))
+            : null;
+          const maxTunnelsOverride = yield* tunnelLimits
+            .getOverride({ userId })
+            .pipe(Effect.catch(() => relayInternalErrorResponse("internal_error")));
+          return {
+            available: t3Chat.available,
+            link,
+            ...(maxTunnelsOverride === null ? {} : { maxTunnelsOverride }),
+          };
         }, mapRelayCommonApiErrors("not_authorized")),
       )
       .handle(
diff --git a/packages/contracts/src/relay.ts b/packages/contracts/src/relay.ts
index 4dbb6a199f472..8ebc9df23a0bb 100644
--- a/packages/contracts/src/relay.ts
+++ b/packages/contracts/src/relay.ts
@@ -981,6 +981,8 @@ export const RelayT3ChatLinkResponse = Schema.Struct({
   // False when this relay has no T3 Chat secret, so clients hide the feature.
   available: Schema.Boolean,
   link: Schema.NullOr(RelayT3ChatLink),
+  // A manual cap that replaces the plan's; T3 Chat upgrades do not raise it.
+  maxTunnelsOverride: Schema.optionalKey(Schema.Number),
 });
 export type RelayT3ChatLinkResponse = typeof RelayT3ChatLinkResponse.Type;
 

From 5cbc207d8c8e92964b36e235740f22b49d938352 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 02:10:40 -0700
Subject: [PATCH 142/146] fix(web): streaming replies no longer re-render every
 visible timeline row (#27420)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/components/chat/MessagesTimeline.tsx  | 42 +++++++++++--------
 apps/web/test/appScenarios.renders.tsx        |  3 ++
 2 files changed, 28 insertions(+), 17 deletions(-)

diff --git a/apps/web/src/components/chat/MessagesTimeline.tsx b/apps/web/src/components/chat/MessagesTimeline.tsx
index a9cab1554a3d3..faa733c76e896 100644
--- a/apps/web/src/components/chat/MessagesTimeline.tsx
+++ b/apps/web/src/components/chat/MessagesTimeline.tsx
@@ -659,12 +659,11 @@ const ConversationTimeline = memo(function ConversationTimeline({
       ? new Set(paintedExpandedAttemptIds).add(activeFindAttemptId)
       : paintedExpandedAttemptIds;
 
-  const pendingApprovalsByRequestId = new Map(
-    pendingApprovals
-      .filter((approval) => !heldApprovalRequestIds?.has(approval.requestId))
-      .map((approval) => [approval.requestId, approval]),
+  const isVisiblePendingApproval = (approval: PendingApproval) =>
+    !heldApprovalRequestIds?.has(approval.requestId);
+  const pendingApprovalRequestIds = new Set(
+    pendingApprovals.filter(isVisiblePendingApproval).map((approval) => approval.requestId),
   );
-  const pendingApprovalRequestIds = new Set(pendingApprovalsByRequestId.keys());
   const rawRows = useIncrementalTimelineRows(`${listIdentityKey}\0${workspaceRoot ?? ""}`, {
     timelineEntries,
     pendingApprovalRequestIds,
@@ -683,17 +682,19 @@ const ConversationTimeline = memo(function ConversationTimeline({
     worktreeSetup,
   });
   const rows = useStableRows(rawRows, listIdentityKey);
-  const unmatchedPendingApprovals = new Map(pendingApprovalsByRequestId);
-  if (unmatchedPendingApprovals.size > 0) {
-    for (const row of rows) {
-      const entries =
-        row.kind === "work" ? row.groupedEntries : row.kind === "work-live" ? [row.entry] : [];
-      for (const entry of entries) {
-        const item = entry.projectedItem?.item;
-        if (item?.type === "approval_request") unmatchedPendingApprovals.delete(item.requestId);
-      }
+  const matchedApprovalRequestIds = new Set<string>();
+  for (const row of pendingApprovalRequestIds.size > 0 ? rows : []) {
+    const entries =
+      row.kind === "work" ? row.groupedEntries : row.kind === "work-live" ? [row.entry] : [];
+    for (const entry of entries) {
+      const item = entry.projectedItem?.item;
+      if (item?.type === "approval_request") matchedApprovalRequestIds.add(item.requestId);
     }
   }
+  const unmatchedPendingApprovals = pendingApprovals.filter(
+    (approval) =>
+      isVisiblePendingApproval(approval) && !matchedApprovalRequestIds.has(approval.requestId),
+  );
   // Run status/timestamps change per stream event; keep them out of shared row context.
   const runs = useStableHandoffRuns(runsProp);
   const minimapItems = deriveTimelineMinimapItems(rows);
@@ -706,7 +707,7 @@ const ConversationTimeline = memo(function ConversationTimeline({
     restoringThreadPosition && restoreRowIndex >= 0 ? { indices: [restoreRowIndex] } : undefined;
   const showsEmptyState =
     rows.length === 0 &&
-    unmatchedPendingApprovals.size === 0 &&
+    unmatchedPendingApprovals.length === 0 &&
     !isWorking &&
     parentThreadLink === null &&
     historyControls === undefined &&
@@ -1000,6 +1001,13 @@ const ConversationTimeline = memo(function ConversationTimeline({
     };
   };
 
+  // Built from props after the last hook so the compiler can memoize the row context; a map
+  // made before a hook would rebuild it, and re-render every row, on each streamed update.
+  const pendingApprovalsByRequestId = new Map(
+    pendingApprovals
+      .filter(isVisiblePendingApproval)
+      .map((approval) => [approval.requestId, approval]),
+  );
   const sharedState: TimelineRowSharedState = {
     pendingApprovals: pendingApprovalsByRequestId,
     respondingRequestIds,
@@ -1238,12 +1246,12 @@ const ConversationTimeline = memo(function ConversationTimeline({
       onGrow={onFooterGrow}
     >
       {footer}
-      {unmatchedPendingApprovals.size > 0 ? (
+      {unmatchedPendingApprovals.length > 0 ? (
         <TimelineRowCtx value={sharedState}>
           <div className="messages-timeline-row-frame">
             <div className="chat-content-lane overflow-x-clip" data-timeline-root="true">
               <WorkLogBlock>
-                {[...unmatchedPendingApprovals.values()].map((approval) => (
+                {unmatchedPendingApprovals.map((approval) => (
                   <TimelinePendingApprovalRow key={approval.requestId} approval={approval} />
                 ))}
               </WorkLogBlock>
diff --git a/apps/web/test/appScenarios.renders.tsx b/apps/web/test/appScenarios.renders.tsx
index 9c1a7d520eeb1..cc7d67798ddd9 100644
--- a/apps/web/test/appScenarios.renders.tsx
+++ b/apps/web/test/appScenarios.renders.tsx
@@ -201,6 +201,9 @@ it("app-stream-assistant-turn", async () => {
       .element(page.getByText(`word${STREAM_DELTAS - 1}`, { exact: false }))
       .toBeVisible();
   });
+  // Only the streaming row changes; history rows must not re-render with it.
+  expect(counted.components.UserTimelineRow).toBeUndefined();
+  expect(counted.components.AssistantTimelineRow).toBe(STREAM_DELTAS);
   await report("app-stream-assistant-turn", [counted], { commits: false });
 });
 

From d8c926c395155be72b09be594cb498adda3dfed2 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 02:10:41 -0700
Subject: [PATCH 143/146] perf(web): streaming replies re-render only their
 last Markdown block (#27417)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/ChatMarkdown.tsx      | 129 ++++++++++++------
 .../chat/markdownStreamBlocks.test.tsx        |  61 +++++++++
 .../components/chat/markdownStreamBlocks.ts   |  43 ++++++
 apps/web/test/appScenarios.renders.tsx        |   4 +-
 4 files changed, 194 insertions(+), 43 deletions(-)
 create mode 100644 apps/web/src/components/chat/markdownStreamBlocks.test.tsx
 create mode 100644 apps/web/src/components/chat/markdownStreamBlocks.ts

diff --git a/apps/web/src/components/ChatMarkdown.tsx b/apps/web/src/components/ChatMarkdown.tsx
index 6a8f80d6d1071..99c2ebbc8f40f 100644
--- a/apps/web/src/components/ChatMarkdown.tsx
+++ b/apps/web/src/components/ChatMarkdown.tsx
@@ -189,6 +189,7 @@ import {
 import { resolveLinkTarget } from "../browser/browserLinkTarget";
 import { PullRequestLinkPreview } from "./pullRequest/PullRequestLinkPreview";
 import { MarkdownCodeBlock, SuspenseShikiCodeBlock } from "./chat/MarkdownCodeBlock";
+import { splitMarkdownBlocks } from "./chat/markdownStreamBlocks";
 import { MarkdownMermaidCodeBlock } from "./chat/MarkdownMermaidCodeBlock";
 import { MarkdownTable } from "./chat/MarkdownTable";
 import { MarkdownDetails } from "./chat/MarkdownDetails";
@@ -434,6 +435,44 @@ const markdownServerConfigFieldsAtom = Atom.family((environmentId: EnvironmentId
   }).pipe(Atom.withLabel("markdown-server-config-fields")),
 );
 
+function fileLinkSourcesKey(
+  text: string,
+  cwd: string | undefined,
+  imageBaseDir: string | undefined,
+): string {
+  const hrefs = extractMarkdownLinkHrefs(renderCodexInlineDirectivesAsMarkdown(text))
+    .filter((href) => !parseComposerContextHref(href))
+    .map(normalizeMarkdownLinkHrefKey)
+    .filter((href) => resolveMarkdownFileLinkMeta(href, cwd, imageBaseDir ?? cwd));
+  const spans = extractInlineCodeSpans(text).filter((span) =>
+    resolveInlineCodeFileLinkMeta(span, cwd, imageBaseDir ?? cwd),
+  );
+  return JSON.stringify([[...new Set(hrefs)], [...new Set(spans)]]);
+}
+
+function resolveFileLinkSources(
+  key: string,
+  cwd: string | undefined,
+  imageBaseDir: string | undefined,
+) {
+  const [hrefs, spans] = JSON.parse(key) as [string[], string[]];
+  const markdownFileLinkMetaByHref = new Map<string, MarkdownFileLinkMeta>();
+  for (const href of hrefs) {
+    const meta = resolveMarkdownFileLinkMeta(href, cwd, imageBaseDir ?? cwd);
+    if (meta) markdownFileLinkMetaByHref.set(href, meta);
+  }
+  const inlineCodeFileLinkMetaByText = new Map<string, MarkdownFileLinkMeta>();
+  for (const span of spans) {
+    const meta = resolveInlineCodeFileLinkMeta(span, cwd, imageBaseDir ?? cwd);
+    if (meta) inlineCodeFileLinkMetaByText.set(span, meta);
+  }
+  const fileLinkParentSuffixByPath = buildFileLinkParentSuffixByPath([
+    ...[...markdownFileLinkMetaByHref.values()].map((meta) => meta.filePath),
+    ...[...inlineCodeFileLinkMetaByText.values()].map((meta) => meta.filePath),
+  ]);
+  return { markdownFileLinkMetaByHref, inlineCodeFileLinkMetaByText, fileLinkParentSuffixByPath };
+}
+
 function useChatMarkdownState({
   text,
   inline = false,
@@ -605,40 +644,6 @@ function useChatMarkdownState({
     });
   };
   const diffThemeName = resolveDiffThemeName(resolvedTheme);
-  const markdownFileLinkMetaByHref = (() => {
-    const metaByHref = new Map<
-      string,
-      NonNullable<ReturnType<typeof resolveMarkdownFileLinkMeta>>
-    >();
-    for (const href of extractMarkdownLinkHrefs(renderCodexInlineDirectivesAsMarkdown(text))) {
-      if (parseComposerContextHref(href)) continue;
-      const normalizedHref = normalizeMarkdownLinkHrefKey(href);
-      if (metaByHref.has(normalizedHref)) continue;
-      const meta = resolveMarkdownFileLinkMeta(normalizedHref, cwd, imageBaseDir ?? cwd);
-      if (meta) {
-        metaByHref.set(normalizedHref, meta);
-      }
-    }
-    return metaByHref;
-  })();
-  const inlineCodeFileLinkMetaByText = (() => {
-    const metaByText = new Map<string, MarkdownFileLinkMeta>();
-    for (const span of extractInlineCodeSpans(text)) {
-      if (metaByText.has(span)) continue;
-      const meta = resolveInlineCodeFileLinkMeta(span, cwd, imageBaseDir ?? cwd);
-      if (meta) {
-        metaByText.set(span, meta);
-      }
-    }
-    return metaByText;
-  })();
-  const fileLinkParentSuffixByPath = (() => {
-    const filePaths = [
-      ...[...markdownFileLinkMetaByHref.values()].map((meta) => meta.filePath),
-      ...[...inlineCodeFileLinkMetaByText.values()].map((meta) => meta.filePath),
-    ];
-    return buildFileLinkParentSuffixByPath(filePaths);
-  })();
   const markdownUrlTransform = (href: string) => {
     if (parseAssistantCitationHref(href)) return href;
     if (parseComposerContextHref(href)) return href;
@@ -666,6 +671,12 @@ function useChatMarkdownState({
   // Subscribe so hydrated settings apply before the anchor synchronously decides whether to intercept _blank.
   const linkTargetPreference = useClientSettings((settings) => settings.browserLinkTarget);
   const mathEnabled = useClientSettings((settings) => settings.mathRenderingEnabled);
+  // Keyed by the file links found, not the text, so streamed text that adds none keeps the
+  // renderer context, and every block reading it, unchanged.
+  // A template literal marks the key as a string, so the compiler memoizes the maps on its value.
+  const fileLinksKey = `${fileLinkSourcesKey(text, cwd, imageBaseDir)}`;
+  const { markdownFileLinkMetaByHref, inlineCodeFileLinkMetaByText, fileLinkParentSuffixByPath } =
+    resolveFileLinkSources(fileLinksKey, cwd, imageBaseDir);
   const resolveThreadPullRequest = (
     href: string,
   ): (ThreadPullRequestKey & { readonly url: string }) | null => {
@@ -1622,6 +1633,32 @@ const CHAT_MARKDOWN_COMPONENTS = {
   },
 } satisfies Components;
 
+const MarkdownSource = memo(function MarkdownSource({
+  text,
+  remarkPlugins,
+  rehypePlugins,
+  urlTransform,
+}: {
+  text: string;
+  remarkPlugins: NonNullable<ReactMarkdownOptions["remarkPlugins"]>;
+  rehypePlugins: NonNullable<ReactMarkdownOptions["rehypePlugins"]>;
+  urlTransform: ReactMarkdownOptions["urlTransform"];
+}) {
+  return (
+    <ChatMarkdownTextContext value={text}>
+      <ReactMarkdown
+        remarkPlugins={remarkPlugins}
+        rehypePlugins={rehypePlugins}
+        skipHtml={false}
+        components={CHAT_MARKDOWN_COMPONENTS}
+        urlTransform={urlTransform}
+      >
+        {text}
+      </ReactMarkdown>
+    </ChatMarkdownTextContext>
+  );
+});
+
 function ChatMarkdown({
   text,
   className,
@@ -1639,8 +1676,17 @@ function ChatMarkdown({
     localMediaPreview,
     closeLocalMediaPreview,
   } = useChatMarkdownState({ text, inline, ...props });
+  // Streaming re-renders only the last block; offsets for task edits need the whole text.
+  const streamingBlocks =
+    props.isStreaming === true &&
+    !inline &&
+    extraRemarkPlugins.length === 0 &&
+    !props.onTaskListChange
+      ? splitMarkdownBlocks(text)
+      : null;
   const incrementalParsing =
     props.isStreaming === true &&
+    streamingBlocks === null &&
     extraRemarkPlugins.length === 0 &&
     /(?:^|\n) {0,3}(?:`{3}|~{3})/.test(text);
   const Root = inline ? "span" : "div";
@@ -1668,21 +1714,20 @@ function ChatMarkdown({
       onCopy={handleCopy}
     >
       <ChatMarkdownRendererContext value={componentState}>
-        <ChatMarkdownTextContext value={text}>
-          <ReactMarkdown
+        {(streamingBlocks ?? [text]).map((source, index) => (
+          <MarkdownSource
+            // oxlint-disable-next-line react/no-array-index-key -- streamed blocks only change at the end
+            key={index}
+            text={source}
             remarkPlugins={remarkPlugins}
             rehypePlugins={
               parseRawHtml
                 ? CHAT_MARKDOWN_RENDER_REHYPE_PLUGINS
                 : CHAT_MARKDOWN_LITERAL_HTML_REHYPE_PLUGINS
             }
-            skipHtml={false}
-            components={CHAT_MARKDOWN_COMPONENTS}
             urlTransform={markdownUrlTransform}
-          >
-            {text}
-          </ReactMarkdown>
-        </ChatMarkdownTextContext>
+          />
+        ))}
       </ChatMarkdownRendererContext>
       {localMediaPreview ? (
         <ExpandedImageDialog preview={localMediaPreview} onClose={closeLocalMediaPreview} />
diff --git a/apps/web/src/components/chat/markdownStreamBlocks.test.tsx b/apps/web/src/components/chat/markdownStreamBlocks.test.tsx
new file mode 100644
index 0000000000000..ae81316580bbd
--- /dev/null
+++ b/apps/web/src/components/chat/markdownStreamBlocks.test.tsx
@@ -0,0 +1,61 @@
+import {
+  CHAT_MARKDOWN_REHYPE_PLUGINS,
+  CHAT_MARKDOWN_REMARK_PLUGINS,
+} from "@t3tools/shared/markdownPipeline";
+import { renderToStaticMarkup } from "react-dom/server";
+import ReactMarkdown from "react-markdown";
+import { describe, expect, it } from "vite-plus/test";
+
+import { splitMarkdownBlocks } from "./markdownStreamBlocks";
+
+// Whitespace between top-level blocks collapses in the rendered message.
+const html = (source: string) =>
+  renderToStaticMarkup(
+    <ReactMarkdown
+      remarkPlugins={CHAT_MARKDOWN_REMARK_PLUGINS}
+      rehypePlugins={CHAT_MARKDOWN_REHYPE_PLUGINS}
+    >
+      {source}
+    </ReactMarkdown>,
+  )
+    .replace(/>\s+</g, "><")
+    .trim();
+
+describe("splitMarkdownBlocks", () => {
+  it.each([
+    "# Title\n\nFirst paragraph with `code` and **bold**.\n\nSecond [link](https://example.com).",
+    "- one\n- two\n\n- loose three\n\n  continued\n\nAfter the list.",
+    "1. first\n\n2. second\n\nText\n\n3) restarted",
+    "```ts\nconst a = 1;\n\n\nconst b = 2;\n```\n\nafter\n\n~~~\nx\n\n~~~~\n\ny\n~~~\n\nend",
+    "> quote\n\n> another quote\n\n> [!NOTE]\n> alert",
+    "| a | b |\n| - | - |\n| 1 | 2 |\n\nAfter the table.",
+    "para\n\n    indented code\n\nnext",
+    "Setext\n===\n\nnext\n---\n\n- [ ] task\n- [x] done",
+  ])("renders each block as the whole text renders it, at every streamed prefix: %j", (text) => {
+    for (let end = 0; end <= text.length; end++) {
+      const source = text.slice(0, end);
+      const blocks = splitMarkdownBlocks(source);
+      expect(blocks?.join("")).toBe(source);
+      expect(blocks!.map(html).join("")).toBe(html(source));
+    }
+  });
+
+  it("splits only between closed blocks", () => {
+    expect(splitMarkdownBlocks("a\n\n```\nb\n\nc\n```\n\n- d\n\n- e\n\nf")).toEqual([
+      "a\n\n",
+      "```\nb\n\nc\n```\n\n- d\n\n- e\n\n",
+      "f",
+    ]);
+  });
+
+  it.each([
+    "[ref]\n\n[ref]: /later",
+    "a[^x]\n\n[^x]: note",
+    "<details>\n\nbody\n\n</details>",
+    ":::note\n\ncontent\n\n:::",
+    "$$\na\n\nb\n$$",
+    "a\r\n\r\nb",
+  ])("keeps text with document-wide syntax whole: %j", (text) => {
+    expect(splitMarkdownBlocks(text)).toBeNull();
+  });
+});
diff --git a/apps/web/src/components/chat/markdownStreamBlocks.ts b/apps/web/src/components/chat/markdownStreamBlocks.ts
new file mode 100644
index 0000000000000..52415ae71977b
--- /dev/null
+++ b/apps/web/src/components/chat/markdownStreamBlocks.ts
@@ -0,0 +1,43 @@
+// Definitions, footnotes, raw HTML, container directives and display math can tie blocks together.
+const DOCUMENT_WIDE_SYNTAX = /^ {0,3}(?:\[[^\]\n]+\]:|<[A-Za-z!?/]|:::|\$\$)|\[\^/m;
+const FENCE_PATTERN = /^ {0,3}(`{3,}|~{3,})/;
+// After a blank line these still continue the previous block: a list item or indented content.
+const CONTINUATION_PATTERN = /^(?:[ \t]|(?:[-*+]|\d{1,9}[.)])(?:[ \t]|$))/;
+
+/**
+ * Cuts Markdown at blank lines that close every open block, so each piece renders exactly as it
+ * would inside the whole text. Returns null when the text uses syntax that spans blocks.
+ */
+export function splitMarkdownBlocks(text: string): string[] | null {
+  if (text.includes("\r") || DOCUMENT_WIDE_SYNTAX.test(text)) return null;
+  const blocks: string[] = [];
+  let blockStart = 0;
+  let lineStart = 0;
+  let fence: string | null = null;
+  let afterBlankLine = false;
+  for (const line of text.split("\n")) {
+    const opener = FENCE_PATTERN.exec(line)?.[1];
+    if (fence !== null) {
+      if (
+        opener &&
+        opener[0] === fence[0] &&
+        opener.length >= fence.length &&
+        line.trim() === opener
+      ) {
+        fence = null;
+      }
+    } else if (line.trim() === "") {
+      afterBlankLine = true;
+    } else {
+      if (afterBlankLine && lineStart > blockStart && !CONTINUATION_PATTERN.test(line)) {
+        blocks.push(text.slice(blockStart, lineStart));
+        blockStart = lineStart;
+      }
+      afterBlankLine = false;
+      fence = opener ?? null;
+    }
+    lineStart += line.length + 1;
+  }
+  blocks.push(text.slice(blockStart));
+  return blocks;
+}
diff --git a/apps/web/test/appScenarios.renders.tsx b/apps/web/test/appScenarios.renders.tsx
index cc7d67798ddd9..5bb6836dd04a7 100644
--- a/apps/web/test/appScenarios.renders.tsx
+++ b/apps/web/test/appScenarios.renders.tsx
@@ -182,7 +182,7 @@ it("app-stream-assistant-turn", async () => {
   const counted = await measure(async () => {
     let text = "";
     for (let delta = 0; delta < STREAM_DELTAS; delta++) {
-      text += `word${delta} `;
+      text += `word${delta}\n\n`;
       await act(() =>
         emitThreadEvent(LIVE, {
           type: "turn-item.updated",
@@ -204,6 +204,8 @@ it("app-stream-assistant-turn", async () => {
   // Only the streaming row changes; history rows must not re-render with it.
   expect(counted.components.UserTimelineRow).toBeUndefined();
   expect(counted.components.AssistantTimelineRow).toBe(STREAM_DELTAS);
+  // Each delta adds a paragraph; finished blocks keep their render.
+  expect(counted.components.MarkdownParagraph).toBe(STREAM_DELTAS);
   await report("app-stream-assistant-turn", [counted], { commits: false });
 });
 

From aaee7743f813984cdf2d266e99f22cea4f28ca6e Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 02:10:41 -0700
Subject: [PATCH 144/146] perf(web): the git actions panel no longer re-renders
 on every streamed update (#27418)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/web/src/components/GitActionsControl.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/web/src/components/GitActionsControl.tsx b/apps/web/src/components/GitActionsControl.tsx
index cae352e6d6b26..a125ceacaed24 100644
--- a/apps/web/src/components/GitActionsControl.tsx
+++ b/apps/web/src/components/GitActionsControl.tsx
@@ -89,7 +89,7 @@ import {
   useVcsInitAction,
   useVcsPullAction,
 } from "../state/sourceControlActions";
-import { useThreadProjection, useQuietThreadShell } from "~/state/entities";
+import { useQuietThreadProjection, useQuietThreadShell } from "~/state/entities";
 import { readEnvironmentScope, useEnvironmentScope } from "~/state/session";
 import { useEnvironmentQuery } from "~/state/query";
 import { serverEnvironment } from "~/state/server";
@@ -958,7 +958,7 @@ export default function GitActionsControl({
         ? store.getDraftThreadByRef(activeThreadRef)
         : null,
   );
-  const activeServerThreadProjection = useThreadProjection(
+  const activeServerThreadProjection = useQuietThreadProjection(
     activeDraftThread !== null && activeServerThreadShell === null ? null : activeThreadRef,
   );
   const activeServerThread =

From 3cbc98241d33f202b78c1ebe7e5b8f35f5d6ac29 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 02:10:41 -0700
Subject: [PATCH 145/146] perf(web): streamed assistant text re-renders only
 its own row (#27419)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../src/components/chat/ThreadTimeline.tsx    |  7 +--
 .../components/chat/TimelineAssistantRows.tsx | 10 +++-
 apps/web/src/state/entities.ts                | 26 ++++++++++
 apps/web/test/appScenarios.renders.tsx        |  4 +-
 .../src/state/threadDetail.test.ts            | 36 +++++++++++++
 .../client-runtime/src/state/threadDetail.ts  | 50 +++++++++++++++++++
 6 files changed, 127 insertions(+), 6 deletions(-)

diff --git a/apps/web/src/components/chat/ThreadTimeline.tsx b/apps/web/src/components/chat/ThreadTimeline.tsx
index 7d1db86178cf4..a68d494d8b0a0 100644
--- a/apps/web/src/components/chat/ThreadTimeline.tsx
+++ b/apps/web/src/components/chat/ThreadTimeline.tsx
@@ -2,7 +2,7 @@ import type { ScopedThreadRef } from "@t3tools/contracts";
 import { type ComponentProps, useLayoutEffect } from "react";
 import { useIncrementalTimelineEntries } from "../../hooks/useIncrementalTimelineEntries";
 import type { TimelineEntriesInput, TimelineEntry } from "../../session-logic";
-import { useThreadVisibleTurnItems } from "../../state/entities";
+import { useTimelineVisibleTurnItems } from "../../state/entities";
 import {
   peekRememberedThreadTimeline,
   rememberReadyThreadTimeline,
@@ -14,7 +14,8 @@ import { MessagesTimeline } from "./MessagesTimeline";
 /**
  * The timeline with the streamed text. ChatView reads the thread through its quiet
  * atoms, which hold through text deltas; this reads the live turn items, so a
- * delta re-renders the timeline without re-rendering ChatView.
+ * reasoning delta re-renders the timeline without re-rendering ChatView. Streamed
+ * assistant text reaches only its own row, through useAssistantMessageText.
  */
 export function ThreadTimeline({
   threadDetailRef,
@@ -34,7 +35,7 @@ export function ThreadTimeline({
   syncing: boolean;
   detailLoading: boolean;
 }) {
-  const visibleTurnItems = useThreadVisibleTurnItems(threadDetailRef);
+  const visibleTurnItems = useTimelineVisibleTurnItems(threadDetailRef);
   const serverEntries = useIncrementalTimelineEntries(activeThreadKey, {
     ...entriesInput,
     visibleTurnItems,
diff --git a/apps/web/src/components/chat/TimelineAssistantRows.tsx b/apps/web/src/components/chat/TimelineAssistantRows.tsx
index 228eb6f79b9c3..458d84b9e982b 100644
--- a/apps/web/src/components/chat/TimelineAssistantRows.tsx
+++ b/apps/web/src/components/chat/TimelineAssistantRows.tsx
@@ -12,7 +12,7 @@ import { McpAppFrame } from "./McpAppFrame";
 import { checkpointFileTotals } from "@t3tools/client-runtime/state/thread-checkpoints";
 import { ChangedFilesCard } from "./ChangedFilesTree";
 import { useFileContextMenuHandler } from "../../fileContextMenu";
-import { useProject, useThreadShell } from "../../state/entities";
+import { useAssistantMessageText, useProject, useThreadShell } from "../../state/entities";
 import { MessageCopyButton } from "./MessageCopyButton";
 import { AssistantCitationSource } from "./AssistantCitationSource";
 import { resolveAssistantMessageCopyState } from "./MessagesTimeline.logic";
@@ -26,7 +26,13 @@ import { MESSAGE_HEADING_LEVEL, MessageAuthorHeading } from "./TimelineRowParts"
 
 export function AssistantTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "message" }> }) {
   const ctx = use(TimelineRowCtx);
-  const messageText = row.message.text || (row.message.streaming ? "" : "(empty response)");
+  // The timeline holds a streaming message's row while only its text grows.
+  const liveText = useAssistantMessageText(
+    row.message.streaming ? ctx.threadRef : null,
+    row.projectedItem?.item.id,
+  );
+  const text = liveText ?? row.message.text;
+  const messageText = text || (row.message.streaming ? "" : "(empty response)");
 
   return (
     <>
diff --git a/apps/web/src/state/entities.ts b/apps/web/src/state/entities.ts
index 54b367df15b8b..0f94280768d4b 100644
--- a/apps/web/src/state/entities.ts
+++ b/apps/web/src/state/entities.ts
@@ -65,6 +65,9 @@ const EMPTY_VISIBLE_TURN_ITEMS_ATOM = Atom.make(EMPTY_VISIBLE_TURN_ITEMS).pipe(
 const EMPTY_CHECKPOINT_SUMMARIES_ATOM = Atom.make<ReadonlyArray<ThreadCheckpointSummary>>(
   Object.freeze([]),
 ).pipe(Atom.withLabel("web-thread-checkpoint-summaries:empty"));
+const EMPTY_ASSISTANT_MESSAGE_TEXT_ATOM = Atom.make<string | null>(null).pipe(
+  Atom.withLabel("web-assistant-message-text:empty"),
+);
 const EMPTY_LAST_VISITED_AT_ATOM = Atom.make<DateTime.Utc | null>(null).pipe(
   Atom.withLabel("web-thread-last-visited:empty"),
 );
@@ -212,6 +215,29 @@ export function useThreadVisibleTurnItems(
   );
 }
 
+/** Visible turn items held through streamed assistant text; see useAssistantMessageText. */
+export function useTimelineVisibleTurnItems(
+  ref: ScopedThreadRef | null,
+): ReadonlyArray<OrchestrationV2ProjectedTurnItem> {
+  return useAtomValue(
+    ref === null
+      ? EMPTY_VISIBLE_TURN_ITEMS_ATOM
+      : environmentThreadDetails.timelineVisibleTurnItemsAtom(ref),
+  );
+}
+
+/** One assistant message's live text, or null when the thread does not hold the item. */
+export function useAssistantMessageText(
+  ref: ScopedThreadRef | null,
+  itemId: string | undefined,
+): string | null {
+  return useAtomValue(
+    ref === null || itemId === undefined
+      ? EMPTY_ASSISTANT_MESSAGE_TEXT_ATOM
+      : environmentThreadDetails.assistantMessageTextAtom(ref, itemId),
+  );
+}
+
 /** Visible turn items without their streamed text; see ThreadStructure. */
 export function useQuietThreadVisibleTurnItems(
   ref: ScopedThreadRef | null,
diff --git a/apps/web/test/appScenarios.renders.tsx b/apps/web/test/appScenarios.renders.tsx
index 5bb6836dd04a7..459f3b9791d7f 100644
--- a/apps/web/test/appScenarios.renders.tsx
+++ b/apps/web/test/appScenarios.renders.tsx
@@ -201,7 +201,9 @@ it("app-stream-assistant-turn", async () => {
       .element(page.getByText(`word${STREAM_DELTAS - 1}`, { exact: false }))
       .toBeVisible();
   });
-  // Only the streaming row changes; history rows must not re-render with it.
+  // Only the streaming row changes. The timeline renders for the new item and its layout, not
+  // per delta, and history rows not at all.
+  expect(counted.components.ConversationTimeline).toBeLessThanOrEqual(3);
   expect(counted.components.UserTimelineRow).toBeUndefined();
   expect(counted.components.AssistantTimelineRow).toBe(STREAM_DELTAS);
   // Each delta adds a paragraph; finished blocks keep their render.
diff --git a/packages/client-runtime/src/state/threadDetail.test.ts b/packages/client-runtime/src/state/threadDetail.test.ts
index 8fc01839183fe..3e66202d0bb4b 100644
--- a/packages/client-runtime/src/state/threadDetail.test.ts
+++ b/packages/client-runtime/src/state/threadDetail.test.ts
@@ -197,6 +197,42 @@ describe("quietThreadAtom", () => {
   });
 });
 
+describe("timelineVisibleTurnItemsAtom", () => {
+  const ref = { environmentId: EnvironmentId.make("environment-1"), threadId: v2ThreadId };
+
+  it("holds through streamed assistant text while the message reads its own text", () => {
+    const stateAtom = Atom.make(
+      AsyncResult.success({
+        ...EMPTY_ENVIRONMENT_THREAD_STATE,
+        data: Option.some<OrchestrationV2ThreadProjection>(withItem(assistant)),
+      }),
+    );
+    const details = createEnvironmentThreadDetailAtoms(() => stateAtom);
+    const timelineAtom = details.timelineVisibleTurnItemsAtom(ref);
+    const textAtom = details.assistantMessageTextAtom(ref, assistant.id);
+    const registry = AtomRegistry.make();
+    registry.mount(timelineAtom);
+    registry.mount(textAtom);
+    const push = (item: OrchestrationV2TurnItem) =>
+      registry.set(
+        stateAtom,
+        AsyncResult.success({
+          ...EMPTY_ENVIRONMENT_THREAD_STATE,
+          data: Option.some(withItem(item, later)),
+        }),
+      );
+    const first = registry.get(timelineAtom);
+
+    push({ ...assistant, text: "Hello", updatedAt: later });
+    expect(registry.get(timelineAtom)).toBe(first);
+    expect(registry.get(textAtom)).toBe("Hello");
+
+    push({ ...assistant, text: "Hello", streaming: false, status: "completed" });
+    expect(registry.get(timelineAtom)[0]?.item).toMatchObject({ text: "Hello", streaming: false });
+    registry.dispose();
+  });
+});
+
 it("only compares replaced entries in a streamed reducer delta", () => {
   const size = 100;
   let slotReads = 0;
diff --git a/packages/client-runtime/src/state/threadDetail.ts b/packages/client-runtime/src/state/threadDetail.ts
index 3819c5d92ba5e..eeeda6a2f348f 100644
--- a/packages/client-runtime/src/state/threadDetail.ts
+++ b/packages/client-runtime/src/state/threadDetail.ts
@@ -148,6 +148,26 @@ function sameVisibleTurnItemStructure(before: VisibleTurnItem, after: VisibleTur
   );
 }
 
+function isStreamingAssistantMessage(visibleItem: VisibleTurnItem): boolean {
+  return visibleItem.item.type === "assistant_message" && visibleItem.item.streaming;
+}
+
+/** Whether `next` only streams more text into assistant messages that were already streaming. */
+function sameApartFromStreamedAssistantText(
+  previous: OrchestrationV2ThreadProjection["visibleTurnItems"],
+  next: OrchestrationV2ThreadProjection["visibleTurnItems"],
+): boolean {
+  return sameProjectionArray(
+    previous,
+    next,
+    (before, after) =>
+      before === after ||
+      (isStreamingAssistantMessage(before) &&
+        isStreamingAssistantMessage(after) &&
+        sameVisibleTurnItemStructure(before, after)),
+  );
+}
+
 /**
  * Whether `previous` and `next` have the same ThreadStructure: they differ
  * only by text streamed into existing assistant and reasoning items or by a
@@ -267,6 +287,32 @@ export function createEnvironmentThreadDetailAtoms<E>(
     );
   });
 
+  // Holds while only streamed assistant text moves, so the timeline re-renders on structure;
+  // each streaming message reads its text through assistantMessageTextAtom.
+  const timelineVisibleTurnItemsAtomFamily = Atom.family((key: string) => {
+    let previous = EMPTY_VISIBLE_TURN_ITEMS;
+    return Atom.make((get) => {
+      const next = get(visibleTurnItemsAtomFamily(key));
+      if (!sameApartFromStreamedAssistantText(previous, next)) previous = next;
+      return previous;
+    }).pipe(
+      Atom.setIdleTTL(0),
+      Atom.withLabel(`environment-thread-timeline-visible-turn-items:${key}`),
+    );
+  });
+
+  const assistantMessageTextAtomFamily = Atom.family((key: string) => {
+    const separator = key.lastIndexOf("\u0000");
+    const thread = key.slice(0, separator);
+    const itemId = key.slice(separator + 1);
+    return Atom.make((get) => {
+      const item = get(visibleTurnItemsAtomFamily(thread)).find(
+        (visibleItem) => visibleItem.item.id === itemId,
+      )?.item;
+      return item?.type === "assistant_message" ? item.text : null;
+    }).pipe(Atom.setIdleTTL(0), Atom.withLabel(`environment-thread-assistant-message-text:${key}`));
+  });
+
   const queueWorkflowAtomFamily = Atom.family((key: string) => {
     let previous: Pick<
       OrchestrationV2ThreadProjection,
@@ -472,6 +518,10 @@ export function createEnvironmentThreadDetailAtoms<E>(
     visibleTurnItemsAtom: (ref: ScopedThreadRef) => visibleTurnItemsAtomFamily(threadKey(ref)),
     quietVisibleTurnItemsAtom: (ref: ScopedThreadRef) =>
       quietVisibleTurnItemsAtomFamily(threadKey(ref)),
+    timelineVisibleTurnItemsAtom: (ref: ScopedThreadRef) =>
+      timelineVisibleTurnItemsAtomFamily(threadKey(ref)),
+    assistantMessageTextAtom: (ref: ScopedThreadRef, itemId: string) =>
+      assistantMessageTextAtomFamily(`${threadKey(ref)}\u0000${itemId}`),
     statusAtom: (ref: ScopedThreadRef) => statusAtomFamily(threadKey(ref)),
     sequenceAtom: (ref: ScopedThreadRef) => sequenceAtomFamily(threadKey(ref)),
     errorAtom: (ref: ScopedThreadRef) => errorAtomFamily(threadKey(ref)),

From 32ecd71726fee16f335484c1f95cbce126d461f6 Mon Sep 17 00:00:00 2001
From: Julius Marminge <julius0216@outlook.com>
Date: Fri, 30 Oct 2026 02:17:08 -0700
Subject: [PATCH 146/146] fix(server): `t3 service protect` can ask for your
 sudo password (#27465)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/server/src/cli/service.ts                  | 10 +++++++++-
 apps/server/src/cloud/serviceProtection.test.ts | 13 +++++++++----
 apps/server/src/cloud/serviceProtection.ts      |  3 +++
 3 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/apps/server/src/cli/service.ts b/apps/server/src/cli/service.ts
index 62edb31d14b62..884cd28c9df87 100644
--- a/apps/server/src/cli/service.ts
+++ b/apps/server/src/cli/service.ts
@@ -314,6 +314,14 @@ const serviceProtectCommand = Command.make("protect", {
             );
           }
 
+          yield* Console.log(
+            [
+              "Keeps T3 Code running when agents fill this machine's memory:",
+              "  - reserves memory for the T3 Code server, so the kernel takes memory from agents first",
+              "  - makes the out-of-memory killer pick agents before the server",
+              "It adds systemd drop-in files and changes nothing else. Undo with `t3 service protect --undo`.",
+            ].join("\n"),
+          );
           const names = remote.map((unit) => unit.replace(/\.service$/, "")).join(" and ");
           const protectRemote =
             remote.length > 0 &&
@@ -328,7 +336,7 @@ const serviceProtectCommand = Command.make("protect", {
           });
           yield* Console.log(
             [
-              "As root, through sudo:",
+              "Drop-ins it writes, as root through sudo:",
               ...formatDropIns(plan.system),
               "As you:",
               ...formatDropIns([plan.managerDefaults, ...plan.user]),
diff --git a/apps/server/src/cloud/serviceProtection.test.ts b/apps/server/src/cloud/serviceProtection.test.ts
index b2e4a1506cb31..eef78cd3f82e7 100644
--- a/apps/server/src/cloud/serviceProtection.test.ts
+++ b/apps/server/src/cloud/serviceProtection.test.ts
@@ -11,6 +11,7 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Sink from "effect/Sink";
 import * as Stream from "effect/Stream";
+import type * as ChildProcess from "effect/process/ChildProcess";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import * as ProcessRunner from "../processRunner.ts";
@@ -122,13 +123,13 @@ it.each([
   expect(ServiceProtection.loadedRemoteAccessUnits(shown)).toEqual(expected);
 });
 
-const fakeSudo = (exitCode: number, onRun: () => void) =>
+const fakeSudo = (exitCode: number, onRun: (command: ChildProcess.StandardCommand) => void) =>
   ChildProcessSpawner.make((command) =>
     Effect.gen(function* () {
       if (command._tag !== "StandardCommand" || command.command !== "sudo") {
         return yield* Effect.die("Unexpected command");
       }
-      onRun();
+      onRun(command);
       return ChildProcessSpawner.makeHandle({
         pid: ChildProcessSpawner.ProcessId(123),
         stdout: Stream.empty,
@@ -180,11 +181,13 @@ it.effect("lowers no score before the manager default is in place, and undoes in
       writesManagerDropIn = false,
     ) => {
       let atSudo: ReturnType<typeof present> | undefined;
+      let sudoOptions: ChildProcess.CommandOptions | undefined;
       return effect.pipe(
         Effect.provideService(
           ChildProcessSpawner.ChildProcessSpawner,
-          fakeSudo(exitCode, () => {
+          fakeSudo(exitCode, (command) => {
             atSudo = present();
+            sudoOptions = command.options;
             if (writesManagerDropIn) {
               NodeFS.mkdirSync(NodePath.dirname(managerDropIn), { recursive: true });
               NodeFS.writeFileSync(managerDropIn, "[Service]\nOOMScoreAdjust=-900\n");
@@ -192,7 +195,7 @@ it.effect("lowers no score before the manager default is in place, and undoes in
           }),
         ),
         Effect.exit,
-        Effect.map((exit) => ({ exit, atSudo })),
+        Effect.map((exit) => ({ exit, atSudo, sudoOptions })),
       );
     };
     const refused = yield* withSudo(ServiceProtection.applyProtection(plan), 1);
@@ -209,6 +212,8 @@ it.effect("lowers no score before the manager default is in place, and undoes in
 
     const applied = yield* withSudo(ServiceProtection.applyProtection(plan), 0);
     expect(applied.atSudo).toEqual({ managerDefaults: true, user: 0 });
+    // sudo needs the controlling terminal to ask for a password.
+    expect(applied.sudoOptions).toMatchObject({ detached: false, stdin: "inherit" });
     expect(present()).toEqual({ managerDefaults: true, user: plan.user.length });
 
     const removed = yield* withSudo(ServiceProtection.removeProtection(plan), 0);
diff --git a/apps/server/src/cloud/serviceProtection.ts b/apps/server/src/cloud/serviceProtection.ts
index b23cd36e3a545..780aee83b4c48 100644
--- a/apps/server/src/cloud/serviceProtection.ts
+++ b/apps/server/src/cloud/serviceProtection.ts
@@ -240,7 +240,10 @@ const runPrivileged = Effect.fn("ServiceProtection.runPrivileged")(function* (sc
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const exitCode = yield* spawner
     .exitCode(
+      // Effect detaches children on POSIX by default; sudo then has no controlling
+      // terminal and cannot ask for a password.
       ChildProcess.make("sudo", ["/bin/sh", "-c", script], {
+        detached: false,
         stdin: "inherit",
         stdout: "inherit",
         stderr: "inherit",