fix: integrate upstream checkpoint 5e1c23d769b1

[Nurozen]

Lecturn was 26 upstream commits behind (13427ec..5e1c23d). This merge brings them in: the docs rewrite, the Windows host-portability test series, and eight small fixes, with Lecturn naming, thread forking, Stave, Connect multi-account and the fork's mobile styling kept.

What changes

• Web: panels no longer replay their open/close animation when you move between threads (fix(web): stop panel motion during navigation pingdotgg/t3code#9766); composer selectors open below their control instead of over it (fix(web): open composer selectors below controls pingdotgg/t3code#9767); the running tool label gets its shine back (fix(web): restore the running tool label shine pingdotgg/t3code#9777); provider refresh/add controls sit on the machine-tab row (fix(web): align provider controls with machine tabs pingdotgg/t3code#9769).
• Mobile: the usage screen is split into Usage and Limits tabs with compact period and metric controls (feat(mobile): split the usage page into Usage and Limits tabs pingdotgg/t3code#9775), rendered on the fork's glass cards with font-lecturn-* weights and the mobile palette.
• Server: retired Codex models disappear after a refresh (fix(server): remove retired Codex models after refresh pingdotgg/t3code#9773); tool.denied is a valid runtime event type (fix(contracts): include tool.denied in runtime event types pingdotgg/t3code#9770); directory fsync tolerates Windows EPERM; theme files refuse symlinks on Windows; media paths are canonicalised the same way as their callers; the Linux resource monitor skips unused per-process detail reads (perf(server): skip unused Linux process detail reads pingdotgg/t3code#9768).
• Tests: fake provider CLIs are Node stubs through the new apps/server/src/testUtils/fakeCli.ts, with symlink and long-temp-dir helpers exported from @lecturn/shared/testing/*.
• Docs: upstream's condensed internals and user guides, plus new docs/operations/development.md, docs/operations/connect-setup.md and docs/user/appearance.md.

Fork-specific change to pingdotgg#9773

Upstream's new Codex rule drops cached models whenever a snapshot arrives without them. The fork's managed provider publishes two snapshot shapes upstream does not have, and both would have wiped the cached Codex model list while detection was still failing:

• a failed shell or provider detection republishes the previous snapshot as status: "warning" with discovery.status timed-out or error;
• the next attempt republishes that snapshot with discovery.status: "detecting" before it probes.

shouldRetainMissingProviderModels in apps/server/src/provider/Layers/ProviderRegistry.ts now keeps cached models for a warning snapshot whose discovery is detecting, timed-out or error. A completed ready discovery still drops retired models, and disabled, signed-out or uninstalled providers still clear. The same clause keeps OpenCode skills and slash commands through those snapshots.

ProviderRegistry.test.ts covers the sequence probe timeout → failed detection → detecting (shell and provider phases) → ready for Codex, the signed-out detecting case for Codex and Antigravity, and OpenCode models, skills and slash commands.

Resolution notes for review

• 72 conflicted paths, most from renamed identifiers. The ones needing judgement:
  • CodexTextGeneration.test.ts: the fork-only checks of the old shell stub (app-server and model probes, --ignore-rules workflow isolation, account routing) are ported into upstream's Node stub. One test now spreads process.env into its explicit environment so the launcher can find node.
  • CursorTextGeneration.test.ts and GrokTextGeneration.test.ts: the fork's workflow-cwd isolation check is ported into the stub source.
  • AntigravityInstallation.test.ts: upstream structure with the fork's realPath expectations.
• Docs take upstream's rewrite with fork-only sections re-inserted once each (Stave, forking and imports, GitHub Copilot, Connect multi-account, Claude runtime model discovery, Codex rollback, external sessions, and the glossary's "Extensions and Contextual" entry).
• Three upstream doc statements that do not hold for Lecturn are changed:
  • docs/user/install.md keeps the Lecturn installation pointer and leaves out winget/brew/AUR and store links.
  • docs/user/updating.md points mobile users to the TestFlight section of the installation guide instead of "App Store or Google Play releases"; Lecturn has no store release.
  • docs/operations/development.md links the fork README's #development section for installing vp; upstream's #install-vp anchor does not exist here.
• Upstream's rewrite of its Connect doc is applied to docs/internals/lecturn-connect.md, keeping the fork's origin-sync, relay-reservation and multi-account sections.
• Eight docs deleted upstream are deleted here. Their fork-only content moved to docs/operations/development.md (desktop data directories), docs/user/appearance.md (mobile surfaces, account colours), docs/user/thread-sidebar.md (tool activity) and AGENTS.md (ADR and artifacts/ rules).
• Cleanly merged files got an identity pass: @t3tools/* imports in 14 test and helper files, temp prefixes, and the three new docs.

Verification

• vp fmt --check over all changed files and the unscoped git diff --cached --check pass.
• Server: 40 test files, 1086 passed and 1 skipped. Desktop: 90 passed. Shared: 14 passed. Contracts, ssh, tailscale and scripts: 70 passed. Web panelAnimations.test.tsx passes. The 49 controller tests pass.
• Typechecks for server, web, mobile, shared and scripts exit 0 with suggestion-level diagnostics only.
• Two tests fail on this macOS host and fail the same way on the fork base, so they are not declared as checks: apps/server/src/entrypoint.test.ts (symlinked temp dir) and one case in scripts/build-desktop-artifact.test.ts (cross-architecture Windows payload probe).
• Not run: the native/resource-monitor Rust tests (local rustc is older than sysinfo requires); that diff was reviewed by reading. Windows-host behaviour of the portability series cannot be exercised here.

UI evidence

Captured on isolated before (fork base) and after stacks. The model-retention change touches no UI source, so the captures were not retaken for it.

Change	Before	After
Tool label shine	https://github.com/user-attachments/assets/7ed771ae-f409-4132-b78e-6e8560047092	https://github.com/user-attachments/assets/c5df24a7-7a09-4edd-ad17-1d5733dad886
Tool label shine (video)	tool-shine-before-5e1c23d7-1791191263-1.mp4	tool-shine-after-5e1c23d7-1791191265-1.mp4
Panel motion on navigation (video)	panel-navigation-before-5e1c23d7-1791191267-1.mp4	panel-navigation-after-5e1c23d7-1791191270-1.mp4
Composer selector placement	https://github.com/user-attachments/assets/f398b173-7233-47ed-a50d-68563ed80602	https://github.com/user-attachments/assets/c059dfdd-eaa0-49fb-b353-0590394d775c
Provider controls row	https://github.com/user-attachments/assets/d732b723-f23a-4ac8-b51c-e33807fe7176	https://github.com/user-attachments/assets/0ea5a229-3d16-43c7-8a49-67244aff0b00
Mobile usage screen	https://github.com/user-attachments/assets/d3f5dbab-b423-4cea-9bf9-4da41457e7b2	https://github.com/user-attachments/assets/201b29c2-4dcd-49c8-885a-e5a408bcb2c3
Mobile Limits tab (new)	—	https://github.com/user-attachments/assets/f3965320-9a8a-45ce-b958-3bdf6d7099b6

With panel animations at 400 ms, navigating to a thread whose right panel is open animated the layout over about 300 ms before and snaps on the first frame after. The provider screenshots are the header strip only (machine tabs with the "Checked … ago" and "+" controls): before, the controls sit on a separate "Providers" title row above the tabs; after, they share the tab row. The strip stops above the host's account details. The mobile screenshots show the host's real usage totals and subscription quota.

🤖 Generated with Claude Code

Integrates 26 upstream commits through 5e1c23d769b182018f5bd6d3623a7edec13d26bc. Scope: the first 26 candidates (2e688a5..5e1c23d), linear history with no merges. Net diff accepted..target excluding .repos is 141 files, +5397/-8729 = 14,126 lines, inside both limits (26 of 50 commits, 14,126 of 15,000 lines). Going one commit further to 394e847 gives 15,335 lines and the full 30 gives 15,742, so both exceed the limit.

Why this cut is coherent:

• Docs rewrite pair docs: keep internal guides focused on architecture pingdotgg/t3code#9755/docs: focus user guides on features and workflows pingdotgg/t3code#9756 (about 8.5k lines, mostly deletions) stays together with its two follow-ups: docs(web): document panel motion during navigation pingdotgg/t3code#9778 adds to docs/user/appearance.md, which docs: focus user guides on features and workflows pingdotgg/t3code#9756 creates, and documents the panel-motion fix fix(web): stop panel motion during navigation pingdotgg/t3code#9766; feat(mobile): split the usage page into Usage and Limits tabs pingdotgg/t3code#9775 edits docs/user/usage.md.
• The complete Windows host-portability series test: stop path and platform tests depending on the host OS pingdotgg/t3code#9564–test(server): make Windows path and async fixtures deterministic pingdotgg/t3code#9576, fix(server): refuse symlinked theme files on Windows too pingdotgg/t3code#9580, test(scripts): keep Windows packaging checks host-portable pingdotgg/t3code#9589 (15 commits) lands as one unit. It shares a new helper, apps/server/src/testUtils/fakeCli.ts, plus .gitattributes, vite config and packages/shared/package.json changes that later commits in the series rely on, so splitting it would leave half-converted fixtures.
• The rest are small independent fixes: fix(web): stop panel motion during navigation pingdotgg/t3code#9766, fix(web): open composer selectors below controls pingdotgg/t3code#9767, perf(server): skip unused Linux process detail reads pingdotgg/t3code#9768 (native/resource-monitor), fix(server): remove retired Codex models after refresh pingdotgg/t3code#9773, fix(contracts): include tool.denied in runtime event types pingdotgg/t3code#9770 (tool.denied contract), feat(mobile): split the usage page into Usage and Limits tabs pingdotgg/t3code#9775 (mobile Usage/Limits tabs), fix(web): restore the running tool label shine pingdotgg/t3code#9777, fix(web): align provider controls with machine tabs pingdotgg/t3code#9769.

What is left for the next batch: pingdotgg#9774 custom model prices, pingdotgg#9794, pingdotgg#9784 and pingdotgg#9805. That keeps the usage-pricing feature and the pingdotgg#9784 regression fix together across contracts, server, client-runtime and web. I read the pingdotgg#9784 diff: it wires the usageLimitSources subscription option in rpc/session.ts and the web/mobile runtime.ts files, refreshes limits on every connected environment in web UsagePage, and touches ClaudeProvider and PullRequestService. It does not touch the mobile usage files changed by pingdotgg#9775, so stopping at 5e1c23d does not strand a fix for anything in this batch.

Risks:

1. Docs (45 of 53 upstream files are fork-touched): expect conflicts in nearly every doc. README.md is fork-owned, keep ours. AGENTS.md, CONTRIBUTING.md, docs/README.md, docs/internals/* and docs/user/* need the Lecturn identity re-applied (t3 names, hosts, env vars, npx lecturn).
   • Upstream deletes docs/internals/{ci,scripts,work-artifacts,workspace-layout}.md, docs/user/{environment-theme,mobile-appearance,tool-activity}.md, docs/architecture/terminal-renderers.md and docs/internals/t3-code-connect-auth-flow.html. Expect modify/delete conflicts where the fork edited them; check for fork-only content before accepting the deletion, and fix dangling links from fork-only docs (thread-forking, lecturn-installation, lecturn-release).
   • New docs/operations/{connect-setup,development}.md and docs/user/appearance.md need an identity pass (grep plain t3), then vp fmt --check.
   • docs/internals/t3-connect.md and scripts/build-desktop-artifact.ts are fork-touched; check their doc-path references.
2. Windows test series (63 of 74 files are fork-touched, mostly tests with renamed identifiers): conflicts should be mechanical, but resolve them against the new fakeCli helper.
   • .gitattributes gains 3 lines and must be unioned with the fork's -whitespace entries, because the controller runs an unscoped git diff --cached --check.
   • Keep the fork's package names in packages/shared/package.json exports and the vite configs.
   • Small runtime changes need a real read: serviceLauncher.ts, cloud/bootService.ts (directory fsync tolerance), environmentTheme.ts (symlink refusal), the media path canonicalisation in fix(server): canonicalise media paths the same way their callers do pingdotgg/t3code#9575, and scripts/mobile-showcase.ts.
3. Fork-overlap code: ProviderRegistry.ts/.test.ts (retired Codex models; keep the fork's session plumbing), panelAnimations.ts, BranchToolbarEnvironmentSelector.tsx, MessagesTimeline.tsx (thread-fork union; shine fix), ProviderSettingsPanel.tsx and index.css.
   • Mobile UsageLimitsSection.tsx and UsageRouteScreen.tsx are fork-touched and rewritten by feat(mobile): split the usage page into Usage and Limits tabs pingdotgg/t3code#9775. Use the fork's font-lecturn-* classes, not the dead font-t3-* ones, and verify the usage deep link.
   • native/resource-monitor/src/main.rs is a shared-implementation path; review it, do not take it wholesale.

Nothing in this range touches release.yml, ci.yml or the saga-group, connect-account and thread-fork server surfaces.

Fresh independent review approved tree 60315c3897bf80c8ec5bfbe2f452a1d1cbcea7ac after controller-rerun focused checks. Merge commit required; no squash/rebase.

Before:

After:

panel-navigation-before-5e1c23d7-1791191267-1.mp4

panel-navigation-after-5e1c23d7-1791191270-1.mp4

tool-shine-before-5e1c23d7-1791191263-1.mp4

tool-shine-after-5e1c23d7-1791191265-1.mp4

Implemented and independently reviewed by fresh Claude Code agents (claude-fable-5-1 top-level, claude-opus-5 subagents).