chore(upstream): sync marcode through 5192f777f

[maarco]

What Changed

Merges 5 upstream commits from pingdotgg/t3code, ca72e381c..5192f777f, as one two-parent merge commit.

SHA	Commit
0ad91b6e	fix(server): follow branch drift in dedicated worktrees so PRs link to their thread (pingdotgg#5159)
d3037064	fix(server): make remote updates rollback-safe (pingdotgg#5181)
78eb3eca	fix(web): stop settle controls overlapping the status label (pingdotgg#4574)
283c7ac4	fix: normalize app icon glyph sizing (pingdotgg#5202)
5192f777	fix(server): surface cloudflared FTL/PNC relay logs as warnings, not debug (pingdotgg#5076)

The bulk is d3037064, which reworks remote updates around a new stable service launcher (serviceLauncher.ts, cloud/serviceLauncherClient.ts, cloud/serviceProtocol.ts, cloud/servicePreflight.ts) and rewrites cloud/selfUpdate.ts and cloud/bootService.ts.

Conflicts resolved (15 paths)

apps/server/src/cloud/**, serverRuntimeStartup.ts — hotspot server-runtime. Marcode's divergence in these files was entirely service identity, so upstream's rewrites were taken and that identity re-applied on top: BOOT_SERVICE_NAME = "marcode", Description=Marcode server, Environment=MARCODE_HOME=, and the Marcode background-service error message.

serverRuntimeStartup.ts needed care: upstream moved the pairing-URL block rather than editing it in place. Accepting their side alone would have silently reverted Marcode's wording along with the old location, so the branded string is re-applied at the block's new home.

In selfUpdate.ts upstream deleted the systemd-sniffing block Marcode's only divergence lived in (capability detection moved into the launcher), so that file now matches upstream exactly — deliberately, not by taking a side.

cloud/*.test.ts — upstream's rewritten tests, with Marcode's unit name and base dir. Upstream dropped the exhaustive unit-string assertion, which was the thing pinning Marcode's branding, so there is a focused replacement test covering the unit file name, description, and MARCODE_HOME. The next upstream rewrite of the renderer will conflict there instead of quietly rebranding an installed service.

assets/prod/** (10 files) — hotspot release-branding. Kept Marcode's mark; the files are byte-identical to main. Upstream's change is glyph geometry for the T3 wordmark (128×128 viewBox, scale 10 → 8.5) and carries no fix that transfers to a different mark.

Two fork-boundary breaks this merge would otherwise have shipped

Neither surfaced as a conflict — both were silent.

1. The background service would not have started. Upstream's new serviceLauncher.ts reads T3CODE_HOME and throws when it is unset, but the unit Marcode installs exports MARCODE_HOME (the same variable the server reads at apps/server/src/cli/config.ts:107). The launcher would have exited before starting a server on every Marcode install. Base-dir resolution is now an exported resolveLauncherBaseDir with a test pinning it to the variable the unit actually exports.

2. CheckpointReactor's new branch-drift test failed. It hardcoded a t3code/0a1b2c3d placeholder branch, but Marcode renamed WORKTREE_BRANCH_PREFIX to marcode, so isTemporaryWorktreeBranch no longer classified the fixture as temporary and the reactor adopted it. The fixture now derives from the exported constant.

Left deliberately upstream-shaped

T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, and the t3 package/CLI name are compatibility identifiers. New upstream user-facing copy naming "the T3 Code background service" (selfUpdate.ts, cloud/servicePreflight.ts) was also left alone: main already words docs/user/background-service.md, docs/user/updating.md, and the sibling "T3 Code desktop app" strings that way, so rebranding only the new lines would have made the fork less consistent, not more. Worth a separate decision if that copy should move to Marcode wording.

Why

Routine upstream sync. d3037064 makes remote updates rollback-safe and 0ad91b6e stops a thread's PR being orphaned when an agent checks out a different branch in its worktree — both worth carrying, and both land in files Marcode has customized.

UI Changes

78eb3eca touches apps/web/src/components/SidebarV2.tsx, swapping focus-within for focus-visible so settle controls stop covering the status label after a mouse click. The file has zero Marcode divergence from the merge base, so it merged without conflict and needed no reconciliation.

No before/after images: this is an upstream-authored CSS state change carried unmodified, and it was not driven live in a browser here. Flagged below rather than assumed.

Checklist

• This PR is small and focused — one upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — see UI Changes; not run
• I included a video for animation/interaction changes — n/a

Verification run

• bootService, selfUpdate, serviceLauncher, servicePreflight, serviceLauncherClient, serverActivation, pinnedRuntime — 28/28 pass
• CheckpointReactor — 16/16 pass (after the fixture fix)
• ManagedEndpointRuntime, client-runtime/state/server — pass
• Typecheck: t3, @t3tools/contracts, @t3tools/client-runtime, @t3tools/shared, @t3tools/web — all exit 0, zero errors
• vp fmt --check on every changed file — clean
• vp lint on apps/server/src, packages/shared/src, SidebarV2.tsx — exit 0
• No lockfile or pnpm-workspace.yaml movement, so no coupled vendored-subtree findings

Not verified here

• server.test.ts "reports workspace root stat failures without relabeling them as missing" fails locally. Pre-existing and environmental, not from this merge: the test predates the merge base, upstream did not touch it in this delta, and it chmod 0o000s a directory expecting stat to fail — which cannot happen under the uid 0 this container runs as. Expected to pass on CI.
• vp run icons:check could not run — it needs a macOS Icon Composer 2.x exporter. The asset files are byte-identical to main, so there is nothing new for it to validate.
• No live browser pass for the SidebarV2 hover/focus change.

---

Generated by Claude Code