fix(server): external MCP reads show background work and native subagent turns - #1648

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…e subagent turns (#1648)

Fork-Domain: device-auth
Fork-Tier: core

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

…ent turns (#1648)

## Problem

External MCP reports run status only.
An owner whose run ended with 5 native subagents still running reads `completed`, and each child reads `idle` with `runCount: 0`.
The UI shows the same owner as **Waiting on 5 subagents**.

Refs #1647; it stays open for the gap below.

## Change

`t3_external_thread_read`, `_list`, and `_wait` gain an additive `work` field.
It reads the projection the UI reads:

| Source | Feeds |
| --- | --- |
| Shell `pendingBackgroundTasks` | `background`, the sidebar's roster |
| Last runless `root_turn` node | `nativeTurn` on provider-native subagents |
| Shell and native turn times | `updatedAt`: the latest |

`work.state` ranks like client-runtime `shellRuntime`:

1. `awaiting_response`: a request waits on a person
2. `running`: a live or queued run, or native turn
3. `waiting_on_background`: held background work
4. `running`: a run waiting on its checkpoint
5. `idle`

### Unchanged

| Field | Rule |
| --- | --- |
| `status`, `pendingRequestCount` | run view, as before |
| Pinned `runId` wait | run outcome stands; `work` reports what remains |
| Native child run ids | none fabricated; `runId` stays null |
| Grant, filters, pagination | `work` computed only for granted, paged rows |

### New wait mode

`until: "work"` polls every 500 ms until `work` is `idle` or `awaiting_response`.
With `runId` it refuses `invalid_request`.

A held command, such as a dev server, stays listed but does not hold the thread.
List reads nodes only for native subagent rows on the page, 4 at a time.
Deleted threads now read as missing at the shell, as the record read already did.

## Known gap: resumed native subagents

`work` reads the projection; it cannot be more current than it.
A native subagent resumed by a later run records nothing on its child thread (#1650, upstream `pingdotgg#16261`).

| Read | Result for a resumed child |
| --- | --- |
| Owner `work.background` | correct: lists it with `childThreadId` |
| Child `work.nativeTurn` | frozen pre-resume turn |
| Child `work.state` | may read `idle` while it works |

Reproduced live on 2026-10-06 with 5 resumed Claude subagents.
The routing fix is separate work under #1650; this PR does not change routing.

## Scope and approval

Owner-requested fix to the fork's external MCP (`device-auth`).
Internal `/mcp` parity is a follow-up.

## Verification

```text
vp test run apps/server/src/mcp/external/           → 47 passed
vp test run apps/server/src/mcp/                    → 256 passed
roster and native turn ignored (mutation)           → 12 of 23 work tests fail
apps/server vp run typecheck                        → exit 0
vp lint <touched files>                             → exit 0
independent review, 2 rounds                        → nothing blocking
aftercare on 6be86e5 (limited, not a full review)   → 0 findings
apps/server vp run build                            → exit 0
vp run fork:ci                                      → exit 0
```

Shells in the tests come from the real `threadShellFromProjection`, shaped like the live repro.
Not yet checked: the running instance; it needs a release and restart.

Claude Opus 5.5 (high, 1m) via Claude Code in T3 Code.

## Fork trailers

Squashes:

- 3c8f826 fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)
- eccf782 fixup! fix(server): external MCP reads show background work and native subagent turns (#1648) (#1648)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>

## Problem

The external MCP connection can read and filter settlement state but cannot change it.
Agents cannot perform the existing UI's settle/unsettle operation through that connection.

## Change

Add `t3_external_thread_settle` with required `threadId`, `settled`, and `clientRequestId`, delegating to the existing lifecycle commands.
Recheck coordination and project access before replay, enforce existing mode ceilings at preflight and under the thread lock, and return the original committed acknowledgement with its command ID and sequence.
Thread read/list continues to report current state after later owner changes.

Settlement retains existing side effects: cancel message-capable async questions and queued automatic wakeups, clear pins/PR watches, and detach provider sessions.
Unsettle reverses the settled flag without restoring those side effects.
The existing predicate rejects active root runs and blocking callback approvals/input; it does not inspect native/background children.

The marked contract export sits in the existing fork-only export group, avoiding the upstream append-boundary conflict.
Rebased onto accepted #1648; only manual resolution was two documentation tables, retaining both features' entries.
Accepted background read/wait behavior survives, including its limitation: resumed native child projections can remain stale.

## Scope and approval

User authorized this focused API parity fix, independent High review, publication, integration resolution and normal source closeout.
No UI, background-observability behavior, credential, grant, account, security-setting or mass-settlement changes.
Runtime release and acceptance remain separately owned.

## Verification

Head: `f1bc18d0fc2c12f37f118dd38b3ea6bb61c5f94b`.
Base/parent: `624767b5026c471d8f8a3ff03a4fddd83e8948df`.
Original checkpoint `a219060e89d4375858cea3c404aa4e7d6e6c6470` retained under `refs/wt-backup/fix/external-mcp-settlement`.
Independent native Codex `gpt-6.1-sol`, `reasoningEffort=high` review: **approve, no material findings** at the new exact head/base.

| Check | Result |
| --- | --- |
| `vp run fork:ci` | Exit 0; 756 scripts tests; scan/check green |
| External MCP, grant, contracts, upstream-client compatibility tests | Exit 0; 114 tests, including 20 settlement tests |
| Existing runtime settlement tests | Exit 0; 6 passed, 61 filtered out |
| Server and contracts typechecks | Both exit 0 |
| `vp run --filter t3 build:bundle` | Exit 0 |
| `vp run knip:check` | Exit 0 |
| HTTP request/response evidence test | Exit 0; 1 passed, 19 filtered out |
| Whole upstream merge-tree policy | Exit 0; no head-only conflicts |

[Final integration evidence](https://github.com/user-attachments/files/33127139/t3-settle-integration-evidence.zip) contains protocol request/response output, exact commands, logs, attributed terminal wrapper receipts and independent review.
Attachment readback matched uploaded bytes.
Policy comparison used the stated base and fresh upstream `3dfe373fddb966101371805b0b102ae5af75b15b`.
All eight required remote checks passed at this head ([CI run](https://github.com/RSI-Software/t3code-hyprws/actions/runs/37525775093)).
Ready-triggered gates remain separate from source CI and independent review.
[Original checkpoint evidence](https://github.com/user-attachments/files/33126181/t3-settle-cifix-evidence.zip) and [published checkpoint review](#1649 (review)) remain available.
That GitHub review is `COMMENTED`, not a formal approval.

<details>
<summary>Coverage and remaining release checks</summary>

Tests cover repeats, concurrent duplicates, key conflicts, session isolation, rebuilt-service recovery, owner reversal before acknowledgement, authorization failures, mode ceilings, and start/archive/delete/mode races.
Parity tests cover cancellations, pin/watch clearing, provider-session projection removal, durable detach intent, and the existing native-child predicate limitation.

The isolated HTTP fixture uses the real route/service/orchestrator with memory SQLite and a mock authenticator.
It does not execute provider processes or a full disk/process restart; existing aggregate lint and bundle warnings remain.
Installed catalog exposure, live authority/refusal behavior, real session detachment and client readback await release.
Runtime remains untouched; deployed `.965` commit identity was not established.

Reproduce protocol evidence at this head:

```sh
T3_SETTLEMENT_EVIDENCE=1 vp test run apps/server/src/mcp/external/ExternalMcpSettlement.fork.test.ts -t "exposes reversible settlement"
```

</details>

Implemented through the Codex harness with `gpt-6.1-sol` at High reasoning.
Native T3 selected provider instance `codex`; validated posting-worker provenance names backend `cliproxy`, harness `[email protected]`.
The new independent reviewer confirms Codex/Sol/High; its backend and harness version remain unconfirmed.
ChatGPT authentication and billing source remain unconfirmed.

## Fork trailers

Squashes:

- 874de6b fix(mcp): expose reversible external thread settlement (#1649) (#1649)
- ebe4e09 fixup! fix(mcp): expose reversible external thread settlement (#1649) (#1649)

Fork-Domain: device-auth
Fork-Tier: core
Co-authored-by: donjor <[email protected]>