From a4f6078bebcb3283e53e1cea247257136ce82cc8 Mon Sep 17 00:00:00 2001
From: MacKinley Smith <smithmackinley@gmail.com>
Date: Fri, 25 Sep 2026 13:43:35 -0600
Subject: [PATCH 01/11] fix(web): return focus to the composer after saving a
 citation note (#13450)

---
 .../components/ComposerPromptEditorTiptap.tsx | 55 +++++++++++++++++++
 .../components/chat/AssistantCitationChip.tsx | 20 +++++++
 2 files changed, 75 insertions(+)

diff --git a/apps/web/src/components/ComposerPromptEditorTiptap.tsx b/apps/web/src/components/ComposerPromptEditorTiptap.tsx
index 74e8736f04e7..2a5fe2ba0588 100644
--- a/apps/web/src/components/ComposerPromptEditorTiptap.tsx
+++ b/apps/web/src/components/ComposerPromptEditorTiptap.tsx
@@ -29,6 +29,7 @@ import {
   useMemo,
   useRef,
   useState,
+  type KeyboardEvent as ReactKeyboardEvent,
 } from "react";
 import { EditorContent, useEditor } from "@tiptap/react";
 
@@ -371,6 +372,16 @@ function ComposerCitationNodeView({ node, editor, getPos }: NodeViewProps) {
       .run();
   }, [editor, nodePos]);
 
+  // Put the caret right after the chip so Enter sends and typing continues the prompt.
+  const onRestoreFocus = useCallback(() => {
+    if (!editor.isEditable) return;
+    const pos = nodePos();
+    if (pos === null) return;
+    const current = editor.state.doc.nodeAt(pos);
+    if (!current || current.type.name !== "composer-citation") return;
+    editor.commands.focus(pos + current.nodeSize);
+  }, [editor, nodePos]);
+
   return (
     <NodeViewWrapper
       as="span"
@@ -378,6 +389,23 @@ function ComposerCitationNodeView({ node, editor, getPos }: NodeViewProps) {
       contentEditable={false}
       spellCheck={false}
       data-composer-citation-chip="true"
+      onKeyDown={(event: ReactKeyboardEvent<HTMLElement>) => {
+        // Tab from the comment button returns to the caret after the chip.
+        if (
+          !editor.isEditable ||
+          event.key !== "Tab" ||
+          event.shiftKey ||
+          event.altKey ||
+          event.metaKey ||
+          event.ctrlKey ||
+          !(event.target instanceof HTMLElement) ||
+          event.target.dataset.citationCommentTrigger === undefined
+        ) {
+          return;
+        }
+        event.preventDefault();
+        onRestoreFocus();
+      }}
     >
       <AssistantCitationChip
         citation={citation}
@@ -396,6 +424,7 @@ function ComposerCitationNodeView({ node, editor, getPos }: NodeViewProps) {
             commentContext.onSubmitAndSend();
             return true;
           },
+          onRestoreFocus,
         }}
       />
     </NodeViewWrapper>
@@ -856,6 +885,32 @@ function ComposerPromptEditorTiptapInner(props: ComposerPromptEditorProps) {
               return true;
             }
           }
+          // Shift+Tab from just after a citation reaches its comment button, which
+          // native tab order skips because the chip lives inside the editor.
+          if (
+            event.key === "Tab" &&
+            event.shiftKey &&
+            !event.altKey &&
+            !event.metaKey &&
+            !event.ctrlKey &&
+            view.state.selection.empty
+          ) {
+            const { $from } = view.state.selection;
+            const citation = $from.nodeBefore;
+            if (citation?.type.name === "composer-citation") {
+              const chip = view.nodeDOM($from.pos - citation.nodeSize);
+              const commentButton =
+                chip instanceof HTMLElement
+                  ? chip.querySelector<HTMLElement>("[data-citation-comment-trigger]")
+                  : null;
+              if (commentButton) {
+                event.preventDefault();
+                event.stopPropagation();
+                commentButton.focus();
+                return true;
+              }
+            }
+          }
           if (event.key === "Enter" && (event.isComposing || event.keyCode === 229)) {
             event.stopPropagation();
             return true;
diff --git a/apps/web/src/components/chat/AssistantCitationChip.tsx b/apps/web/src/components/chat/AssistantCitationChip.tsx
index 6baf14b18887..e03872553a88 100644
--- a/apps/web/src/components/chat/AssistantCitationChip.tsx
+++ b/apps/web/src/components/chat/AssistantCitationChip.tsx
@@ -39,10 +39,13 @@ export function AssistantCitationChip({
     onCancel?: () => void;
     onSave: (comment: string) => boolean;
     onSaveAndSend?: (comment: string) => boolean;
+    /** Returns focus to the host editor when the popover closes instead of to the pencil trigger. */
+    onRestoreFocus?: () => void;
   };
 }) {
   const navigate = useNavigate();
   const commentInputRef = useRef<HTMLTextAreaElement>(null);
+  const commentPopupRef = useRef<HTMLDivElement>(null);
   const draftCommentRef = useRef<string | null>(null);
   const [unavailableSourceAnchor, setUnavailableSourceAnchor] =
     useState<AssistantCitationSourceAnchor | null>(null);
@@ -155,6 +158,7 @@ export function AssistantCitationChip({
         >
           <PopoverTrigger
             aria-label={citation.comment ? "Edit citation comment" : "Add comment to citation"}
+            data-citation-comment-trigger="true"
             render={<ContextChipAction />}
           >
             <PencilIcon aria-hidden="true" />
@@ -169,6 +173,22 @@ export function AssistantCitationChip({
                 commentInputRef.current?.focus({ preventScroll: true });
                 return false;
               }}
+              finalFocus={
+                commentEditor.onRestoreFocus
+                  ? () => {
+                      // Leave focus alone when the user closed the popover by moving to another control.
+                      const activeElement = document.activeElement;
+                      if (
+                        activeElement === document.body ||
+                        (activeElement !== null && commentPopupRef.current?.contains(activeElement))
+                      ) {
+                        commentEditor.onRestoreFocus?.();
+                      }
+                      return false;
+                    }
+                  : undefined
+              }
+              ref={commentPopupRef}
               aria-label="Edit citation comment"
               width="md"
               padding="compact"

From fd996d15e220144ac6e66670169aa87d074ce846 Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Fri, 25 Sep 2026 15:56:44 -0400
Subject: [PATCH 02/11] feat(observability): honor the standard OTLP endpoint,
 headers, and protocol variables (#13492)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 apps/server/src/cli/config.test.ts          | 142 ++++++++++
 apps/server/src/cli/config.ts               |  43 +--
 docs/operations/observability.md            |  12 +
 packages/shared/src/otelEnvironment.test.ts | 290 ++++++++++++++++++++
 packages/shared/src/otelEnvironment.ts      | 228 ++++++++++++++-
 5 files changed, 693 insertions(+), 22 deletions(-)

diff --git a/apps/server/src/cli/config.test.ts b/apps/server/src/cli/config.test.ts
index f9b45caf7442..6b42756ad175 100644
--- a/apps/server/src/cli/config.test.ts
+++ b/apps/server/src/cli/config.test.ts
@@ -999,4 +999,146 @@ it.layer(NodeServices.layer)("cli config resolution", (it) => {
       expect(resolved.otlpLogsUrl).toBe("http://collector.internal:4318/v1/logs");
     }),
   );
+
+  const minimalWebFlags = (baseDir: string) => ({
+    mode: Option.some("web" as const),
+    port: Option.some(3773),
+    host: Option.none<string>(),
+    baseDir: Option.some(baseDir),
+    cwd: Option.none<string>(),
+    devUrl: Option.none<URL>(),
+    noBrowser: Option.none<boolean>(),
+    bootstrapFd: Option.none<number>(),
+    autoBootstrapProjectFromCwd: Option.none<boolean>(),
+    logWebSocketEvents: Option.none<boolean>(),
+    tailscaleServeEnabled: Option.none<boolean>(),
+    tailscaleServePort: Option.none<number>(),
+  });
+
+  it.effect(
+    "resolves each signal's endpoint through T3CODE_OTLP_*_URL, an OTEL endpoint, the bootstrap envelope, and persisted Settings, in that order",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const baseDir = yield* fs.makeTempDirectoryScoped({
+          prefix: "t3-cli-config-otel-precedence-",
+        });
+        const derivedPaths = yield* deriveExplicitServerPaths(baseDir, undefined);
+        yield* fs.makeDirectory(path.dirname(derivedPaths.settingsPath), { recursive: true });
+        yield* fs.writeFileString(
+          derivedPaths.settingsPath,
+          // @effect-diagnostics-next-line preferSchemaOverJson:off
+          `${JSON.stringify({ observability: { otlpLogsUrl: "http://settings:4318/v1/logs" } })}\n`,
+        );
+
+        const fd = yield* openBootstrapFd(
+          makeDesktopBootstrap({
+            otlpMetricsUrl: "http://bootstrap:4318/v1/metrics",
+            // Blank, not an endpoint: it must not stand in front of Settings.
+            otlpLogsUrl: "",
+          }),
+        );
+
+        const resolved = yield* resolveServerConfig(
+          {
+            ...minimalWebFlags(baseDir),
+            mode: Option.some("desktop"),
+            port: Option.some(4888),
+            bootstrapFd: Option.some(fd),
+          },
+          Option.none(),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              ConfigProvider.layer(
+                ConfigProvider.fromEnv({
+                  env: {
+                    T3CODE_OTLP_TRACES_URL: "http://t3:4318/v1/traces",
+                    T3CODE_OTLP_HEADERS: "x-key=secret",
+                    OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "http://otel-traces:4318/custom",
+                    OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: "http://otel-metrics:4318/custom",
+                    OTEL_EXPORTER_OTLP_HEADERS: "x-key=otel",
+                  },
+                }),
+              ),
+              NetService.layer,
+            ),
+          ),
+        );
+
+        // T3CODE_OTLP_TRACES_URL wins over the OTEL variable for the same
+        // signal, and keeps T3 Code's own headers since T3 Code still owns it.
+        expect(resolved.otlpTracesUrl).toBe("http://t3:4318/v1/traces");
+        expect(resolved.otlpTracesExport.headers).toEqual({ "x-key": "secret" });
+        // Metrics named no T3CODE_OTLP_METRICS_URL, so the OTEL endpoint wins
+        // over the bootstrap envelope and brings the OTEL headers and protocol.
+        expect(resolved.otlpMetricsUrl).toBe("http://otel-metrics:4318/custom");
+        expect(resolved.otlpMetricsExport).toEqual({
+          ...DEFAULT_SIGNAL_EXPORT,
+          protocol: "http/protobuf",
+          headers: { "x-key": "otel" },
+        });
+        // Logs named no T3 or OTEL endpoint and a blank bootstrap value, so
+        // Settings answers, and logs keep the shared headers since no OTEL
+        // endpoint claimed them.
+        expect(resolved.otlpLogsUrl).toBe("http://settings:4318/v1/logs");
+        expect(resolved.otlpLogsExport.headers).toEqual({ "x-key": "secret" });
+      }),
+  );
+
+  it.effect(
+    "exports nothing for a signal an OTEL endpoint claimed with a protocol or headers that do not read",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const baseDir = yield* fs.makeTempDirectoryScoped({
+          prefix: "t3-cli-config-otel-off-",
+        });
+        const derivedPaths = yield* deriveExplicitServerPaths(baseDir, undefined);
+        yield* fs.makeDirectory(path.dirname(derivedPaths.settingsPath), { recursive: true });
+        yield* fs.writeFileString(
+          derivedPaths.settingsPath,
+          // @effect-diagnostics-next-line preferSchemaOverJson:off
+          `${JSON.stringify({ observability: { otlpLogsUrl: "http://settings:4318/v1/logs" } })}\n`,
+        );
+
+        const fd = yield* openBootstrapFd(
+          makeDesktopBootstrap({ otlpMetricsUrl: "http://bootstrap:4318/v1/metrics" }),
+        );
+
+        const resolved = yield* resolveServerConfig(
+          {
+            ...minimalWebFlags(baseDir),
+            mode: Option.some("desktop"),
+            port: Option.some(4888),
+            bootstrapFd: Option.some(fd),
+          },
+          Option.none(),
+        ).pipe(
+          Effect.provide(
+            Layer.mergeAll(
+              ConfigProvider.layer(
+                ConfigProvider.fromEnv({
+                  env: {
+                    T3CODE_OTLP_TRACES_URL: "http://t3:4318/v1/traces",
+                    OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel:4318",
+                    OTEL_EXPORTER_OTLP_HEADERS: "x-key=%zz",
+                  },
+                }),
+              ),
+              NetService.layer,
+            ),
+          ),
+        );
+
+        // T3CODE_OTLP_TRACES_URL still wins outright.
+        expect(resolved.otlpTracesUrl).toBe("http://t3:4318/v1/traces");
+        // The OTEL endpoint claimed metrics and logs, so neither the bootstrap
+        // envelope nor Settings receives them with T3 Code's headers.
+        expect(resolved.otlpMetricsUrl).toBeUndefined();
+        expect(resolved.otlpLogsUrl).toBeUndefined();
+      }),
+  );
 });
diff --git a/apps/server/src/cli/config.ts b/apps/server/src/cli/config.ts
index 1b6449433139..9c1ceac82101 100644
--- a/apps/server/src/cli/config.ts
+++ b/apps/server/src/cli/config.ts
@@ -396,6 +396,27 @@ export const resolveServerConfig = (
       headers: env.otlpHeaders,
       exportIntervalMs: env.otlpExportIntervalMs,
     };
+    const traces = OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "traces",
+      { url: env.otlpTracesUrl, export: signalExport },
+      bootstrap?.otlpTracesUrl,
+      persistedObservabilitySettings.otlpTracesUrl,
+    );
+    const metrics = OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "metrics",
+      { url: env.otlpMetricsUrl, export: signalExport },
+      bootstrap?.otlpMetricsUrl,
+      persistedObservabilitySettings.otlpMetricsUrl,
+    );
+    const logs = OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "logs",
+      { url: env.otlpLogsUrl, export: signalExport },
+      bootstrap?.otlpLogsUrl,
+      persistedObservabilitySettings.otlpLogsUrl,
+    );
 
     const config: ServerConfig.ServerConfig["Service"] = {
       logLevel,
@@ -404,22 +425,12 @@ export const resolveServerConfig = (
       traceBatchWindowMs: env.traceBatchWindowMs,
       traceMaxBytes: env.traceMaxBytes,
       traceMaxFiles: env.traceMaxFiles,
-      otlpTracesUrl: otel.disabled
-        ? undefined
-        : (env.otlpTracesUrl ??
-          bootstrap?.otlpTracesUrl ??
-          persistedObservabilitySettings.otlpTracesUrl),
-      otlpMetricsUrl: otel.disabled
-        ? undefined
-        : (env.otlpMetricsUrl ??
-          bootstrap?.otlpMetricsUrl ??
-          persistedObservabilitySettings.otlpMetricsUrl),
-      otlpLogsUrl: otel.disabled
-        ? undefined
-        : (env.otlpLogsUrl ?? bootstrap?.otlpLogsUrl ?? persistedObservabilitySettings.otlpLogsUrl),
-      otlpTracesExport: signalExport,
-      otlpMetricsExport: signalExport,
-      otlpLogsExport: signalExport,
+      otlpTracesUrl: traces?.url,
+      otlpMetricsUrl: metrics?.url,
+      otlpLogsUrl: logs?.url,
+      otlpTracesExport: traces?.export ?? signalExport,
+      otlpMetricsExport: metrics?.export ?? signalExport,
+      otlpLogsExport: logs?.export ?? signalExport,
       otlpServiceName: env.otlpServiceName,
       otelEnvironment: otel,
       mode,
diff --git a/docs/operations/observability.md b/docs/operations/observability.md
index 97c6936ba608..0bdb0eb0c0f8 100644
--- a/docs/operations/observability.md
+++ b/docs/operations/observability.md
@@ -552,6 +552,18 @@ OTLP export:
   `OTEL_EXPORTER_OTLP_HEADERS`: comma-separated `key=value` pairs with percent-encoded values.
 - `T3CODE_OTLP_PROTOCOL`: `http/json` (default) or `http/protobuf`
 
+The server also reads the standard `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_ENDPOINT` and generic
+`OTEL_EXPORTER_OTLP_ENDPOINT` (with `/v1/traces`, `/v1/metrics`, or `/v1/logs` appended), for a
+collector expecting those instead. A non-blank `T3CODE_OTLP_*_URL` wins over either, and a
+per-signal endpoint wins over the generic one for its signal. A blank value counts as unset. A
+signal with an OTEL endpoint takes its headers from `OTEL_EXPORTER_OTLP_HEADERS` and its protocol
+from `OTEL_EXPORTER_OTLP_PROTOCOL` (default `http/protobuf`, read case-insensitively), and a
+per-signal `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_HEADERS` or `_PROTOCOL` wins over the generic
+one for its signal. `T3CODE_OTLP_HEADERS` and `T3CODE_OTLP_PROTOCOL` never apply to it. An endpoint
+that is not an `http` or `https` URL, a protocol other than `http/protobuf` or `http/json` such as
+`grpc`, or headers that are not `key=value` pairs with percent-encoded values turn that signal's
+export off with a startup warning, rather than sending it to the Settings endpoint.
+
 If the OTLP URLs are unset, local tracing still works, metrics stay in-process only, and logs stay
 on stdout only.
 
diff --git a/packages/shared/src/otelEnvironment.test.ts b/packages/shared/src/otelEnvironment.test.ts
index 548f2a78b776..cd4e683faa6b 100644
--- a/packages/shared/src/otelEnvironment.test.ts
+++ b/packages/shared/src/otelEnvironment.test.ts
@@ -106,6 +106,296 @@ describe("OtelEnvironment", () => {
     }),
   );
 
+  describe("endpoints", () => {
+    const urlOf = (signal: OtelEnvironment.OtelSignal) =>
+      OtelEnvironment.OtelSignal.$match(signal, {
+        Export: ({ url }) => url,
+        Off: () => "Off",
+        Unset: () => "Unset",
+      });
+    it.effect.each([
+      {
+        name: "nothing set",
+        env: {},
+        traces: "Unset",
+        metrics: "Unset",
+        logs: "Unset",
+        warnings: [],
+      },
+      {
+        name: "generic endpoint appends each signal's path, keeping the query",
+        env: { OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318/base?api_key=secret" },
+        traces: "https://collector:4318/base/v1/traces?api_key=secret",
+        metrics: "https://collector:4318/base/v1/metrics?api_key=secret",
+        logs: "https://collector:4318/base/v1/logs?api_key=secret",
+        warnings: [],
+      },
+      {
+        name: "a per-signal endpoint is used verbatim",
+        env: { OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "https://tempo:4318/custom" },
+        traces: "https://tempo:4318/custom",
+        metrics: "Unset",
+        logs: "Unset",
+        warnings: [],
+      },
+      {
+        name: "a per-signal endpoint beats the generic one",
+        env: {
+          OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "https://tempo:4318/custom",
+          OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318/base",
+        },
+        traces: "https://tempo:4318/custom",
+        metrics: "https://collector:4318/base/v1/metrics",
+        logs: "https://collector:4318/base/v1/logs",
+        warnings: [],
+      },
+      {
+        name: "a blank per-signal endpoint falls through to the generic one",
+        env: {
+          OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "  ",
+          OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318/base",
+        },
+        traces: "https://collector:4318/base/v1/traces",
+        metrics: "https://collector:4318/base/v1/metrics",
+        logs: "https://collector:4318/base/v1/logs",
+        warnings: [],
+      },
+      {
+        name: "an invalid per-signal endpoint warns and does not fall through",
+        env: {
+          OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "not-a-url",
+          OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318/base",
+        },
+        traces: "Off",
+        metrics: "https://collector:4318/base/v1/metrics",
+        logs: "https://collector:4318/base/v1/logs",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT is not an http or https URL, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "an invalid generic endpoint warns without leaking its query",
+        env: { OTEL_EXPORTER_OTLP_ENDPOINT: "not-a-url?api_key=secret" },
+        traces: "Off",
+        metrics: "Off",
+        logs: "Off",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_ENDPOINT is not an http or https URL, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "an endpoint without a scheme is not an http URL",
+        env: { OTEL_EXPORTER_OTLP_ENDPOINT: "localhost:4318" },
+        traces: "Off",
+        metrics: "Off",
+        logs: "Off",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_ENDPOINT is not an http or https URL, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "the kill switch wins outright over a valid endpoint",
+        env: {
+          T3CODE_OTEL_SDK_DISABLED: "true",
+          OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318/base",
+        },
+        traces: "Unset",
+        metrics: "Unset",
+        logs: "Unset",
+        warnings: [T3_OFF],
+      },
+    ])("$name", ({ env, traces, metrics, logs, warnings }) =>
+      Effect.gen(function* () {
+        const resolved = yield* load(env);
+        assert.strictEqual(urlOf(resolved.traces), traces);
+        assert.strictEqual(urlOf(resolved.metrics), metrics);
+        assert.strictEqual(urlOf(resolved.logs), logs);
+        assert.deepStrictEqual(resolved.warnings, warnings);
+      }),
+    );
+
+    const ENDPOINT = { OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector:4318" };
+    const exportOf = (signal: OtelEnvironment.OtelSignal): unknown =>
+      OtelEnvironment.OtelSignal.$match(signal, {
+        Export: ({ protocol, headers }) => ({ protocol, headers }),
+        Off: () => "Off",
+        Unset: () => "Unset",
+      });
+    it.effect.each([
+      {
+        name: "nothing else set takes the specification's default protocol",
+        env: ENDPOINT,
+        traces: { protocol: "http/protobuf", headers: undefined },
+        logs: { protocol: "http/protobuf", headers: undefined },
+        warnings: [],
+      },
+      {
+        name: "headers are comma-separated pairs with percent-encoded values",
+        env: { ...ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS: "api-key=a%20b,tenant=t3" },
+        traces: { protocol: "http/protobuf", headers: { "api-key": "a b", tenant: "t3" } },
+        logs: { protocol: "http/protobuf", headers: { "api-key": "a b", tenant: "t3" } },
+        warnings: [],
+      },
+      {
+        name: "a per-signal protocol and headers beat the generic ones",
+        env: {
+          ...ENDPOINT,
+          OTEL_EXPORTER_OTLP_PROTOCOL: "http/json",
+          OTEL_EXPORTER_OTLP_HEADERS: "api-key=shared",
+          OTEL_EXPORTER_OTLP_TRACES_PROTOCOL: "http/protobuf",
+          OTEL_EXPORTER_OTLP_TRACES_HEADERS: "api-key=traces%20only",
+        },
+        traces: { protocol: "http/protobuf", headers: { "api-key": "traces only" } },
+        logs: { protocol: "http/json", headers: { "api-key": "shared" } },
+        warnings: [],
+      },
+      {
+        name: "an unsupported protocol turns off the signals it configures",
+        env: { ...ENDPOINT, OTEL_EXPORTER_OTLP_LOGS_PROTOCOL: "grpc" },
+        traces: { protocol: "http/protobuf", headers: undefined },
+        logs: "Off",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL is not http/protobuf or http/json, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "a protocol reads case-insensitively",
+        env: { ...ENDPOINT, OTEL_EXPORTER_OTLP_PROTOCOL: "HTTP/JSON" },
+        traces: { protocol: "http/json", headers: undefined },
+        logs: { protocol: "http/json", headers: undefined },
+        warnings: [],
+      },
+      {
+        name: "undecodable headers turn off every signal once, without leaking them",
+        env: { ...ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS: "api-key=%zz" },
+        traces: "Off",
+        logs: "Off",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_HEADERS is not a list of key=value pairs with percent-encoded values, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "a header without a value separator turns its signal off",
+        env: { ...ENDPOINT, OTEL_EXPORTER_OTLP_LOGS_HEADERS: "Authorization" },
+        traces: { protocol: "http/protobuf", headers: undefined },
+        logs: "Off",
+        warnings: [
+          "OTEL_EXPORTER_OTLP_LOGS_HEADERS is not a list of key=value pairs with percent-encoded values, so the signals it configures are not exported",
+        ],
+      },
+      {
+        name: "blank per-signal headers leave the generic ones in charge",
+        env: {
+          ...ENDPOINT,
+          OTEL_EXPORTER_OTLP_HEADERS: "api-key=shared",
+          OTEL_EXPORTER_OTLP_LOGS_HEADERS: "  ",
+        },
+        traces: { protocol: "http/protobuf", headers: { "api-key": "shared" } },
+        logs: { protocol: "http/protobuf", headers: { "api-key": "shared" } },
+        warnings: [],
+      },
+      {
+        name: "generic headers every signal overrides say nothing",
+        env: {
+          OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: "https://tempo:4318/v1/traces",
+          OTEL_EXPORTER_OTLP_TRACES_HEADERS: "api-key=traces",
+          OTEL_EXPORTER_OTLP_HEADERS: "api-key=%zz",
+        },
+        traces: { protocol: "http/protobuf", headers: { "api-key": "traces" } },
+        logs: "Unset",
+        warnings: [],
+      },
+      {
+        name: "protocol and headers say nothing for a signal no endpoint names",
+        env: { OTEL_EXPORTER_OTLP_PROTOCOL: "grpc", OTEL_EXPORTER_OTLP_HEADERS: "api-key=%zz" },
+        traces: "Unset",
+        logs: "Unset",
+        warnings: [],
+      },
+    ])("$name", ({ env, traces, logs, warnings }) =>
+      Effect.gen(function* () {
+        const resolved = yield* load(env);
+        assert.deepStrictEqual(exportOf(resolved.traces), traces);
+        assert.deepStrictEqual(exportOf(resolved.logs), logs);
+        assert.deepStrictEqual(resolved.warnings, warnings);
+      }),
+    );
+  });
+
+  describe("resolveSignalEndpoint", () => {
+    const t3Export = {
+      protocol: "http/json",
+      headers: { "x-key": "t3" },
+      exportIntervalMs: 5_000,
+    } as const;
+    const withLogs = (logs: OtelEnvironment.OtelSignal, disabled = false) => ({
+      ...OtelEnvironment.none,
+      disabled,
+      logs,
+    });
+    const otelExport = OtelEnvironment.OtelSignal.Export({
+      url: "http://otel:4318/v1/logs",
+      protocol: "http/protobuf",
+      headers: { "x-key": "otel" },
+    });
+    it.each([
+      {
+        name: "T3CODE_OTLP_*_URL wins over an OTEL endpoint",
+        otel: withLogs(otelExport),
+        t3Url: "http://t3:4318/v1/logs",
+        expected: { url: "http://t3:4318/v1/logs", export: t3Export },
+      },
+      {
+        name: "T3CODE_OTLP_*_URL wins over a signal the OTEL variables turned off",
+        otel: withLogs(OtelEnvironment.OtelSignal.Off()),
+        t3Url: "http://t3:4318/v1/logs",
+        expected: { url: "http://t3:4318/v1/logs", export: t3Export },
+      },
+      {
+        name: "an OTEL endpoint brings its headers and protocol over the fallback",
+        otel: withLogs(otelExport),
+        t3Url: " ",
+        expected: {
+          url: "http://otel:4318/v1/logs",
+          export: {
+            protocol: "http/protobuf" as const,
+            headers: { "x-key": "otel" },
+            exportIntervalMs: 5_000,
+          },
+        },
+      },
+      {
+        name: "a signal the OTEL variables turned off does not fall through",
+        otel: withLogs(OtelEnvironment.OtelSignal.Off()),
+        t3Url: undefined,
+        expected: undefined,
+      },
+      {
+        name: "an unset signal takes the first non-blank fallback",
+        otel: withLogs(OtelEnvironment.OtelSignal.Unset()),
+        t3Url: undefined,
+        expected: { url: "http://settings:4318/v1/logs", export: t3Export },
+      },
+      {
+        name: "the kill switch wins over everything",
+        otel: withLogs(otelExport, true),
+        t3Url: "http://t3:4318/v1/logs",
+        expected: undefined,
+      },
+    ])("$name", ({ otel, t3Url, expected }) => {
+      assert.deepStrictEqual(
+        OtelEnvironment.resolveSignalEndpoint(
+          otel,
+          "logs",
+          { url: t3Url, export: t3Export },
+          "",
+          "http://settings:4318/v1/logs",
+        ),
+        expected,
+      );
+    });
+  });
+
   describe("layerResourceAttributes", () => {
     it.effect.each([
       { name: "a list that does not decode", raw: "team=%zz", attributes: [] },
diff --git a/packages/shared/src/otelEnvironment.ts b/packages/shared/src/otelEnvironment.ts
index a10b3be4e278..05a787dcfede 100644
--- a/packages/shared/src/otelEnvironment.ts
+++ b/packages/shared/src/otelEnvironment.ts
@@ -1,6 +1,7 @@
 /**
- * otelEnvironment: the OpenTelemetry kill switch, shared by the server and the
- * desktop main process so both agree on what turns export off.
+ * otelEnvironment: the OpenTelemetry kill switch and endpoint variables,
+ * shared by the server and the desktop main process so both agree on what
+ * turns export off and where it goes.
  *
  * `T3CODE_OTEL_SDK_DISABLED` is read first, so a machine that sets
  * `OTEL_SDK_DISABLED` for everything else can still opt T3 Code back in.
@@ -9,10 +10,33 @@
  */
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
+import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
 import * as SchemaTransformation from "effect/SchemaTransformation";
 
+import { OtlpHeadersFromString, OtlpProtocol, type SignalExport } from "./observability.ts";
+
+/** The signals T3 Code exports, spelled as the variable names spell them. */
+type OtlpSignalName = "TRACES" | "METRICS" | "LOGS";
+
+/**
+ * What the OTEL variables say about one signal. `Off` is a signal they
+ * claimed with an endpoint, protocol, or headers that do not read, so it is
+ * exported nowhere rather than to the bootstrap or Settings collector.
+ */
+export type OtelSignal = Data.TaggedEnum<{
+  Unset: {};
+  Off: {};
+  Export: {
+    readonly url: string;
+    readonly protocol: OtlpProtocol;
+    readonly headers: Readonly<Record<string, string>> | undefined;
+  };
+}>;
+export const OtelSignal = Data.taggedEnum<OtelSignal>();
+
 export interface OtelEnvironment {
   /** Whether OTLP export is off, whatever endpoint is configured. */
   readonly disabled: boolean;
@@ -20,8 +44,17 @@ export interface OtelEnvironment {
   readonly warnings: ReadonlyArray<string>;
   /** `OTEL_RESOURCE_ATTRIBUTES`, or nothing when it could not be read. */
   readonly resourceAttributes: Readonly<Record<string, string>>;
+  readonly traces: OtelSignal;
+  readonly metrics: OtelSignal;
+  readonly logs: OtelSignal;
 }
 
+/** A set but blank value reads as unset, so the source under it can answer. */
+const blankAsUnset = (value: string | undefined): string | undefined => {
+  const trimmed = value?.trim();
+  return trimmed === undefined || trimmed === "" ? undefined : trimmed;
+};
+
 interface Flag {
   /** `undefined` when the variable is unset, blank, or unreadable. */
   readonly value: boolean | undefined;
@@ -93,6 +126,121 @@ const resourceAttributes = Config.Record(
   Config.withDefault<ResourceAttributes>({ value: {} }),
 );
 
+interface Setting<A> {
+  readonly value: A | undefined;
+  readonly warning?: string;
+}
+
+/**
+ * Reads one variable. Blank reads as unset, and a value `parse` rejects warns
+ * without echoing it, since these variables carry credentials.
+ */
+const readOrWarn = <A>(
+  name: string,
+  parse: (raw: string) => Option.Option<A>,
+  warning: string,
+): Config.Config<Setting<A>> =>
+  Config.String(name).pipe(
+    Config.option,
+    Config.map((option): Setting<A> => {
+      const raw = blankAsUnset(Option.getOrUndefined(option));
+      if (raw === undefined) {
+        return { value: undefined };
+      }
+      return Option.match(parse(raw), {
+        onNone: () => ({ value: undefined, warning }),
+        onSome: (value) => ({ value }),
+      });
+    }),
+  );
+
+const parseHttpUrl = (raw: string) =>
+  Option.liftThrowable((value: string) => new URL(value))(raw).pipe(
+    Option.filter((url) => url.protocol === "http:" || url.protocol === "https:"),
+  );
+
+const NOT_EXPORTED = "so the signals it configures are not exported";
+
+const endpoint = (name: string) =>
+  readOrWarn(name, parseHttpUrl, `${name} is not an http or https URL, ${NOT_EXPORTED}`);
+
+// The specification reads enum values case-insensitively.
+const protocol = (name: string) =>
+  readOrWarn(
+    name,
+    (raw) => Schema.decodeUnknownOption(OtlpProtocol)(raw.toLowerCase()),
+    `${name} is not http/protobuf or http/json, ${NOT_EXPORTED}`,
+  );
+
+const headers = (name: string) =>
+  readOrWarn(
+    name,
+    Schema.decodeUnknownOption(OtlpHeadersFromString),
+    `${name} is not a list of key=value pairs with percent-encoded values, ${NOT_EXPORTED}`,
+  );
+
+interface Settings {
+  readonly endpoint: Setting<URL>;
+  readonly protocol: Setting<OtlpProtocol>;
+  readonly headers: Setting<Readonly<Record<string, string>>>;
+}
+
+const settings = (prefix: string): Config.Config<Settings> =>
+  Config.all({
+    endpoint: endpoint(`${prefix}ENDPOINT`),
+    protocol: protocol(`${prefix}PROTOCOL`),
+    headers: headers(`${prefix}HEADERS`),
+  });
+
+/** The signal's own variable claims the signal once set, valid or not. */
+const isClaimed = (setting: Setting<unknown>) =>
+  setting.value !== undefined || setting.warning !== undefined;
+
+const claimed = <A>(own: Setting<A>, generic: Setting<A>) => (isClaimed(own) ? own : generic);
+
+/** Appends the signal's path, keeping the query an intake may take its API key in. */
+const withSignalPath = (signal: OtlpSignalName, base: URL) => {
+  const url = new URL(base);
+  const slash = url.pathname.endsWith("/") ? "" : "/";
+  url.pathname += `${slash}v1/${signal.toLowerCase()}`;
+  return url;
+};
+
+interface ResolvedSignal {
+  readonly signal: OtelSignal;
+  /** The settings this signal read, whose warnings are the signal's to report. */
+  readonly used: ReadonlyArray<Setting<unknown>>;
+}
+
+/**
+ * A signal whose endpoint, protocol, or headers do not read is not exported
+ * rather than sent somewhere, in a format, or without the credentials its
+ * collector expects.
+ */
+const signal = (name: OtlpSignalName, own: Settings, generic: Settings): ResolvedSignal => {
+  const ownEndpoint = isClaimed(own.endpoint);
+  const endpoint = ownEndpoint ? own.endpoint : generic.endpoint;
+  if (endpoint.value === undefined) {
+    const signal = endpoint.warning === undefined ? OtelSignal.Unset() : OtelSignal.Off();
+    return { signal, used: [endpoint] };
+  }
+  const protocol = claimed(own.protocol, generic.protocol);
+  const headers = claimed(own.headers, generic.headers);
+  const used = [endpoint, protocol, headers];
+  if (protocol.warning !== undefined || headers.warning !== undefined) {
+    return { signal: OtelSignal.Off(), used };
+  }
+  const url = ownEndpoint ? endpoint.value : withSignalPath(name, endpoint.value);
+  return {
+    signal: OtelSignal.Export({
+      url: url.toString(),
+      protocol: protocol.value ?? "http/protobuf",
+      headers: headers.value,
+    }),
+    used,
+  };
+};
+
 export const load: Effect.Effect<OtelEnvironment> = Config.all({
   t3: flag(
     "T3CODE_OTEL_SDK_DISABLED",
@@ -111,12 +259,31 @@ export const load: Effect.Effect<OtelEnvironment> = Config.all({
       `OTEL_SDK_DISABLED=${value} was read as false; the OpenTelemetry specification recognizes only the string true, so use OTEL_SDK_DISABLED=true or T3CODE_OTEL_SDK_DISABLED to say it any other way`,
   ),
   resource: resourceAttributes,
+  generic: settings("OTEL_EXPORTER_OTLP_"),
+  traces: settings("OTEL_EXPORTER_OTLP_TRACES_"),
+  metrics: settings("OTEL_EXPORTER_OTLP_METRICS_"),
+  logs: settings("OTEL_EXPORTER_OTLP_LOGS_"),
 }).pipe(
-  Effect.map(({ t3, spec, resource }) => {
+  Effect.map(({ t3, spec, resource, generic, ...own }) => {
     const disabled = t3.value ?? spec.value ?? false;
-    const warnings = [t3.warning, spec.warning, resource.warning].filter(
-      (warning) => warning !== undefined,
+    // The kill switch wins outright, so the signals say nothing once it is set.
+    const signals = disabled
+      ? undefined
+      : {
+          traces: signal("TRACES", own.traces, generic),
+          metrics: signal("METRICS", own.metrics, generic),
+          logs: signal("LOGS", own.logs, generic),
+        };
+    // A generic variable read by several signals warns once.
+    const used = new Set(
+      signals === undefined ? [] : Object.values(signals).flatMap((resolved) => resolved.used),
     );
+    const warnings = [
+      t3.warning,
+      spec.warning,
+      resource.warning,
+      ...Array.from(used, (setting) => setting.warning),
+    ].filter((warning) => warning !== undefined);
     if (disabled) {
       warnings.push(
         t3.value
@@ -124,12 +291,58 @@ export const load: Effect.Effect<OtelEnvironment> = Config.all({
           : "OTEL_SDK_DISABLED is set, so no telemetry is exported, whatever configured it; set T3CODE_OTEL_SDK_DISABLED=false to export anyway",
       );
     }
-    return { disabled, warnings, resourceAttributes: resource.value };
+    return {
+      disabled,
+      warnings,
+      resourceAttributes: resource.value,
+      traces: signals?.traces.signal ?? OtelSignal.Unset(),
+      metrics: signals?.metrics.signal ?? OtelSignal.Unset(),
+      logs: signals?.logs.signal ?? OtelSignal.Unset(),
+    };
   }),
   // Every read above falls back instead of failing, so this cannot happen.
   Effect.orDie,
 );
 
+export type SignalName = "traces" | "metrics" | "logs";
+
+export interface SignalEndpoint {
+  readonly url: string;
+  readonly export: SignalExport;
+}
+
+/**
+ * Where one signal exports and how. `T3CODE_OTLP_*_URL` wins outright with
+ * T3 Code's own export, then an OTEL endpoint with its own headers and
+ * protocol, since `T3CODE_OTLP_HEADERS` was written for a different
+ * collector, then the first of `fallbackUrls` with T3 Code's own export.
+ */
+export const resolveSignalEndpoint = (
+  otel: OtelEnvironment,
+  signal: SignalName,
+  t3: { readonly url: string | undefined; readonly export: SignalExport },
+  ...fallbackUrls: ReadonlyArray<string | undefined>
+): SignalEndpoint | undefined => {
+  if (otel.disabled) {
+    return undefined;
+  }
+  const t3Url = blankAsUnset(t3.url);
+  if (t3Url !== undefined) {
+    return { url: t3Url, export: t3.export };
+  }
+  return OtelSignal.$match(otel[signal], {
+    Export: ({ url, protocol, headers }): SignalEndpoint => ({
+      url,
+      export: { protocol, headers, exportIntervalMs: t3.export.exportIntervalMs },
+    }),
+    Off: () => undefined,
+    Unset: () => {
+      const url = fallbackUrls.map(blankAsUnset).find((candidate) => candidate !== undefined);
+      return url === undefined ? undefined : { url, export: t3.export };
+    },
+  });
+};
+
 /**
  * Provide this around Effect's OTLP exporters, which read
  * `OTEL_RESOURCE_ATTRIBUTES` for themselves and die when it does not decode,
@@ -154,4 +367,7 @@ export const none: OtelEnvironment = {
   disabled: false,
   warnings: [],
   resourceAttributes: {},
+  traces: OtelSignal.Unset(),
+  metrics: OtelSignal.Unset(),
+  logs: OtelSignal.Unset(),
 };

From 1a0c915c41024ddb47e16befd9fc730c1173af02 Mon Sep 17 00:00:00 2001
From: Theo Browne <me@t3.gg>
Date: Fri, 25 Sep 2026 13:09:30 -0700
Subject: [PATCH 03/11] fix(terminal): settling a thread closes its idle shells
 (#13673)

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../OrchestrationEngineHarness.integration.ts |  2 +
 .../Layers/ProviderCommandReactor.test.ts     | 75 ++++++++++++++++++
 .../Layers/ProviderCommandReactor.ts          | 15 ++--
 .../src/project/AgentSessionImporter.test.ts  |  2 +
 .../project/ProjectSetupScriptRunner.test.ts  | 74 +++++++++++++++++-
 .../src/project/ProjectSetupScriptRunner.ts   | 13 +++-
 apps/server/src/terminal/Manager.test.ts      | 67 ++++++++++++++++
 apps/server/src/terminal/Manager.ts           | 77 ++++++++++++++++++-
 docs/user/thread-sidebar.md                   |  4 +-
 9 files changed, 318 insertions(+), 11 deletions(-)

diff --git a/apps/server/integration/OrchestrationEngineHarness.integration.ts b/apps/server/integration/OrchestrationEngineHarness.integration.ts
index 0df54be2f701..1e116a91fea7 100644
--- a/apps/server/integration/OrchestrationEngineHarness.integration.ts
+++ b/apps/server/integration/OrchestrationEngineHarness.integration.ts
@@ -26,6 +26,7 @@ import * as Tracer from "effect/Tracer";
 
 import * as CheckpointStore from "../src/checkpointing/CheckpointStore.ts";
 import { TextGeneration } from "../src/textGeneration/TextGeneration.ts";
+import * as TerminalManager from "../src/terminal/Manager.ts";
 import { OrchestrationCommandReceiptRepositoryLive } from "../src/persistence/Layers/OrchestrationCommandReceipts.ts";
 import { OrchestrationEventStoreLive } from "../src/persistence/Layers/OrchestrationEventStore.ts";
 import { ProjectionPendingApprovalRepositoryLive } from "../src/persistence/Layers/ProjectionPendingApprovals.ts";
@@ -340,6 +341,7 @@ export const makeOrchestrationIntegrationHarness = (
           tryHandlePromptCommand: () => Effect.succeed(false),
         }),
       ),
+      Layer.provide(Layer.mock(TerminalManager.TerminalManager)({ closeIdle: () => Effect.void })),
       Layer.provideMerge(runtimeServicesLayer),
       Layer.provideMerge(gitWorkflowLayer),
       Layer.provideMerge(textGenerationLayer),
diff --git a/apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts b/apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts
index c7d9417bc75b..254aec4bde7e 100644
--- a/apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts
+++ b/apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts
@@ -55,6 +55,7 @@ import {
 import { ProviderAuthService } from "../../provider/Services/ProviderAuthService.ts";
 import { makeProviderRegistryLayer } from "../../provider/testUtils/providerRegistryMock.ts";
 import { TextGeneration } from "../../textGeneration/TextGeneration.ts";
+import { TerminalManager } from "../../terminal/Manager.ts";
 import * as RepositoryIdentityResolver from "../../project/RepositoryIdentityResolver.ts";
 import { OrchestrationEngineLive } from "./OrchestrationEngine.ts";
 import { OrchestrationProjectionPipelineLive } from "./ProjectionPipeline.ts";
@@ -307,6 +308,7 @@ describe("ProviderCommandReactor", () => {
       }),
     );
     const pruneWorktrees = vi.fn((_: { readonly cwd: string }) => Effect.void);
+    const closeIdleTerminals = vi.fn((_: { readonly threadId: string }) => Effect.void);
     const createWorktree = vi.fn(
       (input: { readonly refName: string; readonly path: string | null }) =>
         Effect.succeed({ worktree: { path: input.path ?? "", refName: input.refName } }),
@@ -490,6 +492,7 @@ describe("ProviderCommandReactor", () => {
           generateThreadTitle,
         }),
       ),
+      Layer.provideMerge(Layer.mock(TerminalManager)({ closeIdle: closeIdleTerminals })),
       Layer.provideMerge(ServerSettingsService.layerTest()),
       Layer.provideMerge(SqlitePersistenceMemory),
       Layer.provideMerge(ServerConfig.layerTest(process.cwd(), baseDir)),
@@ -621,6 +624,7 @@ describe("ProviderCommandReactor", () => {
       renameBranch,
       pruneWorktrees,
       createWorktree,
+      closeIdleTerminals,
       refreshStatus,
       generateBranchName,
       generateThreadTitle,
@@ -4339,6 +4343,77 @@ describe("ProviderCommandReactor", () => {
       expect(thread?.settledOverride).toBe("settled");
       expect(thread?.session?.status).toBe("stopped");
       expect(thread?.session?.providerInstanceId).toBe(ProviderInstanceId.make("codex_work"));
+      expect(harness.closeIdleTerminals).toHaveBeenCalledWith({
+        threadId: ThreadId.make("thread-1"),
+      });
     }),
   );
+
+  effectIt.effect("closes idle terminals when a thread without a session settles", () =>
+    Effect.gen(function* () {
+      const harness = yield* Effect.promise(() => createHarness());
+      const terminalsClosed = yield* Deferred.make<void>();
+      harness.closeIdleTerminals.mockImplementation(() =>
+        Deferred.succeed(terminalsClosed, undefined).pipe(Effect.asVoid),
+      );
+
+      yield* harness.engine.dispatch({
+        type: "thread.settle",
+        commandId: CommandId.make("cmd-settle-without-session"),
+        threadId: ThreadId.make("thread-1"),
+      });
+      yield* Deferred.await(terminalsClosed);
+      yield* Effect.promise(() => harness.drain());
+
+      expect(harness.closeIdleTerminals).toHaveBeenCalledWith({
+        threadId: ThreadId.make("thread-1"),
+      });
+      expect(harness.stopSession).not.toHaveBeenCalled();
+    }),
+  );
+
+  effectIt.effect(
+    "keeps terminals when the thread is un-settled before its settle event runs",
+    () =>
+      Effect.gen(function* () {
+        const harness = yield* Effect.promise(() => createHarness());
+        const threadId = ThreadId.make("thread-1");
+        const firstCloseStarted = yield* Deferred.make<void>();
+        const releaseFirstClose = yield* Deferred.make<void>();
+        harness.closeIdleTerminals.mockImplementationOnce(() =>
+          Deferred.succeed(firstCloseStarted, undefined).pipe(
+            Effect.andThen(Deferred.await(releaseFirstClose)),
+          ),
+        );
+
+        yield* harness.engine.dispatch({
+          type: "thread.settle",
+          commandId: CommandId.make("cmd-settle-first"),
+          threadId,
+        });
+        // The reactor is busy with the first settle while the user changes their mind.
+        yield* Deferred.await(firstCloseStarted);
+        yield* harness.engine.dispatch({
+          type: "thread.unsettle",
+          commandId: CommandId.make("cmd-unsettle-first"),
+          threadId,
+          reason: "user",
+        });
+        yield* harness.engine.dispatch({
+          type: "thread.settle",
+          commandId: CommandId.make("cmd-settle-second"),
+          threadId,
+        });
+        yield* harness.engine.dispatch({
+          type: "thread.unsettle",
+          commandId: CommandId.make("cmd-unsettle-second"),
+          threadId,
+          reason: "user",
+        });
+        yield* Deferred.succeed(releaseFirstClose, undefined);
+        yield* Effect.promise(() => harness.drain());
+
+        expect(harness.closeIdleTerminals).toHaveBeenCalledTimes(1);
+      }),
+  );
 });
diff --git a/apps/server/src/orchestration/Layers/ProviderCommandReactor.ts b/apps/server/src/orchestration/Layers/ProviderCommandReactor.ts
index bff5a6096421..f6794135a925 100644
--- a/apps/server/src/orchestration/Layers/ProviderCommandReactor.ts
+++ b/apps/server/src/orchestration/Layers/ProviderCommandReactor.ts
@@ -65,6 +65,7 @@ import {
 import { resolveProjectSettings } from "@t3tools/shared/projectSettings";
 import { VcsStatusBroadcaster } from "../../vcs/VcsStatusBroadcaster.ts";
 import { GitWorkflowService } from "../../git/GitWorkflowService.ts";
+import * as TerminalManager from "../../terminal/Manager.ts";
 const isProviderAdapterProcessError = Schema.is(ProviderAdapterProcessError);
 const isProviderAdapterRequestError = Schema.is(ProviderAdapterRequestError);
 const isProviderAdapterValidationError = Schema.is(ProviderAdapterValidationError);
@@ -222,6 +223,7 @@ const make = Effect.gen(function* () {
   const vcsStatusBroadcaster = yield* VcsStatusBroadcaster;
   const textGeneration = yield* TextGeneration;
   const serverSettingsService = yield* ServerSettingsService;
+  const terminalManager = yield* TerminalManager.TerminalManager;
   /** Environment settings with the thread's project overrides applied. */
   const projectSettingsForThread = Effect.fnUntraced(function* (threadId: ThreadId) {
     const settings = yield* serverSettingsService.getSettings;
@@ -1822,11 +1824,14 @@ const make = Effect.gen(function* () {
         return;
       case "thread.settled": {
         const thread = yield* projectionSnapshotQuery.getThreadShellById(event.payload.threadId);
-        if (
-          Option.isNone(thread) ||
-          thread.value.session == null ||
-          thread.value.session.status === "stopped"
-        ) {
+        // A thread re-engaged before this event ran keeps its shells and session.
+        if (Option.isNone(thread) || thread.value.settledOverride !== "settled") {
+          return;
+        }
+        // Idle shells close so they stop holding the worktree. A terminal that
+        // runs a command (a dev server, an editor) stays for the user to close.
+        yield* terminalManager.closeIdle({ threadId: event.payload.threadId });
+        if (thread.value.session == null || thread.value.session.status === "stopped") {
           return;
         }
         yield* orchestrationEngine.dispatch({
diff --git a/apps/server/src/project/AgentSessionImporter.test.ts b/apps/server/src/project/AgentSessionImporter.test.ts
index 7d623c91b326..2438edca8b1b 100644
--- a/apps/server/src/project/AgentSessionImporter.test.ts
+++ b/apps/server/src/project/AgentSessionImporter.test.ts
@@ -56,6 +56,7 @@ import { makeProviderRegistryLayer } from "../provider/testUtils/providerRegistr
 import { ServerSettingsService } from "../serverSettings.ts";
 import * as AnalyticsService from "../telemetry/AnalyticsService.ts";
 import { TextGeneration } from "../textGeneration/TextGeneration.ts";
+import { TerminalManager } from "../terminal/Manager.ts";
 import { VcsStatusBroadcaster } from "../vcs/VcsStatusBroadcaster.ts";
 import * as RepositoryIdentityResolver from "./RepositoryIdentityResolver.ts";
 import { importRecentAgentThreads } from "./AgentSessionImporter.ts";
@@ -931,6 +932,7 @@ it.layer(integrationLayer)("AgentSessionImporter integration", (it) => {
           Layer.provide(Layer.mock(GitWorkflowService)({})),
           Layer.provide(Layer.mock(VcsStatusBroadcaster)({})),
           Layer.provide(Layer.mock(TextGeneration)({})),
+          Layer.provide(Layer.mock(TerminalManager)({ closeIdle: () => Effect.void })),
           Layer.provide(ServerSettingsService.layerTest()),
         );
 
diff --git a/apps/server/src/project/ProjectSetupScriptRunner.test.ts b/apps/server/src/project/ProjectSetupScriptRunner.test.ts
index dd341a7f7859..650f304e8481 100644
--- a/apps/server/src/project/ProjectSetupScriptRunner.test.ts
+++ b/apps/server/src/project/ProjectSetupScriptRunner.test.ts
@@ -58,7 +58,7 @@ const makeProjectionSnapshotQueryLayer = (project: OrchestrationProject) =>
   });
 
 type TerminalOverrides = Pick<TerminalManager.TerminalManager["Service"], "open" | "write"> &
-  Partial<Pick<TerminalManager.TerminalManager["Service"], "subscribe">>;
+  Partial<Pick<TerminalManager.TerminalManager["Service"], "subscribe" | "closeIdle">>;
 
 const makeTerminalManagerLayer = (overrides: TerminalOverrides) =>
   Layer.succeed(TerminalManager.TerminalManager, {
@@ -67,6 +67,7 @@ const makeTerminalManagerLayer = (overrides: TerminalOverrides) =>
     clear: () => Effect.void,
     restart: () => Effect.die(new Error("unused")),
     close: () => Effect.void,
+    closeIdle: () => Effect.void,
     subscribe: () => Effect.succeed(() => undefined),
     subscribeMetadata: () => Effect.succeed(() => undefined),
     ...overrides,
@@ -262,6 +263,7 @@ describe("ProjectSetupScriptRunner", () => {
           listener = null;
         });
       });
+      const closeIdle = vi.fn(() => Effect.void);
       const project = makeProject([
         {
           id: "setup",
@@ -329,14 +331,82 @@ describe("ProjectSetupScriptRunner", () => {
         ]);
         // The subscription is torn down once the sentinel arrives.
         expect(listener).toBeNull();
+        // A failed run keeps its shell open for a look.
+        expect(closeIdle).not.toHaveBeenCalled();
       }).pipe(
-        Effect.provide(testLayer(project, { open, write, subscribe })),
+        Effect.provide(testLayer(project, { open, write, subscribe, closeIdle })),
         Effect.provideService(HostProcessPlatform, "linux"),
         Effect.provideService(HostProcessEnvironment, { SHELL: "/bin/zsh" }),
       );
     },
   );
 
+  it.effect("closes the idle setup shell after a clean exit", () => {
+    const open = vi.fn(() =>
+      Effect.succeed({
+        threadId: "thread-1",
+        terminalId: "setup-setup",
+        cwd: "/repo/worktrees/a",
+        worktreePath: "/repo/worktrees/a",
+        status: "running" as const,
+        pid: 123,
+        history: "",
+        exitCode: null,
+        exitSignal: null,
+        label: "setup-setup",
+        updatedAt: "2026-01-01T00:00:00.000Z",
+      }),
+    );
+    let written = "";
+    const write = vi.fn((input: { data: string }) =>
+      Effect.sync(() => void (written = input.data)),
+    );
+    let listener: ((event: TerminalEvent) => Effect.Effect<void>) | null = null;
+    const subscribe = vi.fn((next: (event: TerminalEvent) => Effect.Effect<void>) => {
+      listener = next;
+      return Effect.succeed(() => {
+        listener = null;
+      });
+    });
+    const closeIdle = vi.fn(() => Effect.void);
+    const project = makeProject([
+      {
+        id: "setup",
+        name: "Setup",
+        command: "bun install",
+        icon: "configure",
+        runOnWorktreeCreate: true,
+      },
+    ]);
+
+    return Effect.gen(function* () {
+      const runner = yield* ProjectSetupScriptRunner.ProjectSetupScriptRunner;
+      const result = yield* runner.runForThread({
+        threadId: "thread-1",
+        projectCwd: "/repo/project",
+        worktreePath: "/repo/worktrees/a",
+        observeCompletion: {},
+      });
+      if (result.status !== "started" || !result.completion) {
+        return yield* Effect.die("expected an observed setup run");
+      }
+      const sentinel = /__T3_SETUP_DONE___[0-9a-f]{32}:/.exec(written)?.[0];
+      yield* listener!({
+        threadId: "thread-1",
+        terminalId: "setup-setup",
+        type: "output",
+        data: `${sentinel}0\r\n`,
+      });
+
+      expect((yield* result.completion).exitCode).toBe(0);
+      expect(closeIdle).toHaveBeenCalledWith({ threadId: "thread-1", terminalId: "setup-setup" });
+    }).pipe(
+      Effect.provide(testLayer(project, { open, write, subscribe, closeIdle })),
+      Effect.provideService(HostProcessPlatform, "linux"),
+      Effect.provideService(HostProcessEnvironment, { SHELL: "/bin/zsh" }),
+    );
+  });
+
   it.effect("unsubscribes from terminal output when the command cannot be written", () => {
     const open = vi.fn(() =>
       Effect.succeed({
diff --git a/apps/server/src/project/ProjectSetupScriptRunner.ts b/apps/server/src/project/ProjectSetupScriptRunner.ts
index 16cbfaa59496..74bc41e5e8cd 100644
--- a/apps/server/src/project/ProjectSetupScriptRunner.ts
+++ b/apps/server/src/project/ProjectSetupScriptRunner.ts
@@ -36,6 +36,7 @@ export interface ProjectSetupScriptRunnerResultStarted {
    * Resolves when the script's shell prints the completion sentinel. The
    * exit code is null when the terminal exited or was closed before the
    * sentinel arrived. Only present when `observeCompletion` was requested.
+   * An exit code of 0 closes the setup shell if it has nothing left running.
    */
   readonly completion?: Effect.Effect<ProjectSetupScriptCompletion>;
 }
@@ -412,6 +413,16 @@ export const make = Effect.gen(function* () {
         Effect.tapError(() => Effect.sync(() => observed?.unsubscribe())),
       );
 
+    // A clean run leaves only an idle prompt behind; its output stays in the
+    // terminal history. A failed run keeps its shell open for a look.
+    const completion = observed?.completion.pipe(
+      Effect.tap(({ exitCode }) =>
+        exitCode === 0
+          ? terminalManager.closeIdle({ threadId: input.threadId, terminalId })
+          : Effect.void,
+      ),
+    );
+
     return {
       status: "started",
       scriptId: script.id,
@@ -420,7 +431,7 @@ export const make = Effect.gen(function* () {
       terminalId,
       cwd,
       async: script.async !== false,
-      ...(observed ? { completion: observed.completion } : {}),
+      ...(completion ? { completion } : {}),
     } as const;
   });
 
diff --git a/apps/server/src/terminal/Manager.test.ts b/apps/server/src/terminal/Manager.test.ts
index 80ab2c43e42c..f04161cfbd3c 100644
--- a/apps/server/src/terminal/Manager.test.ts
+++ b/apps/server/src/terminal/Manager.test.ts
@@ -1230,6 +1230,73 @@ it.layer(
     }),
   );
 
+  it.effect("closes only a thread's idle shells, ignoring a helper forked from the shell", () =>
+    Effect.gen(function* () {
+      // FakePtyAdapter assigns pids from 9000 in open order.
+      const { manager, ptyAdapter } = yield* createManager(5, {
+        processTable: Effect.succeed([
+          { pid: 9000, ppid: 1, name: "zsh" },
+          // An async prompt worker: a copy of the shell with no children.
+          { pid: 100, ppid: 9000, name: "zsh" },
+          { pid: 9001, ppid: 1, name: "zsh" },
+          { pid: 200, ppid: 9001, name: "node" },
+          { pid: 9002, ppid: 1, name: "zsh" },
+          // A subshell with a child is real work.
+          { pid: 300, ppid: 9002, name: "zsh" },
+          { pid: 301, ppid: 300, name: "sleep" },
+          { pid: 9003, ppid: 1, name: "zsh" },
+        ]),
+      }).pipe(Effect.provide(withHostPlatform("linux")));
+      yield* manager.open(openInput({ terminalId: "idle" }));
+      yield* manager.open(openInput({ terminalId: "dev-server" }));
+      yield* manager.open(openInput({ terminalId: "subshell" }));
+      yield* manager.open(openInput({ threadId: "thread-2" }));
+
+      yield* manager.closeIdle({ threadId: "thread-1" });
+
+      expect(ptyAdapter.processes.map((process) => process.killed)).toEqual([
+        true,
+        false,
+        false,
+        false,
+      ]);
+    }),
+  );
+
+  it.effect("keeps terminals that get input or output while closeIdle checks them", () =>
+    Effect.gen(function* () {
+      const ptyAdapter = new FakePtyAdapter();
+      // The typed command's process misses the snapshot, but its input or echo lands.
+      let duringCheck: (pid: number) => Effect.Effect<void> = () => Effect.void;
+      const { manager, getEvents } = yield* createManager(5, {
+        ptyAdapter,
+        subprocessPollIntervalMs: 60_000,
+        subprocessInspector: (pid) =>
+          duringCheck(pid).pipe(
+            Effect.as({ hasRunningSubprocess: false, childCommand: null, processIds: [] }),
+          ),
+      });
+      yield* manager.open(openInput({ terminalId: "typed" }));
+      yield* manager.open(openInput({ terminalId: "echoed" }));
+      const [typed, echoed] = ptyAdapter.processes;
+      duringCheck = (pid) =>
+        pid === typed!.pid
+          ? manager
+              .write({ threadId: "thread-1", terminalId: "typed", data: "make build\r" })
+              .pipe(Effect.orDie)
+          : Effect.gen(function* () {
+              echoed!.emitData("make build\r\n");
+              yield* waitFor(
+                Effect.map(getEvents, (events) => events.some((event) => event.type === "output")),
+              );
+            }).pipe(Effect.orDie);
+
+      yield* manager.closeIdle({ threadId: "thread-1" });
+
+      expect(ptyAdapter.processes.map((process) => process.killed)).toEqual([false, false]);
+    }),
+  );
+
   it.effect("backs off the spawned fallback when the resource monitor snapshot fails", () =>
     Effect.gen(function* () {
       const fallbackCalls: Array<number> = [];
diff --git a/apps/server/src/terminal/Manager.ts b/apps/server/src/terminal/Manager.ts
index 1a65587430d5..75d592c00c0d 100644
--- a/apps/server/src/terminal/Manager.ts
+++ b/apps/server/src/terminal/Manager.ts
@@ -198,6 +198,17 @@ export class TerminalManager extends Context.Service<
      */
     readonly close: (input: TerminalCloseInput) => Effect.Effect<void, TerminalError>;
 
+    /**
+     * Close a thread's terminals that wait at an idle shell prompt. A terminal
+     * that runs a command stays open. When `terminalId` is set, only that
+     * terminal is considered. Used when a thread settles and when a setup
+     * script finishes.
+     */
+    readonly closeIdle: (input: {
+      readonly threadId: string;
+      readonly terminalId?: string;
+    }) => Effect.Effect<void>;
+
     /**
      * Subscribe to terminal runtime events with a direct callback.
      *
@@ -275,6 +286,8 @@ interface TerminalSessionState {
   exitSignal: number | null;
   updatedAt: string;
   eventSequence: number;
+  /** Counts writes, so closeIdle can see input that has not echoed yet. */
+  inputCount: number;
   cols: number;
   rows: number;
   process: PtyAdapter.PtyProcess | null;
@@ -692,7 +705,17 @@ function deriveSubprocessInspectResult(
   terminalPid: number,
   platform: NodeJS.Platform,
 ): TerminalSubprocessInspectResult {
-  const childPid = (snapshot.childrenByParent.get(terminalPid) ?? [])[0];
+  const commandName = (pid: number) =>
+    normalizeChildCommandName(snapshot.commandById.get(pid) ?? "", platform);
+  const shellName = commandName(terminalPid);
+  // Async prompt themes fork the shell into a helper that waits with no
+  // children of its own. That copy is not a command the user started.
+  const childPid = (snapshot.childrenByParent.get(terminalPid) ?? []).find(
+    (pid) =>
+      shellName === null ||
+      commandName(pid) !== shellName ||
+      (snapshot.childrenByParent.get(pid)?.length ?? 0) > 0,
+  );
   if (childPid === undefined) {
     return { hasRunningSubprocess: false, childCommand: null, processIds: [] };
   }
@@ -707,7 +730,7 @@ function deriveSubprocessInspectResult(
       pending.push(pid);
     }
   }
-  const normalized = normalizeChildCommandName(snapshot.commandById.get(childPid) ?? "", platform);
+  const normalized = commandName(childPid);
   return {
     hasRunningSubprocess: true,
     childCommand: normalized ? truncateTerminalWireLabel(normalized) : null,
@@ -2537,6 +2560,7 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
         exitSignal: null,
         updatedAt: yield* nowIso,
         eventSequence: 0,
+        inputCount: 0,
         cols,
         rows,
         process: null,
@@ -2877,6 +2901,7 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
         terminalId,
       });
     }
+    session.inputCount += 1;
     yield* Effect.try({
       try: () => process.write(input.data),
       catch: (cause) =>
@@ -2958,6 +2983,7 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
           exitSignal: null,
           updatedAt: yield* nowIso,
           eventSequence: 0,
+          inputCount: 0,
           cols,
           rows,
           process: null,
@@ -3042,6 +3068,52 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
       }),
     );
 
+  const closeIdle: TerminalManager["Service"]["closeIdle"] = (input) =>
+    withThreadLock(
+      input.threadId,
+      Effect.gen(function* () {
+        const running = (yield* sessionsForThread(input.threadId)).filter(
+          (session): session is TerminalSessionState & { pid: number } =>
+            session.status === "running" &&
+            Number.isInteger(session.pid) &&
+            (input.terminalId === undefined || session.terminalId === input.terminalId),
+        );
+        if (running.length === 0) return;
+        // A command started during the process check can miss the snapshot,
+        // but its input or echo still lands. Both counters only grow, so the
+        // sum changes when either one does.
+        const activityMark = (session: TerminalSessionState) =>
+          session.eventSequence + session.inputCount;
+        const marks = new Map(
+          running.map((session) => [session.terminalId, activityMark(session)]),
+        );
+        // Inspect now instead of trusting the last poll, so a command started
+        // since then keeps its terminal.
+        const { inspector } = yield* acquireSubprocessInspector;
+        yield* Effect.forEach(
+          running,
+          (session) =>
+            inspector(session.pid).pipe(
+              Effect.flatMap((result) =>
+                result.hasRunningSubprocess ||
+                activityMark(session) !== marks.get(session.terminalId)
+                  ? Effect.void
+                  : closeSession(input.threadId, session.terminalId, false),
+              ),
+            ),
+          { discard: true },
+        );
+      }),
+    ).pipe(
+      // The process check failed, so every terminal stays open.
+      Effect.catch((error) =>
+        Effect.logWarning("failed to close idle terminals", {
+          threadId: input.threadId,
+          error: error.message,
+        }),
+      ),
+    );
+
   return TerminalManager.of({
     open,
     attachStream,
@@ -3050,6 +3122,7 @@ export const makeWithOptions = Effect.fn("TerminalManager.makeWithOptions")(func
     clear,
     restart,
     close,
+    closeIdle,
     subscribe,
     subscribeMetadata,
   });
diff --git a/docs/user/thread-sidebar.md b/docs/user/thread-sidebar.md
index 0d7cfb736774..4a19bac401b9 100644
--- a/docs/user/thread-sidebar.md
+++ b/docs/user/thread-sidebar.md
@@ -90,7 +90,9 @@ Choose **Settle thread** from its menu to move finished work out of the active l
 without deleting the conversation. **Un-settle thread** restores it to active work
 and prevents automatic settlement until new activity resumes the usual rules.
 Manually settling an idle thread dismisses unanswered async questions without
-sending an answer or restarting the agent.
+sending an answer or restarting the agent. Settling also closes the thread's
+terminals that wait at an idle prompt, and keeps their output. A terminal that
+runs a command, such as a dev server, stays open.
 
 By default, environments settle inactive threads after three days and settle
 threads whose pull request merged. A closed pull request can also settle an idle

From f5bd2fddbf00021b29c1dbe32210240886806718 Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Fri, 25 Sep 2026 15:17:22 -0500
Subject: [PATCH 04/11] fix(server): load Cursor keyring with createRequire
 (#13678)

---
 apps/server/src/provider/cursorCredentialStore.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/provider/cursorCredentialStore.ts b/apps/server/src/provider/cursorCredentialStore.ts
index c071e2a88578..9d7d1c3bccff 100644
--- a/apps/server/src/provider/cursorCredentialStore.ts
+++ b/apps/server/src/provider/cursorCredentialStore.ts
@@ -1,5 +1,9 @@
+import * as NodeModule from "node:module";
+
 const CACHE_MS = 5 * 60_000;
 
+const requireForKeyring = NodeModule.createRequire(import.meta.url);
+
 /** Share one Keychain request across usage history and limits in this server process. */
 export function makeCachedCursorAccessTokenReader(
   read: () => Promise<string | null>,
@@ -24,6 +28,6 @@ export function makeCachedCursorAccessTokenReader(
 
 /** Read the Cursor CLI's default macOS credential without invoking the shared security binary. */
 export const readMacCursorAccessToken = makeCachedCursorAccessTokenReader(async () => {
-  const { AsyncEntry } = await import("@napi-rs/keyring");
+  const { AsyncEntry } = requireForKeyring("@napi-rs/keyring") as typeof import("@napi-rs/keyring");
   return (await new AsyncEntry("cursor-access-token", "cursor-user").getPassword()) ?? null;
 });

From 4293433eccbe6c6661acd020e584ae5d2234bf1e Mon Sep 17 00:00:00 2001
From: shivam <91240327+shivamhwp@users.noreply.github.com>
Date: Sat, 26 Sep 2026 01:47:54 +0530
Subject: [PATCH 05/11] perf(server): avoid rereading unchanged files in review
 previews (#13395)

---
 apps/server/src/vcs/GitVcsDriverCore.test.ts | 38 ++++++++++++++++++++
 apps/server/src/vcs/GitVcsDriverCore.ts      |  5 +--
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/apps/server/src/vcs/GitVcsDriverCore.test.ts b/apps/server/src/vcs/GitVcsDriverCore.test.ts
index 4a5dff870fd2..47ca4e178700 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.test.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.test.ts
@@ -1449,6 +1449,44 @@ it.layer(TestLayer)("GitVcsDriver core integration", (it) => {
       }),
     );
 
+    for (const splitIndex of [false, true]) {
+      it.effect(`keeps the preceding second cached in review previews (split: ${splitIndex})`, () =>
+        Effect.gen(function* () {
+          const cwd = yield* makeTmpDir();
+          yield* initRepoWithCommit(cwd);
+          const driver = yield* GitVcsDriver.GitVcsDriver;
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          yield* writeTextFile(cwd, ".gitattributes", "stable.txt filter=probe\n");
+          yield* writeTextFile(cwd, "stable.txt", "unchanged\n");
+          yield* writeTextFile(
+            cwd,
+            ".git/filter.cjs",
+            'require("node:fs").appendFileSync(".git/filter-runs", "read\\n"); process.stdin.pipe(process.stdout);',
+          );
+          yield* git(cwd, ["config", "filter.probe.clean", "node .git/filter.cjs"]);
+          yield* fs.utimes(path.join(cwd, "stable.txt"), 1_699_999_999.5, 1_699_999_999.5);
+          yield* git(cwd, ["add", "."]);
+          yield* git(cwd, ["commit", "-m", "cache stable file"]);
+          if (splitIndex) yield* git(cwd, ["update-index", "--split-index"]);
+          const indexPath = path.join(cwd, ".git", "index");
+          yield* fs.utimes(indexPath, 1_700_000_000, 1_700_000_000);
+          const originalIndex = yield* fs.readFile(indexPath);
+          const originalMtime = (yield* fs.stat(indexPath)).mtime;
+          yield* writeTextFile(cwd, ".git/filter-runs", "");
+          yield* writeTextFile(cwd, "untracked.txt", "new\n");
+          const preview = yield* driver.getReviewDiffPreview({ cwd });
+          assert.deepStrictEqual(
+            preview.sources.find((source) => source.kind === "working-tree")!.files,
+            [{ path: "untracked.txt", previousPath: null, additions: 1, deletions: 0 }],
+          );
+          assert.strictEqual(yield* fs.readFileString(path.join(cwd, ".git/filter-runs")), "");
+          assert.deepStrictEqual(yield* fs.readFile(indexPath), originalIndex);
+          assert.deepStrictEqual((yield* fs.stat(indexPath)).mtime, originalMtime);
+        }),
+      );
+    }
+
     for (const [timestamp, splitIndex] of [
       [1_700_000_000, false],
       [1_700_000_000.9999, false],
diff --git a/apps/server/src/vcs/GitVcsDriverCore.ts b/apps/server/src/vcs/GitVcsDriverCore.ts
index b15cd28b4e92..8ec274a46611 100644
--- a/apps/server/src/vcs/GitVcsDriverCore.ts
+++ b/apps/server/src/vcs/GitVcsDriverCore.ts
@@ -2358,9 +2358,10 @@ export const makeGitVcsDriverCore = Effect.fn("makeGitVcsDriverCore")(function*
     if (indexExists) {
       const { mtime } = yield* fileSystem.stat(indexPath);
       yield* fileSystem.copyFile(indexPath, tempIndexPath);
-      // A newer copy timestamp hides racily clean edits. Round down before Git reads or rewrites it.
+      // Node FileSystem.stat truncates bigint timestamps to milliseconds before creating its Date.
+      // Flooring preserves the source second without making preceding-second files racy.
       const indexTime = Option.isSome(mtime)
-        ? Math.max(0, Math.floor((mtime.value.getTime() - 1) / 1000))
+        ? Math.max(0, Math.floor(mtime.value.getTime() / 1000))
         : 0;
       yield* fileSystem.utimes(tempIndexPath, indexTime, indexTime);
     }

From 2598ce7a5ab0b25e32e0b67b084a9ec23cd8144f Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Fri, 25 Sep 2026 16:42:12 -0400
Subject: [PATCH 06/11] feat(desktop): honor the standard OTLP variables in the
 main process and WSL backends (#13641)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../src/app/DesktopObservability.test.ts      | 105 ++++++++++++++++--
 apps/desktop/src/app/DesktopObservability.ts  |  64 +++++++----
 .../DesktopBackendConfiguration.test.ts       |  76 ++++++++++++-
 .../backend/DesktopBackendConfiguration.ts    |  40 ++++---
 docs/operations/observability.md              |  23 ++--
 5 files changed, 254 insertions(+), 54 deletions(-)

diff --git a/apps/desktop/src/app/DesktopObservability.test.ts b/apps/desktop/src/app/DesktopObservability.test.ts
index 215998631e92..0e4c4d7a969d 100644
--- a/apps/desktop/src/app/DesktopObservability.test.ts
+++ b/apps/desktop/src/app/DesktopObservability.test.ts
@@ -93,6 +93,9 @@ const collectorLayer = (requests: Array<ExportedRequest>) =>
     ),
   );
 
+// A developer's own OTEL_* variables would otherwise pick the endpoints.
+const emptyEnv = ConfigProvider.layer(ConfigProvider.fromEnv({ env: {} }));
+
 const encodeObservabilitySettingsFile = Schema.encodeSync(
   Schema.fromJsonString(
     Schema.Struct({ observability: Schema.Record(Schema.String, Schema.String) }),
@@ -182,7 +185,7 @@ describe("DesktopObservability", () => {
       assert.isFalse(yield* fileSystem.exists(logPath));
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici)),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, emptyEnv)),
     ),
   );
 
@@ -260,7 +263,7 @@ describe("DesktopObservability", () => {
       );
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici)),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, emptyEnv)),
     ),
   );
 
@@ -300,7 +303,7 @@ describe("DesktopObservability", () => {
       assert.equal(records.at(-1)?.annotations.details, "code=1");
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici)),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, emptyEnv)),
     ),
   );
 
@@ -344,7 +347,7 @@ describe("DesktopObservability", () => {
       assert.isFalse(text.includes("y"));
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici)),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, emptyEnv)),
     ),
   );
 
@@ -378,7 +381,7 @@ describe("DesktopObservability", () => {
       assert.equal(lines.length, 258);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici)),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, emptyEnv)),
     ),
   );
 
@@ -424,7 +427,93 @@ describe("DesktopObservability", () => {
       assert.lengthOf(record?.events ?? [], 0);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests))),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests), emptyEnv)),
+    );
+  });
+
+  it.effect("exports to an OTEL endpoint over Settings, with its own headers and protocol", () => {
+    const requests: Array<ExportedRequest> = [];
+    return Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-desktop-observability-test-",
+      });
+      const environmentLayer = makeEnvironmentLayer(baseDir, true, {
+        T3CODE_OTLP_HEADERS: "x-scope=desktop",
+      });
+      yield* writeObservabilitySettings(environmentLayer, {
+        otlpLogsUrl: "https://settings.example.com/v1/logs",
+      });
+
+      yield* Effect.scoped(
+        Effect.logInfo("desktop otel export").pipe(
+          Effect.provide(DesktopObservability.layer.pipe(Layer.provideMerge(environmentLayer))),
+        ),
+      );
+
+      assert.lengthOf(requests, 1);
+      const [request] = requests;
+      assert.strictEqual(request?.url, "https://collector.example.com/v1/logs");
+      assert.strictEqual(request?.headers["x-otel"], "desktop");
+      assert.strictEqual(request?.headers["x-scope"], undefined);
+      assert.strictEqual(request?.headers["content-type"], "application/json");
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        Layer.mergeAll(
+          NodeServices.layer,
+          collectorLayer(requests),
+          ConfigProvider.layer(
+            ConfigProvider.fromEnv({
+              env: {
+                OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector.example.com",
+                OTEL_EXPORTER_OTLP_HEADERS: "x-otel=desktop",
+                OTEL_EXPORTER_OTLP_LOGS_PROTOCOL: "http/json",
+              },
+            }),
+          ),
+        ),
+      ),
+    );
+  });
+
+  it.effect("exports nothing to Settings for logs an unusable OTEL endpoint claimed", () => {
+    const requests: Array<ExportedRequest> = [];
+    return Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-desktop-observability-test-",
+      });
+      const environmentLayer = makeEnvironmentLayer(baseDir, true, {
+        T3CODE_OTLP_HEADERS: "x-scope=desktop",
+      });
+      yield* writeObservabilitySettings(environmentLayer, {
+        otlpLogsUrl: "https://settings.example.com/v1/logs",
+      });
+
+      yield* Effect.scoped(
+        Effect.logInfo("desktop otel off").pipe(
+          Effect.provide(DesktopObservability.layer.pipe(Layer.provideMerge(environmentLayer))),
+        ),
+      );
+
+      assert.lengthOf(requests, 0);
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        Layer.mergeAll(
+          NodeServices.layer,
+          collectorLayer(requests),
+          ConfigProvider.layer(
+            ConfigProvider.fromEnv({
+              env: {
+                OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector.example.com",
+                OTEL_EXPORTER_OTLP_LOGS_PROTOCOL: "grpc",
+              },
+            }),
+          ),
+        ),
+      ),
     );
   });
 
@@ -495,7 +584,7 @@ describe("DesktopObservability", () => {
       );
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests))),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests), emptyEnv)),
     );
   });
 
@@ -519,7 +608,7 @@ describe("DesktopObservability", () => {
       assert.lengthOf(requests, 0);
     }).pipe(
       Effect.scoped,
-      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests))),
+      Effect.provide(Layer.mergeAll(NodeServices.layer, collectorLayer(requests), emptyEnv)),
     );
   });
 
diff --git a/apps/desktop/src/app/DesktopObservability.ts b/apps/desktop/src/app/DesktopObservability.ts
index d39b517759ad..0bcb4d602102 100644
--- a/apps/desktop/src/app/DesktopObservability.ts
+++ b/apps/desktop/src/app/DesktopObservability.ts
@@ -3,6 +3,7 @@ import {
   makeLocalFileTracer,
   makeTraceSink,
   otlpSerializationLayer,
+  type SignalExport,
 } from "@t3tools/shared/observability";
 import * as OtelEnvironment from "@t3tools/shared/otelEnvironment";
 import {
@@ -350,8 +351,10 @@ const readPersistedObservabilitySettings: Effect.Effect<
 });
 
 /**
- * Settings is read once for every signal, so the main process cannot
- * resolve traces against one revision of the file and logs against another.
+ * Resolved as the server resolves them, with persisted Settings as the
+ * fallback. Settings is read once for every signal, so the main process
+ * cannot resolve traces against one revision of the file and logs against
+ * another.
  */
 const resolveOtlpEndpoints = Effect.gen(function* () {
   const otel = yield* OtelEnvironment.load;
@@ -367,10 +370,30 @@ const resolveOtlpEndpoints = Effect.gen(function* () {
 
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
   const persisted = yield* readPersistedObservabilitySettings;
+  const signalExport: SignalExport = {
+    protocol: environment.otlpProtocol,
+    headers: Option.getOrUndefined(environment.otlpHeaders),
+    exportIntervalMs: environment.otlpExportIntervalMs,
+  };
   return {
-    traces: Option.getOrUndefined(environment.otlpTracesUrl) ?? persisted.otlpTracesUrl,
-    metrics: Option.getOrUndefined(environment.otlpMetricsUrl) ?? persisted.otlpMetricsUrl,
-    logs: Option.getOrUndefined(environment.otlpLogsUrl) ?? persisted.otlpLogsUrl,
+    traces: OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "traces",
+      { url: Option.getOrUndefined(environment.otlpTracesUrl), export: signalExport },
+      persisted.otlpTracesUrl,
+    ),
+    metrics: OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "metrics",
+      { url: Option.getOrUndefined(environment.otlpMetricsUrl), export: signalExport },
+      persisted.otlpMetricsUrl,
+    ),
+    logs: OtelEnvironment.resolveSignalEndpoint(
+      otel,
+      "logs",
+      { url: Option.getOrUndefined(environment.otlpLogsUrl), export: signalExport },
+      persisted.otlpLogsUrl,
+    ),
     warnings: otel.warnings,
     resourceAttributes: otel.resourceAttributes,
   };
@@ -602,8 +625,6 @@ const telemetryLayer = Layer.unwrap(
   Effect.gen(function* () {
     const environment = yield* DesktopEnvironment.DesktopEnvironment;
     const endpoints = yield* resolveOtlpEndpoints;
-    const headers = Option.getOrUndefined(environment.otlpHeaders);
-    const serializationLayer = otlpSerializationLayer(environment.otlpProtocol);
     const resource = {
       serviceName: "desktop",
       attributes: {
@@ -629,14 +650,19 @@ const telemetryLayer = Layer.unwrap(
         : [
             Logger.consolePretty(),
             OtlpLogger.make({
-              url: endpoints.logs,
-              exportInterval: `${environment.otlpExportIntervalMs} millis`,
-              headers,
+              url: endpoints.logs.url,
+              exportInterval: `${endpoints.logs.export.exportIntervalMs} millis`,
+              headers: endpoints.logs.export.headers,
               resource,
             }),
           ],
       { mergeWithExisting: false },
-    ).pipe(Layer.provide(OtlpExporter.layerFlusher), Layer.provide(serializationLayer));
+    ).pipe(
+      Layer.provide(OtlpExporter.layerFlusher),
+      Layer.provide(
+        otlpSerializationLayer(endpoints.logs?.export.protocol ?? environment.otlpProtocol),
+      ),
+    );
 
     const tracerLayer = Layer.unwrap(
       Effect.gen(function* () {
@@ -651,11 +677,11 @@ const telemetryLayer = Layer.unwrap(
           endpoints.traces === undefined
             ? undefined
             : yield* OtlpTracer.make({
-                url: endpoints.traces,
-                exportInterval: `${environment.otlpExportIntervalMs} millis`,
-                headers,
+                url: endpoints.traces.url,
+                exportInterval: `${endpoints.traces.export.exportIntervalMs} millis`,
+                headers: endpoints.traces.export.headers,
                 resource,
-              }).pipe(Effect.provide(serializationLayer));
+              }).pipe(Effect.provide(otlpSerializationLayer(endpoints.traces.export.protocol)));
         const tracer = yield* makeLocalFileTracer({
           filePath: tracePath,
           maxBytes: DESKTOP_LOG_FILE_MAX_BYTES,
@@ -679,11 +705,11 @@ const telemetryLayer = Layer.unwrap(
     //   endpoints.metrics === undefined
     //     ? Layer.empty
     //     : OtlpMetrics.layer({
-    //         url: endpoints.metrics,
-    //         exportInterval: `${environment.otlpExportIntervalMs} millis`,
-    //         headers,
+    //         url: endpoints.metrics.url,
+    //         exportInterval: `${endpoints.metrics.export.exportIntervalMs} millis`,
+    //         headers: endpoints.metrics.export.headers,
     //         resource,
-    //       }).pipe(Layer.provide(serializationLayer));
+    //       }).pipe(Layer.provide(otlpSerializationLayer(endpoints.metrics.export.protocol)));
 
     // Logged once the loggers above are installed, so the warnings use them.
     const otelWarningsLayer = Layer.effectDiscard(
diff --git a/apps/desktop/src/backend/DesktopBackendConfiguration.test.ts b/apps/desktop/src/backend/DesktopBackendConfiguration.test.ts
index 8d297750f784..07644a8af47c 100644
--- a/apps/desktop/src/backend/DesktopBackendConfiguration.test.ts
+++ b/apps/desktop/src/backend/DesktopBackendConfiguration.test.ts
@@ -780,12 +780,11 @@ describe("DesktopBackendConfiguration", () => {
         const config = yield* configuration.resolveWsl({ port: 5050, distro: null });
 
         // No settings.json exists here: the endpoints come from the desktop
-        // process's env, which a WSL child cannot inherit, so the bootstrap
-        // has to carry them or log export stays off inside the distro.
+        // environment, and the bootstrap carries them for a WSL child that
+        // lacks the variables.
         assert.equal(config.bootstrap.otlpTracesUrl, "http://127.0.0.1:4318/v1/traces");
         assert.equal(config.bootstrap.otlpMetricsUrl, "http://127.0.0.1:4318/v1/metrics");
         assert.equal(config.bootstrap.otlpLogsUrl, "http://127.0.0.1:4318/v1/logs");
-        assert.notInclude(config.env.WSLENV ?? "", "T3CODE_OTLP_LOGS_URL");
       }).pipe(
         Effect.provide(
           DesktopBackendConfiguration.layer.pipe(
@@ -996,6 +995,73 @@ describe("DesktopBackendConfiguration", () => {
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
 
+  it.effect(
+    "resolveWsl carries the standard OTLP endpoint, headers, and protocol into the distro",
+    () =>
+      Effect.gen(function* () {
+        const fileSystem = yield* FileSystem.FileSystem;
+        const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+          prefix: "t3-desktop-backend-config-test-",
+        });
+
+        const standard = {
+          OTEL_EXPORTER_OTLP_ENDPOINT: "https://collector.example.com:4318/base?api_key=secret",
+          OTEL_EXPORTER_OTLP_LOGS_HEADERS: "authorization=Bearer%20token",
+          T3CODE_OTLP_TRACES_URL: "http://t3.example.com:4318/v1/traces",
+        };
+        const previousWslEnv = process.env.WSLENV;
+        // A developer's own OTLP variables would be forwarded too.
+        const ambientOtel = Object.entries(process.env).filter(
+          ([name]) => name.startsWith("OTEL_") || name.startsWith("T3CODE_OTLP_"),
+        );
+        try {
+          for (const [name] of ambientOtel) delete process.env[name];
+          delete process.env.WSLENV;
+          Object.assign(process.env, standard);
+
+          yield* Effect.gen(function* () {
+            const configuration = yield* DesktopBackendConfiguration.DesktopBackendConfiguration;
+            const config = yield* configuration.resolveWsl({ port: 5050, distro: null });
+
+            assert.equal(
+              config.env.OTEL_EXPORTER_OTLP_ENDPOINT,
+              "https://collector.example.com:4318/base?api_key=secret",
+            );
+            assert.equal(
+              config.env.OTEL_EXPORTER_OTLP_LOGS_HEADERS,
+              "authorization=Bearer%20token",
+            );
+            // Without a flag, WSL passes the values through untranslated.
+            const wslEnv = (config.env.WSLENV ?? "").split(":");
+            assert.include(wslEnv, "OTEL_EXPORTER_OTLP_ENDPOINT");
+            assert.include(wslEnv, "OTEL_EXPORTER_OTLP_LOGS_HEADERS");
+            assert.equal(config.env.T3CODE_OTLP_TRACES_URL, "http://t3.example.com:4318/v1/traces");
+            assert.include(wslEnv, "T3CODE_OTLP_TRACES_URL");
+          }).pipe(
+            Effect.provide(
+              DesktopBackendConfiguration.layer.pipe(
+                Layer.provideMerge(serverExposureLayer),
+                Layer.provideMerge(DesktopAppSettings.layerTest()),
+                Layer.provideMerge(DesktopWslServerTree.layerTest()),
+                Layer.provideMerge(
+                  DesktopWslEnvironment.layerTest({
+                    isAvailable: true,
+                    windowsToWslPath: () => Option.some("/mnt/c/repo/apps/server/src/index.ts"),
+                    getDistroIp: () => Option.some("172.27.0.99"),
+                  }),
+                ),
+                Layer.provideMerge(makeEnvironmentLayer(baseDir, { platform: "win32" })),
+              ),
+            ),
+          );
+        } finally {
+          for (const name of Object.keys(standard)) delete process.env[name];
+          restoreEnv("WSLENV", previousWslEnv);
+          for (const [name, value] of ambientOtel) restoreEnv(name, value);
+        }
+      }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
+  );
+
   it.effect("resolveWsl preserves existing WSLENV entries when forwarding backend secrets", () =>
     Effect.gen(function* () {
       const fileSystem = yield* FileSystem.FileSystem;
@@ -1008,7 +1074,10 @@ describe("DesktopBackendConfiguration", () => {
       const previousAnthropicKey = process.env.ANTHROPIC_API_KEY;
       const previousOtlpHeaders = process.env.T3CODE_OTLP_HEADERS;
       const previousOtlpProtocol = process.env.T3CODE_OTLP_PROTOCOL;
+      // A developer's own OTEL_* variables would be forwarded too.
+      const ambientOtel = Object.entries(process.env).filter(([name]) => name.startsWith("OTEL_"));
       try {
+        for (const [name] of ambientOtel) delete process.env[name];
         process.env.WSLENV = "GOPATH/p:OPENAI_API_KEY/u:EMPTY::AZURE_DEVOPS_EXT_PAT/u";
         process.env.OPENAI_API_KEY = "openai-key";
         process.env.ANTHROPIC_API_KEY = "anthropic-key";
@@ -1065,6 +1134,7 @@ describe("DesktopBackendConfiguration", () => {
         restoreEnv("ANTHROPIC_API_KEY", previousAnthropicKey);
         restoreEnv("T3CODE_OTLP_HEADERS", previousOtlpHeaders);
         restoreEnv("T3CODE_OTLP_PROTOCOL", previousOtlpProtocol);
+        for (const [name, value] of ambientOtel) restoreEnv(name, value);
       }
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
diff --git a/apps/desktop/src/backend/DesktopBackendConfiguration.ts b/apps/desktop/src/backend/DesktopBackendConfiguration.ts
index d400c7a3a878..b3bec8830ec6 100644
--- a/apps/desktop/src/backend/DesktopBackendConfiguration.ts
+++ b/apps/desktop/src/backend/DesktopBackendConfiguration.ts
@@ -90,9 +90,8 @@ const DESKTOP_BACKEND_ENV_NAMES = [
 ] as const;
 
 // Env vars that the WSL backend needs but Windows process.env won't forward
-// across the wsl.exe boundary without WSLENV. The dev-server URL is handled
-// separately via a `--dev-url` CLI flag because WSLENV translation of
-// URL-shaped values (colons / slashes) is unreliable.
+// across the wsl.exe boundary without WSLENV. The dev-server URL travels as
+// the `--dev-url` CLI flag instead.
 const WSL_FORWARDED_ENV_NAMES = [
   "OPENAI_API_KEY",
   "ANTHROPIC_API_KEY",
@@ -101,6 +100,24 @@ const WSL_FORWARDED_ENV_NAMES = [
   "OTEL_SDK_DISABLED",
   "T3CODE_OTLP_HEADERS",
   "T3CODE_OTLP_PROTOCOL",
+  // Forwarded without a WSLENV flag, so the values arrive untranslated. The
+  // server prefers an OTEL endpoint over the bootstrap envelope, so the T3 URLs
+  // travel as variables to keep winning inside the distro as they do on Windows.
+  "T3CODE_OTLP_TRACES_URL",
+  "T3CODE_OTLP_METRICS_URL",
+  "T3CODE_OTLP_LOGS_URL",
+  "OTEL_EXPORTER_OTLP_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_HEADERS",
+  "OTEL_EXPORTER_OTLP_TRACES_HEADERS",
+  "OTEL_EXPORTER_OTLP_METRICS_HEADERS",
+  "OTEL_EXPORTER_OTLP_LOGS_HEADERS",
+  "OTEL_EXPORTER_OTLP_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL",
+  "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
 ] as const;
 
 const WSL_SERVER_SYSTEM_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
@@ -221,12 +238,11 @@ const readPersistedBackendObservabilitySettings = Effect.gen(function* () {
   };
 });
 
-// The bootstrap is the only channel that carries an OTLP endpoint to every
-// backend. A Windows-native child inherits the desktop process's env, but a
-// WSL child gets nothing across wsl.exe that WSLENV does not declare, and
-// WSLENV translation of URL-shaped values is unreliable, so the endpoints are
-// deliberately not forwarded that way. Env beats the persisted settings file,
-// matching the precedence resolveServerConfig and DesktopObservability apply.
+// The bootstrap carries the OTLP endpoints to every backend, including a WSL
+// child that lacks the variables. The T3 URLs also travel as variables in
+// WSL_FORWARDED_ENV_NAMES so they outrank a forwarded OTEL endpoint. Env beats
+// the persisted settings file, matching the precedence resolveServerConfig and
+// DesktopObservability apply.
 const readBackendObservabilitySettings = Effect.gen(function* () {
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
   const persisted = yield* readPersistedBackendObservabilitySettings;
@@ -742,10 +758,8 @@ const resolveWslStartConfig = Effect.fn("desktop.backendConfiguration.resolveWsl
   };
 
   // Forward the dev-server URL as an explicit CLI flag so the WSL backend's
-  // config resolution lands in dev/ instead of userdata/. Inheriting through
-  // WSLENV is unreliable in practice (URL-shaped values with colons /
-  // slashes get translated unpredictably depending on flags), and the
-  // packaged build leaves devServerUrl as None anyway.
+  // config resolution lands in dev/ instead of userdata/. The packaged build
+  // leaves devServerUrl as None.
   const devUrlArgs = Option.match(environment.devServerUrl, {
     onNone: () => [] as ReadonlyArray<string>,
     onSome: (url) => ["--dev-url", url.href],
diff --git a/docs/operations/observability.md b/docs/operations/observability.md
index 0bdb0eb0c0f8..abe82d680b97 100644
--- a/docs/operations/observability.md
+++ b/docs/operations/observability.md
@@ -552,17 +552,18 @@ OTLP export:
   `OTEL_EXPORTER_OTLP_HEADERS`: comma-separated `key=value` pairs with percent-encoded values.
 - `T3CODE_OTLP_PROTOCOL`: `http/json` (default) or `http/protobuf`
 
-The server also reads the standard `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_ENDPOINT` and generic
-`OTEL_EXPORTER_OTLP_ENDPOINT` (with `/v1/traces`, `/v1/metrics`, or `/v1/logs` appended), for a
-collector expecting those instead. A non-blank `T3CODE_OTLP_*_URL` wins over either, and a
-per-signal endpoint wins over the generic one for its signal. A blank value counts as unset. A
-signal with an OTEL endpoint takes its headers from `OTEL_EXPORTER_OTLP_HEADERS` and its protocol
-from `OTEL_EXPORTER_OTLP_PROTOCOL` (default `http/protobuf`, read case-insensitively), and a
-per-signal `OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_HEADERS` or `_PROTOCOL` wins over the generic
-one for its signal. `T3CODE_OTLP_HEADERS` and `T3CODE_OTLP_PROTOCOL` never apply to it. An endpoint
-that is not an `http` or `https` URL, a protocol other than `http/protobuf` or `http/json` such as
-`grpc`, or headers that are not `key=value` pairs with percent-encoded values turn that signal's
-export off with a startup warning, rather than sending it to the Settings endpoint.
+The server and the desktop app also read the standard
+`OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_ENDPOINT` and generic `OTEL_EXPORTER_OTLP_ENDPOINT` (with
+`/v1/traces`, `/v1/metrics`, or `/v1/logs` appended), for a collector expecting those instead. A
+non-blank `T3CODE_OTLP_*_URL` wins over either, and a per-signal endpoint wins over the generic one
+for its signal. A blank value counts as unset. A signal with an OTEL endpoint takes its headers from
+`OTEL_EXPORTER_OTLP_HEADERS` and its protocol from `OTEL_EXPORTER_OTLP_PROTOCOL` (default
+`http/protobuf`, read case-insensitively), and a per-signal
+`OTEL_EXPORTER_OTLP_{TRACES,METRICS,LOGS}_HEADERS` or `_PROTOCOL` wins over the generic one for its
+signal. `T3CODE_OTLP_HEADERS` and `T3CODE_OTLP_PROTOCOL` never apply to it. An endpoint that is not
+an `http` or `https` URL, a protocol other than `http/protobuf` or `http/json` such as `grpc`, or
+headers that are not `key=value` pairs with percent-encoded values turn that signal's export off
+with a startup warning, rather than sending it to the Settings endpoint.
 
 If the OTLP URLs are unset, local tracing still works, metrics stay in-process only, and logs stay
 on stdout only.

From ed809f7ad274ebccdfbf029ccfd7ff2582fd486a Mon Sep 17 00:00:00 2001
From: "t3-code[bot]" <269035359+t3-code[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 14:29:42 -0700
Subject: [PATCH 07/11] fix(web): restore compact provider instance badges
 (#13700)

Co-authored-by: Julius Marminge <51714798+juliusmarminge@users.noreply.github.com>
---
 apps/web/src/components/Sidebar.tsx                       | 2 +-
 apps/web/src/components/chat/ModelPickerSidebar.tsx       | 2 +-
 apps/web/src/components/chat/ProviderInstanceIcon.tsx     | 2 +-
 apps/web/src/components/chat/ProviderModelPicker.test.tsx | 3 ---
 apps/web/src/components/chat/ProviderModelPicker.tsx      | 2 +-
 apps/web/src/components/settings/ProviderInstanceCard.tsx | 2 +-
 apps/web/src/index.css                                    | 7 ++++++-
 apps/web/src/lib/utils.ts                                 | 2 +-
 8 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/apps/web/src/components/Sidebar.tsx b/apps/web/src/components/Sidebar.tsx
index 7cbae330c318..4b8027c14108 100644
--- a/apps/web/src/components/Sidebar.tsx
+++ b/apps/web/src/components/Sidebar.tsx
@@ -1965,7 +1965,7 @@ const SidebarThreadRow = memo(function SidebarThreadRow(props: {
                       showBadge={showInstanceBadge}
                       // Glyph dims, badge stays saturated; offset matches the composer trigger.
                       iconClassName="size-3.5 opacity-60"
-                      badgeClassName="right-[-0.1875rem] bottom-[-0.1875rem] h-3 min-w-3 px-0.5 text-3xs"
+                      badgeClassName="right-[-0.1875rem] bottom-[-0.1875rem] h-3 min-w-3 px-0.5 text-5xs"
                     />
                   </span>
                 ) : null}
diff --git a/apps/web/src/components/chat/ModelPickerSidebar.tsx b/apps/web/src/components/chat/ModelPickerSidebar.tsx
index 80b06cbc680d..d043c053a073 100644
--- a/apps/web/src/components/chat/ModelPickerSidebar.tsx
+++ b/apps/web/src/components/chat/ModelPickerSidebar.tsx
@@ -210,7 +210,7 @@ export const ModelPickerSidebar = memo(function ModelPickerSidebar(props: {
                         ? "var(--background)"
                         : "color-mix(in oklab, var(--muted) 30%, transparent)"
                   }
-                  {...(entry.accentColor ? { badgeClassName: "h-3 min-w-3 px-0.5 text-3xs" } : {})}
+                  {...(entry.accentColor ? { badgeClassName: "h-3 min-w-3 px-0.5 text-5xs" } : {})}
                 />
                 {showNewBadge ? (
                   <span className={NEW_BADGE_CLASS} aria-hidden>
diff --git a/apps/web/src/components/chat/ProviderInstanceIcon.tsx b/apps/web/src/components/chat/ProviderInstanceIcon.tsx
index 4f6d83eb92bf..6c36087a1e29 100644
--- a/apps/web/src/components/chat/ProviderInstanceIcon.tsx
+++ b/apps/web/src/components/chat/ProviderInstanceIcon.tsx
@@ -55,7 +55,7 @@ export const ProviderInstanceIcon = memo(function ProviderInstanceIcon(props: {
       {props.showBadge ? (
         <span
           className={cn(
-            "pointer-events-none absolute right-0 bottom-0 z-10 flex h-3.5 min-w-3.5 items-center justify-center rounded-full border px-0.5 text-3xs font-semibold leading-none shadow-sm",
+            "pointer-events-none absolute right-0 bottom-0 z-10 flex h-3.5 min-w-3.5 items-center justify-center rounded-full border px-0.5 text-4xs font-semibold leading-none shadow-sm",
             props.accentColor
               ? "bg-(--provider-accent) text-white"
               : "bg-card text-muted-foreground",
diff --git a/apps/web/src/components/chat/ProviderModelPicker.test.tsx b/apps/web/src/components/chat/ProviderModelPicker.test.tsx
index da8b262c0a55..54aa051aa639 100644
--- a/apps/web/src/components/chat/ProviderModelPicker.test.tsx
+++ b/apps/web/src/components/chat/ProviderModelPicker.test.tsx
@@ -172,8 +172,5 @@ describe("ProviderModelPicker", () => {
     );
 
     expect(markup).toContain(">CP</span>");
-    expect(markup).toContain("size-4");
-    expect(markup).toContain("h-3");
-    expect(markup).toContain("text-3xs");
   });
 });
diff --git a/apps/web/src/components/chat/ProviderModelPicker.tsx b/apps/web/src/components/chat/ProviderModelPicker.tsx
index c24a3189435a..fbc178965378 100644
--- a/apps/web/src/components/chat/ProviderModelPicker.tsx
+++ b/apps/web/src/components/chat/ProviderModelPicker.tsx
@@ -250,7 +250,7 @@ export const ProviderModelPicker = memo(function ProviderModelPicker(props: {
               iconClassName={cn("size-4", props.activeProviderIconClassName)}
               indicatorBackground={props.instanceIndicatorBackground ?? "var(--contrast-input)"}
               badgeClassName={cn(
-                "right-[-0.125rem] bottom-[-0.125rem] h-3 min-w-3 px-0.5 text-3xs",
+                "right-[-0.125rem] bottom-[-0.125rem] h-3 min-w-3 px-0.5 text-5xs",
                 size === "xs" && "shadow-none",
               )}
             />
diff --git a/apps/web/src/components/settings/ProviderInstanceCard.tsx b/apps/web/src/components/settings/ProviderInstanceCard.tsx
index 4e2405c138b1..ff0546f5012d 100644
--- a/apps/web/src/components/settings/ProviderInstanceCard.tsx
+++ b/apps/web/src/components/settings/ProviderInstanceCard.tsx
@@ -570,7 +570,7 @@ export function ProviderInstanceCard({
       showBadge={Boolean(accentColor)}
       className="size-5"
       iconClassName="size-4 text-foreground/80"
-      badgeClassName="right-[-0.125rem] bottom-[-0.125rem] h-3 min-w-3 px-0.5 text-3xs"
+      badgeClassName="right-[-0.125rem] bottom-[-0.125rem] h-3 min-w-3 px-0.5 text-5xs"
     />
   ) : FallbackIconComponent ? (
     <span className="inline-flex size-5 shrink-0 items-center justify-center">
diff --git a/apps/web/src/index.css b/apps/web/src/index.css
index 9caf42ca2d6c..1039f23b19b8 100644
--- a/apps/web/src/index.css
+++ b/apps/web/src/index.css
@@ -161,12 +161,17 @@ html[data-mobile-composer-route-transition="true"]::view-transition-old(t3-mobil
 @theme inline {
   /* Two steps below Tailwind's text-xs (12px) for dense UI: metadata rows,
      badges, counters, keyboard hints and diagnostics tables. 2xs is 11px,
-     3xs is 10px and the floor of the scale. Registered with tailwind-merge in
+     3xs is 10px. Provider icon overlays use 4xs (8px) and 5xs (7px) to fit
+     their smaller badges. Registered with tailwind-merge in
      lib/utils.ts so cn() treats them as font sizes, not colours. */
   --text-2xs: 0.6875rem;
   --text-2xs--line-height: calc(1 / 0.6875);
   --text-3xs: 0.625rem;
   --text-3xs--line-height: calc(0.875 / 0.625);
+  --text-4xs: 0.5rem;
+  --text-4xs--line-height: 1;
+  --text-5xs: 0.4375rem;
+  --text-5xs--line-height: 1;
   /* Motion. drawer is the decelerating curve for surfaces that slide or pop in
      (composer context, pills). */
   --ease-drawer: cubic-bezier(0.32, 0.72, 0, 1);
diff --git a/apps/web/src/lib/utils.ts b/apps/web/src/lib/utils.ts
index 43d55682e12d..ca9a3a6340c2 100644
--- a/apps/web/src/lib/utils.ts
+++ b/apps/web/src/lib/utils.ts
@@ -6,7 +6,7 @@ import { DraftId } from "../composerDraftStore";
 
 // The theme's extra font sizes (index.css). Unregistered, tailwind-merge reads
 // text-2xs as a colour and drops it next to text-muted-foreground.
-const twMerge = extendTailwindMerge({ extend: { theme: { text: ["2xs", "3xs"] } } });
+const twMerge = extendTailwindMerge({ extend: { theme: { text: ["2xs", "3xs", "4xs", "5xs"] } } });
 
 export function cn(...inputs: CxOptions) {
   return twMerge(cx(inputs));

From 525af2d1ad4b6de847ea658c37a081fd7afe8ef6 Mon Sep 17 00:00:00 2001
From: AKolenda <akole779@mtroyal.ca>
Date: Fri, 25 Sep 2026 18:23:19 -0600
Subject: [PATCH 08/11] perf(mobile): lighter Home rows away from the viewport
 (#13702)

---
 apps/mobile/src/features/home/HomeScreen.tsx  | 62 +++++++++++++++--
 .../home/swipe-row-activation.test.ts         | 68 +++++++++++++++++++
 .../src/features/home/swipe-row-activation.ts | 62 +++++++++++++++++
 .../features/home/thread-swipe-actions.tsx    | 25 ++++++-
 .../features/threads/thread-list-v2-items.tsx |  5 ++
 5 files changed, 217 insertions(+), 5 deletions(-)
 create mode 100644 apps/mobile/src/features/home/swipe-row-activation.test.ts
 create mode 100644 apps/mobile/src/features/home/swipe-row-activation.ts

diff --git a/apps/mobile/src/features/home/HomeScreen.tsx b/apps/mobile/src/features/home/HomeScreen.tsx
index d1d108d3bed0..c57ac15b1ee5 100644
--- a/apps/mobile/src/features/home/HomeScreen.tsx
+++ b/apps/mobile/src/features/home/HomeScreen.tsx
@@ -1,7 +1,7 @@
 import { useAndroidControlSizing } from "../../components/useAndroidControlSizing";
 import type { ThreadMoveDestination } from "../threads/threadOrder";
 import { computeThreadMoveAvailability } from "../threads/threadOrder";
-import { LegendList } from "@legendapp/list/react-native";
+import { LegendList, type LegendListRef } from "@legendapp/list/react-native";
 import {
   type EnvironmentProject,
   type EnvironmentThreadShell,
@@ -18,7 +18,14 @@ import {
 import { useAtomValue } from "@effect/atom-react";
 import { useFocusEffect } from "@react-navigation/native";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { ActivityIndicator, Platform, View } from "react-native";
+import {
+  ActivityIndicator,
+  Platform,
+  View,
+  type GestureResponderEvent,
+  type NativeScrollEvent,
+  type NativeSyntheticEvent,
+} from "react-native";
 import type { SwipeableMethods } from "react-native-gesture-handler/ReanimatedSwipeable";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
 
@@ -59,6 +66,7 @@ import {
   sortHomeProjectScopes,
   type HomeProjectSortOrder,
 } from "./homeThreadList";
+import { createSwipeRowActivation } from "./swipe-row-activation";
 import { SwipeableScrollGateProvider, useSwipeableScrollGate } from "./thread-swipe-actions";
 import { useMaterialFabScroll } from "./MaterialFabScrollContext";
 
@@ -266,8 +274,45 @@ export function HomeScreen(props: HomeScreenProps) {
     openSwipeableRef.current?.close();
   }, []);
   const onMaterialFabScroll = useMaterialFabScroll();
+  const listRef = useRef<LegendListRef>(null);
+  const swipeRowActivation = useMemo(() => createSwipeRowActivation(), []);
+  const activateVisibleRows = useCallback(
+    (rows: ReadonlyArray<ThreadListV2ListItem>) => {
+      const state = listRef.current?.getState();
+      if (state === undefined || !(state.end >= 0)) return;
+      swipeRowActivation.activate(
+        rows.slice(Math.max(0, state.start - 2), state.end + 3).map((row) => row.key),
+      );
+    },
+    [swipeRowActivation],
+  );
+  // Status-bar, accessibility and programmatic scrolls never arm the scroll
+  // gate, so every scroll also activates the visible rows once it settles.
+  const activationTimerRef = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
+  useEffect(() => () => clearTimeout(activationTimerRef.current), []);
+  const handleListScroll = useCallback(
+    (event: NativeSyntheticEvent<NativeScrollEvent>) => {
+      onMaterialFabScroll?.(event);
+      clearTimeout(activationTimerRef.current);
+      activationTimerRef.current = setTimeout(
+        () => activateVisibleRows(listRef.current?.getState().data ?? []),
+        200,
+      );
+    },
+    [activateVisibleRows, onMaterialFabScroll],
+  );
+  const trackListTouches = useCallback(
+    (event: GestureResponderEvent, started: boolean) => {
+      const { changedTouches, touches } = event.nativeEvent;
+      swipeRowActivation.trackTouches(
+        started ? changedTouches.map((touch) => touch.identifier) : [],
+        touches.map((touch) => touch.identifier),
+      );
+    },
+    [swipeRowActivation],
+  );
   const { swipeEnabled, scrollGateHandlers } = useSwipeableScrollGate({
-    onScroll: onMaterialFabScroll,
+    onScroll: handleListScroll,
     onScrollBeginDrag: handleScrollBeginDrag,
   });
 
@@ -657,6 +702,9 @@ export function HomeScreen(props: HomeScreenProps) {
   );
 
   useThreadJumpShortcuts(threadListV2Items, props.onSelectThread);
+  useEffect(() => {
+    if (swipeEnabled) activateVisibleRows(threadListV2Items);
+  }, [activateVisibleRows, swipeEnabled, threadListV2Items]);
 
   const renderV2Item = useCallback(
     ({ item }: { readonly item: ThreadListV2ListItem }) => {
@@ -764,6 +812,7 @@ export function HomeScreen(props: HomeScreenProps) {
           onMoveThread={handleMoveThread}
           onSwipeableClose={handleSwipeableClose}
           onSwipeableWillOpen={handleSwipeableWillOpen}
+          activationKey={item.key}
         />
       );
     },
@@ -952,8 +1001,13 @@ export function HomeScreen(props: HomeScreenProps) {
         {/* Shared with the iPad sidebar: cells are reused across data
             rebuilds and `itemsAreEqual` keeps a minute tick (or an unrelated
             shell update) from re-rendering untouched rows. */}
-        <SwipeableScrollGateProvider enabled={swipeEnabled}>
+        <SwipeableScrollGateProvider enabled={swipeEnabled} activation={swipeRowActivation}>
           <LegendList
+            ref={listRef}
+            onLoad={() => activateVisibleRows(threadListV2Items)}
+            onTouchStart={(event) => trackListTouches(event, true)}
+            onTouchEnd={(event) => trackListTouches(event, false)}
+            onTouchCancel={(event) => trackListTouches(event, false)}
             data={threadListV2Items}
             renderItem={renderV2Item}
             keyExtractor={v2KeyExtractor}
diff --git a/apps/mobile/src/features/home/swipe-row-activation.test.ts b/apps/mobile/src/features/home/swipe-row-activation.test.ts
new file mode 100644
index 000000000000..43f8dcf0ca7e
--- /dev/null
+++ b/apps/mobile/src/features/home/swipe-row-activation.test.ts
@@ -0,0 +1,68 @@
+import { describe, expect, it, vi } from "vite-plus/test";
+
+import { createSwipeRowActivation } from "./swipe-row-activation";
+
+describe("createSwipeRowActivation", () => {
+  it("activates exactly the requested rows and notifies only on change", () => {
+    const activation = createSwipeRowActivation();
+    const listener = vi.fn();
+    activation.subscribe(listener);
+
+    activation.activate(["a", "b"]);
+    activation.activate(["b", "a"]);
+
+    expect(activation.isActive("a")).toBe(true);
+    expect(activation.isActive("c")).toBe(false);
+    expect(listener).toHaveBeenCalledTimes(1);
+
+    activation.activate(["c"]);
+    expect(activation.isActive("a")).toBe(false);
+    expect(activation.isActive("c")).toBe(true);
+    expect(listener).toHaveBeenCalledTimes(2);
+  });
+
+  it("defers changes while a finger is on the list so a press is never remounted", () => {
+    const activation = createSwipeRowActivation();
+    activation.activate(["a"]);
+
+    activation.trackTouches(["1"], ["1"]);
+    activation.activate(["b"]);
+    activation.activate(["c"]);
+    expect(activation.isActive("a")).toBe(true);
+    expect(activation.isActive("c")).toBe(false);
+
+    activation.trackTouches([], []);
+    expect(activation.isActive("a")).toBe(false);
+    expect(activation.isActive("b")).toBe(false);
+    expect(activation.isActive("c")).toBe(true);
+  });
+
+  it("ignores fingers that did not start on the list", () => {
+    const activation = createSwipeRowActivation();
+    activation.trackTouches(["1"], ["1", "2"]);
+    activation.activate(["a"]);
+
+    // The list finger lifts while finger 2 stays on another control.
+    activation.trackTouches([], ["2"]);
+    expect(activation.isActive("a")).toBe(true);
+  });
+
+  it("drops a list finger whose end event never arrived", () => {
+    const activation = createSwipeRowActivation();
+    activation.trackTouches(["1"], ["1"]);
+    activation.activate(["a"]);
+
+    activation.trackTouches(["2"], ["2"]);
+    activation.trackTouches([], []);
+    expect(activation.isActive("a")).toBe(true);
+  });
+
+  it("stops notifying after unsubscribe", () => {
+    const activation = createSwipeRowActivation();
+    const listener = vi.fn();
+    const unsubscribe = activation.subscribe(listener);
+    unsubscribe();
+    activation.activate(["a"]);
+    expect(listener).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/mobile/src/features/home/swipe-row-activation.ts b/apps/mobile/src/features/home/swipe-row-activation.ts
new file mode 100644
index 000000000000..d56d12cba56f
--- /dev/null
+++ b/apps/mobile/src/features/home/swipe-row-activation.ts
@@ -0,0 +1,62 @@
+import { createContext, use, useSyncExternalStore } from "react";
+
+/**
+ * Full swipe rows (pan gesture, animated actions, hidden action buttons) only
+ * exist around the viewport. Every other Home row renders a dormant frame that
+ * paints the same content with a fraction of the native views, so a row the
+ * list rebuilds while scrolling is cheap. The scroll gate already disables
+ * swipes while the list moves, so rows are activated once it rests.
+ */
+export function createSwipeRowActivation() {
+  let activeKeys = new Set<string>();
+  // Swapping a row's frame remounts it, which would cancel a press or long
+  // press in progress, so changes wait until every finger that started on the
+  // list has lifted.
+  const listTouches = new Set<string>();
+  let pendingKeys: ReadonlyArray<string> | null = null;
+  const listeners = new Set<() => void>();
+  const apply = (keys: ReadonlyArray<string>) => {
+    if (keys.length === activeKeys.size && keys.every((key) => activeKeys.has(key))) return;
+    activeKeys = new Set(keys);
+    for (const listener of listeners) listener();
+  };
+  return {
+    subscribe(listener: () => void) {
+      listeners.add(listener);
+      return () => void listeners.delete(listener);
+    },
+    isActive: (key: string) => activeKeys.has(key),
+    activate(keys: ReadonlyArray<string>) {
+      if (listTouches.size > 0) pendingKeys = keys;
+      else apply(keys);
+    },
+    /**
+     * `started` are touches that just began on the list; `onScreen` is every
+     * finger still down anywhere. A finger on another control never holds
+     * changes, and one whose end event went missing is dropped here.
+     */
+    trackTouches(started: ReadonlyArray<string>, onScreen: ReadonlyArray<string>) {
+      for (const id of started) listTouches.add(id);
+      for (const id of listTouches) if (!onScreen.includes(id)) listTouches.delete(id);
+      if (listTouches.size > 0 || pendingKeys === null) return;
+      const keys = pendingKeys;
+      pendingKeys = null;
+      apply(keys);
+    },
+  };
+}
+
+export type SwipeRowActivation = ReturnType<typeof createSwipeRowActivation>;
+
+export const SwipeRowActivationContext = createContext<SwipeRowActivation | null>(null);
+
+const subscribeNever = () => () => {};
+
+/** Rows outside an activation provider (e.g. the iPad sidebar) stay live. */
+export function useSwipeRowDormant(key: string | undefined): boolean {
+  const activation = use(SwipeRowActivationContext);
+  return useSyncExternalStore(
+    activation?.subscribe ?? subscribeNever,
+    () => activation !== null && key !== undefined && !activation.isActive(key),
+  );
+}
diff --git a/apps/mobile/src/features/home/thread-swipe-actions.tsx b/apps/mobile/src/features/home/thread-swipe-actions.tsx
index 44f3c36e6655..e62935c28861 100644
--- a/apps/mobile/src/features/home/thread-swipe-actions.tsx
+++ b/apps/mobile/src/features/home/thread-swipe-actions.tsx
@@ -40,6 +40,7 @@ import Animated, {
 } from "react-native-reanimated";
 
 import { AppText as Text } from "../../components/AppText";
+import { SwipeRowActivationContext, type SwipeRowActivation } from "./swipe-row-activation";
 import { registerThreadDismissal } from "./thread-dismissal";
 
 // Wide enough for the longest action label ("Unarchive").
@@ -129,11 +130,14 @@ const SwipeableScrollGateContext = createContext(true);
 
 export function SwipeableScrollGateProvider(props: {
   readonly enabled: boolean;
+  readonly activation?: SwipeRowActivation;
   readonly children: ReactNode;
 }) {
   return (
     <SwipeableScrollGateContext.Provider value={props.enabled}>
-      {props.children}
+      <SwipeRowActivationContext value={props.activation ?? null}>
+        {props.children}
+      </SwipeRowActivationContext>
     </SwipeableScrollGateContext.Provider>
   );
 }
@@ -260,13 +264,32 @@ interface ThreadSwipeableProps {
    * open/mid-drag state can't leak onto another row.
    */
   readonly resetKey?: string;
+  /** Paints the row without swipe machinery; see swipe-row-activation. */
+  readonly dormant?: boolean;
   readonly simultaneousWithExternalGesture?: ComponentProps<
     typeof ReanimatedSwipeable
   >["simultaneousWithExternalGesture"];
   readonly threadTitle: string;
 }
 
+const closeDormant = () => {};
+
 export function ThreadSwipeable(props: ThreadSwipeableProps) {
+  if (props.dormant) {
+    // Mirrors ReanimatedSwipeable's container and children views.
+    return (
+      <View
+        style={[
+          { overflow: "hidden", backgroundColor: props.backgroundColor },
+          props.containerStyle,
+        ]}
+      >
+        <View style={{ backgroundColor: props.backgroundColor }}>
+          {props.children(closeDormant)}
+        </View>
+      </View>
+    );
+  }
   // Recycled content gets fresh native and animation state. Late callbacks
   // from the previous row retain its action, never the replacement's action.
   return <ThreadSwipeableRow key={props.resetKey} {...props} />;
diff --git a/apps/mobile/src/features/threads/thread-list-v2-items.tsx b/apps/mobile/src/features/threads/thread-list-v2-items.tsx
index 31039388dc09..eb089b95060a 100644
--- a/apps/mobile/src/features/threads/thread-list-v2-items.tsx
+++ b/apps/mobile/src/features/threads/thread-list-v2-items.tsx
@@ -35,6 +35,7 @@ import { copyTextWithHaptic } from "../../lib/copyTextWithHaptic";
 import { useUniwindTheme } from "../../lib/useUniwindTheme";
 import type { PendingNewTask } from "../../state/use-pending-new-tasks";
 import { useThreadPr } from "../../state/use-thread-pr";
+import { useSwipeRowDormant } from "../home/swipe-row-activation";
 import { ThreadSwipeable } from "../home/thread-swipe-actions";
 import { buildThreadTitleRegenerationMenuItems } from "./thread-title-regeneration-menu";
 import {
@@ -518,6 +519,8 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
   readonly canMoveDown?: boolean;
   readonly onSwipeableWillOpen: (methods: SwipeableMethods) => void;
   readonly onSwipeableClose: (methods: SwipeableMethods) => void;
+  /** List key checked against the Home swipe row activation. */
+  readonly activationKey?: string;
   readonly searchMatch?: EnvironmentThreadSearchMatch;
   readonly searchQuery?: string;
   readonly simultaneousSwipeGesture?: ComponentProps<
@@ -545,6 +548,7 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
   } = props;
   const snoozedRow = props.snoozed === true;
   const pinnedRow = props.pinned === true;
+  const dormant = useSwipeRowDormant(props.activationKey);
 
   const pr = useThreadPr(thread);
 
@@ -1180,6 +1184,7 @@ export const ThreadListV2Row = memo(function ThreadListV2Row(props: {
         <CustomSnoozeSheet onClose={() => setCustomSnoozeOpen(false)} onSnooze={handleSnooze} />
       )}
       <ThreadSwipeable
+        dormant={dormant}
         threadKey={`${thread.environmentId}:${thread.id}`}
         backgroundColor={rowAppearance.swipeBackgroundColor}
         compactActions={variant === "slim"}

From aade3a69a8536be98d2fe9b0fb9193289b70e90b Mon Sep 17 00:00:00 2001
From: Yash Singh <saiansh2525@gmail.com>
Date: Fri, 25 Sep 2026 19:27:37 -0500
Subject: [PATCH 09/11] fix(usage): price Cursor cache savings by base model
 (#13731)

---
 apps/server/src/usage/cursorUsageReader.ts | 13 +++++++++++++
 apps/server/src/usage/usagePricing.test.ts | 21 +++++++++++++++++++++
 apps/server/src/usage/usagePricing.ts      | 10 +++++++---
 apps/server/src/usage/usageTranscripts.ts  |  5 +++++
 4 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/apps/server/src/usage/cursorUsageReader.ts b/apps/server/src/usage/cursorUsageReader.ts
index 81c680afff0b..1e07fcc7a825 100644
--- a/apps/server/src/usage/cursorUsageReader.ts
+++ b/apps/server/src/usage/cursorUsageReader.ts
@@ -17,6 +17,18 @@ function tokens(value: unknown): number {
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.trunc(value) : 0;
 }
 
+/**
+ * Maps Cursor's tiered names (`cursor-grok-4.6-high-fast`,
+ * `claude-fable-5-1-thinking-high`) to the base model's rate-table key.
+ * Grok resolves through xAI's first-party entry, which has no bare alias.
+ */
+export function cursorRateModel(model: string): string {
+  const base = model
+    .replace(/^cursor-/, "")
+    .replace(/(?:-thinking)?(?:-(?:none|minimal|low|medium|high|xhigh|max))?(?:-fast)?$/, "");
+  return base.startsWith("grok-") ? `xai/${base}` : base;
+}
+
 export interface CursorAccountUsageReadResult {
   readonly accountKey: string | null;
   readonly records: readonly UsageRecord[];
@@ -232,6 +244,7 @@ export async function readCursorAccountUsage(
           provider: "cursor",
           timestampMs,
           model: event.model,
+          rateModel: cursorRateModel(event.model),
           sessionId,
           totals,
           reportedCostUsd,
diff --git a/apps/server/src/usage/usagePricing.test.ts b/apps/server/src/usage/usagePricing.test.ts
index ca340a44a64e..db4f68c2cb42 100644
--- a/apps/server/src/usage/usagePricing.test.ts
+++ b/apps/server/src/usage/usagePricing.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "@effect/vitest";
 
+import { cursorRateModel } from "./cursorUsageReader.ts";
 import {
   cacheSavingsUsd,
   createOverrideRateTable,
@@ -49,6 +50,26 @@ describe("usage pricing", () => {
     expect(cacheSavingsUsd(table, record("example-model"), overrides)).toBe(1.5);
   });
 
+  it("prices Cursor cache savings at the base model rate", () => {
+    const table = parseRateTable({
+      "claude-fable-5-1": rate(10e-6, 1e-6),
+      "xai/grok-4.7": rate(2e-6, 0.5e-6),
+      "openrouter/x-ai/grok-4.7": rate(3e-6, 0.5e-6),
+    });
+    const cursorRecord = (model: string) => ({
+      ...record(model, 0.25),
+      rateModel: cursorRateModel(model),
+    });
+
+    expect(cacheSavingsUsd(table, cursorRecord("claude-fable-5-1-thinking-high"))).toBeCloseTo(9);
+    expect(cacheSavingsUsd(table, cursorRecord("cursor-grok-4.7-high-fast"))).toBeCloseTo(1.5);
+    expect(cacheSavingsUsd(table, cursorRecord("default"))).toBe(0);
+    expect(priceUsage(table, cursorRecord("grok-4.7-xhigh-fast"))).toEqual({
+      costUsd: 0.25,
+      costSource: "providerReported",
+    });
+  });
+
   it("prices unknown models offline and uses input prices for omitted cache rates", () => {
     const table = parseRateTable({});
     const overrides = createOverrideRateTable({
diff --git a/apps/server/src/usage/usagePricing.ts b/apps/server/src/usage/usagePricing.ts
index 60bf31b93e31..78f6cf2c5cd9 100644
--- a/apps/server/src/usage/usagePricing.ts
+++ b/apps/server/src/usage/usagePricing.ts
@@ -184,7 +184,10 @@ export function lookupRate(table: RateTable, model: string): ModelRate | null {
 }
 
 /** The parts of a transcript record that decide its price. */
-export type PricedRecord = Pick<UsageRecord, "model" | "totals" | "fast" | "reportedCostUsd">;
+export type PricedRecord = Pick<
+  UsageRecord,
+  "model" | "rateModel" | "totals" | "fast" | "reportedCostUsd"
+>;
 
 export interface PricedUsage {
   readonly costUsd: number;
@@ -208,7 +211,7 @@ export function priceUsage(
     return { costUsd: reportedCostUsd, costSource: "providerReported" };
   }
 
-  const rate = override ?? lookupRate(table, model);
+  const rate = override ?? lookupRate(table, record.rateModel ?? model);
   if (rate === null) return { costUsd: 0, costSource: "unpriced" };
 
   const standardCostUsd =
@@ -232,7 +235,8 @@ export function cacheSavingsUsd(
   record: PricedRecord,
   overrides?: RateTable,
 ): number {
-  const rate = overrides?.get(record.model.trim()) ?? lookupRate(table, record.model);
+  const rate =
+    overrides?.get(record.model.trim()) ?? lookupRate(table, record.rateModel ?? record.model);
   if (rate === null) return 0;
   return (
     record.totals.cachedInputTokens *
diff --git a/apps/server/src/usage/usageTranscripts.ts b/apps/server/src/usage/usageTranscripts.ts
index 5da13168a1af..6e01c2c5a8ed 100644
--- a/apps/server/src/usage/usageTranscripts.ts
+++ b/apps/server/src/usage/usageTranscripts.ts
@@ -12,6 +12,11 @@ export interface UsageRecord {
   readonly provider: UsageProviderKind;
   readonly timestampMs: number;
   readonly model: string;
+  /**
+   * Rate-table key when the provider's display name carries tiers the table
+   * does not know, such as Cursor's `claude-opus-5-5-high`. Defaults to `model`.
+   */
+  readonly rateModel?: string;
   readonly sessionId: string;
   readonly totals: UsageTokenTotals;
   readonly reportedCostUsd: number | null;

From 595a1e1f537f403eba408817c2aba35e61c2ac29 Mon Sep 17 00:00:00 2001
From: AKolenda <akole779@mtroyal.ca>
Date: Fri, 25 Sep 2026 18:35:33 -0600
Subject: [PATCH 10/11] perf(mobile): render Home rows further ahead while
 scrolling (#13705)

Co-authored-by: Julius Marminge <julius0216@outlook.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 apps/mobile/src/features/home/HomeScreen.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/mobile/src/features/home/HomeScreen.tsx b/apps/mobile/src/features/home/HomeScreen.tsx
index c57ac15b1ee5..75be079f0de8 100644
--- a/apps/mobile/src/features/home/HomeScreen.tsx
+++ b/apps/mobile/src/features/home/HomeScreen.tsx
@@ -138,6 +138,10 @@ interface HomeScreenProps {
 // measured-height pool expansion. The old tallest-card estimate (~92) fired
 // that warning on every ordinary shelf expand, so the average wins.
 const ESTIMATED_THREAD_LIST_V2_ROW_HEIGHT = 72;
+// Rows away from the viewport are cheap dormant frames (see
+// swipe-row-activation), so render further ahead: a fast fling then reaches
+// rows that are already built instead of rows still being rebuilt.
+const THREAD_LIST_V2_DRAW_DISTANCE = 1_000;
 const PRE_LIQUID_GLASS_BOTTOM_TOOLBAR_HEIGHT = 44;
 /**
  * Top spacing between the list and the Android custom header. The Android
@@ -1014,7 +1018,7 @@ export function HomeScreen(props: HomeScreenProps) {
             getItemType={(item) => item.type}
             itemsAreEqual={threadListV2ListItemsAreEqual}
             estimatedItemSize={ESTIMATED_THREAD_LIST_V2_ROW_HEIGHT}
-            drawDistance={500}
+            drawDistance={THREAD_LIST_V2_DRAW_DISTANCE}
             recycleItems
             extraData={v2ExtraData}
             ListHeaderComponent={v2ListHeader}

From 2a9832b8019039f812706639c11ccc24ce4c4e05 Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Fri, 25 Sep 2026 20:49:17 -0400
Subject: [PATCH 11/11] refactor(observability): name each service after its
 application (#13699)

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../src/app/DesktopObservability.test.ts      | 43 +++++++++++++++++++
 apps/desktop/src/app/DesktopObservability.ts  |  3 +-
 .../src/features/observability/tracing.ts     |  2 +-
 apps/server/src/bin.test.ts                   |  1 -
 apps/server/src/cli/config.test.ts            |  1 -
 apps/server/src/cli/config.ts                 |  2 -
 apps/server/src/cli/pair.ts                   |  1 -
 apps/server/src/cloud/relayTracing.ts         |  4 +-
 apps/server/src/config.ts                     |  5 +--
 .../src/environment/ServerEnvironment.test.ts |  1 -
 apps/server/src/persistence/Layers/Sqlite.ts  |  2 +-
 apps/server/src/server.test.ts                | 11 +++--
 apps/server/src/serverLogger.test.ts          | 31 ++++++++++++-
 apps/web/src/lib/runtime.ts                   |  2 +-
 apps/web/src/observability/clientTracing.ts   |  3 +-
 docs/operations/observability.md              | 24 ++++++-----
 infra/relay/src/observability.test.ts         |  9 ++++
 infra/relay/src/observability.ts              |  3 +-
 packages/shared/src/relayTracing.test.ts      |  2 +
 packages/shared/src/relayTracing.ts           |  1 +
 20 files changed, 116 insertions(+), 35 deletions(-)

diff --git a/apps/desktop/src/app/DesktopObservability.test.ts b/apps/desktop/src/app/DesktopObservability.test.ts
index 0e4c4d7a969d..e23d78aa2161 100644
--- a/apps/desktop/src/app/DesktopObservability.test.ts
+++ b/apps/desktop/src/app/DesktopObservability.test.ts
@@ -477,6 +477,49 @@ describe("DesktopObservability", () => {
     );
   });
 
+  it.effect("keeps its service name while OTEL resource attributes add dimensions", () => {
+    const requests: Array<ExportedRequest> = [];
+    return Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const baseDir = yield* fileSystem.makeTempDirectoryScoped({
+        prefix: "t3-desktop-observability-test-",
+      });
+      const environmentLayer = makeEnvironmentLayer(baseDir, true, {
+        T3CODE_OTLP_LOGS_URL: "https://collector.example.com/v1/logs",
+      });
+
+      yield* Effect.scoped(
+        Effect.logInfo("desktop service name").pipe(
+          Effect.provide(DesktopObservability.layer.pipe(Layer.provideMerge(environmentLayer))),
+        ),
+      );
+
+      assert.lengthOf(requests, 1);
+      const body = requests[0]?.body ?? "";
+      assert.include(body, '"stringValue":"t3code-desktop"');
+      assert.include(body, "deployment.environment.name");
+      assert.include(body, '"key":"service.namespace","value":{"stringValue":"t3code"}');
+      assert.notInclude(body, "renamed");
+    }).pipe(
+      Effect.scoped,
+      Effect.provide(
+        Layer.mergeAll(
+          NodeServices.layer,
+          collectorLayer(requests),
+          ConfigProvider.layer(
+            ConfigProvider.fromEnv({
+              env: {
+                OTEL_SERVICE_NAME: "renamed",
+                OTEL_RESOURCE_ATTRIBUTES:
+                  "service.name=renamed,service.namespace=renamed,deployment.environment.name=development",
+              },
+            }),
+          ),
+        ),
+      ),
+    );
+  });
+
   it.effect("exports nothing to Settings for logs an unusable OTEL endpoint claimed", () => {
     const requests: Array<ExportedRequest> = [];
     return Effect.gen(function* () {
diff --git a/apps/desktop/src/app/DesktopObservability.ts b/apps/desktop/src/app/DesktopObservability.ts
index 0bcb4d602102..ce8233e56612 100644
--- a/apps/desktop/src/app/DesktopObservability.ts
+++ b/apps/desktop/src/app/DesktopObservability.ts
@@ -626,8 +626,9 @@ const telemetryLayer = Layer.unwrap(
     const environment = yield* DesktopEnvironment.DesktopEnvironment;
     const endpoints = yield* resolveOtlpEndpoints;
     const resource = {
-      serviceName: "desktop",
+      serviceName: "t3code-desktop",
       attributes: {
+        "service.namespace": "t3code",
         "service.runtime": "desktop",
         "service.mode": environment.isDevelopment ? "development" : "packaged",
       },
diff --git a/apps/mobile/src/features/observability/tracing.ts b/apps/mobile/src/features/observability/tracing.ts
index eb73abba292b..ae204413e777 100644
--- a/apps/mobile/src/features/observability/tracing.ts
+++ b/apps/mobile/src/features/observability/tracing.ts
@@ -25,7 +25,7 @@ export function resolveTracingConfig(): TracingConfig | null {
 
 export function makeTracingLayer(config: TracingConfig | null, resource: TracingResource) {
   return makeRelayClientTracingLayer(config, {
-    serviceName: "t3-mobile-relay-client",
+    serviceName: "t3code-mobile",
     serviceVersion: resource.serviceVersion,
     runtime: "react-native",
     client: `mobile-${resource.appVariant}`,
diff --git a/apps/server/src/bin.test.ts b/apps/server/src/bin.test.ts
index 31a96304c3e5..aecf82eeac67 100644
--- a/apps/server/src/bin.test.ts
+++ b/apps/server/src/bin.test.ts
@@ -106,7 +106,6 @@ const makeCliTestServerConfig = (baseDir: string) =>
       otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
       otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
       otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-      otlpServiceName: "t3-server",
       otelEnvironment: OtelEnvironment.none,
       mode: "web",
       port: 0,
diff --git a/apps/server/src/cli/config.test.ts b/apps/server/src/cli/config.test.ts
index 6b42756ad175..ef7cdd578899 100644
--- a/apps/server/src/cli/config.test.ts
+++ b/apps/server/src/cli/config.test.ts
@@ -56,7 +56,6 @@ it.layer(NodeServices.layer)("cli config resolution", (it) => {
     otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
     otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
     otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-    otlpServiceName: "t3-server",
     otelEnvironment: OtelEnvironment.none,
     devAllowedOrigins: [],
   } as const;
diff --git a/apps/server/src/cli/config.ts b/apps/server/src/cli/config.ts
index 9c1ceac82101..d724730c953f 100644
--- a/apps/server/src/cli/config.ts
+++ b/apps/server/src/cli/config.ts
@@ -108,7 +108,6 @@ const EnvServerConfig = Config.all({
   otlpExportIntervalMs: Config.Int("T3CODE_OTLP_EXPORT_INTERVAL_MS").pipe(
     Config.withDefault(10_000),
   ),
-  otlpServiceName: Config.String("T3CODE_OTLP_SERVICE_NAME").pipe(Config.withDefault("t3-server")),
   otlpHeaders: Config.schema(OtlpHeadersFromString, "T3CODE_OTLP_HEADERS").pipe(
     Config.option,
     Config.map(Option.getOrUndefined),
@@ -431,7 +430,6 @@ export const resolveServerConfig = (
       otlpTracesExport: traces?.export ?? signalExport,
       otlpMetricsExport: metrics?.export ?? signalExport,
       otlpLogsExport: logs?.export ?? signalExport,
-      otlpServiceName: env.otlpServiceName,
       otelEnvironment: otel,
       mode,
       port,
diff --git a/apps/server/src/cli/pair.ts b/apps/server/src/cli/pair.ts
index 6b29ef60927f..04ce0332c14c 100644
--- a/apps/server/src/cli/pair.ts
+++ b/apps/server/src/cli/pair.ts
@@ -326,7 +326,6 @@ const makePairServerConfig = Effect.fn(function* (input: {
     otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
     otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
     otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-    otlpServiceName: "t3-server",
     otelEnvironment: OtelEnvironment.none,
     mode: "web",
     port: state.port,
diff --git a/apps/server/src/cloud/relayTracing.ts b/apps/server/src/cloud/relayTracing.ts
index e35c94545a5e..eeea28a2b68f 100644
--- a/apps/server/src/cloud/relayTracing.ts
+++ b/apps/server/src/cloud/relayTracing.ts
@@ -7,14 +7,14 @@ const relayClientTracingConfig = resolveRelayClientTracingConfig();
 export const headlessRelayClientTracingLayer = makeRelayClientTracingLayer(
   relayClientTracingConfig,
   {
-    serviceName: "t3-headless-relay-client",
+    serviceName: "t3code-server",
     runtime: "node",
     client: "headless-cli",
   },
 );
 
 export const serverRelayBrokerTracingLayer = makeRelayClientTracingLayer(relayClientTracingConfig, {
-  serviceName: "t3-server",
+  serviceName: "t3code-server",
   runtime: "node",
   client: "environment-server",
   component: "relay-broker",
diff --git a/apps/server/src/config.ts b/apps/server/src/config.ts
index 344619c0eb93..74ffde8efef0 100644
--- a/apps/server/src/config.ts
+++ b/apps/server/src/config.ts
@@ -82,7 +82,6 @@ export class ServerConfig extends Context.Service<
     readonly otlpTracesExport: SignalExport;
     readonly otlpMetricsExport: SignalExport;
     readonly otlpLogsExport: SignalExport;
-    readonly otlpServiceName: string;
     readonly otelEnvironment: OtelEnvironment.OtelEnvironment;
     readonly mode: RuntimeMode;
     readonly port: number;
@@ -119,8 +118,9 @@ export const make = (config: ServerConfig["Service"]) => ServerConfig.of(config)
  * logs report the same service identity to the collector.
  */
 export const otlpResource = (config: ServerConfig["Service"]) => ({
-  serviceName: config.otlpServiceName,
+  serviceName: "t3code-server",
   attributes: {
+    "service.namespace": "t3code",
     "service.runtime": "t3-server",
     "service.mode": config.mode,
   },
@@ -222,7 +222,6 @@ const makeTest = Effect.fn("ServerConfig.makeTest")(function* (
     otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
     otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
     otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-    otlpServiceName: "t3-server",
     otelEnvironment: OtelEnvironment.none,
     cwd,
     baseDir,
diff --git a/apps/server/src/environment/ServerEnvironment.test.ts b/apps/server/src/environment/ServerEnvironment.test.ts
index 12ae321c1cf3..6eb95c84b477 100644
--- a/apps/server/src/environment/ServerEnvironment.test.ts
+++ b/apps/server/src/environment/ServerEnvironment.test.ts
@@ -59,7 +59,6 @@ const makeServerConfig = Effect.fn(function* (baseDir: string) {
     otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
     otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
     otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-    otlpServiceName: "t3-server",
     otelEnvironment: OtelEnvironment.none,
     cwd: process.cwd(),
     baseDir,
diff --git a/apps/server/src/persistence/Layers/Sqlite.ts b/apps/server/src/persistence/Layers/Sqlite.ts
index 88342cbf1fad..032b44645089 100644
--- a/apps/server/src/persistence/Layers/Sqlite.ts
+++ b/apps/server/src/persistence/Layers/Sqlite.ts
@@ -32,7 +32,7 @@ export const makeSqlitePersistenceLive = Effect.fn("makeSqlitePersistenceLive")(
       filename: dbPath,
       spanAttributes: {
         "db.name": path.basename(dbPath),
-        "service.name": "t3-server",
+        "service.name": "t3code-server",
       },
     }),
   );
diff --git a/apps/server/src/server.test.ts b/apps/server/src/server.test.ts
index 12f37780701d..6836d28e25c1 100644
--- a/apps/server/src/server.test.ts
+++ b/apps/server/src/server.test.ts
@@ -489,7 +489,7 @@ const makeBrowserOtlpPayload = (spanName: string) =>
         url: collector.url,
         exportInterval: "10 millis",
         resource: {
-          serviceName: "t3-web",
+          serviceName: "t3code-web",
           attributes: {
             "service.runtime": "t3-web",
             "service.mode": "browser",
@@ -588,7 +588,6 @@ const buildAppUnderTest = (options?: {
       otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
       otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
       otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-      otlpServiceName: "t3-server",
       otelEnvironment: OtelEnvironment.none,
       mode: "desktop",
       port: 0,
@@ -5283,7 +5282,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
               attributes: [
                 {
                   key: "service.name",
-                  value: { stringValue: "t3-web" },
+                  value: { stringValue: "t3code-web" },
                 },
               ],
             },
@@ -5425,7 +5424,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
             "rpc.method": "server.getSettings",
           },
           resourceAttributes: {
-            "service.name": "t3-web",
+            "service.name": "t3code-web",
           },
           scope: {
             name: "effect",
@@ -5556,7 +5555,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
       // the stub's utf8 decode even though the surrounding bytes don't.
       assert.notEqual(forwarded.body[0], "{");
       assert.include(forwarded.body, "client.protobuf.test");
-      assert.include(forwarded.body, "t3-web");
+      assert.include(forwarded.body, "t3code-web");
     }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
 
@@ -5657,7 +5656,7 @@ it.layer(NodeServices.layer)("server router seam", (it) => {
         assert.deepEqual(record.links, []);
         assert.equal(record.scope.name, scopeSpan.scope.name);
         assert.deepEqual(record.scope.attributes, {});
-        assert.equal(record.resourceAttributes["service.name"], "t3-web");
+        assert.equal(record.resourceAttributes["service.name"], "t3code-web");
         assert.equal(record.status?.code, String(span.status.code));
       }).pipe(Effect.provide(NodeHttpServer.layerTest)),
   );
diff --git a/apps/server/src/serverLogger.test.ts b/apps/server/src/serverLogger.test.ts
index a5437582d2e3..43843b249eea 100644
--- a/apps/server/src/serverLogger.test.ts
+++ b/apps/server/src/serverLogger.test.ts
@@ -1,6 +1,7 @@
 import * as NodePath from "@effect/platform-node/NodePath";
 import { assert, describe, it } from "@effect/vitest";
 import * as NodeOS from "node:os";
+import * as ConfigProvider from "effect/ConfigProvider";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
@@ -57,7 +58,6 @@ const configLayer = (overrides: Partial<ServerConfig.ServerConfig["Service"]>) =
         otlpTracesExport: DEFAULT_SIGNAL_EXPORT,
         otlpMetricsExport: DEFAULT_SIGNAL_EXPORT,
         otlpLogsExport: DEFAULT_SIGNAL_EXPORT,
-        otlpServiceName: "t3-server",
         otelEnvironment: OtelEnvironment.none,
         cwd: baseDir,
         baseDir,
@@ -146,11 +146,38 @@ describe("ServerLoggerLive", () => {
       const [request] = requests;
       assert.strictEqual(request?.url, "https://collector.example.com/v1/logs");
       assert.include(request?.body ?? "", "server logger under test");
-      assert.include(request?.body ?? "", "t3-server");
+      assert.include(request?.body ?? "", "t3code-server");
       assert.include(request?.body ?? "", "service.runtime");
     }),
   );
 
+  it.effect("keeps its service name while OTEL resource attributes add dimensions", () =>
+    Effect.gen(function* () {
+      const requests = yield* logThrough({
+        otlpLogsUrl: "https://collector.example.com/v1/logs",
+      }).pipe(
+        Effect.provide(
+          ConfigProvider.layer(
+            ConfigProvider.fromEnv({
+              env: {
+                OTEL_SERVICE_NAME: "renamed",
+                OTEL_RESOURCE_ATTRIBUTES:
+                  "service.name=renamed,service.namespace=renamed,deployment.environment.name=development",
+              },
+            }),
+          ),
+        ),
+      );
+
+      assert.lengthOf(requests, 1);
+      const body = requests[0]?.body ?? "";
+      assert.include(body, '"stringValue":"t3code-server"');
+      assert.include(body, "deployment.environment.name");
+      assert.include(body, '"key":"service.namespace","value":{"stringValue":"t3code"}');
+      assert.notInclude(body, "renamed");
+    }),
+  );
+
   it.effect("stays off the network when no logs endpoint is configured", () =>
     Effect.gen(function* () {
       const requests = yield* logThrough({});
diff --git a/apps/web/src/lib/runtime.ts b/apps/web/src/lib/runtime.ts
index 866f38875c76..fd4f2b194096 100644
--- a/apps/web/src/lib/runtime.ts
+++ b/apps/web/src/lib/runtime.ts
@@ -19,7 +19,7 @@ function configuredRelayUrl(): string {
 
 const httpClientLayer = remoteHttpClientLayer((input, init) => globalThis.fetch(input, init));
 const relayTracingLayer = makeRelayClientTracingLayer(resolveRelayTracingConfig(), {
-  serviceName: "t3-web-relay-client",
+  serviceName: "t3code-web",
   serviceVersion: import.meta.env.APP_VERSION,
   runtime: "browser",
   client: typeof window !== "undefined" && window.desktopBridge ? "desktop" : "web",
diff --git a/apps/web/src/observability/clientTracing.ts b/apps/web/src/observability/clientTracing.ts
index 2471de958615..e8ccd4173d35 100644
--- a/apps/web/src/observability/clientTracing.ts
+++ b/apps/web/src/observability/clientTracing.ts
@@ -15,8 +15,9 @@ import { APP_VERSION } from "~/branding";
 
 const DEFAULT_EXPORT_INTERVAL_MS = 1_000;
 const CLIENT_TRACING_RESOURCE = {
-  serviceName: "t3-web",
+  serviceName: "t3code-web",
   attributes: {
+    "service.namespace": "t3code",
     "service.runtime": "t3-web",
     "service.mode": isElectron ? "electron" : "browser",
     "service.version": APP_VERSION,
diff --git a/docs/operations/observability.md b/docs/operations/observability.md
index abe82d680b97..86a65702c270 100644
--- a/docs/operations/observability.md
+++ b/docs/operations/observability.md
@@ -129,7 +129,7 @@ Default Grafana login:
 export T3CODE_OTLP_TRACES_URL=http://localhost:4318/v1/traces
 export T3CODE_OTLP_METRICS_URL=http://localhost:4318/v1/metrics
 export T3CODE_OTLP_LOGS_URL=http://localhost:4318/v1/logs
-export T3CODE_OTLP_SERVICE_NAME=t3-local
+export OTEL_RESOURCE_ATTRIBUTES=deployment.environment.name=development
 ```
 
 Optional:
@@ -169,7 +169,6 @@ macOS app bundle example:
 T3CODE_OTLP_TRACES_URL=http://localhost:4318/v1/traces \
 T3CODE_OTLP_METRICS_URL=http://localhost:4318/v1/metrics \
 T3CODE_OTLP_LOGS_URL=http://localhost:4318/v1/logs \
-T3CODE_OTLP_SERVICE_NAME=t3-desktop \
 "/Applications/T3 Code.app/Contents/MacOS/T3 Code"
 ```
 
@@ -179,7 +178,6 @@ Direct binary example:
 T3CODE_OTLP_TRACES_URL=http://localhost:4318/v1/traces \
 T3CODE_OTLP_METRICS_URL=http://localhost:4318/v1/metrics \
 T3CODE_OTLP_LOGS_URL=http://localhost:4318/v1/logs \
-T3CODE_OTLP_SERVICE_NAME=t3-desktop \
 ./path/to/your/desktop-app-binary
 ```
 
@@ -311,11 +309,13 @@ Recommended flow in Grafana:
 2. Pick the `Tempo` data source.
 3. Set the time range to something recent like `Last 15 minutes`.
 4. Start broad. Do not begin with a very narrow query.
-5. Look for spans from your configured service name, then narrow by span name or attributes.
+5. Look for spans from the `t3code-server` or `t3code-desktop` service, then narrow by span name or
+   attributes.
 
 Good first searches:
 
-- service name such as `t3-local`, `t3-dev`, or `t3-desktop`
+- service name `t3code-server` or `t3code-desktop`, plus a resource attribute such as
+  `deployment.environment.name`
 - span names like `sendTurn` or a Git operation such as `GitVcsDriver.statusDetails.status`
 - Git spans whose `git.operation` attribute identifies the operation
 - orchestration spans with attributes like `orchestration.command_type`
@@ -525,10 +525,10 @@ It provides:
 The desktop main process is a second producer, assembled in
 `apps/desktop/src/app/DesktopObservability.ts`. It reads the same `T3CODE_OTLP_*` names and the same
 Settings entries as the backend it supervises, and covers work the backend cannot see: app startup,
-window and menu handling, backend supervision, and updates. It reports as service `desktop`
-regardless of `T3CODE_OTLP_SERVICE_NAME`, so a collector shows it alongside the backend rather than
-mixed into it. It exports traces and logs only; the main process records no metrics, so the metrics
-endpoint applies to the backend alone.
+window and menu handling, backend supervision, and updates. It reports as service
+`t3code-desktop`, so a collector shows it alongside the backend rather than mixed into it. It
+exports traces and logs only; the main process records no metrics, so the metrics endpoint applies
+to the backend alone.
 
 ### Env Vars
 
@@ -547,7 +547,6 @@ OTLP export:
 - `T3CODE_OTLP_METRICS_URL`: OTLP metric endpoint
 - `T3CODE_OTLP_LOGS_URL`: OTLP log endpoint
 - `T3CODE_OTLP_EXPORT_INTERVAL_MS`: export interval, default `10000`
-- `T3CODE_OTLP_SERVICE_NAME`: service name, default `t3-server`
 - `T3CODE_OTLP_HEADERS`: extra headers for all three exporters, same format as
   `OTEL_EXPORTER_OTLP_HEADERS`: comma-separated `key=value` pairs with percent-encoded values.
 - `T3CODE_OTLP_PROTOCOL`: `http/json` (default) or `http/protobuf`
@@ -565,6 +564,11 @@ an `http` or `https` URL, a protocol other than `http/protobuf` or `http/json` s
 headers that are not `key=value` pairs with percent-encoded values turn that signal's export off
 with a startup warning, rather than sending it to the Settings endpoint.
 
+Service names are fixed: `t3code-server` for the backend and `t3code-desktop` for the desktop main
+process, both in `service.namespace` `t3code`. `OTEL_SERVICE_NAME` and a `service.name` or
+`service.namespace` in `OTEL_RESOURCE_ATTRIBUTES` are ignored. Tell installations apart with other
+resource attributes, such as `OTEL_RESOURCE_ATTRIBUTES=deployment.environment.name=development`.
+
 If the OTLP URLs are unset, local tracing still works, metrics stay in-process only, and logs stay
 on stdout only.
 
diff --git a/infra/relay/src/observability.test.ts b/infra/relay/src/observability.test.ts
index 3958b28b95dd..d77c01277f1c 100644
--- a/infra/relay/src/observability.test.ts
+++ b/infra/relay/src/observability.test.ts
@@ -62,6 +62,11 @@ it.effect("exports schema error fields as span attributes", () =>
 
     const request = yield* Deferred.await(exportedRequest).pipe(Effect.timeout("1 second"));
     const payload = (yield* decodeJson(request.body)) as OtlpTracer.TraceData;
+    const resourceAttributes = Object.fromEntries(
+      payload.resourceSpans
+        .flatMap((resourceSpan) => resourceSpan.resource.attributes)
+        .map((attribute) => [attribute.key, otlpAttributeValue(attribute.value)]),
+    );
     const span = payload.resourceSpans
       .flatMap((resourceSpan) => resourceSpan.scopeSpans)
       .flatMap((scopeSpan) => scopeSpan.spans)
@@ -75,6 +80,10 @@ it.effect("exports schema error fields as span attributes", () =>
 
     expect(request.authorization).toBe("Bearer test-token");
     expect(request.dataset).toBe("relay-test-traces");
+    expect(resourceAttributes).toMatchObject({
+      "service.name": "t3code-relay",
+      "service.namespace": "t3code",
+    });
     expect(attributes).toMatchObject({
       "error.type": "EnvironmentConnectNotAuthorized",
       "error.environmentId": "environment-1",
diff --git a/infra/relay/src/observability.ts b/infra/relay/src/observability.ts
index ca091d8cce6b..2325d7e0432a 100644
--- a/infra/relay/src/observability.ts
+++ b/infra/relay/src/observability.ts
@@ -222,8 +222,9 @@ export const makeRelayTraceLayer = (input: {
     OtlpTracer.make({
       url: input.tracesEndpoint,
       resource: {
-        serviceName: "t3-code-relay-worker",
+        serviceName: "t3code-relay",
         attributes: {
+          "service.namespace": "t3code",
           "service.runtime": "cloudflare-worker",
           "service.component": "relay",
         },
diff --git a/packages/shared/src/relayTracing.test.ts b/packages/shared/src/relayTracing.test.ts
index 3bb7f1ea1ac2..f96dfea8bb3b 100644
--- a/packages/shared/src/relayTracing.test.ts
+++ b/packages/shared/src/relayTracing.test.ts
@@ -97,6 +97,8 @@ describe("withRelayClientTracing", () => {
           const payload = new TextDecoder().decode(fetchFn.mock.calls[0]?.[1]?.body as Uint8Array);
           expect(payload).toContain("relay request failed");
           expect(payload).toContain("relay socket closed");
+          expect(payload).toContain('"key":"service.name","value":{"stringValue":"relay-test"}');
+          expect(payload).toContain('"key":"service.namespace","value":{"stringValue":"t3code"}');
         }),
       ),
     );
diff --git a/packages/shared/src/relayTracing.ts b/packages/shared/src/relayTracing.ts
index 907773bc15a5..76954558eb07 100644
--- a/packages/shared/src/relayTracing.ts
+++ b/packages/shared/src/relayTracing.ts
@@ -142,6 +142,7 @@ export function makeRelayClientTracingLayer(
       serviceName: resource.serviceName,
       serviceVersion: resource.serviceVersion,
       attributes: {
+        "service.namespace": "t3code",
         "service.runtime": resource.runtime,
         "service.component": resource.component ?? "relay-client",
         "t3.client.surface": resource.client,