## What changed
- Accept two-stroke bindings such as `ctrl-x ctrl-s` in TUI keymap configuration while preserving arrays as alternative bindings.
- Route chords through the active TUI context, show pending and configured chord hints, and cancel pending chords on `esc`, context changes, or a one-second timeout.
- Extend `/keymap` to capture, add, replace, and display key chords.
- Reject chords that conflict with active single-key bindings, overlapping-context chords, or reserved terminal shortcuts.
## Testing
- Add coverage for chord parsing, validation, matching, timeout and cancellation behavior, context dispatch, key capture, and rendered shortcut hints.
GitOrigin-RevId: dfdede03f518d4936ad8621ebf5537026f2b282e
## What changed
- Reattach recorded `executed_tool_calls` metadata when an output is included in a subsequent prompt.
- Bound retained metadata to 32 KiB, prioritizing recent calls and reporting omitted calls in truncation metadata.
- Drop retained entries after their corresponding outputs leave the prompt history.
## Testing
- Cover metadata replay, cleanup after compaction, bounded retained history, and propagation through later tool requests.
GitOrigin-RevId: 1c23a26123be3b7ad51c61f4ad522139b71bb773
## What changed
- Add the optional `delegationAckFiller` field to `thread/realtime/start`.
- Forward explicit `true` or `false` values to V3 Frameless Bidi session payloads as `delegation.ack_filler`; leave the field absent when unspecified so the Realtime API default is preserved.
- Document that V1 and V2 ignore this setting.
## Testing
- Cover both boolean values in Frameless Bidi serialization and verify the WebRTC V3 session creation payload.
GitOrigin-RevId: 9fe8efd14e42738c3e86e3e9a8af81d0f4521244
## What changed
- Run `git init` to mark command execution in the affected pre-tool hook tests.
- Keep marker repositories in per-test temporary directories and assert against
their `.git` directories.
- Check `git version` output when a code-mode hook rewrites a nested command.
GitOrigin-RevId: 71c54ef525b08e1d592f69c8b88eed1ee6403e4f
## Why
Clients need to know whether a `request_user_input` request must wait for an
explicit response or may auto-resolve. Using `autoResolutionMs` as that signal
conflated the blocking decision with timeout policy.
## What changed
- Add required `isBlocking` fields to user input protocol and app-server
request payloads. Plan-mode requests are blocking, while requests from other
enabled modes are non-blocking.
- Drive the TUI's auto-resolution behavior from `isBlocking` and remove
`autoResolutionMs` from the model-facing tool schema.
- Deprecate `autoResolutionMs` while retaining it for compatibility, and treat
legacy payloads without `isBlocking` as blocking.
## Testing
- Cover mode-derived blocking behavior, legacy deserialization, app-server
forwarding, delegated requests, and TUI auto-resolution.
GitOrigin-RevId: 29aade657ef743065ec264376ba567a9b353d7d7
## What changed
- Add optional `realtimeStartInstructions` and `realtimeEndInstructions` fields to `thread/realtime/start`.
- Apply the instructions when Codex enters and leaves realtime mode, while preserving the existing defaults when either field is omitted.
- Limit each field to 8,192 estimated tokens.
## Testing
- Cover custom entry and exit instructions across realtime state transitions.
- Cover token-limit validation for both fields.
GitOrigin-RevId: b9cfa1ff22e084d8a6b2ed56bd27d95ffdd6b6bd
## Why
Legacy thread histories did not use the cross-process writer ownership guard already applied to paginated histories.
## What changed
- Acquire and retain a writer lock whenever a legacy or paginated thread is created or resumed.
- Apply the same ownership checks when archiving or deleting either history mode.
- Release ownership when initialization fails or the active thread shuts down, allowing another process to resume it.
## Testing
- Cover competing create and resume operations for both history modes.
- Cover archive and deletion conflicts for legacy and paginated descendants.
GitOrigin-RevId: 1be79b01966ad2634ed79eb96c0aa0db8eafe2fa
## What changed
- Record the effective detail setting and source and prepared dimensions for
successfully decoded images.
- Associate message images with their role and tool-output images with their
originating call ID.
- Include the collected image preparation metadata in the corresponding turn
analytics event.
## Testing
- Cover image resize metadata, tool-output attribution, turn aggregation, event
serialization, and app-server analytics output.
GitOrigin-RevId: dbfb5ba1ce7cb02dd93d9b579c5109817f16aef5
## What changed
- Add `CodexThread::submit_user_input_and_wait_for_admission` and export the
`UserMessageAdmission` result through `codex-core-api`.
- Resolve submissions only after they start a new turn or steer the active
turn, returning the accepting turn ID in either case.
- Return errors for invalid operations, rejected thread settings, and session
termination instead of leaving admission waiters unresolved.
## Testing
Add integration coverage for concurrent start-and-steer submissions, settings
rejection and recovery, non-user operations, and submission after shutdown.
GitOrigin-RevId: 21f1ede38d399baa9836d61a59b9f9af2dbf83b8
## Why
`ToolExecutor::exposure()` describes a tool's preferred exposure, while the host
may apply step-specific policy when building a tool plan.
## What changed
- Store each runtime together with its effective exposure in `ToolRegistry`.
- Apply MCP, namespace, and collaboration-tool exposure overrides directly to
registry entries instead of wrapping runtimes.
- Use the registry-owned exposure when building model-visible specs, deferred
tool search, code-mode executors, and parallel-call support.
## Testing
- Cover that a hidden MCP tool remains routable but is not eligible for parallel
tool calls.
GitOrigin-RevId: 1bc2760add8d993f477954269fa13681bfcc2444
## What changed
- Recognize the `codex_strict_auto_review` MCP elicitation marker and route
marked approval requests through the configured automatic reviewer.
- Accept only canonical automatic-review approvals and fail closed without a
user prompt when review is unavailable, denied, malformed, disallowed by
policy, or requests persistence.
- Validate Codex Apps approval metadata against the active MCP invocation and
build the review request from the trusted invocation details.
## Testing
- Add unit coverage for strict review decisions, malformed markers, reviewer
failures, explicit policy denials, and lifecycle cleanup.
- Add app-server round-trip coverage for approvals, denials, configuration
constraints, spoofed metadata, persistent requests, and subsequent turns.
GitOrigin-RevId: af73b45a9b63118f25f6429d95b3222c5dbb59fb
## What changed
- Make the skills extension own the catalog prompt templates and rendering path.
- Remove the duplicate core fallback that injected available skills into initial context.
- Update core integration tests to install the skills extension explicitly when they expect model-visible skill context.
GitOrigin-RevId: bbe6b15c4e776a09c98b7f4166426fe4e58434ba
## What changed
- Read the frozen MCP tool catalog directly from the step-scoped `McpBinding`
when building tool routers, plugin injections, and connector state.
- Remove the redundant `Vec<ToolInfo>` from `StepContext` and stop returning a
duplicate catalog from `built_tools`.
GitOrigin-RevId: d12d694e1224da3f6ccb1960868491f0d80c6e19
## What changed
- Route skill dependency updates through the shared `codex-core` `ConfigEditsBuilder`.
- Remove the duplicate MCP config writer and its tests from `codex-config`, while retaining MCP config loading there.
GitOrigin-RevId: cdce84c8353514529126156750433e859b78be3b
## Why
Tool calls can outlive the sampling request that advertised them, so execution
must retain the finalized tool plan for that specific step.
## What changed
- Resolve tool runtimes, parallelism, cancellation behavior, argument diff
consumers, and dispatch from the `ToolRouter` stored in `StepContext`.
- Remove the separate router parameter from `ToolCallRuntime` and code-mode
worker construction so callers cannot supply a different router.
- Add a test helper for installing a router into a test `StepContext`.
GitOrigin-RevId: 9e476ddd228ca5b1c03ed87863618ba77de6200c
## Why
Threads can configure the same MCP server name with different runtimes. Tool calls
must use the runtime associated with the thread that issued the call.
## What changed
- Route MCP readiness checks and call preparation through the invoking session.
- Add regression coverage that alternates calls between two threads and verifies
that each thread continues using its own MCP server process and configuration.
GitOrigin-RevId: 5735f7b29a579f545351385ab01a575e35ead01e
## What changed
- Replace `SessionTaskContext` with `Arc<Session>` in the session task run and abort interfaces.
- Read extension data from `TurnContext` during regular turns instead of storing and forwarding a duplicate reference through the running task.
GitOrigin-RevId: 04bc0d324e5ba781f35ac9c61e811888208b74ae
## What changed
- Add optional `default` and `plan` collaboration-mode messages to model catalog metadata.
- Prefer the active mode's catalog message, including an explicit empty value, while falling back to the existing developer instructions when the catalog variant is absent.
- Track the model in collaboration-mode world state so mode and model changes append the appropriate instructions, and clear prior instructions when no current message exists.
- Preserve catalog collaboration messages when instruction overrides remove other model instruction fields.
## Testing
- Cover catalog deserialization, variant selection, fallback and empty-message behavior, legacy snapshot migration, mode changes, and model changes.
GitOrigin-RevId: d4c6c0028423bc50b0e8175e55586f3e7bc1c3a8
## What changed
Reject `shell_command` and unified `exec_command` calls that provide a
`justification` without also specifying `sandbox_permissions`. The
model-visible error tells callers to explicitly request `require_escalated`
execution or omit the justification.
## Testing
- Add unit coverage for `shell_command` argument validation.
- Add integration coverage for both shell tool paths, including verification
that rejected unified exec calls do not begin execution.
GitOrigin-RevId: 6af39d2c889af492440615eae12085b99a8b5169
## What changed
- Register the legacy `shell_command` handler only when exactly one local environment is available, including when unified exec keeps it hidden for compatibility.
- Reserve the unnamespaced `shell_command` name so external tools cannot claim it when the built-in handler is unavailable. Namespaced tools with that name remain supported.
## Testing
- Cover remote and multiple-environment tool plans, unified exec routing, and external tool registration for reserved and namespaced variants.
GitOrigin-RevId: 93834539b31ac8a7fea072bfa4de792bcc3e053b
## Why
Host skill path aliases should follow the core skill loader's root discovery
order, independent of how catalog entries are sorted for rendering.
## What changed
- Propagate each host skill root's discovery position into its catalog entries.
- Assign `r0`, `r1`, and subsequent aliases from that position while leaving
entries without an explicit root order last.
## Testing
Added coverage for alias ordering in extension rendering and across consecutive
production turns.
GitOrigin-RevId: 9085a3843c91bf2ce78a378cf5ce4926e9c38eb8
## Why
MCP servers running in an executor must not reuse host-owned OAuth credentials,
even when they have the same configured server name and URL.
## What changed
- Derive environment-scoped credential names for executor-owned MCP servers and
use them consistently for login, logout, authentication, and connection setup.
- Mark executor-owned entries in the file credential store and fail closed when
loading or saving an entry could cross the host/executor boundary.
- Preserve compatibility with existing local OAuth credentials, including local
server names that overlap the new reserved prefixes.
## Testing
- Extend the executor MCP integration test to verify that executor requests use
the executor token, never send the host token, and persist both credentials
separately.
GitOrigin-RevId: 4fc92d0533b0fe2e0df34f6d47b81e3d20d07807
## What changed
- Load and cache the host skill provider catalog during world-state contribution.
- Render host skill listings from that catalog with Core-compatible budgeting, while preserving Core's full prompt injection for selected host skills.
- Reuse the cached host catalog for shadow selection, including when skill listings are disabled.
- Preserve an empty Core-compatible skills fragment when every entry exceeds the metadata budget, and make budget warnings independent of the configured percentage.
## Testing
- Cover provider-backed host listings, selected-skill prompt injection, shadow selection, disabled listings, oversized prompts, empty fragments, metrics, and warnings.
GitOrigin-RevId: b6b2d8ea14386356094cff5783d121d74657e9e3
## What changed
- Move the V8 implementation into a dedicated `codex-code-mode-runtime` crate used by `codex-code-mode-host`, removing the embedded runtime fallback from the Codex process.
- Resolve the host executable from the active installation layout and check its availability before selecting tools.
- Fall back to direct tools with a one-time warning when optional code mode is unavailable. Keep `code_mode_only` and `disable_in_process_fallback` configurations fail-closed.
## Testing
- Cover host discovery for standalone and package layouts, including missing hosts and symlinks.
- Verify direct-tool fallback, one-time warnings, and fail-closed code-mode-only behavior.
GitOrigin-RevId: 5aa3c6f1db148b2231fc24089a2ee0e2b00dbddb
## Why
Filesystem denials and managed-network blocks did not share a structured event
shape, requiring downstream consumers to rediscover enforcement paths and parse
backend-specific output. See https://github.com/openai/codex/pull/17573.
## What changed
- Add normalized filesystem and network violation types in `codex-sandboxing`
and emit them through a shared tracing seam.
- Classify filesystem denials by backend and reason, retaining an optional path
and bounded output snippet, and preserve managed-network block context.
- Report the sandbox type through exec-server responses so unified exec can
classify remote denials without guessing; omitted values remain compatible
with older peers.
- Record violations from exec, apply-patch, shell-escalation, unified-exec, and
managed-network enforcement paths without changing denial behavior.
## Testing
- Cover filesystem classification, path extraction, `SIGSYS`, network event
conversion, protocol compatibility, and remote sandbox-type propagation.
GitOrigin-RevId: d673173b4fa6bdf0a24421194a8a61c81fab9c96
## Why
Removing each decoded prefix from a `Vec` shifts all remaining bytes. Repeating
that work is costly for streams containing many invalid UTF-8 bytes or many
framed messages in one relay record.
## What changed
- Buffer unified exec output in a `VecDeque` and use UTF-8 error offsets to
consume the largest valid prefix while continuing to make progress on invalid
input.
- Buffer Noise relay messages in `BytesMut` and advance past decoded frames
without moving the remaining bytes.
## Testing
Added regression coverage for valid data surrounding invalid UTF-8, front
consumption without shifting, and reassembling many JSON-RPC messages from one
record.
GitOrigin-RevId: 661ccfffc68960ac6c9d37c738224da8ea83cbf0
## Why
The `<current_date>` in environment context could diverge from the clock used by current-time features, especially when a host provides an external clock.
## What changed
- Read the current time from the session's time provider whenever world state is built, and render its local date in environment context.
- Use each session's own thread ID for clock reads, including guardian sessions.
- Propagate clock-read failures through turn error events and stop before model inference.
## Testing
- Cover date updates across turns and app-server requests.
- Verify guardian clock reads use the corresponding root or guardian thread ID and do not run during prewarm.
- Verify clock failures emit an error without sending an inference request.
GitOrigin-RevId: bb7f32ccc0229b7bc6f14d7356db00bcce78066d
## What changed
- Pass the canonical `PermissionProfile` through execution requests, sandbox
selection, escalation, and the exec server instead of carrying separate
derived filesystem and network policies.
- Derive runtime sandbox policies from the effective profile at their points of
use, including after applying additional permissions.
- Update sandbox and escalation tests to inspect policies through the profile.
GitOrigin-RevId: 695b82ea94f5289516b0933bb23074cb2dcce8ac
## What changed
- Add the opt-in `executed_tool_call_metadata` feature to record model-attempted direct and code-mode tool calls.
- Attach recorded names and arguments to the matching tool output in the next Responses request, preserving the metadata across sampling retries.
- Bound pending calls and argument sizes, and emit truncation metadata when limits are exceeded.
## Testing
- Cover disabled-by-default behavior, namespaced and nested calls, blocked or failed attempts, retry handling, and recorder limits.
GitOrigin-RevId: 5ce917b73e797b0f6904d46477b9d2cf8ea71bf2
## What changed
Add integration coverage for managed network requests that verifies:
- Guardian allow and deny decisions apply only to the triggering request.
- A decision for a remote environment does not carry over to a local one.
- A user-granted remote session approval remains active after Guardian-reviewed requests.
- Guardian assessments receive the exact network action and execution environment for each request.
GitOrigin-RevId: 6701074c6d60b9f28a6d47ebaf910bb1e9f2fa07
## What changed
Add integration coverage for `apply_patch` with unified exec workspace roots. The test verifies that a normal file can be added while writes under existing `.git`, `.agents`, and `.codex` directories are rejected and do not create files.
GitOrigin-RevId: 21ad5ce7fb06e7c47b4086c1439f12d52d9235de
## What changed
Return telemetry tags directly from `CoreToolRuntime::telemetry_tags` instead of
wrapping them in a future, and update the MCP runtime and tool registry call site
accordingly.
GitOrigin-RevId: 54e03972fe23c0e644c68c73af504dba0871be8e
## What changed
- Force an online model-catalog refresh and verify that the mock server receives it.
- Allow the catalog mock to handle repeated requests.
- Bound the catalog refresh and session shutdown with timeouts, and explicitly wait for shutdown before completing the test.
GitOrigin-RevId: 503b52fd296928757b982abc053c74ed36700ff0
## What changed
- Replace fixed delays with explicit signals that pause the sideband connection after its HTTP handshake request begins.
- Release the handshake after closing the realtime conversation and verify that the connection ends before the handshake completes.
- Shut down the test session while rejecting stale realtime errors or duplicate close events from the canceled sideband task.
GitOrigin-RevId: 37072842b973fff41ec47235ceb9cfe3cf1a5a37
## What changed
- Seed approval scenarios with the bundled model catalog so their model metadata is deterministic.
- Make the patch approval helper surface unexpected exec approvals, errors, aborts, and shutdowns immediately instead of waiting for its timeout.
GitOrigin-RevId: b5ec88494ecaf571a480b4142300eb5f3f98def9
## What changed
Update the code mode yield and termination integration test to generate a
bounded output backlog, then wait on a file-backed gate until the session is
terminated. Remove the timeout that previously guarded submission of the
infinite-loop workload.
GitOrigin-RevId: dd48307f18ab12bfbf02dc26b0f3715f073402a7
## What changed
- Run the strict auto-review enabled and disabled scenarios as separate test cases on a two-thread Tokio runtime.
- Explicitly shut down each Codex instance after verifying that the approved folder grant allows the later `apply_patch` call.
GitOrigin-RevId: cbbf47d834c4a9adcf181b97b8aa72b5f0a513e2
## What changed
Build the `apply_patch` filesystem sandbox context from the executor's canonical permission profile instead of the execution attempt's materialized profile. Continue merging any additional permissions requested by the patch while keeping workspace roots scoped separately to the attempt.
## Testing
- Update the sandbox-context test to verify that executor `workspace-write` permissions are preserved when attempt workspace roots and additional file permissions are present.
GitOrigin-RevId: 2a9a8c2e1b1945e300283c400d0f1e573225a553
## What changed
- Track the first registered tool for each normalized code-mode identifier and use that tool consistently for dispatch metadata and model-facing code-mode declarations.
- Skip duplicate normalized names when building the code-mode executor while preserving shadowed tools in the registry and direct tool exposure where applicable.
- Cover collisions across dynamic and namespaced tools, direct and deferred exposure, code-mode-only operation, and Responses Lite metadata.
GitOrigin-RevId: a4acb57ce44e7de1398981b22af4b87e2a35870f
## What changed
- Retain bounded, non-completion agent messages in remote v2 compaction history so delegated tasks remain available on follow-up turns.
- Account for encrypted agent-message content when estimating token usage and place restored initial context before the latest real user or agent message.
- Exclude child completion messages from retained follow-up history and strip inherited parent agent messages when forking a child.
## Testing
- Extend compaction, history-estimation, and agent-fork tests to cover encrypted delegated tasks, child completions, context ordering, and fork sanitization.
GitOrigin-RevId: ba4392e9cfdf4ecbcdc9c7d8581d58a8d2d78260
## Why
External MCP, extension, and dynamic tools can collide with host-owned tool
names. In particular, a dynamic `tool_search` definition must not replace the
host implementation used to discover and route deferred tools.
## What changed
- Build each turn's tools through a single ordered `ToolRegistry` that retains
the first runtime registered for a name.
- Treat duplicate external tools as skippable collisions while preserving
strict duplicate checks for trusted host tools.
- Reserve host-owned code-mode and `tool_search` runtimes before producing the
model-visible tool list.
- Base hosted web-search fallback behavior on the extension runtime that
actually won registration.
## Testing
- Cover ordered registry mutation and duplicate handling.
- Verify a client-provided `tool_search` cannot shadow the host tool.
- Verify hosted web-search fallback follows the registered browser runtime.
GitOrigin-RevId: acebe360de8ec69ad7da2f684cc2542cbf18a984
## Why
Executor capability discovery can traverse plugin and skill roots, including
symlinks. Under restricted filesystem permissions, discovery must not expose
files outside the permitted paths.
## What changed
- Pass each environment's filesystem sandbox context through capability root
discovery and apply it to metadata, directory walks, and file reads.
- Enable discovery for restricted sessions so permitted executor skills remain
available while inaccessible roots and symlink targets are omitted.
- Key discovery caches by sandbox context and reject sandboxed discovery on
executors that do not advertise support for it.
- Split requests with more than 128 roots into supported-size batches.
## Testing
- Cover permitted and denied external symlink targets.
- Verify restricted skill listing excludes inaccessible skills.
- Verify cache separation across permission contexts and discovery of 129 roots.
GitOrigin-RevId: 44d16468ca003403bdb8b71a04ae8c9ff94ed494
## Why
Executor-backed skill resources must honor the active filesystem permission profile instead of reading outside its allowed roots.
## What changed
- Propagate each environment's filesystem sandbox context into `skills.read` calls.
- Apply turn-scoped permission grants when reading executor skill resources.
- Fail closed when no matching sandbox context exists or a restricted Windows read cannot be sandboxed.
- Preserve the existing resource size limit for both sandboxed and streamed reads.
## Testing
- Cover reads within permitted roots and reads that succeed after a permission grant.
- Verify denied references do not expose their contents and disabled Windows sandboxing is rejected.
GitOrigin-RevId: 5cc679b9385b0621665ff20cf5848863cc6396a4
## What changed
- Add an optional `wait_until_ready` hook to `CoreToolRuntime` and invoke it
before acquiring the tool execution gate.
- Move MCP refresh and server-startup waiting into the MCP runtime's hook.
- Forward readiness waits through tool exposure and namespace wrappers.
- Test exact runtime selection for plain and namespaced tools, including
exposure overrides and missing tools.
GitOrigin-RevId: 8718589fa06f14d053a35a288186613f649d25ff
## What changed
- Split core tool planning from the assembly of MCP, extension, and dynamic tool runtimes.
- Build `ToolRouter` from a single ordered runtime list plus hosted tool specs.
- Centralize whether each `ToolExposure` variant is available in code mode.
- Preserve core, MCP, extension, and dynamic source ordering and existing name-collision priority.
## Testing
- Add coverage for unified source ordering and collisions, code-mode exposure, and standalone web search alongside MCP and dynamic `web.run` tools.
GitOrigin-RevId: b010c2e9728b92b75a35325ca9b2ec465c3bac12
## Why
`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.
## What changed
- Use `http` header and status types directly in core code and tests.
- Build the MCP test readiness client through `HttpClientBuilder`.
- Remove `reqwest` from `codex-core` and its temporary dependency-policy
exception.
GitOrigin-RevId: 8d5c7c86256294a7bb8aa1ae10cc5bea4cb1fc56
## What changed
- Propagate MCP tool `readOnlyHint` annotations through tool-call start and
completion events.
- Include the optional hint in persisted thread history and app-server
`mcpToolCall` items, preserving compatibility when the annotation is absent.
- Document that the hint describes tool capability, not the outcome of a
particular invocation.
## Testing
- Cover read-only and write-capable tools in live events and persisted rollout
data.
- Verify the hint survives thread reads and resumes for both in-progress and
completed MCP calls.
GitOrigin-RevId: dddfe905146075e5137a1094da485b86b99807f0
## Why
MCP catalog discovery must not allow a server to keep pagination running or
growing without bounds.
## What changed
- Apply the shared pagination collector to tool, resource, and resource-template
discovery.
- Limit each catalog to 100 pages and 1,024 items, and reject pagination cursors
larger than 64 KiB or any repeated cursor.
- Bound the entire pagination operation by the configured tool timeout, falling
back to 30 seconds when no timeout is configured.
## Testing
Add unit coverage for every limit and an end-to-end MCP test that preserves
valid multi-page tools while excluding a server that returns an oversized
cursor.
GitOrigin-RevId: 961a1bfa5fe8a265daf56e342a919c980cd720fa
## Why
A failed network policy amendment must not grant access to the requested host or approve it for the rest of the session.
## What changed
- Only approve the host for the session after the allow amendment is applied successfully.
- Otherwise deny the pending request and record a policy-denial outcome for its owning call.
## Testing
Added a managed-network regression test that submits an invalid allow amendment, verifies that the request is blocked, and confirms that retrying the host prompts for approval again.
GitOrigin-RevId: b2014d19128133abd5e19b8a7e4eb27810a45306
## What changed
- Add `thread/section/move` to atomically move a thread into, within, or out of a section. Threads can be inserted before an existing member or appended, and moves within a section preserve `sectionEnteredAt`.
- Add `section_position` sorting to `thread/list`, with ascending order as its default, and expose `sectionEnteredAt` in thread responses.
- Persist section positions and entry times in SQLite, including migration of existing section members into recency order. Section membership is no longer updated through `thread/metadata/update`.
## Testing
- Cover section moves, reordering, pagination, persistence across restarts and rollout reconciliation, concurrent updates, and rank renumbering.
GitOrigin-RevId: aec6d7ddedca5277029b5caf5c074975397e956c
Felipe Coury