feat(server): add bounded thread content search

[juliusmarminge]

Problem

The existing thread search RPC is global, active-only, and cannot return stable anchors into the visible V2 timeline. MCP callers need project-scoped search without changing that established client wire behavior.

Change

Add an opt-in, bounded ProjectionSnapshotQuery.searchThreadContent path that searches durable titles plus visible user and assistant messages. The query:

• scopes every result to one project and an optional thread
• defaults to active threads with an explicit archived opt-in
• excludes deleted projects and threads, streaming output, rolled-back runs, cancelled queued messages, and inherited-only fork content
• treats V2 metadata as authoritative while retaining legacy-only threads
• bounds title and message fragments in SQL before decoding
• escapes literal %, _, and !, rejects NUL, and preserves valid Unicode and internal whitespace
• returns live offset pagination and real source identities when available

The existing searchThreads RPC and cache shape are unchanged.

Behavior

Results are deterministic within each live query page. Legacy hits keep nullable anchors instead of inventing V2 identifiers. V2 title, archive, and deletion state cannot be shadowed by stale legacy rows.

Validation

• vp test run apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.search.test.ts (3/3)
• real in-memory SQLite coverage for V2 and legacy metadata authority, archived/deleted scope, literal wildcard and whitespace matching, Unicode bounds, queued visibility, and pagination
• scoped t3, @t3tools/contracts, and @t3tools/shared typechecks
• targeted lint, format, and git diff --check

Dependency

Bottom of native stack #8785. Based on t3code/codex-turn-mapping at 415ed0f73b97f1655b6282492f81d0b2bba3a9cc. The dependent MCP tool is #8722.

Implemented by GPT-5.6-Sol via Codex in T3 Code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 518d8c0a-3725-4031-bd73-87965881274a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Effect service conventions review: one finding on the new service failure type.

^{Posted via Macroscope — Effect Service Conventions}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 298b869.

This comment will update automatically after the next completed run.

[macroscopeapp]

One convention finding: the new service failure still carries an unstructured message as its only attribute.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit 0d5b88c5b5c898c171adb3d74c2069c1e8f46a26. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a new production thread-content search capability with a substantial cross-generation SQL query, visibility rules, deduplication, pagination, and snippet processing. It is opt-in and well-tested without changing existing callers or product defaults, but the scope and runtime complexity warrant human review.

No code changes detected at 298b869. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Superseded as the active MCP proposal by #10561 in the rebuilt MCP stack, following the maintainer request to review thin service wrappers separately from service hardening.

This is not a full feature-parity replacement. This filters the global top results, so a project can underfill the requested limit. It is not exhaustive or paginated. Project-first SQL pagination and search-service correctness changes belong in a separate service PR.

Closing this mixed proposal without merging. The remote branch agents/mcp-thread-search/search and exact head 298b869dc63809571f15ec9f92eaf1740c7b53f7 are retained so the service changes can be extracted for separate review later.