chore(coil): merge upstream/main d1d15c67f4 (867 commits)

[radroid]

Fixes #135.

The daily sync failed ten days running on the same conflict set, and the range grew to 867 upstream commits (2026-09-02 → 2026-09-12). This merges upstream/main at d1d15c67f4 into main as one merge commit, followed by eight ordinary commits that repair what the merge could not see.

What was resolved by hand (26 files)

All 26 conflicts were the fork's known seams. Notable resolutions:

• Generated files regenerated, never merged: pnpm-lock.yaml re-resolved from the fork's pre-sync lock (security sweep verified intact: sharp 0.35.3, nanoid 3.3.17, tar 7.5.22, undici 6.28.0); routeTree.gen.ts from the TanStack generator (+21/-0, exactly the loops route).
• Docs: upstream rewrote install.md, providers-claude.md, source-control.md in product voice. Took upstream's structure and carried only the fork's distinct facts (coil install banner, "leave the Claude config dir empty", clone-credential notes).
• Android composer editor: upstream's new chip-deletion onKeyDown/onCreateInputConnection overrides are hand-combined with the fork's Enter-to-submit interception. Both behaviours survive.
• Mobile send label: the fork's resolveComposerSendLabel mirror is retired; upstream's inline ternary gained a third condition, and the helper's own docstring said it only mirrored that ternary.
• __root.tsx: the fork's NotificationCoordinator, ThreadOutboxDrain, PushSubscriptionManager, CoilUpdateToast sit inside upstream's new FirstRunGate, alongside upstream's own coordinators.

What the merge could not see (fixed in follow-up commits)

Three read-only review agents walked every seam and every fork import against the range. Findings that broke behaviour without a textual conflict:

1. Rate-limit detection went dark. Upstream feat(usage): show Codex and Claude subscription limits on a Limits tab pingdotgg/t3code#9507 normalised account.rate-limits.updated into status-less utilisation windows and drops the event when the SDK omits utilization. Auto-resume and the loop supervisor classified the raw SDKRateLimitInfo from it. Both taps now read the runtime.warning the adapter raises for a rejected window (its detail is the raw info). The captured-episode fixture stays verbatim; the replay harness converts it on the way in, and the real-adapter replay test asserts the new route.
2. Crash recovery clobbered restart continuations. Upstream feat(updates): continue active threads across server restarts pingdotgg/t3code#9167/fix(server): recover opted-in threads after machine restarts pingdotgg/t3code#9803/fix(server): keep interrupted threads resumable after restarts pingdotgg/t3code#10421 continue opted-in threads across restarts by marking the session starting and parking a resume. The fork's reconciler matched starting and settled that turn to interrupted one phase later. It now skips starting, with a test seeding that shape.
3. Queued messages lost their context. Upstream feat: add inline file previews and attachment chips across surfaces pingdotgg/t3code#11265 moved composer contexts to inline references plus a structured context record and deleted the append*ToPrompt helpers the queue path used. The queue now carries buildMessageContext(...) and the drain sends or legacy-serialises it by server capability, exactly as the immediate send and the mobile outbox do.
4. Toolchain: Effect rc.112 renamed Schema.TaggedErrorClass → Schema.TaggedError (nine fork-only sites); TypeScript 7 retired the tsgo binary (relay typecheck script); apps/coil-home pinned to TS 6 like upstream's apps/marketing.
5. CI: upstream fix(web): add project settings to legacy sidebar project menu pingdotgg/t3code#10021's libsecret helper hard-fails Linux tests and the desktop build without libsecret-1-dev pkg-config; the three coil workflows on ubuntu-latest now install them. The Windows release installed a Spectre component id upstream found to be a silent no-op; mirrored upstream's block with the exit-code check.
6. Web push ignores upstream's new per-minute pull-request sync events, which never change whether a thread needs the user.

Verification (local, Apple Silicon)

• vp run typecheck: green (all 17 packages).
• vp run lint: green (warnings only, all upstream-owned).
• Per-package vp test run --testTimeout=120000 --hookTimeout=120000: contracts 409, shared 801, client-runtime 1413, relay 44, mobile 1491, desktop 1436, web 5092 all pass. Server: see the check below.
• scripts: 389/390; the one failure (build-desktop-artifact.test.ts cross-arch Windows) fails identically on pristine upstream files on an arm64 host, as recorded at the last sync.

After landing

• gh workflow disable cursor-hygiene-webhook.yml (arrives active; it would forward issue/PR payloads to Cursor once its secrets exist). desktop-macos-preview.yml was disabled today; setup-fork.sh's list now names every inherited workflow.
• Close [coil-sync] daily sync needs attention (conflict) #135.

Deferred (design decisions, not sync fixes)

• Upstream's PullRequestSyncReactor bumps thread.updatedAt every minute for a linked review with moving checks; the loop supervisor reads updatedAt as movement, so a loop on a PR-linked thread with running CI may never strike.
• The web outbox's retry classifier is the pre-fix(mobile): keep pending tasks queued when a send fails in flight pingdotgg/t3code#10245 message-matching version of mobile's; a socket drop mid-request discards the queued message instead of retrying.
• Whether the fork's CrashRecoveryReconciler is still needed at all now that upstream's provider-session reconcile covers every case but latestTurn.state === "running" && session === null.
• The SDK bump (0.3.170 → 0.3.260) may make Claude Code hold and self-resume a rate-limited turn; if so, auto-resume's progressing cancel at fire time should defer rather than cancel.

Land with a merge commit (never squash): gh pr merge <n> --merge --subject "chore(coil): merge upstream/main d1d15c67f4 (867 commits)".

Claude Fable 5.1 via Claude Code.

🤖 Generated with Claude Code