[r4iju]

Why
desktop-v0.0.63 shipped from sync/upstream-rebase-20261014, which never merged. The next nightly built main, which was about 660 upstream commits older, and installed it as 0.0.64. That build didn't know migrations 59-64 or the granular auth scopes. Every session that 0.0.63 had stored failed to decode, so every bearer token got 401 invalid_credential, including the Temporal workers' token on the work laptop.

What changes

• Main moves to the rebase line. This branch starts from the 0.0.63 commit and records main as merged with -s ours. feat(server): optionally retry Codex capacity errors with backoff #47 and the mobile copy fix are already in the rebase. feat(server): disable PostHog telemetry by default #48 is cherry-picked. Main's Oct 8 sync merge had resolved two native background-connection fixes into its conflict resolution, so those are ported verbatim with their test. feat(server): agents can settle their own thread after the run ends #46 settle_after_run is dropped because upstream now defers settle on the calling thread until the turn ends.
• Builds only move forward along main. t3-alpha-build refuses a commit that isn't on origin/main or doesn't contain the latest desktop-v* tag. It also refuses an explicit version that isn't newer than that tag.
• Installs never go behind the database. The build stamps its last migration id into the signed app. t3-alpha-install refuses a build that knows fewer migrations than the Mac's statev2.sqlite. It also skips the automatic rollback when a failed build has already migrated the database.

How I verified it

• Replayed the guard against real history. It refuses the Oct 14 hand build and the Oct 15 nightly, and allows the next build from this branch.
• Checked the version rule: 0.0.65 and 0.1.0 pass, while 0.0.64 and 0.0.63 are refused after 0.0.64. Checked the migration id helper on a fixture database, a missing database, and studio's real one (64).
• vp test run apps/server/src/telemetry/AnalyticsService.test.ts: 6/6. apps/server typecheck is clean.
• The ported native files match main byte for byte. I didn't run the Robolectric test.
• After merge: build 0.0.65 from main, install it on the work laptop, check that the existing worker token still authenticates, and check that an old zip is refused.

Risk

• Merge with a merge commit, not a squash. Squashing drops the 0.0.63 commit from main's ancestry, and the guard would then refuse every build.
• Zips built before this change carry no migration stamp, so the installer refuses them.
• Upstream's deferred settle still settles if the user pins or unsettles the thread during that turn. feat(server): agents can settle their own thread after the run ends #46 cancelled in that case.
• A scheduled task prompt that calls settle_after_run must switch to settle.

🤖 Generated with Claude Code