Reliability fixes and server decomposition, merged with main

[bradhallett]

What this PR does

This branch is a large reliability + maintainability batch on top of current main, delivered as one merge commit. It has two halves.

1. Reliability fixes

• boxAgent fleets: materialize the Computer runner for custom fleets so box agents get a working computer context (a94ad66).
• Claude driver: feature-detect --autocompact and replay threads after a soul edit, fixing silent turn loss on --autocompact CLI flag floor (2.1.122) doesn't match what's actually shipped — flag isn't in 2.1.129 #1187 / A bot's updated soul doesn't reach an already-running provider session (partly fixed for Claude, missing for other drivers) #1346 (7f000d3).
• Local VM: fence claims by generation so a recycled VM cannot be mutated by a stale claimant (373c095).
• Browser daemon: recycle wedged session daemons and surface engine failures instead of hanging forever (ec54015).
• Cursor ACP: resolve fast variants deterministically (1c24d48).
• Pi driver: negotiate protocol v2 and reassemble chunked RPC frames (3ad0e64).
• Fleet usage: stop blocking the root agent on usage polls (2d9f243).
• Steer queue: bound each busy thread queue so 429/backpressure cannot grow unbounded (87dbb6a).
• Room handoffs: keep acceptance durable while coalescing settle writes, fixing lost acceptances from Performance audit: transcript re-render, Shiki bundling, room-handoff fsync, fleet agent blocking, boot scans #1189 (3b4783b).
• Loopback notify: add POST /api/notify for local scripts, the local slice of iOS/web companion: no background push notifications; add web push (VAPID) and a script-facing notify route #993 (5511746).
• Browser install route: require JSON content type, closing a malformed-request crash (ee6cbba).
• Test fixtures: pin the agent-browser path in isolated fixtures (1beb3d0) and keep the usage-chip click resilient to header re-renders (48a6eab).
• LAN pairing: accept plain-http pairing links on private LAN hosts, the local half of v0.1.80: no working way to connect a desktop client — every path is blocked (pair 403, HTTPS-only client, tunnel 502, no LAN option) #1283 (8edb864).
• CLI: drop BEL instead of padding provider labels (1907b56).
• Approvals: keep Full approval available for OpenAI-compatible engines, Full access is unavailable for openai-compat providers (DeepSeek/GLM/OpenRouter): every tool call becomes an Allow/Deny card, even at Full #1533 (5a15fd2).

2. Decomposition (no behavior change)

server/index.ts (17k+ lines) is decomposed into route modules, wiring modules, start-turn, store/, runtime, and the internal-routes family; store.tsx into model/reducer/overlays/stream-context; ComputerPanel, Sidebar, ChatView, GroupView, composer, RoutineCalendarPage and CursorAvatar into component module families; claude/codex/acp drivers into focused modules; Electron main.mjs into subsystem modules; MCP and agents-proxy tool switches into registries; shared attachment wire and server-endpoint resolvers deduplicated. Every step was verbatim-move + facade, with importer tests kept unchanged.

Merge with current main

The branch merges main (ec62fcf2) and completes the merge by porting the main-side features that the decomposition had orphaned:

• Incidents wiring: new server/incident-report.ts host, wired in engine-wiring.ts, with the four reportIncident call sites from main (could-not-start in start-turn/phases/dispatch.ts, failed in event-fold/turn-completion.ts, stalled in event-fold.ts, routine-failed in routine-wiring.ts).
• Teammate resolution: resolveTeammate name-or-id handling restored at the three internal routes (ask-bot, delegations, coordination) with self-check and dedup.
• Instance icons: PATCH /api/instances/:id/icon restored on top of the shared provider-icon helpers.
• Message attribution: messageSender moved to request-auth.ts; sender stamped on direct/queued starts and steered appends exactly where main stamps it, and rendered in room-context.ts.
• Delta-context handoffs: the production Handoffs singleton (new server/delta-handoffs.ts) with full turn-path integration — strict-resume context decisions in start-turn/phases/context.ts (decideContext, session-config hashing, unseen-message rendering), handoffs.begin/dispatching/bindTurn/abandon across the dispatch phases, onEvent in the event fold, steer recording on both steer paths, stoppedByPerson on interrupts, and forget on task delete and results-thread discard. markTaskContextExternallyUpdated keeps a hands-record session when the engine supports strict resume, and boot recovery counts a recovered queued message as handed so a resumed session offers it again.
• LLM thread titles: generateThreadTitle extracted to server/thread-titles.ts and wired at both title sites (direct turns in start-turn/phases/provider.ts, group turns in group-turn/start.ts), gated on llmThreadTitlesEnabled and never on peer-opened rows.
• Computer-wait text: bindTurnComputer uses the shared computer-wait.ts chip and give-up wording (holder as bot/task or room), replacing the stale inline strings.
• Generated-image file 403s: the message file route accepts generated-image attachments as durable capabilities (403s fixed), derives href from the rendered-image target on preview, and allows textless bot messages carrying image attachments.
• Instance icon projection: describeInstances projects the saved instance icon so the model picker round-trips it.
• Smaller ports: cache-control: private, no-store on team-computer screenshots, retry-thread.ts import fixes, and two merge-stray syntax errors removed (config/schema.ts, store/tasks.ts).
• Claude first-turn latency: the --autocompact CLI flag floor (2.1.122) doesn't match what's actually shipped — flag isn't in 2.1.129 #1187 --autocompact feature probe (claude --help, ~140ms) ran inline in the first fresh launch of a process, so a follow-up message sent moments after a turn started lost the steer-vs-launch race and was queued instead of steered; the probe is now warmed from the boot-time instance snapshot beside the --version read, and the paired-person steer attribution test passes 10/10 in isolation.
• Lazy computer attach (Auto turns serialize on the computer even when they never use screen tools (eager exclusive Local VM claim at dispatch) #1361): ported main's lazy claim semantics into the decomposed start-turn/phases/integrations.ts: a ready Local VM mounts without claiming (the first screen tools/call claims it through the computer-control gate), the VPS desktop no longer binds exclusively at setup, claimAutoLocalVm pins its target and unwinds lease + turn resource on every failure path (dropLease), and each lazy claim restarts the screen poller with the now-live computer capture. The poller handles (screenPollers, startScreenPoller, stopScreenPoller) are threaded through engine/workflow wiring into the start-turn cleanup deps so the restart path is live, not dormant.
• Instance CLI overrides: ported main's persistableInstanceConfigs config restoration, so saving another engine's CLI no longer freezes inherited url/model/provider defaults into the persisted fleet config.
• Routine cloud guidance: the missing-Box-key run reason is main's exact guidance sentence (run_on="maus" / self-hosted VPS) instead of a bare run-blocking error.
• delta-context determinism: the delegate_bot-source soul-edit e2e now waits for the wake turn's CLI launch before editing the soul. The launch record is written at process start, so the dispatch-time soul read is guaranteed done; without this the test raced on machines where the Local VM runtime probe slows turn setup (identical code and test on main — a Docker-equipped developer machine loses the race).
• Typecheck repair: tsc -p . only covered src/; the server tree is now checked via tsconfig.server.json (server + companion + enterprise), which is how the two syntax errors above were caught.

Verification

• tsc --noEmit -p tsconfig.server.json — clean
• tsc --noEmit -p tsconfig.json — clean
• pnpm lint (oxlint, deny-warnings) — clean
• Full vitest run suite — 7,482 passed / 46 skipped / 1 todo, 0 failed (586 files passed, 3 skipped). The six files that failed before this round (config, codex-device-auth, routine-cron e2e, delta-context e2e, group-local-vm e2e, vps-routing) are green, including the previously load-flaky codex-device-auth sign-out tests.

Not duplicated here

Still in flight in their own PRs and deliberately not rebased into this branch: #1558, #1559, #1560, #1561, #1562, #1563, #1564, #1523, #1521, #1552, #1526, #1120, #1520, #1518, #1507, #1286.

Deferred (need outside action)

• Android companion app has no FCM — scheduled routine/reminder notifications don't survive app being closed #963 FCM push and the web-push half of iOS/web companion: no background push notifications; add web push (VAPID) and a script-facing notify route #993 need credentials/infra.
• v0.1.80: no working way to connect a desktop client — every path is blocked (pair 403, HTTPS-only client, tunnel 502, no LAN option) #1283 public-tunnel deploy plus a security review of LAN --host pairing.