fix: backport attachment reconnect and Claude shutdown recovery

[AIdoesmyjob]

Reconnects should retry failed attachment uploads, and shutting down a Claude session should give an interrupted turn time to preserve its transcript. This requested recovery batch is stacked on the usage/background batch.

Backports pingdotgg#10338 and pingdotgg#13999 from pingdotgg/t3code. The upstream recovery source diffs are preserved, including shared mobile attachment-queue behavior where applicable. Claude abort is awaited before closing the SDK session instead of closing immediately after signaling abort.

Validation: independent focused acceptance passed 233 tests across four files, with additional timeline/settings checks. Source review passed. Actual installed Claude conversation continuity passed during the controlled production restart as recorded below.

Combined-candidate acceptance at exact tip 2ee25b539546efcf2d8b27eeb39f6c45e5eb6677: pinned pnpm 11.10 frozen-lock install passed; all 15 root typecheck tasks passed locally and on Linux; changed TypeScript lint exited zero (warnings only); Linux targeted suites passed 969 tests; full Linux server tests passed 4,081 tests, with 10 skips limited to optional real-provider opt-in / Windows cases; full Linux web tests passed 3,910 tests. Web/server builds and clean-install package smoke passed: HTML, byte-exact served JavaScript, SQLite integrity with 47 migrations, authenticated isolated config/model catalog containing eight Skofo model entries with default gpt-6-astra, and real Codex CLI 0.159.2 protocol-schema compatibility. The checkout is clean. These are recorded acceptance results, not a claim of green GitHub CI.

Installable VM package: /home/monstrcow/.local/share/t3code-deploy/packages/t3-0.0.40-skofo.20260930.reliability1.tgz, SHA-256 045bc56c6be97dc4235d8b39ac12261e434ddb3bafb0db6eb49f8ee741938b56. All 14 direct runtime dependency versions match the frozen lockfile exactly.

Isolated browser acceptance: PASS. Rendered chat widths measured 768 / 1,152 / 1,504 px; the 390 px mobile layout had no horizontal overflow; composer draft and terminal state persisted; the eight-model Skofo catalog and default gpt-6-astra were verified without starting a provider turn. Lukas explicitly approved read-only verification through the existing authenticated production browser session; final production catalog verification passed. No production authentication bypass or permanent verification grant has been created.

Final production acceptance and publication: PASS. Deployed exact source 2ee25b539546efcf2d8b27eeb39f6c45e5eb6677, version 0.0.40-skofo.20260930.reliability1, using the immutable package/checksum above. Source was published by a normal fast-forward with no force, squash, rebase, or SHA rewriting; fork main is exactly the deployed HEAD. All six batch PRs #3–#8 were marked merged at 2026-10-01T17:44:16Z.

Production checks passed: byte-exact installed server/web assets, all 14 runtime dependency pins, Node 24, internal endpoint, public HTTP 302 authentication edge with HSTS, unchanged SQLite user version 0 and 47 migrations, no fatal service logs, stable PID / zero automatic restarts, and authenticated production catalog/UI. Two interrupted threads automatically resumed once in their original Claude conversations, made real progress, and consumed their recovery markers; no extra manual retry prompt was sent. The normal unconsumed five-minute startup grant was preserved and no permanent verification grant was minted. The temporary restart setting was removed with a fresh compare-and-swap and General Settings confirmed it off. Original control-group behavior, 30-second stop timeout, and on-failure restart policy were restored; the temporary drop-in is absent.

The live CLIs were independently updated outside this release lane: current Codex 0.159.3 and Claude 2.1.286 were freshly checked against the candidate, with Anthropic SDK 0.3.260. This release did not upgrade either CLI. The 52 approved abandoned preview/test roots were cleaned up without deleting data files. Earlier procedural systemd-exit/output-format/timestamp and tar-umask mistakes caused safe holds/fallbacks or automatic rollback, not an application regression; the strict guard was preserved. The final frozen V7 deployment exited zero. Final completed record 20261001T173847Z-maintenance-reliability1 has manifest SHA-256 ea2496a8854c1ade2c352a351979ee743da9375b0fb6181c0aa24efcb604b550 and references the completed checksummed original rollback snapshot. Current database contents were retained during the earlier automatic rollback.

This PR was initially reviewed as a scoped stacked batch against its preceding branch. Retargeting to main at release time allowed exact validated/deployed HEAD publication; it did not introduce an unvalidated merge tree. The test evidence above is local/VM acceptance, not a claim of green fork GitHub CI.

Model/harness: OpenAI Codex in Codex desktop; the exact model identifier is not exposed to this release session.