[2/5] feat(connection): persist environment activation

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.

[DominicVonk]

Problem

Saved environments are always treated as desired connections. Users can remove an environment, but they cannot temporarily disable it while preserving its endpoint, credentials, cached data, and identity.

Solution

Add persistent per-environment activation state to the shared connection runtime:

• extend the version-1 catalog document with a backward-compatible disabledEnvironmentIds default;
• add a platform ConnectionActivationStore implemented by web and mobile storage;
• initialize supervisors without connecting disabled environments;
• expose a serialized setEnabled runtime command;
• reconnect on enable and release the active session on disable;
• retain the catalog registration and environment-owned cached data;
• reconcile stale disabled IDs and remove activation state when an environment is deleted.

The supervisor remains the sole owner of desired state and connection lifecycle; UI clients only dispatch the typed activation command.

Review feedback addressed

• startup remains retryable when activation reconciliation fails;
• reconciled disabled IDs are refreshed in memory before supervisors start;
• enable/disable and removal are serialized by the per-environment lease;
• activation state is reset before deleting the durable registration;
• activation persistence failures carry accurate list, set, and reconcile operation labels;
• platform environments still start enabled when cleanup of a shadowed persisted registration fails.

User impact

An environment can be disabled and later re-enabled without pairing it again or losing its cached workspace data.

Stack

This PR is 2/5. Depends on 1/5, #5597.

Please review and merge the upstream PRs in order from 1 through 5. Because this repository does not have native stacked PRs enabled and cross-fork branches cannot be upstream base refs, the upstream diffs are cumulative. The corresponding fork PRs use the true dependent bases and provide the clean per-layer diffs.

Layer	Upstream PR	Clean stacked diff
1	#5597 — network-status recovery	fork #1
2	#5600 — persistent environment activation	fork #2
3	#5598 — environment-management UI	fork #3
4	#5596 — pasted pairing-link parsing	fork #4
5	#5599 — composer-pill activation	fork #5

Validation

Focused activation tests
Test Files 4 passed (4)
Tests 34 passed (34)
Integrated stack tests
Test Files 14 passed (14)
Tests 124 passed (124)
Type checks
@t3tools/client-runtime passed
@t3tools/web passed
@t3tools/mobile passed
Fallow (PR 2 scope)
No issues in 9 changed files; 25 inherited findings excluded

Regression coverage includes retrying startup after reconciliation failure, refreshing reconciled activation state, serializing enable/disable with removal, preserving durable registration when activation reset fails, reporting activation-specific persistence operations, and preserving platform-environment startup when shadow cleanup fails.

The repository Vite+ formatter/linter currently fails before inspecting changed files because it attempts to load vite.config.ts as an Oxlint/Oxfmt configuration. git diff --check passes; this infrastructure failure is recorded here rather than hidden.

Final review pass

Registration and activation now persist in one catalog mutation. The global activation lock is released before supervisor construction, and registration updates can preserve the existing desired state without transiently connecting. Desktop legacy migration now initializes the activation field explicitly.

Latest verification: client-runtime 47 test files / 599 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed. fallow audit --base codex/network-status-refresh passed the new-only gate with inherited findings excluded.

Rebased onto upstream main at 5661c6116 on 2026-08-07. Post-rebase verification: client-runtime 47 test files / 603 tests passed; mobile 100 test files / 624 tests passed; desktop 58 test files / 447 tests passed; client-runtime, web, mobile, and desktop typechecks passed.

Model: GPT-5; harness: Codex.

---

Note

Medium Risk
Touches core connection startup, supervisor desired state, and catalog persistence across platforms; incorrect activation or locking could leave environments stuck disconnected or briefly connected when disabled.

Overview
Adds persistent per-environment activation so saved environments can stay registered but stay disconnected when disabled.

The connection catalog gains a backward-compatible disabledEnvironmentIds field, a ConnectionActivationStore on web/mobile storage, and registration now takes an enabled flag in one catalog mutation. EnvironmentRegistry loads disabled IDs at startup, reconciles stale entries, seeds supervisors with the right desired state (no auto-connect for disabled envs), and exposes setEnabled to connect or disconnect without removing credentials or cache.

Connectivity.followNetworkStatus centralizes network change + app-wakeup handling (revision/lock so in-flight reads don’t stomp newer reports); the registry, supervisor, and relay discovery switch to it. Mobile drops the extra AppState network probe on connectivity changes (wakeups still handle foreground refresh). Connection startup retries on activation reconciliation failure.

A serialized setEnabled command is wired through client state for UI callers.

^{Reviewed by Cursor Bugbot for commit 1306054. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Persist environment activation state across restarts in the connection registry

• Adds a ConnectionActivationStore service (web and mobile storage layers) and extends ConnectionCatalogDocument with a disabledEnvironmentIds field to persist per-environment enabled/disabled state.
• EnvironmentRegistry now loads activation state on start, reconciles it against current targets, and creates supervisors with initiallyDesired reflecting activation rather than always connecting eagerly.
• Adds EnvironmentRegistry.setEnabled to toggle activation at runtime, immediately connecting or disconnecting the supervisor and persisting the choice.
• Platform-managed environments are force-enabled in activation; removing an environment clears its disabled tracking both in-memory and in persistence.
• Introduces Connectivity.followNetworkStatus helper (used by both the registry and EnvironmentSupervisor) that serializes status application, deduplicates in-flight refreshes, and handles wakeup-driven status recovery — fixing missed network transitions during app suspension.
• Risk: EnvironmentRegistry.start now returns ConnectionPersistenceError on failure; callers that previously assumed infallible startup will need to handle this error type.

^{Macroscope summarized 1306054.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 438a924d-9363-480e-a6a9-bb80ae716cf9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

The activation-store work looks consistent with the service conventions in packages/client-runtime and apps/web, but apps/mobile/src/connection/storage.ts wires the new ConnectionPersistenceError operation literals to the wrong stores: target/registration failures now report activation operations, and the activation store reports target/registration operations. That breaks the stable operation diagnostic context the error is meant to carry (and diverges from the correct mapping in apps/web/src/connection/storage.ts).

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new feature for persisting environment activation state across sessions, with changes spanning multiple platforms and affecting connection startup/management behavior. A high-severity open review comment also identifies a potential backoff timing bug that should be addressed.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[cursor]

Platform polls interrupt backoff

High Severity

Equivalent platform reconciles now always call supervisor.connect when initiallyDesired is true. Desktop/web platform sources re-emit the same registrations on a short poll interval, so every tick enqueues ConnectRequested. During backoff that signal ends waitForRetrySignal early without resetting the ladder, so platform environments retry about every poll instead of respecting the longer backoff delays.

Additional Locations (1)

• packages/client-runtime/src/connection/registry.ts#L582-L586

^{Reviewed by Cursor Bugbot for commit 1306054. Configure here.}

[DominicVonk]

Superseded by #5598, which now contains the complete environment-availability behavior as a self-contained PR based directly on main. This removes the stack dependency and lets maintainers merge the remaining PRs in any order.