Phase 1 of docs/superpowers/specs/2026-07-24-t3x-autoresume-ui-design.md.

state.ts
- ThreadRecord gains `enabled`, plus `setEnabled` / `setOverridePrompt` mutations
  (overridePrompt was already stored but had no setter).
- `enabled` is declared with `Schema.withDecodingDefaultKey(Effect.succeed(true))`,
  NOT as a required key. The boot path turns a decode failure into EMPTY_STATE, so a
  required key missing from an older state file would silently destroy every pending
  resume and the fired history. A regression test pins the legacy on-disk format.

  Note: the design doc specified `Schema.optionalWith`, which does not exist in this
  repo's Effect (4.0.0-beta.78). `withDecodingDefaultKey` is the equivalent there.

Reactor.ts
- Detection: a disabled thread never schedules, and posts no timeline note — the user
  turned it off deliberately, so an activity row would be noise.
- fireOne: re-reads the record instead of trusting the value seen at scheduling time,
  so a thread switched off *mid-wait* cancels rather than fires, and does not burn one
  of its 24h attempts.

Tests 50 -> 52 green; server typecheck clean. Both new Reactor tests were verified to
FAIL when the gates are neutered, so they are real guards rather than vacuous.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Closes the gap the PR flagged: the route had typecheck and unit coverage but was
never exercised over HTTP.

Serves ONLY the fork's route layer (not upstream's whole makeRoutesLayer) on an
ephemeral port with EnvironmentAuth mocked, and covers:

- a rejected credential  -> 401/403, not a 500
- a session without the operate scope -> 401/403
- GET on a never-seen thread -> enabled defaults to true
- GET without threadId -> 400
- POST patches one field without clobbering the other (a toggle must not wipe a
  resume message the user is part-way through typing, and vice versa)
- POST with a malformed body -> 400, not a 500

Scope limit, stated plainly: auth is mocked, so these do NOT prove the route's
`authenticateWithOperateScope` faithfully mirrors upstream's private
`authenticateRawRouteWithScope`. That stays a logic mirror tracked in SEAMS.md.
They prove the failure paths render as proper status codes rather than escaping
as a 500 or an unhandled defect.

Writing these caught a mistake in the test itself worth recording: the first
version failed a credential with ServerAuthSessionCredentialValidationError,
which is in NEITHER `ServerAuthCredentialError` nor `ServerAuthInternalError`,
so it matched neither catchIf branch and produced a 500. That looked like a
product bug but was a bad mock — upstream's OTLP route uses the identical two
branches and behaves the same way. Fixed to use ServerAuthInvalidCredentialError.

Tests 53 -> 59 green; server typecheck 0 errors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Adversarial review finding. The severe one is a bug this branch introduced.

state.ts — `recordFor` did `state.threads[threadId] ?? EMPTY_RECORD`. `threads` is a
plain object, so ids like `constructor`, `toString`, `valueOf`, `hasOwnProperty` and
`__proto__` resolve on Object.prototype and are truthy: `??` never falls through and the
caller gets a prototype method typed as a ThreadRecord.

Before this branch threadId only ever arrived from provider events. The new HTTP route is
what makes it caller-controlled, so this branch is what made it reachable:

  * reads dereference `record.pending` (undefined, not null) -> TypeError -> the route's
    catchTags only cover the three auth tags, so it escapes as a 500;
  * writes spread a prototype object, which has no own enumerable properties, and persist
    `{"enabled":false}` with none of the required keys. The next boot fails the WHOLE-file
    decode, and that path collapses to EMPTY_STATE — silently destroying every pending
    resume and the fired history behind the 24h cap.

Now uses `Object.hasOwn`. Regression tests cover all five hostile ids at the store level
plus, at the HTTP boundary, that GET/POST return 200 with defaults instead of 500. All
six were confirmed to FAIL against the old lookup, including "the real thread's pending
resume must survive".

Also from the review:

- AutoResumeOverlay: a debounced resume-message edit was dropped when switching threads
  mid-debounce (the next keystroke in the new thread cleared the old timer), silently
  losing what the user typed. Pending edits now flush, carrying their originating
  threadId. Writes also release the in-flight counter via a guaranteed path — that
  counter gates polling, and URL construction can throw synchronously before the promise
  exists, which would have pinned it above zero and frozen refreshes for the component's
  lifetime.

- Corrected two overstated claims rather than leaving them: t3x/index.ts cited an
  `index.test.ts` that does not exist, and sharing.test.ts is now explicit that it guards
  the memoisation *assumption* for this composition shape using its own probes — it does
  not import T3xLayerLive/T3xRoutesLive and would stay green if they stopped sharing a
  store. (The real wiring was independently verified correct from Effect's source: layer
  memoisation is keyed on layer identity and provideWith/mergeAllEffect/HttpRouter.serve
  all thread one MemoMap.)

Tests 59 -> 66; server and web typecheck both clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>