@@ -22,6 +22,7 @@ github:btsouth
 github:cestercian
 github:chrisdeeming
 github:chuks-qua
+-github:coygeek Filed over 270 automated issues, about 50 a day at peak, far past what maintainers can triage
 github:cursoragent
 github:D3OXY
 github:dbalders
 
@@ -121,9 +121,54 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
   return { tag, sha: commit.sha, version };
 }
 
+// The two places a nightly install looks for an update: the `update-feed` pointer, and
+// releases.atom, which holds the 10 newest git tags of any kind. Older installs take the first
+// nightly in the feed. Reports what each names beside the newest published nightly.
+async function readNightlyUpdateFeed({ github, context, fetch = globalThis.fetch }) {
+  const latest = await findLatestNightly({ github, context });
+  if (!latest) return {};
+
+  const base = `https://github.com/${context.repo.owner}/${context.repo.repo}`;
+  // Only a missing or malformed pointer is stale. Rewriting deletes the old file first, so a
+  // GitHub outage must not look like one.
+  // Node waits five minutes for a stalled response, which is this job's whole time limit.
+  const signal = () => AbortSignal.timeout(30_000);
+  const pointer = await fetch(`${base}/releases/download/update-feed/nightly.json`, {
+    signal: signal(),
+  });
+  if (!pointer.ok && pointer.status !== 404) {
+    throw new Error(`The update-feed pointer answered HTTP ${pointer.status}.`);
+  }
+  let pointerTag;
+  if (pointer.ok) {
+    // A body that fails to arrive throws here; only one that is not JSON counts as malformed.
+    const body = await pointer.text();
+    try {
+      pointerTag = JSON.parse(body)?.tag_name;
+    } catch {}
+  }
+
+  // An unreadable feed leaves `feedTags` unset, so the pointer is still repaired. An error page
+  // can answer HTTP 200, so only an Atom document counts as read.
+  let feedTags;
+  try {
+    const feed = await fetch(`${base}/releases.atom`, { signal: signal() });
+    const body = feed.ok ? await feed.text() : "";
+    if (/<feed[\s>]/.test(body)) {
+      feedTags = Array.from(body.matchAll(/href="[^"]*\/releases\/tag\/([^"]+)"/g), (match) =>
+        decodeURIComponent(match[1]),
+      );
+    }
+  } catch {}
+  const feedNightly = feedTags?.find((tag) => /^v?\d+\.\d+\.\d+-nightly\./.test(tag));
+
+  return { tag: latest.tagName, pointerTag, feedNightly, feedTags };
+}
+
 module.exports = {
   assertCommitOnDefaultBranch,
   assertReleaseSource,
   shouldReleaseNightly,
   resolveLatestNightlyCommit,
+  readNightlyUpdateFeed,
 };
@@ -237,3 +237,81 @@ test("stable releases fail when no nightly is published", async () => {
   const { options } = nightlyCommitFixture({ releases: [nightly(1, { tagName: "v1.0.0" })] });
   await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly found/);
 });
+
+const { readNightlyUpdateFeed } = require("./check-nightly-release.cjs");
+
+// GitHub percent-encodes tag names in the feed, and any tag in the repository takes a slot.
+const atomEntry = (tag) =>
+  `<entry><link rel="alternate" type="text/html" href="https://github.com/example/app/releases/tag/${encodeURIComponent(tag)}"/></entry>`;
+const atomFeed = (tags) => new Response(`<feed>${tags.map(atomEntry).join("")}</feed>`);
+const NEWEST = "v1.0.1-nightly.20260905.123";
+const OLDER = "v1.0.1-nightly.20260905.100";
+
+function updateFeedFixture({ feed, pointer }) {
+  const { options } = fixture({
+    releases: [nightly(1), nightly(0, { tagName: "v1.0.2-preview.1" })],
+  });
+  options.fetch = async (url) =>
+    url === "https://github.com/example/app/releases.atom"
+      ? feed
+      : url === "https://github.com/example/app/releases/download/update-feed/nightly.json"
+        ? pointer
+        : assert.fail(`unexpected fetch ${url}`);
+  return options;
+}
+
+const missing = () => new Response("Not Found", { status: 404 });
+// HTTP 200, then the connection drops before the body arrives.
+const brokenBody = () =>
+  new Response(new ReadableStream({ start: (controller) => controller.error(new Error("reset")) }));
+for (const [name, { feed, pointer }, expected] of [
+  [
+    "a nightly crowded out of the feed and a missing pointer",
+    { feed: atomFeed(["v1.0.2-preview.1", "mobile-android-build/2.3.0/abc"]), pointer: missing() },
+    { pointerTag: undefined, feedNightly: undefined },
+  ],
+  [
+    "the first nightly in the feed, which is the one older installs take",
+    { feed: atomFeed(["update-feed", OLDER, NEWEST]), pointer: Response.json({ tag_name: OLDER }) },
+    { pointerTag: OLDER, feedNightly: OLDER },
+  ],
+  [
+    "a malformed pointer as stale and an unreadable feed as naming nothing",
+    { feed: new Response("", { status: 503 }), pointer: Response.json(null) },
+    { pointerTag: undefined, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "an HTML page with release links as an unreadable feed",
+    {
+      feed: new Response(
+        `<html><feedback-form></feedback-form><a href="/example/app/releases/tag/${OLDER}">x</a></html>`,
+      ),
+      pointer: Response.json({ tag_name: NEWEST }),
+    },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "the pointer when the feed's body fails to arrive",
+    { feed: brokenBody(), pointer: Response.json({ tag_name: NEWEST }) },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+]) {
+  test(`update feed check reports ${name}`, async () => {
+    const { tag, pointerTag, feedNightly, feedTags } = await readNightlyUpdateFeed(
+      updateFeedFixture({ feed, pointer }),
+    );
+    const { unreadable = false, ...named } = expected;
+    assert.deepEqual({ tag, pointerTag, feedNightly }, { tag: NEWEST, ...named });
+    assert.equal(feedTags === undefined, unreadable);
+  });
+}
+
+for (const [name, pointer, error] of [
+  ["answers with an error", () => new Response("", { status: 503 }), /pointer answered HTTP 503/],
+  ["drops the connection", brokenBody, /reset/],
+]) {
+  test(`update feed check does not call a pointer stale when GitHub ${name}`, async () => {
+    const options = updateFeedFixture({ feed: atomFeed([NEWEST]), pointer: pointer() });
+    await assert.rejects(readNightlyUpdateFeed(options), error);
+  });
+}
@@ -10,10 +10,7 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: agent-context-budget-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
+# No concurrency group: label events arrive in bursts, and a cancelled run reports as a failed check.
 jobs:
   budget:
     name: Agent context budget
 
@@ -0,0 +1,77 @@
+name: Issue Vouch
+
+on:
+  issues:
+    types: [opened, reopened]
+  push:
+    branches:
+      - main
+    paths:
+      - .github/VOUCHED.td
+      - .github/workflows/issue-vouch.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: issue-vouch-${{ github.event.issue.number || 'all' }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    name: Label issues by author trust
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            // Only listed authors get a label; open issues number in the thousands,
+            // so unvouched is the default and stays unlabelled.
+            const labelByStatus = { vouched: "vouch:trusted", denounced: "vouch:denounced" };
+            const managedLabelNames = new Set(["vouch:trusted", "vouch:unvouched", "vouch:denounced"]);
+
+            const { data: file } = await github.rest.repos.getContent({
+              owner,
+              repo,
+              path: ".github/VOUCHED.td",
+              ref: context.payload.repository.default_branch,
+            });
+            const statusByUser = new Map();
+            for (const raw of Buffer.from(file.content, "base64").toString("utf8").split("\n")) {
+              const match = /^(-?)github:(\S+)/.exec(raw.trim());
+              if (match) statusByUser.set(match[2].toLowerCase(), match[1] ? "denounced" : "vouched");
+            }
+
+            const issues =
+              context.eventName === "issues"
+                ? [context.payload.issue]
+                : (
+                    await github.paginate(github.rest.issues.listForRepo, {
+                      owner,
+                      repo,
+                      state: "open",
+                      per_page: 100,
+                    })
+                  ).filter((issue) => !issue.pull_request);
+
+            for (const issue of issues) {
+              const status = statusByUser.get(issue.user.login.toLowerCase());
+              const next = labelByStatus[status];
+              const current = issue.labels.map((label) => label.name).filter((name) => managedLabelNames.has(name));
+
+              for (const name of current) {
+                if (name === next) continue;
+                try {
+                  await github.rest.issues.removeLabel({ owner, repo, issue_number: issue.number, name });
+                } catch (error) {
+                  if (error.status !== 404) throw error;
+                }
+              }
+              if (next && !current.includes(next)) {
+                await github.rest.issues.addLabels({ owner, repo, issue_number: issue.number, labels: [next] });
+                core.info(`Issue #${issue.number} (${issue.user.login}): ${status} -> ${next}`);
+              }
+            }
@@ -101,17 +101,17 @@ jobs:
               {
                 name: "vouch:trusted",
                 color: "1f883d",
-                description: "PR author is trusted by repo permissions or the VOUCHED list.",
+                description: "Author is trusted by repo permissions or the VOUCHED list.",
               },
               {
                 name: "vouch:unvouched",
                 color: "fbca04",
-                description: "PR author is not yet trusted in the VOUCHED list.",
+                description: "Author is not yet trusted in the VOUCHED list.",
               },
               {
                 name: "vouch:denounced",
                 color: "d1242f",
-                description: "PR author is explicitly blocked by the VOUCHED list.",
+                description: "Author is explicitly blocked by the VOUCHED list.",
               },
             ];
 
 
@@ -49,7 +49,8 @@ jobs:
   # published nightly, so stable only ever ships a build that nightly users
   # have already run. Scheduled runs also decide here whether a nightly is due.
   # The PAUSE_NIGHTLY repository variable skips scheduled runs only; every later
-  # job needs this one, so a skip here skips the whole run.
+  # job needs this one, so a skip here skips the whole run. `update_feed` runs
+  # without it and checks the variable itself.
   resolve_commit:
     name: Resolve release commit
     if: github.repository == 'pingdotgg/t3code' && (github.event_name != 'schedule' || vars.PAUSE_NIGHTLY != 'true')
@@ -165,14 +166,12 @@ jobs:
             echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
             echo "make_latest=false" >> "$GITHUB_OUTPUT"
           elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-preview}" == "preview" ]]; then
-            # Manual-only test train: exercises the whole release flow for a
-            # commit end users must never receive. Never scheduled.
+            # Manual-only test train: exercises the release flow up to a draft
+            # release for a commit end users must never receive. Never scheduled.
             # Same versioning as nightly under its own prerelease identifier.
-            # A preview release is reachable only by asking for it: npm gets it
-            # under the `preview` dist-tag, which nothing resolves by default,
-            # its desktop builds carry no update feed, and no updater manifest
-            # is attached to the release, so neither stable nor nightly
-            # installs can ever be offered one.
+            # A preview release stays a draft (see "Publish prerelease"), its
+            # desktop builds carry no update feed, no updater manifest is
+            # attached, and npm gets nothing, so no install can be offered one.
             nightly_date="$(date -u -d "$NIGHTLY_DATE" +%Y%m%d)"
 
             node scripts/resolve-nightly-release.ts \
@@ -183,7 +182,6 @@ jobs:
               --github-output
 
             echo "release_channel=preview" >> "$GITHUB_OUTPUT"
-            echo "cli_dist_tag=preview" >> "$GITHUB_OUTPUT"
             echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
             echo "make_latest=false" >> "$GITHUB_OUTPUT"
           else
@@ -1038,22 +1036,93 @@ jobs:
       # The action keeps a stable release a draft until its assets finish uploading, but publishes a
       # prerelease first. Desktop clients update connected servers from the CLI archives as soon as
       # they see the release, so a prerelease also goes public only once every asset is attached.
+      # Previews stay drafts, because a draft has no git tag. releases.atom lists the 10 newest tags,
+      # a day's `preview` tags can sort above its `nightly` ones, and older updaters find nightlies only there.
       - name: Publish prerelease
-        if: needs.preflight.outputs.is_prerelease == 'true'
+        if: needs.preflight.outputs.is_prerelease == 'true' && needs.preflight.outputs.release_channel != 'preview'
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
         run: gh release edit "$RELEASE_TAG" --draft=false
 
+  # A nightly install finds updates in releases.atom, which holds the 10 newest git tags of any
+  # kind, so a burst of other tags hides every nightly. The `update-feed` release is the fixed URL
+  # newer installs also read. Every unpaused scheduled tick and every nightly repairs it, then fails when
+  # the feed's first nightly is not the newest one. See docs/operations/release.md#update-feed.
+  update_feed:
+    name: Check the update feed
+    needs: [preflight, release]
+    if: ${{ !cancelled() && github.repository == 'pingdotgg/t3code' && ((github.event_name == 'schedule' && vars.PAUSE_NIGHTLY != 'true') || needs.preflight.outputs.release_channel == 'nightly') }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          sparse-checkout: .github/scripts
+
+      - id: feed
+        name: Read the update feed
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          retries: 3
+          script: |
+            const { readNightlyUpdateFeed } = require('./.github/scripts/check-nightly-release.cjs');
+            const { tag, pointerTag, feedNightly, feedTags } = await readNightlyUpdateFeed({ github, context });
+            if (!tag) return;
+            core.info(`Newest nightly: ${tag}. Pointer: ${pointerTag}. Feed: ${feedTags?.join(', ')}.`);
+            core.setOutput('tag', tag);
+            core.setOutput('pointer_stale', pointerTag !== tag);
+            core.setOutput('feed', feedTags === undefined ? 'unreadable' : feedNightly === tag ? 'ok' : 'hidden');
+
+      - name: Point the update feed at the newest nightly
+        if: steps.feed.outputs.pointer_stale == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ steps.feed.outputs.tag }}
+        run: |
+          gh api "repos/$GH_REPO/releases/tags/$RELEASE_TAG" --jq '{tag_name, name, body}' > nightly.json
+          gh release view update-feed > /dev/null 2>&1 ||
+            gh release create update-feed --prerelease --latest=false --title "Update feed" \
+              --notes "The desktop updater reads this release to find the newest nightly. Do not delete it. See docs/operations/release.md."
+          gh release upload update-feed nightly.json --clobber
+
+      # Every run, because the pointer can be current while the release's flags are wrong. A draft's
+      # files are not public, and a release marked "latest" is the one stable installs update to.
+      - name: Keep the update feed release public and never latest
+        if: steps.feed.outputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release edit update-feed --draft=false --prerelease --latest=false
+
+      # An unreadable feed says nothing about its tags and the next tick reads it again, so only a
+      # feed that was read and names another nightly first fails the run.
+      - name: Fail when the feed hides the newest nightly
+        if: steps.feed.outputs.tag != '' && steps.feed.outputs.feed != 'ok'
+        env:
+          RELEASE_TAG: ${{ steps.feed.outputs.tag }}
+          FEED: ${{ steps.feed.outputs.feed }}
+        run: |
+          if [[ "$FEED" == "unreadable" ]]; then
+            echo "::warning::releases.atom could not be read, so this run did not check it."
+            exit 0
+          fi
+          echo "::error::The first nightly in releases.atom is not $RELEASE_TAG. Nightly installs older than 0.1.10-nightly.20261112.4603 cannot reach it, and neither can later builds that do not read the pointer when the feed names an older nightly. A preview from a branch not rebased onto main is the usual cause. See docs/operations/release.md#update-feed."
+          exit 1
+
   # The `t3` npm package is a launcher that downloads this version's CLI
   # archive from the GitHub Release, so it publishes only once that release
-  # exists. Preview publishes too, under the `preview` dist-tag, which
-  # nothing resolves unless asked for by name.
+  # exists. A preview release stays a draft, whose files are not public, so
+  # a preview never publishes the launcher.
   publish_cli:
     name: Publish CLI to npm
     needs: [preflight, build_bundle, release]
-    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' && needs.preflight.outputs.release_channel != 'preview' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
 
@@ -49,3 +49,5 @@ node_modules/
 
 # pnpm content-addressable store; never belongs in the repo.
 .pnpm-store/
+
+/packages/ssh/.ssh-launcher-test-*/