Merge upstream and resolve PR #45 conflicts and review findings

[purpshell]

PR #45 cannot accept project-maintainer fixes because its head is tulir/whatsmeow:main with maintainer edits disabled. This project-owned replacement merges its exact upstream head c386243a72bacad080ba2938b37e1e4e0f1ca3b2 into HyperMeow main at 9f40228a8de4dad6bdfe9a30f962cd925b91546c and resolves the conflicts while preserving HyperMeow's module path, semantic-version retractions, Polymorfa Signal fork, bounded queue overflow recovery, shadow-client boundaries, SQL batching, and shipped migrations.

The new upstream bot root-secret migration is appended as version 19, avoiding a collision with HyperMeow's published version 16. Protobuf output is regenerated for the changed schemas using protoc 34.1 and protoc-gen-go 1.36.11 with HyperMeow package paths. Barback's local module dependencies follow the merged contract.

Existing review findings

All 11 existing actionable findings on #45 were verified against the exact upstream head and addressed:

• CodeRabbit: restrict CI to contents: read and disable checkout credential persistence; wait for the active node handler before signaling queue completion; coalesce QR rotations and apply the newest secret before output; populate SendFBMessage's destination; include full bot edits in target-ID decryption.
• Codex: process the retired connection's stream errors before reconnect evaluation; dispatch full-sync fetch errors after releasing the app-state lock; emit primitive JSON without a Value wrapper; propagate primitive and view-model decoding failures; marshal unknown primitive/view-model/text metadata as raw JSON; retain every registered primitive's type discriminator.

No additional automated review was requested. Original findings remain on #45 because these commits are on the replacement branch.

Validation

Final head: 39ba534709bede1080f99889ced78729544c5ac1. Pull-request CI passed both Go 1.26 and Go 1.27 matrix jobs, including build, tests, generated MEX validation, and pre-commit.

• Go 1.27.1: go build ./... and go test -race ./... passed.
• Go 1.26.9: go test ./... passed.
• pre-commit run --all-files passed with Go 1.27.1 and 1.27.2 tools, including vet, staticcheck, tidy, YAML, import formatting, and zerolog checks.
• Generated MEX binding check passed.
• CI tooling pins goimports v0.51.0 and the upstream staticcheck snapshot 452d5bb86b45 (x/tools v0.51.0). Stable staticcheck v0.8.1 cannot read Go 1.27.2 export data; the pinned snapshot passes pre-commit on Go 1.27.2 and staticcheck on Go 1.26.9.
• Barback: default, benchmark_legacy, and race suites passed.
• Regressions cover active-handler cancellation, stream-error/reconnect ordering, app-state callback retry, QR rotation bursts and active-code refresh, authenticated full bot-edit decryption, rich-response round trips and malformed JSON, and schema 18 to 19 migration dispatch.
• git diff --check passed. No live WhatsApp account, PostgreSQL deployment, or downstream production runtime was exercised. Barback tests are local tests, not a full deployed benchmark.

API, SDK, CLI, docs, release, and admin assessment

Part	Status and reason
API	Updated: HyperMeow's Go API/protocol definitions, send destination, rich-response decoding, and ChatSettingsStore methods. Polymorfa's HTTP handlers/specs are unaffected because apps/api/go.mod remains pinned to 90f9e4ec2c88; this PR does not upgrade that consumer.
SDKs	Updated: the standalone Go library and its generated types, internals, and Barback consumer. Other Polymorfa language SDKs are unaffected because no HTTP contract or consumer dependency changes.
CLI	Unaffected: no Polymorfa commands, flags, credentials, output, or CLI dependencies change. Barback command dependencies are synchronized and its tests pass.
Docs	Updated: README.md and CHANGELOG.md cover the upstream revision, Go requirements, send destination, QR refresh, rich-response behavior, and custom-store migration. Public Polymorfa Mintlify docs are unaffected because its pinned runner and customer API behavior do not change.
Feature releases	Unaffected: no Polymorfa release record, entitlement, enrollment, rollout, or feature flag changes. These changes remain unreleased on this draft; installation authority remains reviewed main commits and Go pseudo-versions. No merge, tag, or deployment is included.
Admin controls	Unaffected: this library integration exposes no new customer-facing state, grant, limit, or staff operation in Polymorfa, whose runner dependency remains pinned. Admin capability functions, revisions, audits, and runtime controls do not change.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 539a7ead-9b12-4513-9295-8e20134512a5

---

📥 Commits

Reviewing files that changed from the base of the PR and between 9f40228 and 39ba534.

---

⛔ Files ignored due to path filters (12)

• benchmark/barback/go.sum is excluded by !**/*.sum
• go.sum is excluded by !**/*.sum
• proto/waAICommon/WAWebProtobufsAICommon.pb.go is excluded by !**/*.pb.go
• proto/waCommon/WACommon.pb.go is excluded by !**/*.pb.go
• proto/waDeviceCapabilities/WAWebProtobufsDeviceCapabilities.pb.go is excluded by !**/*.pb.go
• proto/waE2E/WAWebProtobufsE2E.pb.go is excluded by !**/*.pb.go
• proto/waGroupHistory/WAWebProtobufsGroupHistory.pb.go is excluded by !**/*.pb.go
• proto/waHistorySync/WAWebProtobufsHistorySync.pb.go is excluded by !**/*.pb.go
• proto/waSyncAction/WAWebProtobufSyncAction.pb.go is excluded by !**/*.pb.go
• proto/waWa6/WAWebProtobufsWa6.pb.go is excluded by !**/*.pb.go
• proto/waWeb/WAWebProtobufsWeb.pb.go is excluded by !**/*.pb.go
• proto/waWebLabyrinthWaWasm/WAWebLabyrinthWaWasm.pb.go is excluded by !**/*.pb.go

---

📒 Files selected for processing (63)

• .github/workflows/go.yml
• .pre-commit-config.yaml
• CHANGELOG.md
• CONTRIBUTING.md
• README.md
• appstate.go
• appstate/keys.go
• benchmark/barback/cmd/bench/main.go
• benchmark/barback/cmd/bench/phone_consent_sync.go
• benchmark/barback/go.mod
• business_test.go
• client.go
• client_runtime_test.go
• download-to-file.go
• download.go
• go.mod
• group.go
• handshake.go
• internals.go
• message.go
• msgsecret.go
• notification.go
• pair.go
• prekeys.go
• proto/waAICommon/WAWebProtobufsAICommon.proto
• proto/waCommon/WACommon.proto
• proto/waDeviceCapabilities/WAWebProtobufsDeviceCapabilities.proto
• proto/waE2E/WAWebProtobufsE2E.proto
• proto/waGroupHistory/WAWebProtobufsGroupHistory.proto
• proto/waHistorySync/WAWebProtobufsHistorySync.proto
• proto/waSyncAction/WAWebProtobufSyncAction.proto
• proto/waWa6/WAWebProtobufsWa6.proto
• proto/waWeb/WAWebProtobufsWeb.proto
• proto/waWebLabyrinthWaWasm/WAWebLabyrinthWaWasm.proto
• qrchan.go
• receipt.go
• retry.go
• send.go
• sendfb.go
• shadow.go
• socket/framesocket.go
• socket/noisehandshake.go
• socket/noisesocket.go
• socket/noisesocket_test.go
• store/clientpayload.go
• store/noop.go
• store/sqlstore/store.go
• store/sqlstore/upgrades/00-latest-schema.sql
• store/sqlstore/upgrades/19-wasa-root-secret.sql
• store/sqlstore/upgrades/upgrades_test.go
• store/store.go
• types/events/events.go
• types/jid.go
• types/message.go
• types/richresponse/json_test.go
• types/richresponse/primitive.go
• types/richresponse/textentity.go
• types/richresponse/util.go
• types/richresponse/viewmodel.go
• types/user.go
• upstream_sync_test.go
• user.go
• util/log/zerolog.go

---

 _________________________________________________
< Let's pair program: you type, I judge lovingly. >
 -------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T08:55:43.980325Z	39ba534	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-10T08:57:25.219707Z	39ba534	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.