[meramsey]

Summary

• Restore friendly login, login help, login qr, and login email dispatch while preserving mautrix-go flow IDs and permission checks.
• Harden QR/email authentication with serialized account operations, structured/redacted provider errors, Retry-After and per-account cooldown handling, and safe reconnect behavior.
• Validate public LINE IDs and MID results before portal creation, preserve opaque case-sensitive gateway IDs, and reuse/reopen canonical DM portals.
• Preserve outbound cancellation/error acknowledgements and inbound media authentication/metadata behavior.
• Keep the current upstream contact-search result cap, cancellation checks, and context-aware avatar requests from connector: keep contact search bounded and stop it when the request is canceled #296.
• Include targeted regression tests, coverage gates, optimized test modes/caches, and reproducible Linux release tooling.

Root causes

• The upstream-first rebuild omitted the LINE-specific login command registration from LineConnector.Init, leaving only mautrix-go's fully qualified flow-ID parser; login qr was therefore rejected even though QR authentication remained enabled.
• Earlier lookup and media paths accepted insufficiently validated provider identities/results or lost useful cancellation/error classification. The follow-up changes validate data before persisting portals and keep sensitive provider data out of surfaced diagnostics.

Relationship to existing PRs

• Supersedes the still-open fix: resolve LINE IDs and harden sends, QR login, and media #271 as a more current, tested replacement: all nine commits are present by patch equivalence, and this branch adds subsequent authentication, identity, validation, CI and release corrections. Please compare before merging either; this PR does not close or modify fix: resolve LINE IDs and harden sends, QR login, and media #271.
• Adapts applicable test-mode, deterministic concurrency, coverage-gate and CI-cache work from the six-commit test: optimize Go test performance and strengthen CI validation meramsey/line#1. Two patches are identical by patch ID; the remaining tooling is adapted in later integration commits. Its environment-specific benchmark report was not copied. feat: ✨ Add read receipts on both sides #1 remains open and unchanged.
• Incorporates upstream main through 45a48b9, including connector: keep contact search bounded and stop it when the request is canceled #296's bounded/cancellable contact search; it does not revert that upstream improvement.

Validation

• Targeted login, public-ID/MID/opaque identity, start-chat/portal reuse, QR lifecycle, provider errors, and cooldown tests passed.
• normal: 512 pass events, 1 skip, 0 failures.
• race: 512 pass events, 1 skip, 0 failures.
• coverage: 512 pass events, 1 skip, 0 failures; package coverage gates passed.
• release: all above checks, gofmt, go vet, staticcheck, go mod verify, coverage-checker tests, and build passed.
• Release source is checkpoint f36c646b468719877c9fb4329f2cab18b652fbca; reproducible Linux amd64 builds with Go 1.26.10 and libolm 3.2.16 were byte-identical.

Compatibility and limitations

• Existing fully qualified login flow IDs and network.qr_login configuration remain supported.
• Optional historical lookup-shape diagnostics are intentionally deferred pending current-schema/privacy review; safe lookup validation remains.
• Live QR/provider behavior and the known Matrix E2EE puppet sender/device warning require operator verification. No live account actions or encryption changes were performed.
• No production deployment was performed as part of this integration task.