v0.10.0-rc.9

Native signing status: Windows: unsigned transition artifact. SmartScreen publisher identity is not established. macOS: unsigned transition artifact. Developer ID and notarization are not established. Checksums and GitHub build provenance remain required. Do not bypass SmartScreen or Gatekeeper.

Fixed

• Retained quota for a provider login recorded without an email (a generic
  default identity) now survives failed refreshes. The account-scoped cache
  lookup reads the plain provider file where those snapshots are written, so
  an expired-token state shows stale bars and reset times instead of a blank
  card. Exact identity matching keeps a legacy specific-account snapshot from
  being relabeled as generic, and one generic label never answers for another.
• Provider failure copy no longer displaces an expired-login message with the
  generic reconnect line, and a gRPC resource-exhausted throttle is labeled
  rate limited instead of provider slow.
• OAuth grant files are flushed to disk before their atomic rename, so an
  operating-system crash during a token refresh cannot truncate a grant whose
  rotated refresh token the provider has already invalidated.
• A fixed-port OAuth login now fails closed when another local process already
  holds the IPv6 loopback port, instead of silently continuing IPv4-only and
  letting that process receive the authorization redirect. PKCE already kept
  the code unredeemable; the login no longer hangs, and hosts without IPv6
  loopback still sign in over IPv4.
• The source-setup portable desktop fallback now says when no published
  release matches the checkout version instead of a raw HTTP 404 exception on
  Windows or a silent skip on macOS and Linux, and states that the installed
  desktop app is unchanged with the two truthful next steps.
• A Grok read denied because the CLI's stored token is already past its
  recorded expiry now reports an expired login with the repair steps (use Grok
  once, or quotabot login grok) instead of a bare gRPC status, so an idle
  machine shows what to do rather than an unexplained code. The exact provider
  status is kept in the message, denials for a token that should still be
  valid keep their raw status, and throttling and provider errors are never
  reclassified. The desktop Connect action now appears for this proven expiry.
• The scheduled install smoke no longer fails when the target release predates
  tools/verify-doctor.ps1. The workflow fetches its own commit's verifier
  before the Windows doctor checks, so smoking the latest stable release keeps
  the fail-closed verification instead of erroring on a missing script.
• Desktop provider cards keep retained quota bars and reset times above a
  failed-refresh warning, so a temporary Grok or Claude metadata failure cannot
  visually replace known quota. Compact provenance now labels whole-account
  scope explicitly instead of reading like the error affects the whole account.