[helix-a]

Summary

• Update Synapse to v1.164.1, packaged as 1.164.1:0. Scrutiny tier: Patch.
• Fixes clearing user status for clients sending null profile values; updates msgpack to address memory exhaustion from malformed public room list tokens (GHSA-j586-36cw-2gc2).
• Verified the published GHCR image includes linux/amd64 and linux/arm64. Localized release notes link to the upstream changelog.
• Ketesa v1.5.2 and start-sdk 3.1.1 are already current; no approved issues were open. No wrapper behavior or migration changes.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol

Testing

• Passed helix-build -- make format, helix-build -- npx tsc --noEmit, and git diff --check.
• Package not built locally: only the image tag, package version, and release notes changed; CI builds the PR.
• Untested: upgrade an existing homeserver to 1.164.1:0, confirm healthy startup, retained history/media, client login and message sync, then restart and confirm persistence.
• Untested: on a running homeserver with include_profile_updates_in_sync enabled, clear user status using a client sending a null profile value and confirm the status clears successfully.

Merge with a merge commit — do not squash. next is long-lived: a merge commit leaves it a true ancestor of master, so it fast-forwards cleanly afterwards. A squash re-lands the same content under a new commit, so the branch is left carrying history master will never contain.