KMP Phase 5: startup processor, runtime generations, restart-free reinitialization (R2)

[stslex]

Phase 5 — startup processor, runtime generations, restart-free reinitialization

Implements maintainer decision R2 (2026-08-22) plus three rework rounds. Governing spec:
documentation/feature-specs/kmp-phase-5-startup-processor.md — §8.4/§8.5a/§8.5b hold the
CURRENT protocol (rewritten in place each round); §20–§25 are the per-round records; raw
evidence (known-negative and red-on-base JUnit XMLs) in
documentation/feature-specs/kmp-phase-5-evidence/.

Status: the R4.2 correction is addressed (durable-phase-aware terminal dispatch, on top
of R4.1 and the round-4 maintainer correction). Still a draft; not marked ready.

The protocol, as it stands now

• One serialized replacement transaction (spec §8.4): submission-owned bodies on the
  never-cancelled host scope; restore sources STAGED into runtime-owned copies inside the
  non-suspending submission frame; ALL caller compensation on one typed
  DatabaseReplacementEffects object — onBeforeMutation inside the mutex, exactly one
  terminal method per transaction, failures folded onto the outcome (effectsError), never a
  silently clean commit.
• A crash-durable attempt journal (§8.5a): at most one unresolved attempt
  (Prepared → Committed → resolved), claimed atomically before anything irreversible;
  Prepared at cold start means "outcome unknown" and never yields a peek-driven success.
  Owner-isolated end to end (R4): the id-less pre-R3 legacy marker converts atomically under
  its one synthetic owner id, an arbitrary attempt can neither claim nor clear it, and the
  scenario-1 re-claim CHECKS its result instead of mutating unjournaled.
• Crash-safe reservation lifecycle (R4): the rollback snapshot is reserved per-attempt
  INSIDE the transaction; promotion onto the canonical undo slot COPIES, so the journal-named
  file survives every crash point; the reservation is deleted only after the durable
  Committed record, and a retained copy is cleaned idempotently by the committed cold-start
  finalization. A journal-named source is AUTHORITATIVE — missing means a typed rejection and
  terminal recovery, never a silent substitution of another attempt's canonical slot — and a
  committed rollback consumes EXACTLY the file it applied (typed SourceConsumption), so a
  reservation-sourced recovery leaves the previous restore's undo valid.
• Terminal classification (R4): RetrySafe is removed. A pre-PONR rejection of the
  recovery rollback proves only that THIS rollback did not mutate — never what the original
  Prepared attempt did — so every rollback outcome short of a clean durable commit is
  RecoveryRequired: zero DB-bound arming (no planner, no repositories, no dialog observer),
  no Main UI, every asset preserved, the explicit recovery surface. A graph-only reinitialize
  over an unresolved Prepared journal aborts rather than publishing over unproven data.
• Replay-safe finalization (R4): every data-bearing write (undo availability, persisted
  dialogs) lands BEFORE the attempt resolves; a death anywhere replays idempotently; the
  committed-rollback replay takes its availability verdict from ground truth (canonical file
  existence). The one documented at-most-once residual — the interrupted rollback's
  user-facing dialog — has its exact boundary in §8.5b.
• Result truth (§8.4): Committed = the REQUESTED operation committed;
  RecoveredByRollback = serving on PRE-operation data (restore-FAILURE semantics, no undo
  offer); phase-aware Fatal dispatch; Fatal is terminal under concurrency.
• Teardown terminality (R3+R4): PONR = the START of every irreversible action. Strict
  replacement joins the lifetime (Store jobs included — they parent to the generation) before
  close; graph-only publishes N+1 only after N's teardown COMPLETES, and a failed teardown or
  unjoinable candidate is FATAL — never publish-anyway, never a republished N beside leaked
  candidate work, never an epoch advance while N's producers live
  (PartialCandidateUnwindException makes the partial-build failed-unwind distinct from an
  ordinary construction abort).
• Closed admission (R3): worker leases as the first operation inside doWork; token-based
  UI admission granted during COMPOSITION with an ABA-safe atomic retire; snackbar models
  generation-tagged at enqueue with the epoch advancing BEFORE publication.

R4.1 — the final bounded correction (spec §24)

• Committed canonical rollback is no longer repeatable after a crash: the
  RecoveryCompleted finalization is SOURCE-AWARE from the journal's own
  rollbackSnapshotPath discriminator (null = canonical applied → finish its consumption
  idempotently + clear availability; non-null = consume exactly the named file, preserve a
  surviving canonical and its availability) — never inferred from file existence; resolve
  LAST; idempotent replay.
• A requested rollback's successful retry commits as the requested operation: Committed
  recorded through the ORIGINAL effects before the exact-source consumption (failures
  surfaced, never a clean Completed; asset + journal retained on a failed record), same
  bounded ladder, outcome Completed. Anonymous compensation remains only for the rollback of
  a failed Restore.
• The inline rollback disposes the candidate through THE teardown protocol (VM clear →
  cancel + bounded join → close) before any file swap; a failed clear/join/close is Fatal
  with zero renames after; no double teardown.
• The bounded-clear liveness proof: a dispatcher that accepts but never runs the clear —
  the machine reaches Fatal within the drain budget (deferred completes, no successor, epoch
  unchanged, admission retired, worker acquirer fails loud); the old unbounded implementation
  was executed as a mutant and hangs the pin.

R4.2 — durable phase vs terminal dispatch (spec §25)

• commitMutation returns the EXPLICIT protocol phase (CommitResult.Durable | NotDurable):
  a failure in reservation promotion or the durable record is never dispatched as a committed
  terminal — pre-R4.2 the Completed(effectsError) shape let the production onCommitted
  effects resolve the still-Prepared attempt, clear availability, publish success and
  acknowledge, erasing exactly the state conservative recovery needs. NotDurable maps to
  FailedAfterMutation (RestartProcess), the bounded recovery ladder (RebuildInProcess — a
  restore rolls back onto its kept reservation; a requested rollback retries source + record
  once, persistent failure → Fatal with everything preserved), or FailedAfterMutation from
  the inline branch. The only remaining origin of Completed.effectsError is a failure OF the
  terminal callback after a DURABLE commit.
• The one @Suppress added by 39e9155c is removed (typed ProbeViewModelFactory); the
  zero-new-suppressions claim is verified against the FULL range 936ab699..HEAD.
• The liveness pin uses a REAL queueing dispatcher and executes the abandoned clear after the
  Fatal verdict, proving the documented residual literally.

Commits

Rounds 1–3 (95458856…936ab699) as recorded in spec §20–§22. Round 4 + R4.1:

SHA	Commit
1dacb403	fix(backup): make restore attempt ownership crash-durable (blockers A, B, C, E)
3e9aee6e	fix(runtime): terminalize incomplete graph-only teardown (blocker D)
e9459025	fix(runtime): close the defects the round-4 adversarial review confirmed
7c82c368	docs(kmp): reconcile round-4 corrections and evidence
39e9155c	fix(runtime): close the remaining rollback protocol gaps (R4.1)
83793531	docs(kmp): reconcile final rollback evidence and PR truth (R4.1)
f2d3c81a	fix(runtime): never dispatch a pre-durable commit failure as committed (R4.2)
85a3e48f	docs(kmp): record the R4.2 durable-phase correction (R4.2)

Round-4 discriminating tests — proven RED on the pre-correction head

All 11 mandated round-4 tests (plus supporting pins — 21 failures total: 20 named tests +
1 parameterized invocation) were run against a worktree at 936ab699 and FAILED there; the
six R4.1 pins were proven the same way against 7c82c368 (raw XMLs:
kmp-phase-5-evidence/r4-red-on-base-*.xml and r41-red-on-base-*.xml). Spec §23.1/§24 map
each correction to its exact pin; §23.2 is the crash-state matrix for one restore attempt
across every process-death point — a COMPOSED proof (file-level pins against the real
provider, ordering pins against the runtime, classification pins against the coordinator); no
literal two-launch process-death integration test exists.

Known-negatives (executed red and reverted; XMLs committed)

Round 4: R4-A explicit-path→canonical fallback re-enabled; R4-B "publish the candidate
anyway" restored after a failed teardown; R4-C the invalid safe-retry classification
restored. R4.1: the unbounded-clear mutant (the old withContext(mainDispatcher) form)
hangs the new liveness pin to its timeout. Earlier rounds' N1–N3, R3-A–R3-D and the
severed-dispose device XML stand.

Verification (final, all forced)

Host battery (assembleDebug testDebugUnitTest verifyPaparazziDebug lintDebug assembleDebugAndroidTest --rerun-tasks --no-build-cache --no-configuration-cache): exit 0,
3265/3265 tasks, 2725 host tests / 0 failures, zero Paparazzi movers.
detekt + :lint-rules:test: exit 0, zero new suppressions (no @Suppress, no baseline or
config change in the round-4 diff). Device (API-34 arm64): ui_tests.yml-form
Regression 81/0 and Smoke 44/0; Room same-instance characterization
2/2 unchanged. Affected-KMP iOS compile: exit 0 (link/runtime remains honestly UNVERIFIED — no
host before Phase 7). A fresh-context 4-hunt adversarial review ran over crash ordering,
source-owner identity, teardown return values and outcome truth/test vacuity; its outcome is
recorded in spec §23.5 and every confirmed finding is fixed in e9459025; the three R4.1
protocol defects and their fixes are recorded in §24.

Android production behavior

MainActivity untouched; cold-start order identical; restore success keeps result-then-restart;
RestartProcess remains the production policy; Metro create() roots, Nav3 shell, recovery
ordering unchanged. The saveable-slot one-frame death window stays documented-deferred
(§18(a)); no Phase 7 work; no swappable DAO/repository indirection (the only repository touched
is the journal's own RestoreStateRepository). §23.4 lists the deliberate residuals with their
exact boundaries.

Do not merge — Ilya merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WWXhGN9th6NP3MWu4No3nz

[github-actions]

Unit Test Results

  247 files    247 suites   13m 9s ⏱️
2 261 tests 2 261 ✅ 0 💤 0 ❌
2 264 runs  2 264 ✅ 0 💤 0 ❌

Results for commit d8a4465.

♻️ This comment has been updated with latest results.

[stslex]

REQUEST_CHANGES addressed — all six findings fixed in 95458856 + 366997da, docs/evidence truth pass in 52429c8c. Full map in spec §20.1 (fixes) and §20.2 (exact per-suite proof claims); highlights:

Finding	Fix	Pinned by
1 — self-cancelling transaction	Submission ownership: transactions run on the runtime's never-cancelled hostScope; callers submit+await; post-commit effects ride beforeMutation/onCommitted hooks on the transaction's coroutine; every escape resolves via a per-transaction PONR tracker (no stranded Transitioning)	AppRuntimeReplacementTest: Settings-Store cancel mid-await, undo-initiator-inside-outgoing-lifetime (hook runs, no deadlock)
2 — quiesce not a closed barrier	BackupWorkLease: deps+lease atomic under the admission lock; quiesce awaits every lease incl. constructed-before-RUNNING; timeout aborts pre-close; parked acquirers bind to the successor. Snapshot drain deleted	lease-drain abort + reopen + real parked-thread rebinding (JVM); release-in-finally (BackupWorkerTest); one-lease-per-admission (MetroWorkerFactoryTest)
3 — UI gate accepts foreign disposes	Per-generation-id attachment counts; only the outgoing id's zero releases; no-op holder defaults removed (abstract)	wrong-id / stale-id / multi-attachment negatives (JVM) + the composed device handshake below
4 — phase-conflated failure seam	DatabaseReplacementResult (Committed / RejectedBeforeMutation / FailedAfterMutation / FatalNoGeneration); asset deletion only pre-mutation; post-PONR cleanup runtime-owned	coordinator/use-case suites: FailedAfterMutation & Fatal preserve every asset/marker
5 — leaking ladder	Staged construction closes an owned DB on graph-factory throw; never-rename-after-failed-close; rolledBack-before-consume in BOTH rollback paths; Fatal throws from every holder, never converts to Serving	ladder suite incl. orphan-DB close, rolled-back retry, Fatal reads
6/7 — state-machine defects	Atomic same-op single-flight under the submission lock; graph-only aborts keep the outgoing ViewModelStore intact (probe-ViewModel asserted); nested rollback in graph-only preflight rejected deterministically (no mutex deadlock); one immutable published value behind both phase faces	AppRuntimeTest (12 tests)

Composed real-handshake device proof: AppRuntimeUiHandshakeDeviceTest runs a REAL AppRuntime behind the whole app shell (MetroTestGraphHolder.runtimeDelegate — production stream, production callbacks). Known-negative executed+reverted: severing the dispose callback turns it red with the bounded Aborted("ui region did not dispose in time") — raw XML committed (known-negative-ui-handshake-severed-dispose.xml). RuntimeGenerationSwapDeviceTest's claims narrowed to its honest boundary (inode/close/fresh-Room over empty quiesce populations).

Re-verification (2026-08-23, forced): host battery 3265/3265 tasks, 2609 tests / 0 failures; detekt + :lint-rules:test green (zero suppressions added); Regression 78/0, Smoke 43/0 on the API-34 emulator; :core:data:backup:api iOS compile green. Spec §19 retitled — the in-repo review records are artifacts, not GitHub approvals.

Kept as directed: RestartProcess production default, Metro create() roots, Nav3 shell, cold-start ordering; no Phase 7 work; the saveable-slot one-frame death window stays documented-deferred (§20.3). PR remains a draft.

[stslex]

Round-2 REQUEST_CHANGES addressed — the callback lambdas are deleted and ownership/terminal semantics are consolidated into one transaction protocol (spec §8.4 rewritten in place; §21 = the round-2 record with per-suite proof claims in §21.2).

Correction	Mechanism	Pinned by
1 — source ownership at submission	Staging into a runtime-owned copy in the non-suspending submission frame; terminal cleanup on every outcome; no NonCancellable awaits	Submission-frame pin under a STANDARD host dispatcher (+UNDISPATCHED caller); the composed gate's genuine caller finally-delete; mid-copy debris cleanup
2 — runtime-owned compensation	Typed DatabaseReplacementEffects (onBeforeMutation in-mutex + exactly one terminal method, UNDER the mutex, on the transaction coroutine, escapes included) + the durable restore_mutation_interrupted journal (§8.5a); Committed(effectsError) never silently clean	Packaged-effects discriminators (capture WITHOUT invoking → nothing runs post-await → manual invoke runs the writes); marker+caller-killed+timeout gate; T2-blocked-behind-T1's-suspended-compensation pin
3 — result truth	Committed = requested op only; new RecoveredByRollback (restore-failure semantics; the inline-S1-rollback outer path no longer lies Completed)	RecoveredByRollback, never Completed ×2 + the integration gate's "no success lie"; known-negative N1 (4 pins red)
4 — asset preservation	Delete-on-FailedAfterMutation branch + test REMOVED; non-commit rollbacks preserve everything AND return the new RecoveryRetryPending (no restart → no silent boot loop; truthful failure dialog)	Two-coordinator process-restart gate; preserve-everything pins; StartupProcessorTest continuation pin
5 — PONR at the start	PONR = teardown start / close INVOCATION / rename; close-throw → Fatal (RestartProcess: FailedAfterMutation + journal), never a cleanup-safe rejection; candidate/orphan/inline close throws stop the ladder; candidate jobs joined before their DB closes	close-throw-Fatal + no-rename pins; known-negative N2 (5 pins red); candidate-join order pin
6 — complete teardown	Strict clears the outgoing VMStore + joins the lifetime BEFORE close (unjoinable → Fatal, no close); graph-only publishes N+1 only after N's teardown boundary	probe-VM + DB-job order-recorded pin; unjoinable→Fatal pin; teardown-before-publish pin (both observers see Transitioning, never N+1)
7 — admission	Lease at doWork's FIRST op (factory captures nothing; never-started worker holds nothing); UI retire CAS atomic with the zero observation; snackbar queue generation-tagged (discard on commit / preserve on abort)	never-started-no-lease + doWork-time-binding pins; order-sensitive unconfined acquirer; the 4000-iteration retire-CAS hammer; kit epoch pins + known-negative N3
8 — Fatal terminal	Liveness rechecked inside the mutex; queued/post-Fatal ops do nothing and return Fatal; publishTransitioning cannot overwrite Fatal; deferreds complete exactly once incl. internal CE; phase-aware Fatal dispatch (a did-nothing transaction runs no compensation)	A-Fatal-while-B-queued; replace/reinitialize-after-Fatal; CE-in-preflight deferred-resolves; no-op-Fatal-no-compensation pin

Adversarial verification round (§21.2a): a 4-lens pass (protocol interleaving / mandate compliance / test vacuity / caller semantics) ran pre-submission; every confirmed finding is fixed in e9886497 — terminal-effects-under-the-mutex, phase-aware Fatal dispatch, the RecoveryRetryPending no-boot-loop outcome, staging debris, and five test-vacuity holes hardened into discriminating pins. One deliberate residual documented (anomalous RestartProcess close-throw journal window, §21.2a).

Verification (forced): host battery 3265/3265, 2648/0; device Regression 78/0 + Smoke 43/0 (API-34, re-run on the hardened protocol); detekt/lint/lint-rules green, zero suppressions added; :core:data:backup:api iOS compile green. Known-negatives N1/N2/N3 executed red and reverted — XMLs committed beside the evidence README.

Spec §8/§9/§11.3/§17/§18/§20 truth-passed against the new protocol (the round-1 record carries a supersession banner). PR remains a draft.

[stslex]

Round-3 REQUEST_CHANGES addressed — five bisect-green commits on the same draft PR. The durable record is now attempt-scoped and every gate is a real barrier. Governing text: §8.4 / §8.5a / §8.5b rewritten in place; §22 is the round-3 record with each test's exact proof boundary and a crash-point table.

#	Blocker	Fix	Pinned by
1	restore_mutation_interrupted was written only by terminal effects, so a death after close-start left the OLD valid DB with no marker → the cold-start peek published a false RestoreSuccess	Attempt journal: Prepared persisted atomically pre-PONR with identity + context + reserved rollback path; Committed only after the rename succeeded AND the reservation was promoted; owner-only transitions; legacy/unparsable read as Prepared	a PREPARED attempt never peeks the schema and never claims success (+18 repository tests). KN R3-A reproduces the false success on demand
2	every non-commit rollback collapsed into one retry outcome, after which chores armed and the main UI showed over an unknown DB	RetrySafe (proven pre-PONR, DB intact) vs RecoveryRequired (post-PONR/closed/fatal → RouteToRecovery, arming zero DB-bound work)	RecoveryRequired routes to recovery and arms ZERO db-bound work (planner, recoveryBootstrap, cleanupTempFiles each exactly = 0)
3	preserveCurrentDb() ran pre-submission, outside the mutex, onto ONE canonical path	reservation taken inside the transaction, per-attempt, recorded in the journal, promoted on commit, discarded only by its owner; preserveCurrentDb deleted	reserve-inside-the-transaction, rejected-attempt-keeps-the-previous-slot (sentinel bytes), promote-on-commit, swap < promote < record ordering
4	UI gate counted attachments (ABA-prone) and admitted from an EFFECT — i.e. after the region's children had already resolved	token gate with atomic retire; admission during composition via RememberObserver; Store jobs parented to the generation lifetime; onCleared ends the Store	ABA test a counter cannot pass; the rewritten retire-CAS hammer; a real BaseStore.launchDefault whose DB-touching finally completes before cancelAndJoin returns. KN R3-C
5	epoch advanced AFTER publish; requeue re-stamped the current epoch; resolve accounting was a non-atomic RMW with no fence	advance before publish; the epoch travels with the model and requeue preserves it; one linearizable gate; fence closes admission atomically with the zero observation	five snackbar tests + the snackbar epoch advances BEFORE the successor is published. KN R3-B
6	buildGeneration cancelled a partial candidate and closed its DB immediately	one teardown path: clear → cancel + bounded JOIN → close only after the join → any failure stops the ladder with no later rename	candidate-jobs-joined-before-close and partial-construction-joins-before-closing-the-orphan, both order-recorded with a DB-touching finally

The adversarial review earned its keep. A fresh-context pass over crash ordering, concurrent asset ownership, admission and test vacuity confirmed eleven defects — two of which would have shipped as a bricked feature or silent data loss:

• an interrupted-but-committed rollback was re-driven, failed looking for the file it had already consumed, and left the attempt unresolved forever — refusing every future restore and undo with no in-app remedy;
• the recovery path erased the journal's pointer to the only copy of the true pre-attempt database, so a second interruption reverted the user past their own data;
• the ladder recorded the caller's attempt as committed for a rollback (the false-RestoreSuccess hole from another direction), and applied the older canonical slot instead of the attempt's reservation;
• promoteRollbackReservation deleted the undo slot before the move;
• UiAdmissionGate.admit leaked a grant across a losing CAS retry, handing a token to a generation the gate had already reported clear;
• a refused region was cached against the id alone, so an abort's same-id re-publish left the app blank.

It also showed three of my own new pins were not discriminating: the generation-job seam had no test (a one-token revert restored the defect with the suite green — the parameter is now required, making that a compile error), the promote-before-record ordering was unpinned, and the retire-CAS hammer could not observe its own gap (its racer tidied up before the assertion; it now keeps the token, and KN R3-C fails it at iteration 29).

One more hole was found by a gate, not by the review. Making generationJob required stops the argument being dropped, but not the value being wrong — remember { null } still compiles and still un-parents every Store job. The device Smoke run surfaced it indirectly by going red for an unrelated-looking reason: :core:ui:mvi's probe deliberately builds a Store with no app graph, and the processor now legitimately needs one app-scope binding, so its plain Application failed the appDeps cast.

The tempting fix was a ?: null fallback in rememberStoreProcessor. It would have compiled, turned the gate green, and re-opened precisely the defect blocker 4 exists to prevent — the strictness of that cast is what forbids a Store from silently starting un-parented jobs. So the probe supplies the contract the way production does instead (an applicationContext implementing AppDepsHolder, overriding only LocalContext so the scope invariants under test are untouched), and a new device test ends the lifetime the holder handed out to prove the seam supplies the real parent. §22.3b carries the reasoning and the proof boundary.

Known-negatives executed red and reverted, XMLs committed: R3-A (ignore the attempt phase → false RestoreSuccess, 7 coordinator tests red), R3-B (publish before the epoch advance), R3-C (two-step retire, dies at hammer iteration 29), R3-D (remember { null } for the generation job — red on the new seam pin while the scope test beside it stays green, which is why the gap outlived the review's first pass). Six further mutations run by the test authors each died to their own new pin.

Gates, all forced (--rerun-tasks --no-build-cache --no-configuration-cache): host battery exit 0 in 8m29s, 3265/3265 executed, 2688 host tests / 0 failures; detekt + :lint-rules:test exit 0 with zero new suppressions (the LargeClass pressure from these fixes was resolved by extracting GenerationQuiescer, not silenced); Paparazzi in the graph with zero golden movers; device Regression 81/0, Smoke 44/0, and the Room same-instance characterization 2/2, unchanged in what it proves. Affected KMP iOS modules compile; link and runtime stay honestly unverified — no iOS host exists before Phase 7.

Everything else is unchanged: Android production stays RestartProcess, no Phase 7 work, and no swappable DAO/repository indirection — the only repository touched is RestoreStateRepository, the journal's own persistence surface. Six commits, each green when authored; the seam commit carries the probe fix so the device Smoke gate is green from that commit onward rather than only at the tip.

PR remains a draft.

[stslex]

Round-4 maintainer correction addressed — four bisect-green commits on the same draft PR. §8.4/§8.5a/§8.5b rewritten in place; §23 is the record with the per-death-point crash-state matrix (§23.2) and the adversarial-review record (§23.5). Every mandated test was proven RED at 936ab699 (new test files onto a worktree at that commit; raw XMLs committed as r4-red-on-base-*.xml) and is green at head.

Blocker	Fix	Red-on-base pin
A — promotion moved the reservation before durable Committed; explicit-source misses silently fell back to another attempt's canonical; consumeSource deleted the canonical instead of the exact applied file; keepReservation missed rejected-with-failed-compensation	copy-based promotion (the journal-named file survives every crash point; deleted only after the record, with idempotent committed-cold-start cleanup); journal-named sources AUTHORITATIVE (typed rejection, never substitution); typed SourceConsumption (exact-file consumption); reservation kept on every unresolved-journal outcome	promotion COPIES… (real files, sentinels, the impl suite); a MISSING journal-named rollback source is a typed rejection…; an explicit rollback applies and consumes EXACTLY its named source…; a rejection whose terminal compensation fails KEEPS the reservation…; ladder recovery whose reservation VANISHED goes Fatal…
B — RejectedBeforeMutation from the recovery rollback read as "safe retry": planner armed, observer armed, Main UI over a file whose original Prepared mutation state was unproven	RetrySafe REMOVED — every non-commit rollback outcome is RecoveryRequired (zero DB-bound arming, no Main UI, assets + journal preserved). The graph-only reinitialize over an unresolved Prepared journal now aborts, per locked invariant 4	every non-commit rollback outcome requires terminal recovery (rejection case) + the zero-arming processor pins
C — the legacy marker was broken both ways: the legitimate synthetic owner was REFUSED (its unchecked claim left the mutation unjournaled and the recovery failing its own bookkeeping) while ANY arbitrary attempt id could erase the marker through resolveAttempt	atomic legacy→owner-scoped conversion under exactly the synthetic id; resolveAttempt requires that id; ScenarioOneRollbackEffects CHECKS its re-claim; legacy Prepared → rollback → Committed → resolved end-to-end	repository: only the synthetic legacy owner claims… + the flipped arbitrary-resolver pin (real DataStore); coordinator: the recovery re-claim CHECKS ownership… + the legacy end-to-end
D — "publishing the candidate anyway" after a failed post-PONR teardown; the candidate-teardown verdict discarded on the preflight-fail path; the partial-build join verdict ignored for shared-DB candidates	a failed teardown/join is TERMINAL: best-effort remaining cleanup → aggregate → Fatal — no publication, no epoch advance, gates closed; tearDownCandidate == false → Fatal, never a republished N; PartialCandidateUnwindException makes the failed unwind distinct from an ordinary construction abort	mandated tests 7–10, all red on base
E — handleRestoreSuccess resolved the journal BEFORE marking undo availability (a death between hid a valid undo forever); the committed-rollback replay unconditionally revoked the previous restore's undo; retained reservations leaked	replay-safe ordering everywhere: data-bearing writes first, resolve LAST; ground-truth availability (canonical file existence); idempotent retained-reservation cleanup; the at-most-once rollback-dialog residual documented with its exact boundary (§8.5b)	success finalization is data-bearing-first…; a finalization failure never leaves the journal resolved with the undo hidden (mandated test 11); …keeps the previous restore's still-valid undo; …cleans up the RETAINED reservation copy idempotently

The mandated fresh-context adversarial review earned its keep (4 hunts: crash ordering, source-owner identity, teardown return values, outcome truth/vacuity). Production RestartProcess checked clean on every prong; the confirmed findings — all RebuildInProcess-scoped — are fixed in e9459025, each pin proven red against the pre-fix production (r4-review-red-prefix-*.xml):

• CRITICAL: the inline scenario-1 rollback dropped its submitted sourcePath and hard-coded the canonical slot — a journal-named reservation was ignored while ANOTHER attempt's older snapshot was applied and consumed. It now runs the same source policy as the top level, and runs onBeforeMutation before mutating, so a death inside the inline mutation replays truthful Prepared/Rollback bookkeeping instead of a false RestoreSuccess.
• HIGH: the post-clean-commit ladder recovery rolled back while the journal still read Committed — the very next preflight published RestoreSuccess for rolled-back data, no crash required. The recovery now durably UN-commits first, applies without consuming, and grants one bounded fresh attempt after an inline re-recovery.
• Plus: ground-truth undo availability in the settings effects, terminal OrphanCloseException handling for the generation-1 build, and a bounded ViewModelStore clear so a wedged main dispatcher cannot hang the machine inside the mutex.

Known-negatives (executed red, reverted, XMLs committed): R4-A explicit-path→canonical fallback re-enabled; R4-B "publish the candidate anyway" restored; R4-C the invalid safe-retry classification restored.

Gates (all forced): host battery exit 0 — 2712 host tests / 0 failures, 3265/3265 executed, zero Paparazzi movers; detekt + :lint-rules:test exit 0 with zero new suppressions (verified by diff: no @Suppress added, no config/baseline touched); device API-34 Regression 81/0, Smoke 44/0, Room same-instance characterization 2/2 unchanged; affected KMP iOS compile exit 0 — link/runtime honestly UNVERIFIED (no host before Phase 7).

No Phase 7 work; no swappable DAO/repository indirection; deliberate residuals with exact boundaries in §23.4. PR remains a draft.

[stslex]

R4.1 final correction addressed — two commits (39e9155c + the docs commit) on the same draft PR. Spec §24 is the record; every new pin ran red at 7c82c368 (r41-red-on-base-*.xml) or against the executed-and-reverted unbounded-clear mutant, and is green at head.

Blocker	Fix	Red pin
1 — a committed canonical rollback stayed repeatable after a record→consume crash: the replay read the surviving canonical as "a valid previous undo" and left the same rollback offered again — replaying it after later writes would erase them	the RecoveryCompleted finalization is SOURCE-AWARE from the journal's own rollbackSnapshotPath discriminator (null = the canonical was applied → finish its consumption idempotently + clear availability; non-null = consume exactly the named file, preserve a surviving canonical and its availability, clear only if the canonical is actually absent) — never inferred from file existence; resolve LAST; the branch replays idempotently on any mid-way failure	a committed CANONICAL-sourced rollback consumes the canonical — the same undo is never offered again (consume → clear → resolve order + second-launch NoOp); a committed-rollback finalization failure keeps the journal — the replay is idempotent; the explicit-source pair (A consumed, B + availability survive; A-with-no-canonical clears)
2 — a requested rollback's successful retry was committed as anonymous compensation: the canonical was consumed while the real journal stayed Prepared/Rollback, and the next preflight — an unresolvable Prepared attempt with no source left — went Fatal	the retry commits through the ORIGINAL effects: Committed recorded before the exact-source consumption; a failed record keeps the asset and the unresolved journal, surfaced on the outcome (never a clean Completed); same bounded ladder; outcome Completed, never RecoveredByRollback. Anonymous compensation remains only for the rollback of a failed Restore, where recording the Restore as committed would be false	the composed pin with a journal-aware production-shaped preflight: two swaps and no third, onMutationCommitted before the consumption, the preflight observes Committed/Rollback, a Serving successor publishes, terminal effects exactly once, clean Completed; plus the negative bookkeeping case
3 — the inline rollback closed the candidate database before its ViewModelStore was cleared or its lifetime joined: a candidate job's DB-touching finally could run against the closed handle	inline invalidation routes through THE candidate teardown protocol (a suspend disposal callback backed by tearDownCandidate(candidate, close = true)): claim → invalidate → VM clear → cancel + bounded join → close → only then swap; candidateDisposed prevents a second teardown; a failed clear/join/close is Fatal with zero renames after, nothing published, journal and assets preserved	the order pin (VM clear / job finally → close → swap, exact source applied and consumed); an UNJOINABLE candidate stops the inline rollback FATAL — zero renames after admission (bounded, epoch unchanged, admission retired)

The missing liveness proof: the previous immediate-throw test could not distinguish clearStoreBounded from the old unbounded withContext(mainDispatcher). The new pin uses a dispatcher that ACCEPTS but never RUNS the clear, with the transition on an advanceable scheduler: after the drain budget the submitted deferred completes, the outcome and runtime are Fatal, no successor publishes, the epoch does not advance, UI admission stays retired, and the worker acquirer wakes and fails loudly. The old implementation was executed as a mutant and hangs this test to its timeout (known-negative-r41-unbounded-clear.xml), then reverted.

Truth pass (also folded into the spec/README/PR body): the round-4 red-on-base evidence is 21 failures total (20 named + 1 parameterized invocation); the crash-state matrix is explicitly a composed proof (no literal two-launch process-death integration test exists) and now carries the Committed canonical rollback: record → consume death row; §23.4's null-source residual covers any Prepared attempt (legacy, interrupted canonical-sourced rollback, torn write); and the claim that a committed rollback's source identity "cannot be known" is removed — rollbackSnapshotPath is the durable discriminator.

AppRuntime re-crossed the LargeClass ceiling from these fixes; the cohesive non-publishing pieces moved to ReplacementMechanics/RuntimeGeneration.kt — no suppression anywhere.

Gates (all forced): host battery exit 0 — 2720 host tests / 0 failures, 3265/3265 executed, zero Paparazzi movers; detekt + :lint-rules:test forced, exit 0, zero new suppressions; device API-34 Regression 81/0, Smoke 44/0, Room characterization 2/2 unchanged; affected KMP iOS compile exit 0 — link/runtime honestly UNVERIFIED.

PR remains a draft.

[stslex]

R4.2 addressed — two commits (f2d3c81a + 85a3e48f). Spec §25 is the record; §8.4's terminal-selection and §8.5a's durable-commit-ordering paragraphs rewritten in place.

Blocker A — pre-durable commit failures were dispatched as committed terminals. commitMutation conflated "the file mutation happened" with "the mutation became durably provable": a promotion or onMutationCommitted failure returned Completed(effectsError), and runTerminalEffects dispatched onCommitted for every Completed — the production committed effects then resolved the still-Prepared attempt, cleared undo availability, published success and acknowledged the initiating action, erasing exactly the state §8.5a's conservative recovery depends on. The protocol phase is now EXPLICIT (CommitResult.Durable | NotDurable), and every one of the four call sites maps NotDurable to a non-committed continuation:

• RestartProcess → FailedAfterMutation: journal Prepared, reservation retained, next launch recovers;
• RebuildInProcess primary → the bounded recovery ladder: a restore rolls back onto its kept reservation (deterministic RecoveredByRollback; no candidate ever serves the unprovable file), a requested rollback retries its source and durable record once;
• recovery commit → persistent record failure ends Fatal with journal and assets preserved;
• inline scenario-1 → FailedAfterMutation: feedback allowed, no resolve, no clear.

The only remaining origin of Completed.effectsError is a failure OF the terminal onCommitted callback after a durable commit — a different phase, never conflated. Caller mappings reconcile by construction: a pre-durable failure can no longer become Succeeded/RestoreSucceeded/clean Success anywhere.

Production-shaped proofs — all eight pins red at 83793531 (r42-red-on-base-runtime.xml): the persistent-record retry whose REAL committed terminal (resolve/clear/publish/ack) is never invoked while Prepared + source + availability survive into a bounded Fatal; the one-shot requested-rollback failure (exactly ONE committed terminal — the base dispatched a stale SECOND from the record that never landed); promotion failure under both policies; the inline record failure that cannot erase the Prepared journal; the focused durable-phase-selects-terminal pin; and the two rewritten legacy pins. The one-shot RESTORE proof was the adversarial review's one confirmed finding (vacuous against a targeted divert-gating mutant) — strengthened with the swap-before-preflight and clean-effectsError axes, after which it too is red on base (§25.1). KN R4.2 (the old dispatch restored on the retry path) kills the production-shaped pin (known-negative-r42-predurable-dispatch.xml); reverted, empty diff.

Blocker B — the zero-suppression claim is true again. The one @Suppress("UNCHECKED_CAST") added by 39e9155c is removed via a typed ProbeViewModelFactory (Class.cast), the pre-existing sibling factory converted with it, and the claim verified against the FULL range: git diff -U0 936ab699..HEAD -- '*.kt' adds no suppressions.

Liveness truth. The wedged-main pin now uses a REAL queueing dispatcher (runnables retained), and after the Fatal verdict it EXECUTES the abandoned clear — the documented residual proven literally: the late clear changes nothing. The unbounded-clear mutant was re-executed against this exact test — it fails it at the deferred-completion assertion (known-negative-r42-unbounded-clear-queued.xml) — and reverted.

Gates (all forced): host battery exit 0 — 2725 host tests / 0 failures, 3265/3265, zero Paparazzi movers; detekt + :lint-rules:test forced, exit 0; device API-34 Regression 81/0, Smoke 44/0, Room characterization 2/2 unchanged; affected KMP iOS compile exit 0 — link/runtime honestly UNVERIFIED. A fresh-context 4-hunt adversarial review ran over durable-phase dispatch, every commitMutation call site, caller mappings, and test vacuity/evidence truth; its outcome is in §25.4 — no invariant counterexample; the one confirmed vacuity finding is fixed above; the canonical-integrity observation is on record as a named residual.

PR remains a draft.

[stslex]

@claude review

[claude]

Claude finished @stslex's task in 11m 13s —— View job

---

Claude finished the review

Todo list

• Gather context (PR body, spec doc, changed files)
• Read governing spec (documentation/feature-specs/kmp-phase-5-startup-processor.md) §8.4/§8.5a/§8.5b/§25
• Review core runtime files: AppRuntime.kt, ReplacementMechanics.kt, StartupProcessor.kt, RuntimeGeneration.kt, GenerationQuiescer.kt
• Review RestoreStateRepositoryImpl.kt (journal / attempt durability), DatabaseReplacement.kt, DatabaseSnapshotProviderImpl.kt
• Review UI admission / snackbar generation code (SnackbarManager.kt, BaseStore.kt, StoreProcessor.kt)
• Review recovery coordinator / backup domain (RestoreRecoveryCoordinator.kt, RestoreLatestBackupUseCase.kt)
• Post final review

Summary

I checked the PR's own protocol claims against the code (not just the description), focusing on the durable-commit dispatch (CommitResult.Durable/NotDurable), PONR/teardown terminality, Fatal terminality, the attempt-journal reservation lifecycle, and generation-tagged UI/snackbar admission. Those core invariants hold up — I traced all four commitMutation call sites and confirmed NotDurable never becomes a committed terminal, and the snackbar epoch-fence/admission gate uses a real atomic CAS (updateAndGet), not a check-then-act race.

I did find a few real issues, none of which block the protocol's core correctness claims:

1. [Major] Crashlytics reporting silently skipped for the dominant recovery path — feature/recovery/src/main/kotlin/io/github/stslex/workeeper/feature/recovery/domain/RestoreRecoveryCoordinator.kt:165. runPostRestoreLaunch()'s fallback branch — a Prepared/unknown-phase attempt, i.e. the process died mid-restore before committing, exactly the scenario the attempt journal exists to catch — calls recoverFrom(attempt, context, cause = null). Inside recoverFrom (line 187), reporter.recordRestoreTimeFailure(...) only fires if (cause != null && context != null) (line 192). Since cause is hard-coded null here, this non-fatal never reaches Crashlytics for the primary interrupted-restore case — it only fires for the narrower "attempt already Committed but the post-commit schema peek unexpectedly throws" branch (line 115). Verified against the diff and the test suite (a PREPARED attempt never peeks the schema... makes no assertion about reporter). Worth synthesizing a placeholder Throwable so the non-fatal still records with real context.

2. [Minor] Asymmetric re-entrancy guard, latent deadlock trap — app/app/src/main/java/io/github/stslex/workeeper/runtime/AppRuntime.kt:434-476. rollbackToPreRestoreBackup checks coroutineContext[ReplacementTransaction] / GraphOnlyTransition.Key to detect a call from inside its own transaction and route it inline (avoiding a deadlock on the non-reentrant transitionMutex). restoreFromSnapshot (line 434-438) has no equivalent guard and goes straight to replace(...). No current caller invokes it reentrantly, so it's not live today, but nothing stops a future preflight path from doing so and self-deadlocking on transitionMutex. Worth the same guard or a defensive check().

3. [Minor] Over-broad visibility on transition-only snackbar controls — core/ui/kit/src/main/kotlin/io/github/stslex/workeeper/core/ui/kit/snackbar/SnackbarManager.kt:118-157. fenceResolves(), unfenceResolves(), and advanceGenerationEpoch() are public (the sibling requeue/beginResolve/endResolve are correctly internal). They appear public only because the runtime orchestrator lives in a different Gradle module; any feature module can currently call fenceResolves() without a matching unfenceResolves() and deadlock every future snackbar app-wide, or call advanceGenerationEpoch() and silently discard in-flight toasts. Consider a narrower visibility boundary (e.g. a runtime-only internal interface).

4. [Minor, documented risk] generationJob capture fragility — core/ui/mvi/src/main/kotlin/io/github/stslex/workeeper/core/ui/mvi/processor/StoreProcessor.kt:72-74. remember(context) { context.appDeps<StoreGenerationDeps>().appScopeLifetime.job } is correctly invalidated today only because every Store-resolving composable happens to sit inside App.kt's key(currentPhase.id) block; context (the Activity) itself doesn't change on a graph-only swap. A future call site composed outside that boundary would silently capture an already-cancelled parent job (jobs launched in it would silently no-op). Not exploitable today, but the invariant isn't documented at this call site the way the analogous LocalViewModelStoreOwner hazard is on AppFeature.kt.

5. [Nit] stageRestoreSource ignores a failed cleanup delete — app/app/src/main/java/io/github/stslex/workeeper/runtime/ReplacementMechanics.kt:149-163. After the copyTo fallback (cross-filesystem rename failure), source.delete()'s return value is discarded — a disk-space leak on delete failure, not a protocol-correctness issue.

6. [Nit] Dead field — core/data/backup/scheduling/src/main/kotlin/io/github/stslex/workeeper/core/data/backup/scheduling/RestoreStateRepositoryImpl.kt:90,138. KEY_LEGACY_MUTATION_INTERRUPTED is written/cleared but never read by getAttempt(); harmless (legacy synthesis conservatively always reads Prepared anyway) but the stronger pre-R3 signal it once carried is now silently discarded.

7. [Nit] Stale doc comment — app/common/src/main/kotlin/io/github/stslex/workeeper/App.kt:87. Still refers to "The DisposableEffect is the runtime's Quiescing signal," but the actual signal is GenerationAdmission : RememberObserver (onForgotten/onAbandoned) — no DisposableEffect exists there anymore.

One agent flagged a "cold-start currentGeneration double-build/leak race" as a candidate Major finding; I traced it by hand and it does not hold up — synchronized(buildLock) (AppRuntime.kt:215) is genuine JVM mutual exclusion (not a check-then-act race), a second thread blocks until the first either publishes or throws, and isFatal cannot become true before generation 1 exists (nothing sets it pre-cold-start). I'm not including it as a finding.

Not re-litigated: the previously-documented residuals the PR body already discloses (the null-source Prepared recovery case, the mid-copy promoteRollbackReservation partial-write residual named in spec §25.4, the saveable-slot one-frame death window) all check out as described in code — I didn't find anything beyond what's already disclosed there.

Given this PR's own extremely thorough multi-round adversarial process, none of the above look like blockers for the underlying protocol; #1 (Crashlytics gap) is the one I'd actually want fixed before merge since it's a real production-observability regression for the most common recovery path.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85a3e48f07

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Block access after a generation's database closes

Under ReplacementPolicy.RebuildInProcess, executeRebuildTransaction closes the outgoing database while leaving currentOrNull pointing to that generation and isFatal false until a successor or fatal outcome is published. During that interval, any direct holder read through BaseApplication.appGraph returns the closed generation; there is also a check/use race if publishFatal runs after this check. The UI and worker gates do not protect other graph-holder readers, so they can resolve repositories backed by a terminal Room instance. Track the post-close state atomically and make this accessor fail instead of returning the outgoing generation.

Useful? React with 👍 / 👎.

[stslex]

Verified — the mechanism is real, but the scope inverts what the fix should be.

Under RebuildInProcess the window you describe is narrow: executeRebuildTransaction closes at AppRuntime.kt:549 and republishes or goes Fatal within the same mutex hold.

On production it is much wider, and deliberately so. BaseApplication builds the runtime with the default ReplacementPolicy.RestartProcess, and runRestartProcessSwap never calls publishTransitioning(), never quiesces, and never retires the UI — it closes the database, swaps the file, and returns Completed(generation = null). The runtime stays Serving(outgoing) over a terminally-closed Room handle, and BackupClickHandler.scheduleAppRestart() then waits RESTART_DELAY_MS = 2_000 before AppReinitializer calls Runtime.getRuntime().exit(0). So the real exposure is ~2 seconds of live UI over a dead handle, plus an open workerGate in that window, since close() is only ever called from GenerationQuiescer.quiesce.

That is not a regression from this branch. The pre-split restoreFromSnapshot closed the live database itself — its old KDoc said so, and told the caller it must restart — and §8.4 line 327 states the intent outright: RestartProcess "preserves shipped behavior exactly: no Quiescing".

So making currentGeneration fail after close would not protect the path that is actually exposed; it would only tighten a path Android never takes. The accurate response is to record the production window as a named residual in §18 alongside the saveable-slot one, rather than to harden the accessor.

[stslex]

Automated review pass (Claude Code) over the full branch: 12 area reviewers, each finding then put to two independent refutation lenses, and every surviving item re-verified by hand against the tree.

Gates reproduce green locally: detekt 0 issues, 751 unit tests across app:app, core:ui:mvi, feature:recovery, feature:settings, core:ui:kit, 0 failures/errors/skips.

The comment trim is clean. Of 22,671 deleted lines exactly 5 survive a non-comment filter, and all 5 are benign: three are lines whose trailing comment was shortened (AppTheme.kt:41, AppRuntimeTest.kt:373, UiLayerNoDataRule.kt:54 all keep their code) and two are the KDoc-only imports the commit message already names. That matches d8a44658b's own claim, independently.

Three findings already have fixes written (staged locally, not yet pushed to this branch, so they are not visible in the diff above): the Scenario-1 recovery export, the anchors the trim invalidated, and the AppCoroutineScopeImpl entry the spec contradicted itself about.

The three inline comments below are what is left. All three are Phase-7 / instrumentation scoped, not Android production, because GenerationQuiescer, workerGate.close(), uiGate.awaitRetired and the snackbar fence have no reachable Android call site — every one sits inside runGraphOnlyTransition (iOS-only caller) or the RebuildInProcess ladder, exactly as §1 line 763 grep-pins.

One finding was raised and then refuted by both lenses, recorded so it is not re-raised: "an in-process Fatal strands AppUiPhase.Transitioning forever." It does not hold on production — publishTransitioning() is never called on the RestartProcess path at all.

[stslex]

Fenced refusal requeues with no suspension point — flagging this one as needs settling, not as a confirmed defect, because my own trace disagrees with the two reviewers that raised it.

When beginResolve() returns false the model goes straight back on the queue and the function returns. The App.kt collector then receives the same model immediately, so the refusal path is a loop with nothing in it that yields.

Why it probably does not bite: the fence only goes up inside GenerationQuiescer.quiesce, which runs uiGate.awaitRetired first — and that cannot succeed until the generation region is forgotten, which is the same main-frame event that cancels the LaunchedEffect holding the collector. A cancelled collector should die at its next receive() rather than spin.

Why it might: receive() on a channel with an element already buffered can take a fast path that does not check job cancellation, and the ED11 deferred delete runs under NonCancellable, so there is a real window where the collector is cancelled-but-running.

Settling it needs a pin, not a patch — a test that fences with a non-empty queue and a cancelled collector and asserts the collector terminates. Unreachable on Android today either way (fenceSnackbarResolves has no production call site), so this is a Phase-7 obligation rather than a merge blocker.

[stslex]

selectRecoverySource cannot tell "exact-file source was not applied" from "it was applied and only the durable record failed."

Both arrive here with reservation == null and consume = ExactFile, and the branch stops unconditionally. So an explicit-source requested rollback whose onMutationCommitted throws once — a transient DataStore write failure — goes Fatal instead of taking the one bounded source-and-record retry §8.4 mandates for a requested rollback.

Concretely: an interrupted restore leaves attempt A Prepared naming reservation R; recoverFrom calls rollbackToPreRestoreBackup(sourcePath = R, ...); the swap succeeds; recordAttemptCommitted(A) throws; commitMutation returns NotDurable; recoverViaRollback lands here and stops. The live file already holds the correct pre-restore image at that point, so Fatal is stricter than the protocol requires.

One of the two lenses refuted this on the grounds that stopping is the conservative reading of §8.5a — which is defensible. Recording it because the reason the branch stops is a lost distinction, not a decision: MutationPlan carries no flag for whether replaceLiveDatabaseFile already succeeded, so the code could not take the retry even if the protocol wanted it to.

RebuildInProcess only, so no Android production impact.

[stslex]

The harness turns a real admission REFUSAL into a granted token, which makes the admission invariant untestable against a real AppRuntime.

runtimeDelegate?.admitUiGeneration(id) ?: StaticToken(id) — the elvis fires in two different situations that mean opposite things: no delegate installed, and the delegate answered null on purpose. The retiredIds guard above only covers harness-simulated retirement, not the real gate's verdict.

The consequence is concrete: mutate UiAdmissionGate.admit to always return null — the exact defect the invariant exists to rule out — and AppRuntimeUiHandshakeDeviceTest, the branch's only test that puts a real runtime behind the real shell, still passes, because the harness manufactures a grant. Against production wiring the same mutant blanks the app.

Secondary: that path also increments staticAttachments, so outstandingAdmissions(id) reports a grant the real gate never issued, and the harness's own leak accounting is wrong in the runtime mode where it matters most.

Fix shape: distinguish the two cases — if (runtimeDelegate != null) return runtimeDelegate.admitUiGeneration(id) before the static fallback.

[stslex]

Bot review triage (automated verification pass)

Every item from the @claude review above reproduced against HEAD and classified per the merge-flow rule. Six of seven still stand; one is already closed.

#	Bot finding	Class	State
1	Crashlytics skipped for the dominant recovery path	correct — and new	open
2	Asymmetric re-entrancy guard on restoreFromSnapshot	correct, not live	open
3	fenceResolves / unfenceResolves / advanceGenerationEpoch are public	correct	open
4	generationJob capture fragility	correct — already decided	open, documented
5	stageRestoreSource discards a failed source.delete()	correct, nit	open
6	KEY_LEGACY_MUTATION_INTERRUPTED is write-only	correct	open
7	Stale DisposableEffect KDoc in App.kt	correct	fixed

1 — reproduced exactly. RestoreRecoveryCoordinator.kt:97 calls recoverFrom(attempt, context, cause = null) and the reporter at :106 is gated on if (cause != null && context != null). The Prepared/unknown-phase branch is the interrupted-restore case the attempt journal exists to catch, and it is the one that never reaches Crashlytics; only the narrower "already Committed but the schema peek threw" branch at :70 passes a non-null cause. No test asserts on reporter for the Prepared path, so nothing catches it either. This is the one I would want closed before merge — it is a production-observability hole on the most likely recovery path, not a code-correctness issue.

3 — reproduced. fenceResolves() :83, unfenceResolves() :94, advanceGenerationEpoch() :117 are public while their siblings requeue() :66, beginResolve(), endResolve() are internal. The asymmetry is real and the failure mode the bot names is real: an unpaired fenceResolves() from any feature module wedges every future snackbar app-wide, because unfenceResolves() is the only thing that clears the gate.

6 — reproduced. KEY_LEGACY_MUTATION_INTERRUPTED appears only at :63 and :106, both prefs.remove(...). The read at :47 is KEY_LEGACY_RESTORE_IN_PROGRESS, a different key. Harmless today because legacy synthesis conservatively reads Prepared regardless, so the entry is dead weight rather than a defect.

7 — closed, incidentally: the comment trim in d8a44658b removed the stale KDoc. The current text describes GenerationAdmission : RememberObserver correctly.

Not re-litigated: the residuals the PR body already discloses — the null-source Prepared case, the mid-copy promoteRollbackReservation partial write in §25.4, the one-frame saveable-slot death window in §18 — all check out in code as described. The pass found nothing beyond them.

One bot-adjacent claim I could not confirm and am recording as refuted: a reviewer raised "an in-process Fatal strands AppUiPhase.Transitioning forever, so the app is a permanent blank screen." Both refutation lenses killed it and I agree: publishTransitioning() has no reachable call site on the RestartProcess production path, so the state is never entered on Android.