[RCmerci]

Journal replaced distinct sync, storage and native failures with generic Diagnostics messages, making the reported applyAuthoritative.failed impossible to distinguish. Preserve bounded reason codes and safe technical context from each producer through the runner, worker/service and Swift Diagnostics. Also show graph-scoped Local tx (applied service checkpoint) and Remote tx (largest observed service transaction), using exact Int64 decimal strings.

Changes

• Preserve authoritative-integrity reasons, outbox kind/state and frozen-interval/count context without retaining datoms, attribute values or graph content. Keep validation, sync results, retries and commits unchanged; this PR does not claim to fix the original intermittent Capture failure.
• Preserve snapshot-state/checkpoint, storage/cache, upload/recovery, E2EE/crypto, HTTP/TLS/DNS and asset-decode causes. Scoped callbacks match exact live requests; terminal multi-consumer fanout retains the same deep cause while fresh work and retired scopes cannot inherit it.
• Carry finite native runtime/startup/props/scroll/event, attachment/Photos, Cognito/Keychain/binding and recovery causes across OCaml/C/Swift. Fence replaced callbacks by request identity and account/graph generations. Cancellation and existing recovery decisions stay intact.
• Reject unknown/duplicate/malformed diagnostic carrier fields and unbounded context. Unknown external failures become finite safe summaries; raw exceptions, body text, credentials, key material, account identifiers, file paths and URL queries are never displayed. Consecutive identical errors deduplicate, while A→B→A remains visible. Secondary cleanup failures remain support warnings without reversing primary success.
• Make Diagnostics reachable from account preparation failure. Change only the three approved diagnostic spec interfaces; no Dune or dependency changes.

Validation

• 729 OCaml Alcotest cases pass: application 148, worker runner 50, worker reducer 20, sync 327, overlay storage 86 and overlay sync 98. Worker service suite also passes.

• Swift owner tests and iOS source typecheck pass, including real OCaml/C/Swift runtime/crypto boundary fixtures. Build-helper suite: 55 run, 54 passed, 1 skipped. Isolated native display checks verify full integrity context, HTTP 503 and cursor precision; they are separate from normal-App sync acceptance.

• Final-source normal Simulator candidate 1.5877.6506 was installed as a data-preserving update and tested with the existing Web App on the designated synthetic test graph. Passed Capture→Web and Web→Journal creation, exact UUID/parent identity, remote edits while an append draft stays open, subsequent Journal child append, synthetic deletion/Undo restoring the same UUID, cold-start catchup without Capture, native Photos upload of a generated 32×32 image, Web image rendering and native full-screen preview. Timeline multi-day content/reselect-to-top, detail/back/copy and Diagnostics pass. Applied/observed tx progressed 933→949; final outbox is zero. No integrity failure was observed in these cases. Test blocks remain available.

• Final native/Swift source-input hashes match the tested product tree; strict app signature verification and git diff --check pass. Product code is unchanged after the 6506 acceptance. The existing wrapped-key crypto harness now verifies the precise authentication response, exactly one operation-matched terminal record, its failing stage and a nonnegative integer duration; existing opt-in/privacy/cap/recovery checks remain. This test-only correction reproduces and fixes the first CI run's stale generic-result expectation and passes locally.

• GitHub Journal CI passes on final head 3ce09ad0c515f06dfe26634f46a98661945364e9: run 259, including all-target build and full regression suite. Automated code review completed with no findings on product commit ac3dd2e; the subsequent commit changes only the existing crypto harness and its decision record, and has no new automated review result.

Limits

• Simulator native objects use experimental host restamping: cross_abi_validated=false; no release or TestFlight claim.
• The existing full PhotoSave file fixture has an executor ImageIO notImage failure also reproduced at untouched main. Owner-level checks and iOS source typecheck pass; the actual Simulator image upload/preview passed.
• Native existing-block body/status editing is not offered by the current detail UI. No normal in-App transport pause control was identified, so offline transport/recovery was not forced through OS network changes. Full pagination exhaustion, live login/sign-out/graph switching and injected real-graph failures were not tested; scope/cancellation/failure propagation use isolated owner fixtures. The Chrome upload channel needs extension file access; native attachment upload was tested instead.
• A closed-snapshot race has no deterministic public seam; guarded checkpoint-invalid and encrypted WorkerDB decrypt-failure→service full-chain execution are not claimed. Producers/consumers and reachable public snapshot-state cases are covered.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T06:50:16.601492Z	ac3dd2e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.