[RCmerci]

Summary

• Wake the owning graph after a durable mutation commits or replays, including when its caller retires during the commit.
• Expose the durable operation in submission descriptors. Send deletions individually while preserving normal mutation batching and order.
• Preserve a queued deletion when an earlier local mutation receives its own authoritative echo. Continue honoring genuine remote conflicts.
• Recover from typed precommit token/crypto supersession without stopping sync. Fence the exact pending request, retain newer observations, and preserve accepted/rejected server outcomes. Genuine crypto failures still fail normally.

Regression coverage

• Durable commit/replay wakeups, hidden resident graphs, retirement and failed commits.
• Delete first/middle/last, consecutive deletes, normal batch limits and dependency eligibility.
• Own append/save echoes followed by queued deletion, with same-batch and later real remote-conflict controls.
• Actual asynchronous encryption and ACK-admission races, hidden-resident routing, malformed/provider crypto controls, stale/duplicate completions and independently refreshed views.

Validation

• dune build -j 4 @all app/native_embed.exe.o: passed.
• dune runtest -j 4 --force: passed, 1,339 counted tests across 22 suites, plus uncounted standalone test executables.
• Independent read-only review: no supported findings on the final diff.
• Native isolated TLS/WSS acceptance: automatic encrypted Capture, immediate Capture then Delete, offline recovery, lost-ACK reconnect replay without duplicate insertion, and sequential convergence to a second independent client passed.
• Attachment transfer: real Worker import, AES-GCM HTTPS PUT 500 then explicit retry 200, GET/decrypt/checksum and byte-for-byte validation passed.
• Simulator local UI: in-place upgrade preserved all 10 queued records; Capture/Delete and two consecutive saves added 4 records; all 14 persisted across graph switch and cold restart. Manual Sync reached the deliberately unavailable-token error. Successful GUI network sync is not claimed.

Limits

• Uses only synthetic graphs and ephemeral test keys. No production account or graph was modified.
• The local test peer models the protocol and cursor barriers; it is not the deployed backend or its checksum implementation.
• Simulator runtime uses the maintained experimental host-restamp route, with cross_abi_validated=false; it does not certify physical-device ABI.
• Production OAuth/key retrieval, deployed backend compatibility, simultaneous cross-device edits, production WebSocket heartbeat timeouts and full attachment picker/automatic retry/metadata orchestration are not end-to-end verified.
• spec-dev-tool check --all could not run because the tool is unavailable in PATH and the prepared switch.
• No TestFlight release or deployment.

Validated base: 2bfb68d80e6c9909dd4e4d18d893104f5ac8067a.
Final reviewed diff SHA256: 685d053ae1f6cb846b689518d24125e586c3d48bb352d329772713b42a7452fc.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T08:53:02.863389Z	b26805b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.