[RCmerci]

Summary

Move every OCaml bridge entry onto one process-lifetime serial thread. Worker wakeups now advance application state/feed planning without waiting for SwiftUI work; the LUI backend and platform facade remain on MainActor.

• Copy patches into a generation-fenced FIFO; pop one item at a time so nested event delivery cannot reorder batches.
• Pause admission of new autonomous pumps across synchronous UI transactions, including nested patch application. Core callbacks never wait for UI.
• Read bridge failure reasons on the calling core thread. Retain failed-stop cleanup responsibility in the executor; reject live-owner replacement and make retired facades' late stops harmless.
• Preserve the existing 11 startup/barrier scenarios and add two deterministic thread/FIFO/deferred-wake/retired-generation and failed-stop lease cases. Align both pre-existing event-adapter stubs with the production adapter's nonisolated contract; no assertions or scenarios removed.

Matched Release Simulator evidence

32 process-cold launches, 16 balanced adjacent pairs, same retained account/graph/cache/Keychain. Both variants import the identical native object and use the same LUI pin, Release configuration, SDK and toolchain. No profiler or recording in this cohort.

Median boundary	Baseline	Prototype
Process birth → first feed log receipt	2711.24 ms	2244.65 ms
main_raw → first feed receipt	1169.48 ms	689.73 ms
Feed scan → complete publication	1098.49 ms	119.40 ms

The primary feed-receipt improvement is 17.21%; all 16 pairs improve (paired median 18.06%). This is not a 17% visible-first-screen claim. Pre-main time does not improve. An earlier 32-run screen used a different native object and is excluded from attribution.

A separate 16-launch video-on ABBA cohort estimates useful sampled pixels at 2552.2 → 2452.9 ms; paired median 3.23%, conditional bootstrap 95% 1.33–4.67%. Capture-clock and uncalibrated framebuffer delays prevent a stable ≥3% visible-latency claim. Real cached-content cold start, read-only navigation, scrolling, Options/Diagnostics and two foreground returns passed; private recordings are not published.

Validation and limits

CI is green on the unchanged final head. The controlled rerun of run 42821387763, build-and-test job 129866433950, passed the complete gate, including the previously failing durable-delete case. The earlier deletion failure did not recur; its root cause remains unproven and is not classified as preexisting/flaky or fixed by retry. No deletion assertion, deadline or production logic changed. The scoped picker-fixture repair also passes; its forced hidden-menu probe establishes a selector ambiguity, not historical CI target selection. Existing local exact base/head controls and the original failed CI evidence are retained.

Final head: ef7f7916b18725b822bdba7eee9e82941e8c9770; all 35 production Swift input hashes match the measured candidate (86e587e). The two follow-ups change a test-only isolation annotation and scope the existing picker account-menu lookups; production bytes are unchanged. Full dune build @all app/native_embed.exe.o, dune runtest --force, 13 startup cases, 16 failure cases, graph-name feedback, native event ABI tests and diff hygiene pass locally. The initial CI caught the overlooked failure-harness stub annotation; its complete original matrix now runs unchanged. Independent read-only review of the production diff found no remaining confirmed blocker. New production lines have zero formatter diagnostics; pre-existing whole-file style diagnostics and six unchanged decision-document format errors remain.

Additional synthetic write/restart acceptance (Simulator). On the preserved encrypted/offline run-b fixture, one real Capture/Send passed canonical Timeline/Detail readback, then both readbacks after process restart with the same candidate binary, container, support root, fixture and memory-only keys. Documented temporary READWRITE preparation generated only WAL/SHM; the connection closed/exited before Capture, with main-DB hash/mtime and fixture/catalog unchanged. No post-write preparation, installation, copying or reseeding; no source changes. The oracle was final editor text frozen before Send, after iOS sentence capitalization; initial lowercase-input byte fidelity was not tested. Protected Lambda RTC remained untouched and passed its fresh empty-outbox gate. This is narrow local correctness evidence, not startup-performance, remote-sync or crash-durability evidence.

Unattributed UI observation: after Timeline scrolling, the top row overlapped its date header before and after restart. No matched-baseline comparison, attribution to owner isolation or fix was attempted; the write/readback pass is not blanket UI acceptance.

Experimental host-restamp remains cross_abi_validated=false. Device/target-native ABI, exact compositor/no-recording pixels, live-account writing/outbox/remote sync, cross-account/graph changes, fault-injected UI, crash/power-loss durability and long-background reclamation are not validated. Native stop acceptance is not a worker-Idle guarantee. This preserves the explicitly reviewed admission boundary, not byte-for-byte equivalence of all asynchronous schedules.

Based on #158's branch to keep this PR's diff limited to owner isolation; #158 itself is unchanged. No Dune/spec/interface or pinned LUI checkout changes.

Link to Devin session: https://app.devin.ai/sessions/7a5eed6555b64cd682e8abd3905c930f
Open in Devin Desktop: https://app.devin.ai/desktop/session/7a5eed6555b64cd682e8abd3905c930f?variant=devin
Requested by: @RCmerci

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T12:18:45.539079Z	86e587e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.