[RCmerci]

App/Worker requests previously relied on runtime ownership tables and loosely associated results. This PR implements the typed coordination boundary and migrates the App's read, durable-write, observation, media/Import and lifecycle paths onto the existing Worker Service/client. It includes the Sync, Worker, Overlay and storage changes needed to execute those contracts.

Implementation and ownership

• Add the independent, wrapped virtual library journal_worker_coordination / logseq_journal.worker_coordination under app/spec/worker_coordination/, with a Dune implements implementation under app/impl/worker_coordination/: worker_api, worker_pure_coordinator and worker_effect_runner.
• The pure coordinator handles request/resource lifecycles, identity and generation checks, response acceptance, cancellation, retry/release decisions, observation/changefeed coordination and handoff state. The runner performs client I/O, associates actual in-flight mailbox IDs and queues later events. It borrows the existing client and serial pump; there is no adapter, second transport or extra permanent Mailbox.on_event subscription. Application retains UI/navigation, authentication/catalog, client lifetime and business planning.
• Sync/Worker provide authoritative, versioned bootstrap registration/baseline/replay and unregister ACKs, covering resident phases, selection, deletion and usable sessions. Binding, worker, account, session and presentation identities remain distinct. Owned terminal responses, including errors and cancellation, have one consumer; broadcast pushes retain separate fanout.
• Typed reads preserve the actual Protocol/Graph_types DTOs, revisions, relationships, task properties, references and bounded continuations for Timeline, Favorites, Detail and Copy. Partial pages retain continuation/completeness information; Copy retains revision checks.
• Durable mutations use immutable intent identities and original commit evidence with presentation-bound Confirm/canonical readback. Atomic Append resolves or reuses the journal page, writes the complete block tree/statuses, outbox and commit proof in one transaction, including an already-created Web journal page. Mutation and Import recovery are read-only and paginated; acknowledgement retains original proof. Uncertain submissions retain their identity, and Unknown/unconfirmed outcomes cannot be acknowledged away.
• Import reserves recoverable inputs before preparation. Typed asset consumers, file leases, media versions and checked physical release ACKs retain the originating owner across scope changes. Empty observations remain registered; sampling/replay and change ACKs are coordinated with actual consumer application. Completed ownership records are reclaimed after their real return/creator/cleanup boundaries, avoiding lifetime request/resource quotas.
• Host handoff joins actual scoped writes, callbacks and resource settlement before consuming an owner/target/binding-scoped, single-use permission. Failed cleanup retains its obligation. Shutdown remains nonblocking. App lifecycle entry points use this boundary; migrated paths remove their obsolete legacy dispatch/pending ownership rather than consuming responses twice.

The spec library does not depend on the App. Compile-only consumers use the real App projection. Feed/Favorites/Detail/Capture planning and presentation remain with their business reducers.

Existing UI/UX and recovery

Preserve the existing screens, layout, navigation and interaction model. Remove the added pending-record Diagnostics sections, read-only/Retry recovery page, Detail observation error/retry controls and Closing graph… state. Non-network errors do not offer user Retry, and transient coordination states do not add UI. Safe recovery runs in the background while existing error/Diagnostics surfaces retain failures and durable evidence.

The final changes also fix preview presentation stopping the native runtime, late canonical replies invalidating a reopened Timeline prefix, and a rapid reopen click being overwritten by an unfinished close. Navigation retains the latest selection until actual settlement, recomputes current slots, and respects cancellation, sign-out and rebinding.

Validation at e6abcb613bcb6f99912d4307fec4011500226278

• Journal CI run 41737709323 passed for this exact head, including full build/native embed, full regression, and Swift/build boundary checks.
• Local final-source dune build @all app/native_embed.exe.o and forced dune runtest passed. The validated source hashes match the committed tree. Coverage includes pure unit tests and shrinking property tests, real Service/storage/protocol integration, 222 mounted App tests, 189 Runtime locality tests and 354 Sync tests.
• Interface/export and source-boundary checks passed, including 22 positive and 23 type-negative contract clients and three compile-only consumers using actual App projections. Native Swift runtime-failure/startup checks also passed.
• Independent read-only review of the final recovery/lifecycle changes found issues that were reproduced, fixed and re-reviewed; no unresolved P1/P2 remained in that final review scope.

Simulator evidence and limits

The final-source Simulator packages exercised real App views/reducers with isolated synthetic encrypted graphs, memory-only keys and blocked authentication. The normal package rechecked stored-image preview/open/return, Detail responsiveness, retained Task/image content and Copy feedback.

Four final-source fault scenarios used explicitly controlled backend I/O faults, with production App UI unchanged:

1. Execute a real local commit while discarding its replies: the draft remains editable; automatic confirmation preserves the next edit, the same intent/payload/proof and one outbox record.
2. Inspect Diagnostics during that pending submission: original sections remain, with no added pending-record list or local Retry.
3. Fail one real observation invalidation refresh: parent/child content remains usable, without a new error bar or Retry. Protocol/registration guarantees are also covered by integration tests.
4. Hold a real writer after commit: close uses the original picker; a single reopen click made before writer exit takes effect after actual settlement, with one record and no startup failure.

Additional, earlier-source Simulator runs covered Capture/Child Task creation, status/Delete, new-photo selection and Import, Favorites scrolling and graph switching/reordering. Those runs are distinguished from final-binary coverage; not every operation was repeated on the final package. Same-data base/head comparisons covered Timeline, Composer, the picker and Favorites; the large Favorites fixture produced a membership-read byte-budget error on base and a successful read on the candidate.

This is not exhaustive GUI or pixel-by-pixel parity proof. Real login, live online synchronization, real-account/graph behavior and iPhone execution were not tested. The Simulator uses an isolated warm-start host and experimental host-restamped native objects (cross_abi_validated=false), so it does not establish real-device ABI acceptance. Synthetic fault instrumentation, private evidence, app packages and real user data are outside the PR. No merge or release is part of this change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T08:14:29.854442Z	9e133d0	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e133d035f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Expose read-only accessors for page and block results

For a client implementing the specified Journal-to-Children read flow, Journal returns an opaque page with no way to obtain the UUID required by Children.parent; likewise, returned block values expose neither identity nor content for rendering. Inspecting the public interfaces shows no accessors or manifest type aliases for either type, so Core.reply and Core.observed expose typed containers whose contents clients cannot actually use. Add read-only identity/content accessors or private result records, and cover a positive client that reads a journal page, requests its children, and consumes their rendering fields.

Useful? React with 👍 / 👎.