[RCmerci]

Summary

Fix a cold-start race that reports invalidRequest / listTimelineDates with "Continuation does not belong to this query, session and budget".

The local timeline can begin paging before authentication restoration finishes. When account reconciliation replaces the Worker session, Expected-owner reads follow the replacement binding, but an embedded continuation still belongs to the previous execution. Retrying it with the new session and budget incorrectly turns a recoverable stale traversal into invalid input, even when the graph generation is unchanged.

Before dispatching an Expected read, validate the embedded continuation's original session. If that session has been revoked, return Stale_read so the existing business reducer restarts from its retained boundary without the expired cursor. Keep strict query, item-budget and byte-budget validation for continuations from the current session. Direct/Sealed ownership and cancellation checks remain unchanged.

Only the coordinator implementation and its existing pure regression test are changed. No public contract, Dune, Swift UI, dependency or personal graph changes.

Regression coverage

The new public coordinator regression failed against the original implementation, then passed with the fix. It covers all eight typed continuation families, admitted and Full-queued handover, a continuation submitted after session replacement, a fresh read after rejection, and same-session item/byte mismatches remaining invalid input. Existing generation, direct/Sealed and cancellation tests still pass.

The investigation also checked the exact rejection predicates: continuation ownership, query key, item limit and byte limit. This does not claim exhaustive coverage of every malformed field or identity combination.

Cold-start Simulator reproduction

Used an isolated iPhone 13 / iOS 26.1 Simulator with production native runtime, view tree and reducers, a synthetic 31-day graph with one root per day, memory-only fixture keys and an offline authentication provider. The provider varies currentUserID completion timing and deliberately fails token retrieval; no real account, credentials or graph were used.

• Baseline f63732d7f7df94c6294fb61c99a2866b734eeff1: cold launches with 0/20 ms authentication delay stopped at 21/28 of the initial 30 roots. At 0 ms, the actual Error info screen showed the exact continuation error, listTimelineDates, graph generation 1 and workerService / coordination / invalidInput.
• Fixed 3ef0938c11e348711c19f98541ef9dfedb0cb03d: all six delays, 0/20/50/100/250/1000 ms, completed the initial 30 roots. The 0/20/50 ms logs show cursorless recovery. The final 0 ms Error info inspection showed only the intentionally simulated token failure, with no continuation or listTimelineDates error.
• Console logs do not contain the error text, so an empty text search was not treated as UI proof.

The disposable fixture was checkpointed into DELETE journal mode before each launch for portable initial mirror inspection. Test hosts and synthetic setup are outside the PR. These are source-bound experimental host-restamped Simulator builds with cross_abi_validated=false, not real-device or complete iOS ABI acceptance.

Validation on the exact head

• dune build @all app/native_embed.exe.o: passed.
• dune runtest --force: passed.
• git diff --check: passed.
• Independent read-only review of the final two-file diff: no actionable findings.
• spec-dev-tool check --all: fails on pre-existing document format/section errors; baseline and fix produce byte-identical output. No decision documents changed.
• Remote CI is pending at PR creation.

Base: main at f63732d7f7df94c6294fb61c99a2866b734eeff1. Head: 3ef0938c11e348711c19f98541ef9dfedb0cb03d. No merge or release is included.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T05:56:54.528400Z	3ef0938	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.