Stabilize startup and Block Detail loading

[RCmerci]

App launch could switch between native opening progress, provisional account screens, and a Timeline placeholder before the first feed completed. Startup now keeps one loading surface, shows its progress only after 100 ms, and admits the Timeline when the current graph and initial feed are ready (including an empty feed). Required sign-in, graph selection, unlock and explicit Retry remain immediately available. The public startup owner fences stale account/timer completions and foreground transitions; native SwiftUI owns the shared first-visible-frame clock and presentation. Attachment work does not delay initial body publication.

Opening Block Detail could publish the root and direct children before materialized descendants arrived, causing text and siblings to move during the initial read. This stages the bounded initial non-asset body before publication, delays its body-only progress indicator by 100 ms, and keeps native navigation and Capture available. Local attachment opening now says Loading; only typed remote transfer availability says Downloading.

The initial owner retains the draft and uses the existing visible-demand limits: at most 10 levels, 128 items per page, the conservative 384-item materialization budget and 128 attempts. Continuations remain explicit Load more/Retry. Initial descendant failures have explicit Retry; session, route and graph guards fence late completions. Shared refreshes are charged cumulatively to the hidden initial owner, including the root; a pending page whose reservation is consumed is fenced and remains an explicit continuation. Known root/descendant deletions apply during staging; Undo preserves spent budgets and detached draft identity while admitting fresh read generations. Asset acquisition stays independent of body publication, preserves known image slots and displayed leases, and retains separate queued/offline/upload/unlock labels. No full-graph pre-read, additional download, refresh or automatic retry is introduced.

Validation:

• Public owner behavioral RED followed by GREEN, including eleven staging review groups for same/different-branch refresh, cumulative/duplicate refresh, consumed attempts, staged root/subtree deletion, cancelled completion, Undo, Back/graph/Retry, detached drafts, unaffected sibling reads and precise staged Undo targets, exhausted-attempt root Undo immediate settlement with/without a retained draft, including bounded nested staging, explicit retry with retained draft, local Ready → Loading → File, Downloading → Loading → File, wait states, and late/duplicate acquisition completion. Existing transfer tests confirm cache hits avoid Fetch and misses schedule Fetch; 17 transfer tests, routes/semantics and 79 application-view tests pass.
• dune build @all app/native_embed.exe.o passes. Full forced dune runtest with the reused external build directory has one existing test_asset_cache failure (repository root not found). Its sealed public-interface check passes separately from the real Git worktree using a temporary ignored cache link removed in finally; this is disclosed rather than counted as an all-green full run.
• Native iPhone 13 / iOS 26.1 Simulator: first review-fix head 7ccbfcd: 5/5 passed, zero failure/skip (fast/slow, Retry, 3/10 levels, 128-page continuation). These are existing synthetic smoke cases; refresh/deletion interleavings are verified by public-owner regressions, without duplicate formal UI coverage. Previous-head 0313b98 fast/nested smoke: 2/2 passed, zero failure/skip. New final-head 584cb36 fast-body smoke: 1/1 passed, zero failure/skip, tracked separately; the changed exhausted-budget Undo path is verified through public-owner regressions and the original independent controls. Historical evidence: prior bounded-body run 9/9, attachment-phase run 3/3, zero failures/skips. Checks cover fast/slow initial reads, failure/Retry, Back and rapid target changes, 3/10-level initial bodies, 128-item paging/continuations, assets and stable slots. The phase run observes local Loading, Downloading → Loading → File, and missing → explicit Retry → Loading → File, with body, navigation and Capture retained.
• Both native runs use a synthetic service and locally generated fixture media. Phase evidence uses controlled 10-second typed Downloading and 8-second local-acquire delays; these are QA delays, not production thresholds or real remote download acceptance. No phone or personal graph was used.

Evidence retained outside Git in ChatGPT Library:

• Bounded staging report: libfile_04aa684bc4d881918a5d93d77d8d051b (9/9 native run).
• Attachment phase report: libfile_b9828558d028819188598050c7b2e128 (3/3 native run; source hashes and complete screenshot map).
• Local Loading screenshot: libfile_00ee66d770a48191b991a5397367e6d8.
• Downloading screenshot: libfile_848bed181ae88191b518b7e5fcbc1d97.
• Post-download local Loading screenshot: libfile_69dab9569d3c819191861ab40ed4ab99.

The PR includes 0724522, 0d22b4f, 0023dc9, and review-fix commits 7ccbfcd / 0313b98 / 584cb36; production changes are limited to Detail/application route ownership and attachment presentation. No Swift, protected spec/, Dune or Timeline/Favorites production change is included.

Independent review identified two P2 staging interleavings at 0023dc9; the original report/probe/RED logs are preserved outside Git. The fix adds only staging budget/deletion ownership and public-owner regressions (four files), retaining all prior commits. Source/build/CMI SHA256 identity for re-review is retained in staging-undo-settle/public-source-identity.json (including immutable public artifact snapshots).

Incremental independent review at 0313b98 found exhausted-budget root Undo left Ready data in Loading. 584cb36 immediately runs the existing initial settlement after restoring the owner, retaining spent counters, late-event fencing and detached draft; it changes only that production branch plus public regressions. The reviewer's original controls source passes all eleven groups when linked to the new immutable app.cmxa/app.a and public CMI snapshots.

Final frozen head 584cb363fc1d9d408a1d568c84ec08c32fcd1665: exact-head Journal CI run 38185801279 completed successfully on its first attempt. Build all/native embed, full regression suite and evidence upload passed; WIP also passed. Final-head synthetic fast-body smoke is 1/1, separate from historical 0313 2/2 and 7cc 5/5. Public-owner regressions and the unmodified independent controls verify the exhausted-budget Undo fix.

Startup validation:

• Public startup presentation RED→GREEN cases cover the delay boundary, phase changes, empty/cached feed, mandatory interaction, failures/Retry, offline local content, stale account/graph/timer completions and background/resume.
• All 79 existing Application view tests pass. The graph-generation fixture now emits a matching manager generation; native list replacement assertions remain intact. Actual App.swift and the native Simulator QA host compile against existing dependencies.
• The original 11 synthetic native acceptance scenarios passed in one continuous Simulator recording. Additional repeated empty-feed controls reproduced a persistent native blank while the OCaml owner and retained tree were ready. The same valid public patch stream reproduces in a standalone LUI-only app that links no Journal Swift or OCaml code: 19/21, with two persistent blanks. Application adaptation is stopped pending an upstream native-rendering fix; the specific internal LUI cause is not yet confirmed. Failed recordings/AX are retained. Native acceptance remains blocked despite green CI; no forced root rebuild or upstream edit was adopted.
• Exact-head Journal CI passed for 0aa9a90 (run 38207400130). The preceding run identified obsolete component-location assertions; the existing boundary checks were moved to the current host ownership and passed against the real source directory.

Native blocker controls: old production584cb 21/21; current18/21; restored Fill17/21 (reverted); forced-root diagnostic21/21 (not adopted); product-factory replay19/21; simple-factory replay19/21; standalone LUI-only19/21. Exact native source38551254511c59d9141a8f9b276c78783cbac044. The standalone input SHA256 is ac2483237ef5ef1197cdcebb7f68793de1a825ebee451a8d8915585cdf12fd6b.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T22:48:18.665345Z	0023dc9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.