Close the live-mirror flow hand-off gaps that skipped a timed phase

Field incident (2026-07-17): a Cardio flow run driven from a locked phone
durably completed the 30-min Main Circuit ~5 minutes in, then fought the
watch until manual swipes forced agreement. Second bulletproofing pass
(BULLETPROOFING.md, "2026-07-18 — Live-run mirror & flow hand-off"):

- H4: RunFlowView (both platforms) follows the driver's cross-log
  hand-off frame (forward-only by plan order, runnable target only), and
  a remote completion mid-flow hands off via onAdvance instead of
  dismissing the run (which tore down the Live Activity and stranded the
  flow in the mirror cover).
- H5: wall-clock plausibility gate — a duration exercise never
  auto-completes before startedAt + sets × duration; the flow-terminal
  rest self-repairs to computeResume() and the Finish auto-Done holds
  for a human tap. Human Done taps stay ungated.
- M6: both bridges persist liveVersion as a UserDefaults high-water mark
  so an app relaunch can't get every subsequent frame dropped as stale.
- M7: phone list + mirror cover absorbs gain the watch's strictly-newer
  guard, so a stale cache echo can't regress the working doc.
- Diagnostics: run-flow os_log breadcrumbs (page transitions, applied
  frames, repairs, hand-offs, gate trips) on both drivers.

Open, documented: M5 (no reconciliation signal across a single-set
duration phase), M8 (watch context apply lacks per-log staleness guard),
L5 (spurious pager write-backs read as human swipes).

Workouts/Views/WorkoutLogs/LiveRunCoverView.swift

@@ -89,10 +89,13 @@ struct LiveRunCoverView: View {
         .onAppear {
             if doc == nil, let workout { doc = WorkoutDocument(from: workout) }
         }
-        .onChange(of: workout?.updatedAt) { _, _ in
+        .onChange(of: workout?.updatedAt) { _, incoming in
             // Absorb the durable progress the watch drove (currentStateIndex / status). The
             // live *page* is driven by frames, not this — so re-seeding the doc is safe.
-            if let workout { doc = WorkoutDocument(from: workout) }
+            // Strictly newer only (matching the list absorbs): a stale cache echo must not
+            // regress the working copy, which the next persist would re-stamp as newest.
+            guard let incoming, incoming > (doc?.updatedAt ?? .distantPast), let workout else { return }
+            doc = WorkoutDocument(from: workout)
         }
     }