Field incident (2026-07-17): a Cardio flow run driven from a locked phone
durably completed the 30-min Main Circuit ~5 minutes in, then fought the
watch until manual swipes forced agreement. Second bulletproofing pass
(BULLETPROOFING.md, "2026-07-18 — Live-run mirror & flow hand-off"):
- H4: RunFlowView (both platforms) follows the driver's cross-log
hand-off frame (forward-only by plan order, runnable target only), and
a remote completion mid-flow hands off via onAdvance instead of
dismissing the run (which tore down the Live Activity and stranded the
flow in the mirror cover).
- H5: wall-clock plausibility gate — a duration exercise never
auto-completes before startedAt + sets × duration; the flow-terminal
rest self-repairs to computeResume() and the Finish auto-Done holds
for a human tap. Human Done taps stay ungated.
- M6: both bridges persist liveVersion as a UserDefaults high-water mark
so an app relaunch can't get every subsequent frame dropped as stale.
- M7: phone list + mirror cover absorbs gain the watch's strictly-newer
guard, so a stale cache echo can't regress the working doc.
- Diagnostics: run-flow os_log breadcrumbs (page transitions, applied
frames, repairs, hand-offs, gate trips) on both drivers.
Open, documented: M5 (no reconciliation signal across a single-set
duration phase), M8 (watch context apply lacks per-log staleness guard),
L5 (spurious pager write-backs read as human swipes).
rzen
c4fe412308