Native Docs review record

2026-09-13: independent specification review dispatched as gpt-6-astra with high reasoning. Actual runtime identity was not independently verified. The amended specification was approved after adding native known-schema editing parity, twelve locales/accessibility, sandboxed CRDT decoding, bounded per-document recovery, explicit UTF-16 positions, memory-only content and current stream authorization.

Final independent production branch review: approved at c2e1a92, against inherited d5ff04e17144583620ff3b9950fcf6722e7001e9, with the evidence and manual acceptance limits below. The review covered the working web inventory, native Mac/iOS implementation, current authorization, sealed server storage, lossless CRDT identity/formatting, own-only undo, generation/recovery transitions, native clipboard/export, and the three narrowly scoped Yrs deletion backports. No additional concrete production blocker was established after the persisted-rule regression passed. The reviewer authored the isolated UI targets/runner and independent wire/deletion probes; production implementation was reviewed independently. This does not claim exhaustive manual parity acceptance.

The final original server CI and native engine/Apple gate passed. All six parallel Mac/simulator/device builds passed in ../native-build-logs/20260913T095810.093604Z/results.json. Source review preserves normal Yrs garbage collection; it does not adopt an unbounded tombstone policy.

Isolated native review

The review app, UI test runner, and Go fixture are separate test targets. They use a fresh temporary database and the real native approval/exchange flow. They never access a production account.

Run from the repository root with a booted simulator and the Go toolchain required by go.mod on PATH:

python3 native/scripts/review-ios.py --simulator SIMULATOR_UUID

The runner builds the review app and UI tests before starting the fixture, then installs both bundles. It starts TestNativeReviewFixture, checks that its exact native credential can read the document list, and writes mode-0600 Documents/review.json into each current simulator container. The app and test runner each read their own file; neither uses a hardcoded host temporary path.

UI execution has a seven-minute limit inside the fixture's ten-minute lifetime. On success, failure, or timeout, cleanup stops the test processes, signals the fixture to finish, terminates the review bundles, and deletes credentials from both original and current containers. Resolving containers again handles Xcode reinstalling an application during the test.

Logs and the .xcresult bundle remain under native/build/review-TIMESTAMP. --go /path/to/go selects a toolchain explicitly. --skip-build reuses already rebuilt artifacts. --smoke verifies authentication, credential installation, and cleanup without claiming editor acceptance.

The orchestration smoke test passed on 2026-09-13 with simulator 5064842A-8777-44F3-9AFF-E6562CF88F71. On the same iPhone simulator, the native create/type/Bold/append flow passed with exact body and formatting verified via a fresh authenticated Markdown export. Its screenshot was visually inspected. The runner removed both credentials and stopped the fixture afterward. The same accepted binary passed the identical flow and fresh server read on iPad Pro 13-inch (M5), iOS 26.5, with simulator C12B219D-0114-4EB6-A75B-6F6565D422CD.

--only testCreateTypeFormatAndPersistDocument isolates that case; --only testExportPDFAndMarkdownDestinationsAndCancellation isolates export. Export acceptance opens both native destination pickers and cancels; the runner asserts no private export staging remains and cleans it on failure too. An actual external destination write is outside these cases. On the iPad simulator, both export picker/cancel flows passed in 24.458 seconds. Their screenshots were visually inspected: each picker displays “Native review document”. The runner confirmed that no export staging directory remained and removed both review credentials before stopping the fixture.

The latest iPhone build also passed testCreateTypeFormatAndPersistDocument with exact saved body and bold formatting in native/build/review-20260913T092049.526154Z/Review.xcresult; credentials and fixture cleanup passed. This covers the generation-reuse and explicit-selection changes as well as ordinary typing.

Additional review cases are testInputRuleReversalAndMultilinePersistence, testKeyboardJumpSearchOpensDocument, and testJumpButtonSearchOpensDocument. The final rebuilt iPhone rule case passed in 16.859 seconds in native/build/review-20260913T095637.456828Z/Review.xcresult. It verifies native prefix removal, Backspace restoration, multiline typing, and the exact fresh server Markdown body. The earlier extra empty list is absent after the three targeted Yrs deletion backports. Its screenshot was visually inspected; fixture and credential cleanup passed.

The iPhone jump-button case passed in native/build/review-20260913T094927.493167Z/Review.xcresult: native search uses the real ranked endpoint and the selected result opens the second document. The review-only testRegisteredCommandAndSoftwareSubmitOpenDocument case and selected XCTest suite passed in 20.223 seconds, recorded in native/build/review-20260913T100847.314877Z/ui.log. It locates the actual focused native editor, verifies its registered Command-K binding and priority, dispatches that fixed selector through UIKit's responder chain, searches the real endpoint, and submits with software-keyboard newline. The second document's native editor opens. Xcode then hung while finalizing its result bundle; the owned runner was interrupted and its normal cleanup removed credentials and stopped the fixture. Direct synthetic screenshots were retained. This is passing XCTest evidence, not a successful final xcodebuild exit. The fixed-command probe is confined to the separate review target and has no production launch hook.

Physical hardware keyboard acceptance remains unverified. iPad typeKey occasionally opened search but also inserted a literal K; hardware Return injection did not open the result even after adding an explicit key handler. One hardware-connection attempt had the same Return result, and restored the original ConnectHardwareKeyboard=0 preference afterward. These failed HID cases remain diagnostics and are not claimed as passing. The phone keyboard case explicitly skips: Apple's XCUIElement overview documents keyboard interaction for macOS and iPadOS; attempted iPhone Command-K injection produced a literal K.

Other unexecuted manual matrices remain listed in PARITY.md: full formatting and clipboard UI combinations, simultaneous live editing across devices, native sharing, VoiceOver/native-speaker review, final destination writes/print, and interactive Mac close/menu behavior. Their implemented paths and targeted tests were reviewed; those matrices are not represented as manually completed.

A failed XCTest case now gets 45 seconds for Xcode to finalize its result bundle; if Xcode remains stuck, the runner stops only its own test process group and cleans up. This failure path was exercised. The seven-minute total test bound still applies. Synthetic jump screenshots are also written by the separate test runner and copied into the private review log directory during cleanup, so they survive an incomplete .xcresult; their originals are removed afterward.