Finding register

A backward step of the wall clock silences every running timer for the length of the step

lib/engine/engine.dart:312; deadlines set at :177, :182; consumer lib/ui/home.dart:248 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S1_engine.md · proof/01_findings/S1/ · proof/01_findings/S1_refute/. Reproduced on an independently built clean copy; heartbeat proven monotonic (so the app is awake and silent); backstop proven to run on the same RTC_WAKEUP wall clock, so it does not rescue this. Three corrections: the Evidence block is a stitched composite, not verbatim — replace it with s1_facts_test.dart:92-121 as written; the silence is bounded by the size of the step, not permanent; the proposed fix is defective as written (probe R2b) and must be redesigned before implementation.

findings/S1_engine.md § S1-F1 — A backward step of the wall clock silences every running timer for the length of the step: proof/01_findings/S1/facts_run.txt, probes A1 and A3 (PASS = the defective behaviour is real), and proof/01_findings/S1/defects_run.txt, tests S1-F1 and S1-F1b (FAIL). The probe drives the real 150 ms heartbeat for 60 simulated minutes of wall time: dart // s1_facts_test.dart, probe A1 final t = single('a', 300); // a five-minute dish e2.startTimer(t2); h2.t -= 3600000; // operator / NTP steps the clock back one hour for (var ms = 0; ms < 60 * 60 * 1000; ms += Engine.tickMs) { h2.t += Engine.tickMs; e2.tick(); } expect(h2.fired, isEmpty, reason: '60 real minutes on a 5-minute timer: NOT ONE alarm'); expect(e2.run['a']!.status, RunStatus.running); 00:00 +1: A. wall-clock manipulation A1 clock set BACK 1h: a 5-min timer stays silent for 65 minutes 00:00 +3: A. wall-clock manipulation A3 clock BACK while a chain runs: the chain stalls mid-step The symmetric case is equally proven: probe A2 shows a forward step of one hour makes three unrelated dishes ring simultaneously and writes a bogus driftMs of 3301200 into the journal. The failing counterpart, from defects_run.txt: S1-F1 a 5-min timer must ring within 5 min of REAL time even if the wall clock is stepped back one hour [E] S1-F1b a 5-min timer must NOT ring 55 minutes early because the clock was stepped forward one hour [E] Daylight saving and timezone changes are not affected, and that is proven rather than assumed: EngineHost.now() is implemented as DateTime.now().millisecondsSinceEpoch (lib/ui/home.dart:248), which is a UTC instant. Probe A4 pins DateTime.parse('2026-10-25T01:00:00Z').millisecondsSinceEpoch == 1792890000000 and shows .toLocal() yields the identical epoch value. The exposure is clock setting, not clock labelling.

CORRECTED FIX: expose Android SystemClock.elapsedRealtime() (or POSIX CLOCK_BOOTTIME) through a platform channel and store a suspend-inclusive monotonic deadline beside the wall-clock deadline. Drive countdown and firing from the monotonic deadline; retain epoch time only for OS notification scheduling and persistence reconciliation. Never use Dart Stopwatch. RED/GREEN TEST: inject independent wall and boot clocks, start a running timer, move wall time backward by one hour while boot time advances normally, and assert the alarm fires after the original duration; add a 24-hour simulated suspend where both elapsed-real-time and the timer duration advance together and assert no 24-hour deadline extension.

findings/S1_engine.md § S1-F1 — A backward step of the wall clock silences every running timer for the length of the step: s1_defects_test.dart::S1-F1 and S1-F1b — currently red. With the fix they are rewritten against a fake host whose now() is stepped by −3 600 000 ms while monotonicMs() continues to advance by tickMs, and they must go green: the five-minute dish rings after five minutes of monotonic time, and the forward step does not make it ring early. ---

The zone→sound migration is NOT idempotent: a second run rewrites every dish's ringtone to Bell

lib/engine/store.dart:255-285; false claim at :249-252; mechanism lib/engine/models.dart:56-63 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · proof/01_findings/S2/ · proof/01_findings/S2_refute/. Reproduced twice from scratch, once with no write failure at all — the trigger needs no wrong-typed value. One wording correction: _guard (store.dart:174-180) does observe and report the write result; what it does not do is raise it as critical, retry, or let a caller await it. Delete "never verifies" before this reaches the report.

findings/S2_persistence.md § S2-F2 — The zone→sound migration is NOT idempotent: a second run rewrites every dish's ringtone to Bell: the claim, verbatim: dart // store.dart:249-252 /// Idempotent by construction: it re-reads the same zones and assigns the /// same tones, so dying before the flag is written costs nothing. The order /// matters and is deliberate — save the timers FIRST, then flag, then drop /// the legacy key, so no interruption can lose a tone. The lookup it depends on: dart // store.dart:273-279 for (final t in e.timers) { final inherited = tones[t.legacyZoneId] ?? _legacyFallbackSound; // 'Bell' Recorded run proof/01_findings/S2/02_migration.txt: DEFECT 1b — the migration is NOT idempotent across a reload boot1 sounds={Fries: Beep, Crispy: Beep, Dough: Chime} boot2 moved=3 sounds={Fries: Bell, Crispy: Bell, Dough: Bell} DEFECT 1 — ... silently reverts an operator's tone choice SECOND RUN moved=3, sounds now {Fries: Bell, Crispy: Bell, Dough: Bell} The existing test named "ne tourne QU'UNE fois" (store_test.dart:145-158) does not test this: it never reloads from storage and relies on the flag still being set, so it proves the flag gate works and says nothing about idempotency.

findings/S2_persistence.md § S2-F2 — The zone→sound migration is NOT idempotent: a second run rewrites every dish's ringtone to Bell: make the guard structural rather than flag-dependent. Only apply an inherited tone when the timer actually carries a legacyZoneId, i.e. replace line 274 with dart final zid = t.legacyZoneId; if (zid == null) continue; // post-zones timer: never touch final inherited = tones[zid] ?? _legacyFallbackSound; This makes the migration idempotent by construction for real, independently of the flag, and also fixes S2-F4. Additionally, verify the flag write: _guard should report the _kZoneSound failure as isCritical: true so a lost one-shot flag is visible.

findings/S2_persistence.md § S2-F2 — The zone→sound migration is NOT idempotent: a second run rewrites every dish's ringtone to Bell: s2_migration_test.dart, tests "DEFECT 1b — the migration is NOT idempotent across a reload" and "DEFECT 4 — a v0.4.11+ timer carried through the migration is forced to Bell". Both assert the defect today; invert to expect(_sounds(boot2), _sounds(boot1)) and expect(_sounds(e)['Baklava'], 'Cascade'). Red now, green after. ---

The OS alarm backstop is dead on iOS: the notification plugin is initialised Android-only and no iOS sound resource is bundled, so the app boots into a permanent red banner and iOS has nothing to play

lib/alarm_backstop.dart:72-76 (InitializationSettings has no DarwinInitializationSettings); _ready gate :79-96; ios/Runner.xcodeproj/project.pbxproj PBXResourcesBuildPhase block 97C146EC1CF9000F007C117D (no sound resource) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · findings/S9_platform_config.md · agent_reports/S3_refute.md · agent_reports/S9_refute.md. Found independently by S3 (audio/backstop angle) and S9 (platform-config angle). S3's refuter verified the defect against the plugin source at flutter_local_notifications_plugin.dart:142-147 and by mutation B4. S9's refuter raised its own F07 to BLOCKER and folded S9-F03's blocking condition into it. Also the still-open half of the 2026-07-19 prior audit's A1-1.

findings/S3_audio_alarms.md § S3-F1 — the OS-level alarm backstop is dead on iOS, and the app boots into a permanent red banner: plugin source, flutter_local_notifications-22.1.0/lib/src/flutter_local_notifications_plugin.dart:142-147: dart } else if (defaultTargetPlatform == TargetPlatform.iOS) { if (settings.iOS == null) { throw ArgumentError( 'iOS settings must be set when targeting iOS platform.', ); } App source, lib/alarm_backstop.dart:72-76: dart await _plugin.initialize( settings: const InitializationSettings( android: AndroidInitializationSettings('@mipmap/ic_launcher'), ), ); Test run, proof/01_findings/S3/02_test_full_suite_with_s3.txt (test S3: on iOS, Backstop.init() fails and the app carries a permanent critical banner with NO OS-level safety net, source proof/01_findings/S3/tests/s3_backstop_test.dart:78-102), console line: [cadence] backstop-init: Invalid argument(s): iOS settings must be set when targeting iOS platform. The test asserts b.ready == false, Diag.critical contains backstop-init, zero zonedSchedule calls and zero show calls. findings/S9_platform_config.md § S9-F07 — No iOS notification sound resource is bundled and the notification plugin is initialised Android-only, so the iOS backstop has nothing to play: The complete Runner resources build phase, verbatim from ios/Runner.xcodeproj/project.pbxproj: 97C146EC1CF9000F007C117D /* Resources */ = { isa = PBXResourcesBuildPhase; buildActionMask = 2147483647; files = ( 97C147011CF9000F007C117D /* LaunchScreen.storyboard in Resources */, 3B3967161E833CAA004F5970 /* AppFrameworkInfo.plist in Resources */, 97C146FE1CF9000F007C117D /* Assets.xcassets in Resources */, 97C146FC1CF9000F007C117D /* Main.storyboard in Resources */, ); runOnlyForDeploymentPostprocessing = 0; }; Verbatim, lib/alarm_backstop.dart:71-76 — Android-only initialisation: dart await _plugin.initialize( settings: const InitializationSettings( android: AndroidInitializationSettings('@mipmap/ic_launcher'), ), ); $ grep -rn "DarwinInitializationSettings\|DarwinNotificationDetails" lib/ (no output) Static analysis only — no Xcode on this machine, so the bundle contents are read from the project file rather than from a built .app.

findings/S3_audio_alarms.md § S3-F1 — the OS-level alarm backstop is dead on iOS, and the app boots into a permanent red banner: add iOS: DarwinInitializationSettings(requestAlertPermission: true, requestSoundPermission: true, requestBadgePermission: false) to the InitializationSettings at alarm_backstop.dart:73-75; add iOS: const DarwinNotificationDetails(presentAlert: true, presentSound: true, sound: 'cadence_alarm.wav', interruptionLevel: InterruptionLevel.timeSensitive) to _details at alarm_backstop.dart:61-62; bundle cadence_alarm.wav in the Runner target (the Android copy already exists at android/app/src/main/res/raw/cadence_alarm.wav); and resolve IOSFlutterLocalNotificationsPlugin for the permission request alongside the Android one at alarm_backstop.dart:77-80. No new user-facing capability — this is the iOS half of an existing one. findings/S9_platform_config.md § S9-F07 — No iOS notification sound resource is bundled and the notification plugin is initialised Android-only, so the iOS backstop has nothing to play: Add a CAF or WAV alarm sound to the Runner target's resources build phase (the same waveform tools/build_ringtones.py already writes for Android, converted with afconvert), extend the initialisation to InitializationSettings(android: …, iOS: DarwinInitializationSettings(requestAlertPermission: true, requestSoundPermission: true, requestCriticalPermission: false)), and pass DarwinNotificationDetails(sound: 'cadence_alarm.caf', interruptionLevel: InterruptionLevel.timeSensitive) in _details. Coordinate with S3, which owns the runtime path.

findings/S3_audio_alarms.md § S3-F1 — the OS-level alarm backstop is dead on iOS, and the app boots into a permanent red banner: proof/01_findings/S3/tests/s3_backstop_test.dart:78-102 asserts the broken state today; against the fix, invert it to expect(b.ready, isTrue) plus expect(only('initialize'), hasLength(1)) under debugDefaultTargetPlatformOverride = TargetPlatform.iOS. That inverted test is red before the fix (the plugin throws) and green after. findings/S9_platform_config.md § S9-F07 — No iOS notification sound resource is bundled and the notification plugin is initialised Android-only, so the iOS backstop has nothing to play: A Dart test asserting Backstop's InitializationSettings exposes a non-null iOS member and that _details.iOS?.sound is non-null. Red now (both are null), green after. Plus, once Xcode exists, unzip -l Runner.app | grep -c '\.caf' returns ≥ 1. ---

An iOS build cannot ring at all once it leaves the screen: UIBackgroundModes is absent from the whole Info.plist

ios/Runner/Info.plist:4-69 — key absent from the top-level <dict> (file is 70 lines, not the 63 S3's manifest records) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · findings/S9_platform_config.md · agent_reports/S3_refute.md · agent_reports/S9_refute.md. Both refuters enumerated the plist keys themselves and confirmed the absence (grep -c UIBackgroundModes → 0; 18 top-level keys). S9's refuter split the finding: the fact holds, but adding UIBackgroundModes does not fix it — the blocking condition belongs to S9-F07 (the merged row above) and that is where the Phase-4 fix goes. Do not implement S9-F03's fix as written.

findings/S3_audio_alarms.md § S3-F2 — an iOS build cannot ring at all once it leaves the screen: ios/Runner/Info.plist contains, in full, only these top-level keys: CADisableMinimumFrameDurationOnPhone, CFBundleDevelopmentRegion, CFBundleDisplayName, CFBundleExecutable, CFBundleIdentifier, CFBundleInfoDictionaryVersion, CFBundleName, CFBundlePackageType, CFBundleShortVersionString, CFBundleSignature, CFBundleVersion, LSRequiresIPhoneOS, UIApplicationSceneManifest, UIApplicationSupportsIndirectInputEvents, UILaunchStoryboardName, UIMainStoryboardFile, UISupportedInterfaceOrientations, UISupportedInterfaceOrientations~ipad. No UIBackgroundModes, and no audio background mode. The wakelock (lib/main.dart:28, WakelockPlus.enable()) prevents the screen sleeping while the app is in front; it does not keep a backgrounded app scheduled. findings/S9_platform_config.md § S9-F03 — UIBackgroundModes is absent from Info.plist, so the iOS build cannot sound an alarm once the app leaves the screen: The complete set of top-level keys in ios/Runner/Info.plist (70 lines, read in full): CADisableMinimumFrameDurationOnPhone, CFBundleDevelopmentRegion, CFBundleDisplayName, CFBundleExecutable, CFBundleIdentifier, CFBundleInfoDictionaryVersion, CFBundleName, CFBundlePackageType, CFBundleShortVersionString, CFBundleSignature, CFBundleVersion, LSRequiresIPhoneOS, UIApplicationSceneManifest, UIApplicationSupportsIndirectInputEvents, UILaunchStoryboardName, UIMainStoryboardFile, UISupportedInterfaceOrientations, UISupportedInterfaceOrientations~ipad. There is no UIBackgroundModes. $ grep -c UIBackgroundModes ios/Runner/Info.plist 0 The key and its permitted values, from Apple (https://developer.apple.com/documentation/bundleresources/information-property-list/uibackgroundmodes, retrieved 2026-08-04, captures/apple_uibackgroundmodes.txt), verbatim: > UIBackgroundModes — Services provided by an app that require it to run in the background. > […] Possible Values: audio, bluetooth-central, bluetooth-peripheral, external-accessory, > fetch, location, nearby-interaction, network-authentication, newsstand-content, > processing, push-to-talk, remote-notification, voip The verbatim comment in ios/Runner/AppDelegate.swift:19-21 showing that .playback was chosen for the mute switch, not for backgrounding: swift // • Alarm stream: iOS has no per-stream volume. The equivalent guarantee is // the .playback audio session category, which keeps sound audible even when // the physical silent switch is ON — the closest analogue of USAGE_ALARM. Static analysis only — no Xcode on this machine, so this is read from the declaration files and not observed on a device.

CORRECTED FIX: do not add UIBackgroundModes: audio. Implement the Darwin local-notification repair in store_readiness/04_ios_blockers.md §5 with DarwinInitializationSettings, DarwinNotificationDetails, a bundle-root sound, and the time-sensitive entitlement. RED/GREEN TEST: the iOS platform-override arm from proof/02_store/s02_probe_platform_test.dart must change from Backstop.ready=false and zero channel calls to ready=true with a non-null Darwin zonedSchedule payload.

findings/S3_audio_alarms.md § S3-F2 — an iOS build cannot ring at all once it leaves the screen: device protocol D1 below. Static proof is not available for this one and is not claimed. findings/S9_platform_config.md § S9-F03 — UIBackgroundModes is absent from Info.plist, so the iOS build cannot sound an alarm once the app leaves the screen: A plist assertion runnable without Xcode: /usr/libexec/PlistBuddy -c "Print :UIBackgroundModes:0" ios/Runner/Info.plist must print audio. Red now (Print: Entry, ":UIBackgroundModes:0", Does Not Exist), green after. On-device confirmation must be added once Xcode is installed: background the app with a timer running and confirm the ringtone plays. ---

setStreamVolume failure is swallowed in Kotlin and never verified in Dart, so the 15 % audible floor is a claim the app cannot back

android/app/src/main/kotlin/dev/sergemio/cadence/MainActivity.kt:57-59 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md §Part 1 · proof/01_findings/S3_refute/. The severity survives; the justification does not. The refuter went to AOSP AudioService.java:4495-4504, :3745-3765, :4613-4626, :6724-6752 and proved the cited SecurityException cannot fire at this call site — the app passes flags = 0, and the throw is guarded by wouldToggleZenMode(getNewRingerMode(...)) which needs FLAG_ALLOW_RINGER_MODES. Consequence: fix (1) (reply result.error(...)) is inert; promote fix (2) to the whole remedy. See S3R-F2.

findings/S3_audio_alarms.md § S3-F3 — setStreamVolume failure is swallowed in Kotlin and never verified in Dart, so the 15% audible floor is a claim the app cannot back: the catch above, verbatim from MainActivity.kt:57-58. The documented throw, from proof/01_findings/S3/captures/android_audiomanager.txt:4646 and :4663 (retrieved 2026-08-04, https://developer.android.com/reference/android/media/AudioManager): From N onward, volume adjustments that would toggle Do Not Disturb are not allowed unless the app has been granted Notification Policy Access. See NotificationManager.isNotificationPolicyAccessGranted(). ... Throws SecurityException if the volume change triggers a Do Not Disturb change and the caller is not granted notification policy access. Dart-side blindness, proven by test S3: a setAlarmVolume that FAILS is recorded but NOT critical, so the operator is never warned the alarm stream was not set (proof/01_findings/S3/tests/s3_volume_channel_test.dart): when the channel itself throws, the app records volume-set in Diag.log but Diag.critical.value stays empty — no operator banner. When the Kotlin swallows instead, not even that happens, because result.success(null) means the Dart future completes normally. The correct ordering is in place and is now proven: test S3: on the rising edge of a ring the operator level is written to STREAM_ALARM BEFORE the ringtone is handed to the player asserts the observed sequence ['volume:0.4', 'volume:0.4', 'play'] (boot assertion, rising edge, WAV), so the design is right and only the failure reporting is missing. agent_reports/S3_refute.md § S3R-F2 — the SecurityException S3 uses to justify BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert: full quoted capture with line numbers and a sha256 of the decoded source in proof/01_findings/S3_refute/captures/aosp_audioservice_setStreamVolume.txt. Key blocks quoted in Part 1 above.

CORRECTED FIX: do not rely on returning result.error from the cited SecurityException catch; that exception cannot occur with flags == 0. After setting the alarm-stream volume, read it back and compare it with the requested floor; return a structured false/result value on mismatch, propagate that result through Dart, and surface it through a renderable critical scope. RED/GREEN TEST: substitute an audio manager whose setter returns without changing the stream value; current code reports success, fixed code reports failure and raises the operator banner.

findings/S3_audio_alarms.md § S3-F3 — setStreamVolume failure is swallowed in Kotlin and never verified in Dart, so the 15% audible floor is a claim the app cannot back: a test in test/volume_test.dart that mocks cadence/volume to answer PlatformException(code: 'volume_write_failed') on setAlarmVolume and asserts Diag.critical.value contains volume-set. Red today — the test named above records that the current code marks it non-critical — green after. Kotlin side: device protocol D2. agent_reports/S3_refute.md § S3R-F2 — the SecurityException S3 uses to justify BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert: a test in test/volume_test.dart mocking cadence/volume so setAlarmVolume answers a different level from the one requested (say 0.0 for a request of 0.4) and asserting the operator is told. That test cannot be written today because the verb returns null; it is red the moment the read-back lands and the comparison is missing, green after.

The release build type signs with the debug keystore; both APK and AAB carry CN=Android Debug, which Google Play does not accept

android/app/build.gradle.kts:30-36 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S9_platform_config.md · proof/01_findings/S9_refute/. Reproduced on the refuter's own build of both artefacts. Policy source: https://developer.android.com/studio/publish/app-signing.

findings/S9_platform_config.md § S9-F01 — The release build type signs with the debug keystore; both the APK and the AAB carry CN=Android Debug, which Google Play does not accept: Verbatim, android/app/build.gradle.kts:30-36: kotlin buildTypes { release { // TODO: Add your own signing config for the release build. // Signing with the debug keys for now, so `flutter run --release` works. signingConfig = signingConfigs.getByName("debug") } } Measured on both artifacts (proof/01_findings/S9/apk_aab_signing.txt): Signer #1 certificate DN: C=US, O=Android, CN=Android Debug Signer #1 certificate SHA-256 digest: 49d5b0ff27a90c3e017dcd7c04cd979111cce9a8de4a666b2c492e13800e1aae === AAB certificate === Owner: C=US, O=Android, CN=Android Debug Issuer: C=US, O=Android, CN=Android Debug Serial number: 1 Valid from: Tue Aug 04 11:37:42 CEST 2026 until: Thu Jul 27 11:37:42 CEST 2056 SHA256: 49:D5:B0:FF:27:A9:0C:3E:01:7D:CD:7C:04:CD:97:91:11:CC:E9:A8:DE:4A:66:6B:2C:49:2E:13:80:0E:1A:AE What Google Play does with such an upload, from the official documentation (https://developer.android.com/studio/publish/app-signing, retrieved 2026-08-04, captures/android_app_signing.txt:156), verbatim: > Because the debug certificate is created by the build tools and is insecure by design, most app > stores (including the Google Play Store) do not accept apps signed with a debug certificate for > publishing. And on the impermanence of that key (captures/android_app_signing.txt:164-172), verbatim: > The self-signed certificate used to sign your app for debugging has an expiration date of 30 > years from its creation date. […] To fix this problem, simply delete the debug.keystore file […] > The next time you build and run a debug version of your app, Android Studio regenerates a new > keystore and debug key.

findings/S9_platform_config.md § S9-F01 — The release build type signs with the debug keystore; both the APK and the AAB carry CN=Android Debug, which Google Play does not accept: Generate an upload keystore outside the repo (keytool -genkey -v -keystore <path>/upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias upload), add an untracked android/key.properties (already covered by android/.gitignore:12), and replace lines 30-36 with a real config: kotlin signingConfigs { create("release") { val props = java.util.Properties() val f = rootProject.file("key.properties") if (f.exists()) f.inputStream().use { props.load(it) } keyAlias = props.getProperty("keyAlias") keyPassword = props.getProperty("keyPassword") storeFile = props.getProperty("storeFile")?.let { file(it) } storePassword = props.getProperty("storePassword") } } buildTypes { release { signingConfig = signingConfigs.getByName("release") } } Then opt in to Play App Signing at first upload, so a lost upload key can be reset without losing the app (captures/android_app_signing.txt:116).

findings/S9_platform_config.md § S9-F01 — The release build type signs with the debug keystore; both the APK and the AAB carry CN=Android Debug, which Google Play does not accept: flutter build appbundle --release followed by keytool -printcert -jarfile build/app/outputs/bundle/release/app-release.aab | grep Owner. Red now: prints Owner: C=US, O=Android, CN=Android Debug. Green after: prints the upload certificate's distinguished name, and CN=Android Debug appears nowhere in the output. ---

The iOS App Store icon set is the byte-identical Flutter placeholder logo; flutter_launcher_icons was configured to skip iOS

pubspec.yaml:35 (ios: false); ios/Runner/Assets.xcassets/AppIcon.appiconset/*.png — all 15, not only Icon-App-1024x1024@1x.png at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S9_platform_config.md · agent_reports/S9_refute.md §BLOCKER 2 · agent_reports/S11_refute.md §7 R-F1. Found twice, independently. S9 found it from the platform-config side and graded BLOCKER; S11's refuter found it from the asset-provenance side after discovering S11 had omitted ios/ from its inventory entirely (R-F2), and graded it BLOCKER without knowledge of S9's row. S9's refuter proved all 15 icons are template, not just the 1024. Root cause is a single line: pubspec.yaml:35.

findings/S9_platform_config.md § S9-F02 — The iOS App Store icon is the byte-identical Flutter placeholder logo; flutter_launcher_icons was configured to skip iOS: Verbatim, pubspec.yaml:33-39: yaml flutter_launcher_icons: android: true ios: false image_path: "assets/icon/ic_legacy.png" adaptive_icon_background: "#F4EFE4" adaptive_icon_foreground: "assets/icon/ic_foreground.png" adaptive_icon_monochrome: "assets/icon/ic_monochrome.png" Byte-identity against the Flutter SDK's own template copy (Flutter 3.44.8): MD5 (ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png) = c785f8932297af4acd5f5ccb7630f01c MD5 (Flutter host_app_ephemeral/Runner.tmpl/Assets.xcassets/AppIcon.appiconset/ Icon-App-1024x1024@1x.png) = c785f8932297af4acd5f5ccb7630f01c Visual confirmation: the repo's 1024×1024 icon renders as the blue Flutter chevron; the Android launcher icon at android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png renders as the Cadence 7-segment mark on the #F4EFE4 ground. The asset catalogue has never been touched since the initial port: $ git log --oneline -- ios/Runner/Assets.xcassets/ 22902e0 Cadence v0.2.0 — app Flutter (moteur + UI + audio natif) avec lot robustesse App Store Review Guidelines (https://developer.apple.com/app-store/review/guidelines/, retrieved 2026-08-04, captures/appstore_review_guidelines.txt:155), Guideline 2.1 App Completeness, verbatim: > Submissions to App Review […] should be final versions with all necessary metadata and fully > functional URLs included; placeholder text, empty websites, and other temporary content should be > scrubbed before submission. And Guideline 2.3.9 (captures/appstore_review_guidelines.txt:175), verbatim: > You are responsible for securing the rights to use all materials in your app icons, screenshots, > and previews […] agent_reports/S11_refute.md § R-F1 — The iOS App Store icon is Google's Flutter logo: R29 (config and hashes), R30 (byte comparison against flutter_template_images 5.0.0), R31 (Android contrast). === pubspec flutter_launcher_icons ios setting === flutter_launcher_icons: android: true ios: false image_path: "assets/icon/ic_legacy.png" BIT-IDENTICAL-TO-FLUTTER-TEMPLATE ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png BIT-IDENTICAL-TO-FLUTTER-TEMPLATE ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-20x20@1x.png … (all 15 AppIcon sizes) … BIT-IDENTICAL-TO-FLUTTER-TEMPLATE ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage.png BIT-IDENTICAL-TO-FLUTTER-TEMPLATE ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@2x.png BIT-IDENTICAL-TO-FLUTTER-TEMPLATE ios/Runner/Assets.xcassets/LaunchImage.imageset/LaunchImage@3x.png I rendered Icon-App-1024x1024@1x.png (1024×1024 RGB, sha256 7770183009e91411…) and confirmed by eye that it is the Flutter logo. For contrast, android/.../mipmap-xxxhdpi/ic_launcher.png renders as the Cadence seven-segment mark in the #E8600F / #828A80 / #F4EFE4 palette (R31), proving the Android path was regenerated and the iOS path was not.

findings/S9_platform_config.md § S9-F02 — The iOS App Store icon is the byte-identical Flutter placeholder logo; flutter_launcher_icons was configured to skip iOS: Set ios: true in pubspec.yaml:35, supply the 1024×1024 source (the Android path already points at Serge's artwork under assets/icon/), and run dart run flutter_launcher_icons. The iOS marketing icon must be opaque with no alpha channel and no rounded corners; Apple applies the mask. agent_reports/S11_refute.md § R-F1 — The iOS App Store icon is Google's Flutter logo: set ios: true at pubspec.yaml:35 and run dart run flutter_launcher_icons, regenerating the AppIcon set from assets/icon/ic_legacy.png as Android already does. Compliance plumbing, no new feature, inside R6.

findings/S9_platform_config.md § S9-F02 — The iOS App Store icon is the byte-identical Flutter placeholder logo; flutter_launcher_icons was configured to skip iOS: A shell check run in CI: md5 -q ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png must not equal c785f8932297af4acd5f5ccb7630f01c, and sips -g hasAlpha on the same file must report no. Red now (hash matches the template), green after. --- agent_reports/S11_refute.md § R-F1 — The iOS App Store icon is Google's Flutter logo: red now, green after — shasum -a 256 ios/Runner/Assets.xcassets/AppIcon.appiconset/Icon-App-1024x1024@1x.png must not return 7770183009e914112de7d8ef1d235a6a30c5834424858e0d2f8253f6b8d31926, and no iOS AppIcon hash can appear in flutter_template_images 5.0.0.

The iOS project has never been configured for a real signing identity, and the required Xcode/SDK toolchain is not installed

ios/Runner.xcodeproj/project.pbxproj:349, :469, :526 (no DEVELOPMENT_TEAM) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S9_platform_config.md · agent_reports/S9_refute.md §BLOCKER 4. Confirmed, and the 2026-04-28 Xcode-26 requirement date verified verbatim against https://developer.apple.com/news/upcoming-requirements/.

findings/S9_platform_config.md § S9-F04 — The iOS project has never been configured for a real signing identity, and the required Xcode/SDK toolchain is not installed: Every signing-related setting in the 644-line project file, complete: $ grep -n "DEVELOPMENT_TEAM\|CODE_SIGN\|ProvisioningStyle\|entitlements" ios/Runner.xcodeproj/project.pbxproj 349: "CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer"; 397: CODE_SIGN_STYLE = Automatic; <- RunnerTests target only 414: CODE_SIGN_STYLE = Automatic; <- RunnerTests target only 429: CODE_SIGN_STYLE = Automatic; <- RunnerTests target only 469: "CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer"; 526: "CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer"; DEVELOPMENT_TEAM appears zero times. No entitlements file exists in the tree: $ find . -name "*.entitlements" -not -path "./.git/*" (no output) Apple's current upload requirement (https://developer.apple.com/news/upcoming-requirements/, retrieved 2026-08-04, captures/apple_upcoming_requirements.txt:22-26), verbatim: > SDK minimum requirements — Since April 28, 2026 — Apps uploaded to App Store Connect must be > built with Xcode 26 or later using an SDK for iOS 26, iPadOS 26, tvOS 26, visionOS 26, or > watchOS 26. Toolchain state, from the project baseline (proof/00_baseline/doctor.txt), verbatim: ✗ Xcode installation is incomplete; a full installation is necessary for iOS and macOS development. ! CocoaPods not installed.

findings/S9_platform_config.md § S9-F04 — The iOS project has never been configured for a real signing identity, and the required Xcode/SDK toolchain is not installed: Enrol in the Apple Developer Program, then set DEVELOPMENT_TEAM = <TEAMID> and CODE_SIGN_STYLE = Automatic on the Runner target's Debug, Release and Profile configurations, and register the bundle identifier dev.sergemio.cadence in the Developer portal. Install Xcode 26 from the Mac App Store, then sudo xcode-select --switch /Applications/Xcode.app/Contents/Developer, sudo xcodebuild -runFirstLaunch, and brew install cocoapods. This unblocks S9-F02, F03, F07 and F09, none of which can be verified on-device until it is done.

findings/S9_platform_config.md § S9-F04 — The iOS project has never been configured for a real signing identity, and the required Xcode/SDK toolchain is not installed: flutter build ipa --release exits 0 and produces a signed .ipa, and grep -c DEVELOPMENT_TEAM ios/Runner.xcodeproj/project.pbxproj returns a non-zero count. Red now (build fails: no Xcode, no team), green after. ---

One accidental tap on the biggest target on the board converts a cooking dish into one that will never ring, and cancels its OS safety net

lib/ui/home.dart:387-399, lib/engine/engine.dart:243-251, lib/alarm_backstop.dart:104-106 and :127-128 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S10_refute.md §6. A single tap on a running tile pauses it. The tile is the largest touch target on the board and the same target the product asks the cook to slap to silence an alarm. pauseTimer sets endsAt = null, so the engine will never fire it, and _desired then drops it so the scheduled OS alarm is cancelled too. Both layers of protection removed by one accidental tap.

findings/S2_persistence.md § S2-F14 — Deleting the migration's persistence step passes all 123 existing tests (mutation S2-M1): mutation patch saved at proof/01_findings/S2/mutation_M1.patch: diff --- store.dart.orig +++ lib/engine/store.dart @@ -280 +280 @@ - if (moved > 0) saveDefs(e); + // MUTATION S2-M1: migration no longer persists the inherited tones Recorded run proof/01_findings/S2/06_mutation_M1_existing_suite.txt — the full baseline suite under the mutation: 00:02 +123: All tests passed! EXIT_CODE=0 Recorded run proof/01_findings/S2/07_mutation_M1_probe_goes_red.txt — the S2 regression test added for this finding, under the same mutation: 00:00 +2 -1: GAP — nothing in the suite asserts the migration PERSISTS the tones [E] Expected: {'Fries': 'Beep', 'Crispy': 'Beep', 'Dough': 'Chime'} Actual: {'Fries': null, 'Crispy': null, 'Dough': null} EXIT_CODE=1 The same test is green on unmutated code (proof/01_findings/S2/02_migration.txt, 11/11 pass). agent_reports/S10_refute.md § M1 — One accidental tap on the biggest target on the board converts a cooking dish into one that will never ring, and cancels its OS safety net: dart // lib/engine/engine.dart:243-251 void pauseTimer(String id) { final r = run[id]; if (r == null || r.status != RunStatus.running) return; r.status = RunStatus.paused; r.remainingMs = math.max(0, r.endsAt! - host.now()); r.endsAt = null; host.persistRun(); host.onClick(false); } dart // lib/alarm_backstop.dart:103-106 final r = engine.run[t.id]; if (r == null || r.status != RunStatus.running || r.endsAt == null) { continue; } Visual signal exists but is quiet: tile.dart:196 sets pieFill = C.pausedFill (theme.dart:30, a grey 0xFFC9C2B5) and tile.dart:208-211 greys the ink; the breathing animation that is meant to carry the state (tile.dart:257-259) is disabled outright when the platform reports reduce-motion (_reduced, tile.dart:99). agent_reports/S14_refute.md § S14R-M1 — The analyser's strict type-checking modes were never measured, and turning them on surfaces six ERROR-severity type holes, one of them on the exact line S14 wrote finding F4 about: the whole analyzer: block added to a pristine copy, no source change (proof/01_findings/S14_refute/analysis_options_strict_modes.yaml [not published]), run recorded in proof/01_findings/S14_refute/analyze_strict_modes.txt — 13 issues, 6 of them error: error • The argument type 'dynamic' can't be assigned to the parameter type 'Object'. • lib/main.dart:31:27 • argument_type_not_assignable error • The argument type 'dynamic' can't be assigned to the parameter type 'Map<dynamic, dynamic>'. • lib/engine/models.dart:76:72 • argument_type_not_assignable error • The argument type 'dynamic' can't be assigned to the parameter type 'Object'. • lib/engine/store.dart:142:32 • argument_type_not_assignable error • The argument type 'dynamic' can't be assigned to the parameter type 'Object'. • lib/engine/store.dart:178:34 • argument_type_not_assignable error • The argument type 'dynamic' can't be assigned to the parameter type 'Object'. • lib/audio/voice.dart:197:33 • argument_type_not_assignable error • The argument type 'dynamic' can't be assigned to the parameter type 'Object'. • lib/alarm_backstop.dart:231:36 • argument_type_not_assignable plus six inference_failure_on_untyped_parameter warnings on the matching catchError((e) { lines. The one that carries runtime risk is lib/engine/models.dart:76: dart : (j['steps'] as List) .map((s) => StepDef.fromJson(Map<String, dynamic>.from(s))) s is dynamic. If a persisted timer's steps array holds anything that is not a map — the exact situation lib/engine/store.dart's _preserveCorrupt path exists for — Map.from(s) throws at load time. strict-casts names it statically today; nothing does now. agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: M1 clones key corrupt -> runs=1/4 clones=0/3 | run backup=null | banner={load-cadence-clones-v1} and the row pair in §6 (C0 runs=6/6 → C1 runs=3/6). After the probe calls saveRun, the persisted run map holds one entry.

findings/S2_persistence.md § S2-F14 — Deleting the migration's persistence step passes all 123 existing tests (mutation S2-M1): adopt s2_migration_test.dart's test "GAP — nothing in the suite asserts the migration PERSISTS the tones" into test/store_test.dart's migration group. It decodes prefs.getString('cadence-timers-v1') after the call and asserts the tone of each dish. agent_reports/S10_refute.md § M1 — One accidental tap on the biggest target on the board converts a cooking dish into one that will never ring, and cancels its OS safety net: within R6 as defect repair — keep an OS backstop armed for a paused run is not possible (there is no deadline), so the in-scope repair is the operator-visible one: the board has no aggregate signal that a dish is paused. Report the confirmation/undo question as the product decision; the missing paused row in the failure analysis is a reporting defect to correct now. agent_reports/S14_refute.md § S14R-M1 — The analyser's strict type-checking modes were never measured, and turning them on surfaces six ERROR-severity type holes, one of them on the exact line S14 wrote finding F4 about: add to analysis_options.yaml, alongside the lint rules chosen in §2.5: yaml analyzer: language: strict-casts: true strict-inference: true strict-raw-types: true and fix the 13 sites — six by typing the catchError parameter (Object e), one by giving models.dart:76 an explicit as Map check, the rest mechanical. Compliance plumbing, in scope under R6. agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: when _readList(_kClones, …) reports a drop or a total failure, do not let reconcile silently harvest the orphaned run entries — preserve cadence-run-v1 to its own .corrupt sibling in the same load, and raise the existing load-cadence-clones-v1 critical with a count of the run entries about to be dropped.

findings/S2_persistence.md § S2-F14 — Deleting the migration's persistence step passes all 123 existing tests (mutation S2-M1): re-apply mutation_M1.patch and confirm flutter test exits non-zero. It exits 0 today. --- agent_reports/S10_refute.md § M1 — One accidental tap on the biggest target on the board converts a cooking dish into one that will never ring, and cancels its OS safety net: extend test/backstop_test.dart with a case that arms a running timer, pauses it, and asserts the scheduled alarm was cancelled — green today, which is the point: the behaviour is real and untested as a risk, not as a feature. agent_reports/S14_refute.md § S14R-M1 — The analyser's strict type-checking modes were never measured, and turning them on surfaces six ERROR-severity type holes, one of them on the exact line S14 wrote finding F4 about: flutter analyze --fatal-infos --fatal-warnings must exit 0 with the strict block present. It exits 1 with 13 issues at 03a176e — recorded above. Then remove the explicit type from one catchError parameter and confirm flutter analyze returns to non-zero, proving the gate is live rather than merely present. agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: my test "M1 — a corrupt clones value silently destroys the RUN entries…". Invert expect(store.prefs.getString('cadence-run-v1.corrupt'), isNull) to isNotNull. Red now, green after.

A restaurant's entire configuration exists in one copy, on one tablet, with no in-app export and no import

lib/engine/store.dart:15-24 (the only persistence keys); lib/journal.dart:207 (the only export in lib/, and it exports the flight recorder, not the configuration); Settings surface lib/ui/modals.dart:616-693 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S10_product.md · findings/S13_data.md · agent_reports/S10_refute.md §1 · agent_reports/S13_refute.md · research/01_prior_work.md A1-4 / A1-R5. Found three times — S10, S13, and the 2026-07-19 prior audit (A1-4 and A1-R5, both recorded STILL OPEN) — and the two refuters disagree. S10's refuter downgraded to MEDIUM because Android Auto Backup supplies backup, restore and second-device transfer by platform default for exactly the cadence-timers-v1 key. S13's refuter confirmed HIGH. Resolved HIGH: S13-R2 measured that the platform default S10's refuter relied on stops silently once roughly nine journal exports exhaust the 25 MB per-app quota, so it cannot be treated as the restaurant's backup. BLOCKER remains wrong — a missing export is none of R13's three conditions. Full resolution in CONTRADICTIONS.md §6.

findings/S10_product.md § S10-F1 — A restaurant's entire configuration exists in one copy, on one tablet, with no export and no way back: $ grep -rniE "undo|confirm|backup|station|owner|assign|history|snooze|template|duplicate" lib/ | grep -viE ":[0-9]+: *(//|///)" lib/i18n.dart:124: 'backstopDown': '⚠️ Backup alarm unavailable — keep the app on screen' lib/ui/home.dart:194: if (!_foreground) return; // duplicate of the same transition $ grep -rn "exportCopy" lib/ lib/journal.dart:207: static Future<String?> exportCopy() async { lib/ui/modals.dart:701: final path = await Journal.exportCopy(); (proof/01_findings/S10/greps.txt §A, §B) findings/S13_data.md § S13-F4 — There is no export or import of timer configuration, so a replaced tablet loses the kitchen: proof/01_findings/S13/no_config_export_import.txt — the only share_plus call site in the whole app is lib/ui/modals.dart:705, inside _sendJournal, and the only dart:io File( sites in lib/ are lib/journal.dart:70,225 (the third grep hit, lib/ui/modals.dart:706, is XFile, a cross_file wrapper around the path exportCopy already returned). And proof/01_findings/S13/probe_data.txt, PROBE-E shows the configuration is already a clean, small, self-describing JSON document — 705 bytes for the whole seeded kitchen: TIMER_CONFIG_IS_STORED_AS_JSON=true TIMER_CONFIG_BYTES=705 [ { "id": "u7w2fw4acnl2", "name": "Manouche", "durationSec": 45, "sound": "Cascade", "phrase": "" }, … { "id": "r1ibznc1rpu0", "name": "Cook chicken", "durationSec": 810, "sound": "Cascade", "phrase": "", "steps": [ {"name":"Cook","sec":360}, {"name":"Flip","sec":90}, {"name":"Cook","sec":360} ] } ]

findings/S13_data.md § S13-F4 — There is no export or import of timer configuration, so a replaced tablet loses the kitchen: R6 forbids new end-user features in this audit, so this is reported with a spec, not implemented. The spec: a Settings action that writes cadence-timers-v1 verbatim to <temp>/cadence-config-<device>-<date>.json and hands it to the same SharePlus path _sendJournal already uses, plus an import that validates through the existing TimerDef.fromJson and Store._readList salvage machinery (lib/engine/store.dart:91-113) before replacing. Both halves reuse code that already exists and is tested; neither needs a new dependency. Note the ordering constraint: an import that overwrites must not run through seedIfFresh's guard at :305-310, which exists precisely to stop a kitchen's config being replaced.

findings/S10_product.md § S10-F1 — A restaurant's entire configuration exists in one copy, on one tablet, with no export and no way back: a test that seeds a store with N timers, exports, clears every key, imports, and asserts byte-identical cadence-timers-v1 — red today because no export entry point exists. findings/S13_data.md § S13-F4 — There is no export or import of timer configuration, so a replaced tablet loses the kitchen: a store_test.dart round trip — seed a kitchen, export to a string, clear the store, import, and assert the resulting Engine.timers equals the original including chain steps and tones. Red today (the functions do not exist). ---

What the operator experiences in each service failure, assuming the OS backstop does not ring

lib/alarm_backstop.dart:99-116, :122-149, :177-221, :238-248; lib/ui/home.dart:174-204 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S10_product.md · agent_reports/S10_refute.md. Every row of the table checks out against the code, including the Wi-Fi row (no INTERNET permission in the manifest). Incomplete on one row: the _desired filter at :104 also excludes paused, and the table has no paused row — that gap is M1 below.

findings/S10_product.md § S10-F14 — What the operator experiences in each service failure, assuming the OS backstop does not ring: dart // lib/alarm_backstop.dart:103-106 final r = engine.run[t.id]; if (r == null || r.status != RunStatus.running || r.endsAt == null) { continue; } | Failure | What the operator loses | How they recover | Residual risk if the backstop is silent | |---|---|---|---| | Tablet knocked, app backgrounded | Nothing; every run mutation persists immediately (home.dart:252-258 → store.dart:151) and ringing dishes get an immediate notification (alarm_backstop.dart:238-248) | Reopen; tick() fires anything that expired (home.dart:188) | The dish rings only when someone reopens the app | | App killed by the OS while a dish is counting | Nothing persisted is lost; the AlarmManager alarm was already armed at deadline + 1.5 s | Relaunch; overdue runs fire on the first tick, 150 ms in | Silence until relaunch, and the count-up then reads +0:00 (S10-F6) | | App killed while a dish is ringing | The OS alarm for that dish was cancelled the moment it started ringing | Relaunch: nextVoiceAt is persisted, so the repeat re-fires | Nothing rings at all until someone opens the app — the single largest hole | | Force-stop (manufacturer task killer, user swipe on some skins) | Android's stopped state also stops the app's pending alarms | Manual relaunch only | Total silence, with no indication anything is wrong | | Device reboot | The board is blank until someone launches the app; scheduled notifications are re-registered by the boot receiver (AndroidManifest.xml, ScheduledNotificationBootReceiver) | Launch the app; absolute endsAt means nothing drifted | Silence for the whole reboot window | | Battery dies | Everything, until it is charged and rebooted. main.dart:28 holds the screen awake for the whole service with no battery indicator and no low-battery warning anywhere in lib/ | Charge, reboot, launch | Total silence; this is the most likely field failure of all | | Wi-Fi drops | Nothing. The app has no network code and requests no INTERNET permission (greps.txt §G: count 0); voice selection actively penalises network voices (L8) | n/a | None — this is a genuine strength and should be said out loud in the sales conversation |

findings/S10_product.md § S10-F14 — What the operator experiences in each service failure, assuming the OS backstop does not ring: the ringing-state hole is defect repair, not a feature: _desired could keep a net armed for a run whose status is ringing, at its rangAt plus a grace, so a kill during the ring still produces a notification. The trade-off L11(a) protected against — a redundant notification popping over a live app — is handled by the same foreground cancel that already handles the running case.

findings/S10_product.md § S10-F14 — What the operator experiences in each service failure, assuming the OS backstop does not ring: extend test/backstop_test.dart with a case that sets a run to ringing and asserts a scheduled alarm still exists — red today, since _desired skips it at :104-106. ---

Every destructive action in the product is one unconfirmed tap with no undo

lib/ui/tile.dart:618-625 (✕), lib/ui/modals.dart:348-351 (🗑); the HIGH is carried by lib/engine/engine.dart:378-380 (Save kills a live run and every batch of it) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S10_product.md · agent_reports/S10_refute.md §1, §3. "No confirmation, no undo" is CONFIRMED and total: grep -rniE "\bundo\b\|AlertDialog\|showDialog.*confirm" lib/ → exit 1, no output; grep -rn "onLongPress\|onDoubleTap" lib/ → exit 1, no output. "Four one-tap gestures" is REFUTED — only one of the four is one tap, and a different one touches the menu. A missing confirmation is none of R13's three BLOCKER conditions.

findings/S10_product.md § S10-F2 — Every destructive action in the product is one unconfirmed tap with no undo: dart // lib/engine/engine.dart:375-380 if (editingId != null) { final t = timers.where((x) => x.id == editingId).firstOrNull; if (t == null) return false; // vanished from under the open editor run.remove(t.id); // reset run state so it matches the new shape host.onStopped(t.id); removeClonesOf(t.id); // batches are tied to the def they were cloned from dart // lib/ui/modals.dart:348-351 _modalBtn('🗑', danger: true, onTap: () => Navigator.pop( context, TimerEditorResult(delete: true))),

findings/S10_product.md § S10-F2 — Every destructive action in the product is one unconfirmed tap with no undo: none within R6 for the confirmations themselves (they are new UI). What is inside R6: saveDef currently discards the run of a dish whose timing did not change — an edit to name, tone or phrase alone does not require the run to be dropped, and preserving it in that case is defect repair, not a feature. Report the confirmation dialogs as the product decision; fix the unnecessary run-kill as a defect.

findings/S10_product.md § S10-F2 — Every destructive action in the product is one unconfirmed tap with no undo: a test that starts a dish, calls saveDef(editingId: id, name: 'X', phrase: '', sound: 'Bell', durationSec: <unchanged>), and asserts engine.run[id] != null — red today (engine.dart:378 removes it unconditionally).

In edit mode, tapping a ringing tile opens the editor instead of silencing the alarm

lib/ui/home.dart:349-353 (S10 cited :348-353), tested before r.status == RunStatus.ringing at :365; lib/ui/tile.dart:569-570 renders the ±/✕ row only for running/paused at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S10_product.md · agent_reports/S10_refute.md. editing defaults false (home.dart:40), is not persisted, and nothing auto-exits it — so the tile carries no escape while ringing. Severity stands.

findings/S10_product.md § S10-F3 — In edit mode, tapping a ringing tile opens the editor instead of silencing the alarm: dart // lib/ui/home.dart:348-353 void _tapTile(TimerDef t) { if (editing) { if (engine.isClone(t.id)) return; // clones: inert in edit mode _openEditor(t); return; } The ringing branch that would have stopped it sits below at :365-374 and is never reached. The tile's ✕ is not an escape either — tile.dart:569-570 renders the control row only for running or paused.

findings/S10_product.md § S10-F3 — In edit mode, tapping a ringing tile opens the editor instead of silencing the alarm: treat a ringing run as taking precedence over edit mode inside _tapTile — move the r.status == RunStatus.ringing test above the editing test. This is defect repair, not a new capability.

findings/S10_product.md § S10-F3 — In edit mode, tapping a ringing tile opens the editor instead of silencing the alarm: a widget test that puts the board in edit mode with one ringing timer, taps the tile, and asserts engine.run[id] == null and no dialog on screen — red today.

The shipped app contains three OFL-licensed font families with no copyright notice and no licence text

pubspec.yaml:48-69 (seven fonts declared); repository root (no licence file) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S11_asset_licensing.md · agent_reports/S11_refute.md §1. The factual predicate is wrong. All seven binaries ship the copyright notice in name ID 0/13, and DSEG7Classic-Bold.ttf ships the complete OFL 1.1 text inside name ID 13, byte-identical to the licensor's published copy. The real defect covers six files, not three families. Termination is further contested by the licensor's own FAQ 1.10. The release APK shipping no font notice is separately CONFIRMED, and LicenseRegistry/showLicensePage was proven from Flutter SDK source to surface nothing. Rewrite the finding before implementing.

findings/S11_asset_licensing.md § S11-F1 — The shipped app contains three OFL-licensed font families with no copyright notice and no licence text, which terminates the licence: $ git ls-files | grep -icE 'licen|notice|ofl|copying' 0 (proof/01_findings/S11/01_no_licence_files.txt) NOTICES.Z uncompressed chars: 1381653 NOTICES contains 'Big Shoulders' : False NOTICES contains 'Chivo' : False NOTICES contains 'DSEG' : False NOTICES contains 'Open Font License' : False (proof/01_findings/S11/09_apk_notices.txt, run against the release APK, all seven .ttf files confirmed present in the same archive) $ grep -rnE 'showLicensePage|showAboutDialog|AboutDialog|LicenseRegistry|LicensePage|addLicense' lib/ test/ android/ ios/ web/ grep exit=1 (1 = no match anywhere) (proof/01_findings/S11/11_no_licence_ui.txt) Licence text and TERMINATION clause: proof/01_findings/S11/bsd_OFL.txt, chivomono_OFL.txt, dseg046_DSEG-LICENSE.txt, all retrieved 2026-08-04 from the copyright holders' own distributions.

findings/S11_asset_licensing.md § S11-F1 — The shipped app contains three OFL-licensed font families with no copyright notice and no licence text, which terminates the licence: commit findings/S11_LICENSES_draft.md as LICENSES.md at the repository root, and surface it in the app: register the three notices with LicenseRegistry.addLicense in main() and add a "Licences" row to the existing Settings dialog that opens showLicensePage. This is compliance plumbing, not a feature, so it is inside R6.

findings/S11_asset_licensing.md § S11-F1 — The shipped app contains three OFL-licensed font families with no copyright notice and no licence text, which terminates the licence: a test that asserts the notice reaches the shipped bundle and the registry. Red now, green after: dart test('font notices are registered', () async { final entries = await LicenseRegistry.licenses.toList(); final text = entries.expand((e) => e.paragraphs).map((p) => p.text).join(' '); for (final needle in ['Big Shoulders', 'Chivo', 'DSEG', 'Open Font License']) { expect(text, contains(needle)); } }); plus the artifact-level check, which is the one that actually matters: unzip -p build/app/outputs/flutter-apk/app-release.apk assets/flutter_assets/NOTICES.Z | gunzip | grep -c 'Open Font License' must be non-zero.

After a reboot nothing brings the board back; only the OS notifications survive

android/app/src/main/AndroidManifest.xml:22-43 — the only activity, MAIN/LAUNCHER-only intent filter at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S12_lifecycle.md · agent_reports/S12_refute.md §6. Confirmed from the merged manifest read in full. One of the three S12 findings confirmed as written.

findings/S12_lifecycle.md § S12-F9 — After a reboot nothing brings the board back; only the OS notifications survive: the manifest, verbatim (proof/01_findings/S12/grep_boot_receiver_manifest.txt): 17: <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/> 51: <action android:name="android.intent.action.BOOT_COMPLETED"/> 52: <action android:name="android.intent.action.MY_PACKAGE_REPLACED"/> 53: <action android:name="android.intent.action.QUICKBOOT_POWERON" /> 54: <action android:name="com.htc.intent.action.QUICKBOOT_POWERON"/> and the plugin source that the receiver calls, ~/.pub-cache/hosted/pub.dev/flutter_local_notifications-22.1.0/android/src/main/java/com/dexterous/flutterlocalnotifications/FlutterLocalNotificationsPlugin.java:227-238: java static void rescheduleNotifications(Context context) { ArrayList<NotificationDetails> scheduledNotifications = loadScheduledNotifications(context); for (NotificationDetails notificationDetails : scheduledNotifications) { try { ... } else if (notificationDetails.timeZoneName != null) { zonedScheduleNotification(context, notificationDetails, false); Against that, the app's only activity declaration (android/app/src/main/AndroidManifest.xml:22-43) carries MAIN/LAUNCHER at :40-41 and nothing else. UNVERIFIED (R3): that this fires on a physical tablet has not been observed. It cannot be observed from this workstation — the baseline records flutter doctor as [✗] Android toolchain — Unable to locate Android SDK and no connected Android device (proof/00_baseline/SUMMARY.md §2). The exact protocol that would settle it: install the release build on the target tablet; start a 30-minute timer; adb shell dumpsys alarm | grep dev.sergemio.cadence and record the entry; reboot the tablet; without opening the app, re-run the same dumpsys and record whether the entry reappears; wait for the deadline and record whether the notification fires. Save all four captures. Treat the code comment at lib/alarm_backstop.dart:6 ("Scheduled alarms survive a device reboot (boot receiver)") as unverified until then.

findings/S12_lifecycle.md § S12-F9 — After a reboot nothing brings the board back; only the OS notifications survive: report as a spec item (R6 — this is behaviour the business must decide on, not a defect repair): either add a first-party BOOT_COMPLETED receiver that starts MainActivity, or document that the tablet must be configured in Android's kiosk/device-owner mode with Cadence as the home app. The second costs no code and is what a fleet deployment wants anyway.

findings/S12_lifecycle.md § S12-F9 — After a reboot nothing brings the board back; only the OS notifications survive: the four-capture dumpsys/reboot protocol above, plus a fifth capture showing the Cadence board on screen after the reboot with no human interaction. ---

S12's own Backstop.dispose() fix leaves the OS safety net on a stale deadline

The patch's second hunk, against lib/alarm_backstop.dart:266; the policy it contradicts is at lib/alarm_backstop.dart:240-242 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S12_refute.md §2.1 · proof/01_findings/S12_refute/r6_backstop_dispose_WITH_s12fix.txt. Measured both ways. Unpatched, a teardown inside the 300 ms debounce window leaves the OS holding the new deadline — correct. With S12's patch applied it holds the stale one, ten seconds later than the cook asked for. That is the BLOCKER class of failure traded for a duplicate notification that was never wrong. The correct dispose() is _flushSchedules(); _debounce?.cancel(); _debounce = null; _pending = null; — the same policy the class already applies at onBackground().

Replay the named proof at agent_reports/S12_refute.md §2.1 · proof/01_findings/S12_refute/r6_backstop_dispose_WITH_s12fix.txt against The patch's second hunk, againstlib/alarm_backstop.dart:266; the policy it contradicts is atlib/alarm_backstop.dart:240-242` on a disposable copy of03a176e72ef0075eec86b8915cbe6e93042a3b9d`.

CORRECTED FIX: disposal must first call _flushSchedules(), then cancel and clear _debounce and _pending; never discard a committed deadline update. RED/GREEN TEST: change a deadline by ten seconds, dispose inside the 300 ms debounce window, and assert the OS request holds the new deadline, not the stale one.

agent_reports/S12_refute.md § S12R-F3 — S12's Backstop.dispose() leaves the OS safety net on a stale deadline: proof/01_findings/S12_refute/tests/s12r_backstop_dispose_discards_test.dart, test "B1". Change its final expectation to expect(scheduled.length, 2) and assert the second armed instant is 10,000 ms below the first. Red with S12's patch as written, green with the flush added.

The exported journal carries operator free text and a device description off the device, unredacted

lib/journal.dart:205-237 (export) and lib/ui/modals.dart:696-717 (share) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S13_data.md · agent_reports/S13_refute.md. Confirmed by S13's refuter, and the export path is independently verified by S5's refuter for a different defect (modals.dart:698-717 and journal.dart:233-236 verbatim-exact). Related: S10-F12 (the journal is the operator's only record and it is French-only).

findings/S13_data.md § S13-F1 — The exported journal carries operator free text and a device description off the device, unredacted: the real generated payload, proof/01_findings/S13/probe_data.txt, PROBE-C (EXPORT_BYTES=1157 for this short session): ================================================ SESSION 2026-08-04 12:09:22.619 · Cadence v0.4.12 APPAREIL macos !! SESSION PRECEDENTE TUEE — derniere trace 2026-08-04 12:02:22.618 (silence de 7 min 0 s avant ce demarrage). L'app ne s'est PAS fermee proprement. ================================================ 12:09:22.619 demarrage charge: 7 timers, 0 en cours, langue=fr 12:09:22.619 ecran maintien allume actif (wakelock) 12:09:22.619 secours alarmes systeme actives 12:09:22.619 CREATION "Frites Jean-Marc" — 90 s · sonnerie=Bell · annonce="Table 12 pour Mme Dupont" 12:09:22.619 depart Frites Jean-Marc 90 s 12:09:22.619 ALARME Frites Jean-Marc sonne — decalage 12 ms · a l'ecran · sonnerie=Bell 12:09:22.619 parole "Table 12 pour Mme Dupont" 12:09:22.619 ARRET Frites Jean-Marc alarme coupee apres 4.2 s 12:09:22.619 reglage langue -> fr (voix fr-FR) 12:09:22.619 reglage volume -> 60% (appareil) 12:09:22.619 SUPPRESSION timer "Frites Jean-Marc" 12:09:22.620 !! PANNE CRITIQUE voice-init: engine dead 12:09:22.620 · battement timers=7 actifs=1 sonnent=0 lots=1 a l'ecran 12:09:22.620 EXPORT journal extrait depuis les reglages The share call itself (lib/ui/modals.dart:705-711), verbatim: dart await SharePlus.instance.share(ShareParams( files: [XFile(path)], subject: 'Cadence log — ${Journal.device.split('·').first.trim()} — ' '${p(now.day)}/${p(now.month)} ${p(now.hour)}h${p(now.minute)}', text: 'Journal de bord Cadence v${Journal.appVersion}\n' 'Appareil : ${Journal.device}\n', )); What leaves the device, in what format, to where, at whose initiation: a plain-text .txt file plus a subject and body, handed to the Android/iOS share sheet, only when the operator taps the button (lib/ui/modals.dart:678-681). Cadence chooses no destination and performs no upload; the destination is whatever app the operator picks. Cadence never transmits it itself (§3).

findings/S13_data.md § S13-F1 — The exported journal carries operator free text and a device description off the device, unredacted: this is compliance plumbing, in scope under R6. Two changes: (a) show the operator what is about to be sent — a one-line count and the first and last timestamps — before the share sheet opens; (b) add a redaction option that replaces timer names with their stable ids in the exported copy, keeping the diagnostic value (drift, kills, alarm timings) while removing the free text. Do not remove the journal; research/01_prior_work.md L13 establishes it as the deliverable of the tablet campaign.

findings/S13_data.md § S13-F1 — The exported journal carries operator free text and a device description off the device, unredacted: a journal_test.dart case that logs a line containing Table 12 pour Mme Dupont, calls exportCopy(redact: true), and asserts the exported file does not contain that string while still containing ALARME and the drift figure. Red today — the parameter does not exist and PROBE-C shows the string present. ---

Android auto-backup is on by default, so the journal, the kitchen's entire menu and every preference are copied into the operator's Google account and restored onto any device

android/app/src/main/AndroidManifest.xml:18-21 — the <application> element (S13 cited :20-23; :22-23 are <activity / android:name=".MainActivity") declares only label, name and icon; no android:allowBackup, no android:dataExtractionRules, no android:fullBackupContent at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S13_data.md · findings/S9_platform_config.md · agent_reports/S13_refute.md · agent_reports/S10_refute.md §6 M4 · agent_reports/S9_refute.md. Found three times, from the data-privacy, platform-config and product sides, and refuted twice. S9's refuter proved the absence from its own merged manifest (0 occurrences) and confirmed MEDIUM for the config-gap framing; S13's refuter confirmed HIGH for the data-exposure framing. Take HIGH — the two grades are the same omission read as a configuration gap and as a privacy exposure, and the exposure framing is the one with the measured consequence (S13-R2). S13-R3 REFUTES S13's reasoning: Google's Data Safety guidance defines "collect" as transmitting data off a user's device by the developer, and explicitly exempts a user's own backup to their own cloud account. Following S13-F2's rationale would produce a false store filing on both stores. State the fact; do not declare it as collection.

findings/S13_data.md § S13-F2 — Android auto-backup is on by default and copies the journal and every preference into the operator's Google account: proof/01_findings/S13/apk_permissions.txt — read from the shipped app-release.apk (SHA-256 f11a484d821ed4ab11121ea01f7291841dad320def22cbf9b8f9f61c77e7ca9e): b'allowBackup' in manifest -> False b'a\x00l\x00l\x00o\x00w\x00B\x00a\ in manifest -> False (UTF-16 form) b'dataExtractionRules' in manifest -> False and the merged Gradle release manifest shows the <application> element carrying only android:name, android:appComponentFactory, android:extractNativeLibs, android:icon, android:label. The default, verbatim from developer.android.com (capture proof/03_market/captures/s13_android_allowbackup.txt, URL https://developer.android.com/guide/topics/manifest/application-element, retrieved 2026-08-04): > android:allowBackup — Whether to let the application participate in the backup and restore > infrastructure. … The default value of this attribute is "true". > > Note: For apps targeting Android 12 (API level 31) or higher, this behavior varies. On devices > from some device manufacturers, you can't disable device-to-device migration of your app's files. The app targets API 36 (uses-sdk android:targetSdkVersion="36" in the merged manifest), so it is in that second category. What auto-backup takes, verbatim from developer.android.com (capture proof/03_market/captures/s13_android_autobackup.txt, URL https://developer.android.com/identity/data/autobackup, retrieved 2026-08-04): > Files saved to your app's internal storage and accessed by getFilesDir() or getDir(String, int) > > … sharedpref: the directory where SharedPreferences are stored. > > Auto Backup excludes files in directories returned by getCacheDir(), getCodeCacheDir(), and > getNoBackupFilesDir(). The journal lives in getDir("flutter", MODE_PRIVATE) — path_provider_android resolves getApplicationDocumentsDirectory() there (path_provider_android-2.3.1/lib/src/path_provider_android_real.dart:36-46, quoted in proof/01_findings/S13/transitive_http_reachability.txt context) — which is the exact API the Android documentation names as included. Net effect: all 11 preference keys, any .corrupt sibling, and the whole cadence-journal.txt, including every operator free-text field, are uploaded to the tablet owner's Google Drive backup. Only the exported copy in the temp directory escapes it, because getTemporaryDirectory() maps to cacheDir. findings/S9_platform_config.md § S9-F10 — android:allowBackup and android:dataExtractionRules are undeclared, so the timer run-state is cloud-backed-up and device-transferred by default: Verbatim, android/app/src/main/AndroidManifest.xml:18-21 — the complete <application> opening tag: xml <application android:label="Cadence" android:name="${applicationName}" android:icon="@mipmap/ic_launcher"> Confirmed absent after manifest merge, in the packaged release manifest (build/app/intermediates/packaged_manifests/release/processReleaseManifestForPackage/AndroidManifest.xml:60-65): xml <application android:name="android.app.Application" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:extractNativeLibs="false" android:icon="@mipmap/ic_launcher" android:label="Cadence" > Neither android:allowBackup nor android:dataExtractionRules nor android:fullBackupContent appears. The persisted key whose restore is dangerous, verbatim from lib/engine/models.dart:97 and lib/engine/store.dart:16: RunEntry.endsAt is an absolute epoch-millisecond deadline stored under cadence-run-v1. Source for the default and the mechanism: Android Auto Backup (https://developer.android.com/guide/topics/data/autobackup, retrieved 2026-08-04, captures/android_allowbackup_ref.txt). agent_reports/S10_refute.md § M4 — Android Auto Backup is on by default and is nowhere in the product's own account of its data: the <application> element of the manifest carries android:label, android:name and android:icon and no backup attribute of any kind. Official behaviour: "Apps that target Android 6.0 (API level 23) or higher automatically participate in Auto Backup… The default value is true, but we recommend explicitly setting the attribute in your manifest"; the included set lists "sharedpref: the directory where SharedPreferences are stored"; backups go "to the user's Google Drive" with "up to 25 MB of backup data per app user", and occur when "the user has enabled backup on the device… at least 24 hours have elapsed… the device is idle… the device is connected to a Wi-Fi network" — https://developer.android.com/identity/data/autobackup, retrieved 2026-08-04, capture at proof/01_findings/S10_refute/captures/android_autobackup.txt. agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: lib/journal.dart:25-26: dart static const _maxBytes = 3 * 1024 * 1024; // rotate above 3 MB static const _keepBytes = 1024 * 1024; // keep the last 1 MB and lib/journal.dart:227-231: dart // best-effort USB-reachable copy; never blocks the share try { final ext = await getExternalStorageDirectory(); if (ext != null) await _file!.copy('${ext.path}/$name'); } catch (_) {} with the filename carrying date and time (:221-223), so each export creates a new file. Android's own documentation (capture proof/03_market/captures/s813r_android_autobackup.txt, URL https://developer.android.com/identity/data/autobackup, retrieved 2026-08-04): > By default, Auto Backup includes files in most of the directories that are assigned to your app by > the system: Shared preferences files … Files saved to your app's internal storage and accessed by > getFilesDir() or getDir(String, int) … Files on external storage in the directory returned by > getExternalFilesDir(String) > Backup data is stored in a private folder in the user's Google Drive account, limited to 25 MB per > app. … Caution: If the amount of data is over 25 MB, the system calls onQuotaExceeded() and > doesn't back up data to the cloud. agent_reports/S13_refute.md § S13-R3 — S13-F2's store-declaration rationale is wrong, and following it would over-declare on both stores: capture proof/03_market/captures/s813r_play_data_safety_expanded.txt, URL https://support.google.com/googleplay/android-developer/answer/10787469?hl=en, retrieved 2026-08-04, §"Data collection": > "Collect" means transmitting data from your app off a user's device. > Note: Developers do not have to declare data access as collection if it occurs solely on the user's > device as long as the data is never transmitted off the user's device. and, on the exact shape of the backup case: > My app enables users to upload their data directly to Google Drive or Dropbox for backup or > storage. My app does not access any of this data. Should that still be disclosed as "collection"? > It depends on the particular implementation. If the user chooses to upload their data directly to > their own external drive or cloud storage account (such as Google Drive, Dropbox, or similar > services) and this upload is governed by the external drive or cloud storage provider's terms of > service and privacy policy, and your app never collects or accesses the data in question, then your > app does not need to declare the collection of this data. Apple's definition is quoted in §1 above and gives the same answer. Auto Backup is performed by the Android OS into the tablet owner's own Google account under Google's terms; Serge never receives or accesses it. Neither is the share-sheet export, whose destination the operator chooses. agent_reports/S2_refute.md § S2R-M4 — The .corrupt backup write is itself unverified and non-critical, so the "never silently lost" guarantee can fail silently: with a platform store that refuses writes to cadence-timers-v1.corrupt — M4 backup present=false | scopes=[load-cadence-timers-v1, save-set-cadence-timers-v1.corrupt] | critical={load-cadence-timers-v1} save-set-cadence-timers-v1.corrupt is absent from critical.

findings/S13_data.md § S13-F2 — Android auto-backup is on by default and copies the journal and every preference into the operator's Google account: compliance plumbing, in scope under R6. Add to the <application> element: android:allowBackup="false" — or, if the timer configuration should survive a device swap, android:dataExtractionRules="@xml/backup_rules" with the journal excluded and only cadence-timers-v1 included. The second option also happens to be the cheapest partial answer to S13-F4. Decide which; do not ship the current silent default. findings/S9_platform_config.md § S9-F10 — android:allowBackup and android:dataExtractionRules are undeclared, so the timer run-state is cloud-backed-up and device-transferred by default: Declare the policy explicitly on the <application> element rather than inheriting it. Either android:allowBackup="false" if restored timer state is not wanted, or android:allowBackup="true" together with an android:dataExtractionRules XML that excludes cadence-run-v1 and cadence-clones-v1 from both <cloud-backup> and <device-transfer> while keeping cadence-timers-v1, cadence-lang and cadence-vol — so a restored device keeps the chef's timer definitions and loses only the transient run state. The second is the better product behaviour and is still a configuration change, not a feature. agent_reports/S10_refute.md § M4 — Android Auto Backup is on by default and is nowhere in the product's own account of its data: set android:allowBackup explicitly, in whichever direction Serge chooses, per the platform's own recommendation. Compliance plumbing, in scope under R6. agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: delete previous cadence-log-*.txt files in the external directory before writing a new one, keeping at most the newest (S13-F5's own fix — this finding raises its priority). Then, when fixing S13-F2, use android:dataExtractionRules that include cadence-timers-v1 and exclude the journal and the external directory, rather than allowBackup="false", so config recovery survives and the quota stops being consumed by transcripts. agent_reports/S13_refute.md § S13-R3 — S13-F2's store-declaration rationale is wrong, and following it would over-declare on both stores: rewrite the "Why it matters" paragraph; keep the fix (dataExtractionRules over allowBackup="false", per S13-R2). Correct §1's framing to "GDPR controller inventory", and add one line recording that both store forms answer "no data collected", with the two definitions quoted. agent_reports/S2_refute.md § S2R-M4 — The .corrupt backup write is itself unverified and non-critical, so the "never silently lost" guarantee can fail silently: give _guard an {bool isCritical = false} parameter (S2-F10 proposes the same signature change for the one-shot flags) and pass isCritical: true for the .corrupt sibling write at store.dart:123.

findings/S13_data.md § S13-F2 — Android auto-backup is on by default and copies the journal and every preference into the operator's Google account: rebuild the release APK and re-run the manifest dump in proof/01_findings/S13/apk_permissions.txt. It prints b'allowBackup' in manifest -> False today; after the fix it prints True and the merged manifest shows android:allowBackup="false". --- findings/S9_platform_config.md § S9-F10 — android:allowBackup and android:dataExtractionRules are undeclared, so the timer run-state is cloud-backed-up and device-transferred by default: An assertion over the merged manifest: grep -c 'android:allowBackup' build/app/intermediates/packaged_manifests/release/processReleaseManifestForPackage/AndroidManifest.xml returns 0 now and ≥ 1 after; plus a Store unit test that loads a cadence-run-v1 blob whose endsAt is a week in the past and asserts the resulting engine state contains no ringing entries. --- agent_reports/S10_refute.md § M4 — Android Auto Backup is on by default and is nowhere in the product's own account of its data: grep the built manifest for the attribute; it is absent today. --- agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: extend test/journal_test.dart with a _FakePaths overriding getExternalStoragePath(), call exportCopy() three times, and assert the external directory holds at most one cadence-log-*.txt. Red today (three files). agent_reports/S13_refute.md § S13-R3 — S13-F2's store-declaration rationale is wrong, and following it would over-declare on both stores: not a code test — the two quoted definitions above are the artifact. agent_reports/S2_refute.md § S2R-M4 — The .corrupt backup write is itself unverified and non-critical, so the "never silently lost" guarantee can fail silently: my test "M4 — the .corrupt backup write is itself unverified…". Invert the last expectation to contains('save-set-cadence-timers-v1.corrupt'). Red now, green after. ---

The journal writes an unmanaged second copy to external storage that nothing ever deletes

lib/journal.dart:228-231 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S13_data.md · agent_reports/S13_refute.md §3 S13-R2. Raised by its own refuter. The unmanaged copies are not merely clutter: they sit in a directory Android backs up by default, each is 1–3 MB, and roughly nine of them exhaust the 25 MB per-app Auto Backup quota, at which point cloud backup stops silently for the whole app (S13-R2). The surrounding block (:226, :231) is independently verified verbatim by S5's refuter for S5-F10.

findings/S13_data.md § S13-F5 — The journal writes an unmanaged second copy to external storage that nothing ever deletes: proof/01_findings/S13/no_config_export_import.txt, section 3, quotes the block verbatim; proof/01_findings/S13/probe_data.txt, PROBE-D shows one export producing one dated file alongside the primary journal: AFTER_EXPORT_FILES=[cadence-journal.txt, cadence-log-macos-2026-08-04-12h09.txt] The comment at :227 states the intent — a copy reachable over USB — which is exactly why it sits outside private storage. agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: lib/journal.dart:25-26: dart static const _maxBytes = 3 * 1024 * 1024; // rotate above 3 MB static const _keepBytes = 1024 * 1024; // keep the last 1 MB and lib/journal.dart:227-231: dart // best-effort USB-reachable copy; never blocks the share try { final ext = await getExternalStorageDirectory(); if (ext != null) await _file!.copy('${ext.path}/$name'); } catch (_) {} with the filename carrying date and time (:221-223), so each export creates a new file. Android's own documentation (capture proof/03_market/captures/s813r_android_autobackup.txt, URL https://developer.android.com/identity/data/autobackup, retrieved 2026-08-04): > By default, Auto Backup includes files in most of the directories that are assigned to your app by > the system: Shared preferences files … Files saved to your app's internal storage and accessed by > getFilesDir() or getDir(String, int) … Files on external storage in the directory returned by > getExternalFilesDir(String) > Backup data is stored in a private folder in the user's Google Drive account, limited to 25 MB per > app. … Caution: If the amount of data is over 25 MB, the system calls onQuotaExceeded() and > doesn't back up data to the cloud.

findings/S13_data.md § S13-F5 — The journal writes an unmanaged second copy to external storage that nothing ever deletes: before writing the new external copy, delete previous cadence-log-*.txt files in that directory, keeping at most the newest one. Alternatively gate the external copy behind a debug/pilot flag so it does not ship to restaurants at all. Either is a few lines inside the existing try block. agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: delete previous cadence-log-*.txt files in the external directory before writing a new one, keeping at most the newest (S13-F5's own fix — this finding raises its priority). Then, when fixing S13-F2, use android:dataExtractionRules that include cadence-timers-v1 and exclude the journal and the external directory, rather than allowBackup="false", so config recovery survives and the quota stops being consumed by transcripts.

findings/S13_data.md § S13-F5 — The journal writes an unmanaged second copy to external storage that nothing ever deletes: extend test/journal_test.dart with a _FakePaths that also overrides getExternalStoragePath(), call exportCopy() three times, and assert the external directory holds at most one cadence-log-*.txt. Red today (three files). --- agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: extend test/journal_test.dart with a _FakePaths overriding getExternalStoragePath(), call exportCopy() three times, and assert the external directory holds at most one cadence-log-*.txt. Red today (three files).

S13-F5 and S13-F2 compound into silent loss of the only configuration backup: roughly nine journal exports blow Android's 25 MB Auto Backup quota and cloud backup stops, unannounced

lib/journal.dart:25-26 (_maxBytes = 3 MB, _keepBytes = 1 MB), :221-231 (the export copy) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S13_refute.md §3. Three facts each present in S13's report and never multiplied: (a) every export writes a new dated copy into getExternalStorageDirectory() and nothing deletes any of them; (b) that directory is Context.getExternalFilesDir(null), which Android's Auto Backup documentation lists among the directories it backs up by default; (c) Auto Backup is capped at 25 MB per app, past which onQuotaExceeded() fires and the system stops backing the app up entirely. Each rotated copy is 1–3 MB. A pilot kitchen exporting daily crosses the quota inside a fortnight — and this is the evidence that settles the S10-F1 / S13-F4 severity dispute (CONTRADICTIONS.md §6): the platform default S10's refuter relied on is not dependable.

agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: lib/journal.dart:25-26: dart static const _maxBytes = 3 * 1024 * 1024; // rotate above 3 MB static const _keepBytes = 1024 * 1024; // keep the last 1 MB and lib/journal.dart:227-231: dart // best-effort USB-reachable copy; never blocks the share try { final ext = await getExternalStorageDirectory(); if (ext != null) await _file!.copy('${ext.path}/$name'); } catch (_) {} with the filename carrying date and time (:221-223), so each export creates a new file. Android's own documentation (capture proof/03_market/captures/s813r_android_autobackup.txt, URL https://developer.android.com/identity/data/autobackup, retrieved 2026-08-04): > By default, Auto Backup includes files in most of the directories that are assigned to your app by > the system: Shared preferences files … Files saved to your app's internal storage and accessed by > getFilesDir() or getDir(String, int) … Files on external storage in the directory returned by > getExternalFilesDir(String) > Backup data is stored in a private folder in the user's Google Drive account, limited to 25 MB per > app. … Caution: If the amount of data is over 25 MB, the system calls onQuotaExceeded() and > doesn't back up data to the cloud.

agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: delete previous cadence-log-*.txt files in the external directory before writing a new one, keeping at most the newest (S13-F5's own fix — this finding raises its priority). Then, when fixing S13-F2, use android:dataExtractionRules that include cadence-timers-v1 and exclude the journal and the external directory, rather than allowBackup="false", so config recovery survives and the quota stops being consumed by transcripts.

agent_reports/S13_refute.md § S13-R2 — S13-F5 and S13-F2 compound into silent loss of the only configuration backup: extend test/journal_test.dart with a _FakePaths overriding getExternalStoragePath(), call exportCopy() three times, and assert the external directory holds at most one cadence-log-*.txt. Red today (three files).

A failure inside Store.open() kills the app before runApp: the tablet shows a blank window forever, nothing logged, nothing on screen

lib/main.dart:22-35, specifically :24 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S14_entry_unowned.md · agent_reports/S14_refute.md §2.1. Test T1 re-run green; realism established from the Android plugin's Kotlin source; the blank-window claim verified against the Flutter engine's own FlutterActivity.java, i.e. reachable without mocking.

findings/S14_entry_unowned.md § S14-F1 — A failure inside Store.open() kills the app before runApp: the tablet shows a blank window forever, with nothing logged, nothing on screen, and no way for the operator to know why: verbatim source — dart Future<void> main() async { WidgetsFlutterBinding.ensureInitialized(); final store = await Store.open(); await Journal.init(store.prefs, kAppVersion); (lib/main.dart:22-25) and dart static Future<Store> open() async => Store(await SharedPreferences.getInstance()); (lib/engine/store.dart:29-30) Executable proof — test T1 in proof/01_findings/S14/s14_main_test.dart, run recorded in proof/01_findings/S14/probe_main_green.txt (00:00 +4: All tests passed!, EXIT_CODE=0). T1 installs a mock handler on MethodChannel('plugins.flutter.io/shared_preferences') that throws PlatformException(code: 'storage_unavailable'), calls the real main(), and asserts: dart expect(thrown, isA<PlatformException>(), reason: 'main() has no try around Store.open(); the error escapes'); expect(find.byType(app.CadenceApp), findsNothing); expect(find.byType(HomeScreen), findsNothing); expect(find.byType(MaterialApp), findsNothing); expect(Diag.log, isEmpty, reason: 'no Diag entry is produced by a failed Store.open()'); expect(Diag.critical.value, isEmpty, reason: 'no critical scope, therefore no operator banner'); All five assertions hold. T2 in the same file is the control: the identical Store.open() call succeeds when the store is available, so the exception in T1 is the storage failure and nothing else in main().

findings/S14_entry_unowned.md § S14-F1 — A failure inside Store.open() kills the app before runApp: the tablet shows a blank window forever, with nothing logged, nothing on screen, and no way for the operator to know why: wrap the two awaited boot calls and always reach runApp. No new user feature — it is defect repair and reuses the operator banner that already exists: dart Store? store; try { store = await Store.open(); } catch (e) { Diag.fail('boot-store', e, isCritical: true); } then, when store == null, runApp a minimal failure screen carrying the existing i18n.call('loadFail') string (lib/i18n.dart:75-76, :121-122) plus the exception text, so the cook sees a message and the next engineer sees a cause. Journal.init already never throws by design (lib/journal.dart:64, "Never throws: a broken journal must never take the app down with it") and does not need the same treatment — but it must be called on both branches so the failure itself is recorded.

findings/S14_entry_unowned.md § S14-F1 — A failure inside Store.open() kills the app before runApp: the tablet shows a blank window forever, with nothing logged, nothing on screen, and no way for the operator to know why: T1 as written goes green today because it asserts the broken behaviour. Invert it: expect(find.textContaining(<the failure string>), findsOneWidget) after await main() with the throwing store mock. That assertion fails at 03a176e (nothing is rendered — proven above by findsNothing on MaterialApp) and passes after the fix. ---

Both awaited startup calls can hang forever with no timeout and no watchdog, producing the same blank window with no exception to catch

lib/main.dart:24-25 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S14_entry_unowned.md · agent_reports/S14_refute.md §2.2. S14 argued from absence. The refuter executed it: flutter test killed at 90 s wall clock, EXIT_CODE=124.

findings/S14_entry_unowned.md § S14-F2 — Both awaited startup calls can hang forever with no timeout and no watchdog, producing the same blank window with no exception to catch: .timeout( appears exactly once in the whole of lib/, and it is not in the boot path — lib/audio/voice.dart:168, a 12-second timeout on the speak invocation (research/00_code_map.md §3.3, ".timeout(...): one site"). lib/main.dart verbatim contains no try, no timeout, and one error handler, the .catchError at :30 on the unawaited wakelock chain (research/00_code_map.md §3.3, row 1: lib/main.dart:30 is the file's only entry in the 38-site error-handling inventory).

findings/S14_entry_unowned.md § S14-F2 — Both awaited startup calls can hang forever with no timeout and no watchdog, producing the same blank window with no exception to catch: put a bounded wait on each boot call and always reach runApp: await Store.open().timeout(const Duration(seconds: 5)) and await Journal.init(...).timeout(const Duration(seconds: 5)), both inside the F1 try, with the TimeoutException routed to Diag.fail('boot-store' | 'boot-journal', e, isCritical: true). The 5-second figure is not a magic number: it must be shorter than the operator's tolerance for a black screen and longer than a cold prefs read on the known field device (Lenovo TB-8505F, Android 10, named in commit f46d142), and it should be pinned by the same constant in both places.

findings/S14_entry_unowned.md § S14-F2 — Both awaited startup calls can hang forever with no timeout and no watchdog, producing the same blank window with no exception to catch: a test that installs a mock handler on MethodChannel('plugins.flutter.io/shared_preferences') returning a Completer that is never completed, then asserts main() completes and the failure screen is rendered within the fake-async budget. At 03a176e that test hangs and is reported as a timeout by flutter test; after the fix it passes. ---

A timer created after v0.4.11 is forced to Bell if the migration ever re-runs

lib/engine/store.dart:273-279 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · proof/01_findings/S2_refute/. The loop has no legacyZoneId == null guard. Unlike S2-F3 this is reachable through the S2-F2 kill window and needs no wrong-typed value.

findings/S2_persistence.md § S2-F4 — A timer created after v0.4.11 is forced to Bell if the migration ever re-runs: recorded run proof/01_findings/S2/02_migration.txt: DEFECT 4 — a v0.4.11+ timer carried through the migration is forced to Bell sounds after migration: {Fries: Beep, Baklava: Bell} Baklava was seeded with 'sound': 'Cascade' and no zoneId.

findings/S2_persistence.md § S2-F4 — A timer created after v0.4.11 is forced to Bell if the migration ever re-runs: the if (zid == null) continue; guard in S2-F2's fix resolves this finding too.

findings/S2_persistence.md § S2-F4 — A timer created after v0.4.11 is forced to Bell if the migration ever re-runs: s2_migration_test.dart, test "DEFECT 4"; change the final expectation to expect(_sounds(e)['Baklava'], 'Cascade'). Red now, green after. ---

A failed journal write discards the buffered lines permanently and tells nobody; Journal.ready keeps returning true

lib/journal.dart:163-180, specifically :167-168 (the _buf.clear() before the write) and :175-177 (debugPrint only); ready => _file != null at :53; Settings block stays up at lib/ui/modals.dart:673 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · findings/S5_error_handling.md · agent_reports/S2_refute.md · agent_reports/S5_refute.md. Found twice. S2 filed the data-loss half at HIGH and reproduced it (probe J1: the two lines logged during the outage are absent, Diag.log=0, Journal.ready=true). S5 filed the reporting half at MEDIUM and its refuter recorded that S5 missed the data loss sitting in the same six lines, and that S5's proposed fix ("stamp !! ECRITURE JOURNAL IMPOSSIBLE into the buffer for the next flush") is not implementable — by the time the handler runs the buffer is already cleared. Take S2's grade and drop S5's fix.

findings/S2_persistence.md § S2-F5 — A failed journal write discards the buffered lines permanently and tells nobody: the code, verbatim — dart // journal.dart:166-177 if (_buf.isEmpty) return; final chunk = List<String>.from(_buf); _buf.clear(); // <- cleared BEFORE the write try { await _file!.writeAsString('${chunk.join('\n')}\n', mode: FileMode.append, flush: true); await _prefs?.setInt(_kLastBeat, DateTime.now().millisecondsSinceEpoch); } catch (e) { debugPrint('[cadence] journal write failed: $e'); // <- chunk is discarded } Recorded run proof/01_findings/S2/03_journal_diagnostics.txt: J1 DEFECT — a failed journal write DISCARDS the buffered lines permanently after failed writes: Diag.log=0 entries, Journal.ready=true recovered file: 12:03:38.792 reprise stockage revenu The two lines logged during the outage — ALARME Fries and ARRET Fries — never appear. findings/S5_error_handling.md § S5-F4 — Journal write failures are reported to nobody, and Journal.ready keeps saying yes: verbatim, lib/journal.dart:169-177: dart try { await _file!.writeAsString('${chunk.join('\n')}\n', mode: FileMode.append, flush: true); // "last known alive" moves with every write, so a kill is dated to the // last event rather than to the last 60s beat await _prefs?.setInt(_kLastBeat, DateTime.now().millisecondsSinceEpoch); } catch (e) { debugPrint('[cadence] journal write failed: $e'); } Forced to fire by replacing the journal file with a directory of the same name — test S5-F4 … a write that fails is reported to NOBODY, and ready stays true (proof/01_findings/S5/01_s5_tests_baseline.txt): [cadence] journal write failed: FileSystemException: Cannot open file, … (OS Error: Is a directory, errno = 21) with Journal.ready == true, Diag.log empty and Diag.critical.value empty. In a release build debugPrint goes to the platform log, which nobody reads on a kitchen tablet.

findings/S2_persistence.md § S2-F5 — A failed journal write discards the buffered lines permanently and tells nobody: on failure, re-insert the chunk at the head of _buf (_buf.insertAll(0, chunk)) up to a bounded retry budget, and route the failure through Diag.fail('journal-write', e, isCritical: true) so the operator banner lights. To avoid the recursion Diag.fail → Journal.log → _flush, guard with a static bool _reportingWriteFailure re-entrancy flag. findings/S5_error_handling.md § S5-F4 — Journal write failures are reported to nobody, and Journal.ready keeps saying yes: add static bool writeFailed = false; set in the handler, and one-shot debugPrint-plus-in-memory record via Diag.log.add(DiagEntry(...)) directly (bypassing Diag.fail, which is what would recurse). Have Journal.ready return _file != null && !writeFailed, so the Settings block hides itself, and stamp !! ECRITURE JOURNAL IMPOSSIBLE into the buffer for the next successful flush. journal.dart:108 should additionally Diag.log.add(...) so the exported diagnostics of a later session record that the previous one had no recorder.

findings/S2_persistence.md § S2-F5 — A failed journal write discards the buffered lines permanently and tells nobody: s2_journal_diag_test.dart, test "J1 DEFECT". Invert the last two expectations to expect(text, contains('ALARME Fries')) and expect(Diag.critical.value, contains('journal-write')). Red now, green after. --- findings/S5_error_handling.md § S5-F4 — Journal write failures are reported to nobody, and Journal.ready keeps saying yes: the existing test with expect(Journal.ready, isTrue) changed to isFalse and expect(Diag.log, isEmpty) changed to expect(Diag.log.map((d) => d.scope), contains('journal-write')). Red now, green after. ---

Journal rotation erases the entire journal when the file cannot be decoded

lib/journal.dart:192-203 (catch (_) { await f.writeAsString(''); }), triggered from :72 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · findings/S5_error_handling.md · agent_reports/S2_refute.md · agent_reports/S5_refute.md. Found twice, and the two refuters disagree on severity. S2's refuter reproduced the destruction (probe J3: 3,146,812 bytes → 167 bytes) and kept HIGH; lcov confirms 192,194,195,196,197,199,201 are all uncovered. S5's refuter downgraded to MEDIUM on the ground that the trigger needs the file to first exceed _maxBytes = 3 MiB. Resolved HIGH — S12's refuter reconciled journal growth at 237 KiB/day, so the 3 MiB cap is crossed in 13 days of kiosk uptime, which makes the trigger reachable inside a fortnight. S2 owns journal.dart depth; S5's row is duplicated effort, not a boundary gap.

findings/S2_persistence.md § S2-F6 — Journal rotation erases the entire journal when the file cannot be decoded: the code, verbatim — dart // journal.dart:192-203 static Future<void> _rotate(File f) async { try { final raw = await f.readAsString(); final cut = raw.length - _keepBytes; final start = raw.indexOf('\n', cut < 0 ? 0 : cut) + 1; await f.writeAsString( '[... debut du journal tronque pour rester sous 3 Mo ...]\n' '${raw.substring(start)}'); } catch (_) { await f.writeAsString(''); // <- total destruction, silently } } Recorded run proof/01_findings/S2/03_journal_diagnostics.txt: J3 DEFECT — rotation destroys the ENTIRE journal when the file cannot be decoded journal was 3146812 bytes; after init it is 167 bytes surviving content: ================================================ SESSION 2026-08-04 12:03:38.824 · Cadence v0.4.12 APPAREIL macos ================================================ 167 bytes is the new session header alone. The line seeded as SESSION 2026-08-01 — a whole service worth of evidence is gone. findings/S5_error_handling.md § S5-F3 — Journal._rotate erases the entire flight recorder when it cannot read it: verbatim, lib/journal.dart:192-203: dart static Future<void> _rotate(File f) async { try { final raw = await f.readAsString(); final cut = raw.length - _keepBytes; final start = raw.indexOf('\n', cut < 0 ? 0 : cut) + 1; await f.writeAsString( '[... debut du journal tronque pour rester sous 3 Mo ...]\n' '${raw.substring(start)}'); } catch (_) { await f.writeAsString(''); } } Forced to fire with a 3,360,001-byte journal whose tail is a dangling UTF-8 lead byte — what a force-stop mid-write leaves behind — test S5-F4 … _rotate ERASES the whole journal when the read fails (proof/01_findings/S5/01_s5_tests_baseline.txt): S5: journal was 3360001 bytes, is now 171 chars: " ================================================ SESSION 2026-08-04 1" Every historic line is gone; the 171 characters that remain are this session's own header, written after the wipe. Diag.log is empty — nothing was reported. Mutation proof (R8): removing await f.writeAsString('') from the handler (proof/01_findings/S5/08_mutationB.patch) turns that named test red, because the file still holds the original 3 MB (proof/01_findings/S5/08_mutationB_result.txt, EXIT_CODE=1) — confirming the baseline test passes only because production code emptied the file.

findings/S2_persistence.md § S2-F6 — Journal rotation erases the entire journal when the file cannot be decoded: read bytes, not text, and never truncate to empty on error: dart final bytes = await f.readAsBytes(); final keep = bytes.length <= _keepBytes ? bytes : bytes.sublist(bytes.length - _keepBytes); await f.writeAsBytes( utf8.encode('[... debut du journal tronque ...]\n') + keep); and on catch (e) rename the file to cadence-journal.corrupt.txt and start a fresh one, so the evidence survives, plus Diag.fail('journal-rotate', e, isCritical: true). findings/S5_error_handling.md § S5-F3 — Journal._rotate erases the entire flight recorder when it cannot read it: never destroy on error. Rename the unreadable file aside and start a new one: dart } catch (e) { try { await f.rename('${f.path}.broken'); } catch (_) {} Diag.fail('journal-rotate', e); } (init already re-creates the file at journal.dart:71 when it does not exist.) If a rename is unwanted, f.readAsString(encoding: const Utf8Codec(allowMalformed: true)) removes the dominant trigger without any data loss.

findings/S2_persistence.md § S2-F6 — Journal rotation erases the entire journal when the file cannot be decoded: s2_journal_diag_test.dart, test "J3 DEFECT". Invert to expect(after, contains('a whole service worth of evidence')). Red now, green after. --- findings/S5_error_handling.md § S5-F3 — Journal._rotate erases the entire flight recorder when it cannot read it: the existing test S5-F4 … _rotate ERASES the whole journal when the read fails, with its assertions inverted: expect(after.contains('ligne de journal reelle'), isTrue) and expect(Diag.log.map((d) => d.scope), contains('journal-rotate')). Red now, green after. ---

A dead journal is completely silent: no diagnostic, no banner, and every later event vanishes

lib/journal.dart:108-111 and :133-134 (also :208, :233) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · proof/01_findings/S2_refute/. Probes J2/J7 reproduce.

findings/S2_persistence.md § S2-F7 — A dead journal is completely silent: no diagnostic, no banner, and every later event vanishes: recorded run proof/01_findings/S2/03_journal_diagnostics.txt: J2 DEFECT — the journal is silently DEAD when init fails journal ready=false | Diag scopes=[audio-init] | critical={audio-init} J7 — exportCopy returns null and journals nothing when the journal is down exportCopy -> null | Diag=[] An audio failure raises a banner; the failure of the diagnostic tool itself raises nothing.

findings/S2_persistence.md § S2-F7 — A dead journal is completely silent: no diagnostic, no banner, and every later event vanishes: in the catch at 108, add Diag.fail('journal-init', e, isCritical: true); after _file = null. Diag.fail is safe to call here — its own Journal.log at diagnostics.dart:37 no-ops when _file == null. Add the same to the exportCopy catch at 233 (Diag.fail('journal-export', e) — note that scope string is already used by ui/modals.dart, so reuse it).

findings/S2_persistence.md § S2-F7 — A dead journal is completely silent: no diagnostic, no banner, and every later event vanishes: s2_journal_diag_test.dart, test "J2 DEFECT". Change expect(Diag.log.map((d) => d.scope).toList(), ['audio-init']) to containsAll(['journal-init', 'audio-init']) and assert expect(Diag.critical.value, contains('journal-init')). Red now, green after. ---

Diag.fail can itself throw, and the throw escapes the catch block that called it

lib/diagnostics.dart:29 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · proof/01_findings/S2_refute/. Independently reproduced (test R8a): escaped=Bad state: toString exploded, Diag.log=0, critical={}. All ten store.dart call sites cited (:38,47,56,120,126,137,142,145,176,178) verified valid.

findings/S2_persistence.md § S2-F8 — Diag.fail can itself throw, and the throw escapes the catch block that called it: the code, verbatim — dart // diagnostics.dart:28-38 static void fail(String scope, Object e, {bool isCritical = false}) { log.add(DiagEntry(DateTime.now(), scope, '$e')); // <- can throw if (log.length > _max) log.removeAt(0); if (_warned.add(scope)) debugPrint('[cadence] $scope: $e'); if (isCritical && !critical.value.contains(scope)) { critical.value = {...critical.value, scope}; } Journal.log(isCritical ? '!! PANNE CRITIQUE' : '! panne', '$scope: $e'); } Recorded run proof/01_findings/S2/03_journal_diagnostics.txt: D1 DEFECT — Diag.fail THROWS when the error object's toString() throws Diag.fail escaped with: Bad state: toString exploded; Diag.log=0 The test additionally asserts Diag.critical.value is empty and the journal file contains no PANNE line — the failure is neither contained nor recorded.

findings/S2_persistence.md § S2-F8 — Diag.fail can itself throw, and the throw escapes the catch block that called it: stringify defensively once, at the top: dart String msg; try { msg = '$e'; } catch (_) { msg = '<unprintable ${e.runtimeType}>'; } then use msg throughout, and wrap the Journal.log call at 37 in its own try/catch so a journal fault cannot escape the choke point either.

findings/S2_persistence.md § S2-F8 — Diag.fail can itself throw, and the throw escapes the catch block that called it: s2_journal_diag_test.dart, test "D1 DEFECT". Invert to expect(escaped, isNull) and expect(Diag.log, hasLength(1)). Red now, green after. ---

Corrupt timers plus a wrong-typed seeded flag installs the demo kitchen over a real one

lib/engine/store.dart:300-310 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S2_persistence.md · proof/01_findings/S2_refute/. Reproduced (R9a), and a variant needing no wrong type at all was proven (R9b): JSON-corrupt cadence-timers-v1 plus an absent cadence-seeded-v1, on any post-migration tablet where store.dart:283 already removed the zones key, seeds the seven demo dishes. This finding stands on its own reachable trigger and does not fall with S2-F1.

findings/S2_persistence.md § S2-F9 — Corrupt timers plus a wrong-typed seeded flag installs the demo kitchen over a real one: recorded run proof/01_findings/S2/01_corruption_matrix.txt: DEFECT — corrupt timers + wrong-typed seeded flag => the demo seed replaces the kitchen seedIfFresh returned true; board is now [Manouche, Mozzarella sticks, Fries, Crispy, Melt cheese, Dough, Cook chicken]

findings/S2_persistence.md § S2-F9 — Corrupt timers plus a wrong-typed seeded flag installs the demo kitchen over a real one: treat "we could not read the flag" as "not fresh". Change line 301 to dart if (prefs.containsKey(_kSeeded)) return false; // any value at all means we have run before and add a third guard: refuse to seed when Diag.critical.value contains any load- scope, i.e. when this boot already reported corrupt data.

findings/S2_persistence.md § S2-F9 — Corrupt timers plus a wrong-typed seeded flag installs the demo kitchen over a real one: s2_corruption_matrix_test.dart, test "DEFECT — corrupt timers + wrong-typed seeded flag". Invert to expect(seeded, isFalse) and expect(e.timers, isEmpty). Red now, green after. ---

A corrupt clones value silently destroys the run entries of every batch in flight

lib/engine/store.dart:65 and lib/engine/engine.dart:76-80 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S2_refute.md §7. load decodes the three keys independently, but reconcile() couples them: losing the clones list deletes every run entry belonging to a batch, under a key that was never damaged, with no .corrupt backup taken. Reachable through the ordinary JSON path (row C1) — no wrong type needed.

agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: M1 clones key corrupt -> runs=1/4 clones=0/3 | run backup=null | banner={load-cadence-clones-v1} and the row pair in §6 (C0 runs=6/6 → C1 runs=3/6). After the probe calls saveRun, the persisted run map holds one entry.

agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: when _readList(_kClones, …) reports a drop or a total failure, do not let reconcile silently harvest the orphaned run entries — preserve cadence-run-v1 to its own .corrupt sibling in the same load, and raise the existing load-cadence-clones-v1 critical with a count of the run entries about to be dropped.

agent_reports/S2_refute.md § S2R-M1 — A corrupt clones value silently destroys the run entries of every batch in flight: my test "M1 — a corrupt clones value silently destroys the RUN entries…". Invert expect(store.prefs.getString('cadence-run-v1.corrupt'), isNull) to isNotNull. Red now, green after.

On iOS there is no audible floor at all, and nothing detects a muted device

ios/Runner/AppDelegate.swift:54-59; lib/ui/home.dart:209-218 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md. The refuter read AppDelegate.swift in full and verified every line reference in the parity table. No Xcode on this machine — the iOS half was never compiled or run, by either agent. Note that S3-F17's own proposed fix raises Diag.fail('volume-device', …, isCritical: true), a scope the operator banner cannot render — see S3R-F3.

findings/S3_audio_alarms.md § S3-F17 — on iOS there is no audible floor at all, and nothing detects a muted device: ios/Runner/AppDelegate.swift:53-59, verbatim: swift switch call.method { case "getAlarmVolume": // nil = "no device alarm stream here" → Dart uses app-level scaling. // Deliberately NOT an error: nothing is broken, iOS just has no knob. result(nil) case "setAlarmVolume": result(nil) Proven on the Dart side by test S3: when the platform has NO alarm stream (getAlarmVolume returns null, the iOS answer) the level goes to app-level gain and the channel is never written to (proof/01_findings/S3/tests/s3_volume_channel_test.dart): zero setAlarmVolume calls, zero Diag entries, empty Diag.critical — a completely silent fallback.

findings/S3_audio_alarms.md § S3-F17 — on iOS there is no audible floor at all, and nothing detects a muted device: AVAudioSession.sharedInstance().outputVolume is readable and observable on iOS. Add a getOutputVolume verb to the cadence/volume channel on the Swift side (returning AVAudioSession.sharedInstance().outputVolume as a Double), have _initSystemVolume and the ring rising edge read it, and raise Diag.fail('volume-device', 'appareil en sourdine', isCritical: true) below a threshold. That is a defect repair — the app already promises a floor — not a new feature: the banner, the string slot and the diagnostic plumbing all exist.

findings/S3_audio_alarms.md § S3-F17 — on iOS there is no audible floor at all, and nothing detects a muted device: a Dart test that mocks getOutputVolume → 0.0 and asserts Diag.critical.value contains volume-device after boot. It cannot be written today because the verb does not exist. Device confirmation: protocol D3.

The TTS engine's "I do not have that language" answer is discarded, so the voice can be silently wrong for a whole service

android/app/src/main/kotlin/dev/sergemio/cadence/MainActivity.kt:90-94 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md §Part 2. The refuter read MainActivity.kt in full, re-derived the eight catch (_: Exception) sites by grep, opened each, and traced every one to its result.* reply and then to the Dart consumer. The "8 of 8, nobody informed" claim holds site by site.

findings/S3_audio_alarms.md § S3-F4 — the TTS engine's "I do not have that language" answer is discarded, so the voice can be silently wrong for a whole service: MainActivity.kt:90-94, verbatim: kotlin "setLanguage" -> { try { tts?.setLanguage(Locale.forLanguageTag(call.arguments as String)) } catch (_: Exception) {} result.success(null) } The discarded contract, proof/01_findings/S3/captures/android_texttospeech.txt:1454-1462 (https://developer.android.com/reference/android/speech/tts/TextToSpeech, retrieved 2026-08-04): public int setLanguage (Locale loc) ... int Code indicating the support status for the locale. See LANG_AVAILABLE, LANG_COUNTRY_AVAILABLE, LANG_COUNTRY_VAR_AVAILABLE, LANG_MISSING_DATA and LANG_NOT_SUPPORTED. Dart blindness proven by test S3: setLocale on a dead engine is a silent no-op — the operator is never told the language change did not reach the voice (proof/01_findings/S3/tests/s3_voice_test.dart), which asserts both the call list and Diag.log are empty after setLocale('fr-FR').

findings/S3_audio_alarms.md § S3-F4 — the TTS engine's "I do not have that language" answer is discarded, so the voice can be silently wrong for a whole service: return the status: val r = tts?.setLanguage(...) ?: TextToSpeech.ERROR; result.success(r), keeping the cast guarded and answering result.error on a bad argument. In lib/audio/voice.dart:54 and :84, treat LANG_MISSING_DATA (-1) and LANG_NOT_SUPPORTED (-2) as Diag.fail('voice-locale', …, isCritical: true) — the voiceDown banner string already exists in lib/i18n.dart.

findings/S3_audio_alarms.md § S3-F4 — the TTS engine's "I do not have that language" answer is discarded, so the voice can be silently wrong for a whole service: extend test/voice_test.dart with a mock whose setLanguage returns -1 and assert Diag.critical.value contains voice-locale. Red today (the value is not even read), green after.

The journal records an announcement as spoken before the native side has had a chance to fail, and the native false is thrown away

lib/audio/voice.dart:165-168 and :134 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md. Both discarded booleans verified at voice.dart:134 and :167 by grep and by eye. S5's refuter independently strengthened the reachability: MainActivity.kt:132-134 wires UtteranceProgressListener.onError/onStop to completeSpeak(id, false) → result.success(false), and speak() at :145 replies false outright when the engine is not ready — all of it discarded after voice.dart:165 has already written parole "…" to the journal.

findings/S3_audio_alarms.md § S3-F5 — the journal records an announcement as spoken before the native side has had a chance to fail, and the native "false" is thrown away: the Dart block above, verbatim from lib/audio/voice.dart:165-168. Kotlin :150-155: kotlin val r = try { t.speak(text, TextToSpeech.QUEUE_FLUSH, params, id) } catch (_: Exception) { TextToSpeech.ERROR } if (r != TextToSpeech.SUCCESS) { pendingSpeaks.remove(id) result.success(false) } Proven by tests S3: the native side answering "I did not speak" is discarded — no Diag entry, no banner, nothing distinguishes it from success and S3: setVoice answering false is discarded too (proof/01_findings/S3/tests/s3_voice_test.dart): both assert Diag.log is empty after a false answer.

findings/S3_audio_alarms.md § S3-F5 — the journal records an announcement as spoken before the native side has had a chance to fail, and the native "false" is thrown away: capture the answer — final ok = await _ch.invokeMethod<bool>('speak', …) ?? false; — write the parole journal line only when ok is true, and Diag.fail('voice-speak', 'moteur a refuse la phrase', isCritical: true) when it is false. Same treatment at voice.dart:134 for setVoice: downgrade the journal line to "voix par defaut" when the engine refused.

findings/S3_audio_alarms.md § S3-F5 — the journal records an announcement as spoken before the native side has had a chance to fail, and the native "false" is thrown away: the two tests named above invert — change expect(Diag.log, isEmpty) to expect(Diag.log.map((e) => e.scope), contains('voice-speak')). They pass today with isEmpty (proof recorded) and will fail against the fix, and vice-versa.

The backstop reports itself ready when POST_NOTIFICATIONS was refused, and never re-checks the channel afterwards

lib/alarm_backstop.dart:79-96, specifically _ready = true after a refused permission at :83-90; consumer :64 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md. Verified by reading the block.

findings/S3_audio_alarms.md § S3-F6 — the backstop reports itself ready when POST_NOTIFICATIONS was refused, and never re-checks the channel afterwards: lib/alarm_backstop.dart:83-90, verbatim: dart if (notif == false) { // without it the safety net can ring but shows nothing — say it loudly Diag.fail('backstop-notif', 'permission notifications REFUSEE', isCritical: true); } // stale alarms from a previous process die here; sync() re-creates them await _plugin.cancelAll(); _ready = true; Proven by test S3: notification permission denied is CRITICAL but the backstop still reports itself ready and keeps scheduling (proof/01_findings/S3/tests/s3_backstop_test.dart), which asserts b.ready == true and one zonedSchedule call after a denied permission. Channel immutability confirmed at the plugin level too: flutter_local_notifications-22.1.0/android/.../FlutterLocalNotificationsPlugin.java:456-475 (canCreateNotificationChannel) creates the channel only when it does not already exist, because the app never sets channelAction — so changing importance, sound or enableVibration in lib/alarm_backstop.dart:44-59 has no effect on any device where cadence-alarms already exists.

findings/S3_audio_alarms.md § S3-F6 — the backstop reports itself ready when POST_NOTIFICATIONS was refused, and never re-checks the channel afterwards: (a) in init, set _ready = notif != false so a refused permission stops the app pretending it has a net; (b) add a re-check on every foreground transition — onForeground() already runs there (lib/ui/home.dart:189) — calling AndroidFlutterLocalNotificationsPlugin.areNotificationsEnabled() plus a getNotificationChannels() lookup for cadence-alarms, raising and clearing Diag.fail('backstop-notif', …, isCritical: true); (c) bump the channel id to cadence-alarms-v2 so the shipped importance and sound actually take effect on devices that already carry v1.

findings/S3_audio_alarms.md § S3-F6 — the backstop reports itself ready when POST_NOTIFICATIONS was refused, and never re-checks the channel afterwards: the test named above flips from expect(b.ready, isTrue) to expect(b.ready, isFalse); add a second test that mocks areNotificationsEnabled → false after a healthy init and asserts Diag.critical.value contains backstop-notif after onForeground(). Both are red today.

Exact-alarm revocation on Android 12/12L cancels every backstop, and nothing in the app detects it

android/app/src/main/AndroidManifest.xml:13-15; lib/alarm_backstop.dart:80 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md. Permissions verified present. Two of S3's sub-line ranges drift: it cites the boot receiver at :48-56 (actual :47-58, class name at :49) and the <queries> TTS_SERVICE action at :75-77 (actual block :68-78, action at :76). The elements are the ones it names.

findings/S3_audio_alarms.md § S3-F7 — exact-alarm revocation on Android 12/12L cancels every backstop, and nothing in the app detects it: AndroidManifest.xml:13-15, verbatim: xml <uses-permission android:name="android.permission.USE_EXACT_ALARM"/> <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM" android:maxSdkVersion="32"/> and the documented behaviour at captures/android_exact_alarms.txt:183-189 (https://developer.android.com/develop/background-work/services/alarms/schedule, retrieved 2026-08-04), including "To check whether the permission is granted to your app, call canScheduleExactAlarms() before trying to set an exact alarm." The same capture at :167 records that USE_EXACT_ALARM "Cannot be revoked by the user", which is what bounds the exposure to API 31-32. The existing degradation path is real and tested (test/backstop_test.dart:115-128), but it covers only the refused-at-schedule case.

findings/S3_audio_alarms.md § S3-F7 — exact-alarm revocation on Android 12/12L cancels every backstop, and nothing in the app detects it: call AndroidFlutterLocalNotificationsPlugin.canScheduleExactAlarms() (exposed by the plugin) at init and on each foreground transition; when it is false, set _exactOk = false up front and raise Diag.fail('backstop-exact', …, isCritical: true) so the operator sees the degradation before a timer needs it rather than after.

findings/S3_audio_alarms.md § S3-F7 — exact-alarm revocation on Android 12/12L cancels every backstop, and nothing in the app detects it: a test that mocks canScheduleExactAlarms → false, calls init(), syncs a running timer and asserts the first zonedSchedule already carries scheduleMode == 'inexactAllowWhileIdle' and Diag.critical.value contains backstop-exact. Today the first attempt is alarmClock — asserted green in test/backstop_test.dart:98-113 — so this test is red now.

The alarm level is re-imposed only on the rising edge of a ring, so the volume rocker can mute an alarm that is already ringing

lib/audio/alarm_volume.dart:60-67 (onRunChanged); the only other write path is setLevel :53-56 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md. Verified by reading the file in full. sane (:44-45) handles non-finite input correctly. S3's proposed onRepeat hook does not yet exist, so its stated red-then-green test is honest.

findings/S3_audio_alarms.md § S3-F8 — the alarm level is re-imposed only on the rising edge of a ring, so the rocker can mute an alarm that is already ringing: lib/audio/alarm_volume.dart:60-67, verbatim: dart void onRunChanged({required bool anyRinging}) { if (anyRinging && !_wasRinging) { Journal.log('volume', 'niveau alarme reimpose a ${(_level * 100).round()}% (debut de sonnerie)'); apply(_level); } _wasRinging = anyRinging; } The single-write behaviour is asserted by the project's own test test/volume_test.dart:103-115 (le niveau est reimpose au DEBUT de la sonnerie, une seule fois): 20 consecutive onRunChanged(anyRinging: true) calls produce exactly one write. Mutation proof that this test is real: proof/01_findings/S3/mutations/M1_volume_floor.patch (floor 0.15 → 0.0) turns test/volume_test.dart red — proof/01_findings/S3/mutations/M1_volume_floor.after.txt, EXIT_CODE=1.

findings/S3_audio_alarms.md § S3-F8 — the alarm level is re-imposed only on the rising edge of a ring, so the rocker can mute an alarm that is already ringing: distinguish the two sources. AlarmVolume.setLevel is only ever called from the Settings slider (lib/ui/home.dart:481), so it is safe to re-assert on every repeat as well as every rising edge: add void onRepeat() => apply(_level); and call it from _HomeScreenState.onAlarmRepeat (lib/ui/home.dart:306-312) before sounds.ringtone. A slider moved mid-ring still wins, because setLevel updates _level first.

findings/S3_audio_alarms.md § S3-F8 — the alarm level is re-imposed only on the rising edge of a ring, so the rocker can mute an alarm that is already ringing: a new test in test/volume_test.dart: build an AlarmVolume, call onRunChanged(anyRinging: true) then onRepeat() three times, and assert four writes. It cannot compile today (onRepeat does not exist) and passes after.

lib/audio/audio.dart had 5.26 % line coverage: every path a silent alarm takes was untested

lib/audio/audio.dart (whole file, 116 lines) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S3_audio_alarms.md · agent_reports/S3_refute.md §Part 6. Reproduced to the digit. S3's 40 new tests lift audio.dart to 97.37 % (37/38), voice.dart to 96.59 %, alarm_backstop.dart to 94.00 %, alarm_volume.dart to 100 %, whole project 71.93 % (1386/1927), suite 163 pass / 0 fail, flutter analyze 0 issues — every number reproduced exactly on the refuter's copy. But see S3R-F1: three of those 40 tests do not detect the behaviour they name, so coverage is not the same as protection.

findings/S3_audio_alarms.md § S3-F9 — lib/audio/audio.dart had 5.26% line coverage: every path a silent alarm takes was untested: baseline lcov record for the file, reproduced from the pinned tree: SF:lib/audio/audio.dart DA:23,0 DA:31,0 DA:37,0 DA:38,0 DA:39,0 DA:40,0 DA:44,0 DA:45,0 DA:46,0 DA:48,0 DA:50,0 DA:52,0 DA:58,0 DA:62,0 DA:66,0 DA:69,0 DA:71,0 DA:72,0 DA:73,0 DA:74,0 DA:76,0 DA:83,1 DA:84,3 DA:86,0 DA:87,0 DA:89,0 DA:91,0 DA:92,0 DA:96,0 DA:97,0 DA:99,0 DA:103,0 DA:104,0 DA:105,0 DA:106,0 DA:107,0 DA:111,0 DA:114,0 LF:38 LH:2 end_of_record The remedy is written and measured: proof/01_findings/S3/tests/s3_audio_test.dart (14 tests) takes the file to 37/38 lines, 97.37% — proof/01_findings/S3/03_lcov_with_s3.info [not published]. The single remaining uncovered line is :107 (Vibration.vibrate(duration: 120) inside hapticStep).

findings/S3_audio_alarms.md § S3-F9 — lib/audio/audio.dart had 5.26% line coverage: every path a silent alarm takes was untested: land proof/01_findings/S3/tests/s3_audio_test.dart as test/audio_test.dart. It needs two dev-dependencies the project does not yet declare — audioplayers_platform_interface: ^7.2.0 and vibration_platform_interface: ^0.1.2, both already in pubspec.lock as transitive packages — added to dev_dependencies in pubspec.yaml. No production code changes and no new features.

findings/S3_audio_alarms.md § S3-F9 — lib/audio/audio.dart had 5.26% line coverage: every path a silent alarm takes was untested: mutation proof/01_findings/S3/mutations/M3_audio_critical.patch removes isCritical: critical from the "player pool not ready" report at audio.dart:66; the test S3: ringing before init() finished is reported CRITICAL, not thrown goes red — proof/01_findings/S3/mutations/M3_audio_critical.after.txt, EXIT_CODE=1. Restored, the suite is green: proof/01_findings/S3/04_test_restored_green.txt, EXIT_CODE=0.

Three of S3's 40 new tests assert a behaviour the whole 163-test suite cannot detect

proof/01_findings/S3/tests/s3_audio_test.dart:220-235, :321-332, :237-250; subject code lib/audio/audio.dart:62, :69, :111-115, :44-54 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S3_refute.md §4. Each of the three names a specific behaviour in its title and then asserts something true whether or not that behaviour exists. Phase 4 is expected to land these files as test/audio_test.dart; landed as-is they carry three assertions that can never go red, in the one module whose failure mode is a silent alarm. One of the three is the test S3 cites as the proof of S3-F10.

agent_reports/S3_refute.md § S3R-F1 — three of S3's 40 tests assert a behaviour the whole 163-test suite cannot detect: proof/01_findings/S3_refute/mutations/A4.patch, A4b.patch, A10.patch, A11.patch with their whole-suite --reporter=json runs raw_json/A4.json, A4b.json, A10.json, A11.json. Machine summary in mutations/mutation_results.json; each record reads "failing": [], "testDone_total": 184, "clean_after_revert": true. For contrast, the same harness on the other 21 mutations produced a failing set of exactly one.

agent_reports/S3_refute.md § S3R-F1 — three of S3's 40 tests assert a behaviour the whole 163-test suite cannot detect: assert the player identity, not the call count. AudioPlayer exposes playerId; the fake already keys volumes and _ev by it. Replace the three ringtone calls' assertion with: capture the playerId used for each of three consecutive ringtone calls and expect(ids.toSet(), hasLength(1)), then assert that same id never appears among the click ids. For (2), assert the HapticFeedback system channel received HapticFeedbackType.lightImpact via TestDefaultBinaryMessengerBinding…setMockMethodCallHandler(SystemChannels.platform, …). For (3), assert plat.volumes.keys.single is one of the two pooled player ids, which pins the fallback.

agent_reports/S3_refute.md § S3R-F1 — three of S3's 40 tests assert a behaviour the whole 163-test suite cannot detect: re-run A4.patch, A10.patch and A11.patch against the repaired tests; each must produce a failing set of exactly the named test. The harness is stored and takes six seconds per mutation.

The SecurityException justifying BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert

android/app/src/main/kotlin/dev/sergemio/cadence/MainActivity.kt:57; AOSP AudioService.java:4495-4504, :3745-3765, :4613-4626, :6724-6752 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S3_refute.md §4. The finding S3-F3 survives; its evidence and a third of its remedy do not. Drop fix (1), promote fix (2).

agent_reports/S3_refute.md § S3R-F2 — the SecurityException S3 uses to justify BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert: full quoted capture with line numbers and a sha256 of the decoded source in proof/01_findings/S3_refute/captures/aosp_audioservice_setStreamVolume.txt. Key blocks quoted in Part 1 above.

agent_reports/S3_refute.md § S3R-F2 — the SecurityException S3 uses to justify BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert: drop fix (1) from S3-F3 and promote fix (2) to the whole remedy — have setAlarmVolume answer audio.getStreamVolume(AudioManager.STREAM_ALARM).toDouble() / max and have _applyAlarmLevel compare the achieved level against the requested one, raising a critical diagnostic on mismatch. Keep the try/catch but make it reply result.error, since it costs nothing; do not rely on it. Device protocol D2 is unchanged and is what settles it on hardware.

agent_reports/S3_refute.md § S3R-F2 — the SecurityException S3 uses to justify BLOCKER S3-F3 cannot fire at that call site, and 1 of its 3 proposed fixes is inert: a test in test/volume_test.dart mocking cadence/volume so setAlarmVolume answers a different level from the one requested (say 0.0 for a request of 0.4) and asserting the operator is told. That test cannot be written today because the verb returns null; it is red the moment the read-back lands and the comparison is missing, green after.

The operator banner cannot render five of the app's critical scopes, so a critical diagnostic can be raised and shown to nobody — and two of S3's own fixes land in exactly that hole

lib/ui/home.dart:670-703 (the _criticalBanner scope map, six startsWith prefixes, no else); live offender lib/engine/store.dart:270 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S3_refute.md §4. Overlaps and strengthens S5-F5, which found the same hole from the error-handling side and counted one scope. S3's refuter enumerated five unrenderable scopes and showed that S3-F3 fix (3) (Diag.fail('volume-set', …, isCritical: true)) and S3-F17's proposed volume-device scope both land in it. Fix the else branch before implementing either.

agent_reports/S3_refute.md § S3R-F3 — the operator banner cannot render five of the app's scopes, so a critical diagnostic can be raised and shown to nobody — and two of S3's fixes land in exactly that hole: lib/ui/home.dart:673-689, verbatim: dart final msgs = <String>{}; for (final scope in crit) { if (scope.startsWith('voice')) { msgs.add(i18n.call('voiceDown')); } else if (scope.startsWith('audio')) { msgs.add(i18n.call('audioDown')); } else if (scope.startsWith('save')) { msgs.add(i18n.call('saveFail')); } else if (scope.startsWith('load')) { msgs.add(i18n.call('loadFail')); } else if (scope.startsWith('wakelock')) { msgs.add(i18n.call('screenDown')); } else if (scope.startsWith('backstop')) { msgs.add(i18n.call('backstopDown')); } } if (msgs.isEmpty) return const SizedBox.shrink(); grep -rn "isCritical: true" lib/ returns 13 call sites; migrate-zone-sound at store.dart:270 is the one that no prefix matches. Proven by three new tests I wrote and ran, proof/01_findings/S3_refute/tests/s3r_banner_test.dart, output recorded in proof/01_findings/S3_refute/02_banner_defect_test.txt (EXIT_CODE=0, 3 passed): a control — Diag.fail('audio-play', 'boom', isCritical: true) renders ⚠️ Sound is not working on this tablet; the defect — Diag.fail('migrate-zone-sound', 'boom', isCritical: true) puts the scope in Diag.critical while no widget with the banner colour 0xFFB3452B is built at all; and the fix-hole — the same is true of a critical volume-set and volume-device together.

agent_reports/S3_refute.md § S3R-F3 — the operator banner cannot render five of the app's scopes, so a critical diagnostic can be raised and shown to nobody — and two of S3's fixes land in exactly that hole: replace the startsWith chain with a const Map<String, String> from scope prefix to i18n key, add 'volume' (reusing audioDown) and 'migrate' (reusing loadFail), and add a final else that falls back to a generic key rather than dropping the scope. Then add a test that iterates every scope literal appearing in a Diag.fail(..., isCritical: true) call in lib/ and asserts each maps to a non-empty message — that closes the class, not just the instances.

agent_reports/S3_refute.md § S3R-F3 — the operator banner cannot render five of the app's scopes, so a critical diagnostic can be raised and shown to nobody — and two of S3's fixes land in exactly that hole: s3r_banner_test.dart's second and third tests invert — change findsNothing to findsOneWidget for the banner container. They pass with findsNothing today (recorded) and fail after.

The 150 ms heartbeat is gated behind three awaits with no timeout; if one never completes the board freezes silently

lib/ui/home.dart:136 (await sounds.init()), :148 (await _initSystemVolume()), ticker created at :154 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S4_ui.md · proof/01_findings/S4/. Same code region as R5-F1 (a throw in _boot skips the ticker) and S12-F1 (unmount during the awaits orphans the ticker). Three distinct failure modes, three distinct fixes — do not collapse them. S14's refuter proved the sibling hang in main() by execution (EXIT_CODE=124 at 90 s), which establishes the class.

findings/S4_ui.md § S4-F04 — The 150 ms heartbeat is gated behind three awaits with no timeout; if one never completes the board freezes silently: grep, proof/01_findings/S4/greps.txt: ### grep -rn .timeout( lib/ lib/audio/voice.dart:168: .timeout(const Duration(seconds: 12)); exit=0 Behaviour with the audio platform channel answering with a future that never completes, proof/01_findings/S4/boot_hang.txt: BOOT[hang] heartbeatRebuildsOver20Ticks=0 bannerVisible=false criticalScopes={} tileStillShown=1 Twenty pumped 150 ms intervals produced zero rebuilds, no banner and no critical scope, while the tile stayed on screen — a board that looks alive and is not.

findings/S4_ui.md § S4-F04 — The 150 ms heartbeat is gated behind three awaits with no timeout; if one never completes the board freezes silently: put the heartbeat first and the dependencies second. (a) Move _ticker = Timer.periodic(...) above the three awaits, or (b) keep the order but bound each await — await sounds.init().timeout(const Duration(seconds: 5), onTimeout: () => throw TimeoutException('audio init')) and likewise for _initSystemVolume() and backstop.init(), with the existing catch reporting through Diag.fail(..., isCritical: true) so the banner appears. Either way the countdown must never depend on a plugin answering. Option (b) is smaller and keeps the documented reason for awaiting audio (lib/ui/home.dart:89-91).

findings/S4_ui.md § S4-F04 — The 150 ms heartbeat is gated behind three awaits with no timeout; if one never completes the board freezes silently: heartbeat_starts_even_when_audio_never_answers — mock xyz.luan/audioplayers with a Completer that is never completed, pump 20 × 150 ms, and assert the home State rebuilt at least 15 times and that a critical banner is visible. Red now (0 rebuilds, no banner), green after.

An out-of-set tone name reaches assetFor unvalidated and rings a silent alarm

lib/engine/store.dart:274-277 (the v0.4.11 migration), lib/engine/models.dart:71 (fromJson), lib/engine/engine.dart:66 (soundFor), lib/audio/audio.dart:83-84 (assetFor) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S6_refute.md §Findings S6 missed. S6's negative result ("Referenced-but-missing WAVs: Zero") is true of C.tones but C.tones is not the reachable input set of assetFor. migrateZoneSounds copies any string out of the legacy zones JSON onto TimerDef.sound with no membership check, and fromJson accepts any string from prefs. Interacts with S3-F19 — see CONTRADICTIONS.md §7.

agent_reports/S6_refute.md § S6R-F1 — An out-of-set tone name reaches assetFor unvalidated and rings a silent alarm: proof/01_findings/S6_refute/missing_asset_silent_alarm.txt (EXIT_CODE=0, 3 tests pass, i.e. the defect reproduces), test source at proof/01_findings/S6_refute/tests/s6r_missing_asset_test.dart. The migration test seeds a pre-v0.4.11 tablet whose zone carries 'sound': 'Sonnerie' and asserts: dart final moved = store.migrateZoneSounds(e); expect(moved, 1); final t = e.timers.single; expect(t.sound, 'Sonnerie'); // straight from legacy JSON, unchecked expect(File('assets/audio/${SoundBox.assetFor(t.sound)}').existsSync(), isFalse, reason: 'a migrated timer now rings SILENTLY'); and lib/engine/store.dart:274-277 verbatim: dart for (final t in e.timers) { final inherited = tones[t.legacyZoneId] ?? _legacyFallbackSound; if (t.sound != inherited) { t.sound = inherited;

agent_reports/S6_refute.md § S6R-F1 — An out-of-set tone name reaches assetFor unvalidated and rings a silent alarm: clamp on the way in, in Engine.soundFor (one place, covers migration, JSON and the editor): String soundFor(TimerDef t) => C.tones.contains(t.sound) ? t.sound : kDefaultSound; — or, if engine.dart must not import lib/ui/theme.dart, move the tone list to lib/engine/models.dart beside kDefaultSound and have C.tones read it. No new feature.

agent_reports/S6_refute.md § S6R-F1 — An out-of-set tone name reaches assetFor unvalidated and rings a silent alarm: the second and third tests in proof/01_findings/S6_refute/tests/s6r_missing_asset_test.dart invert — soundFor returns kDefaultSound and the asset resolves to a file that exists. They pass today (proving the hole) and must fail after the fix, with the assertions flipped to isTrue.

The 150 ms heartbeat is untested, and its named constant has zero consumers

lib/engine/engine.dart:32 and lib/ui/home.dart:154 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md. The refuter reproduced grep -rn "Engine.tickMs" test/ → zero references, and re-applied S7's tickMs 150→5000 mutation itself: +123: All tests passed!, EXIT_CODE=0. The dead-constant half is the same defect as S6-F2; the untested-heartbeat half is S7's own and is not duplicated.

findings/S7_tests.md § S7-F1 — The 150 ms heartbeat is untested, and its named constant has zero consumers: $ grep -rn "tickMs\|milliseconds: 150" lib/ test/ lib/ui/home.dart:154: _ticker = Timer.periodic(const Duration(milliseconds: 150), (_) { lib/engine/engine.dart:32: static const int tickMs = 150; mutations/M01.txt and M02.txt both end 00:0N +123: All tests passed! / EXIT_CODE=0 (123 + 0 = 123, so every test ran). Patches M01.patch, M02.patch, both distinct.

findings/S7_tests.md § S7-F1 — The 150 ms heartbeat is untested, and its named constant has zero consumers: make home.dart:154 read const Duration(milliseconds: Engine.tickMs) (R7 — one constant, one owner), then add the test below.

findings/S7_tests.md § S7-F1 — The 150 ms heartbeat is untested, and its named constant has zero consumers: in test/home_test.dart, test('the heartbeat period is the engine tick', () => expect(Engine.tickMs, 150)); plus testWidgets('the board re-renders at least 6 times per second', …) which pumps HomeScreen with the injected clock of S7-F3 and counts TileView rebuilds over one simulated second, asserting greaterThanOrEqualTo(6). Red under M02.patch, green after.

The ringtone-asset test cannot detect a filename-case mismatch on macOS

test/i18n_defaults_test.dart:70-78; subject lib/audio/audio.dart:83-84 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md §10. Verified verbatim at source.

findings/S7_tests.md § S7-F13 — The ringtone-asset test cannot detect a filename-case mismatch on macOS: subject, verbatim lib/audio/audio.dart:83-84: dart static String assetFor(String tone) => '${tone.toLowerCase().replaceAll('buzzer', 'buzz')}.wav'; test, verbatim test/i18n_defaults_test.dart:73-77: dart for (final t in C.tones) { final f = File('assets/audio/${SoundBox.assetFor(t)}'); expect(f.existsSync(), isTrue, reason: '$t → ${f.path} is missing'); expect(f.lengthSync(), greaterThan(1000), reason: '$t is an empty file'); } filesystem proof: $ ls assets/audio/ | head -3 beep.wav bell.wav bowl.wav $ test -f assets/audio/Chirp.wav && echo resolves resolves $ diskutil info / | grep "File System Personality" File System Personality: APFS mutations/M52.txt → all 123 green, EXIT_CODE=0. Scope note: the mutation proves the test is blind to case. The consequence for the shipped app follows from Flutter resolving AssetSource('audio/…') against manifest keys generated from the on-disk names; that mechanism is not something this stream measured on device.

findings/S7_tests.md § S7-F13 — The ringtone-asset test cannot detect a filename-case mismatch on macOS: assert the exact expected filename per tone, and compare against a real directory listing, which is case-exact on any filesystem.

findings/S7_tests.md § S7-F13 — The ringtone-asset test cannot detect a filename-case mismatch on macOS: dart test('assetFor produces the exact on-disk filename', () { expect(SoundBox.assetFor('Chirp'), 'chirp.wav'); expect(SoundBox.assetFor('Buzz'), 'buzz.wav'); expect(SoundBox.assetFor('Buzzer'), 'buzz.wav'); final onDisk = Directory('assets/audio').listSync().map((f) => f.uri.pathSegments.last).toSet(); for (final t in C.tones) { final name = SoundBox.assetFor(t); expect(name, name.toLowerCase(), reason: '$t → $name is not lowercase'); expect(onDisk, contains(name), reason: '$t → $name absent from the real listing'); } }); Red under M52.patch, green at HEAD.

Six lib/ files — 837 of 1,927 instrumented lines, 43.4 % of the codebase — are executed by zero tests

lib/main.dart, lib/ui/home.dart (722), lib/ui/tile.dart (819), lib/ui/header.dart (215), lib/ui/theme.dart, lib/ui/logo.dart — all 0.00 % at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · findings/S4_ui.md · findings/S5_error_handling.md · proof/00_baseline/coverage.txt. Found three times, from the test, UI and error-handling angles. S7's refuter turned the aggregate into a measured consequence: the six 0 %-coverage files hold 43.4 % of instrumented lines and took 2 of S7's 57 mutations; line-proportional sampling would have placed ~25, and every one of those would have survived by construction. S5's refuter noted S5-F9 partly double-counts a baseline fact and survives only as maintainability.

findings/S4_ui.md § S4-F13 — 1,541 lines of interaction model are at 0.00 % coverage, and four defects were sitting in them: baseline (proof/00_baseline/SUMMARY.md §6, files at 0.00 %) plus the code map's importer proof: grep -rn "package:cadence/ui/tile.dart" test/ → no output; grep -rn "package:cadence/ui/home.dart" test/ → no output. Against that, this stream's runs: proof/01_findings/S4/layout_stress.txt, touch_targets.txt, rebuild_cost.txt. findings/S5_error_handling.md § S5-F9 — lib/ui/tile.dart: 819 lines, no error handling, no coverage, all countdown rendering: verbatim, the unguarded rendering arithmetic at lib/ui/tile.dart:184-201: dart case 'running': final stepDur = r!.chain ? t.steps![r.stepIndex].sec : t.durationSec; final rem = (r.endsAt! - widget.nowMs) / 1000.0; pieP = (rem / stepDur).clamp(0.0, 1.0); and the proof that the invariant is enforced upstream, lib/engine/engine.dart:81-91: dart run.removeWhere((id, r) { final def = _defFor(id); if (def == null) return true; if (r.status == RunStatus.running && r.endsAt == null) return true; if (r.status == RunStatus.paused && r.remainingMs == null) return true; if (r.chain) { if (!def.isChain) return true; if (r.stepIndex < 0 || r.stepIndex >= def.steps!.length) return true; } return false; }); demonstrated by test S5-F1 … the structural invariants tick() guards are already enforced by reconcile() (proof/01_findings/S5/01_s5_tests_baseline.txt), which shows both violating shapes being dropped. Coverage figure from the audit baseline (AGENT_RULES.md §Verified baseline facts: ui/tile.dart among the 0.00% files). findings/S7_tests.md § S7-F16 — Six lib/ files, 837 of 1,927 instrumented lines, are executed by zero tests: baseline proof/00_baseline/SUMMARY.md §6, verbatim rows: | 1 | lib/main.dart | 0 | 17 | 0.00% | | 2 | lib/ui/header.dart | 0 | 70 | 0.00% | | 3 | lib/ui/home.dart | 0 | 390 | 0.00% | | 4 | lib/ui/logo.dart | 0 | 4 | 0.00% | | 5 | lib/ui/theme.dart | 0 | 12 | 0.00% | | 6 | lib/ui/tile.dart | 0 | 344 | 0.00% | M02.txt, M57.txt → all 123 green, EXIT_CODE=0, distinct patches.

findings/S4_ui.md § S4-F13 — 1,541 lines of interaction model are at 0.00 % coverage, and four defects were sitting in them: land the Phase 4 suite specified below (§"Widget tests Phase 4 must add"). The harness already exists at proof/01_findings/S4/tests/s4_harness.dart and boots a real HomeScreen with every platform channel stubbed. findings/S5_error_handling.md § S5-F9 — lib/ui/tile.dart: 819 lines, no error handling, no coverage, all countdown rendering: the ErrorWidget.builder from S5-F2 covers the visible half — replace the grey box with the app's own "this tile failed" surface and a Diag.fail('tile-render', …). Separately, add a widget test that pumps TileView with a RunEntry(status: running, chain: true) against a non-chained TimerDef and asserts the app degrades rather than throws. That test is worth more than the guard. findings/S7_tests.md § S7-F16 — Six lib/ files, 837 of 1,927 instrumented lines, are executed by zero tests: the test files specified in §4.

findings/S4_ui.md § S4-F13 — 1,541 lines of interaction model are at 0.00 % coverage, and four defects were sitting in them: flutter test --coverage and assert lib/ui/tile.dart and lib/ui/home.dart are each ≥ 60 % line coverage, and that lib/ui/theme.dart is ≥ 90 % (it is 82 lines of pure functions). Red now (0.00 %), green after. --- findings/S5_error_handling.md § S5-F9 — lib/ui/tile.dart: 819 lines, no error handling, no coverage, all countdown rendering: testWidgets('a tile with a violated run invariant degrades, not throws') pumping the shape above; today it throws Null check operator used on a null value from tile.dart:186, after the fix it renders a failure surface and Diag.log contains tile-render. --- findings/S7_tests.md § S7-F16 — Six lib/ files, 837 of 1,927 instrumented lines, are executed by zero tests: flutter test --coverage reports non-zero line coverage for each of the six, and M02.patch and M57.patch both go red.

Every assertion about the alarm lead is computed from the constant it claims to test

test/engine_test.dart:61, :145, :166, :172; test/robustness_test.dart:291 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md §10. Listed by the refuter under "what I did not overturn — verified verbatim at source". S1's refuter independently re-applied the alarmLeadMs → 0 mutation and got +123: All tests passed!.

findings/S7_tests.md § S7-F2 — Every assertion about the alarm lead is computed from the constant it claims to test: verbatim test/engine_test.dart:61-71: dart const ring = 60000 - Engine.alarmLeadMs; host.t += ring - 1; e.tick(); expect(host.fired, isEmpty); host.t += 1; e.tick(); expect(host.fired, ['a']); verbatim test/robustness_test.dart:290-291: dart expect(e.run['p']!.driftMs, inInclusiveRange(6500 + Engine.alarmLeadMs, 7500 + Engine.alarmLeadMs)); mutations/M03.txt → 00:02 +123: All tests passed!, EXIT_CODE=0.

findings/S7_tests.md § S7-F2 — Every assertion about the alarm lead is computed from the constant it claims to test: pin the value once, and add one literal-instant test; keep the derived assertions as readability aids.

findings/S7_tests.md § S7-F2 — Every assertion about the alarm lead is computed from the constant it claims to test: test('the alarm lead is 1.2 s', () => expect(Engine.alarmLeadMs, 1200)); and: start a 60 s timer at host.t = 1000000, tick at 1058799 expecting host.fired empty, tick at 1058800 expecting ['a']. Red under M03.patch (it would fire at 1059600), green at HEAD.

lib/ui/home.dart (722 lines) has no test, and cannot be time-tested as written

lib/ui/home.dart:248; file coverage 0.00 % at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · proof/00_baseline/coverage.txt. The refuter accepted the clock-injection prerequisite as real: its audit of the home_test.dart specification says the spec is implementable "after the S7-F3 clock injection, which the spec names as a prerequisite".

findings/S7_tests.md § S7-F3 — lib/ui/home.dart (722 lines) has no test, and cannot be time-tested as written: dart // lib/ui/home.dart:247-248 @override int now() => DateTime.now().millisecondsSinceEpoch; $ grep -rn "package:cadence/ui/home.dart" test/ → no output (code map §2.18) baseline SUMMARY.md §6: lib/ui/home.dart | 0 | 390 | 0.00%. M02.txt → all 123 green.

findings/S7_tests.md § S7-F3 — lib/ui/home.dart (722 lines) has no test, and cannot be time-tested as written: add an injectable clock — const HomeScreen({required this.store, this.clock = _wallClock}) used by now(). No user-facing change (R6-safe). Then add test/home_test.dart per §4.2.

findings/S7_tests.md § S7-F3 — lib/ui/home.dart (722 lines) has no test, and cannot be time-tested as written: testWidgets('a restored overdue timer rings on the first tick and announces once') — seed a run entry whose endsAt is in the past, pump HomeScreen with the injected clock and a recording voice double, advance one tick, assert exactly one enqueued phrase. Today the test cannot be written at all; after the fix it is red under M02.patch and green at HEAD.

The backstop's past-deadline guard is not what makes its own test pass

lib/alarm_backstop.dart:181; test test/backstop_test.dart:88-96 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md §10. Listed under "what I did not overturn — verified verbatim at source".

findings/S7_tests.md § S7-F4 — The backstop's past-deadline guard is not what makes its own test pass: the guard, verbatim lib/alarm_backstop.dart:178-181: dart // A deadline at or behind the wall clock never gets a backstop: the // in-app engine rings it within one tick (this is the −10s-past-zero // case — Android rejects past dates and the error must not cascade). if (at <= DateTime.now().millisecondsSinceEpoch + 500) return; the assertions, verbatim test/backstop_test.dart:92-95: dart b.sync(engineWith(-5000), 'ringing'); await Future<void>.delayed(Duration.zero); expect(scheduled(), isEmpty); // no call, no error, no banner expect(Diag.critical.value, isEmpty); mutations/M44.txt → 00:02 +123: All tests passed!, EXIT_CODE=0; patch M44.patch.

findings/S7_tests.md § S7-F4 — The backstop's past-deadline guard is not what makes its own test pass: assert the guard directly instead of its downstream effect.

findings/S7_tests.md § S7-F4 — The backstop's past-deadline guard is not what makes its own test pass: add to G1 expect(Diag.log.map((d) => d.scope), isNot(contains('backstop-past')), reason: 'the guard must return before the plugin is ever called'); Red under M44.patch (the plugin raises ArgumentError, so backstop-past is logged), green at HEAD.

No backstop test uses a chained timer, so the final-deadline rule is unprotected

lib/alarm_backstop.dart:108-112; test/backstop_test.dart:70-79 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md §10. "Strengthened by execution counts S7 did not measure."

findings/S7_tests.md § S7-F5 — No backstop test uses a chained timer, so the final-deadline rule is unprotected: verbatim lib/alarm_backstop.dart:107-112: dart var at = r.endsAt!; if (r.chain && t.steps != null) { for (var i = r.stepIndex + 1; i < t.steps!.length; i++) { at += t.steps![i].sec * 1000; // final deadline of the whole chain } } the only engine builder in the file, verbatim test/backstop_test.dart:70-73: dart Engine engineWith(int endsAtDelta) { final e = Engine(FakeHost()); e.timers = [TimerDef(id: 'a', name: 'Fries', durationSec: 60)]; mutations/M46.txt → all 123 green, EXIT_CODE=0.

findings/S7_tests.md § S7-F5 — No backstop test uses a chained timer, so the final-deadline rule is unprotected: add the chained case to backstop_test.dart.

findings/S7_tests.md § S7-F5 — No backstop test uses a chained timer, so the final-deadline rule is unprotected: dart test('a chained timer is backed by the END of the chain, not the current step', () async { final b = Backstop(); await b.init(); final e = Engine(FakeHost()); e.timers = [TimerDef(id: 'c', name: 'Chicken', durationSec: 810, steps: [ StepDef(name: 'Cook', sec: 360), StepDef(name: 'Flip', sec: 90), StepDef(name: 'Cook', sec: 360)])]; final stepEnd = DateTime.now().millisecondsSinceEpoch + 360000; e.run = {'c': RunEntry(status: RunStatus.running, chain: true, stepIndex: 0, endsAt: stepEnd)}; b.sync(e, 'ringing'); await Future<void>.delayed(Duration.zero); final iso = (scheduled().single.arguments as Map)['scheduledDateTimeISO8601'] as String; expect(DateTime.parse(iso).millisecondsSinceEpoch, stepEnd + 450000 + 1500); }); Red under M46.patch (it would schedule at stepEnd + 1500), green at HEAD.

Nothing proves the backstop cancels the OS alarm of a timer that was stopped

lib/alarm_backstop.dart:127-129 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md. S10's refuter independently verified the same cancel path from the product side (:127-128 cancels the armed alarm the moment a run stops matching _desired).

findings/S7_tests.md § S7-F6 — Nothing proves the backstop cancels the OS alarm of a timer that was stopped: verbatim lib/alarm_backstop.dart:125-129: dart // 1) Immediate cancel: a timer no longer running loses its net now — a // phantom ring for a stopped timer is the one thing we never risk. for (final id in _scheduled.keys.toList()) { if (!desired.containsKey(id)) _cancel(id); } mutations/M49.txt → all 123 green. grep -n "'cancel'" test/backstop_test.dart → no assertion on a cancel call anywhere in the file.

findings/S7_tests.md § S7-F6 — Nothing proves the backstop cancels the OS alarm of a timer that was stopped: add the cancel path to backstop_test.dart.

findings/S7_tests.md § S7-F6 — Nothing proves the backstop cancels the OS alarm of a timer that was stopped: dart test('stopping a timer cancels its OS alarm immediately', () async { final b = Backstop(); await b.init(); final e = engineWith(60000); b.sync(e, 'ringing'); await Future<void>.delayed(Duration.zero); e.run.remove('a'); calls.clear(); b.sync(e, 'ringing'); expect(calls.where((c) => c.method == 'cancel'), hasLength(1)); }); Red under M49.patch, green at HEAD.

The voice queue's pacing, staleness and cancellation guards all survive mutation

lib/audio/voice.dart:177 (300 ms gap), :184 (20 s staleness), :174 (generation guard) at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S7_tests.md · agent_reports/S7_refute.md §10. "Strengthened by execution counts S7 did not measure."

findings/S7_tests.md § S7-F8 — The voice queue's pacing, staleness and cancellation guards all survive mutation: verbatim lib/audio/voice.dart:174-185: dart if (myGen != _gen) return; // this utterance was cancelled by stopFor() _speaking = false; _currentId = null; Timer(const Duration(milliseconds: 300), _drain); } void _dropStale() { if (_queue.isEmpty) return; final now = DateTime.now().millisecondsSinceEpoch; _queue.removeWhere((x) { if (now - x.at < staleMs) return false; M38.txt, M39.txt, M40.txt each end +123: All tests passed!, EXIT_CODE=0; three distinct patches.

findings/S7_tests.md § S7-F8 — The voice queue's pacing, staleness and cancellation guards all survive mutation: drive the queue with package:fake_async so the timings are asserted, not waited out.

findings/S7_tests.md § S7-F8 — The voice queue's pacing, staleness and cancellation guards all survive mutation: three tests in voice_test.dart — test('a phrase older than staleMs is dropped, not spoken'): enqueue, elapse(20001 ms), complete the in-flight utterance, assert spoken never contains it; test('the next utterance waits 300 ms'): complete the first, elapse(299 ms) → spoken has length 1, elapse(2 ms) → length 2; test('a cancelled utterance never re-drains'): stopFor mid-flight, assert exactly one re-drain. Red under M39.patch, M38.patch, M40.patch respectively; green at HEAD.

lib/ui/modals.dart (300 instrumented lines, 65 % covered) received zero mutations; five of six the refuter placed there survive

lib/ui/modals.dart:217, :303, :428, :436, :523, :524 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S7_refute.md §5 · proof/01_findings/S7_refute/extension_results.json. The second-largest instrumented file, the only place a cook edits a timer, reached by two widget-test files — and nothing in the audit said whether its 65 % coverage carries any assertions. It largely does not: the editor's own duration floors and clamps are unprotected, including the 5 s per-step floor and the 0..59 seconds clamp. Those clamps also duplicate Engine.saveDef (modals.dart:520-525 vs engine.dart:368) — R7 territory that S6 missed.

agent_reports/S7_refute.md § S7R-F4 — lib/ui/modals.dart (300 instrumented lines, 65 % covered) received zero mutations; five of six I placed there survive: verbatim from proof/01_findings/S7_refute/extension_results.json (patches and full json captures in proof/01_findings/S7_refute/extension/): N01 lib/ui/modals.dart SURVIVED nred=0 seen=123 editor step seconds clamp 0..59 -> 0..120 N02 lib/ui/modals.dart SURVIVED nred=0 seen=123 editor drops the 5 s per-step floor N03 lib/ui/modals.dart SURVIVED nred=0 seen=123 minute picker upper clamp 180 -> 300 N04 lib/ui/modals.dart SURVIVED nred=0 seen=123 seconds picker step 5 s -> 10 s N05 lib/ui/modals.dart KILLED nred=2 seen=123 preset chip label pads seconds to 3 digits N06 lib/ui/modals.dart SURVIVED nred=0 seen=123 new-timer default duration 180 s -> 60 s the duplicated floor, verbatim lib/ui/modals.dart:520-525: dart void _commitStep(StepDef s, {int? minVal, int? secVal}) { final m = minVal ?? s.sec ~/ 60; var ss = secVal ?? s.sec % 60; ss = ss.clamp(0, 59); s.sec = (m * 60 + ss) < 5 ? 5 : m * 60 + ss; } line_execution.json shows N01/N02/N06 land on lines the suite never executes (hits = 0) and N03/N04 on lines it executes 4 times each and still does not assert.

agent_reports/S7_refute.md § S7R-F4 — lib/ui/modals.dart (300 instrumented lines, 65 % covered) received zero mutations; five of six I placed there survive: implement S7's §4.10 test/modals_test.dart, and add the two clamp assertions named there through the widget (_commitStep both ends, and the minute picker at 0 and 180).

agent_reports/S7_refute.md § S7R-F4 — lib/ui/modals.dart (300 instrumented lines, 65 % covered) received zero mutations; five of six I placed there survive: the new tests go red under extension/N01.patch, N02.patch, N03.patch and N04.patch, and green at HEAD.

lib/ui/tile.dart (819 lines, the largest file in the app) received zero mutations; all three the refuter placed survive

lib/ui/tile.dart:183, :200, :498 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

agent_reports/S7_refute.md §5 · proof/01_findings/S7_refute/extension_results.json. The three probed outputs are the idle duration, the ringing count-up and the chained step count — the single thing a cook looks at across the pass. All three can be broken outright with the suite fully green.

agent_reports/S7_refute.md § S7R-F5 — lib/ui/tile.dart (819 lines, the largest file in the app) received zero mutations; all three I placed survive: verbatim from extension_results.json: N07 lib/ui/tile.dart SURVIVED nred=0 seen=123 a ringing tile counts DOWN instead of up (no + prefix) N08 lib/ui/tile.dart SURVIVED nred=0 seen=123 an idle tile prints nothing instead of its full duration N09 lib/ui/tile.dart SURVIVED nred=0 seen=123 a chained tile no longer prints its step count the ringing count-up, verbatim lib/ui/tile.dart:199-200: dart default: // ringing timeText = fmtUp((widget.nowMs - (r!.rangAt ?? widget.nowMs)) / 1000.0); line_execution.json: all three at hits = 0. Two further probes of the same class, also surviving: N10 lib/ui/header.dart SURVIVED header colon blink threshold 500 ms -> 900 ms N11 lib/ui/header.dart SURVIVED header clock hidden at every width (breakpoint 560 -> 5600) N12 lib/main.dart SURVIVED OS text scaling no longer disabled (MediaQuery.withNoTextScaling dropped) N13 lib/audio/audio.dart SURVIVED a sound lost before init() is no longer reported as critical

agent_reports/S7_refute.md § S7R-F5 — lib/ui/tile.dart (819 lines, the largest file in the app) received zero mutations; all three I placed survive: implement S7's §4.3 test/tile_test.dart, §4.4 test/header_test.dart and §4.8 test/main_test.dart as specified — all three are implementable as written (§6).

agent_reports/S7_refute.md § S7R-F5 — lib/ui/tile.dart (819 lines, the largest file in the app) received zero mutations; all three I placed survive: the new tests go red under extension/N07.patch, N08.patch, N09.patch, N10.patch, N11.patch, N12.patch and green at HEAD.

The app declares no Flutter localisations, so every framework string is English whatever the app language

lib/main.dart:43-56 — the MaterialApp passes no localizationsDelegates, no supportedLocales, no locale; flutter_localizations absent from pubspec.yaml and pubspec.lock at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S8_i18n.md · agent_reports/S8_refute.md · agent_reports/S14_refute.md §3 S14R-M2. Found twice, independently, and settled. S8 filed it at HIGH; S14's refuter found the identical defect at the identical lines from the app-entry side and graded it MEDIUM, with the mechanism spelled out: Flutter installs DefaultMaterialLocalizations, whose locale is fixed at en_US. S8's own refuter, working without knowledge of S14's, confirmed HIGH — that is the governing grade. See CONTRADICTIONS.md §6. Related but distinct: S9R-M03 (the iOS bundle declares English only).

findings/S8_i18n.md § S8-F1 — The app declares no Flutter localisations, so every framework string is English whatever the app language: proof/01_findings/S8/probe_i18n.txt, PROBE-6 and PROBE-7 — the first inspects the shipped CadenceApp, the second a replica of main.dart:43-56 minus HomeScreen: MaterialApp.locale=null MaterialApp.supportedLocales=[en_US] MaterialApp.localizationsDelegates=null MaterialApp.localeResolutionCallback=null MaterialLocalizations runtimeType=DefaultMaterialLocalizations resolved Locale=en_US pasteButtonLabel="Paste" copyButtonLabel="Copy" cutButtonLabel="Cut" selectAllButtonLabel="Select all" okButtonLabel="OK" cancelButtonLabel="Cancel" modalBarrierDismissLabel="Dismiss" and proof/01_findings/S8/no_localised_resources.txt: `agent_reports/S14_refute.md` § S14R-M2 — The only `MaterialApp` in the product declares no localisations, so every string Flutter itself supplies stays English no matter which language the cook picked: `proof/01_findings/S14_refute/s14r_l10n_test.dart`, recorded green in `proof/01_findings/S14_refute/l10n_gap.txt` (`00:00 +1: All tests passed!`, `EXIT_CODE=0`, `GIT_HEAD: 03a176e…`). It sets the persisted language to French, confirms the app's own strings do change, then reads the localisations the real widget tree resolves:dart final store = await Store.open(); expect(store.lang, 'fr', reason: 'the operator chose French'); expect(I18n('fr').call('cancel'), isNot(I18n('en').call('cancel')), ...); await tester.pumpWidget(app.CadenceApp(store: store)); final ctx = tester.element(find.byType(HomeScreen)); final ml = MaterialLocalizations.of(ctx); expect(ml, isA(), ...); expect(Localizations.localeOf(ctx), const Locale('en', 'US'), ...); expect(ml.pasteButtonLabel, 'Paste'); expect(ml.cutButtonLabel, 'Cut'); expect(ml.selectAllButtonLabel, 'Select all'); expect(ml.okButtonLabel, 'OK'); All eight assertions hold. And: $ grep -rn "localizationsDelegates|supportedLocales|GlobalMaterialLocalizations" lib/ (no output) ```

agent_reports/S14_refute.md § S14R-M2 — The only MaterialApp in the product declares no localisations, so every string Flutter itself supplies stays English no matter which language the cook picked: add flutter_localizations (SDK dependency, no third-party code) and pass, at lib/main.dart:43-56: dart localizationsDelegates: GlobalMaterialLocalizations.delegates, supportedLocales: const [Locale('fr'), Locale('en')], locale: Locale(store.lang), store.lang is already the single source of truth for language (lib/engine/store.dart:159-163), so no new user-facing capability appears — R6-compatible.

agent_reports/S14_refute.md § S14R-M2 — The only MaterialApp in the product declares no localisations, so every string Flutter itself supplies stays English no matter which language the cook picked: invert the test above. expect(ml, isA<DefaultMaterialLocalizations>()) and expect(ml.pasteButtonLabel, 'Paste') must become expect(ml.pasteButtonLabel, 'Coller') with the store set to 'fr'. That assertion fails at 03a176e — proven above, the label is 'Paste' — and passes after.

The generated spoken announcement is grammatically wrong in both languages, and v0.4.7 replaced correct English with it

lib/i18n.dart:148-150; migration at lib/engine/store.dart:187-231 at 03a176e72ef0075eec86b8915cbe6e93042a3b9d.

findings/S8_i18n.md · agent_reports/S8_refute.md §1. The refuter re-derived the v0.4.7 English regression against git history, not against the finding's prose. Interacts with S2-F10 (repairGeneratedPhrases deletes the operator's own sentence if it re-runs) — same migration, confirmed by S2's refuter — and with S8-R2, which shows the operator is shown the ungrammatical phrase live in the editor, not merely told it.

findings/S8_i18n.md § S8-F2 — The generated spoken announcement is grammatically wrong in both languages, and v0.4.7 replaced correct English with it: proof/01_findings/S8/probe_seed_lang.txt, PROBE-H (every row confirms wasGeneratedByUs=true, so the migration does fire on all seven): NAME | OLD_HANDWRITTEN_EN | REGENERATED_EN | SAME? | REGENERATED_FR Manouche | The manouche is ready | The manouche is ready | true | Manouche est prêt Mozzarella sticks | The mozzarella sticks are ready | The mozzarella sticks is ready | false | Mozzarella sticks est prêt Fries | The fries are ready | The fries is ready | false | Fries est prêt Crispy | The crispy is ready | The crispy is ready | true | Crispy est prêt Melt cheese | The melt cheese is ready | The melt cheese is ready | true | Melt cheese est prêt Dough | The dough is ready | The dough is ready | true | Dough est prêt Cook chicken | The chicken is ready | The cook chicken is ready | false | Cook chicken est prêt and PROBE-I for French agreement on realistic French dish names: FR "Frites" -> "Frites est prêt" (correct French: "Les frites sont prêtes") FR "Pâtes" -> "Pâtes est prêt" (correct French: "Les pâtes sont prêtes") FR "Moules" -> "Moules est prêt" (correct French: "Les moules sont prêtes") FR "Pizza" -> "Pizza est prêt" (correct French: "La pizza est prête") This is not a re-litigation of decision L9 (research/01_prior_work.md §3). L9's rule — never write our words into the operator's data — is right and is untouched by this finding. The defect is in the words themselves, generated at speak time.

findings/S8_i18n.md § S8-F2 — The generated spoken announcement is grammatically wrong in both languages, and v0.4.7 replaced correct English with it: two changes, both inside lib/i18n.dart, no new user-facing capability. (a) Make the French form agreement-free — '$name : c\'est prêt' — which is correct for every gender and number. (b) Make the English form keep the operator's capitalisation and choose is/are, or apply the same neutral shape: '$name — ready'. Decide once; the current construction cannot be made correct without one of the two.

findings/S8_i18n.md § S8-F2 — The generated spoken announcement is grammatically wrong in both languages, and v0.4.7 replaced correct English with it: extend test/i18n_defaults_test.dart with a table test over ['Frites','Pâtes','Pizza','Mozzarella sticks','Fries'] asserting the generated phrase against the agreed correct string. Red today for at least Frites, Pâtes, Mozzarella sticks, Fries. ---