# Native Docs review record

2026-09-13: independent specification review dispatched as gpt-6-astra with high reasoning. Actual runtime identity was not independently verified. The amended specification was approved after adding native known-schema editing parity, twelve locales/accessibility, sandboxed CRDT decoding, bounded per-document recovery, explicit UTF-16 positions, memory-only content and current stream authorization.

Final independent production branch review: approved at `c2e1a92`, against
inherited `d5ff04e17144583620ff3b9950fcf6722e7001e9`, with the evidence and manual
acceptance limits below. The review covered the working web inventory, native
Mac/iOS implementation, current authorization, sealed server storage, lossless
CRDT identity/formatting, own-only undo, generation/recovery transitions, native
clipboard/export, and the three narrowly scoped Yrs deletion backports. No
additional concrete production blocker was established after the persisted-rule
regression passed. The reviewer authored the isolated UI targets/runner and
independent wire/deletion probes; production implementation was reviewed
independently. This does not claim exhaustive manual parity acceptance.

The final original server CI and native engine/Apple gate passed. All six
parallel Mac/simulator/device builds passed in
`../native-build-logs/20260913T095810.093604Z/results.json`. Source review preserves
normal Yrs garbage collection; it does not adopt an unbounded tombstone policy.

## Isolated native review

The review app, UI test runner, and Go fixture are separate test targets. They
use a fresh temporary database and the real native approval/exchange flow.
They never access a production account.

Run from the repository root with a booted simulator and the Go toolchain
required by `go.mod` on PATH:

```sh
python3 native/scripts/review-ios.py --simulator SIMULATOR_UUID
```

The runner builds the review app and UI tests before starting the fixture, then
installs both bundles. It starts `TestNativeReviewFixture`, checks that its exact
native credential can read the document list, and writes mode-0600
`Documents/review.json` into each current simulator container. The app and test
runner each read their own file; neither uses a hardcoded host temporary path.

UI execution has a seven-minute limit inside the fixture's ten-minute lifetime.
On success, failure, or timeout, cleanup stops the test processes, signals the
fixture to finish, terminates the review bundles, and deletes credentials from
both original and current containers. Resolving containers again handles Xcode
reinstalling an application during the test.

Logs and the `.xcresult` bundle remain under `native/build/review-TIMESTAMP`.
`--go /path/to/go` selects a toolchain explicitly. `--skip-build` reuses already
rebuilt artifacts. `--smoke` verifies authentication, credential installation,
and cleanup without claiming editor acceptance.

The orchestration smoke test passed on 2026-09-13 with simulator
`5064842A-8777-44F3-9AFF-E6562CF88F71`. On the same iPhone simulator, the native
create/type/Bold/append flow passed with exact body and formatting verified via
a fresh authenticated Markdown export. Its screenshot was visually inspected.
The runner removed both credentials and stopped the fixture afterward.
The same accepted binary passed the identical flow and fresh server read on
iPad Pro 13-inch (M5), iOS 26.5, with simulator
`C12B219D-0114-4EB6-A75B-6F6565D422CD`.

`--only testCreateTypeFormatAndPersistDocument` isolates that case;
`--only testExportPDFAndMarkdownDestinationsAndCancellation` isolates export.
Export acceptance opens both native destination pickers and cancels; the runner
asserts no private export staging remains and cleans it on failure too.
An actual external destination write is outside these cases.
On the iPad simulator, both export picker/cancel flows passed in 24.458 seconds.
Their screenshots were visually inspected: each picker displays “Native review
document”. The runner confirmed that no export staging directory remained and
removed both review credentials before stopping the fixture.

The latest iPhone build also passed `testCreateTypeFormatAndPersistDocument`
with exact saved body and bold formatting in
`native/build/review-20260913T092049.526154Z/Review.xcresult`; credentials and
fixture cleanup passed. This covers the generation-reuse and explicit-selection
changes as well as ordinary typing.

Additional review cases are `testInputRuleReversalAndMultilinePersistence`,
`testKeyboardJumpSearchOpensDocument`, and `testJumpButtonSearchOpensDocument`.
The final rebuilt iPhone rule case passed in 16.859 seconds in
`native/build/review-20260913T095637.456828Z/Review.xcresult`. It verifies native
prefix removal, Backspace restoration, multiline typing, and the exact fresh
server Markdown body. The earlier extra empty list is absent after the three
targeted Yrs deletion backports. Its screenshot was visually inspected; fixture
and credential cleanup passed.

The iPhone jump-button case passed in
`native/build/review-20260913T094927.493167Z/Review.xcresult`: native search uses
the real ranked endpoint and the selected result opens the second document.
The review-only `testRegisteredCommandAndSoftwareSubmitOpenDocument` case and
selected XCTest suite passed in 20.223 seconds, recorded in
`native/build/review-20260913T100847.314877Z/ui.log`.
It locates the actual focused native editor, verifies its registered Command-K
binding and priority, dispatches that fixed selector through UIKit's responder
chain, searches the real endpoint, and submits with software-keyboard newline.
The second document's native editor opens. Xcode then hung while finalizing its
result bundle; the owned runner was interrupted and its normal cleanup removed
credentials and stopped the fixture. Direct synthetic screenshots were retained.
This is passing XCTest evidence, not a successful final xcodebuild exit. The
fixed-command probe is confined to the separate review target and has no
production launch hook.

Physical hardware keyboard acceptance remains unverified. iPad `typeKey`
occasionally opened search but also inserted a literal K; hardware Return
injection did not open the result even after adding an explicit key handler.
One hardware-connection attempt had the same Return result, and restored the
original `ConnectHardwareKeyboard=0` preference afterward. These failed HID
cases remain diagnostics and are not claimed as passing. The phone keyboard
case explicitly skips: Apple's [XCUIElement overview](https://developer.apple.com/documentation/xcuiautomation/xcuielement)
documents keyboard interaction for macOS and iPadOS; attempted iPhone Command-K
injection produced a literal K.

Other unexecuted manual matrices remain listed in `PARITY.md`: full formatting
and clipboard UI combinations, simultaneous live editing across devices, native
sharing, VoiceOver/native-speaker review, final destination writes/print, and
interactive Mac close/menu behavior. Their implemented paths and targeted
tests were reviewed; those matrices are not represented as manually completed.

A failed XCTest case now gets 45 seconds for Xcode to finalize its result bundle;
if Xcode remains stuck, the runner stops only its own test process group and
cleans up. This failure path was exercised. The seven-minute total test bound
still applies. Synthetic jump screenshots are also written by the separate test
runner and copied into the private review log directory during cleanup, so they
survive an incomplete `.xcresult`; their originals are removed afterward.