status

.artifacts/20260831-105824-plan-code-ui-audit/review.md

@@ -0,0 +1,316 @@
+# Review Report
+
+- Task: 20260831-105824-plan-code-ui-audit
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol
+- Effort: high
+- Reviewed: 2026-08-31T12:21:07Z
+- Verdict: changes-requested
+
+## Findings
+
+### 1. Blocker — the current product does not compile
+
+- **Evidence:** `Sources/Media/PinnedMediaResourceLoader.swift:94` coalesces `Int?` from `parseTotalLength` with `Int64` from `expectedContentLength`:
+  `Self.parseTotalLength(http) ?? http.expectedContentLength`.
+- **Reproduction:** both XcodeBuildMCP `test_sim` and `build_sim` fail at that line with `binary operator '??' cannot be applied to operands of type 'Int?' and 'Int64'`.
+- **Impact:** no current tests run and no current app binary can be produced. Historical iteration-02 results (12 passing tests) do not validate the present worktree, which contains unreported partial iteration-03 edits.
+- **Correction:** use one integer type throughout (prefer `Int64` for resource lengths), add the requested 200/206/unknown-total parser tests, then rerun the complete suite and build.
+
+### 2. High — final connection failures leave a live room and wake lock behind, and retry can reuse that room
+
+- **Evidence:** `VoiceSession.handleAgentTimeout` sets `.failed` and returns on the second timeout without disconnecting (`Sources/LiveKit/VoiceSession.swift:182-193`). `connect()` then allows `.failed` but calls `start()` without recreating/tearing down the existing room (`:109-131`). `didUpdateConnectionState` handles only reconnecting↔connected, not terminal disconnection (`:475-488`). Idle-timer cleanup occurs only in explicit `disconnect()` (`:378-392`).
+- **Impact:** after “Agent never joined,” the UI shows Start while the prior room can remain connected and `UIApplication.shared.isIdleTimerDisabled` remains true. Retry can call `connect` on a connected/broken `Room`. A terminal network disconnect can leave the UI ready and the screen awake indefinitely.
+- **Correction:** centralize failure teardown: cancel waits, invalidate the generation, disconnect/recreate the room, stop state/audio, restore the idle timer, and end media scope before exposing retry. Handle terminal `.disconnected` for the active room. Add lifecycle tests through injected room/token seams or an integration test.
+
+### 3. High — media can restart during an active interruption and ignores `shouldResume`
+
+- **Evidence:** interruption begin only calls `player.pause()` and end unconditionally plays when local `desired == "playing"` (`Sources/Media/MediaPlayerController.swift:63-76`). Polling continues, and reconciliation calls `player.play()` whenever server desired is playing and rate is zero (`:166-178`, `:215-228`). No interruption flag or server `/control pause|resume` is used.
+- **Impact:** the next 1.5-second poll can restart audio while a call/Siri interruption is still active. An interruption ending without `.shouldResume` still resumes, or the next poll does. Rate KVO reports a pause but `/report` does not change server desired (`hope-voice-api/web/media_server.py:703-721`).
+- **Correction:** track active interruption and prior playback; suppress reconcile play while active; inspect `AVAudioSessionInterruptionOptionShouldResume`; make server desired coherent with pause/resume control; and test begin, end-with-resume, end-without-resume, and poll-during-interruption.
+
+### 4. High — text mode exposes a control that can turn the microphone back on
+
+- **Evidence:** the mic toggle remains available for every ready session (`Sources/Features/Conversation/ConversationView.swift:97-108`) and directly calls `session.setMuted`. Text mode only sets the mic off when mode is applied (`Sources/LiveKit/VoiceSession.swift:361-369`).
+- **Impact:** while the UI and agent remain in text mode, tapping “Muted” can enable the local microphone. This violates the text-mode privacy/behavior contract and creates local/agent mode divergence.
+- **Correction:** disable or hide the mic toggle in text mode (as the web UI does at `hope-voice-api/web/app.js:191-217`), and enforce `settings.textMode => microphone disabled` inside the session API rather than only in the view.
+
+### 5. High — server URL changes can silently target the default server or leave the session on the old server
+
+- **Evidence:** invalid configuration falls back to `192.168.86.2` in `ConversationView.makeSession` (`Sources/Features/Conversation/ConversationView.swift:17-26`) and again in media operations (`Sources/Features/Media/MediaPanelView.swift:448-457`). Settings writes every keystroke immediately (`Sources/Features/Settings/SettingsView.swift:18-24`). Conversation replacement is ignored unless the current session is already idle (`ConversationView.swift:56-64`); changing the URL during a call persists the new URL but leaves the session configured to the old one after hang-up because no later change event occurs.
+- **Impact:** the app can connect to a server different from the visible setting, and media and conversation can target different configurations. Rapid edits while idle also launch multiple unstructured replacement tasks.
+- **Correction:** validate and apply on explicit submit/save, never silently fall back for an invalid user value, serialize session replacement, and either forbid active-session edits or queue one replacement immediately after disconnect. Show a blocking configuration error instead.
+
+### 6. Medium — transcript cross-source dedupe is asymmetric, interleaving-sensitive, and suppresses legitimate repeats
+
+- **Evidence:** data-after-primary dedupe checks only `events.last` (`Sources/LiveKit/TranscriptHandler.swift:58-65`); primary-after-data always upserts by a different segment ID (`:36-41`, `:76-82`). `TranscriptHistory.add` drops any adjacent same-role/same-text entry with no time/source bound (`Sources/LiveKit/TranscriptHistory.swift:25-36`). Tests cover primary→data but not data→primary or interleaving (`Tests/TranscriptDedupeTests.swift:26-37`).
+- **Impact:** the same utterance can appear twice when delivery order reverses or another role interleaves; conversely, a user legitimately repeating the same phrase can be lost indefinitely until another history entry appears.
+- **Correction:** track recent finals by normalized role/text/source and timestamp in a short window; reconcile either source order without relying on the last array element; keep persistence append semantics separate from transport dedupe; add both-order, interleaving, expiry, and legitimate-repeat tests.
+
+### 7. Medium — persisted transcript history is not rendered, and Clear does not clear the visible transcript
+
+- **Evidence:** `TranscriptHistory` loads persisted entries (`Sources/LiveKit/TranscriptHistory.swift:17-22`), but `TranscriptListView` renders only `events` (`Sources/Features/Conversation/OrbView.swift:64-107`) and never reads `history.entries`. The Clear action calls only `clearHistory()` (`Sources/Features/Conversation/ConversationView.swift:33-37`), leaving `events` intact.
+- **Impact:** “history persistence (last 50)” is storage without user-visible restoration, and Clear appears to do nothing until relaunch/new session. This contradicts UPDATE_PATH phase 3 and PLAN’s completed claim.
+- **Correction:** define one visible transcript model combining restored finals with current events, and make Clear atomically clear visible events and persisted history. Add relaunch/load/max-50/clear tests.
+
+### 8. Medium — the partial microphone-interruption fix is not lifecycle-safe
+
+- **Evidence:** `micMutedByInterruption` is documented as cleared on disconnect (`Sources/LiveKit/VoiceSession.swift:55-57`) but `disconnect()` does not clear it (`:378-392`). A new `.began` does not reset a stale true flag when the mic is already muted (`:401-410`). Mute/unmute operations are unstructured tasks and can cross an early `.ended` (`:408`, `:416`).
+- **Impact:** an interruption ending after disconnect/reconnect, or nested/missing-end notifications, can unmute a user who should remain muted. The current code only fixes the simplest “already muted before one well-formed interruption” case.
+- **Correction:** reset the flag at disconnect and at the start of each interruption sequence, associate it with session generation, and resume only after a successful interruption-owned mute and a matching end with `.shouldResume`. Add focused state tests.
+
+### 9. Medium — conversation-state inference ports a reference bug and can remain “thinking” after speech ends
+
+- **Evidence:** when remote audio becomes silent, the iOS model transitions speaking→thinking (`Sources/LiveKit/ConversationState.swift:54-66`). It is driven only by speaking-participant delegate callbacks (`Sources/LiveKit/VoiceSession.swift:441-455`), so no later callback is guaranteed to release that state. The current web reference explicitly changed speaking→listening to avoid “thinking forever” (`hope-voice-api/web/app.js:414-426`).
+- **Impact:** status/orb/thinking chip can become stale after an agent response. The “ported verbatim/full parity” claim is contradicted by the current reference implementation.
+- **Correction:** align with current server reference, or implement an explicit turn-state/timer that deterministically exits thinking. Add state-transition tests including remote speech ending with no subsequent participant update.
+
+### 10. Medium — media control publishing can escape its originating LiveKit room
+
+- **Evidence:** `publishMediaState` captures `session` but reads `session.room` later inside an unstructured task and has no session-generation/room-identity check (`Sources/Media/MediaPlayerController.swift:369-379`). VoiceSession can replace its room during teardown/retry (`Sources/LiveKit/VoiceSession.swift:177-180`).
+- **Impact:** a delayed pause/stop/play event from an old media/session lifecycle can be published into a newly created conversation room, changing the new agent’s listening state.
+- **Correction:** capture the exact `Room` and generation before launching, require that room still be current/connected before publish, and cancel or invalidate outstanding media reporting tasks on scope changes.
+
+### 11. Medium — the resource loader still has cancellation, status, and resource-management gaps
+
+- **Evidence:** every loading request creates a new pinned `URLSession` (`Sources/Media/PinnedMediaResourceLoader.swift:78`); the task is not retained; cancellation only logs and cannot cancel upstream work (`:109-114`); non-2xx responses are treated as successful bytes (`:84-104`); loader URL identities are never removed (`:16-18`, `:50-54`).
+- **Impact:** seeks/item swaps can continue downloading cancelled ranges, leak session/loader bookkeeping, and feed 404/500 JSON into AVPlayer as media. These risks remain even after the content-length type error is fixed.
+- **Correction:** share/invalidate a pinned session, map loading requests to data tasks, cancel and remove them in `didCancel`, validate 200/206 status, clean loader mappings, and test 404/cancellation/range behavior. Keep webm unsupported as documented.
+
+### 12. Medium — configurable HTTPS servers are rejected by the hard-coded pin delegate
+
+- **Evidence:** every TLS server-trust challenge is accepted only if its leaf matches the single LAN DER hash (`Sources/Networking/TLSPinning.swift:40-51`), regardless of configured host. `SettingsStore.serverURL` is documented as configurable, and `ServerConfig` permits public HTTPS hosts (`Sources/Networking/ServerConfig.swift:21-45`).
+- **Impact:** a valid public HTTPS deployment or another LAN host fails token/media calls even with a trusted certificate. “How to point at another deployment” is therefore not true without source changes.
+- **Correction:** apply the fixed pin only to the pinned deployment host and use default trust for other explicitly supported hosts, or make trust/pins part of validated configuration. Do not weaken trust for the default self-signed host.
+
+### 13. Low — completed parity/accessibility claims include absent UI features
+
+- **Evidence:** UPDATE_PATH requires agent visualizer bars, a barge-in hint while speaking, Dynamic Type/accessibility work, and an app icon (`UPDATE_PATH.md:110-126`, `:306-316`, `:218-229`). The iOS app has no agent visualizer, shows the hint whenever text mode is ready (`ConversationView.swift:82-86`), has no reduced-motion handling (`OrbView.swift:44-57`), and the AppIcon entry has no filename (`Resources/Assets.xcassets/AppIcon.appiconset/Contents.json:1-12`). Transcript rows lack combined VoiceOver semantics (`OrbView.swift:111-137`).
+- **Impact:** phase 0/3/8 and “full web parity” are not complete. The separate `ui-ux-spec.md` accurately identifies many of these gaps, but specification is not implementation.
+- **Correction:** classify these as planned UI redesign/device qualification, not complete; implement and verify the redesign in its own scoped task. Do not fold it into the current correctness correction unless Build explicitly expands scope.
+
+### 14. Low — the model picker’s disconnected state contradicts its own requirement
+
+- **Evidence:** because a non-nil session is always passed, an idle session with no models displays “Loading available models…” (`Sources/Features/Settings/SettingsView.swift:33-44`) rather than “Start a conversation to load the model list.”
+- **Impact:** users see an indefinite loading state while disconnected.
+- **Correction:** branch on `session.isReady`/connection state, not merely session existence.
+
+## Acceptance Criteria
+
+### PLAN / UPDATE_PATH completion matrix
+
+Legend: **Implemented** = code path exists; **Simulator-verified** = historical evidence or current reviewer evidence; **Device-unverified** = original real-iPhone exit remains open; **Server-blocked** = deployment prevents the stated check; **Contradicted** = code/evidence conflicts with a completion claim.
+
+| Area / phase | Implemented | Simulator-verified | Device-unverified | Server-blocked | Contradicted / qualification |
+|---|---|---|---|---|---|
+| Phase 0 scaffold/settings | Mostly | Historical launch/build only | Install on iPhone | No | App icon is empty; current build now fails |
+| Phase 1 token/TLS/config | Yes for default host | Live health/state 200 and current DER/SPKI pins match; historical token test | Token exit on device | No | Generic configurable HTTPS hosts fail hard-coded pin; invalid URL silently falls back |
+| Phase 2 LiveKit lifecycle/audio/transcripts | Mostly | Historical connect/agent_ready/text transcript evidence | Mic, remote TTS, full device exit | Simulator mic unavailable | Final-failure/disconnected cleanup is incomplete; separate agent and ready waits are conflated into one 10 s timer |
+| Phase 3 state/UI/history/mode | Partial | Historical text-mode round-trip and remote state evidence | Local speech, meter, wake lock | Mic path unavailable in this simulator | History not restored/cleared visibly; state inference differs from current web; visualizer/barge-in parity absent |
+| Phase 4 voice/model settings | Mostly | Historical live agent logs and persistence | Current real-device/live qualification | No | Source/reference list contains 12 voices, not the repeatedly claimed 13; idle picker copy is wrong |
+| Phase 5 media API/player/reconcile | Partial | Historical range/reconcile/UI; reviewer verified server endpoints | Audible playback/interruption | Current YouTube library webm blocks AVPlayer decode | Current resource loader does not compile; interruption/report lifecycle incomplete; “no client change needed” was premature |
+| Phase 6 search/choices/library/streams | Mostly | Historical simulator/server evidence | Supported-format stream playback on device | Existing webm tracks only | Invalid config can target fallback server; operational failures are often log-only |
+| Phase 7 task panel | Yes | Historical real task-event evidence | Device UI not required for protocol | No | No automated protocol/store coverage; otherwise wire format matches `task_registry.py`/`agent.py` |
+| Phase 8 hardening/accessibility | Partial | Historical reconnect matrix only | Interruption, mic denial, wake lock, device matrix | Mic environment | Terminal lifecycle, both interruption paths, text-mode mic privacy, stale media publish, reduced motion and transcript accessibility remain open |
+| Phase 9 docs/handoff | Docs exist | N/A | N/A | N/A | README/PLAN overstate full parity and current build status |
+| UI/UX audit + Hope square spec | Yes (artifact) | Reference code/assets inspected | Redesign not device-tested | No | `ui-ux-spec.md` is a specification only; product still uses the old orb/empty icon |
+
+### UPDATE_PATH feature inventory
+
+| Feature | Classification | Evidence / gap |
+|---|---|---|
+| Token → join → agent → ready | Implemented, historically simulator-verified, lifecycle contradicted | `VoiceSession.swift`; Findings 2 and readiness timing qualification |
+| Audio-level state/orb | Implemented, device-unverified, contradicted | `ConversationState.swift`; Finding 9; old orb remains |
+| Mic meter + agent visualizer | Partial/device-unverified | Meter exists; agent bars absent |
+| Transcript partial/final/history/clear | Partial, contradicted | Findings 6–7 |
+| Voice/text mode + `lk.chat` | Implemented, historically simulator/server-verified; privacy defect | AgentSession accepts `lk.chat`; Finding 4 |
+| Mute | Implemented, device-unverified; mode invariant broken | Finding 4 |
+| Voice/model picker + sync | Implemented, historically simulator/server-verified | Independent best-effort sync is correct; idle copy and count claims remain |
+| Background tasks | Implemented, historically simulator/server-verified | Payload matches `agent/task_registry.py:71-102` and `agent.py:953-983` |
+| Media player/API/reconciliation/reporting | Partial; current build blocked; audible current-library playback server-blocked | Findings 1, 3, 10–11 |
+| Wake lock | Implemented, device-unverified; failure cleanup contradicted | `VoiceSession.swift:150`, `:389`; Finding 2 |
+| Reconnect/stale guards | Partial, contradicted | Room callbacks use identity guards, but terminal disconnect and media publish do not |
+| Accessibility/Dynamic Type | Partial | Labels exist; reduced motion, transcript semantics, and full audit absent |
+| App icon/Hope visual identity | Not implemented in product | Spec delivered separately; AppIcon has no filename |
+
+### Iteration 01/02 fix verification
+
+| Fix | Review result |
+|---|---|
+| POST object responses | Correct code shape; historical test passed; current suite blocked by Finding 1 |
+| Published media desired | Correctly assigned in reconcile; deterministic tests exist |
+| Reporting protocol | Improved, but not complete because interruption and stale-room publishing remain |
+| Poll restart after conversation | Implemented; lifecycle behavior still needs explicit ownership/teardown tests |
+| Persisted text mode on join | Implemented with independent mode sync |
+| Live Settings text mode | Binding/onChange fix is valid; text-mode mic toggle violates invariant |
+| Retry from failed state | Guard fixed, but actual failed-room cleanup/retry lifecycle remains broken |
+| Persisted model preference | Deterministic preference ordering fixed; invalid model is isolated from mode sync |
+| Transcript replacement/dedupe | Open-partial replacement is correct; symmetric/time-bounded dedupe is not |
+| Automated tests | Test target and 12 historical tests exist; high-risk lifecycle/protocol/accessibility paths remain uncovered; current suite cannot compile |
+
+### Iteration 03 request assessment
+
+| Item | Current status | Assessment |
+|---|---|---|
+| 1. Symmetric, bounded transcript dedupe | Not implemented | No inverse/interleaving/window tests; Findings 6–7 |
+| 2. Mic interruption ownership | Partially implemented | Simple flag added, but disconnect/new-begin/generation/race handling is missing; Finding 8 |
+| 3. Media interruption | Not implemented | Existing code is exactly the unsafe behavior described; Finding 3 |
+| 4. HTTP 206 total content length | Attempted but build-breaking | Parser added without test and with `Int`/`Int64` compile error; Findings 1 and 11 |
+| 5. `streamURL(trackID:)` | Implemented | `MediaAPI.swift:185-190` now constructs the progressive endpoint and does not fetch bytes. Signature changed from async/throws, but no callers exist; low risk. A URL-construction test is still appropriate. |
+| 6. Stale comments | Implemented for identified examples | `applyTextMode` comment now names `.onChange`; no removed callback references remain. |
+| Verification/report/manifest | Missing | Current build/tests fail; no `iterations/03-implementation.md` exists; partial iteration-03 edits were not reported before review. |
+
+**Missing from iteration 03:** final failed/disconnected room cleanup, text-mode mic privacy, server-config replacement semantics, visible history/clear behavior, current-reference state inference, stale media-room publishing, resource-loader cancellation/status/session cleanup, generic-host TLS behavior, and acceptance-claim corrections.
+
+**Potentially over-scoped:** item 5 repairs an unused helper and has no current production caller. It is harmless and logically correct, but should not displace the runtime/lifecycle fixes. The broader UI redesign should remain a separate task rather than be added to iteration 03.
+
+## Verification Evidence
+
+- Read `brief.md`, `PLAN.md`, `UPDATE_PATH.md`, `manifest.md`, `implementation.md`, all iteration request/implementation artifacts through `iterations/03-request.md`, `ui-ux-spec.md`, and `ui-research-implementation.md`.
+- Inspected the complete current `git diff`, every Swift source file, all three test files, project configuration/resources, README/device checklist, and relevant reference code in `hope-voice-api/web/app.js`, `web/media_server.py`, `agent/agent.py`, `agent/task_registry.py`, and `tests/test_media.py`.
+- `xcodebuildmcp_session_show_defaults` → project `Voice.xcodeproj`, scheme `Voice_iOS`, iPhone 17 Pro simulator `AFDA137E-1657-428E-BF01-E5CD7989772C`.
+- `xcodebuildmcp_test_sim` → **failed during compile** at `PinnedMediaResourceLoader.swift:94`; no tests executed. Log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T12-17-58-766Z_pid94423_f452990c.log`.
+- `xcodebuildmcp_build_sim` → **failed** at the same line. Log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T12-18-10-993Z_pid94423_3b0b4aa7.log`.
+- Historical iteration-02 evidence says 12 tests passed and build succeeded before the partial iteration-03 worktree changes; this was not independently reproducible against the current tree.
+- Live read-only diagnostics: current server DER SHA-256 is `07907abd…af46` and SPKI pin is `vmrfRuHv…Q5hMU=`; both exactly match `TLSPinning.swift`/Info.plist. `/media/api/healthz` and `/media/api/state?room=default` returned HTTP 200.
+- `git diff --check` → clean. `plutil -lint Resources/Info.plist` → OK. `git status --short` confirmed only the reported product/test/artifact changes; reviewer made no product edits.
+
+## Residual Risks
+
+- No real-device evidence exists for microphone capture, TTS audibility, interruption behavior, wake lock, mic-denied fallback, or supported-format media.
+- Existing YouTube library tracks are webm and block AVPlayer decode, but a supported direct MP3/AAC stream could still be used for client/device qualification; the server blocker is not a substitute for that test.
+- Plain `ws://` LiveKit signaling exposes the room JWT to the LAN. This is a documented deployment tradeoff, not fixed here.
+- The self-signed pin matches today but rotates with the container certificate; shipped builds remain operationally brittle.
+- Historical simulator/server logs in PLAN.md were not independently preserved in task attachments, so they are treated as reported evidence, not current proof.
+
+## Required Actions
+
+1. Return Findings 1–12 and the iteration-03 assessment to coder; do not approve until the current suite/build pass.
+2. Add focused tests for symmetric/time-bounded transcript dedupe, resource-length parsing, interruption state, state transitions, config replacement, and failure teardown where practical.
+3. Re-run complete XcodeBuildMCP test/build after corrections and write `iterations/03-implementation.md` with actual current evidence.
+4. Perform the real-device checklist before marking the original phase exits/full parity complete.
+5. Correct PLAN/README completion language and keep the Hope visual redesign as a separately implemented/reviewed task.
+
+---
+
+## Iteration 04 Review Addendum — 2026-08-31T13:02:29Z
+
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol
+- Verdict: **changes-requested**
+- Detailed report: `iterations/04-review.md`
+- Current build: **succeeded** via XcodeBuildMCP (2.8 s).
+- Current test command: **16 passed / 0 failed / 0 skipped**, but only `MediaAPITests`, `MediaReconcileTests`, and `TranscriptDedupeTests` were discovered. `PinnedMediaResourceLoaderTests.swift` and `ConversationStateTests.swift` are absent from the generated Xcode project, so 12 claimed tests did not run.
+- Current finding count: **7** (5 high, 2 medium).
+
+### Current top findings
+
+1. Generated project omits both new test files; the claimed suite composition/count is false. Once discovered, the stream URL expectation is missing `/media/api`, and conversation EMA tests need another silence tick.
+2. `visibleRows = history.entries + events` duplicates every live final; same-source legitimate repeats remain suppressed, and persistence still drops adjacent repeats permanently.
+3. Settings still persists each keystroke; active-session URL changes are discarded rather than deferred; invalid media settings still use default-host fallback.
+4. Failure teardown can react recursively to its own `room.disconnect`; intentional agent retry can be classified as terminal disconnect; non-timeout connect failures still skip cleanup.
+5. Media no-resume interruption clears suppression before asynchronous server pause completes, allowing polling to restart playback.
+6. Resource-loader `removeLoader` is unused, task dictionaries are mutated across queues, and unknown 206 totals still use range length as full length.
+7. Mic interruption mute/unmute tasks remain unordered and ownership is marked before successful mute.
+
+### Superseding verification evidence
+
+- XcodeBuildMCP test log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T12-58-36-052Z_pid94423_12510633.log`.
+- XcodeBuildMCP build log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T12-58-53-892Z_pid94423_5f92c809.log`.
+- Build blocker from original Finding 1 is fixed. The remaining disposition matrix and concrete corrections are authoritative in `iterations/04-review.md`.
+
+---
+
+## Iteration 06 Review Addendum — 2026-08-31T13:55:00Z
+
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol
+- Verdict: **changes-requested**
+- Detailed report: `iterations/06-review.md`
+- Independent verification: **47 tests passed / 0 failed / 0 skipped** across all five discovered suites; separate simulator build succeeded.
+- Current finding count: **7** (5 high, 1 medium, 1 low).
+
+### Current top findings
+
+1. `.failed` exposes Start before failure teardown finishes, so immediate retry can be disconnected by the old cleanup task.
+2. Mic end/unmute work is unretained and can complete after a newer begin/mute; operations are not one serialized chain.
+3. Dedupe transfers source ownership rather than consuming a matched pair; `P1,D1,P2,D2` drops the entire second utterance.
+4. Rapid accepted server Applies can leave `activeServerURL` different from the config used to construct the session.
+5. An old should-resume media task can call `player.play()` during a newer interruption.
+6. Failed sessions cannot apply a corrected server and Settings does not directly observe session state.
+7. The 47-test total is correct, but all reports use an inaccurate per-suite breakdown.
+
+### Superseding verification evidence
+
+- XcodeBuildMCP test log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T13-52-53-924Z_pid94423_58a6793f.log`.
+- XcodeBuildMCP result bundle: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/result-bundles/test_sim_2026-08-31T13-52-53-924Z_pid94423_3468939d.xcresult`.
+- XcodeBuildMCP build log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T13-53-07-806Z_pid94423_6bf6e3a5.log`.
+- Detailed acceptance disposition and corrections are authoritative in `iterations/06-review.md`.
+
+---
+
+## Iteration 07 Review Addendum — 2026-08-31T14:25:00Z
+
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol
+- Verdict: **changes-requested**
+- Detailed report: `iterations/07-review.md`
+- Independent verification: **49 tests passed / 0 failed / 0 skipped** across all five discovered suites; separate simulator build succeeded.
+- Current finding count: **3** (2 high, 1 medium).
+
+### Current findings
+
+1. A newer mic begin snapshots `isMuted` before awaiting an old end/unmute, so it can skip its final mute and leave the microphone enabled.
+2. Server coalescing processes only one pending replacement; a third accepted URL can remain unapplied indefinitely.
+3. Terminal failure cleanup leaves old agent/mic error/model state visible into failure and retry.
+
+### Superseding verification evidence
+
+- XcodeBuildMCP test log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T14-20-50-489Z_pid94423_32855de5.log`.
+- XcodeBuildMCP result bundle: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/result-bundles/test_sim_2026-08-31T14-20-50-489Z_pid94423_fd18ee90.xcresult`.
+- XcodeBuildMCP build log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T14-21-04-018Z_pid94423_8f26cb11.log`.
+- Current per-suite source counts: Transcript 24, MediaReconcile 7, ConversationState 5, MediaAPI 1, Pinned Loader 12.
+- Detailed acceptance disposition and corrections are authoritative in `iterations/07-review.md`.
+
+---
+
+## Iteration 08 Review Addendum — 2026-08-31T21:52:04Z
+
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol (actual model ID: openai/gpt-5.6-sol)
+- Verdict: **changes-requested**
+- Detailed report: `iterations/08-review.md`
+- Independent verification: **59 tests passed / 0 failed / 0 skipped** across all six discovered suites; separate simulator build succeeded; source counts and generated-project membership match; `git diff --check` is clean.
+- Current finding count: **1 medium**.
+
+### Current finding
+
+`teardownForFailure` clears ephemeral state before asynchronous room teardown, but direct old-room participant and connection-state callbacks are not lifecycle-gated and can repopulate `agent`/`isReconnecting` before `.failed` is published. The new control-event allowlist does not cover those direct `RoomDelegate` callbacks.
+
+### Superseding verification evidence
+
+- XcodeBuildMCP test log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T21-49-50-739Z_pid94423_e7565563.log`.
+- XcodeBuildMCP result bundle: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/result-bundles/test_sim_2026-08-31T21-49-50-739Z_pid94423_c82a15cd.xcresult`.
+- XcodeBuildMCP build log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T21-50-04-874Z_pid94423_dc756cb2.log`.
+- Current per-suite source counts: Transcript 24, ConversationState 10, MediaReconcile 7, ServerReplacement 5, Pinned Loader 12, MediaAPI 1.
+- Mic user-intent/ordering and arbitrary A→B→C worker semantics are accepted by source inspection with passing focused tests; device/UI integration remains residual.
+
+---
+
+## Iteration 09 Final Review Addendum — 2026-08-31T22:06:00Z
+
+- Agent: reviewer
+- Model: openai-codex/gpt-5.6-sol (actual model ID: openai/gpt-5.6-sol)
+- Verdict: **approve**
+- Detailed report: `iterations/09-review.md`
+- Findings: **0** (`No findings`).
+- Independent verification: **65 tests passed / 0 failed / 0 skipped** across all six discovered suites; separate simulator build succeeded; test source counts and generated-project membership match; `git diff --check` is clean.
+- Iteration-08 callback race is closed: participant and connection callbacks are lifecycle/teardown-gated, and failure/disconnect perform a final shared ephemeral reset immediately before terminal state publication.
+- Previously approved correctness findings remain accepted with all focused suites passing. Real-device behavior, supported server media format, and the separate Hope UI implementation remain residual qualifications, not blockers to code-correctness approval.
+
+### Superseding verification evidence
+
+- XcodeBuildMCP test log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/test_sim_2026-08-31T22-02-03-855Z_pid94423_2cf79d11.log`.
+- XcodeBuildMCP result bundle: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/result-bundles/test_sim_2026-08-31T22-02-03-855Z_pid94423_77ceed4b.xcresult`.
+- XcodeBuildMCP build log: `~/Library/Developer/XcodeBuildMCP/workspaces/voice-ios-9eb036fdea81/logs/build_sim_2026-08-31T22-02-14-911Z_pid94423_0052ca2d.log`.
+- Current per-suite source counts: Transcript 24, ConversationState 16, MediaReconcile 7, ServerReplacementCoordinator 5, Pinned Loader 12, MediaAPI 1 = **65**.