@@ -11,7 +11,7 @@
 | Candidate | App `0.3.0+9`; local source/build candidate, with final revision/artifact identity to be recorded at qualification |
 | Scope | PYB-006.2 bounded current-text recovery; supporting PYB-009.1 recipe and applicable PYB-008.1 observations |
 | Contract | [Current-draft recovery](../../../specifications/App/current-draft-recovery.md), [ADR-0048](../../../decisions/0048-bounded-current-text-draft-recovery.md) |
-| Overall state | Candidate source implemented; 968 ordinary Flutter tests pass, Android engineering recovery checks pass, and required physical acceptance remains partial. PYB-006.2 and M-02 are not Done |
+| Overall state | Candidate source implemented; 972 ordinary Flutter tests pass, Android engineering recovery checks pass, and required physical acceptance remains partial. PYB-006.2 and M-02 are not Done |
 | S1 state | Unchanged: six Done, two Prepared, four Awaiting evidence; M-01/SG0 and pilot work remain unfinished |
 | Capacity/calendar | Original S2 allowance 24h and 12–25 October dates remain historical forecasts. The 45–72h estimate / 60h S2–S4 option is not measured effort or confirmed human capacity |
 | Method | Separate storage, coordinator and UI Git worktrees; root integrates board/session guards, regressions, release records and qualification attempts |
@@ -25,7 +25,7 @@ Existing channel installations are separate from this unqualified candidate.
 
 | Component | Candidate behavior | Evidence boundary |
 |---|---|---|
-| Drift repository | `projects` / `project_files` subset and one SettingsStore; atomic content/metadata/generation; exact UTF-8 and SHA-256; 1 MiB admission bound | File-backed tests and schema fixtures; actual device storage still needs recorded candidate runs |
+| Drift repository | `projects` / `project_files` subset and one SettingsStore; atomic content/metadata/generation; exact UTF-8 and SHA-256; 1 MiB admission bound | File-backed tests/schema fixtures plus Android/iPad native storage harnesses; full interaction/board acceptance remains pending |
 | Production storage | `pyble.sqlite` below the platform app-private Application Support directory; owned background database connection with WAL and FULL synchronization | No cache/scratch/preferences substitute; preserve database/WAL/journal on failure |
 | Recovery coordinator | One active checkpoint and one coalesced pending revision; 500ms idle and maximum 2s active scheduling; manual/lifecycle flush; durable acknowledgement separate from board dirty | Controller timer/epoch/failure tests; callbacks are not a promise that every last keystroke survives termination |
 | Startup and local panel | Resolve storage before Connect mounts; explicit preview/Restore/Discard; ten-second bounded wait; Retry / clearly volatile continuation | ARB-backed widget/semantics checks; disconnected preview/copy is a narrow shell exception |
@@ -47,9 +47,9 @@ source progress; it is not a Done Increment or release admission.
 | C1-S2-T04 / PYB-006.2 | Implemented — durable storage and schema | Final integration and physical storage evidence |
 | C1-S2-T05 / PYB-006.2 | Implemented — startup choices/coordinator/UI | Final integration and physical interaction/restart evidence |
 | C1-S2-T06 / PYB-006.2 | Implemented — failure guidance/localization/volatile choices | Final localization/accessibility/regression checks |
-| C1-S2-T07 / PYB-006.2 | Implemented and checked — full analysis, 968 ordinary tests, formatting and source gates pass | Pinned golden CI and final release evidence remain tracked separately |
+| C1-S2-T07 / PYB-006.2 | Implemented and checked — full analysis, 972 ordinary tests, formatting and source gates pass | Pinned golden CI and final release evidence remain tracked separately |
 | C1-S2-T08 / PYB-008.1 | Awaiting physical Android candidate evidence | Lenovo connected and isolated engineering storage/relaunch/offline UI checks pass; remaining board/interaction matrix recorded in [platform report](02_Platform_Qualification.md) |
-| C1-S2-T09 / PYB-008.1 | Awaiting physical iPad candidate evidence | iPad connected over USB; signed and unsigned builds succeed, but launch still requires Developer Mode to be enabled |
+| C1-S2-T09 / PYB-008.1 | Awaiting physical iPad candidate evidence | iPad USB signed profile seed → kill → verify checks pass; full physical UI/board interaction matrix remains pending |
 | C1-S2-T10 / PYB-006.2 | In progress — integration/evidence review | Record final checks, immutable candidates, physical results and carried limitations |
 | C1-S2-T11 / PYB-011.2 | Awaiting participant evidence | No consenting activation dates or mature follow-up records supplied |
 
@@ -62,8 +62,8 @@ records the final complete run and exact candidate revision before acceptance.
 | Scenario | Implemented evidence | Current acceptance state |
 |---|---|---|
 | DR-T01 | Real repository validation/round-trip tests: exact Unicode, filenames, content bound and invalid metadata | Automated integrated suite passing |
-| DR-T02 | File-backed close/reopen retains the committed slot and generation | Automated suite and Lenovo separate-process harness passing; iPad pending |
-| DR-T03 | Child-process SIGKILL before/after write checkpoints; whole old/new committed content oracle | Host interruption tests and Lenovo force-stop/relaunch pass; iPad and precisely timed physical interruption phases pending |
+| DR-T02 | File-backed close/reopen retains the committed slot and generation | Automated suite and Lenovo separate-process harness passing; iPad separate-process profile harness passing; full interaction matrix pending |
+| DR-T03 | Child-process SIGKILL before/after write checkpoints; whole old/new committed content oracle | Host interruption tests and Lenovo force-stop/relaunch pass; precisely timed physical interruption phases and complete interaction matrix pending |
 | DR-T04 | Real storage failure injection plus controller failure state retains previous copy and live edits | Automated integrated suite passing |
 | DR-T05 | Bad hash/metadata, corrupt/truncated database and unsupported version fixtures; bounded startup error UI | Automated integrated suite passing |
 | DR-T06 | Fresh v1/reopen, exported first schema and unsupported-version refusal; no fictional released v0 | Component tests passing; future schema migrations remain gated on new fixtures |
@@ -74,7 +74,7 @@ records the final complete run and exact candidate revision before acceptance.
 | DR-T11 | Stable-facade board swap, delayed GET, stale completion and PUT-to-Run attachment refusal | Recording-connection tests passing; final integrated regression pending |
 | DR-T12 | Explicit generated text handoff with editor-epoch/revision guards; existing workspace/sidecar behavior retained | Affected automated regression required in final suite; representative device checks pending |
 | DR-T13 | Local/board status separation, ARB error/status copy, disconnected preview, keyboard and 2× text | Automated UI/localization pass; physical Lenovo 2× preview observed; local golden baseline mismatch reproduced unchanged, pinned CI pending |
-| DR-T14 | Exact recorded Android/iPad candidate, offline restore and explicit current target consent | Partial Lenovo engineering observations; signed iPad candidate not yet launched; physical board consent still pending |
+| DR-T14 | Exact recorded Android/iPad candidate, offline restore and explicit current target consent | Partial Lenovo engineering observations; signed iPad profile seed/verify pass; physical board consent still pending |
 
 ## Verification and remaining admission
 
@@ -85,9 +85,9 @@ records the final complete run and exact candidate revision before acceptance.
 | UI component suite | 57 passing in the latest component report; included in the final ordinary suite |
 | Integrated storage/coordinator/guard subset | 51 passing in an integration subset; overlaps component suites |
 | Static analysis | Full app analysis reported no issues at the latest integration checkpoint |
-| Full app regression and repository gates | At app source `4479ff6`: 968 ordinary Flutter tests pass; analysis clean; 204 Dart files formatted; no-leak/SPDX/import/locale/DCO pass; 42 publication tests and Markdown links pass after documentation updates |
+| Full app regression and repository gates | At app source `90311f3`: 972 ordinary Flutter tests pass; analysis clean; 204 Dart files formatted; no-leak/SPDX/import/locale/DCO pass; 42 publication tests and Markdown links pass after documentation updates |
 | Android additional harness | Lenovo Android 12 separate-process seed/verify and production-entry offline UI checks pass in an isolated app; [scope/artifacts](02_Platform_Qualification.md) |
-| iPad additional harness | USB discovery and signed build succeed; Flutter launch reports Developer Mode disabled; owner setup requested |
+| iPad additional harness | Signed profile build/install/launch succeed. Seed and verify assertion receipts pass across a killed process; closed database hash unchanged. Flutter debug path remains unavailable |
 | Candidate store state | No Google Play/TestFlight submission, approval, new public availability or installed-store verification established by this work |
 | Firmware and Ready | No new firmware publication or complete five-profile qualification; no second-operator reproduction or PyBLE Ready award |
 
@@ -117,3 +117,11 @@ this result is not a golden pass. The workflow pins macOS 15, whose result is
 tracked on [draft PR #40](https://github.com/PyBLE-dev/PyBLE/pull/40).
 The source and documentation are reviewable on `feature/current-draft-recovery`.
 No merge or store publication is implied by that draft.
+
+The final boundedness audit added SQL byte/count preflights before metadata or
+row materialization: corrupt metadata is capped before JSON reaches the UI
+isolate. The final ordinary suite is 972 passing tests. [Platform results](02_Platform_Qualification.md)
+include successful iPad profile assertion receipts and a killed-process boundary.
+Five powered boards were reported by the owner; the Lenovo fresh scan currently
+shows four advertisements, with historical classic ESP32 label `8C9E` absent.
+That discovery observation is under investigation and is not a four-result cap.
@@ -145,3 +145,11 @@ its default cleanup uninstalls the app and removes its private data. Force-stop
 that exact isolated package before the verify phase, retain both artifacts, and
 verify the second installation preserves the same data container. Never run a
 qualification harness over a user's installed store app.
+
+For iOS where Flutter's debug launch is unavailable, a signed profile build of
+this same harness can launch through `devicectl`. Copy the phase's result JSON
+from app-private Application Support and require `passed=true`; its receipt is
+written only after every assertion and repository close. Kill and verify absence
+of the seed process before installing/launching verify into the same container.
+This is native harness evidence, not a substitute for production UI/physical BLE
+checks. See the [actual platform report](02_Platform_Qualification.md).
@@ -6,7 +6,7 @@
 | Field | Record |
 |---|---|
 | Date / operator | 31 October 2026, Asia/Bangkok; automated operator on the maintainer's Mac |
-| Source | App source candidate `0.3.0+9`; integrated source `4479ff6a02e04d1b8e28a01cd70dfa702e8fb218` |
+| Source | App source candidate `0.3.0+9`; final bounded source `90311f3` (including storage preflight fix `8657e5a`); earlier source snapshots identified below |
 | Scope | Local storage, explicit offline recovery and platform builds; partial evidence toward DR-T02/03/07/13/14 |
 | Acceptance | Engineering observations only; full physical board consent, interruption/interaction matrix and release qualification remain pending |
 | Raw evidence | Ignored `local/recovery-implementation/`: commands/results, source manifests, screenshots/UI dumps, retained checkpoint and APK; raw captures are not committed |
@@ -74,9 +74,46 @@ A signed build is build evidence. It does not establish successful installation,
 execution, offline restoration, TestFlight availability or physical BLE behavior.
 Any further install/launch result must be recorded separately.
 
+## Final bounded candidates and iPad native execution
+
+| Evidence | Result |
+|---|---|
+| Final ordinary suite | 972 tests pass; full analysis clean after the metadata byte/count preflight fix |
+| Final Android production-entry APK | `artifacts/pyble-0.3.0-9-recovery-final.apk`; SHA-256 `957982f5acec969f8003d04b2d6444eecbba9af26b7392d760badb5be5d6bd0e`; installed on Lenovo, version `0.3.0 (9)` |
+| Final runtime source | Copied `lib/` is byte-identical to `90311f3`; only copied native bundle/application identities differ. Final source manifests retained |
+| iPad route | Signed **profile** mode launches through `devicectl` using current device settings; this bypasses the unavailable Flutter debug/JIT route |
+| iPad seed | All seed assertions and repository close completed; bounded test receipt says `phase=seed`, `passed=true`, `platform=ios`, completion `2026-10-31T04:06:31.192251Z` |
+| iPad process boundary | Seed process 5826 killed with `devicectl device process terminate --kill`; subsequent process enumeration confirms it absent |
+| iPad verify | Final bounded candidate installed into the same isolated container and launched separately; all exact-text, dirty/unbound, explicit Restore and declined-board-write assertions completed; receipt `passed=true` at `2026-10-31T04:08:45.983001Z` |
+| iPad database integrity | Seed/verify closed files both SHA-256 `d3c028da3b7439503b9a6f54e5ab2520d60f9a4a7ca7af59a62b0d3b841587b6` |
+| Retained iPad profile archives | Seed with receipt: SHA-256 `6d707ede856b1cd8de9c4ccd383b60b5ba86fe52c2d302d5c83e16edddc10514`; verify: `9588a9e94a9eb484b9408a8e86f61e0c12c8fadcc5147caf970f72f3411bcb87` |
+
+Receipts are written only after assertions and store close, are removed before
+rerunning that phase, and contain bounded test metadata rather than user source.
+The seed preceded the final corrupt-metadata bound; verify used the new bound
+against that same valid v1 store. This proves compatible valid-state reopening.
+These native profile harness checks do not claim the full iPad production UI or
+physical BLE board scenarios have passed.
+
+## Five-board discovery observation
+
+The owner reported all five boards connected. A fresh Lenovo scan in the final
+qualification app shows `PyBLE-DA86`, `PyBLE-3DCB`, `PyBLE-5646` and `PyBLE-C81A`.
+The [historical hardware record](../../../testing/tutorial-five-board-screenshot-provenance-2026-08-28.md)
+associates the absent `8C9E` label with classic ESP32, and `3DCB` with Pico 2 W.
+Names are contextual labels, not new identity or authorization evidence.
+
+Source inspection found no four-result limit: the adapter filters by PBLE
+service UUID, the accumulator retains distinct OS device IDs and the list
+renders the complete hit count. Both ESP/Pico agents resume advertising after
+disconnection. An active connection elsewhere or absent firmware advertising
+can explain a missing board, but neither cause has yet been established for
+`8C9E`. USB enumeration of its CP2102 adapter alone does not prove agent health.
+No board was reset, flashed or sent a command during this diagnosis.
+
 ## Remaining release evidence
 
-Complete iPad execution, the remaining Android interaction/interruption rows,
+Complete the iPad production interaction matrix, remaining Android interaction/interruption rows,
 explicit harmless physical board Save/Run/Files destination consent, applicable
 Blocks handoff checks and the selected release matrix. Preserve candidate
 provenance and report every unrun row. Participant follow-up and the unfinished