yyods · Oct 31, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 25, 2026
@@ -6,8 +6,9 @@ are released independently from this monorepo.
 ## Unreleased
 
 These app, website, and repository-source changes do not designate a new app
-or firmware release. The qualified firmware release remains v0.6.0, built from
-its annotated tag rather than from the newer branch tip.
+or firmware release. Firmware v0.6.1 is published on the owner's confirmation;
+incomplete automated evidence remains pending. The qualified v0.6.0 release
+remains a separate historical baseline built from its annotated tag.
 
 The current compatible app feature set now targets `0.2.0`; build `5` was
 handed off through Transporter for TestFlight. This candidate identity improves
@@ -81,6 +82,21 @@ and submission packet do not claim Play submission, approval, or rollout.
   Vitest 4.1.12, with patched Sharp, Undici, source-map-js and supporting
   dependencies. Refreshed the reviewed license notices and dependency
   regression assertions while retaining the high/critical audit gate.
+- Added the reviewed Cycle 1 roadmap, milestones, Scrum working agreement,
+  stories and Sprint Backlogs, plus C1-S1 execution evidence and operational
+  pilot/validation procedures. Verified existing Play 0.2.0 (8) and TestFlight
+  0.2.0 (6) installations and launches on connected tablets; pilot setup and
+  participant evidence remain pending. No fresh enrollment, reinstall, pilot
+  results or new release are claimed.
+- Specified bounded Drift current-text recovery, local restore/discard,
+  failure handling and document/session guards in ADR-0048 and the App
+  contracts. Implementation remains pending; sizing requires revising the
+  original S2 forecast.
+- Verified live Android open-testing wording and prepared correction of the
+  older public TestFlight description. Installed identities are now recorded;
+  Android code/assets match the retained build-8 AAB, while iPad build-6 source
+  mapping and a minimum-OS metadata discrepancy need distribution-owner
+  follow-up. The TestFlight metadata change remains pending.
 - Prepared Google Play open-testing listing text, reviewer hardware setup,
   tester instructions, data-use assessment, and reproducible store artwork
   with authentic screenshot provenance. Store availability remains a separate

@@ -311,6 +311,8 @@ publish new firmware or replace the live site.
 - [App contract](docs/specifications/app.md)
 - [Hardware and compatibility](docs/specifications/hardware.md)
 - [Public roadmap](docs/ROADMAP.md)
+- [Cycle 1 delivery plan](docs/developments/2026-q4-reliable-workflow/01_Overview_and_Scrum_Framework.md)
+- [C1-S1 execution and remaining evidence](docs/developments/2026-q4-reliable-workflow/c1-s1/00_Execution_Record.md)
 - [Architecture decisions](docs/decisions/README.md)
 - [Validation evidence index](docs/validation/README.md)
 - [Security policy](SECURITY.md)

@@ -16,13 +16,23 @@ maintainer guidance beside the source they govern.
 ## Proposed release plans
 
 - [Firmware v0.6.1 and v0.7.0 roadmap](planning/firmware-v0.6.1-v0.7.0-roadmap.md)
-  — v0.6.1 hardening is approved for implementation; the Reliable Projects
-  v0.7.0 scope remains proposed
+  — v0.6.1 is published on owner confirmation; incomplete automated evidence
+  remains pending, and Reliable Projects v0.7.0 remains proposed
+- [Implementation strategy](planning/PyBLE_Implementation_Plan_and_Strategy_v1.0.md)
+  — current outcomes, evidence gates and conditional expansion
+- [Cycle 1 Scrum delivery package](developments/2026-q4-reliable-workflow/01_Overview_and_Scrum_Framework.md)
+  — roadmap, milestones, stories and capacity forecasts
+- [C1-S1 execution record](developments/2026-q4-reliable-workflow/c1-s1/00_Execution_Record.md)
+  — channel evidence, pilot kit, recovery contract/sizing and validation recipe;
+  existing Play/TestFlight installations verified; pilot setup and participant
+  evidence remain pending
 
 ## Detailed specifications
 
 - [`specifications/App/`](specifications/App/) — app requirements, test design,
   and the Signal visual system
+- [Bounded current-text recovery contract](specifications/App/current-draft-recovery.md)
+  — specified in C1-S1; implementation and acceptance evidence remain pending
 - [`specifications/firmware/`](specifications/firmware/) — firmware
   requirements, test design, browser flashing, release integrity, and HIL
   gates
@@ -64,7 +74,11 @@ bundled offline examples required by its own product contracts.
   plan](testing/testflight/0.2.0-build-5.md)
 - [PyBLE 0.1.0 (4) TestFlight description and test
   plan](testing/testflight/0.1.0-build-4.md)
-
-Internal sprint notes and automated-agent orchestration are intentionally kept
-outside the public source repository. Public work is planned through the
-roadmap and GitHub issues.
+- [Current channel and artifact ledger](developments/2026-q4-reliable-workflow/c1-s1/01_Channel_and_Artifact_Ledger.md)
+- [TestFlight metadata correction packet](developments/2026-q4-reliable-workflow/c1-s1/05_TestFlight_Metadata_Correction.md)
+  — prepared replacement for the stale public description; store update pending
+
+Reviewed delivery plans and redacted execution evidence live under
+`developments/`. Raw observations, contact/consent records, device identifiers,
+local worktree state and automated-agent orchestration remain outside Git.
+Planning IDs are not GitHub issue numbers; link actual issues when created.
@@ -31,12 +31,29 @@ v0.7.0 remains non-normative and requires separate maintainer approval.
 
 ## Near term
 
+- Complete the [C1-S1 remaining evidence](developments/2026-q4-reliable-workflow/c1-s1/00_Execution_Record.md):
+  confirmed pilot ownership/setup, actual capacity and five real baseline
+  observations. Existing Play 0.2.0 (8) and TestFlight 0.2.0 (6) installations
+  and launches are verified on connected tablets; fresh enrollment/reinstallation
+  was not exercised. The pilot kit, recovery design and validation inventory
+  are prepared; this does not complete the Sprint or board qualification.
+- Implement the [bounded current-text recovery contract](specifications/App/current-draft-recovery.md)
+  after replanning against its 45–72 hour working estimate for engineering,
+  recipe, representative platform checks and follow-up. Current drafts remain
+  volatile; full A-24 and Blocks persistence remain separate scope.
+- Correct the [stale public TestFlight description](developments/2026-q4-reliable-workflow/c1-s1/05_TestFlight_Metadata_Correction.md)
+  through the distribution owner; replacement copy is prepared, not published.
 - Continue the app 0.2.0 beta train; source is currently `0.2.0+8`. The
   [Android publication review](testing/website/android-open-testing-2026-09-25.md)
   records live open-testing availability. The
   [prepared build-8 handoff](testing/google-play/0.2.0-build-8.md) remains a
-  source-specific historical record, not validation of subsequent source
-  changes in the installed store app.
+  source-specific historical record. The [current Android installation check](developments/2026-q4-reliable-workflow/c1-s1/06_Android_Channel_Verification.md)
+  matches 38 retained code/asset entries to that AAB; this supports its historical
+  source mapping, not complete binary equivalence or validation of subsequent
+  source changes. The [iPad check](developments/2026-q4-reliable-workflow/c1-s1/07_iPad_Channel_Verification.md)
+  records TestFlight build 6 with source mapping unresolved; distribution-owner
+  review is needed for conflicting minimum-OS metadata before making a support
+  claim.
 - Review the proposed v0.7.0 Reliable Projects scope before implementation.
 - Expand user-facing setup, recovery, and board-specific wiring guidance
 - Gather Android open-testing feedback and improve installation and recovery

@@ -57,3 +57,15 @@ Unchanged: the `Connection` seam (D1), neutral types (D2), Riverpod as the one s
 - Extends [ADR-0007](0007-riverpod-state-management.md) (Riverpod / D3) and [ADR-0009](0009-runtime-connection-manager.md) (runtime session facade); honors [ADR-0008](0008-signal-design-system.md) (`SignalCodeColors` for the editor/console surfaces).
 - Ratifies App [TDD.md §11.6](../specifications/App/TDD.md#116-working-loop-provider-contract-frozen) and the scoping freeze notes in [TDD.md §11.1](../specifications/App/TDD.md#111-editor)/[§11.4](../specifications/App/TDD.md#114-console--error-explanation) and [specs.md §4.5](../specifications/App/specs.md)/§4.6/§4.7/§4.8.
 - Scopes App stories **A-20 / A-21 / A-16 / A-30** (working-loop subset); defers FR-EDIT-7, NFR-REL-3/FR-PROJ-6, and the rich-editor part of FR-EDIT-1 to **A-24** ([OI-1](../specifications/App/specs.md)).
+
+## 2026-09-25 follow-up — bounded current-text recovery specified
+
+The historical decision and its original context above remain unchanged.
+[ADR-0012](0012-flutter-code-editor-behind-editorsurface.md) already superseded
+the rich-editor deferral. [ADR-0048](0048-bounded-current-text-draft-recovery.md)
+now specifies the bounded current-text recovery successor, with its
+[write/failure/board-authority contract](../specifications/App/current-draft-recovery.md)
+and [C1-S1 review and sizing](../developments/2026-q4-reliable-workflow/c1-s1/03_Recovery_Design_and_Sizing.md).
+The inspected source is still volatile; implementation and acceptance evidence
+are pending. The remaining A-24 project, settings, console, import and Blocks
+obligations are carried, not satisfied by the successor design.
@@ -28,3 +28,13 @@ The Signal landscape shell renders a fixed three-pane IDE frame — **Files side
 - The change is confined to the shell + providers; the `Connection` seam (D1/D2), the import boundary (no UI package imports `lib/ble`, CON-8), Riverpod (ADR-0007), and every §1A.3 rejection are unchanged.
 
 Unchanged rejection list, seam, and layering as in [ADR-0009](0009-runtime-connection-manager.md)/[ADR-0010](0010-working-loop-in-memory-document.md).
+
+## Follow-up — 25 September 2026
+
+[ADR-0048](0048-bounded-current-text-draft-recovery.md) and the
+[bounded recovery contract](../specifications/App/current-draft-recovery.md)
+specify a narrow successor exception: a local recovery preview/Restore/Discard
+panel must be reachable without a board, permission prompt or network access.
+The normal IDE remains connection-gated; this is not a full offline IDE or an
+authorization to restore board-write authority. Implementation is pending, so
+the current shell behavior above remains the recorded runtime baseline.
@@ -0,0 +1,72 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Part of PyBLE (https://pyble.dev) — see /LICENSE. -->
+
+# ADR 0048 — Recover one current text draft through the planned Drift store
+
+**Status:** Specified for implementation (2026-09-25) under the user's request
+to execute C1-S1. Source implementation and physical acceptance remain pending; no named human
+sign-off is claimed and this is not release admission.
+
+## Context
+
+[ADR-0010](0010-working-loop-in-memory-document.md) recorded an intentionally
+volatile current document and deferred Drift persistence to A-24. That
+limitation remains in the inspected source. Its old rich-editor deferral has
+already been superseded by [ADR-0012](0012-flutter-code-editor-behind-editorsurface.md),
+so the persistence problem must be scoped against the current rich Editor,
+Blocks handoff and file-backed Run implementation.
+
+The current provider has a mutation epoch, but Save/Run/Files completion guards
+still compare document values. A stable Connection facade also makes object
+identity insufficient to bind a multi-step text action to one attached board.
+Recovery must not amplify either gap by restoring a historical target as
+current write authority.
+
+C1-S1 requests a bounded contract and an honest estimate, not the full A-24
+implementation. The [design review and sizing](../developments/2026-q4-reliable-workflow/c1-s1/03_Recovery_Design_and_Sizing.md)
+records this distinction and the proposed reforecast.
+
+## Decision
+
+Adopt [the bounded current-draft contract](../specifications/App/current-draft-recovery.md)
+for the next implementation slice:
+
+1. Use one current-text slot in the planned Drift `projects`/`project_files`
+   subset and single SettingsStore. Commit its content and recovery metadata
+   atomically. No scratch file or separate preferences backend.
+2. Distinguish local checkpoint state from board-dirty state. A saved-local
+   indication acknowledges a successful transaction for that exact revision.
+3. Offer explicit offline Restore/Discard with nondestructive failure handling.
+   A local recovery panel is a narrow extension of
+   [ADR-0011](0011-connection-gated-shell.md); it does not implement the complete
+   offline IDE.
+4. Restore text without board authority. Require a current-session destination
+   decision before a recovered document can be saved, uploaded or run on a
+   board; use document epochs and the existing neutral session stamp across
+   asynchronous boundaries.
+5. Include interrupted-write, corrupt/full storage, version handling, stale
+   completions and applicable platform evidence in the same usable increment.
+   Keep Blocks graph recovery and the rest of A-24 explicitly carried.
+
+This decision supersedes only ADR-0010's volatile-only current-text design for
+the future accepted slice. It does not retroactively claim that released builds
+persist drafts, change PBLE/1 or remove the existing provider/Connection seams.
+
+## Alternatives considered
+
+| Option | Decision |
+|---|---|
+| Ad-hoc text/JSON scratch file or separate preferences | Rejected: duplicates the accepted Drift direction and leaves another migration/storage boundary |
+| Complete all A-24 projects, histories, imports and Blocks state together | Deferred: exceeds the first bounded outcome and needs separate contracts |
+| Infer the old board from a recovered path or advertised name | Rejected: path and display identity do not authorize a new session |
+| Restore automatically over a fresh empty provider | Rejected: races hydration, user edits and pending replacement decisions |
+| Ship only successful restart recovery, add failure handling later | Rejected: cannot meet the recovery story's minimum safety acceptance |
+
+## Consequences
+
+The implementation needs the actual Drift/native database dependencies,
+versioned schemas, local recovery UI and stronger completion guards. None of
+these exist merely because this ADR is written. The estimate exceeds the
+original C1-S2 recovery allowance; future Sprint selection must be reforecast
+without weakening the failure cases. The narrower feature can eventually
+protect useful current text, while full project persistence remains unfinished.
@@ -51,5 +51,8 @@ Each ADR captures one significant decision: its context, the choice, and the con
 | [0045](0045-adopt-ios-15-deployment-floor.md) | Adopt iOS and iPadOS 15 as the maintained source and compiled distribution floor while preserving build 5 as historical evidence | Accepted |
 | [0046](0046-publish-release-bound-static-learning-center.md) | Publish a static `/learn` center whose app, firmware, examples, validation, privacy, and deployment claims remain release-bound | Accepted |
 | [0047](0047-standardize-official-workspaces-on-lfs2.md) | Standardize all five official firmware workspaces on explicit, fail-closed LFS2 mounting and provisioning | Accepted |
+| [0048](0048-bounded-current-text-draft-recovery.md) | Specify bounded Drift current-text recovery with explicit local durability, recovery choices and session-bound board authority; implementation pending | Specified |
 
 Decided 2026-06-30 (0001–0005); 0006 accepted 2026-07-01; 0007, 0008, 0009 and 0010 accepted 2026-07-02; 0011 accepted 2026-07-03; 0012 accepted 2026-07-25; 0013 accepted 2026-07-27; 0014, 0015, 0016, and 0017 accepted 2026-07-28; 0018–0022 accepted 2026-07-29; 0023 and 0024 accepted 2026-08-01; 0025 and 0026 accepted 2026-08-02; 0027–0029 accepted 2026-08-03; 0030 accepted 2026-08-11; 0031–0033 accepted 2026-08-12; 0034 accepted 2026-08-13; 0035 and 0036 accepted 2026-08-16; 0037 and 0038 accepted 2026-08-20; 0039 accepted 2026-08-21; 0040 accepted 2026-08-22; 0041 accepted 2026-08-25; 0042–0045 accepted 2026-08-27; 0046 accepted 2026-08-28; 0047 accepted 2026-09-03.
+
+0048 specified for implementation on 2026-09-25 during C1-S1; this status does not claim delivered persistence or release acceptance.