[antuz123]

R4 evidence reconciliation, 22 October: 1d8a86a7462d935cbd0e28b857934b5718c152fc is the submitted source baseline for iOS620/Android627. Public release remains held under the current instruction; the latest posted console receipt is 21 October, and a fresh authenticated store readback is unavailable here. The owner-reported installed iPhone2.6.4 is retained in #7066; it does not by itself establish global store state or R4 closure. Existing R5 implementation, branches, checks and deferred cases continue unchanged.

An upgraded account can retain automatic-backup consent without a protected namespace, while Keeper's local Version History can remain stale after a store update. This separate follow-up adds guarded backup retry/readable results and the owner-requested Version History correction.

Refs #7066 — keep it open. State: NEEDS_LOCAL. The owner calls this the 5.1 patch; that is a scope label, not an assigned app release version. The original phone's exact failure causes and corrected behavior remain unconfirmed.

Baseline and patch-only review

• Exact completed R5 implementation source: 77b72da29ac5f2cdf3f51c9a0e9f3fd1c2af7238 from R5: safe key deletion and startup fixes on submitted 2.6.4 source (draft) #7058. It remains an open draft/NEEDS_LOCAL checkpoint; public 2.6.5 release is not established.
• Contains submitted R4 source 1d8a86a7462d935cbd0e28b857934b5718c152fc. Package/native inputs remain 2.6.4 / Android627 / iOS620.
• Patch-only comparison. Base is sprint per AGENTS.md; ordinary PR diff includes inherited R4/R5 history.
• Separate worktree/branch in the selected Bitcoin Keeper Cloud environment. Repository objects and current GitHub access verified; R5/sprint refs remain unchanged. No duplicate implementation found.
• Initial 5k–10k estimate became 12.1k for backup; owner-added history correction brings the rough changed-characters/4 estimate to 16.8k code/test tokens. No legacy purge, broad redesign, parked investigation, dependency/protocol or release-version change.

Changes and demonstrated defects

• Enabled never-enrolled backup had only read-only Check Again. Back Up Now now uses the existing explicit repair with consent, account/session, conflict-preservation, acknowledged upload and complete authenticated readback guards. Check Again stays read-only; disabled/conflict/known-deleted states cannot silently repair/recreate.
• Authenticated never-enrolled Delete remains non-success and explains absence. It never enrolls just to delete, claims legacy erasure, or conflates turning automatic backup off with protected-copy deletion.
• Wrapping/stacked backup actions, full explanations, status spacing and persistent scrollable More feedback replace the affected clipped controls/long bottom toast. Scoped English/Spanish copy.
• User-requested diagnostics show fixed operation/stage/category, bounded HTTP error status/elapsed time and native version/build only. They are in memory, session-bound, cleared on account change/new operation, and retain the safe upload failure through uncertain readback. No raw errors, bodies, headers, identifiers or recovery material.
• Owner-added Version History: login used shared Redux version for account upgrades, assumed a last history row, and compared only its build number. It now uses the selected account version, checks the full native version/build tuple, and handles empty/stale history. Missing current history is recorded as Current installation observed only after successful migration or a known-current account. Existing recovery/initial rows and dates survive both observation and actual migration; failed migrations cannot append success history. Legacy missing-version fallback alone cannot establish a current account.
• Version History separately labels Installed app version from native DeviceInfo. Historical rows stay historical; the store listing never supplies a fabricated installed version.
• Before controls: backup UI 2 assertion failures; history 4 actual-login + 1 actual-migration preservation failures; installed-version UI 2 failures. Corresponding final tests pass. These establish source defect classes, not this phone's precise cause.
• Evidence, commands and native matrix.

Owner device evidence

The owner confirms the iPhone is running 2.6.4 after the App Store update, while Keeper's in-app Version History still shows 2.6.3. Accept that installed version as owner-confirmed evidence; no further phone version check is requested. The stale history correction is included in this 5.1 follow-up.

The original backup request-stage cause and confirmation of corrected backup behavior remain separate acceptance questions. No reset, reinstall, restore-over, backup deletion, private recovery export or raw-log collection is requested on the working phone.

Actual Cloud checks

Node22.23.3 / Yarn1.22.22; frozen dependencies and six patches. Final package/lock/Pod/native inputs unchanged; version consistency PASS.

Check	Actual result
Full Jest	49 suites / 553 PASS, zero skips/failures
Full recovery	Hosted Cloud PASS: 502 tests, including 10 real encrypted-Realm cases. Earlier Bitcoin Keeper worker run492pass/1missing-binding file-load failure was environment-specific
Targeted history	27 Node PASS (13 new); Version History Jest 9 PASS; installed-header UI 2 PASS
Backup regressions	Targeted diagnostics/transport/repair 70 PASS; backup UI 12 PASS
Whole ESLint	FAIL: 4450 errors / 882 warnings, same as pre-history patch; original R5 baseline4451/882. Zero added findings
Whole TypeScript	FAIL: 943 diagnostics, same baseline; zero added findings
New history UI/test lint + formatting	PASS; changed existing modules retain documented baseline findings
Version, whitespace, new test syntax, dependency/native-input preservation	PASS
Genuine current-backend upgraded-account proof	BLOCKED / NOT RUN: real Realm binding download denied by proxy CONNECT403 to static.realm.io; no cache/official GitHub release asset
iOS/Android native app, physical devices	NOT RUN

Retained evidence from first patch 3c5f8d8ace5c211ed78264b1a460c4e06e060ceb, not rerun after history addition: actual current-Relay disposable Mongo protocol/legacy 45 PASS, readiness 7 PASS; gate/protected-runner contracts 14 PASS; Android tooling 31 PASS; release Node28/Python7 PASS. Ruby-dependent guards FAIL30pass/11missing-Ruby failures; combined release stops at missing Ruby (exit127). Those prerequisites remain unavailable. Backend-only passes do not establish the upgraded app/phone.

Current Relay production receipt selects 29597b27eeeb299205bf7d0555db0a90c38cc4be with 14 hosted checks on 21 October, using a fresh namespace. No production account/backend operation occurred in this task. The supplemental opt-in witness pins current Relay without changing historical proof pins.

Hosted checks for this exact head:

• CI: Tests job PASS with553Jest/502recovery, real Realm binding and Ruby/release checks (Node28/Python7/Ruby21runs117assertions). Lint job reports success under inherited continue-on-error; it does not clear documented lint findings. Separate legacy genuine matrix FAIL:2pass/293fail: its fixture supplies invalid mnemonic/seed for current protected authority and pins old public Relay. Do not weaken authority or transfer that result to the new current-v3 witness.
• CodeQL analysis execution PASS, but the separate security check FAILS on the same incomplete multi-character sanitization alert at src/services/wallets/operations/index.ts:110–111, previously reported as high severity. The module is byte-identical to R5 and this patch. Security review remains required; no dismissal, waiver or exploitability conclusion.
• Public backend setup: both SigningServer adapter and local backend/bootstrap PASS.
• keeper/local-validation is FAIL/NEEDS_LOCAL, awaiting exact-head native evidence.

The automatic Android diagnostic signing run is CANCELLED: APK/AAB build/sign SKIPPED, artifacts 0. No other workstream/workflow was changed. No merge, signing, distribution, deployment or publication occurred.

Cloud versus native acceptance — clarification

The NEEDS_LOCAL label comes from AGENTS.md and the current repository gate. It records missing IOS/ANDROID/HARDWARE acceptance; it is not a claim that the code fix, ordinary tests, Realm or Ruby require a personal Mac.

The exact-head hosted Tests job has now passed 553 Jest + 502 recovery, including real encrypted Realm, and the Ruby/release checks. Those results supersede the earlier worker-specific prerequisite gaps above. The separate legacy fixture matrix still fails; the current private-backend v3 upgrade witness remains unrun and belongs in Cloud.

iOS native acceptance needs a macOS/Xcode runtime, which can be hosted. Android app/emulator acceptance can run on Linux Cloud. An existing historical hosted-native workflow demonstrated both platforms, but it is absent from this patch/default branch, is PR-only, and tested a different SHA with fresh-startup smoke only; no result transfers. Its iOS simulator build disables signing; its Android path uses public debug-key signing, so the owner's no-signing boundary must be preserved before running that path. No signing, distribution, infrastructure integration or workflow dispatch was performed for this clarification.

The current backend is private and the app repo is public. A current-v3 Cloud lane must use authorized private checkout access without copying private source into this public repository or weakening protocol checks. Only the final non-destructive confirmation on the owner's existing iPhone inherently needs that phone.

Codex local handoff

State: NEEDS_LOCAL
PR: #7067
Base: sprint
Head branch: codex/7066-protected-backup-correction
Head commit: c1c4b80
Goal and acceptance criteria: complete disposable existing-account protected-backup/recovery/deletion acceptance and the owner-added stale Version History correction, then obtain non-destructive confirmation on the original phone. Keep #7066 open.
Changes made: guarded backup retry, truthful absence guidance, bounded session diagnostics, local backup UI corrections; account-specific upgrade/history reconciliation, preservation of recovery history and separate native installed-version label. No release version assigned.
Cloud checks: exact-head hosted Tests PASS553Jest/502recovery with genuine Realm and Ruby/release checks; history Node27/Jest9/UI2 PASS; backup targeted70/UI12 PASS; lint4450/882 and TypeScript943 inherited FAIL, zero added; version/input/diff PASS. Genuine upgrade proof BLOCKED; native checks NOT RUN. Prior backend45+7/tooling/contracts/release results retain their recorded prior-source scope. Hosted public-backend PASS; legacy genuine matrix FAIL2pass/293fail; exact-head CodeQL security FAIL on the inherited finding, review required.
Required local checks: IOS, ANDROID, HARDWARE
Local checks requested: remaining native app acceptance only, on this exact SHA. Prefer hosted macOS/Xcode and disposable Android cloud emulators where available; the state label does not require the owner's personal Mac. Ordinary Realm/Ruby checks are already complete in hosted Cloud; the pinned-current-v3 upgrade witness remains Cloud integration work, not a Mac prerequisite. Native execution must preserve the no-signing/distribution boundary. On disposable accounts execute docs/7066-protected-backup-correction.md: saved consent/legacy copies, never-enrolled and interrupted enrollment, read-only recheck, explicit repair/full authenticated readback, cold launch, metadata update, complete recovery into another disposable installation, disable retention, protected-only Delete/fresh tombstone/recreation, uncertainty and A→B→A binding. For history, upgrade an older account after another account advanced the shared version; test empty/stale/same-build and build-only history, failed migration, preserved Recovered Wallet row/date and repeated launches without duplicates. Check installed native version/build independently of historical rows. Validate small width/larger text and affected backup/history UI on both platforms. HARDWARE includes the original iPhone only after an approved corrected build: normal navigation/reopen/unlock and Back Up Now/Check Again and reopen/recheck; never reset/uninstall/restore over/delete backups/export private data on that phone.
Risks / known gaps: Owner confirms installed iPhone2.6.4 with stale Version History2.6.3; no further version check is requested. The original backup request cause and corrected behavior remain unconfirmed. Real upgraded-account integration, IOS/ANDROID/HARDWARE remain unrun; The Bitcoin Keeper worker's Realm/Ruby restrictions were environment-specific; hosted Cloud has passed those checks. Existing lint/type findings and the inherited high CodeQL alert remain for review. Implementation verification, native acceptance and original-phone confirmation are separate. No release/sign/distribution/deploy approval.