[a3384379]

PiP playback controls could remain blocked after an accepted toggle was rejected or never confirmed, while a queued Live Activity publication could still run after end(). This closes the latest audit's N1/N2 paths and keeps the existing final-target coordination and render recovery behavior.

• Associate accepted commands with their actual sequence, track/generation, connection epoch, negotiated server session, and monotonic send time. A matching protocol/unknown_command rejection releases the command only for an explicit retry after fresh state. Arbitrary errors, ATT results, unchanged reports, and timeouts keep the non-idempotent toggle protection.
• After eight seconds without confirmation, cancel stale unsent intent, query existing playback state once, and show an unknown-result message in PiP and the app with the existing reconnect action. Stop/reopen keeps unresolved protection; reconnect requires fresh state and a new user request. Command entrypoint refusals also remain distinguishable from accepted sends.
• Cancel and check publication tasks before publishers or ActivityKit side effects, check target ID/state again after awaits, fence observers by epoch/activity ID, and exclude ending or ended activities from restoration. Already scheduled cleanup survives publication-session end, still protects a newly selected activity, and keeps ending IDs excluded until each single cleanup completes.

Validation: both added production-entrypoint reproductions failed on the unmodified implementation. Final local simulator XCTest passed 120/120 on its first complete run (16 new regressions); unsigned generic iOS App/Widget build succeeded with no Swift source warnings. Three of those regressions exercise the production cleanup queue's asynchronous completion, current-ID protection, and exclusion/deduplication, addressing the PR review finding. The real renderer's unknown-message pixels were asserted and its exported attachment visually checked. String Catalog JSON and git diff --check passed. Existing R1–R5 regressions remain; the R3 legacy recovery test now also requires a new explicit request after its old 46-second intent expires.

Quick smoke was run and remains FAIL, Required 2/6: the two PASS entries skip build/install in quick mode, and the unavailable iPhone prevents launch/log/preferences/container verification. Cross-app PiP, Sony BLE, background/lockscreen, Dynamic Island, audio interruptions, and soak acceptance remain unperformed. Full smoke and a local Android build are not required for this scope. The historical snapshot-storage load == nil CI flake was not fixed here; new CI first attempts and any workflow retry must be reported separately.

Baseline: b57ba7f0893a8fa0cc7353f1ab639b4e39726745. All 10 changed files belong to N1/N2, tests, feedback translations, and the implementation record. BLE wire formats and Sony/Android implementation are unchanged; both lyric settings stay independent and default off, with no new default-off timers, polling, rendering, or audio activation. The primary checkout was clean before this task; previously delivered PR #12 changes and their backup stash were preserved.

Final source head: 79f9bfc329b16a91bfd98c2540f7aac401e5aa20. The final cleanup repair was followed by a first-pass local 120/120 run, generic App/Widget build, and quick smoke with the same unavailable-device failure.

Exact-head CI: push run 37394691039 passed iOS 120/120 on attempt 1, deployment 9/9, and both Android test/APK builds. PR run 37394694965 passed deployment 9/9 and Android; its iOS first attempt failed the unchanged PerformanceStabilityTests.testLastNowPlayingSnapshotStoreSaveLoadAndClear assertion at line 782 (load == nil). The existing workflow's single automatic retry passed 120/120. All 53 lyric tests passed both PR attempts. This records the historical storage flake; it does not claim to repair it or to achieve first-attempt success for the PR run. Superseded development runs are not counted as final-head evidence.

See docs/LYRICS_DISPLAY_IMPLEMENTATION.md for exact local artifacts, protocol limitations, index verification, and device boundaries. The user has already authorized commit and merge while retaining the documented device-acceptance gap.

Merged master validation: PR #13 merged at 2026-10-06T00:50:10Z as f360082c35c5b1100fa974e09196f0adc3f8a241. The independent master push run 37396063604 completed successfully on this exact merge commit: iOS 120/120 on attempt 1, deployment entrypoints 9/9, and both Android unit-test/debug-APK builds. The master iOS log contains one successful test banner, no failed-test banner, no automatic-retry warning, and only derived-data attempt 1. The primary checkout is clean and matches remote master; source-head and merged-master file trees are identical. Physical-device acceptance remains unperformed because the iPhone is unavailable.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T00:27:14.276277Z	07d4111	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07d41115cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".