Document controlled generation archive rollout

CHANGELOG.md

@@ -13,6 +13,15 @@
   and the prepared-items tile can inspect every proposal rather than only its
   first compact summary.
 
+- Completed the controlled schema-v22/schema-v21 rollout without uninstalling
+  or clearing Android data. The production Android archive uses a supported
+  post-rename file durability barrier on emulated external storage, and the
+  desktop publishes each complete MTP generation before its correlated
+  reference. Two real post-migration bidirectional exchanges, separated by a
+  Trainlog-service restart, completed with durable ACKs and no session
+  duplication. The expected AI proposal retained its identity, six entries,
+  and `pending` state on Android and remained independently visible in Web.
+
 - Fixed a production full-generation timeout caused by recursively uploading
   retained staging and unrelated transport history on every MTP push. Each
   phase now publishes a private bounded outbox containing only its request,

docs/current_state.md

@@ -341,9 +341,11 @@ Android resource-parity, language-owner, typed sync-presentation, and
 stable-data presentation tests. A real-device/manual visual language-switch
 smoke remains a manual validation; it does not change the validated status.
 
-Hardware-dependent MTP and the final real Drive plus Android-triggered AI-draft
-smoke test are not automated. The latter is why
-`TRAINLOG_AI_SESSION_DRAFT_V1` remains `VALIDATION_PENDING`.
+Hardware-dependent MTP is not automated. The controlled real-device rollout
+validated two consecutive full-generation exchanges around a Trainlog-service
+restart. The expected AI proposal was verified in the persistent Android store
+and the read-only Web proposal projection with its original identity and
+content; no proposal-to-execution-draft conversion was performed.
 
 ## Active limitations
 
@@ -351,16 +353,18 @@ smoke test are not automated. The latter is why
 desktop producers/consumers for `trainlog-causal-deletions` V1. All contracted
 domains are durably protected; exact replay is idempotent and unprovable or
 concurrent ancestry conflicts before mutation. Protected legacy snapshots are
-refused before resurrection. Staged generation acknowledgement is implemented,
-but active synchronization still selects V3: no staged-service activation,
-deployment, or user-data migration occurred.
+refused before resurrection. The default automatic daemon path remains V3,
+while the trusted local Web opt-in now runs the deployed full-generation path.
+Its acknowledged generations can leave the active admission window only
+through the verified schema-v22/schema-v21 archive ledger; pending, rejected
+and ambiguous generations remain protected.
 
 The focused causal closeout additionally proves child-data delete/update
 conflicts including change-and-revert, imported built-in and alias protection,
 active/pending/desktop draft-revision equivalence, protected companion refusal,
 current-view retirement and bounded pre-effect admission. The later generation
 slice additively advances schemas to desktop v22/Android v21 without changing
-active V3 transport selection.
+default automatic V3 selection.
 
 The residual causal evidence also proves legitimate Android and desktop
 producer directions separately for exercise retirement, populated body
@@ -378,8 +382,6 @@ pre-existing GCC 16.2.1 Web warning gate remains documented rather than green.
   remain shell placeholders until their Core/API ownership and implementation
   order are explicitly contracted.
 - `APP_SHELL_V1` still awaits the recorded human visual/accessibility review.
-- AI proposal exchange still awaits one real Drive plus Android-triggered
-  bidirectional smoke test.
 - Session Generator V1 is hidden while V2 planning semantics are developed.
 - Hardware MTP validation requires a connected unlocked Android device.
 - Scientific knowledge is bounded to reviewed catalog entries; unknown custom

docs/sync_exchange.md

@@ -824,8 +824,10 @@ object double; the same compiled transport algorithm remains under test.
 
 Each worker push is additionally scoped by a private disposable outbox. The
 first push contains only the correlated request; the post-import push adds the
-desktop consumption ACK; the publication push adds the current desktop
-generation reference and exactly its referenced generation directory. The
+desktop consumption ACK. Publication uses two causally ordered bounded pushes:
+the immutable current desktop generation directory is committed first, with
+its manifest last, and only then is its run-correlated reference made visible.
+Android therefore cannot consume a reference to an in-progress MTP directory. The
 durable transport root remains the owner of retained generations, staging,
 legacy compatibility artifacts, and evidence, but those unrelated objects are
 not recursively sent on every phase. Constructing an outbox does not delete or

docs/tests.md

@@ -1340,6 +1340,21 @@ Focused archive tests cover interrupted-copy resume, invalid archives,
 simulated insufficient space, missing and late ACKs, and idempotent ACK replay
 after archival.
 
+The controlled Samsung SM-G990B rollout migrated the authentic Android backup
+from schema v20 to v21 and an authentic desktop copy from v21 to v22 before
+installation. The installed release retained its existing certificate and
+advanced from versionCode 6 through 7 to 8 without uninstalling or clearing
+data. Real MTP validation preserved the failed-run evidence that exposed an
+Android external-storage directory-fsync incompatibility and an early desktop
+generation reference. After their bounded repairs, run
+`sy_06200dd7-0d51-4f33-b80d-9976822ba87d` completed, the two Trainlog services
+were restarted, and run `sy_783014b0-f3f0-4f1e-8f4f-723acfc02dbc` completed.
+Both exchanged distinct generations and durable ACKs with zero session
+reconciliation. The final Android backup passed integrity and foreign-key
+checks at schema v21 with 13 generations, five verified archives, 13 ACKs,
+five consumed generations, and six active generations. The expected AI
+proposal remained `pending` with its original identity and six entries.
+
 ## Readability validation
 
 The normalized C scope is checked non-mutatively with the explicit

tui/meson.build

@@ -786,6 +786,11 @@ test(
   find_program('python3'),
   args: [meson.project_source_root() / 'tests/test_sync_deployment_tools.py'],
 )
+test(
+  'sync_error_classification',
+  find_program('python3'),
+  args: [meson.project_source_root() / 'tests/test_sync_error_classification.py'],
+)
 test(
   'schema_v21_migration',
   executable('test_schema_v21_migration', 'tests/test_schema_v21_migration.c', dependencies: trainlog_core_dep),