Protect and migrate existing ReviewMonitor local state during recovery cutover

[lynnswap]

Parent: #96
Related: #97, #102

Risk

Current-main and v0.6.2 use materially different account/runtime/history layouts. A recovery build must never use the existing ~/.codex_review home or codexReview.runtimePreferences value as a writable destination.

Recovery environment

Use versioned recovery-owned paths/preferences under ReviewMonitor Application Support:

• RecoveryV1/CodexHome
• RecoveryV1/review-history.sqlite
• codexReview.recoveryV1.runtimePreferences

Development probes also use an isolated preference suite and MCP port.

Import eligibility and identity

• Source fingerprint is SHA-256 of source installation ID, registry schema version, and canonical source-root identity; no credential bytes enter it.
• A review is eligible only when a non-subagent outer thread has stable thread/turn IDs, a canonical review marker, and typed entered/exited-review-mode evidence.
• Reviewer/compact/spawn/other child threads and thread-only records without canonical turn evidence are skipped with a manifest reason.
• Deterministic ReviewID is legacy-v1: plus SHA-256 of source fingerprint, outer thread ID, and review turn ID.
• Human result comes only from canonical outer exitedReviewMode.review.
• Exact duration uses authoritative start/completion/duration data; missing data imports as lower-bound/unavailable, never guessed.

Credentials/preferences

• ChatGPT auth bytes may be copied only into the recovery home with owner-only permissions, never decoded/logged, then validated by current app-server account read.
• Invalid ChatGPT auth requires normal sign-in.
• Raw API keys are not copied. Only non-secret API-key account metadata imports as requiring reauthentication through Reintroduce API key authentication on the v0.6.2 recovery architecture #97.
• Runtime home/database paths and probe ports are never copied from legacy preferences; only validated user choices are imported.

Transaction and rollback

• reviewImports records source fingerprint, importer/schema version, deterministic legacy key, source content hash, destination review ID, status, and skip/failure reason.
• Each review imports atomically with unique (sourceFingerprint, legacyKey, importerVersion).
• Identical committed import is a no-op.
• A failed transaction leaves no review rows and records a retryable manifest failure separately.
• The current source remains unchanged and its preflight hash manifest is the rollback point; deleting/recreating only the recovery destination is always safe.

Acceptance criteria

• Environment preparation completes before app-server/MCP admission and cannot fall through to legacy defaults.
• Import is idempotent, deterministic, content-heuristic-free, and secret-safe.
• Canonical outer reviews import once; reviewer JSON never becomes product history.
• Current-main source and original preferences remain byte-for-byte untouched.
• Both current-main and recovery builds can relaunch from their independent homes.
• Partial failure, retry, app termination, duplicate source, incompatible schema, missing metadata, invalid auth, and database rollback are tested.

[lynnswap]

Import admission now requires a quiescent source: stop current-main ReviewMonitor/app-server/all known writers, refuse an active source, snapshot the source root/account/auth/rollouts/preferences and every SQLite DB+WAL+SHM at one boundary, and require matching before/after manifests. Journal/debt recovery and SQLite validation run only on the staging copy. Same import key + different content hash is a typed no-write conflict; success is one atomic transaction and rollback failure metadata is recorded in a separate transaction. Recovery paths also include isolated LoginStaging and SavedAccounts directories.

[lynnswap]

The safe cutover contract is now pinned at local checkpoint fbe0595 and split into five sequential Wave 7 slices: 7A quiescent locator/lsof snapshot, 7B1 sanitized exact-ID plain/zstd source adapter, 7B2 atomic Wave4 history import, 7C numeric schema 0/1 auth + preference conversion, and 7D admission/rollback/live proof.

The source allowlist now names the current-main DB/WAL/SHM cohorts, rollout paths, provider-filtered auth inputs, and two UserDefaults values. API-key artifacts are excluded before open/read/copy/hash. IDs, semantic source hash, outer-review eligibility, duration precedence, failure rows, history-vs-runtime admission, same-parent rollback archive, and current-main zero-write proof are fixed in the canonical design and Docs/recovery-wave-7-task-brief-2026-08-20.md.

Implementation remains gated on reviewed Wave 6 plus the Wave4 duration/import seam, Wave5 RegistryV2 batch seam, and a targeted pinned-binary auth-free thread/read(includeTurns:true) proof for compressed/legacy/paginated fixtures.

[lynnswap]

Safe-cutover update: #113 is now a hard prerequisite for any RecoveryV1 path mutation or import destination. Cutover/import must consume descriptor capabilities, not canonicalized URL strings. Outcome-unknown or identity-mismatched staging remains preserved and fail-closed; only manifested, unreferenced, identity-matching owned leases may be cleaned.