[yuxino]

Changes

• Restore bounded recovery when an established xAI streaming recognition connection fails. Share the provider error policy with desktop so Gemini/xAI authentication, missing credentials and unsupported languages stop with the actionable error instead of being retried.
• Refresh the display confirmation time when a new session accepts identical final text. Also fix duplicate admission in the shared reducer's zero-history contract; current production controllers retain 20 rows, so this is a component-boundary fix rather than a claim of duplicated saved sessions in the app.
• Allow a complete valid custom ASR credential replacement to repair a malformed saved slot, while preserving partial-edit validation, the independent text slot, durable read-back and rollback.

Each defect has a failing regression followed by the same passing case. Provider protocols, retry budgets and credential-store fallback are unchanged.

Validation

• Full ./scripts/check.sh: core 108 tests plus 4 contracts, runtime 942 tests, JNI Rust 30 tests, desktop 671 tests and frontend 2,803 tests passed; existing ignored tests remain.
• Android testDebugUnitTest testReleaseUnitTest lintDebug lintRelease: 299 JVM tests in each variant, no failures or skips, with the actual host JNI library.
• Actual JNI local TLS/WebSocket scenarios: xAI reconnects after an established transport closes; authentication rejection ends after one connection with a sanitized code.
• Independent review of recovery and subtitle changes; synthetic credential repair, restart, malformed-document rejection and rollback checks.

The running production app was preserved. No real credentials, capture, live-provider session, physical-device acceptance, release or deployment was performed. Detailed evidence and limits are in docs/development/integration-runs.md.