tracking(reliability): close proven lifecycle and persistence gaps before 3.0

[psimaker]

Classification

P1 tracking issue; 3.0 gate. This is not an implementation issue.

Each checked item below requires a small child issue with its own current reproduction or complete causal proof, regression test, scoped plan, and verification. Audit statements are leads until revalidated on the implementation HEAD.

Proven audit checklist

• Foreground/background ownership and claim reacquisition.
  Evidence: SyncthingManager.swift:703-732,748-779; VaultSyncApp.swift:117-136; BackgroundSyncService.swift:155-161,193-203,845-899,957-961; EngineAttach.swift:58-59.
• Non-atomic check-then-stop windows.
  Evidence: BackgroundSyncService.swift:845-899,957-961.
• Single-flight follower reports .alreadyIdle independently of leader outcome.
  Evidence: BackgroundSyncService.swift:442-447,562-579.
• Sticky Go engine-liveness flag after internal supervisor exit.
  Evidence: go/bridge/bridge.go:46-187,200-232.
• Start/stop waits and global lock without deadline.
  Evidence: go/bridge/bridge.go:46-187,200-225.
• MainActor bridge/file I/O and rescan paths.
  Evidence: SyncthingManager.swift:89-91,1853-1893,2359-2394; ConflictDiffView.swift:249-271; SyncBridgeService.swift:231-235.
• PendingFolders error silently permits a local-only accepted folder.
  Evidence: go/bridge/pendingfolders.go:143-157.
• .stignore read error is represented as an empty list.
  Evidence: go/bridge/folderstatus.go:159-191.
• Unbounded conflict-file reads and line-diff preparation.
  Evidence: go/bridge/conflicts.go:158-180,218-221; ConflictDiffView.swift:8-9,28-54,292-320; LineDiffView.swift:57,67-108.
• Filesystem confinement, symlink handling, and path/config TOCTOU.
  Evidence: go/bridge/conflicts.go:106-115; go/bridge/pendingfolders.go:131-194; go/bridge/folders.go:143-200.
• Configuration durability between Modify/Wait and physical save.
  Evidence: go/_syncthing_patched/lib/config/wrapper.go:32,221-301,504.
• Physical-device and minimum/current iOS evidence matrix.
  Evidence: ios/project.yml:5-8,44-52,155-167; .github/workflows/ci.yml:302-310; docs/engineering-readiness-2.0.md:108-112.
• Required Swift Build & Test and Strings Key Parity merge gates.
  Audit API evidence: these contexts were not required on main at commit 9931f7a.

User and safety impact

These gaps can allow false results, lifecycle interruption, hangs, lost persistence, unsafe path assumptions, or release evidence that does not cover supported devices. For several entries the code gap is PROVEN while real-device/product impact remains INFERENCE or UNVERIFIED and must stay labeled accordingly.

Acceptance criteria

• Every checklist item is revalidated against its implementation HEAD.
• Each implementation has a child issue, focused RED regression or exact causal proof, isolated diff, mandatory suite, and independent review.
• Ownership/liveness work defines explicit success and lease invariants.
• Filesystem work fails closed without implicit migration or deletion.
• Hardware/simulator and CI-policy evidence is versioned.
• All 3.0 blockers are closed or explicitly waived with bounded evidence.

Regression-test policy

No aggregate "tracking issue test." Each child supplies the smallest deterministic reproduction, preserves RED/GREEN output, and distinguishes product defects from simulator, fixture, race-detector, upstream, and host failures.

Out of scope

Implementing any checklist item here, broad lifecycle/Bridge rewrite without child scope, 2.0.2 drive-by fixes, Hub/Coordinator/Pairing/Desktop work, signing, StoreKit, tags, releases, or version bumps.

Verification

Periodic read-only status review; child-issue links; required command/output records; physical-device claims only from real hardware; final independent 3.0 readiness review.

Dependencies

• Child issues are created only immediately before their separately approved implementation.
• Related dedicated issues: 2.0.2 safety train, conflict-retention policy, and STUN-race investigation.
• Blocks 3.0 reliability readiness.