Hourleaf product roadmap — trust, speed, Shortcuts, and release

[kiku-jw]

Implement the accepted full Hourleaf product roadmap while preserving the existing local ledger and the minimal, immediately understandable iPhone experience.

Status: Awaiting Owner
Next actor: Nick
Next action: Sign the Apple Account into Xcode locally and complete any password or 2FA prompt. Then tell Codex "готово" to retry the verified Hourleaf 1.0.2 (13) upload, processing readback, attachment, and submission.

Outcome

Hourleaf becomes a durable private ministry-hours product: entries are recoverable and portable, common actions are one tap or a system Shortcut away, every total is explainable, planning remains calm, and optional platform features do not compromise offline-first use.

Product constraints

• Native SwiftUI and Apple frameworks; no third-party SDKs, ads, tracking, or product analytics.
• Local-first and fully usable without network, iCloud, an account, or a paid Apple Developer membership.
• Preserve all existing user records and Personal Team testing data through an explicit portable-backup migration path.
• Minimal UI: reveal complexity only where it is needed; explain each control in ordinary RU/UK/EN language with a concrete consequence or example.
• Credit never contributes to the 600-hour service-year goal; totals may exceed 600; no time carries across August to September.
• Backup v1 has no password. Warn plainly when notes are included.
• No external account, direct recipient delivery, CRM, contacts, territories, maps, GPS, streaks, badges, social features, or AI coaching.

Specification decisions

• Preserve the four-tab app and fast-entry default; advanced planning, report history, data tools and Shortcuts help remain progressively disclosed.
• Use one actor-isolated asynchronous Core Data repository and one validated command path for SwiftUI, App Intents, widgets, Watch and timer.
• Every entry mutation appends an immutable revision and returns a persisted Undo-capable mutation receipt.
• Until Portable Forever is verified, retain and show every soft-deleted entry. Only then may Hourleaf introduce a tested 30-day purge policy.
• Backup v1 is one canonical JSON .hourleafbackup, SHA-256 checked, plain and password-free; notes receive an explicit warning.
• Restore v1 validates in a temporary store, previews, makes a verified pre-restore backup and performs whole-database replacement only.
• Implement iOS 17 App Intents/App Shortcuts immediately after the shared command layer. Control Center controls are iOS 18+ and gated separately.
• App Intent writes/reads require authentication, work offline and never depend on a live SwiftUI environment.
• App Group/data widgets, CloudKit, Watch, TestFlight and App Store retain signed-device/account owner gates.
• Existing com.kikuai.hourleaf.local records migrate to the final bundle through .hourleafbackup.

Executable slices

• 1. V2 model, actor repository, migration fixtures
• 2. Shared commands, revisions, soft delete, Recently Deleted, Undo
• 3. iOS 17 App Intents, App Shortcuts, typed routes, Action Button smoke — code merged at 8d1f70b; signed-device gate pending
• 4. Canonical backup v1 codec/checksum/export — merged at 10c51b2
• 5. Backup/CSV UI, previewed restore, rollback
• 6. One-Tap exploration completed — Repeat Last Entry was removed after field feedback; fast entry remains available through blank Quick Entry, Shortcuts, widget, and timer
• 7. Explainable report states, review, immutable corrections/templates
• 8. Calm pace, calendar and versioned service-year archive
• 9. Reminder actions and opt-in Quiet Gap Check
• 10. Privacy-safe widget and iOS 18 controls — M4 code merged at cbb24d6; signed App Group/widget/control acceptance remains owner-gated
• 11. Opt-in crash-safe timer; Live Activity later
• 12. Opt-in private iCloud — NO-GO until paid CloudKit access and an accepted V3 branch/conflict-preservation model; local-first store plus portable backup remain authoritative
• 13. Native Apple Watch companion — direct service/credit entry, Watch Connectivity, localized Watch UI, icons, privacy manifest, and embedded packaging are implemented; one physical direct entry was accepted, while Siri/Shortcuts remains a TestFlight acceptance gate.
• 14. CSV then fixture-backed competitor imports — strict Hourleaf CSV complete; named adapters remain fixture-gated
• 15. Local-bundle migration, accessibility/privacy/device QA and owner-gated public release — ungated foundation accepted at cdb303a; signed-device/public-release gates remain

Cross-slice acceptance

• Existing stores migrate without data loss; destructive actions are reversible.
• A backup round-trips every supported entity and a failed/corrupt restore cannot replace the live store.
• Common service/credit additions work through both the app and App Intents via one validated command contract, offline, with undo.
• Shortcuts are discoverable, parameterized, localized, and do not expose private notes/totals by default.
• A non-technical older user can understand quick entry, settings, report state, backup/restore, and planning without documentation.
• Unit, migration, integration, UI, localization, accessibility, offline/restart, and signed-device smoke evidence is recorded per slice.
• Coherent verified slices are committed and pushed; this Issue remains the sole execution ledger for the roadmap.

Verified delivery

Slice 1 landed on main at 12706b0. Fresh evidence: 32 unit/integration tests; 13 full UI tests plus 3 final report-boundary UI checks; unsigned generic-device Debug and Release builds; exact byte preservation of the V1 model; Sol Max adversarial review GO with no P0/P1/P2 findings. Physical iPhone remains untouched.

Slice 2 landed on main at c0fcb99. Fresh evidence: 58 unit/integration and 16 UI tests; unsigned generic-device Debug and Release builds; strict invalid-date/duration/revision handling; idempotent exact replay; optimistic revision conflicts; soft delete/restore; all four Undo inverses and the exact ten-minute boundary; report calculation/presentation fingerprints; RU/UK/EN validation; unchanged Core Data model/project/entitlements; Sol Max re-review GO with P0 0 and P1 0. Physical iPhone remains untouched.

Slice 3 code landed on main at 8d1f70b. Fresh evidence: 70 unit/integration and 19 UI tests (89/89 total); unsigned Debug and Release builds; Xcode Analyze; exactly three RU/UK/EN promoted commands; one shared repository actor; coalesced active/foreground/startup refresh; typed reminder routing; cold and warm blank-form reset; Sol Max adversarial GO with P0 0 and P1 0. A disposable signed smoke attempt stopped before installation because Xcode has no signed-in Personal Team account, so the physical device and its ledger remained unchanged. The slice stays open only for Shortcuts, Action Button, and reminder lifecycle smoke after the owner signs in to Xcode.

Slice 4 landed on main at 10c51b2. Fresh evidence: exact raw preservation of all 10 V2 entities and 115 attributes; canonical password-free JSON with SHA-256 and bounded validation; atomic no-overwrite protected export; 26 focused backup tests; 115/115 combined tests after Shortcuts integration; unsigned Debug and Release builds; Xcode Analyze; unchanged models/project/entitlements/privacy/dependencies; Sol Max publish GO with P0 0, P1 0, and P2 0. Signed file-protection and File Provider behavior move to the Slice 5 disposable canary. The physical iPhone ledger remains untouched.

Slice 11 is accepted on the feature branch at 962aec5: host-only, default-off crash-safe timer; review-before-save; no note capture; no extension ledger writer. Unit, UI, Release and Analyze gates passed. App Group/control/widget and physical-device canaries remain owner-gated.

Slice 14 is accepted on the feature branch at bc784c0: strict bounded Hourleaf CSV import, deterministic identities, one-save atomic application, conservative duplicate handling, ten-minute batch Undo, aggregate-only preview and human EN/RU/UK UI. Fresh final evidence: 417/417 unit/integration, 43/43 UI, post-cleanup coordinator 4/4, Release build, Xcode Analyze, protected-hash/localization gates and one bounded adversarial review with P0/P1/P2 = 0. A real external-file import journey remains signed-device acceptance; named competitor adapters require an owner-supplied sanitized export fixture.

Live revision-graph validation landed on main at 1dfadb5: backup and live snapshots now share one fail-closed immutable-history validator. App Group, CloudKit and Watch writers remain capability- and signed-device-gated.

Owner-controlled gates

Apple account credentials, 2FA, paid membership, App ID/iCloud container changes, CloudKit production schema, TestFlight/App Store publication, and irreversible provider actions require explicit owner participation when reached.

[kiku-jw]

Roadmap preflight on 2026-08-02:

• Verified owner/root: /Users/nick/Documents/HoursJW -> https://github.com/KikuAI-Lab/Hourleaf.git.
• main is clean and synchronized at 4b76a0e.
• Fresh full simulator baseline passed: 15 unit/integration + 13 UI tests, 28/28 total, on iPhone 17 Pro / iOS 26.5.
• Current build has no AppIntents.framework dependency or App Shortcuts metadata yet.
• Native prior-art check supports using Core Data persistent-store replacement plus AppShortcutsProvider without third-party backup/shortcut dependencies.
• Sol Max specification lane is active; code execution has not started.

[kiku-jw]

Slice 1 accepted and published to main at 12706b0.

Evidence:

• 32/32 unit and integration tests passed after integration into main.
• 13/13 full UI tests passed; 3 report-boundary UI checks were rerun on the final code.
• Unsigned generic-device Debug and Release builds passed.
• The V1 Core Data model is byte-for-byte unchanged; V2 is additive and current.
• Migration normalization is strict, idempotent and count/readback verified; malformed required data fails visibly instead of being dropped.
• Store-load failure, stale report inputs, concurrent settings saves and immutable report receipts have regression coverage.
• Sol Max adversarial review verdict: GO; no P0/P1/P2 findings.

The physical iPhone was not installed or mutated. Portable backup plus verified restore remains the gate before any model-changing device install.

Next active slice: shared mutation commands, replay safety, optimistic revisions, soft delete, Recently Deleted, and ten-minute Undo.

[kiku-jw]

Slice 5 execution contract — restore and Data Management

Accepted base: 10c51b2.

• Scope is local-only single-store restore. Cloud-backed or multi-store configurations are rejected before staging; Hourleaf never turns iCloud off automatically.
• A selected .hourleafbackup is copied into bounded app-owned protected staging, decoded by the frozen v1 codec, imported into a fresh current-model temporary SQLite store, closed/reopened, and accepted only when raw and domain readbacks preserve the incoming digest.
• Preview is read-only and shows understandable counts/date range before confirmation. Confirm replaces the whole ledger; there is no merge, password, or typed phrase.
• Every app and App Intent writer is stopped by one repository maintenance lease. Before replacement, Hourleaf creates and rereads an exact portable backup of state A plus coordinator-created old-store evidence.
• Store transitions use Core Data coordinator copy/replace/destroy APIs only. SQLite, WAL, and SHM files are never copied or deleted manually.
• A protected journal and armed marker guarantee restart resolves to exact A or exact B, never a mixture. Corrupt or unknown recovery state blocks normal store loading and preserves evidence.
• All app-owned backup, staging, journal, temporary-store, old-store and CSV files are protected before their first byte; signed-device attribute readback remains a disposable-canary gate.
• Settings gains one progressively disclosed row for Backup and export. Copy is plain RU/UK/EN, warns that the password-free file and notes are readable, states that restore replaces everything, and explains that CSV is spreadsheet-only.
• CSV exports active entries only, with notes opt-in and off by default.
• The physical com.kikuai.hourleaf.local ledger remains untouched until simulator fault tests, Sol review, and a separately signed disposable roundtrip all pass.

[kiku-jw]

Slice 5 M1 checkpoint accepted and published on codex/hourleaf-restore-v1 at 6d647753a76d094d4b830679112440a4fee1b133.

Evidence:

• independent LedgerMaintenanceTests: 7/7 passed on iPhone 17 Pro Simulator (/tmp/hourleaf-m1-rereview.TC2Lx7/LedgerMaintenance.xcresult);
• adversarial re-review: GO, P0/P1/P2 = 0;
• exact-A final digest and store removal now share one Core Data coordinator barrier;
• writers before the barrier abort close; writers after it cannot land before removal;
• failed fresh reopen remains retryable;
• destructive store cleanup accepts only the exact owned typed staging artifact;
• Core Data model, project, entitlements and privacy manifest unchanged.

Next: bounded staged import and all-ten-entity temp-store validation, followed by journaled confirm/recovery. CSV and Data Management UI remain in a separate reviewed lane. No physical iPhone app or ledger was touched.

[kiku-jw]

Slice 5 Data Management component lane accepted and published on codex/hourleaf-data-management-ui at 8ece9f554c1b16f5be0adfb62dd5a29a62f120bb.

Evidence:

• independent focused CSV/UI-state run: 14/14 passed (/tmp/hourleaf-csv-ui-rereview.7ewRma/CSVExporter.xcresult);
• worker full unit target: 110/110; Debug build and RU/UK/EN localization lint passed;
• adversarial re-review: GO, P0/P1/P2 = 0;
• deterministic active-only CSV uses BOM, RFC 4180, CRLF and note opt-in;
• app-owned share artifacts have idempotent cleanup on completion/cancel/dismiss;
• restore controls are explicitly unavailable while iCloud sync is active;
• restore/disappear state cannot discard a candidate concurrently with replacement;
• plain password-free backup and CSV note privacy warnings are present.

This branch is deliberately not wired into Settings/AppModel yet; integration waits for the restore backend contract. Physical file-protection proof remains a disposable signed-device gate, and the real iPhone ledger remains untouched.

[kiku-jw]

Roadmap completeness audit (research reports 25-28 + PRO recommendation + accepted product contract): no missing P0 feature was found before safe restore. Accepted post-Slice-5 order remains:

1. One-Tap v1: one derived Repeat last entry action only; latest active record, kind+minutes only, today, no note, .appOneTap, existing Undo. No presets or fourth promoted Shortcut tile.
2. Report Readiness and immutable corrections/service-year close.
3. Calm service-only pace to 600, never capped and excluding credit.
4. Opt-in actionable reminders, then backup-confidence status and privacy-safe quick surfaces.
5. Timer/Watch/imports/iCloud remain later gated work.

Deliberate non-features: backup password/recovery key, adaptive suggestions, automatic time creation, zero-time entries, streaks/badges, CRM, PDF without evidence, and Cloud sync as a backup substitute.

Trust correction required before production signing: local-only must be the truthful default while Settings says sync is planned. Future iCloud sync must be an explicit opt-in with conflict/restore semantics, never silently enabled. This does not alter the current Personal Team local ledger and requires no account action now.

[kiku-jw]

Slice 5 M2 accepted and published on codex/hourleaf-restore-v1 at b29fb4e35ea6f292c64b5c8552a540e49f850861.

Evidence:

• independent HourleafRestorePreparationTests: 11/11 passed at /tmp/hourleaf-slice5-m2-20260803-051954.xcresult;
• final combined M2 + M1: 18/18 passed; no SQLite vnode-unlinked warnings after the test-lifetime fix;
• Sol Max adversarial review: GO, P0/P1/P2 = 0;
• selected backup is coordinated and bounded, imported across all 10 raw entities, reopened, and accepted only when raw/domain/raw digests remain exact;
• private-cloud and in-memory stores reject before staging; preview never mutates live data;
• deterministic typed staging cleanup follows the documented Core Data truncate contract, proves the old store UUID and all model records are gone, survives split cleanup faults and process restart, and never manually deletes SQLite/WAL/SHM;
• protected model, managed objects, project, entitlements, privacy manifest, and frozen backup v1 codec/exporter are unchanged.

Next checkpoint: journaled confirm, exact pre-restore A backup/evidence, whole-store replacement, A-or-B crash recovery, and reminder rescheduling. Physical iPhone data remains untouched.

[kiku-jw]

UX minimalism slice accepted and published.

• Branch: codex/hourleaf-ux-minimalism
• Commit: 7aa67c8
• Removes the decorative onboarding hero and keeps one concise explanation.
• Clarifies editable credit-label intent, minute-handling examples, pre-Hourleaf time, and plain-language privacy copy in EN/RU/UK.
• Removes the misleading storage/sync row until the truthful local-only runtime slice lands.
• Preserves the safe 0:00 edit confirmation and soft-delete flow.

Verification:

• independent review: GO, P0/P1/P2 = 0
• localization plist/key parity and git diff check: pass
• exact three promoted Shortcuts: pass
• onboarding UI: pass
• zero-duration edit/delete UI: pass
• Settings UI copy: pass

This branch is intentionally isolated and will be integrated after restore M3.

[kiku-jw]

Truthful local-only checkpoint accepted and published on branch codex/hourleaf-local-truth at e2e7e3e.

Evidence:

• Runtime storage is local by default in every build; CloudKit remains possible only through a future explicit opt-in and migration gate.
• Shipping iCloud and Push capabilities, CODE_SIGN_ENTITLEMENTS, and the CloudKit entitlement file are removed; Debug and Release build settings expose no iCloud or Push entitlement.
• Core Data V1/V2 compiled model bytes and version checksums are identical before and after the IDE CloudKit flag correction, so the existing SQLite path/schema is not split.
• Fresh unsigned generic-device Debug and Release builds passed.
• Full simulator suite passed 116/116; after the final Settings cleanup, the affected UI test passed again 1/1. RU/UK/EN plist and key parity checks passed.
• Sol Max independent review: GO, P0/P1/P2 = 0.
• Settings no longer exposes the misleading storage/sync row, and privacy copy says plainly that records stay on this iPhone.

No installer or physical device command was run, and the real iPhone ledger remains untouched. If real CloudKit use were ever discovered despite the canonical history, a separate drain/migration canary remains mandatory before rollout.

[kiku-jw]

Restore M3a is frozen, independently accepted, and published.

• Branch: codex/hourleaf-restore-v1
• Commit: 17fe55677663b9c67f01fb0d6d7f64dfe72eda44 (Add crash-safe restore journal)
• Scope: checksummed crash journal and marker, exact A/B terminal decision matrix, protected bounded pre-restore backup evidence, hard-link final/partial crash-window handling, proof-gated cleanup, and idempotent preflight.
• Focused M2 + M3a verification: 35/35 passed, 0 failures/skips. Result bundle: /tmp/hourleaf-m3a-accept.KWOE9x/Logs/Test/Test-Hourleaf-2026.08.03_07-43-14-+0300.xcresult.
• Independent worker verification: 35/35 passed. Result bundle: /tmp/hourleaf-restore-m3b-freeze/Logs/Test/Test-Hourleaf-2026.08.03_07-42-27-+0300.xcresult.
• Generic iOS device builds with signing disabled: Debug succeeded at /tmp/hourleaf-m3a-debug.tZ2MPv; Release succeeded at /tmp/hourleaf-m3a-release.Xtjqw1.
• Independent Sol review: GO, P0 0 / P1 0 / P2 0.
• Frozen source hashes: RestoreJournal.swift = 11849b39bcaa5d57ec9693f25e7746c8266ea920a1c0e54df741ae463037ac42; RestoreJournalTests.swift = e9b7a5ed7c355265d7ef5e7b2b8b05592fcc558770396e6be44229ec6ccce995.
• Remote readback matches local commit exactly; worktree is clean.

No physical-device install, signing, or real Hourleaf ledger mutation was performed. M3b coordinator integration remains next; it must preserve actor serialization and produce terminal proof only after fresh Core Data readback.

[kiku-jw]

Roadmap specification coverage is now frozen and independently accepted.

• Quick Surfaces + Timer v1: SHA-256 a4973c59fdefbe975c6d06566bfc9fa0851487915296bd2f0e7fa3fd76e51fa2 (1,135 lines / 65,732 bytes).
• Platform Expansion v1: SHA-256 0fd0085af855e88178d74103ba74adc67a36f60413d0efcd23d72b12566ddd2f (1,852 lines / 98,538 bytes).
• Independent final research/coverage audit: GO, P0/P1/P2 = 0. The written roadmap is product-complete at specification level; implementation and release remain in progress.

Frozen dependency order:
local restore/integration -> One-Tap -> Report + immutable corrections/archive -> Pace/reminders -> Quick Surfaces/Timer -> optional platform trains.

Key corrections captured before code:

• exactly three promoted App Shortcuts remain; timer controls are private system actions and never auto-create ledger time;
• widget/control extension never becomes a second ledger writer and sees only a fail-private redacted sidecar;
• V3/backup-v2 cannot migrate or ship alone; F1/F1b land only with a selected V3-dependent capability and complete versioned restore;
• V2 CSV import and local-bundle migration remain independent on the accepted password-free backup-v1/M3 restore contract;
• every multi-head conflict consumer is defined: reports, service-year archive, pace, reminders, widget, One-Tap, Watch, CSV, backup, imports and ordinary totals fail closed rather than present a provisional branch as truth;
• sync derives pending uploads from the immutable graph and advances remote tokens only after durable repository commit/readback;
• backup-confidence evidence is version-aware; unresolved timer state blocks restore.

No product code, Git branch, Apple account, signing, CloudKit, physical device, or real ledger was changed by these specification lanes. Owner gates remain explicit for App Group/App ID/iCloud, membership if ever chosen, signing/device canaries, Watch, TestFlight/App Store, CloudKit production, and any real-ledger migration.

[kiku-jw]

Restore M3a journal correction accepted

The bounded correction for the exact-A journal contract is now published.

• Corrected M3b spec SHA-256: d240e1e2fc5a38dbfebde5b1973e7d4b64dd914139db829b38a800ab4a55dd20
• Commit: 19591ab9c29ccb7ffa670626aa01e06776b0c16a
• Branch: codex/hourleaf-restore-journal-correction
• Parent fresh combined restore tests: 52/52 passed
• Worker focused journal tests: 34/34 passed
• Worker Debug and generic Release builds: passed
• Source SHA-256: 52df26d17a244aa8f7ce7ee453f6d2b4b1fb9bb40087c300691485e489716fd5
• Test SHA-256: 8208375c9114e8643eb4b7968061cfd6bafff41fe66eb295b2a325ea22a917a5
• Diff scope: exactly RestoreJournal.swift and RestoreJournalTests.swift
• Device ledger: not touched

This supersedes the earlier M3b spec revision. The review loop is closed: implementation proceeds against the frozen hash above; non-critical follow-ups go to backlog instead of reopening the specification.

[kiku-jw]

Restore M3b accepted and published

Crash-safe restore confirmation and startup recovery are now committed.

• Commit: a0ef413d6f3b1f54cd287814d5905902846560f1
• Branch: codex/hourleaf-restore-v1
• Frozen spec SHA-256: d240e1e2fc5a38dbfebde5b1973e7d4b64dd914139db829b38a800ab4a55dd20
• Parent fresh relevant restore suite: 65/65 passed
• Worker focused suite: 13/13 passed
• Parent unsigned generic iOS Release build: passed
• Parent Analyze: passed
• git diff --check: clean
• Protected M3a hashes remain exact
• Physical device and real ledger: not touched

Accepted behavior includes direct exact-A recovery for all three pre-replacement phases, maintenance writer/readiness gating through reminder reconciliation and the final terminal readback, idle completed-residue cleanup before normal runtime creation, and fail-closed A-or-critical rollback.

Next executable step is integration with the accepted UX/Data Management/local-only stack. That merge must retain restore APIs while preserving cloudSyncEnabled: false, no iCloud/Push entitlements, and Core Data models with usedWithCloudKit=NO.

[kiku-jw]

Restore integration is now published on codex/hourleaf-one-tap-v1 at cd16866ea9e72e8980f74da75d9ef77206f0ab7e.

Evidence:

• accepted local-only restore branch merged with the app runtime, Data Management navigation/actions, post-restore refresh, recovery bootstrap, and localized maintenance/recovery copy
• pre-final-test-addition unit run: 176/176 passed (/tmp/hourleaf-integration-unit.zyhOq0/UnitTests.xcresult)
• the two final AppModel tests and the Luna-authored Settings → Data Management UI test compile successfully
• unsigned generic iOS Debug build passed (/tmp/hourleaf-integration-compile.iO9yTG)
• unsigned generic iOS Release build passed (/tmp/hourleaf-integration-release-final)
• Xcode Analyze passed (/tmp/hourleaf-integration-analyze-final)
• localization plists lint and RU/UK/EN key parity passed; git diff --check clean
• remote branch readback equals the commit above

Honest limitation: after the earlier 195/195 merged baseline and 176/176 wired unit run, CoreSimulator began hanging before test code execution at waiting for workers to materialize. Repeating on other simulators and restarting CoreSimulator reproduced the same Xcode runner failure, so the final added tests are compile-verified but not execution-verified. No physical iPhone, signing, install, CloudKit, or user ledger was touched.

[kiku-jw]

Slice 6 One-Tap v1 published

Commit 167419f58455fb27e8bd4b573b9a8aa90df838c4 is published on codex/hourleaf-one-tap-v1.

Evidence:

• derived Repeat last entry copies only kind and minutes, writes today with no note and .appOneTap, and reuses existing Undo
• deterministic latest-active selector, stale proposal no-write, double-tap guard, credit preservation, over-600 behavior and exact replay are covered by 16 domain/AppModel tests
• frozen backup v1 round-trip preserves .appOneTap, nil note, exact minutes and create revision
• one combined UI flow covers hidden/visible action, repeat, manual draft preservation, Undo and note privacy; accessibility XXXL plus exact Russian/Ukrainian labels also compile
• final generic Simulator test build succeeded at /tmp/hourleaf-one-tap-final-testbuild
• unsigned generic iOS Release succeeded at /tmp/hourleaf-one-tap-final-release
• Xcode Analyze succeeded at /tmp/hourleaf-one-tap-final-analyze
• EN/RU/UK localization lint and 200-key parity passed
• V1/V2 model hashes remain dbfcef97... and 69d8472b...; project, schema, backup production format, entitlements and App Intents are unchanged; exactly three App Shortcuts remain

The Simulator test runner was not retried because the existing Xcode/CoreSimulator failure occurs before test code materializes. No physical device, signing, account, iCloud or user ledger was touched. Next implementation slice: Report Readiness and immutable report/archive corrections.