frontend-patterns/research/reviews/RecoveryWalkthroughReview.md

Recovery walkthrough review

Codex editorial review, 2026-09-25. Frozen inputs: repository 96d1143, with per-file and prompt hashes in the review runs. One separate model was asked to challenge both cases through llm-connect. This is not independent human review or an empirical comparison. The revised second prompt explicitly corrected errors in the first response; this is not a blinded evaluation.

Execution and disposition

Attempt 01 exceeded its 2,500-token response cap. The incomplete text is quarantined, never counted as a completed review. It confused omniscient trace descriptions with client knowledge and treated intended idempotent replay as problematic. Do not apply its proposed change from a write producing v12 to a write against v12: that changes the scenario incorrectly.

Attempt 02 completed with a stricter prompt limiting findings and total words. Full response is retained. Across both attempts: two service calls, 10,605 reported tokens. No direct provider calls, credential retrieval, or unrecorded retries.

1. Reject the proposed VC-01 freshness correction. An obsolete read cannot confirm that a later write superseded it. Allowing it to update freshness markers would weaken the intended invariant. Discard here means not applying obsolete data.
2. Reject the proposed VC-02 retry correction as a defect finding. The trace retries the same immutable opC under an explicit deduplication assumption. Changed payload would be a different proposal; it must not be smuggled into that retry. A new ID while the original outcome is unresolved risks an extra transition. The response's conditional same-payload clause is already covered by the trace's contract.

Two model findings reviewed, zero adopted. Its statement that baseline usefulness is unknown is retained. This negative result is evidence about this review attempt, not evidence that the walkthroughs are correct or that model reviews never help.

Editorial corrections supported by local reasoning

E01: VC-02 steps 6/8 previously left opA's lifecycle unspecified. Block it on detected conflict, atomically supersede it when opC is queued, and require the receiver to reject stale delayed operations. Local queue retirement alone cannot stop an in-flight write. Delayed opA receipts affect history only. These are proposed contracts, not product guarantees.

E02: VC-01 step 9 lacked an operational rule for discarding obsolete reads. Add local read generations plus an explicit read-after-write/server-version requirement. Generation orders local requests, not opaque server revisions or replica freshness.

E03: Add operation-specific evidence handling: a late error cannot reverse confirmed acceptance, and a previous operation's receipt cannot clear newer typing. Define composer-to-pending handoff separately from storage durability, motivated by the pinned frontend code.

These are Codex editorial changes, not adopted model findings. They sharpen the contract but remain synthetic reasoning. No new tests of frontend runtime behavior were performed. Independent review, usability, crash recovery and full-pattern recurrence remain open under FEP-WP-0002 T02/T03.