fix: surface graph startup errors and prepare unlock prompts

[RCmerci]

Opening a graph could stop before the journal appeared: a missing cached wrapped key required an extra Retry before reaching the encryption-password form, while a snapshot below the supported schema could leave startup loading indefinitely. Start one online key preparation after an unusable local key, show the password form only when both encrypted materials exist, and surface snapshot admission failures with their actual/minimum versions on the existing failure page and in Diagnostics.

Remote key-preparation failures stay visible with explicit Retry and graph-selection exits; they do not loop automatically. Wrong passwords remain resubmittable. New graph selection retires old key-access tickets, including account-material/private-unlock work scoped to that graph challenge, and same-account catalog reconciliation preserves a preparation failure. Opening the picker alone retains the current session. Parser/SQLite and decrypted-value errors expose fixed safe messages rather than content-bearing error text.

Validation: full dune build @all app/native_embed.exe.o and dune runtest --force passed (898 Alcotest cases, 87 custom checks). New regressions were observed RED before implementation and GREEN afterward, using the owning public pure reducer for the automatic preparation and recovery states. Existing runner/transport fixtures were adapted without adding duplicate regression coverage. An isolated iPhone 13 mini Simulator passed five actual XCTest scenarios in 79.998 seconds: direct password/wrong-password/current-session resume, network/authentication recovery, graph switching before late material, schema 65.29 error/Retry/Diagnostics, and opening a schema 65.33 snapshot. The probe uses production DB/Core/Runner/Application with synthetic transport/authentication and an experimental host-restamped ARM64 object (cross_abi_validated=false); it does not prove cloud sync or full iOS cross-ABI acceptance.

No real graph was migrated, deleted, reset or edited, and no real credentials or iPhone were operated. Independent review is bound to final commit 0cfa3fb1367c48839c34cfbacd7a634811dbdb51, with no remaining evidenced findings. git diff --check and this PR's decision document pass; spec-dev-tool check --all still reports three pre-existing incomplete decision documents. The only interface change remains the explicitly approved actual/minimum payload on storage Admission.Unsupported_schema; this UX addition changes no .mli, spec/ or Dune file.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T11:30:42.655310Z	8fbd7a2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.