Keep a Slept Voice Buffer Out of the First-Hour Retry Queue

You join the mobile repo on a Monday morning, and the first ticket asks for a remote voice dry-run before lunch. The handset on the desk is the repo's current debug phone, and the OS build is the one printed in the ticket. You start a capture, lock the screen while the request is in flight, and the process is frozen before any transcript returns. This opening is a proposed first-hour scenario, not a lab measurement from a device you can cite yet.

When the screen wakes, a naive client treats the frozen call as a transport error and enqueues the same audio buffer again. The retry record also keeps the free-server base URL, a session token, and a partial transcript so the next launch can resume. That record is exactly what a first rollback must not leave behind in DataStore, UserDefaults, or a debug log. You can catch this class of leak before the first pull request, if you separate retryable metadata from sensitive payload bytes.

What the first hour is proving

You are not proving that a model is accurate, and you are not proving that a free server will stay available next quarter. You are proving that a sleep transition drops in-flight audio, refuses to persist a session token, and still recovers a clean idle state. The expected observation is a redacted retry record, an empty audio directory, and a cold start that does not call the remote host. If any of those three checks fail, the first pull request is not ready, even when the happy-path demo sounds fine.

Power, network, and permission state belong in the notes beside the steps, because a later reader cannot reproduce a lifecycle result without them. For this proposed run, assume the phone is unplugged, Wi-Fi is on, cellular data is available, and the microphone permission stays granted through the sleep. Do not invent a battery percentage or a latency percentile for a run you have not executed on this handset. Write "not measured" in those columns until you have a trace from the same device and the same build.

Fields that may survive sleep

Use the table below as a review checklist in the first pull request, and keep it next to the client change. A field that is useful for debugging is still forbidden if it can reconstruct the user's voice or the host session. The reviewer should be able to accept the enum and still reject the row that stores a URL. That split matters more than a green demo, because the queue outlives the screen you just unlocked.

Field	After sleep	Retry queue	Rollback notes
New request id	Generate again	Yes, opaque	Yes, if redacted
Base URL	Drop from disk	No	No
Session token	Drop immediately	No	No
Audio bytes	Delete the file	No	No
Partial transcript	Drop	No	No
Failure class enum	Keep	Yes	Yes
Elapsed milliseconds	Keep only if measured	Yes	Label measured or not

What the reviewer accepts

The failure class should stay a closed enum, and it should never embed the response body or the request URL. Allowed values in this proposed policy are slept, revoked, offline, and timeout, with no free-text suffix attached. A partial transcript is not a failure class, even when the words look harmless in a debug build. If you need a human explanation, write it in the pull request from memory, not from a file the app still holds.

Proposed redaction helper

The TypeScript below is a proposed artifact for the first pull request, and it has not been executed against a device in this draft. You can port the same checks to Kotlin or Swift if the repo is not a React Native app. The function returns metadata only, and it refuses audio bytes, tokens, transcripts, and base URLs as retry input. A thrown error here is a successful privacy stop, not a cue to dump the raw object.

type FailureClass = "slept" | "revoked" | "offline" | "timeout";

type RetryMeta = {
  requestId: string;
  failureClass: FailureClass;
  elapsedMs: number | null;
};

const BLOCKED = ["audio", "token", "transcript", "authorization", "baseurl"];

export function redactForRetry(input: Record<string, unknown>): RetryMeta {
  for (const key of Object.keys(input)) {
    const lowered = key.toLowerCase();
    if (BLOCKED.some((word) => lowered.includes(word))) {
      throw new Error("retry record refused a sensitive field");
    }
  }
  const failureClass = input.failureClass;
  if (
    failureClass !== "slept" &&
    failureClass !== "revoked" &&
    failureClass !== "offline" &&
    failureClass !== "timeout"
  ) {
    throw new Error("retry record refused an unknown failure class");
  }
  const requestId =
    typeof input.requestId === "string" && input.requestId.length > 0
      ? input.requestId
      : `local-${Date.now()}`;
  const elapsedMs = typeof input.elapsedMs === "number" ? input.elapsedMs : null;
  return { requestId, failureClass, elapsedMs };
}

Call this helper before you write AsyncStorage, DataStore, SharedPreferences, or a file under the cache directory. If the helper throws, delete the capture file and leave the queue untouched, then surface a local idle state. Do not catch the error and serialize the original input as a fallback, because that fallback is the leak. If the runtime lacks a UUID helper, a local timestamp string is enough for this proposed check.

A free server is only the dry-run host

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The outreach for this draft describes MonkeyCode as an open-source project with free model access and a free server option. That option can serve as a remote dry-run host when you do not want to stand up your own machine. Treat the availability note as operator-supplied, and re-read the project docs before you plan a soak.

Do not depend on a quota, a model name, a region, or a duration that this draft does not verify. This article does not measure latency, uptime, or token use, and it does not name a model or freeze a token allowance. You should keep the base URL in a debug-only config that the release build cannot read. You should never commit a session token beside that config, even when the dry-run lasts only an hour.

A free host does not relax the sleep rule, so audio bytes and partial text still stay off the retry queue. If the docs you open today list a free token allowance, copy that figure into your own test notes. A post should not freeze a token number that the project can change without a new release. Confirm the license in the repository before you vendor any client sample into the first pull request.

If you want to confirm the current free-model and free-server notes, start from the project docs. Stop when the offer no longer matches your plan, and do not treat this article as the source of those limits. That check belongs before the first pull request, not after a rollback has already shipped a hardcoded host. One mismatched doc page is a reason to pause the dry-run, not a reason to cache audio until the host returns.

Steps for the proposed sleep run

Work through these steps on the debug handset, and write the actual device and OS build beside step one before you lock the screen. Keep the phone unplugged for the whole pass, and do not start a second capture until the first cache check is done. Mark every observation as measured or proposed, so a later reader can tell a real trace from this draft. If the ticket names a different lifecycle event, write that event above the list before you change the steps.

1. Confirm the microphone permission is granted, the phone is unplugged, and Wi-Fi is the active network before you start the capture.
2. Start a short voice capture, lock the screen while the request is still in flight, and wait until the process has been frozen.
3. Wake the phone, unlock the app, and confirm the user-visible state is idle rather than a resumed recording.
4. Inspect the retry store and confirm it holds only a failure class, an opaque id, and an elapsed field marked measured or not.
5. Confirm the voice cache directory is missing or empty, and confirm no partial transcript file remains beside it.
6. Run the log scan below, and treat any token-shaped hit as a failed first-hour check rather than a logging nit.

Android log scan

These commands are a proposed observation method, and they do not replace the device run you still need to perform yourself. Replace the package name and the log tag after you read them from the repo, and do not assume the examples below match your application id. A clean proposed result is one slept line, no token-shaped hit, and an empty or missing voice cache after the wake. Save the command output next to the pull request, but only after the token scan has already passed.

adb logcat -d -s VoiceDryRun:I
adb logcat -d | rg -n "Bearer |sessionToken|partialTranscript" || echo "no token-shaped hit"
adb shell run-as com.example.voicedryrun ls cache/voice || echo "no voice cache"

iOS stream

On iOS, stream the subsystem you actually ship, then search for the same three patterns before you attach anything to the pull request. If rg is missing on the workstation, use findstr on Windows with the same patterns, and record which tool you ran. Do not paste a raw log that still contains a transcript into the pull request description or a public issue. A simulator log can hint at string leaks, but it does not replace the sleep transition on a physical phone.

log stream --predicate 'subsystem == "com.example.voicedryrun"' --level info

Rollback before you merge

After the dry-run, revert the client change on a branch and install that build over the same debug app without clearing data first. Cold start the app, leave the microphone idle, and confirm that no request leaves the device for the previous host. Then clear app data on purpose and repeat the cold start, so you can separate a leftover queue from a fresh install. The recovery outcome you want is restarted idle, not silently resumed, and not a retry of the slept buffer.

Uncleared reinstall

Record whether the result recovered, restarted, or silently disappeared, and attach the device, OS, and framework versions beside that sentence. A reviewer should reject the pull request if the reverted build still prints a resume line that names the old request id. That failure means the queue outlived the code you thought you had rolled back on this branch. Fix the storage path, repeat the uncleared install, and only then ask for another review from the same teammate.

adb shell pm clear com.example.voicedryrun
adb shell am start -n com.example.voicedryrun/.MainActivity
adb logcat -d -s VoiceDryRun:I

Who should skip this

Skip this workflow if the product must legally retain audio for a medical, legal, or accessibility record, because deletion on sleep would violate that requirement. Skip it if you cannot run a physical device, because an emulator sleep does not reproduce the same process freeze or radio handoff. Skip it if the first ticket is only a copy change, because this test plan is heavier than that review needs. Also skip a remote dry-run when on-device speech already meets the ticket and a network hop would add retention risk.

Limitations you should keep visible

This draft does not include a measured trace, a battery figure, or a latency table from a handset. Any number you add later must come from your own device, and it must name the build you actually ran. Example package names and log tags are placeholders, not a claim that a specific OS build was certified here. Android cached-app limits, iOS jetsam, and OEM task killers can delete files for reasons this policy does not control.

A redaction helper cannot see strings that a native SDK logs before your code runs, so you still need the log scan. Free model access and a free server option can change without notice, so re-read the docs on the day you run. A missing endpoint is not a reason to persist audio until the host returns and the queue can flush. Do not treat this article as a security audit, a compliance sign-off, or a benchmark of any vendor.

If your log scan finds a token, rotate that credential, delete the local capture, and do not file the raw line in a public issue. Pin the framework version from the lockfile you actually have, rather than from a blog post that will go stale. Ask a teammate to repeat the uncleared reinstall on a second handset before you call the check done. That second handset still needs its own OS build in the notes, because a matching result on one phone is not a class proof.

What to send back

If you run the same sleep and rollback on your own phone, reply with the device, the OS build, and the transition steps you actually used. Say whether the voice buffer recovered, restarted idle, or silently disappeared after you reverted the branch. Those three details are enough for another reader to compare environments without copying your audio or your tokens. Leave the capture file off the comment, even when the redaction helper already passed on your machine.