Audit: PhoneMessageCoordinator commits dedup before modelContext guard; wire context in App.init

[wuersch]

Severity: Medium (practical impact today low — healthKitWorkoutUUID has no readers yet) · Audit finding 10 · Suggested branch: fix/phone-coordinator-wiring

Problem

• (10) Kraftli Timers/Services/PhoneMessageCoordinator.swift:59 — modelContext is wired only in ContentView's .onAppear, which never fires on a background launch (WC wakes a terminated iPhone app with no scene). The WorkoutSessionEndedMessage handler stores lastHandledSessionEnded (dedup state) before updateLogWithWatchUUID bails at the nil-context guard (lines 76–79), so the dual-delivery twin arriving within the 10 s window is rejected as a "duplicate" — the Watch's HealthKit UUID is never linked to the WorkoutLog, with no retry path.

Verifier caveat (moderate confidence)

One verifier argued the twin straddle is unrealistic (sendMessage is never queued, so a lone delivery fails on the nil guard regardless of dedup order) and that healthKitWorkoutUUID currently has no readers — making the practical impact a hygiene nit today. It becomes real the moment anything reads the UUID (e.g. a future workout-detail HealthKit link).

Fix direction

Commit the dedup record only after the message is successfully applied (or buffer-and-replay when modelContext is nil). Better: wire modelContext in App.init — the model container exists there — eliminating the window entirely.