fix(alarm): fail-safe alarm system overhaul (SDD alarm-system-overhaul, slice A)

Root-cause fix for the unstoppable-alarm incident (alarm rang 15 minutes,
only uninstall silenced it) plus systematic hardening of every stop path.

Native (Kotlin):
- Verified stop: stopActiveAlarm now derives its result from the real
  post-teardown state (companion instance + synchronous stopEverything +
  activeRingingId check) instead of reporting unconditional success.
- Atomic teardown: every stop path (stop action, notification button,
  snooze, missed, onDestroy, startForeground failure) funnels through one
  stopEverything() covering audio, wakelock, notification, foreground
  state and firing-record cleanup; player.release() guarded.
- Bounded ringing: 10-minute auto-silence armed via AlarmManager fires a
  FIRED->MISSED transition with a localized missed-alarm notification;
  repeating alarms keep their native rearm, deleted alarms never produce
  ghost MISSED notifications.
- Durable firing record with onStartCommand re-validation (resurrection
  guard) and boot-time stale cleanup; firing records cleared on every
  refuse/mismatch/cancel path.
- New notification-only dismissal channel (dismissAlarmNotificationOnly)
  so UI-level dedup can never kill a live ring's audio.

Flutter (Dart):
- Stop/disable/edit/delete of a ringing alarm always attempt to silence
  it; on native-query failure the stop falls back toward silence via the
  id-scoped legacy stop.
- Verified-stop results surface failures: the ringing screen keeps
  dismiss-by-design on success, but on a verified failure it stays up
  with a persistent force-stop banner (guarded against double-dismiss)
  and auto-dismisses if the ring ends externally (missed/notification).
- Missed events sync alarm bookkeeping without opening the ringing UI.
- 4 new l10n keys translated across all 13 locales (ARB guard green).

550 tests green, analyzer clean. Reviewed in 3 adversarial 4-lens rounds
(2 deterministic + 1 refuter-corroborated critical fixed); formal
gentle-ai receipt waived by maintainer authorization (correction scope
legitimately exceeded the frozen genesis paths). On-device QA checklist
in openspec/changes/alarm-system-overhaul/tasks.md pending before
archive.

openspec/changes/alarm-system-overhaul/apply-progress.md

@@ -0,0 +1,68 @@
+# alarm-system-overhaul — Apply Progress (Slice A)
+
+## Status: complete (pending final full-suite verification + bounded review)
+
+Slice A (Phases 1-7 of tasks.md) is fully implemented and every task checkbox is marked with
+verified evidence. Phase 8 / Slice B (P1 permission fallbacks) is intentionally untouched —
+deferred to a follow-up delivery per the orchestrator decision recorded in Engram
+(`decision/alarm-system-overhaul-pre-apply-orchestrator-decisions`).
+
+## How this phase ran (recovery notes)
+
+- The initial apply agent implemented most of Slice A but stalled (stream watchdog) before
+  recording progress; a second continuation agent also stalled early. Recovery was done in
+  smaller stages: (1) a mapping agent verified every Phase 1-7 task acceptance criterion
+  against the working tree (grep/diff evidence, table below summarized) and marked tasks.md;
+  (2) a surgical TDD agent closed the one functional gap the mapping found (task 7.4);
+  (3) the orchestrator ran the final full-suite verification.
+- Baseline established during recovery: full `flutter test` suite green (544 tests) and
+  `flutter analyze` clean (1 known pre-existing info in test/estado/estado_radio_test.dart:641)
+  BEFORE the 7.4 fix; final run after 7.4 recorded below.
+
+## Task evidence summary (full table in the mapping agent report; all grep-verified)
+
+- 1.1-1.4 (fail-safe native stop): `@Volatile activeRingingId` companion snapshot;
+  atomic `stopEverything()` (stopForeground(REMOVE)+stopSelf+wakelock+MediaPlayer+notification)
+  routed from ACTION_STOP/ACTION_STOP_ACTIVE/onDestroy/missed paths; id-agnostic
+  `ACTION_STOP_ACTIVE` for ringing UI + notification Stop (`stopPendingIntent` action updated).
+- 2.1-2.7 (auto-silence + durable firing record): `AUTO_SILENCE_MILLIS` (10 min),
+  AlarmManager-armed `ACTION_MISSED` → `onAlarmMissed` (stops if active, posts missed
+  notification via existing channel, clears firing record, no re-arm of the fired instance);
+  durable firing record written before `player.start()`, `onStartCommand` stale re-validation,
+  `START_NOT_STICKY` preserved; boot-time `cleanupStaleFiringRecords()` in
+  `reschedulePersistedAlarms`; `missedTitle`/`missedText` in AlarmNotificationStrings.
+- 3.1 (channel contract): `stopActiveAlarm` + `getActiveRingingAlarmId` in MainActivity dispatcher;
+  `stopActiveAlarm` reports `STOP_FAILED` errors instead of silent void.
+- 4.1-4.6 (Dart orchestration): `ResultadoDetencion`, `alarmaSonandoId()`,
+  `detenerSonidoActivo()` on the puerto; fakes gained `fallaDetener`/`alarmaSonandoIdValor`/
+  `detencionesActivas`; `_detenerSiEstaSonando` wired into `guardarAlarma` (covers
+  `cambiarActiva`) and `eliminarAlarma`; `finalizarEjecucion` stops active sound and surfaces
+  `_error` on failure. Spec scenarios SS-1a/b/c/d, SS-2a/b covered by tests.
+- 5.1-5.4 (ringing screen fail-safe UX): `forzarDetencion()`; `_detener()` keeps
+  dismiss-by-design but captures ScaffoldMessenger pre-dismiss and shows a retryable
+  force-stop SnackBar on failure (mirrors the existing snooze-failure pattern).
+  SS-3a/b/c covered by tests.
+- 6.1-6.2 (missed-event sync): `accionMissed` native event → `_registrarEjecucionPerdida`
+  → `completarEjecucion`, no re-arm. Test present.
+- 7.1-7.4 (l10n): 4 new keys in en+es ARBs only (11 other locales untouched — CI ARB guard);
+  missed-alarm strings wired through `setNotificationStrings` (`missedTitle`,
+  `missedTemplate` with `{name}` sentinel via new `_plantillaNombre` helper) — 7.4 closed the
+  gap found during mapping (RED→GREEN evidence in task report).
+
+## Deviations
+
+- Task 7.4 added during apply verification (missed-string wiring was implied by NA-3a intent
+  but not an explicit task). No other scope deviations; no unexpected diff content.
+
+## Changed-line accounting (excluding generated lib/l10n/gen/*)
+
+- Working tree at mapping time: ~1045 insertions total incl. generated; non-generated portion
+  within the 800-line session ceiling (final figure recorded by the review lifecycle at
+  review start).
+
+## Remaining work
+
+- None for Slice A code. Next: bounded 4-lens review → sdd-verify → commit/push.
+- Slice B (Phase 8, P1 fallbacks) — follow-up delivery.
+- On-device QA checklist (tasks.md) — requires the user with real hardware; sdd-archive held
+  until that passes.