Pre-dispatch identity verification races app launch: step-2 capture lands mid-transition and fails closed

[thymikee]

Found during #1381's live ADR 0016 validation. Pre-existing (ADR 0012 step 4 / #1209 behavior); #1349's wait-side fix does not cover it because this is the pre-dispatch path.

Symptom

Replaying an annotated .ad whose step 2 is a press right after step 1's open --relaunch: the press's pre-dispatch target verification captures a fresh snapshot while the app is still launching/mounting and gets an unusable capture — Android: helper "insufficient foreground app content"; iOS: the sparse private-ax fallback under load — so the step fails closed as identity-unverifiable (capture-failed / sparse-snapshot) before dispatch. Observed live on both platforms (Pixel emulator + iPhone 17 Pro sim, the latter flapping with machine load).

Why recordings hide it

At record time the author interleaves snapshot/reads between open and the first press, which absorb the launch transition — and the script writer strips snapshot steps, so the published plan replays the press immediately after open with no settling step. Unannotated scripts don't hit it (no pre-dispatch capture); annotated ones — the very scripts ADR 0012/0016 make trustworthy — do.

Workaround that works today (live-verified)

Author a landmark wait right after open (the ADR 0016 destination-guard pattern applied to the start screen): wait 'label="…"' rides out the launch transition (after #1381's wait fix) and the subsequent press verifies against a settled tree. With that authoring shape the full iOS cold replay passes ("Replayed 4 steps in 24.0s" incl. ~19s of launch settling).

Possible directions (not decided here)

• Bounded retry inside captureDivergenceObservation when the capture failure is a content verdict (isUnreadableCaptureContentError, added in feat(replay): recorded landmark identity for wait, is coverage — read-only step identity (#1349) #1381) — mirrors the wait-loop semantics on the pre-dispatch path, still failing closed at a bounded deadline.
• Or: the script writer emits an implicit launch-landmark wait after a recorded open (heavier; touches authoring semantics).
• At minimum: help workflow authoring guidance to record a wait after open.