Pre-push review: T-2152 superseded entitlement scan stale state

diff --git a/prism/Services/StoreManager.swift b/prism/Services/StoreManager.swiftindex 9b4d69be..85bf4757 100644--- a/prism/Services/StoreManager.swift+++ b/prism/Services/StoreManager.swift@@ -122,6 +122,22 @@ final class StoreManager {     @ObservationIgnored     private var latestEntitlementObservation: UInt64 = 0 +    /// Stamps of `verifyEntitlements()` scans that have taken an observation+    /// stamp but not yet resolved (committed or discovered they never will,+    /// e.g. cancellation). Only scans are ever "outstanding" — a transaction+    /// event stamps and commits synchronously on the `MainActor`, so it never+    /// suspends between the two (T-2152).+    @ObservationIgnored+    private var outstandingScanObservations: Set<UInt64> = []++    /// A stale-but-real scan result held back during the `.loading` bootstrap+    /// window because a newer scan was still outstanding when it arrived+    /// (T-2152). Promoted once every newer scan is known to have resolved+    /// without committing; discarded the moment any commit actually lands,+    /// since that is by definition newer information.+    @ObservationIgnored+    private var pendingLoadingFallback: (state: EntitlementState, observation: UInt64)?+     // MARK: - Init      convenience init() {@@ -245,8 +261,16 @@ final class StoreManager {         // stamp captures when this scan began reading the world; the commit         // below is dropped if newer evidence has arrived since.         let observation = beginEntitlementObservation()+        outstandingScanObservations.insert(observation)         let hasUnlock = await entitlementSource.hasUnlockEntitlement() +        // This scan is resolving one way or another — commit or not, it is no+        // longer outstanding. Do this before touching `pendingLoadingFallback`+        // so a held-back result blocked only by this scan can be promoted+        // below (T-2152).+        outstandingScanObservations.remove(observation)+        defer { promotePendingLoadingFallbackIfUnblocked() }+         // A cancelled scan reports `false` from a truncated read of the         // entitlement sequence. A partial read is not evidence of "no         // entitlement", so it must never commit `.locked` (T-1868).@@ -372,23 +396,64 @@ final class StoreManager {     /// — recency of information decides the winner, never completion order     /// (T-1868, actor reentrancy).     ///-    /// One exception: while `entitlementState` is still `.loading`, any write-    /// is accepted. `.loading` carries zero information, so no stamp can be-    /// staler than it — and without this, a writer that takes the latest stamp-    /// but never commits (a scan cancelled mid-read) would veto every earlier-    /// writer's successful read and strand the state at `.loading` until the-    /// next writer event. A newer in-flight scan still wins afterwards: its-    /// stamp is the latest, so its commit overwrites this bootstrap value.-    /// Only scans can burn a stamp without committing (transaction events-    /// stamp and commit synchronously), so the exception can never resurrect-    /// a value a transaction event has superseded.+    /// One exception: while `entitlementState` is still `.loading`, a stale+    /// write may still be accepted. `.loading` carries zero information, so no+    /// stamp can be staler than it — and without some exception here, a writer+    /// that takes the latest stamp but never commits (a scan cancelled+    /// mid-read) would veto every earlier writer's successful read and strand+    /// the state at `.loading` until the next writer event.+    ///+    /// That exception cannot be unconditional, though (T-2152): if a NEWER scan+    /// is still outstanding — mid-flight, not yet resolved one way or the+    /// other — it might commit something different, so an older result must+    /// not publish yet. It is held in `pendingLoadingFallback` instead and+    /// promoted by `promotePendingLoadingFallbackIfUnblocked()` once every+    /// newer scan is known to have resolved without committing. Only scans can+    /// burn a stamp without committing (transaction events stamp and commit+    /// synchronously), so this can never resurrect a value a transaction event+    /// has superseded — a transaction event's own commit always holds the+    /// latest stamp and takes the unconditional branch below.     private func commitEntitlement(_ next: EntitlementState, observedAt observation: UInt64) {-        guard observation == latestEntitlementObservation || entitlementState == .loading else {+        guard observation == latestEntitlementObservation else {+            guard entitlementState == .loading else { return }+            guard !outstandingScanObservations.contains(where: { $0 > observation }) else {+                // A newer scan might still supersede this result. Hold it back+                // rather than dropping it outright, keeping only the freshest+                // held-back candidate.+                if observation > (pendingLoadingFallback?.observation ?? 0) {+                    pendingLoadingFallback = (next, observation)+                }+                return+            }+            pendingLoadingFallback = nil+            entitlementState = next             return         }+        pendingLoadingFallback = nil         if entitlementState != next { entitlementState = next }     } +    /// Promotes a held-back scan result once every newer scan that was+    /// blocking it has resolved without committing (T-2152). Without this, a+    /// newer scan cancelled before it commits would strand `entitlementState`+    /// at `.loading` — worse than the stale-publish bug this mechanism exists+    /// to prevent, since every gated export surface is disabled while+    /// `.loading`. Cancellation is the only way a scan resolves without+    /// committing, so this is the sole path here;+    /// `cancelledScanDoesNotStrandLoading` pins it.+    ///+    /// This runs from `verifyEntitlements`'s `defer`, so it only fires when a+    /// blocking scan RETURNS. A scan that never returns keeps its stamp+    /// outstanding and the fallback held — `hasUnlockEntitlement()` has no+    /// timeout, so that case still sits at `.loading`, where pre-T-2152 code+    /// would have published the older scan's answer.+    private func promotePendingLoadingFallbackIfUnblocked() {+        guard entitlementState == .loading, let fallback = pendingLoadingFallback else { return }+        guard !outstandingScanObservations.contains(where: { $0 > fallback.observation }) else { return }+        entitlementState = fallback.state+        pendingLoadingFallback = nil+    }+     private func checkVerified<T>(_ result: VerificationResult<T>) throws -> T {         switch result {         case .verified(let value):

diff --git a/prismTests/StoreManagerTests.swift b/prismTests/StoreManagerTests.swiftindex ae38ad4c..d623a0b6 100644--- a/prismTests/StoreManagerTests.swift+++ b/prismTests/StoreManagerTests.swift@@ -440,6 +440,82 @@ struct StoreManagerTests {         // until the next writer event, wedging every gated export.         #expect(store.entitlementState == .unlocked)     }++    // MARK: - T-2152: superseded scans must not publish while a newer scan+    // is still outstanding, even during the `.loading` bootstrap window.+    //+    // Before the fix, `commitEntitlement` accepted ANY stamp while+    // `entitlementState == .loading`, regardless of whether a newer scan was+    // still in flight. Completion order (not the observation clock) decided+    // the winner during that window — the same defect T-1868 fixed for the+    // post-bootstrap case, reopened for the pre-bootstrap one.++    @Test("An older scan cannot publish while a newer scan is still pending, even while loading")+    @MainActor+    func olderScanCannotPublishWhileNewerScanStillPendingDuringLoading() async {+        // Models the exact T-2152 trigger: scan A reads the pre-sync world,+        // scan B starts (e.g. after AppStore.sync()) and remains in flight,+        // and A completes first.+        let source = ScriptedEntitlementSource(results: [false, true])+        let store = StoreManager(+            exportCounter: makeCounter(),+            entitlementState: .loading,+            entitlementSource: source+        )++        let scanA = Task { await store.verifyEntitlements() }+        await source.waitForScanStart(1)+        let scanB = Task { await store.verifyEntitlements() }+        await source.waitForScanStart(2)++        // Release only A. B (the newer, still-live scan) stays suspended.+        source.open(0)+        await scanA.value++        // Expected: A's superseded result must not publish — B still owns+        // the latest stamp and might yet commit something different.+        // Before the fix: state incorrectly flips to `.locked` here because+        // the `entitlementState == .loading` exception ignored B entirely.+        #expect(store.entitlementState == .loading)++        source.open(1)+        await scanB.value++        // B, the genuinely latest scan, wins once it resolves.+        #expect(store.entitlementState == .unlocked)+    }++    @Test("A held-back result is promoted once the newer scan holding it back turns out to be cancelled")+    @MainActor+    func heldBackResultPromotedWhenBlockingNewerScanIsCancelled() async {+        // Companion liveness check for the fix above: withholding A's result+        // while B is pending must not permanently strand `.loading` if B+        // itself never commits (external cancellation, e.g. a `.task` scope+        // exit). A's genuine read must still surface once B's fate is known.+        let source = ScriptedEntitlementSource(results: [true, false])+        let store = StoreManager(+            exportCounter: makeCounter(),+            entitlementState: .loading,+            entitlementSource: source+        )++        let first = Task { await store.verifyEntitlements() }+        await source.waitForScanStart(1)+        let second = Task { await store.verifyEntitlements() }+        await source.waitForScanStart(2)++        source.open(0)+        await first.value+        #expect(store.entitlementState == .loading)++        second.cancel()+        source.open(1)+        await second.value++        // A's held-back result must be promoted now that B is known to never+        // commit.+        #expect(store.entitlementState == .unlocked)+    } }  // MARK: - Test doubles

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex 8c650b61..78f21bf5 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -20,6 +20,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0  ### Fixed +- A verification scan that starts during the app's initial entitlement bootstrap can no longer publish a stale result while a newer scan is still in flight (T-2152). While `entitlementState` was still `.loading`, any scan's result was accepted regardless of whether a more recent scan — for example one started right after `AppStore.sync()` — was still reading the world; the older scan finishing first could briefly flip the paywall to locked (or unlocked) ahead of the newer, more current answer. An older result that arrives while a newer scan is still outstanding is now held back rather than published, and is promoted only once every newer scan has resolved — either by committing, or by being cancelled without ever committing, which still lets the held-back result through so a cancelled scan cannot leave the paywall stranded on `.loading`. The trade is that the brief loading state now ends when the last overlapping scan answers rather than the first, so it can last marginally longer; every control it gates is disabled meanwhile, so nothing silently does nothing. - Opening an SVG image full screen now shows that document's image, rather than one belonging to a different document (T-1866). Two documents that each referred to an SVG by the same relative name — `./diagram.svg` sitting next to each file, say — shared a single entry in the store of rendered previews, because that store was keyed on the name written in the markdown instead of on the file the name actually resolves to. Whichever document you opened first won: opening the second document's diagram showed you the first one's picture, with nothing to indicate it was the wrong one, and it kept doing so for the rest of the session. Rendered SVG previews are now keyed on the resolved image itself — a file's full path, a remote address, or the contents of an inline image — so same-named images in different documents can no longer stand in for one another. Reopening the same image in the same document still comes back instantly from the store, as before, and two documents that embed a byte-for-byte identical inline image do still share one rendered preview, which is correct: identical content renders identically. - A note imported from a document, anchored to a nested list item (a sub-item under a top-level list item), now shows its quoted text and the section it belongs to (T-1871). In the notes pane it appeared with a blank quote and no heading, and it could not be told apart from any other nested-item note in the document. The note itself was always attached to the correct item — only the surrounding context was missing, and it was missing every time the document was opened, not just on a reload. Imported notes are rebuilt from the document on each open, and that rebuild only recognised top-level list-item identifiers, so a nested item's identifier was never matched and the context came back empty. Nested identifiers are now recognised the same way every other part of the app that addresses list items already recognises them, so an imported note on a nested item gets the same context as one on a top-level item. - Refreshing a document opened from a URL no longer leaves a background download running loose after you close it (T-1805). Tapping Refresh started an untracked download with no way to stop it: closing the document, or navigating to a different one, before the download finished let it keep running, and when it finally completed it could still overwrite that URL's title in Recent Files — even though you had already moved on — or race a second refresh for a stale result. Closing the document, or starting another refresh, now cancels the one in flight, and a refresh that has been superseded or cancelled no longer writes its result anywhere.