Pre-push review: T-2133 iPad renderers stay attached to a closed scene

diff --git a/prism/Services/RenderingUtilities.swift b/prism/Services/RenderingUtilities.swiftindex 87bde6f1..33051186 100644--- a/prism/Services/RenderingUtilities.swift+++ b/prism/Services/RenderingUtilities.swift@@ -2,6 +2,69 @@ import Foundation import WebKit import OSLog +/// Describes whether a previously attached render-host window can still be+/// used. Kept free of UIKit types so the revalidation decision in+/// `WindowAttachmentValidator.isStillLive` is unit-testable on macOS even+/// though only iOS ever needs it in production — macOS instead hosts+/// renderers in a dedicated off-screen `NSWindow` that is retained for the+/// process lifetime and never needs revalidation. The production conformance+/// (`UIWindowHostState`, wrapping a real `UIWindow`) lives in+/// `WebViewPool.swift` under `#if os(iOS)`.+@MainActor+protocol AttachedHostState {+    /// Whether the window reference is still alive (not deallocated).+    var windowIsPresent: Bool { get }+    /// Whether the window's owning scene is still connected to the app.+    var sceneIsConnected: Bool { get }+}++/// Pure decision logic for whether a render host attached on iOS is still+/// live, or must be replaced by re-attaching to a currently-connected+/// scene's window (T-2133). On iPad, a scene can close at any time while+/// another stays open — a renderer or pooled WebView that attached to the+/// closed scene's window keeps a technically-non-nil `UIWindow` reference+/// (until it deallocates), but JavaScript execution against it silently+/// fails or times out because the window is no longer part of any live+/// scene.+@MainActor+enum WindowAttachmentValidator {+    /// True when a previously attached host window is still safe to reuse:+    /// the window itself has not been deallocated, and its owning scene is+    /// still connected to the app.+    static func isStillLive(_ state: AttachedHostState) -> Bool {+        state.windowIsPresent && state.sceneIsConnected+    }++    /// The platform-agnostic half of the T-2133 fix: decide whether `state`+    /// is stale and, if so, detach then reattach in that order. Both+    /// production call sites (`MermaidRenderer.renderInternal`,+    /// `WebViewPool.getOrCreateWebView`) differ only in what "the window" and+    /// "detach"/"reattach" mean for their own WebView — the decide-then-act+    /// sequencing itself is identical, so it is expressed once here and is+    /// directly live-testable with spy closures (no UIKit required), rather+    /// than only checkable by scanning each call site's source text.+    ///+    /// - Parameters:+    ///   - state: The current attachment to validate.+    ///   - detach: Invoked first when `state` is stale, to release the old+    ///     attachment (e.g. `webView.removeFromSuperview()`).+    ///   - reattach: Invoked second when `state` is stale, to attach to a+    ///     currently-live host. Any throw propagates to the caller.+    /// - Returns: `true` if `state` was stale and `detach`/`reattach` ran;+    ///   `false` if `state` was already live and neither closure ran.+    @discardableResult+    static func reattachIfNeeded(+        _ state: AttachedHostState,+        detach: () -> Void,+        reattach: () throws -> Void+    ) rethrows -> Bool {+        guard !isStillLive(state) else { return false }+        detach()+        try reattach()+        return true+    }+}+ /// Shared rendering helpers used by `SVGRenderer`, `BackgroundDiagramRenderer`, /// and `MermaidRenderer`. The helpers cover three patterns that were previously /// duplicated across the three renderers: racing an async operation against a

diff --git a/prism/Services/MermaidRenderer.swift b/prism/Services/MermaidRenderer.swiftindex a49801e2..591d2027 100644--- a/prism/Services/MermaidRenderer.swift+++ b/prism/Services/MermaidRenderer.swift@@ -197,8 +197,27 @@ final class MermaidRenderer: NSObject {     }      private func renderInternal(source: String, themeConfig: MermaidThemeConfig?) async throws -> String {-        // Ensure webView is attached to a window (required for JS execution on macOS)-        #if os(macOS)+        // Ensure webView is attached to a live window before every render.+        #if os(iOS)+        // The window attached at init (or during a previous render) may+        // have gone away since: the user can close an iPad scene at any+        // time while another stays open, leaving `attachedWindow` pointing+        // at a window that is no longer part of any connected scene.+        // Revalidate and re-attach to a currently connected scene when+        // stale — otherwise JavaScript execution silently fails or times+        // out (T-2133).+        try WindowAttachmentValidator.reattachIfNeeded(+            UIWindowHostState(window: attachedWindow),+            detach: {+                self.webView.removeFromSuperview()+                self.attachedWindow = nil+            },+            reattach: { self.attachToWindowLegacy() }+        )+        if attachedWindow == nil {+            throw MermaidError.renderFailed("No window available for webView attachment")+        }+        #elseif os(macOS)         if renderWindow == nil {             attachToWindowLegacy()         }

diff --git a/prism/Services/WebViewPool.swift b/prism/Services/WebViewPool.swiftindex d4cae5b2..704261bc 100644--- a/prism/Services/WebViewPool.swift+++ b/prism/Services/WebViewPool.swift@@ -71,6 +71,24 @@ extension UIWindowScene: WindowSceneProviding {     var sceneActivationState: UIScene.ActivationState { activationState }     var sceneWindows: [UIWindow] { windows } }++/// Production `AttachedHostState` for a `UIWindow` a renderer previously+/// attached its WebView to. Used to detect a stale attachment left behind+/// when the window's owning scene disconnects — e.g. the user closes an+/// iPad scene while another stays open (T-2133). `window` is weak: once the+/// window itself deallocates, `windowIsPresent` reports it directly rather+/// than relying on the scene check.+@MainActor+struct UIWindowHostState: AttachedHostState {+    weak var window: UIWindow?++    var windowIsPresent: Bool { window != nil }++    var sceneIsConnected: Bool {+        guard let scene = window?.windowScene else { return false }+        return UIApplication.shared.connectedScenes.contains(scene)+    }+} #endif  // MARK: - WebViewPool@@ -347,6 +365,19 @@ final class WebViewPool: NSObject, WKNavigationDelegate {     /// The WebView is stored in the pool only after successful window attachment.     private func getOrCreateWebView(at index: Int) throws -> (WKWebView, Bool) {         if let existing = pool[index] {+            #if os(iOS)+            // A pooled WebView may have been attached to a scene that has+            // since closed (e.g. the user closed an iPad scene while+            // another stayed open). Revalidate before reuse and re-attach+            // to a currently connected scene when stale — otherwise+            // JavaScript execution against the detached view silently+            // fails or times out (T-2133).+            try WindowAttachmentValidator.reattachIfNeeded(+                UIWindowHostState(window: existing.window),+                detach: { existing.removeFromSuperview() },+                reattach: { try self.attachToWindowHierarchy(existing) }+            )+            #endif             return (existing, false)         }         let webView = createWebView()

diff --git a/prismTests/WebViewPoolTests.swift b/prismTests/WebViewPoolTests.swiftindex 534a4e4d..526b1ccd 100644--- a/prismTests/WebViewPoolTests.swift+++ b/prismTests/WebViewPoolTests.swift@@ -806,3 +806,120 @@ final class MockWindow: UIWindow {     } } #endif++// MARK: - Window Attachment Revalidation Tests (T-2133)++/// Tests for `WindowAttachmentValidator.isStillLive`, the pure decision that+/// backs "should a renderer/pooled WebView re-attach before this render?".+///+/// Deliberately **not** `#if os(iOS)`-gated: `make test-quick` runs on+/// macOS, where an `#if os(iOS)` test body never executes, so the+/// revalidation decision is expressed against the platform-agnostic+/// `AttachedHostState` protocol (see `RenderingUtilities.swift`) precisely+/// so it can be exercised here without any UIKit dependency.+///+/// Regression test for T-2133: MermaidRenderer and WebViewPool attached a+/// hidden WebView to an iPad scene's window once, at init/first render, and+/// never revalidated that attachment. If the user closed that scene while+/// another stayed open, later renders reused a WebView attached to a window+/// that was no longer part of any connected scene — JavaScript execution+/// against it silently failed or timed out.+@MainActor+struct WindowAttachmentValidatorTests {++    /// Test double for `AttachedHostState` — no UIKit types involved, so+    /// this exercises the same decision logic production code applies via+    /// `UIWindowHostState` without requiring a live `UIWindow`/`UIWindowScene`.+    struct MockAttachedHostState: AttachedHostState {+        let windowIsPresent: Bool+        let sceneIsConnected: Bool+    }++    @Test("Live when window is present and its scene is connected")+    func liveWhenPresentAndConnected() {+        let state = MockAttachedHostState(windowIsPresent: true, sceneIsConnected: true)+        #expect(WindowAttachmentValidator.isStillLive(state) == true)+    }++    @Test("Not live when the window has deallocated")+    func notLiveWhenWindowGone() {+        let state = MockAttachedHostState(windowIsPresent: false, sceneIsConnected: true)+        #expect(WindowAttachmentValidator.isStillLive(state) == false)+    }++    @Test("Not live when the window's scene has disconnected (T-2133 core case)")+    func notLiveWhenSceneDisconnected() {+        // This is the exact T-2133 scenario: the scene the window belonged+        // to was closed (e.g. an iPad scene), but the weak `UIWindow`+        // reference has not deallocated yet.+        let state = MockAttachedHostState(windowIsPresent: true, sceneIsConnected: false)+        #expect(WindowAttachmentValidator.isStillLive(state) == false)+    }++    @Test("Not live when both window and scene are gone")+    func notLiveWhenBothGone() {+        let state = MockAttachedHostState(windowIsPresent: false, sceneIsConnected: false)+        #expect(WindowAttachmentValidator.isStillLive(state) == false)+    }++    // MARK: - reattachIfNeeded++    /// Live wiring pin for `WindowAttachmentValidator.reattachIfNeeded`, the+    /// platform-agnostic "decide, then detach+reattach" helper both+    /// `MermaidRenderer.renderInternal` and `WebViewPool.getOrCreateWebView`+    /// now delegate to. Unlike those two call sites (`#if os(iOS)`-gated+    /// internally, so only pinnable on macOS via `WindowAttachmentWiringTests`'+    /// source scan), this helper itself is plain Swift with no UIKit+    /// dependency, so it can be exercised for real here with spy closures —+    /// no text scan needed for the behaviour these tests cover.++    private struct SpyReattachError: Error {}++    @Test("reattachIfNeeded does nothing when the state is already live")+    func reattachIfNeededSkipsWhenLive() throws {+        let state = MockAttachedHostState(windowIsPresent: true, sceneIsConnected: true)+        var detachCalled = false+        var reattachCalled = false++        let didReattach = try WindowAttachmentValidator.reattachIfNeeded(+            state,+            detach: { detachCalled = true },+            reattach: { reattachCalled = true }+        )++        #expect(didReattach == false)+        #expect(detachCalled == false)+        #expect(reattachCalled == false)+    }++    @Test("reattachIfNeeded detaches then reattaches, in order, when the state is stale")+    func reattachIfNeededRunsInOrderWhenStale() throws {+        // The T-2133 core case: window still present, scene disconnected.+        let state = MockAttachedHostState(windowIsPresent: true, sceneIsConnected: false)+        var callOrder: [String] = []++        let didReattach = try WindowAttachmentValidator.reattachIfNeeded(+            state,+            detach: { callOrder.append("detach") },+            reattach: { callOrder.append("reattach") }+        )++        #expect(didReattach == true)+        #expect(callOrder == ["detach", "reattach"])+    }++    @Test("reattachIfNeeded propagates the reattach closure's throw after detaching")+    func reattachIfNeededPropagatesReattachError() {+        let state = MockAttachedHostState(windowIsPresent: false, sceneIsConnected: false)+        var detachCalled = false++        #expect(throws: SpyReattachError.self) {+            try WindowAttachmentValidator.reattachIfNeeded(+                state,+                detach: { detachCalled = true },+                reattach: { throw SpyReattachError() }+            )+        }+        #expect(detachCalled == true)+    }+}

diff --git a/prismTests/WindowAttachmentWiringTests.swift b/prismTests/WindowAttachmentWiringTests.swiftnew file mode 100644index 00000000..18c447c9--- /dev/null+++ b/prismTests/WindowAttachmentWiringTests.swift@@ -0,0 +1,254 @@+//+//  WindowAttachmentWiringTests.swift+//  prismTests+//+//  T-2133 follow-up: pins the CALL SITES, not just the decision.+//++import Foundation+import Testing+@testable import prism++/// `WindowAttachmentValidatorTests` (in `WebViewPoolTests.swift`) pins both+/// halves of the decision production code applies: `isStillLive` (the pure+/// check) and, since the round-2 review redesign, `reattachIfNeeded` (the+/// platform-agnostic "decide, then detach+reattach" behaviour), the latter+/// exercised live with spy closures. That leaves exactly the gap T-1943+/// already taught this codebase about: a direct-invocation test cannot see+/// missing wiring, because it never asks production code to reach the seam+/// on its own. Deleting the `WindowAttachmentValidator.reattachIfNeeded(...)`+/// call from either production call site — `MermaidRenderer.renderInternal`+/// or `WebViewPool.getOrCreateWebView` — would leave `WindowAttachmentValidatorTests`+/// green while reintroducing the exact T-2133 bug (a WebView left attached to+/// a closed iPad scene's window).+///+/// A *live* wiring pin — handing `WebViewPool`/`MermaidRenderer` a fake stale+/// host state and observing that the re-attach path runs — is not buildable+/// here for the call sites themselves: the `if !isStillLive(...) { detach();+/// reattach() }` sequencing they used to inline is `#if os(iOS)`-gated at+/// each site (the doc comment on `AttachedHostState` in+/// `RenderingUtilities.swift` explains why — macOS hosts renderers in a+/// dedicated `NSWindow` that never needs revalidation), so that code path+/// doesn't compile into the macOS test target `make test-quick` runs at all.+/// The decide-then-act *behaviour* itself is no longer iOS-only, though: it+/// now lives in the platform-agnostic `WindowAttachmentValidator.reattachIfNeeded`,+/// which is exactly what `WindowAttachmentValidatorTests` exercises live. What's+/// left for THIS suite to pin is narrower and genuinely can't be tested any+/// other way: that each `#if os(iOS)` call site still actually calls that+/// helper, since neither call site compiles on macOS for a live test to call+/// into directly.+///+/// So this is the structural alternative CLAUDE.md documents for exactly this+/// situation (`ImageMaterializationChokepointTests`,+/// `URLChokepointAdoptionTests`): it isolates each production function's body+/// by name and asserts it still calls `WindowAttachmentValidator.reattachIfNeeded`.+/// Because the helper itself is now the thing that's live-tested, a single+/// stable identifier per call site is sufficient here — there's no longer a+/// need to also pin the reattach expression's exact spelling (a local+/// variable name, argument list, or line-wrapping), which is what made the+/// prior two-assertion version of this suite brittle. It reuses+/// `ProductionSourceScan`'s source-root discovery rather than a fresh copy of+/// that logic.+///+/// ## What it cannot see+///+/// A textual scan cannot prove the call is reached at the right *time*+/// (before every render/checkout, not just somewhere in the function), only+/// that the call is still present in the function body. Reordering rather+/// than deleting the call would not be caught — nor would passing the wrong+/// state, or swapping the detach/reattach closures for no-ops; those are+/// exactly what `WindowAttachmentValidatorTests`' live `reattachIfNeeded`+/// tests pin instead. The live `WindowAttachmentValidatorTests` and+/// `WebContentTerminationWiringTests` remain the model for a platform where+/// exercising the real call site is possible; this suite exists because, on+/// macOS, the call sites themselves are not reachable.+struct WindowAttachmentWiringTests {++    // MARK: - Function body isolation++    /// A file under `prism/` that must exist for source-root discovery to+    /// have found the right tree. `RenderingUtilities.swift` hosts+    /// `WindowAttachmentValidator` itself.+    private static let sentinel = "Services/RenderingUtilities.swift"++    private static func productionSource(_ relativePath: String) throws -> String {+        let root = try #require(+            ProductionSourceScan.productionSourceRoot(sentinel: sentinel),+            "Could not locate the prism/ source tree; the wiring pin cannot run."+        )+        return try String(+            contentsOf: root.appendingPathComponent(relativePath),+            encoding: .utf8+        )+    }++    /// Isolates the source of the function named `name`, from its `func`+    /// line to the matching closing brace, so a match on+    /// `reattachIfNeeded(` elsewhere in the file (a comment, a different+    /// function) cannot satisfy this test. Two things keep the isolation+    /// honest:+    /// - The `func` search requires the identifier to be followed+    ///   immediately by `(` (`"func \(name)("`), so a differently-named+    ///   function that merely shares the same prefix (e.g. a future+    ///   `renderInternalFallback` sorted earlier in the file) cannot hijack+    ///   the match.+    /// - Every line has its `//` line comment stripped (quote-aware, so a+    ///   string literal containing `//` is untouched) before brace counting+    ///   and before the caller's `.contains` check, so a comment that+    ///   happens to mention the identifier being pinned can't satisfy the+    ///   assertion after the real call is gone — the same stale-doc-drift+    ///   concern `ProductionSourceScan.staleMarkers` guards against+    ///   elsewhere in this codebase.+    ///+    /// Brace counting itself ignores anything inside a string literal too,+    /// mirroring `ProductionSourceScan.unclosedParens`, so a future string+    /// literal containing `{`/`}` cannot desync the count.+    private static func functionBody(named name: String, in source: String) throws -> String {+        let lines = source.components(separatedBy: "\n").map(stripLineComment)+        let marker = "func \(name)("+        let startIndex = try #require(+            lines.firstIndex { $0.contains(marker) },+            "Could not find `\(marker)` — has it been renamed, given a different signature, or moved?"+        )++        var depth = 0+        var started = false+        var bodyLines: [String] = []+        for line in lines[startIndex...] {+            depth += braceDelta(in: line)+            started = started || depth > 0+            bodyLines.append(line)+            if started, depth == 0 { break }+        }+        return bodyLines.joined(separator: "\n")+    }++    /// Strips a `//` line comment from `line`, ignoring `//` that appears+    /// inside a string literal. Quote/escape tracking mirrors `braceDelta`.+    private static func stripLineComment(_ line: String) -> String {+        var result = ""+        var inQuote = false+        var escaped = false+        let characters = Array(line)+        var index = 0+        while index < characters.count {+            let character = characters[index]+            if escaped {+                result.append(character)+                escaped = false+            } else if character == "\\" {+                result.append(character)+                escaped = true+            } else if character == "\"" {+                inQuote.toggle()+                result.append(character)+            } else if !inQuote, character == "/", index + 1 < characters.count, characters[index + 1] == "/" {+                break+            } else {+                result.append(character)+            }+            index += 1+        }+        return result+    }++    /// `{` minus `}` in `line`, ignoring anything inside a string literal.+    private static func braceDelta(in line: String) -> Int {+        var delta = 0+        var inQuote = false+        var escaped = false+        for character in line {+            if escaped {+                escaped = false+            } else if character == "\\" {+                escaped = true+            } else if character == "\"" {+                inQuote.toggle()+            } else if !inQuote, character == "{" {+                delta += 1+            } else if !inQuote, character == "}" {+                delta -= 1+            }+        }+        return delta+    }++    // MARK: - The pins++    @Test("MermaidRenderer.renderInternal still calls WindowAttachmentValidator.reattachIfNeeded before rendering")+    func mermaidRendererRevalidatesBeforeRender() throws {+        let source = try Self.productionSource("Services/MermaidRenderer.swift")+        let body = try Self.functionBody(named: "renderInternal", in: source)++        #expect(+            body.contains("reattachIfNeeded("),+            """+            renderInternal must revalidate the attached window via \+            WindowAttachmentValidator.reattachIfNeeded before every render (T-2133). \+            Without this, a WebView left attached to a closed iPad scene's window \+            keeps rendering against it, and JavaScript execution silently fails or \+            times out. The helper's own detach/reattach behaviour is covered live by \+            WindowAttachmentValidatorTests' reattachIfNeeded tests in WebViewPoolTests.swift.+            """+        )+    }++    @Test("WebViewPool.getOrCreateWebView still calls WindowAttachmentValidator.reattachIfNeeded before reuse")+    func webViewPoolRevalidatesBeforeReuse() throws {+        let source = try Self.productionSource("Services/WebViewPool.swift")+        let body = try Self.functionBody(named: "getOrCreateWebView", in: source)++        #expect(+            body.contains("reattachIfNeeded("),+            """+            getOrCreateWebView must revalidate a pooled WebView's window via \+            WindowAttachmentValidator.reattachIfNeeded before reuse (T-2133). Without \+            this, a pooled WebView attached to a closed iPad scene's window is handed \+            back unchanged, producing blank snapshots or timeouts in the still-open \+            scene. The helper's own detach/reattach behaviour is covered live by \+            WindowAttachmentValidatorTests' reattachIfNeeded tests in WebViewPoolTests.swift.+            """+        )+    }++    // MARK: - The isolation helper itself++    /// `functionBody(named:in:)` is the whole mechanism here, so its edges+    /// are pinned directly — the same discipline+    /// `ImageMaterializationChokepointTests.rulesCatchTheSpellingsThatUsedToSlipPast`+    /// applies to its own rules.+    @Test("functionBody isolates only the named function, ignoring string-literal braces, comments, and same-prefixed functions")+    func functionBodyIsolatesOnlyTheNamedFunction() throws {+        let source = """+        struct Example {+            func targetFallback() {+                print("decoy, must not hijack the match for `target`")+            }++            func before() {+                let s = "not { part of before }"+            }++            func target(x: Int) -> Int {+                if x > 0 {+                    return x // reattachIfNeeded( in a comment, must not survive stripping+                }+                return 0+            }++            func after() {+                print("after")+            }+        }+        """++        let body = try Self.functionBody(named: "target", in: source)++        #expect(body.contains("func target("))+        #expect(body.contains("return x"))+        #expect(!body.contains("reattachIfNeeded("))+        #expect(!body.contains("decoy"))+        #expect(!body.contains("before"))+        #expect(!body.contains("after"))+    }+}

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex bb517458..00b2a68d 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0  ### Fixed +- On iPad, Mermaid and SVG rendering no longer silently fails or times out in a second scene after the scene it first rendered in has been closed (T-2133). The hidden WebViews used for offscreen rendering attached to a scene's window once, at creation, and never checked whether that window was still part of a connected scene before reusing it; closing the original scene left them attached to a dead window while the app kept trying to render through it. Both the mermaid renderer and the shared WebView pool now revalidate that attachment before every render and re-attach to a currently connected scene's window when it has gone stale. - An image that is tiny as a file but enormous as a picture can no longer exhaust memory or terminate Prism, whether it comes from the web, from a file beside the document, or written directly into the markdown (T-2132, T-2149, T-2151, T-1867). A picture is stored compressed, and a plain-coloured one compresses at about a thousand to one — so a 400 KB download can be a 20,000 by 20,000 image that needs about 400 MB the moment anything tries to display it, and four times that if it is in colour. Prism's limits were all written on the wrong side of that: a 50 MB cap on the download said nothing about the picture inside it, and the 2 MB cap on a local SVG was applied only after the whole file had already been read, so a very large one could freeze the app on its way to being refused. The limits that did exist covered only images fetched from the web; the same image referenced from a file next to your document, or embedded inline in the markdown, went straight to the renderer unchecked. Prism now reads the picture's dimensions from its header — a few bytes, before anything is decoded — and decides from that. An ordinary image is displayed as before. A very large one referenced from the web or from a file is scaled down to fit. One beyond any reasonable size is refused outright and shows the usual "Image failed to load" placeholder, rather than being handed to a decoder that would have to build the whole thing first. How large a picture is now also accounts for how much detail each dot of it carries: most pictures store one byte per colour, but some store two or four, and Prism previously assumed the smaller size for all of them and so under-counted the deep ones by half or three quarters. One consequence you may see: a very large deep-colour photograph that used to display at full size is now scaled down, because its true size was always above the limit and is now measured as such. Files are now read up to their limit instead of read whole and then measured — including the copy Prism keeps of a document you have not saved yet, which is restored when the app reopens. How much decoding happens at once is limited by how much memory those pictures actually need rather than by how many of them there are, so a page full of large images no longer overruns while appearing to stay within its bounds. Two things behave differently, both deliberately. An image whose file does not say how big it is, or what kind of dots it stores, now shows the "Image failed to load" placeholder instead of being displayed — there is no way to know what it would cost until it has already cost it. And an image written directly into the markdown is treated more strictly than the same image kept in a file beside the document: it is either small enough to display as it is or refused, never scaled down. That difference is about memory rather than effort. Scaling a picture that is written into the markdown means rebuilding it and writing the smaller version back into the page, where it then stays for as long as the document is open — which costs more memory, for longer, than not showing it. A picture in a file has somewhere else to keep its smaller version, so it can be scaled instead of refused. Animated images are unaffected in either case: they play as before, however many frames they have. - A verification scan that starts during the app's initial entitlement bootstrap can no longer publish a stale result while a newer scan is still in flight (T-2152). While `entitlementState` was still `.loading`, any scan's result was accepted regardless of whether a more recent scan — for example one started right after `AppStore.sync()` — was still reading the world; the older scan finishing first could briefly flip the paywall to locked (or unlocked) ahead of the newer, more current answer. An older result that arrives while a newer scan is still outstanding is now held back rather than published. If the newer scan goes on to answer, its fresher result is published and the held-back one is simply dropped; if instead it is cancelled without ever answering, the held-back result is released, so a cancelled scan cannot leave the paywall stranded on `.loading`. The trade is that the brief loading state now ends when the last overlapping scan answers rather than the first, so it can last marginally longer; every control it gates is disabled meanwhile, so nothing silently does nothing. - Saving a pasted document to a file no longer disturbs whatever document you opened next (T-2213). A save finishes in two parts: the file is written straight away, but the document only becomes that file once its notes have been moved across, and on a slow iCloud connection that second part can still be running after you have closed the document or opened another one. When it finished late, it acted on the document then on screen instead of the one it had saved: the pasted text of that other document was deleted from the place Prism keeps unsaved documents — so it could no longer be recovered after a relaunch — its entry in Recent Files was labelled with the wrong document's title, and an action you had queued behind its own Save prompt could run without you confirming it. A save that failed to move its notes also raised an alert naming a file you were no longer looking at. Each of these now belongs to the document that was actually saved, and the document on screen is left alone. Its Recent Files entry is labelled with its own title rather than the other document's. Where that other document had itself started saving in the meantime, the late save no longer takes over the shortcut that document had prepared for its own file, which can leave the saved file without a Recent Files entry of its own. The file is saved either way, and can be opened from the Files app.