Fence stale feed results and stop guessing at unknown account state

Signing in again keeps the account ID and the context, so a request
already in flight under the previous credential could land afterwards
and write that user's private feed back into the cache and onto disk.
Feed results now carry the account they were requested for and are
dropped if it has moved.

An account with no recorded status was reported as "sign in required".
While the identity scope is unresolved nothing can read the Keychain
under the right scope, so that is the absence of an answer, not one — on
a tokenless or first-seen Apple account it told users with working
logins to sign in again and dropped reads to local data. It is now a
state of its own.

Transport failures mark the account unreachable instead of leaving it
"signed in", which is what the documented local read fallback keys on.
Neither that nor a rejection is overwritten by the Keychain-based
refresh any more: only the server can clear what the server said.

Disabling sync deliberately does not rewrite Keychain items to local.
That means deleting them, and deleting a synchronizable item propagates
to every device — "stop syncing this login" would sign the user out
elsewhere, which is not what the toggle says. The reasoning is recorded
at the call site.

Yattee/Services/SubscriptionFeedCache.swift

@@ -178,6 +178,8 @@ final class SubscriptionFeedCache {
 
     /// Updates the cache with new videos and persists to disk.
     func update(videos: [Video]) {
+        guard isCurrentAccountsResult() else { return }
+
         let oldCount = self.videos.count
         let oldDate = self.lastUpdated
         self.videos = videos
@@ -193,6 +195,8 @@ final class SubscriptionFeedCache {
 
     /// Appends videos to the existing cache (for pagination).
     private func appendVideos(_ newVideos: [Video]) {
+        guard isCurrentAccountsResult() else { return }
+
         let existingIDs = Set(videos.map { $0.id })
         let uniqueNewVideos = newVideos.filter { !existingIDs.contains($0.id) }
         videos.append(contentsOf: uniqueNewVideos)
@@ -210,10 +214,40 @@ final class SubscriptionFeedCache {
     /// Call this when the user switches between local and Invidious accounts.
     func handleAccountChange() {
         LoggingService.shared.info("Subscription account changed, clearing feed cache", category: .general)
+        // Anything already in flight was authenticated as the previous account.
+        // Clearing does not cancel it, and signing in again keeps the same
+        // account ID and context — so without this fence the old request lands
+        // afterwards and writes the previous user's private feed straight back
+        // into the cache, and onto disk.
+        accountGeneration += 1
         clear()
         feedLoadState = .idle
     }
 
+    /// Which account's data the running request belongs to.
+    ///
+    /// Only one refresh runs at a time (every entry point guards on
+    /// `isLoading`), so a single pair of counters is enough to tell "this result
+    /// is for the account we are showing" from "this result is a leftover".
+    private var accountGeneration = 0
+    private var requestGeneration = 0
+
+    /// Marks the start of a request, capturing the account it is for.
+    private func beginRequest() {
+        requestGeneration = accountGeneration
+    }
+
+    private func isCurrentAccountsResult() -> Bool {
+        guard requestGeneration == accountGeneration else {
+            LoggingService.shared.info(
+                "Discarding a feed result that belongs to the previous login",
+                category: .general
+            )
+            return false
+        }
+        return true
+    }
+
     // MARK: - Refresh
 
     /// Refreshes the feed from network.
@@ -229,6 +263,8 @@ final class SubscriptionFeedCache {
             return
         }
 
+        beginRequest()
+
         // The *effective* context, so an account still waiting on its instance
         // or credential falls back to local rather than reporting
         // notAuthenticated while the subscriptions list already shows local data.
@@ -437,6 +473,7 @@ final class SubscriptionFeedCache {
             return
         }
 
+        beginRequest()
         isLoading = true
         feedLoadState = .loadingMore
 

Yattee/Services/Subscriptions/DataContextValidator.swift

@@ -9,6 +9,10 @@ import Foundation
 
 /// Why the selected context cannot be used at the moment.
 enum DataContextUnavailability: Hashable, Sendable {
+    /// Nothing is known yet: the Apple account the credentials are keyed by is
+    /// still being established, so the Keychain cannot be read under the right
+    /// scope. Never render this as "sign in required".
+    case checking
     /// The account exists but its instance hasn't arrived from iCloud yet.
     case instancePending
     /// The account's instance has been switched off. The selection is kept —
@@ -105,6 +109,7 @@ final class DataContextValidator {
 
             switch accountsManager.status(for: id) {
             case .signedIn: return .valid
+            case .checking: return .temporarilyUnavailable(.checking)
             case .credentialMissing: return .temporarilyUnavailable(.credentialMissing)
             case .credentialRejected: return .temporarilyUnavailable(.credentialRejected)
             case .unreachable: return .temporarilyUnavailable(.unreachable)

Yattee/Services/Subscriptions/InvidiousSubscriptionProvider.swift

@@ -38,7 +38,22 @@ final class InvidiousSubscriptionProvider: SubscriptionProvider {
             return
         }
 
-        guard case APIError.unauthorized = error else { return }
+        // A server that cannot be reached says nothing about the credential.
+        // Recorded all the same: the account has to stop reporting itself as
+        // usable, or reads never fall back and the user is shown failures
+        // instead of local data.
+        switch error {
+        case APIError.timeout, APIError.noConnection:
+            accountsManager.setStatus(.unreachable, for: account.id)
+            return
+        case APIError.cancelled:
+            return
+        case APIError.unauthorized:
+            break
+        default:
+            return
+        }
+
         guard accountsManager.instance(for: account)?.usesBasicAuth == false else { return }
 
         accountsManager.setStatus(.credentialRejected, for: account.id)

Yattee/Services/Subscriptions/PipedSubscriptionProvider.swift

@@ -38,7 +38,22 @@ final class PipedSubscriptionProvider: SubscriptionProvider {
             return
         }
 
-        guard case APIError.unauthorized = error else { return }
+        // A server that cannot be reached says nothing about the credential.
+        // Recorded all the same: the account has to stop reporting itself as
+        // usable, or reads never fall back and the user is shown failures
+        // instead of local data.
+        switch error {
+        case APIError.timeout, APIError.noConnection:
+            accountsManager.setStatus(.unreachable, for: account.id)
+            return
+        case APIError.cancelled:
+            return
+        case APIError.unauthorized:
+            break
+        default:
+            return
+        }
+
         guard accountsManager.instance(for: account)?.usesBasicAuth == false else { return }
 
         accountsManager.setStatus(.credentialRejected, for: account.id)