mirror of
https://github.com/yattee/yattee.git
synced 2026-10-23 13:12:53 +00:00
5a77e93558
The accounts.unresolved.* UserDefaults namespace was found on a real device holding a stale, contradictory snapshot: a tombstoned account listed live, context reset to local, every sync outbox still pending. With iCloud Drive off the identity scope dips to unresolved on every foreground activation, so that snapshot was loaded — and rewritten — in an entirely ordinary configuration. Close it off on four fronts: - Gate the unprompted writers. reconcileLegacyAccounts() and migrateLegacyContextIfNeeded() now no-op while the identity scope is unresolved; reloadForCurrentIdentity() re-runs both once a scope resolves, so nothing is lost, and nothing synthesizes accounts or queues uploads under a namespace that answers to no one. - Fence the reload gap. Between a scope change and this manager's observer reloading, namespace already names the new identity while memory still holds the old snapshot. loadedNamespace records what memory belongs to; save(), the stored-context flag, and every coordinator path that builds, enqueues, applies or confirms account-category records refuses when it mismatches. Staged downloads stay durable and re-apply after the reload. - Tie confirmations and conflict retries to the identity that sent them. Every outbound account-category record carries an identityNamespace field; didSave honours only confirmations whose record carries the current identity's stamp, conflict resolutions inherit the local record's stamp and are dropped when foreign, and a skipped confirmation re-registers the durable outbox so nothing strands. The abandoning conflict branches re-register it too. - Purge the stale blob. Once a scope resolves, the unresolved namespace keys and the unresolved credential-fingerprint store are removed; the activation-time validators no longer correct the context or rewrite the legacy selection from unresolved state. Hardened through four adversarial review rounds; the last found nothing.