Re-audit round: an aborted edit script had silently dropped half a
prior fix, so each item here is grep-verified in the report trail.
- identity reset now actually drains the credential sync queue and
epoch-tags in-flight callbacks so account A's completing upload
cannot become account B's state; an empty partition resets every
account-scoped setting (locale, recents, agent settings, theme)
instead of inheriting the previous account's; rebuilt persistence
baselines go through the CredentialLoad seams so settings keep
saving and unsupported snapshots stay fail-closed after a switch
- mutation admission is one helper shared by the REST push and /mcp:
write tools take a WritePass (read tools stay free) and refuse with
a proper tools/call error once shutdown closes the barrier; the
write drain escalates to a 60s hard cap with blocked-writer logging
instead of flushing past active writers at 10s
- a runtime-rejected ingest restores the thumbnail registry snapshot
captured before install (vendor/jian gains the restore_snapshot
counterpart), so a rejected document's thumbnails no longer stay
active locally
f3ea6e8c99