Repair inherited AI request ownership and offline generation/state defects #154

Describe the bug
The v4.2.0 integration review found four retained AI issues that predate this upstream merge. They are NOT fixed by rejecting explicit cloud token-truncated responses. This issue records the remaining risk rather than claiming an AI-wide safety audit passed.

A2 — High: proofread/translate/custom callbacks retain no originating editor generation, request identity or source range. InputLogic uses its reusable current connection in the callback; helpers post completion to Main after the worker is finished. Cancelling an already-finished coroutine does not invalidate that queued callback. A late result can therefore replace text or move selection in a different editor, or use a newer request's shared original text.

A3 — High: offline ProofreadService starts prediction before collecting the global replay-zero SharedFlow. The flow's extra buffer does not retain events when no subscriber exists; fast Done/Error can be lost and leave collection waiting. DROP_OLDEST also permits token loss under backpressure. Event/request ownership must be made explicit, not patched by an arbitrary delay or timeout.

A4 — Medium: offline getTargetLanguage returns literal English and setTargetLanguage is a no-op. Dedicated/Advanced selectors reinitialize from it and reset to English despite correctly persisted French; the toolbar uses persisted preferences, and plugin translation consumes the hardcoded getter. Local llama translation reads a different stored display-name preference and is not affected identically.

A5 — Medium: offline proofreading logs complete input, prompt, generated text and final output unconditionally. These are Android diagnostic logs, not an assertion of public access, but unnecessary retention of typed content should be removed or explicitly guarded.

To Reproduce
These paths are source-confirmed at integration 70ae2c7; deterministic failing-before production-path fixtures remain to be written.

• Hold request A's Main callback, switch editor or start B, then release A. No mutation or selection change may occur on B.
• Use a fake LlamaHelper event source through the real prediction/collection seam that emits Done/Error immediately, and a controlled slow collector for token ordering.
• Select French in offline translation settings, recreate the screen, then inspect both the displayed choice and language received by the plugin.
• Perform offline generation with diagnostic log capture and verify ordinary builds do not log typed or generated content.

Expected behavior

• Every editor mutation validates a request-local editor generation and unchanged source/range on Main; finish-input/cancel/new requests invalidate queued success AND error callbacks.
• Subscribe before generation, keep request-local terminal delivery and ordered non-dropping output, and prevent obsolete jobs from cancelling or publishing into later requests.
• One authoritative target-language representation drives both selectors, plugin calls and local model prompts without overwriting existing values merely by opening settings.
• No unconditional full-content logging.
  Preserve flavor boundaries and actual translation-engine fallback behavior. Do not add INTERNET to offline/lite or substitute a plugin-only engine for bundled llama.

Screenshots
N/A — asynchronous editor/event/preference fixtures.

App version & Flavor
Retained fork behavior, reviewed in v4.2.0 integration 70ae2c7. A2 affects AI-capable flavors; A3–A5 concern offline paths. Offlinelite has no AI.

Device Info

• Model: no device reproduction claimed for this review.
• OS version: not established; exact deterministic regression reproduction is part of the follow-up.