Repair inherited AI request ownership and offline generation/state defects

[AsafMah]

Describe the bug
The v4.2.0 integration review found four retained AI issues that predate this upstream merge. They are NOT fixed by rejecting explicit cloud token-truncated responses. This issue records the remaining risk rather than claiming an AI-wide safety audit passed.

A2 — High: proofread/translate/custom callbacks retain no originating editor generation, request identity or source range. InputLogic uses its reusable current connection in the callback; helpers post completion to Main after the worker is finished. Cancelling an already-finished coroutine does not invalidate that queued callback. A late result can therefore replace text or move selection in a different editor, or use a newer request's shared original text.

A3 — High: offline ProofreadService starts prediction before collecting the global replay-zero SharedFlow. The flow's extra buffer does not retain events when no subscriber exists; fast Done/Error can be lost and leave collection waiting. DROP_OLDEST also permits token loss under backpressure. Event/request ownership must be made explicit, not patched by an arbitrary delay or timeout.

A4 — Medium: offline getTargetLanguage returns literal English and setTargetLanguage is a no-op. Dedicated/Advanced selectors reinitialize from it and reset to English despite correctly persisted French; the toolbar uses persisted preferences, and plugin translation consumes the hardcoded getter. Local llama translation reads a different stored display-name preference and is not affected identically.

A5 — Medium: offline proofreading logs complete input, prompt, generated text and final output unconditionally. These are Android diagnostic logs, not an assertion of public access, but unnecessary retention of typed content should be removed or explicitly guarded.

To Reproduce
These paths are source-confirmed at integration 70ae2c7; deterministic failing-before production-path fixtures remain to be written.

• Hold request A's Main callback, switch editor or start B, then release A. No mutation or selection change may occur on B.
• Use a fake LlamaHelper event source through the real prediction/collection seam that emits Done/Error immediately, and a controlled slow collector for token ordering.
• Select French in offline translation settings, recreate the screen, then inspect both the displayed choice and language received by the plugin.
• Perform offline generation with diagnostic log capture and verify ordinary builds do not log typed or generated content.

Expected behavior

• Every editor mutation validates a request-local editor generation and unchanged source/range on Main; finish-input/cancel/new requests invalidate queued success AND error callbacks.
• Subscribe before generation, keep request-local terminal delivery and ordered non-dropping output, and prevent obsolete jobs from cancelling or publishing into later requests.
• One authoritative target-language representation drives both selectors, plugin calls and local model prompts without overwriting existing values merely by opening settings.
• No unconditional full-content logging.
  Preserve flavor boundaries and actual translation-engine fallback behavior. Do not add INTERNET to offline/lite or substitute a plugin-only engine for bundled llama.

Screenshots
N/A — asynchronous editor/event/preference fixtures.

App version & Flavor
Retained fork behavior, reviewed in v4.2.0 integration 70ae2c7. A2 affects AI-capable flavors; A3–A5 concern offline paths. Offlinelite has no AI.

Device Info

• Model: no device reproduction claimed for this review.
• OS version: not established; exact deterministic regression reproduction is part of the follow-up.

[AsafMah]

Local implementation update (not yet pushed or released):

• A2: editor/request/source-range ownership in 0e528460b; 38fe4ab2b adds localized feedback for unreadable/refused editor snapshots and separates same-editor loading cleanup from stale-result rejection.
• A4: persistent target-language reconciliation in 790cd7e2f, exercised through settings recreation, plugin translation and local prompt generation.
• A3: 79d659f3b replaces the lossy global event bridge with request-owned token accumulation and serialized native generation/load/unload. Cancelled delivery is rejected immediately; a blocking native call drains before engine reuse.
• A5: application full-content/exception logging removed, JVM parameter-map diagnostics redacted without changing the JNI payload.

The first targeted runs and follow-up have deterministic failing-before fixtures; the follow-up ran 35 cases per AI-capable flavor with no skipped cases. The integrated offline AI/input/curation selection ran 215 cases with fresh results and no new failures. Exact receipt files are retained locally; ignored/early-returned inherited InputLogic cases are not represented as new executed coverage.

Keep this issue open: native privacy is not fully resolved. The cached io.github.ljcamargo:llamacpp-kotlin:0.4.0 JNI library contains the doCompletion: prompt diagnostic. Public JNI source at https://github.com/ljcamargo/kotlinllamacpp/blob/c292c068bdd258203dd41fc6d0f08578eddd59f3/llamaCpp/src/main/cpp/jni.cpp uses an unconditional Android LOGI call with the prompt. That source is supporting evidence, not an established provenance match for the published AAR. An audited pinned native dependency fix and native/device evidence remain necessary; application-log removal alone does not establish native log privacy. No backend/library substitution was made.

[AsafMah]

Scope update authorized by the maintainer: #155 adopts current upstream plugin-based offline AI and removes the retained bundled llama backend. The earlier instruction in this issue to preserve bundled llama/four flavors is superseded. A3 native-event mechanics are retired with that backend, not a mandate for a private native rebuild. Editor/request delivery guards remain; the upstream language/provider path has direct regression coverage; host proofreading input/output logging stays suppressed. External plugin runtime/privacy behavior is a separate boundary. No new AI repair project is planned. This issue remains open pending integration/triage, not automatic closure.