fix: resolve opensource review findings

[k-undurkhaan-2]

Summary

• Harden the v2 persistence, import, restore, migration, backup, reset, and interrupted-session paths against stale writes, revision rollback, tombstone ABA, malformed snapshots, and partial legacy migration.
• Fix suite, listening, reading, vocabulary, browse, and lazy-loading races, including trusted placeholder handshakes, exact suite window ownership, multi-suite submissions, grouped answer replay, stale async rendering, cache invalidation, import safety, and keyboard accessibility.
• Correct targeted generated reading metadata/explanations and improve the reading/listening migration tooling.
• Replace the ineffective Vitest entrypoint with the repository's native test runner, broaden CI discovery, harden Windows/E2E runners, and regenerate all production bundles.

Why

The review found several independent paths where stale asynchronous work or incomplete identity checks could overwrite newer state, revive deleted data, lose practice progress, misroute suite completions, or render an outdated UI. Other defects came from legacy migration assumptions, unsafe imported markup, generated-data mismatches, and test files that were not actually exercised by the configured unit-test command.

The changes preserve the project's existing IndexedDB-first data contract, suite message protocol, generated bundle workflow, and graceful degradation rules while adding explicit conflict, ownership, identity, and latest-wins checks.

User and developer impact

Users get safer restore/reset behavior, durable interrupted sessions, reliable suite and replay navigation, correct vocabulary scheduling, safer imports, and consistent behavior under rapid navigation or multi-window use. Developers get regressions for the repaired edge cases, complete test discovery, more deterministic E2E execution, and bundle drift detection.

Validation

• JavaScript test entrypoint: 72/72 passed
• Python unittest discovery: 20/20 passed
• Static/browser aggregate suite: 138/138 passed
• Unified E2E runner: 8/8 passed
• Final Chromium suite practice flow: passed
• Production bundles: 14/14 current
• git diff --check: passed
• Commit ba62cb574488b878aa766ba25bd60a9d152eab33: verified OpenPGP good signature

Known non-blocking debt

• The bundle checker still reports eight pre-existing allowlisted global-symbol collisions.
• Reading explanation coverage still has historical source-content gaps; the quality report now surfaces them without fabricating missing content.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba62cb5744

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[k-undurkhaan-2]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 54c246acfb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".