Harden scanner input, build safety, offline recovery and cancellable OCR

[senegrom]

Scope

These fixes target browser-scanner only, not master. Native fixes are already merged in PR #19 as cb0819f and are included here. The original app PR #18 remains separate. Concurrent scanner changes through 9ea64d8 have been reconciled and preserved, including guided review, grid-artifact rejection, stricter nested validation and their regression suites.

Fixed

• Validate dimensions before allocation and validate boxes/nested fields before rendering or persistence. Invalid imports preserve the current board; invalid saved sessions recover safely. Scan settings are snapshotted and results validated before committing state, including automatic type detection.
• Build in an isolated staging directory; publish only after success. Refuse source/Git/ancestor paths, symbolic output links and unowned existing directories. Failed builds retain the last good output. Older unmarked _site directories must be moved aside once rather than deleted automatically.
• Use the same digest verifier for asset fetching, offline readiness and preparation. Corrupt cached entries are evicted/refetched; invalid network responses never become ready. Interrupted/evicted caches report not ready. Verified online responses remain usable when storage quota is exhausted.
• Own OCR workers from initialization onward. Stop terminates children even during pending language loading; late progress cannot masquerade as cancellation acknowledgement. Posting errors clean up and preserve the original exception. Keep whole-task and per-worker deadlines.
• Separate task, history, camera/photo and offline responsibilities; format first-party code. Reuse grayscale and move threshold/region preparation to the image worker, including the concurrent patch's stroke/corner exclusion.
• Add shared JS/Python payload fixtures and real-browser PR coverage, not just deployment-time tests.

Exact solving is unchanged

No weaker cage approximation, removed matching/guarantee deduction, reordered solver queue or added puzzle branching. PR #19's exact partition generator is stack-safe; unlimited parallel searches observe failures from outstanding required branches while positive caps retain their original deterministic prefix semantics.

Final PR validation — all checks passed

Final clean head: 44aefb720ddac794d1c1f88409890132a2997609.

CI run 34062413331: Python 3.14.7 660 passed on Linux, 658 passed on Windows, with 32 slow tests deselected on each. The two additional Linux parameters exercise forkserver. Clean-wheel imports and actual installed CLI solves passed on both platforms, as did compilation and dependency validation.

Forward-compatibility run 34062413365 passed for Python 3.14 free-threaded and Python 3.15 prerelease.

Browser PR run 34062413342 passed the combined Python suite, JavaScript unit/lifecycle tests, module parsing, self-hosted build, and both actual Chromium/mobile-WebKit acceptance suites. The latter use real Python and OCR WebAssembly, not substituted solver/OCR results.

Retained independent evidence

Combined reconciliation run 34062123312 also passed. benchmarks/review3_browser.json records 27 checks per engine: all eleven puzzle families, malformed imports/autosaves, cancellation during real language initialization followed by a fresh scan, poisoned-cache recovery, and offline reload/solve/recognition with the origin server stopped. No page errors or external runtime requests were observed. Both engines read all 30 baseline clues correctly with no corrections; WebKit still conservatively flags two correct clues.

benchmarks/review3_recognition.json retains additional generated baseline/serif/shifted/perspective-shadow/4x4 fixtures plus guided review and blank-photo checks. These are generated fixtures, not a representative real-world photo benchmark. Native baseline comparisons retain identical root deductions, complete solution sets and branch counts; both Killer cases still need zero backtracking.

The 32 slow tests, full long-running corpora and physical-phone camera/installation behaviour are outside this run's scope. No universal speedup is claimed.

All temporary application scripts and write-enabled verification workflows are removed from the final diff. Permanent test CI retains read-only contents permissions.