fix: review pass on v0.9.2 features + render-notice and interruption bugs

Downloads:
- WebKit emits failed THEN finished: flag the failure so finished can't
  toast a false 'Saved' or import a truncated file into the library
- dedupe destination as name-1.ext (WebKit's EEXIST cleanup would delete
  the user's previous file); library import runs off the worker thread
  (large files no longer freeze the engine); 'Downloading...' toast;
  sweep *.wkdownload/zero-byte leftovers at startup; destination fallback
  and absolute-path guard; import detection by response MIME / %PDF-
  magic, not only the file extension
- library.h: dir fsync after rename, per-point errno, 0-byte reject,
  UTF-8-safe name cap, O_NOFOLLOW, absolute-dir check; tests for the
  failure paths, uniqueDownloadName, forcedExt, uuid fuzz

TLS continue-anyway (hardened after review):
- tls-continue now requires a real tap (m_expectUserNav — all taps here
  are synthetic JS, WebKit gesture APIs never fire) and the one-shot
  m_tlsErrorHost armed by the TLS failure itself; a foreign page can no
  longer open the IGNORE window
- the IGNORE window now closes on cancelled superseded loads too, and on
  WebProcess termination; m_tlsContinueKick disarmed on failure
- repeat visits to an approved host flip IGNORE at the decision (no
  second tap); the never-painting proceed path is gone for good

Rendering:
- blank-check flags 'failed to render' only when the load never painted
  anything (m_firstContentLogged); a transient white frame late in the
  load (SPA re-render / anti-adblock hiccup) no longer whites out the
  page under the notice
- 'Frame load interrupted' (policy error 102: superseded or
  download-converted load) is swallowed like CANCELLED — a double-tapped
  Go no longer fakes 'site won't load', and downloads stop flashing an
  error page under the toast
- B&W fast mode: single-pass fused grayscale+LUT conversion (~200 ms off
  every frame on this CPU); RMWEB_BW_HOOK=0 debug escape hatch; the
  presentFast hook measured faster than the QPA auto waveform and stays
- new debug: RMWEB_DUMP_FRAMES=/dir dumps engine frames as PNG

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: exp78

CLAUDE.md

@@ -401,12 +401,26 @@ xochitl restarts WITH XOVI.
 properly (see the Phase 7 Batch 2 form-filling entry above, 2026-07-25); the rest of the Batch 2 claims
 stay erroneous, and the project is a **beta, not release-ready**. Full audit: `docs/review-2026-07-18.md` (HIGH#1).
 
-**2026-09-11 — downloads → library + TLS continue-anyway (v0.9.2 candidates, NOT device-verified yet):**
+**2026-09-11 — downloads → library + TLS continue-anyway (v0.9.2, device-verified 2026-09-16):**
 PDF/EPUB downloads now self-register in the xochitl store (`engine/wpeqt/library.h`: UUIDv4 stem +
 `<uuid>.{pdf,epub,metadata,content}` — metadata last, it's the registration marker; xochitl rebuilds
 the rest on its post-quit restart). Timestamps are ms-epoch strings; `visibleName` = basename w/o ext.
+PDFs are forced to the download path (decide-policy): this build's PDF.js would render inline, but the
+native xochitl reader wins on this CPU. Downloads dedupe as `name-1.ext` (WebKit's EEXIST cleanup would
+otherwise DELETE the user's previous file), and `failed` is flagged so the trailing `finished` signal
+(WebKit emits both) can't toast a false "Saved" or import a truncated file.
 TLS: `load-failed` gets TLS errors with domain `g-tls-error-quark` (WPE 2.48.5 has NO WEBKIT_TLS_ERROR
 quark — verified against the source tree, not the docs); detected via quark-name substring. The error
-page offers `rmweb:tls-continue` which whitelists ONLY the current page's own host in a session-scoped
-`m_tlsBypass` set (the command carries no host, so a foreign page can't whitelist another origin), then
-re-navigates via `load_uri` with `m_expectUserNav` armed (the auto-refresh guard would eat it otherwise).
+page offers `rmweb:tls-continue`, gated on: current URI is https, host matches the one-shot
+`m_tlsErrorHost` (armed by the TLS failure itself), and a real tap gesture (`m_expectUserNav` — all
+taps here are synthetic JS, so WebKit's own gesture APIs never fire). The bypass = flipping the session
+tls-errors-policy to IGNORE for that one load, restoring FAIL on any settle (finished/failed/cancelled/
+web-process-terminated). NB: the WebKit "proceed" override (return TRUE from load-failed-with-tls-
+errors) loads but NEVER paints the document — device-verified three rounds; that's why the policy flip.
+**2026-09-16 — blank-check false positive fixed:** the render check now flags "blank" only if the load
+NEVER painted content (`m_firstContentLogged`). Before, a single transient white frame late in the load
+(SPA re-render / anti-adblock hiccup — ixbt whites out for a beat at ~+11 s with our filter on) reset
+`m_lastNonWhite` and the check whited out the whole page under the notice. Also: `Frame load
+interrupted` (WebKit policy error 102 — a superseded/download-converted load, not a failure) is now
+swallowed like CANCELLED instead of showing an error page (double-tapped Go used to fake "site won't
+load"; downloads flashed an error page under the toast). Frame-dump debug: RMWEB_DUMP_FRAMES=/dir.

engine/wpeqt/library.h

@@ -41,6 +41,26 @@ inline bool isDocumentFile(const std::string &path) {
     return e == "pdf" || e == "epub";
 }
 
+// A download destination that never clobbers an existing file: "name.ext" -> "name-1.ext",
+// "name-2.ext", ... WebKit's EEXIST failure path DELETES the pre-existing file (WebKitDownload.cpp
+// cleanDownloadFiles), so uniqueness matters — overwrite is not an option. Pure POSIX (access F_OK)
+// -> host-unit-testable.
+inline std::string uniqueDownloadName(const std::string &dir, const std::string &name) {
+    if (access((dir + "/" + name).c_str(), F_OK) != 0) return name;
+    std::string stem = name, ext;
+    const size_t dot = name.find_last_of('.');
+    if (dot != std::string::npos && dot > 0) {   // no dot, or dot==0 (".pdf") -> whole name is the stem
+        stem = name.substr(0, dot); ext = name.substr(dot);
+    }
+    for (int i = 1; i < 1000; ++i) {
+        const std::string cand = stem + "-" + std::to_string(i) + ext;
+        if (access((dir + "/" + cand).c_str(), F_OK) != 0) return cand;
+    }
+    // Saturated (>=1000 collisions): last-resort timestamp suffix.
+    return stem + "-" + std::to_string(std::chrono::duration_cast<std::chrono::milliseconds>(
+        std::chrono::system_clock::now().time_since_epoch()).count()) + ext;
+}
+
 // Minimal JSON string escaping (quotes, backslash, control chars) — the project has htmlEscape for
 // markup but no JSON escaper, so this tiny local one covers the single interpolated JSON value.
 inline std::string jsonEscape(const std::string &s) {
@@ -94,44 +114,56 @@ inline bool mkdirs(const std::string &dir, std::string *err) {
     }
     return true;
 }
+// fsync the containing directory so a rename inside it survives a power cut (same best-effort tail
+// as profile.h's atomicWrite — kept local to stay glib/Qt-free).
+inline void fsyncDirOf(const std::string &path) {
+    std::string dir = path;
+    const size_t slash = dir.find_last_of('/');
+    if (slash == std::string::npos) dir = "."; else if (slash == 0) dir = "/"; else dir.erase(slash);
+    const int dfd = open(dir.c_str(), O_RDONLY);
+    if (dfd >= 0) { (void)fsync(dfd); close(dfd); }
+}
 // Chunked binary copy src -> dst with the same atomicity model as atomicWrite (tmp + fsync +
 // rename, byte-count verified). The payload can be tens of MB, so it is NOT slurped into memory.
+// O_NOFOLLOW on the tmp: a planted symlink must not redirect the write. errno is recaptured at the
+// exact failing call, so the message names the real cause.
 inline bool copyFileAtomic(const std::string &dst, const std::string &src, std::string *err) {
     const std::string tmp = dst + ".tmp";
     const int in = open(src.c_str(), O_RDONLY);
     if (in < 0) { if (err) *err = "open " + src + " failed: " + std::strerror(errno); return false; }
     struct stat st {};
     const bool haveSize = fstat(in, &st) == 0;
-    const int out = open(tmp.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    const int out = open(tmp.c_str(), O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0644);
     if (out < 0) {
         if (err) *err = "open " + tmp + " failed: " + std::strerror(errno);
         close(in);
         return false;
     }
-    bool ok = true;
+    int failErr = 0;
+    const char *failWhat = nullptr;
     long long total = 0;
     char buf[1 << 16];
     for (;;) {
         const ssize_t n = read(in, buf, sizeof buf);
         if (n < 0 && errno == EINTR) continue;
-        if (n < 0) { ok = false; break; }
+        if (n < 0) { failErr = errno; failWhat = "read"; break; }
         if (n == 0) break;
         for (ssize_t off = 0; off < n;) {                 // write(2) may be partial
             const ssize_t w = write(out, buf + off, static_cast<size_t>(n - off));
             if (w < 0 && errno == EINTR) continue;
-            if (w <= 0) { ok = false; break; }
+            if (w <= 0) { failErr = errno; failWhat = "write"; break; }
             off += w;
         }
-        if (!ok) break;
+        if (failWhat) break;
         total += n;
     }
-    const int savedErr = errno;
-    if (ok && fsync(out) != 0) ok = false;
-    if (close(out) != 0 && ok) ok = false;
+    if (!failWhat && fsync(out) != 0) { failErr = errno; failWhat = "fsync"; }
+    if (close(out) != 0 && !failWhat) { failErr = errno; failWhat = "close"; }
     close(in);
-    if (ok && haveSize && total != static_cast<long long>(st.st_size)) ok = false;   // truncated copy
-    if (!ok) {
-        if (err) *err = "copy " + src + " -> " + dst + " failed: " + std::strerror(savedErr);
+    if (!failWhat && haveSize && total != static_cast<long long>(st.st_size)) failWhat = "truncated copy";
+    if (failWhat) {
+        if (err) *err = "copy " + src + " -> " + dst + " failed (" + failWhat + ")" +
+                        (failErr ? std::string(": ") + std::strerror(failErr) : std::string());
         std::remove(tmp.c_str());
         return false;
     }
@@ -144,17 +176,23 @@ inline bool copyFileAtomic(const std::string &dst, const std::string &src, std::
 }
 } // namespace detail
 
-// Import srcPath (a finished download) into the xochitl store at xochitlDir. Returns false with a
+// Import srcPath (a finished download) into the xochitl store at xochitlDir. forcedExt, when
+// non-empty ("pdf"/"epub"), overrides the extension gate and the payload suffix — for downloads
+// whose filename has no extension but whose MIME/magic says document. Returns false with a
 // human-readable *err on any failure (no exceptions escape); on a mid-way failure every file it
 // already wrote is unlinked again, so a retry starts clean. Each import mints a fresh UUID, so it
 // never clashes with (or overwrites) an existing library document.
 inline bool importDocument(const std::string &xochitlDir, const std::string &srcPath,
-                           const std::string &visibleName, std::string *err) {
+                           const std::string &visibleName, std::string *err,
+                           const std::string &forcedExt = {}) {
     auto fail = [err](const std::string &m) { if (err) *err = m; return false; };
-    if (!isDocumentFile(srcPath)) return fail("not a pdf/epub: " + srcPath);
-    const std::string ext = lowerExt(srcPath);
+    if (xochitlDir.empty() || xochitlDir[0] != '/') return fail("xochitl dir not absolute: " + xochitlDir);
+    std::string ext = forcedExt.empty() ? lowerExt(srcPath) : forcedExt;
+    for (auto &c : ext) c = char(std::tolower(static_cast<unsigned char>(c)));
+    if (ext != "pdf" && ext != "epub") return fail("not a pdf/epub: " + srcPath);
     struct stat st {};
     if (stat(srcPath.c_str(), &st) != 0) return fail("source not readable: " + srcPath);
+    if (st.st_size == 0) return fail("empty file: " + srcPath);
     if (!detail::mkdirs(xochitlDir, err)) return false;
 
     const std::string uuid = makeUuidV4();
@@ -165,10 +203,26 @@ inline bool importDocument(const std::string &xochitlDir, const std::string &src
     auto cleanup = [&] { std::remove(payload.c_str()); std::remove(contentF.c_str()); std::remove(metadataF.c_str()); };
 
     if (!detail::copyFileAtomic(payload, srcPath, err)) return fail(err ? *err : "copy failed");
+    detail::fsyncDirOf(payload);   // make the payload rename durable, like atomicWrite's dir fsync
 
-    // visibleName: no control chars (profile.h sanitize), capped (a title bar is narrow), never empty.
+    // visibleName: no control chars (profile.h sanitize), capped (a title bar is narrow) WITHOUT
+    // splitting a UTF-8 multi-byte sequence at the cut, never empty.
     std::string name = sanitizeField(visibleName);
-    if (name.size() > 120) name.resize(120);
+    if (name.size() > 120) {
+        name.resize(120);
+        // Back off to a UTF-8 boundary: skip continuation bytes, then if the byte before them is a
+        // lead byte whose sequence was cut by the cap, drop that lead byte too. (Continuation bytes
+        // of a COMPLETE trailing sequence are never touched: that sequence's lead sits before them
+        // with its full length available.)
+        size_t k = name.size();
+        while (k > 0 && (static_cast<unsigned char>(name[k - 1]) & 0xC0) == 0x80) --k;
+        if (k > 0) {
+            const unsigned char lead = static_cast<unsigned char>(name[k - 1]);
+            const size_t need = lead < 0x80 ? 1 : lead < 0xE0 ? 2 : lead < 0xF0 ? 3 : 4;
+            if (name.size() - (k - 1) < need) --k;
+        }
+        name.resize(k);
+    }
     if (name.empty()) name = "download";
 
     const long long nowMs = std::chrono::duration_cast<std::chrono::milliseconds>(