fix(swift-sdk): only claim "newer build" where the evidence has a direction

A hash disagreement is symmetric — it says the store's shape of an entity is
not the live model's, not which came first. V1/V2/V3 are unfrozen, so adding
one attribute to any live model makes every EXISTING store disagree on that
entity: an older store, reported as a newer one, with "reset the wallet" as
the offered remedy. An unregistered version identifier is ambiguous the same
way (pre-V1, or a version since dropped from the plan). Both become
`.unplaceable`, which rethrows SwiftData's own error. The one asymmetric
fact left — the store carries an entity this schema does not have — keeps
`newerThanRegistered`, and with it the only honest "update the app".

Last round's cancellation fix overshot: latching above the handle guard also
latched on the guard's deliberately uncached no-op return, so a manager built
and shut down before `configure()` could never produce a support export
again. The latch is now as conditional as the state it accompanies — a live
handle, or a pass actually in flight, counted for both halves.

The flag was also polled at only three points, so `shutdown()`'s drain could
wait for the whole-wallet fingerprint, the per-account snapshots and
`logTxoAnomalies` — the stages that dominate the queue hold. Each is gated
now, and the audit's check no longer hides inside `if let allTransactions`,
where it was skipped exactly when the audit had already been declined.

The #4438 audit knew only BIP44 addresses, so a mixed send's own CoinJoin
change was booked as "unattributed" — documented as peers' outputs — and a
CoinJoin-side output missing from PersistentTxo was invisible: a third route
to the false all-clear. The pool now covers CoinJoin accounts, the account
check compares against the account the pool named, and the missing counts
are reported per side.

Also: every early return out of the memory half now emits its
`diff_incomplete=true` summary, since an absent summary reads as a truncated
log; and the export entry point documents that its only caller is the host
app, by design.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: llbartekll

packages/swift-sdk/Sources/SwiftDashSDK/Persistence/DashModelContainer.swift

@@ -73,11 +73,13 @@ public enum DashModelContainer {
         /// lists (every v4.2.0-dev.1 store, until the remaining V1/V2 shapes
         /// are frozen). Inferred migration may open it.
         case driftedRegisteredVersion
-        /// Written by a build this SDK does not know — a version identifier
-        /// it never registered, or an entity its schema lacks. Inferred
-        /// migration would open it and silently drop what the newer build
-        /// wrote, so it must not run; the pre-fallback crash was the safe
-        /// outcome here.
+        /// Positively written by a NEWER build: the store carries an entity
+        /// this schema does not have, which nothing older could have created.
+        /// Inferred migration would open it and silently drop that entity's
+        /// table, so it must not run; the pre-fallback crash was the safe
+        /// outcome here. This is the only verdict the host may turn into
+        /// "update the app", because it is the only one whose evidence has a
+        /// direction — see `unplaceable` for why a hash disagreement does not.
         case newerThanRegistered(reason: String)
         /// The metadata reads but does not place the store against any
         /// registered version: no declared version identifier, or nothing to
@@ -170,12 +172,20 @@ public enum DashModelContainer {
     ) -> StoreSchemaVerdict {
         if matchesRegisteredVersion { return .matchesRegisteredVersion }
 
+        // Nothing to place the store against — every schema failed to build a
+        // model. Not a fact about the store at all.
+        guard !registered.isEmpty else {
+            return .unplaceable(reason: "no_registered_models")
+        }
+
         // SwiftData writes each `VersionedSchema.versionIdentifier` into the
-        // store; one this plan never registered was written by a newer build,
-        // and a store carrying none cannot be placed at all.
+        // store. One this plan does not register places it nowhere, but says
+        // nothing about which side is older: a pre-V1 store and a version
+        // since dropped from `DashMigrationPlan.schemas` look exactly like a
+        // future one from here.
         let registeredIdentifiers = Set(registered.map(\.identifier))
         if let unknown = storeVersionIdentifiers.first(where: { !registeredIdentifiers.contains($0) }) {
-            return .newerThanRegistered(reason: "unregistered_version_identifier=\(unknown)")
+            return .unplaceable(reason: "unregistered_version_identifier=\(unknown)")
         }
         // No identifier at all places the store nowhere. Older stores and
         // stores with truncated metadata land here too, so this is not a
@@ -193,7 +203,9 @@ public enum DashModelContainer {
         }
 
         // An entity the current schema does not have can only have been
-        // written by a newer build; inferred migration would drop its table.
+        // written by a newer build — this is the one asymmetric fact
+        // available here, so it is the one verdict allowed to say "newer".
+        // Inferred migration would drop its table.
         let unknownEntities = Set(storeEntityHashes.keys).subtracting(currentEntities).sorted()
         if !unknownEntities.isEmpty {
             return .newerThanRegistered(
@@ -229,7 +241,16 @@ public enum DashModelContainer {
         guard !unexpectedDrift.isEmpty else {
             return .unplaceable(reason: "no_entity_disagreement")
         }
-        return .newerThanRegistered(
+        // Deliberately NOT `newerThanRegistered`. A hash disagreement is
+        // symmetric: it says the store's shape of that entity is not the live
+        // model's, not which of the two came first. V1/V2/V3 are still
+        // unfrozen (only `PersistentAssetLock` is frozen), so adding one
+        // attribute to any live model makes every EXISTING store disagree on
+        // that entity — an older store, reported as a newer one, with a reset
+        // offered as the remedy. Direction needs evidence this comparison does
+        // not have; until the models are frozen, the honest verdict is that
+        // the store cannot be placed.
+        return .unplaceable(
             reason: "unexpected_entity_drift=\(unexpectedDrift.sorted().joined(separator: "|"))"
         )
     }

packages/swift-sdk/Sources/SwiftDashSDK/PlatformWallet/PlatformWalletManager.swift

@@ -473,11 +473,34 @@ public class PlatformWalletManager: ObservableObject {
     /// must not participate in `ensureSyncNativeOpAllowed`.
     private var activeCoreDiagnosticsNativeOpCount = 0
     /// Set by `shutdown()` before it drains `activeCoreDiagnosticsNativeOpCount`.
-    /// A diagnostic pass checks it before every FFI read, so the drain waits
-    /// for at most the one read already in flight — never for the rest of an
+    /// A diagnostic pass checks it before every stage, so the drain waits for
+    /// at most the one stage already in flight — never for the rest of an
     /// export — and a support export can never outlive the process it is
-    /// diagnosing. Never reset: a manager is shut down once.
+    /// diagnosing. Never reset: a manager is shut down once, and a pass that
+    /// has been told to stop must not be able to un-tell itself.
+    ///
+    /// Which is why `shutdown()` raises it only when there is a real teardown
+    /// or a pass to stop — see the call site. A never-configured manager takes
+    /// an UNCACHED no-op return from `shutdown()` precisely so it can still be
+    /// configured afterwards, and a one-way latch set on that path would
+    /// silence diagnostics for the rest of a perfectly live manager's life.
     let coreDiagnosticsCancellation = CoreDiagnosticsCancellation()
+
+    /// Diagnostic passes in flight, including the SwiftData half that runs
+    /// with no handle at all. `activeCoreDiagnosticsNativeOpCount` cannot
+    /// stand in for this: it counts only admitted FFI work, so it is zero in
+    /// exactly the unconfigured case whose database half still needs to be
+    /// told to stop.
+    private var activeCoreDiagnosticsPassCount = 0
+
+    func beginCoreDiagnosticsPass() {
+        activeCoreDiagnosticsPassCount += 1
+    }
+
+    func endCoreDiagnosticsPass() {
+        guard activeCoreDiagnosticsPassCount > 0 else { return }
+        activeCoreDiagnosticsPassCount -= 1
+    }
     private var nativeOpDrainContinuations: [CheckedContinuation<Void, Never>] = []
 
     /// Admission + bookkeeping shared by the async native entrypoints:
@@ -678,9 +701,18 @@ public class PlatformWalletManager: ObservableObject {
             // configured (`emitCoreWalletDiagnostics` runs its database half
             // with no handle), and the early return below would leave it with
             // no way to be told to stop — holding the queue, and every Rust
-            // persister callback entering through it, across teardown. The
-            // flag is one-way and costs nothing on the no-op path.
-            coreDiagnosticsCancellation.cancel()
+            // persister callback entering through it, across teardown.
+            //
+            // But only as conditionally as the shutdown state it accompanies:
+            // the guard's no-op return is deliberately UNCACHED so a manager
+            // built and shut down before `configure()` can still be configured
+            // later, and this latch is one-way, so raising it there would leave
+            // that live manager unable to produce a support export ever again.
+            // A real teardown, or a pass actually in flight, is the whole set
+            // of cases with something to cancel.
+            if handle != NULL_HANDLE || activeCoreDiagnosticsPassCount > 0 {
+                coreDiagnosticsCancellation.cancel()
+            }
             guard handle != NULL_HANDLE else {
                 // Never configured (or a test double without a handle):
                 // nothing to tear down. Do not cache this no-op: a manager