[Borisserz]

Summary

Fixes #320.

• UpdateChecker.check() stamped lastChecked before the GitHub request finished. A failed lookup (offline, timeout, bad payload) still started the 30-minute cooldown, so reopening the popover stayed silent even though no release was seen.
• lastChecked is now recorded only after the release is validated:
  • the release URL is a trusted https://github.com URL, and
  • the tag normalizes to a plain MAJOR.MINOR.PATCH version (optional v/V prefix, surrounding whitespace and leading zeros dropped) via UpdateChecker.normalizedReleaseVersion.
• Malformed tags (latest, v2.5, 2.5.5.1, 2.5.x, release-2.5.5, non-ASCII digits, components that would overflow) and unsupported prerelease/build tags (v2.6.0-beta.1, 2.6.0-rc1, v2.6.0+build.5) are treated as failed checks: nothing is offered, and the next attempt fetches again instead of waiting 30 minutes. Before this, isNewer read non-numeric parts as 0, so a prerelease compared equal to the release and garbage compared as 0.0.0.
• An in-flight guard keeps overlapping popover opens from stacking concurrent requests now that the early stamp is gone.
• The fetch is injectable (fetchLatest:), so tests don't hit the network. Rebased onto current main, which added skip/settingsNotice/defaults. The validated version goes through the existing consider(latest:url:), so skip behaviour is unchanged.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• Other:

Test plan

• testFailedCheckDoesNotStartTheCooldown: a nil fetch does not stamp; the next check fetches.
• testSuccessfulCheckStartsTheCooldownAndAppliesTheRelease: a valid release applies and honours minInterval; the next fetch happens after the cooldown.
• testRejectedReleaseUrlDoesNotStartTheCooldown: an unsafe URL is a failed check.
• testMalformedOrPrereleaseTagIsAFailedCheckAndDoesNotBlockTheNextOne: 16 malformed and prerelease tags. For each: not offered, Settings still says current, and an immediate retry fetches and applies a valid v2.5.5.
• testNormalizedReleaseVersion: prefix, whitespace and leading zeros normalized; prerelease, short and overflowing tags rejected.
• testOverlappingChecksShareOneFetch: a check while one is in flight does not fetch; after it finishes, the next one does.

Fault injection, each reverted afterwards:

• Stamping lastChecked before validation fails the failed-check, malformed-tag and overlap tests.
• Removing tag validation fails the malformed/prerelease test.
• Removing the in-flight guard fails the overlap test.

Results:

• swift test --filter UpdateCheckerTests: 16 passed.
• scripts/test-gate.sh: 1390 tests ran; 1389 pass. The only local failure is SessionKeySettingsRenderingTests, a UI layout test unrelated to this change. On this machine it currently fails even alone on other branches built from main, while it passed in CI on those branches.
• docs/reference/defect-log.md: the entry now covers tag validation.

Checklist

• swift build and swift test pass (CI build-test green; locally all but the unrelated UI flake noted above)
• PR title and description are written in English
• No copyrighted assets, secrets, or private tooling references are committed (see CONTRIBUTING)
• Tests were added or updated for this change

[chattymin]

Please validate and normalize the release tag before recording . A malformed or otherwise unsupported tag must be treated as a failed check so the next attempt is not blocked for 30 minutes. Please add regression coverage for malformed and unsupported prerelease tags, and rebase onto the current main branch.

[chattymin]

Clarification: the timestamp that must only be recorded after successful tag validation is lastChecked.

[Borisserz]

Thanks for the review. Addressed in e6bd4ca (rebuilt on current main):

• lastChecked is recorded only after tag validation. check() now requires a trusted release URL and a tag that normalizes to plain MAJOR.MINOR.PATCH (UpdateChecker.normalizedReleaseVersion: optional v/V, whitespace and leading zeros dropped). Anything else is a failed check: nothing is offered and the next attempt is not blocked for 30 minutes.
• Regression coverage: testMalformedOrPrereleaseTagIsAFailedCheckAndDoesNotBlockTheNextOne runs 16 malformed and prerelease tags (latest, v2.5, 2.5.5.1, v2.6.0-beta.1, 2.6.0-rc1, v2.6.0+build.5, overflowing and non-ASCII digits, …). Each one is not offered, and an immediate retry applies a valid release. testNormalizedReleaseVersion covers the normalizer directly. Each guard was fault-injected to confirm its test fails.
• Rebased onto current main. The validated version flows through the existing consider(latest:url:), so skip/settingsNotice behaviour is unchanged.