[ryanbr]

Summary

Addresses #2547. LiveState carries dozens of @Published properties on one ObservableObject, and an ObservableObject invalidates every observer on any published change. So @Published var log woke every view in the app once per appended line, and a history drain plus a re-score burst emits hundreds a minute.

That is the invalidation half of the background CPU kill @pipiche38 reported in #2521. #2546 cut the cost of each invalidation by about two orders of magnitude; this cuts how many there are, to at most four a second however fast lines arrive.

Android has throttled this for a while, via boundedRevision(ble.logRevision, coalesceMs = 250) in TestCentreScreen.kt. Same interval here, so the platforms behave alike rather than iOS being the outlier.

The rule: coalesce the publish, never the capture

log becomes a synchronous computed read over a non-published logBuffer, and a new @Published logRevision is what SwiftUI observes. Reading log therefore still returns the buffer as it is right now, so code that appends and then inspects the log in the same turn sees its own line. That is not hypothetical: AlarmReadbackDecodeTests, BatteryEstimateTraceEmitTests and others assert live.log.contains { ... } immediately after triggering an append, and coalescing the data rather than the notification would have broken them and lost real log lines.

The disk archive and the #990 drained-rows tally stay strictly per line, and the archive write happens before the publish.

Leading edge plus a trailing flush: the first line after an idle gap publishes immediately, so a live log does not sit a quarter second behind, and the last line of a burst always lands rather than waiting for a line that may never arrive.

Why the decision is a separate pure function

logPublishDecision(now:lastPublish:flushQueued:interval:) is a nonisolated static func returning an enum, so the whole policy is pinned by synchronous tests with no clock and no run loop, and the async half is a thin adapter that makes no decisions. The boundary case matters and is covered: elapsed equal to the interval publishes rather than scheduling, otherwise a steady stream at exactly the interval would queue a flush per line and double the work.

Two details that would bite a later edit

The try? on the sleep is not incidental. logFlushQueued is what suppresses every other publish in the window, so the one thing that closure must always do is clear it. A cancelled sleep throws; swallowing it and falling through still clears the flag and publishes. Rewriting it as try await with the error propagating would leave the flag set forever, and the log would keep capturing while the UI silently froze. There is a comment saying so at the site.

Isolation. A static member of a @MainActor type is actor-isolated, so the interval constant is nonisolated in order to be usable as the default argument of the nonisolated decision function. That is the same reason legacyTailKey in the same file carries the keyword, and the same mistake that cost #2546 a CI round trip.

Also

The card now observes logRevision rather than log.count. The revision is monotonic and ticks exactly once per publish; the count plateaus while the ring trims, so it could stay equal across an append and skip a scroll.

Verification

• swiftc -parse and python3 Tools/doc_comment_lint.py: clean. Stated plainly because -parse does not type-check or check isolation, so on a Linux host it is close to no verification for Swift; the macOS leg is the real check and I audited the new symbols for isolation reachability by hand instead.
• 9 new StrandTests cases. Seven pin the pure policy including the boundary, a backward clock, and the never-published sentinel. Two pin the behaviour that matters: that all fifty lines of a burst are readable synchronously, and that those fifty produce one publish rather than fifty. Reverting to a per-line publish turns the second into fifty.
• Surveyed every reader and writer before changing the property: no $log publisher subscribers anywhere, the only writers are inside append(log:), and nothing ever assigned to log, so making it get-only is safe.
• Strand/BLE/** is outside the parity ledger's SWIFT_GLOBS, so no parity entry is expected for the new symbols.

Not done here: moving log off LiveState entirely, the other option in #2547. That would remove the invalidation rather than rate-limit it, but it touches every reader and is a larger change; this one is bounded and matches a shipped Android precedent.