[dovvnloading]

Summary

Addresses the P1 problems identified in the November 8 Graphite code review without changing main directly.

• Make chat node parsing robust to literal [h...] message text and recover controls if node creation fails.
• Prevent concurrent AI generations and give model-provider requests finite timeouts.
• Keep model-pull dialogs alive until background Qt threads finish; block node deletion during generation.
• Serialize in-progress note/frame edits and retain a deleted active chat as an explicitly unsaved canvas.
• Preserve original chat branches on response regeneration by adding alternate sibling responses rather than overwriting existing nodes.
• Limit generated chart payloads, histogram bins, Sankey sizes, and non-finite values before rendering.
• Correct security disclosure guidance to prefer private vulnerability reports.

Tests

Added tests/test_high_priority_fixes.py with regression coverage for literal header text, UI recovery, branch-preserving regeneration, unsaved editing, active chat deletion, provider timeout use, and chart validation.

Run:

python -m compileall -q graphite_app/graphite_app
QT_QPA_PLATFORM=offscreen python -m unittest discover -s tests -v

Follow-up

• Manual desktop testing is still recommended for slow model downloads, editor focus changes, and chart generation UI behavior.
• API model discovery remains synchronous in Settings and can be moved to a worker in a follow-up PR.

[dovvnloading]

Review completed on head 45babfa5381546d82c04d49194c18e4197666c35. I checked the changed chat/error-recovery, persistence, regeneration lifecycle, provider timeout, chart bounds, and regression-test paths. During review I caught and corrected two additional issues: the background regeneration callback could outlive its temporary context menu; a failed AI response node could leave chat input disabled. Both now have regression coverage. CI for this head passes all 21 tests. No further blocking issues found in the reviewed diff. Follow-up: manual Qt desktop smoke testing and moving synchronous API-model discovery off the UI thread.