Post-merge review fixes for #40: unreachable German strings, weakened tests, tier-collapse doc drift

[kipp-ing]

Post-merge review of PR #40 (German localization + Supporter-Unlock tier collapse), and the fixes for everything it found.

The review ran as a 6-dimension fan-out — tier-collapse semantics, catalog wiring, format/plural integrity, Siri phrase localization, test integrity, and repo policy — with every candidate finding routed through an adversarial verifier before it was acted on. 20 candidates, 14 confirmed, 6 refuted, 11 distinct defects after dedup (three dimensions independently found the same plural).

Fixed — localization that never resolved at runtime

• PhotoAlbumPickerView — the limited-access pool row rendered the model's hardcoded English SourceCollection.title, so the "Ausgewählte Fotos" entry added in German localization + Siri phrases (300), on the 1100 Supporter-Unlock tier collapse #40 only ever appeared when pool enumeration failed. The row now shows and persists the localized name. Row identity moves off the display label onto the sentinel collection ID, which also fixes a latent bug: identity was the label, so a rename would have made an already-added pool look un-added.
• AlbumPickerView.subtitle — the photo count was concatenated into a plain String, leaving the 1 photo / %lld photos German plurals unreachable.
• PurchaseViewModel.failureMessage — a bare English String with no catalog entry, rendered verbatim under an already-translated title. Now resolves against .module (a package's strings do not live in the app bundle); German added.

Fixed — tests that had stopped testing

• refreshIgnoresTipsAndRevokedTransactions asserted against a revoked and a live transaction for the same product, so it passed whether or not isRevoked was honoured — while still claiming @covers FR-1100-12. Split into a revoked-only case (grants nothing) and a live-alongside-revoked case (still grants).
• FrameIntentGlueTests compared String(localized:) against English literals; those strings gained German in German localization + Siri phrases (300), on the 1100 Supporter-Unlock tier collapse #40, so a de_DE run would go red. Locale pinned to English, keeping the assertions about the contract wording rather than the runner's language.

Fixed — copy and docs

• The iOS money pledge still said "the unlocks" (plural) post-collapse, with the German translated from the stale plural. Now word-for-word the tvOS string, so both platforms share one catalog entry.
• Four code comments asserted an English-only policy retired on 2026-07-23, each sitting directly above code that localizes.
• docs/manual-verification.md — the T042 ASC checklist, the one remaining 1100 task, still asked for "Family Sharing ON for the three non-consumable unlocks" and "Buy Automation". The sibling quickstart.md §5 had the identical sentence corrected by German localization + Siri phrases (300), on the 1100 Supporter-Unlock tier collapse #40; the two are back in step as T041 requires.
• docs/spec-overview.md, CLAUDE.md, docs/where-the-money-goes.md (the declared canonical source of the string this PR changes), specs/300-slideshow/spec.md (amendment banner + FR-300-30 + US7 + Roadmap), specs/800-app-intents/spec.md, and contracts/uitest-seams.md.
• docs/handover-release-prep.md marked historical — everything in its "Deferred" list has since shipped.

Refuted under adversarial check

Worth recording, because these were the high-stakes hypotheses:

• No claw-back. A stale two-tier snapshot genuinely fails to decode, but nil → EntitlementSet.none is the specified contract, tested at EntitlementSnapshotCacheTests.swift:166, and no unlock.pro transaction can exist — nothing has shipped publicly, and FR-1100-13 binds from first public release.
• Dropped legacy product ids — same reasoning.
• --uitest-entitlements reachable in a Release build — refuted on five independent checks; the production path only diverges under the launch argument, and the seam writes to a throwaway defaults suite.

Known gaps, now documented rather than papered over

ProductID.uiSlug is genuinely untested — no XCUITest references unlock.price.supporter or unlock.buy.supporter. The contract now says so plainly instead of requiring an assertion that does not exist.

Gates

• PurchaseKit host suite: 106 passed / 0 failed
• Full iOS suite (iPad Pro 11-inch (M4)): 163 passed / 0 failed / 5 skipped — the 5 skips are the ASC-screenshot, live-smoke, and 3 device-rig items
• Also confirms BrokerSetupUITests: testExistingBrokerPrefillsFieldsMasksPasswordAndRemoves fails on main — 'broker.username' never appears #21 BrokerSetupUITests and ShareSheetIncomingUITests: testIncomingLinkPrefillsSetupWhenUnconfigured is order-dependent — passes alone, fails in the full suite #22 ShareSheetIncomingUITests now pass; the CLAUDE.md note calling them open failures was itself stale and has been corrected

https://claude.ai/code/session_01XWbnBdWdcjnCH5smD6X1Ai