fix(app): enforce report-backed quarantine safety

CHANGELOG.md

@@ -29,6 +29,9 @@ All notable changes to Diskern are documented here. The format follows
 
 ### Changed
 
+- Desktop quarantine now uses the exact finding from the completed backend
+  report, with graph-aware verdicts, generation-scoped report authority and
+  fail-closed stale-finding checks; frontend verdict values are never trusted
 - Licensed under MIT
 - Rule patterns are globs rather than substrings, so a rule stays inside
   the directory it names. The Firefox rule covers `cache2` rather than

app/README.md

@@ -30,15 +30,17 @@ a live file counter.
 | --- | --- |
 | `start_scan` | Read-only scan; returns a report, or `null` if cancelled |
 | `cancel_scan` | Stops the scan in flight |
-| `quarantine_finding` | Moves one file to quarantine, re-classifying server-side first |
+| `quarantine_finding` | Moves one exact report finding to quarantine; the backend owns the verdict and rejects stale or superseded report state |
 | `list_quarantine` | Everything currently quarantined, read from the manifest |
 | `restore_quarantined` | Puts one file back where it came from |
 | `purge_quarantine` | Empties quarantine for good — the only deletion in the app |
 
 Everything except `quarantine_finding` and `purge_quarantine` is
 read-only. Quarantine is manifest-backed, so what was moved in one
 session is still restorable in the next; the Quarantine panel renders
-before any scan has been run for exactly that reason.
+before any scan has been run for exactly that reason. A completed scan is the
+user-review snapshot for quarantine: starting or cancelling another scan
+invalidates that snapshot, and a new scan is required before acting again.
 
 ## Updater
 

app/src-tauri/Cargo.toml

@@ -21,3 +21,6 @@ tauri = { version = "2", features = [] }
 tauri-plugin-updater = "2"
 tauri-plugin-dialog = "2"
 tauri-plugin-process = "2"
+
+[dev-dependencies]
+tempfile = "3"