Reject stale navigation envelopes before shared boundaries

crates/oa-desktop/src/app/allocation_drag.rs

@@ -437,7 +437,29 @@ impl App {
         self.refresh_draft();
         true
     }
+    pub(super) fn allocation_press_owns_current_view(&self, press: &Press) -> bool {
+        self.allocation_drag.active.is_none()
+            && self.allocation_stamp_valid(press.stamp)
+            && press.arrange == self.allocation_drag.arrange_next
+    }
+    pub(super) fn allocation_event_envelope(&self, event: &Event) -> bool {
+        match event {
+            Event::Cancel(token) | Event::Preview(_, token, _) | Event::Release(_, token, _) => {
+                self.allocation_drag
+                    .active
+                    .as_ref()
+                    .is_some_and(|active| active.press.token == *token)
+            }
+            Event::Refused(epoch, _) => *epoch == self.allocation_drag.epoch,
+            // Invalid Press packets deliberately report why the view or draft
+            // changed. Leave their existing validation and feedback intact.
+            _ => true,
+        }
+    }
     pub(super) fn allocation_event(&mut self, event: Event) -> Task<Message> {
+        if !self.allocation_event_envelope(&event) {
+            return Task::none();
+        }
         match event {
             Event::ArrangeNext => {
                 self.allocation_drag.retire();
@@ -475,9 +497,7 @@ impl App {
                 if self.allocation_drag.active.is_some() {
                     return Task::none();
                 }
-                if !self.allocation_stamp_valid(press.stamp)
-                    || press.arrange != self.allocation_drag.arrange_next
-                {
+                if !self.allocation_press_owns_current_view(&press) {
                     self.status = if self.allocation_drag_clean() {
                         "The view changed. Start this drag again.".into()
                     } else {