fix(web): prevent history entries with mismatched URL/entity

When navigating between pages, the router updates location before the
old component unmounts. This caused the history tracking effect to
re-run with stale entityId/entityType props but a new URL, creating
corrupted entries like "Machine learning" pointing to /works/W123.

Changes:
- use-user-interactions: Validate URL matches entityType/entityId before
  recording history entry (skip if URL doesn't contain entity path)
- catalogue-db: Filter out entries where stored entityType doesn't match
  URL path in getHistory(), catching existing corrupted entries

Author: Mearman

apps/web/src/hooks/use-user-interactions.ts

@@ -245,6 +245,20 @@ export const useUserInteractions = (options: UseUserInteractionsOptions = {}): U
     if (autoTrackVisits && entityId && entityType) {
       const trackPageVisit = async () => {
         try {
+          // Validate URL matches current entity to prevent race conditions during navigation
+          // When navigating from entity A to entity B, location updates before component unmounts,
+          // which could cause recording entity A with entity B's URL
+          const currentUrl = location.pathname + serializeSearch(location.search);
+          const urlMatchesEntity = currentUrl.includes(`/${entityType}/`) && currentUrl.includes(entityId);
+          if (!urlMatchesEntity) {
+            logger.debug(
+              USER_INTERACTIONS_LOGGER_CONTEXT,
+              "Skipping history record - URL doesn't match entity (navigation race condition)",
+              { entityId, entityType, currentUrl }
+            );
+            return;
+          }
+
           // Debounce: skip if same entity was recorded recently
           const now = Date.now();
           if (
@@ -254,8 +268,6 @@ export const useUserInteractions = (options: UseUserInteractionsOptions = {}): U
             return;
           }
 
-          const currentUrl = location.pathname + serializeSearch(location.search);
-
           // Only pass displayName if it matches the current entityId
           // This prevents race conditions where a stale displayName is stored
           const safeDisplayName = displayNameEntityRef.current === entityId ? displayName : undefined;

packages/utils/src/storage/catalogue-db.ts

@@ -1097,6 +1097,9 @@ export class CatalogueService {
       C: "/concepts/",
     };
 
+    // Non-entity pages that shouldn't be validated against entity patterns
+    const nonEntityPatterns = ["/about", "/settings", "/history", "/bookmarks", "/catalogue", "/search"];
+
     return entities.filter((entity) => {
       if (entity.entityId.length === 0) return false;
       if (entity.entityId.includes(CORRUPTED_ENTITY_ID_PATTERN)) return false;
@@ -1105,15 +1108,28 @@ export class CatalogueService {
       if (entity.notes?.includes(CORRUPTED_ENTITY_ID_PATTERN)) return false;
       if (entity.notes?.includes(urlEncodedPattern)) return false;
 
-      // Validate entityId matches URL path (detect mismatch like Work ID with Author URL)
+      // Validate entityId/entityType matches URL path (detect race condition mismatches)
       const urlMatch = entity.notes?.match(/URL: ([^\n]+)/);
       if (urlMatch) {
         const url = urlMatch[1];
+
+        // Skip validation for non-entity pages
+        const isNonEntityUrl = nonEntityPatterns.some(pattern => url.includes(pattern));
+        if (isNonEntityUrl) {
+          return true;
+        }
+
+        // Validate entityType matches URL path
+        // This catches race conditions where entity A's props were recorded with entity B's URL
+        const entityTypeUrlPath = `/${entity.entityType}/`;
+        if (!url.includes(entityTypeUrlPath)) {
+          return false;
+        }
+
+        // Also validate entityId matches URL path for prefixed IDs
         const entityPrefix = entity.entityId.charAt(0).toUpperCase();
         const expectedPath = entityPrefixToPath[entityPrefix];
-        // If we have a known prefix and URL doesn't match expected path, filter it out
-        // Skip validation for non-entity pages like /about, /settings
-        if (expectedPath && !url.includes(expectedPath) && !url.startsWith("/about") && !url.startsWith("/settings")) {
+        if (expectedPath && !url.includes(expectedPath)) {
           return false;
         }
       }