JsonFilePersistenceProvider.LoadStateAsync throws UnauthorizedAccessException for an unreadable state file, while other read failures return null

[matt-edmondson]

What's wrong

JsonFilePersistenceProvider.LoadStateAsync (JsonFilePersistenceProvider.cs#L65-L85) catches JsonException, IOException and ArgumentException. For each of them it returns null, which callers treat as "no saved state".

File.ReadAllTextAsync throws UnauthorizedAccessException when the file exists but can't be read. That exception derives from SystemException, not IOException, so it isn't caught. It escapes through Navigation<T>.LoadStateAsync into the caller.

Why it matters

• docs/Design-Decisions.md promises "Graceful Degradation: Navigation continues if persistence fails".
• The behaviour is also inconsistent. A file locked by another process (IOException) degrades to "no state". A file the user can't read crashes application startup instead. That happens when the file is owned by another account, when its ACLs were tightened, or when a roaming profile copied it with the wrong permissions.

Suggested fix

Add catch (UnauthorizedAccessException) { return null; } alongside the existing handlers.

Acceptance criteria

• A test makes the state file unreadable (chmod 000 on Unix, or a deny ACL on Windows) and asserts that LoadStateAsync returns null.
• Loading through Navigation<T> in that state reports "no state loaded" rather than throwing.

[matt-edmondson]

Triage

• Category: Bug
• Priority: Medium
• Suggested area / assignee: Navigation, persistence (JsonFilePersistenceProvider.LoadStateAsync) (maintainer: @matt-edmondson)
• Duplicates / related: No duplicate. Closed LoadStateAsync with JsonFilePersistenceProvider always throws InvalidOperationException, so saved navigation can never be restored #53 was a different LoadStateAsync failure. No open PR covers it.

Rationale: An unreadable state file crashes application startup, while other read failures degrade gracefully. That contradicts the documented "Graceful Degradation" design. It's an edge case (ACLs, another account's file, roaming profiles), but the consequence is an app that won't start, and the fix is one line.

Suggested next steps: Add catch (UnauthorizedAccessException) { return null; }. Add the chmod 000 / deny-ACL test and the Navigation<T>-level "no state loaded" assertion.

---

Generated by Claude Code