Redline: OneDrive folder transport as alternative to AirDrop (MMDB-2631) #23

2026-09-05T05:30:40Z

kua-agent commented

2026-09-05 05:30:40 +00:00

Backlog: MMDB-2631 (app redline). Requirement, verbatim (Ben, 2026-09-05 08:40 Dubai): "add onedrive to the app in any case".

What changed and why

Redline could only send the review PDF to the iPad via AirDrop. Windows has no AirDrop, and a folder inside the OneDrive sync root gives the same round trip on both platforms: the PDF is saved into the folder, the iPad opens it from Files > OneDrive and marks it up in place, OneDrive syncs it back, and the same folder is watched for the marks.

Settings gains a "Send via" control: AirDrop (default, unchanged) or OneDrive folder.
OneDrive mode auto-detects ~/Library/CloudStorage/OneDrive-* (MMD root first) and uses <root>/Redline; Choose… overrides it. Outbox and watch folder are both that folder. AirDrop folder overrides are stored separately and restored untouched when switching back.
Send in OneDrive mode writes the PDF (temp + atomic rename), archives the session, and reports "Saved to OneDrive — N pages. Open it in Files on your iPad." No AirDrop sheet. An existing-but-unwritable or missing folder refuses with a clear message and keeps the captures.
Unmarked PDFs in that folder are not shown as returned (ReturnWatcher.recordUncommented = false in OneDrive mode); a file marked up in place is recorded on the next scan.
Menu row reads "Send to OneDrive" in OneDrive mode.
New Core types: SendTransport, TransportSettings, OneDriveLocator, TransportSettings.resolvedAppSupportPaths(); new error oneDriveFolderUnavailable.

Review findings fixed before merge (adversarial review by a separate agent)

BLOCKER: after a relaunch with OneDrive selected the watcher still watched the AirDrop folder. Fixed: launch paths come from the transport-aware resolver and bootstrap() re-points the watcher before starting it; two regression tests plus a relaunch sub-step in the self-test.
MAJOR: unwritable folder bypassed the OneDrive error. Fixed with a writability check and a chmod 500 test.
MAJOR: transport switch racing an in-flight send. Fixed: transport and folder snapshotted before any await; switching is refused while a send runs.
MINOR: hardcoded sync-root path in the self-test, test-name typo, unordered reconcile tasks (generation counter).

Gates run (real output)

swift build: Build complete.
swift test: Test run with 118 tests in 1 suite passed (builder run and coordinator re-run).
./scripts/build-app.sh: signed with the existing Apple Development identity, no prompts.
Self-test chain on the built app: PICKER-SELFTEST PASS, REGION-PERSIST PASS, SEND-TRUTH PASS, UPDATE-SELFTEST PASS, ONEDRIVE-SELFTEST PASS.
ONEDRIVE-SELFTEST ran against the real OneDrive sync root; folders Redline-selftest-20260905-0900xx…0929xx under OneDrive-MMDGROUP each hold the produced PDF, and Microsoft Graph lists them cloud-side in Ben's OneDrive (transport proven end to end Mac → OneDrive cloud).
Offscreen renders (SHOTDECK_SNAPSHOT_DIR) of Settings in AirDrop mode, OneDrive mode, OneDrive-missing state, and the menu with "Send to OneDrive" were looked at by the coordinator; one layout defect (wrapped "not found" text) fixed.

Not verified

The real iPad round trip (open in Files > OneDrive, mark up, sync back, Mac shows it as returned) has not been run by an agent; the return path is proven only by an in-place PDFKit ink annotation on the file, which is what the iPad does at file level.
No Windows build exists; this PR is Mac only.

🤖 Generated with Claude Code

https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

Backlog: MMDB-2631 (app redline). Requirement, verbatim (Ben, 2026-09-05 08:40 Dubai): "add onedrive to the app in any case". ## What changed and why Redline could only send the review PDF to the iPad via AirDrop. Windows has no AirDrop, and a folder inside the OneDrive sync root gives the same round trip on both platforms: the PDF is saved into the folder, the iPad opens it from Files > OneDrive and marks it up in place, OneDrive syncs it back, and the same folder is watched for the marks. - Settings gains a "Send via" control: AirDrop (default, unchanged) or OneDrive folder. - OneDrive mode auto-detects `~/Library/CloudStorage/OneDrive-*` (MMD root first) and uses `<root>/Redline`; Choose… overrides it. Outbox and watch folder are both that folder. AirDrop folder overrides are stored separately and restored untouched when switching back. - Send in OneDrive mode writes the PDF (temp + atomic rename), archives the session, and reports "Saved to OneDrive — N pages. Open it in Files on your iPad." No AirDrop sheet. An existing-but-unwritable or missing folder refuses with a clear message and keeps the captures. - Unmarked PDFs in that folder are not shown as returned (`ReturnWatcher.recordUncommented = false` in OneDrive mode); a file marked up in place is recorded on the next scan. - Menu row reads "Send to OneDrive" in OneDrive mode. - New Core types: `SendTransport`, `TransportSettings`, `OneDriveLocator`, `TransportSettings.resolvedAppSupportPaths()`; new error `oneDriveFolderUnavailable`. ## Review findings fixed before merge (adversarial review by a separate agent) - BLOCKER: after a relaunch with OneDrive selected the watcher still watched the AirDrop folder. Fixed: launch paths come from the transport-aware resolver and `bootstrap()` re-points the watcher before starting it; two regression tests plus a relaunch sub-step in the self-test. - MAJOR: unwritable folder bypassed the OneDrive error. Fixed with a writability check and a chmod 500 test. - MAJOR: transport switch racing an in-flight send. Fixed: transport and folder snapshotted before any await; switching is refused while a send runs. - MINOR: hardcoded sync-root path in the self-test, test-name typo, unordered reconcile tasks (generation counter). ## Gates run (real output) - `swift build`: Build complete. - `swift test`: Test run with 118 tests in 1 suite passed (builder run and coordinator re-run). - `./scripts/build-app.sh`: signed with the existing Apple Development identity, no prompts. - Self-test chain on the built app: PICKER-SELFTEST PASS, REGION-PERSIST PASS, SEND-TRUTH PASS, UPDATE-SELFTEST PASS, ONEDRIVE-SELFTEST PASS. - ONEDRIVE-SELFTEST ran against the real OneDrive sync root; folders `Redline-selftest-20260905-0900xx…0929xx` under OneDrive-MMDGROUP each hold the produced PDF, and Microsoft Graph lists them cloud-side in Ben's OneDrive (transport proven end to end Mac → OneDrive cloud). - Offscreen renders (`SHOTDECK_SNAPSHOT_DIR`) of Settings in AirDrop mode, OneDrive mode, OneDrive-missing state, and the menu with "Send to OneDrive" were looked at by the coordinator; one layout defect (wrapped "not found" text) fixed. ## Not verified - The real iPad round trip (open in Files > OneDrive, mark up, sync back, Mac shows it as returned) has not been run by an agent; the return path is proven only by an in-place PDFKit ink annotation on the file, which is what the iPad does at file level. - No Windows build exists; this PR is Mac only. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

kua-agent added 12 commits 2026-09-05 05:30:40 +00:00

feature(core): OneDrive transport settings, locator, and watcher recordUncommented flag 299d55e884

Adds SendTransport/TransportSettings (UserDefaults-backed, mirrors FolderSettings)
and OneDriveLocator, which finds a OneDrive-* sync root under
~/Library/CloudStorage and resolves the Redline send/watch folder inside it
(MMD-named roots preferred). TransportSettings.effectiveFolders() is the one
function that combines the transport choice with FolderSettings/OneDriveLocator.

ReturnWatcher gains recordUncommented (default true, today's AirDrop behaviour):
when false, a document with zero human marks is neither recorded into the
ledger nor returned by scanNow. This is needed because in OneDrive mode the
outbox and watch folder are the same folder, so a freshly written, unmarked
PDF must not be treated as a return — only a later, actually marked-up save
of the same file should be.

Adds ShotdeckError.oneDriveFolderUnavailable(path:) for when the OneDrive
folder is missing or unwritable at send time.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

feature: OneDrive folder as a second send transport 6449c72b3b

send(anchor:) now branches on TransportSettings.transport(). OneDrive mode
skips AirDrop entirely: it verifies the resolved OneDrive folder exists right
before composing (never trusts stale state), archives the session immediately
after the PDF lands, and sets "Saved to OneDrive — N page(s). Open it in Files
on your iPad." AirDrop's existing behaviour, including handleDidFailToShareItems,
is untouched and only reached from the .airDrop branch.

AppModel seeds outbox/watch from TransportSettings.effectiveFolders() instead
of FolderSettings.resolve() directly, tracks the live `transport`, and
bootstrap() creates the OneDrive folder and sets the watcher's
recordUncommented flag (true only for AirDrop) before the watcher starts.

Settings gets a "Send via" segmented picker above Folders. AirDrop shows the
existing watch/output rows; OneDrive shows a single read-only OneDrive folder
row (Choose... reuses the existing directory picker) plus one caption
explaining the same-folder round trip, or a "No OneDrive folder found" prompt
when nothing resolves (Choose... stays usable). Switching transport re-points
the watcher's folder and recordUncommended live; AirDrop's own folder
overrides are stored separately and are untouched by a OneDrive-and-back
round trip.

Menu's "Send..." row reads "Send to OneDrive" when that transport is active.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

test: OneDrive transport settings/locator unit tests + ReturnWatcher recordUncommended coverage 78cc7d5b1a

TransportSettingsTests: default airDrop, set/get round-trip, garbage stored
value falls back to airDrop, oneDriveFolder store/reset, effectiveFolders for
both transports, oneDriveFolderUnavailable's errorDescription contains the path.

OneDriveLocatorTests: fake home tree under Library/CloudStorage — syncRoots
returns only real OneDrive-* directories (ignores a same-named plain file and
a GoogleDrive-* one), MMD-named root sorts first; no CloudStorage dir means
empty roots and a nil defaultRedlineFolder; resolveOneDriveFolder prefers an
existing stored override and falls back to the default when the stored path
no longer exists. All against temp dirs, never the real home.

ReturnWatcherTests: recordUncommended defaults to true and still records an
unmarked PDF (existing AirDrop tests are unaffected); with it set false, an
unmarked PDF is neither recorded nor returned by scanNow, and marking it up
in place with a real PDFKit ink annotation then re-scanning does record it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

selftest: ONEDRIVE-SELFTEST phase, proven against the real OneDrive sync root 80a128b667

New phase chained after UPDATE-SELFTEST (so a full SHOTDECK_PICKER_SELFTEST
chain now prints all five PASS lines) and also runnable standalone via
REDLINE_SELFTEST_PHASE=onedrive, since the harness has no other per-phase
selector.

Points TransportSettings at a NEW "Redline-selftest-<Dubai timestamp>" folder
under the real /Users/.../OneDrive-MMDGROUP sync root (never a fake home tree
— that proves the transport against the actual OneDrive file provider), drives
a seeded session through the OneDrive branch of send(anchor: nil), asserts the
PDF landed, the session archived, and the status starts with "Saved to
OneDrive", then confirms the watcher does NOT report the fresh unmarked PDF
as returned. It then adds a real PDFKit ink annotation to that PDF in place —
what the iPad does — saves it, and confirms the watcher now reports it as
commented. Prints "ONEDRIVE-SELFTEST PASS path=<folder>". Never deletes
anything under OneDrive; the created folder and PDF are left in place.

UserDefaults.standard's transport/oneDriveFolder keys are snapshotted and
restored around the phase, the same pattern runRegionPersistPhase already
uses for CaptureRegion — there is no separate defaults-suite threading
through AppModel/send(), so this is the only way to drive the real send()
path without leaving the real app pointed at the selftest folder afterward.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: correct recordUncommented test names (were misspelled "commended") 2937d2d5e0

Two @Test descriptions and function names in ReturnWatcherTests.swift used
"recordUncommended" (commended, as in praised) instead of "recordUncommented"
(commented, as in has a comment) — a typo introduced when the tests were
added. The actual public API (ReturnWatcher.recordUncommented,
setRecordUncommented) was already spelled correctly everywhere; only these
two test names/descriptions needed fixing.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

feature: model-owned resolvedOneDriveFolder + OneDrive Settings/menu panel snapshots 209921f084

SettingsView's OneDrive row called OneDriveLocator.resolveOneDriveFolder()
directly with the real UserDefaults.standard and the real home directory,
which made that row impossible to drive from a fake/isolated environment.
Moved that resolution into AppModel as a tracked resolvedOneDriveFolder
property (nil means "no OneDrive folder found"), refreshed at init,
bootstrap, chooseTransport, chooseOneDriveFolder, and inside send()'s live
folder check. SettingsView and chooseOneDriveFolder's picker-start path now
read model.resolvedOneDriveFolder instead of calling OneDriveLocator
directly — state flows through the model like everything else in this app.

PanelSnapshot (SHOTDECK_SNAPSHOT_DIR) adds three panels on a SEPARATE
isolated model so the transport switch never bleeds into the six existing
AirDrop-mode panels:
- panel-07-settings-onedrive.png: transport=oneDrive with a resolved folder,
  built by pointing OneDriveLocator.defaultRedlineFolder at a fake home tree
  (Library/CloudStorage/OneDrive-MMDGROUP under this snapshot's own temp
  root) so the displayed path is shaped like the real default without ever
  touching the real home.
- panel-08-settings-onedrive-missing.png: a fake home with no
  Library/CloudStorage at all, resolved through a throwaway UserDefaults
  suite (never .standard) so the "no OneDrive folder found" state and its
  still-usable Choose... button are exercised for real.
- panel-09-captures-present-onedrive.png: 3 captures + transport=oneDrive,
  confirming the menu row reads "Send to OneDrive".

Extracted the 3-swatch capture seeding (panel 04) into addSampleCaptures(to:)
so panel 09 reuses it instead of duplicating the loop.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix(core): transport-aware launch paths + writable-folder check (adversarial review) 20de467e87

BLOCKER fix, Core half: adds TransportSettings.resolvedAppSupportPaths(),
the transport-aware equivalent of the AirDrop-only
FolderSettings.resolvedAppSupportPaths() — launch code must use this one so
the ReturnWatcher it feeds is never seeded with a stale AirDrop folder while
OneDrive is the persisted transport. Both now share a single
AppSupportPaths.standardRoot() helper for the ~/Library/Application
Support/Shotdeck root, instead of computing it three separate times.

MAJOR fix, Core half: adds OneDriveLocator.isWritableDirectory(at:) — exists
+ isDirectory is not enough; an existing-but-unwritable folder (permissions
revoked) must be treated as unavailable, not silently attempted and surfaced
as a generic PDF-composition failure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: BLOCKER — launch model uses transport-aware paths; bootstrap reconciles watcher folder unconditionally ef0d8712f7

AppDelegate.makeLaunchModel() built `paths` via the AirDrop-only
FolderSettings.resolvedAppSupportPaths(), so ReturnWatcher's internal
watchFolder (seeded from paths.watchFolder in its own init) was the AirDrop
folder even when OneDrive was the persisted transport, and bootstrap() never
reconciled it before starting. Net effect: on every relaunch with OneDrive
selected, PDFs went to OneDrive but FSEvents kept watching the stale AirDrop
folder for the whole session — marked-up returns were never detected.

Fix: makeLaunchModel() now calls TransportSettings.resolvedAppSupportPaths()
(single source of truth for the transport-folder mapping); made internal
(not private) with an optional appSupportRoot override so
PickerSelfTest's relaunch-simulation sub-step can call the exact same
function against a temp root instead of the real Application Support folder.
bootstrap() now unconditionally calls watcher.updateWatchFolder(watchFolderURL)
before watcher.start() (belt-and-suspenders reconciliation, even though the
paths fix alone already makes this a no-op in the normal case), and sets
recordUncommented before start as it already did.

Regression tests proving this land in the same PR (ReturnWatcherTests.swift):
one characterizing the old bug's exact construction still missing a marked
OneDrive-mode return, one proving the fixed launch-construction path detects
it end to end. The ONEDRIVE-SELFTEST phase also gains a relaunch sub-step
using this same makeLaunchModel() function.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: MAJOR — send() race between concurrent transport switch and an in-flight send bd11ba96c5

Two issues: (1) directoryExists(at:) only checked existence + isDirectory, so
an existing-but-unwritable OneDrive folder skipped the
oneDriveFolderUnavailable branch and surfaced as a generic pdfCompositionFailed
message instead — now uses OneDriveLocator.isWritableDirectory(at:). (2)
send() read `self.outboxURL` again inside composePDFForSend() after at least
one await had already run, so a concurrent chooseTransport() call
(SettingsView.swift) could flip transport/outboxURL/recordUncommented
mid-send, landing the PDF under one transport's folder while the
archive/status branch ran the other's.

Fix: send() now snapshots BOTH transport and the destination folder into
local `let`s once, before any await, and passes the folder explicitly into
the renamed composePDFForSend(outbox:) — which no longer reads
self.outboxURL at all. The archive/status switch already used the frozen
`transport` local. (chooseTransport/chooseOneDriveFolder additionally refuse
outright while isSending is true — see the SettingsView.swift commit — so in
practice this race can no longer even be triggered, but the snapshot is the
actual structural fix regardless.)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: refuse transport changes mid-send; generation-guard rapid toggling; one-line "not found" row 6484fde530

MAJOR: chooseTransport/chooseOneDriveFolder now refuse (status "Finish the
current send first.") while isSending is true, closing off the send-vs-
transport-switch race at the UI entry point (SendController.swift's commit
in this same series is the structural fix underneath).

MINOR: both functions spawned unstructured `Task { }` calls to
watcher.setRecordUncommented/updateWatchFolder; rapid toggling could apply
an earlier, superseded call's folder/flag after a later one had already won.
Fixed with a monotonically increasing `reconcileGeneration` counter
(AppModel.swift) bumped synchronously before each Task starts; the Task
checks its own snapshot against the live value before every mutating step
(not just once via Task.isCancelled), so the LAST choice always wins.
Verified via ONEDRIVE-SELFTEST's new rapid-toggle sub-step (this branch's
PickerSelfTest.swift commit), which proves the watcher ends up watching the
folder from the last chooseTransport call.

Design fix (Ben, panel-08 review): the "No OneDrive folder found — sign in to
OneDrive or choose a folder." value text wrapped over four lines, making that
row tall and ragged next to Choose…. The value column now reads exactly "Not
found" (secondary colour, one line, same as the truncated-path style), and
the explanation moves to the caption below: "No OneDrive folder found. Sign
in to OneDrive, or choose a folder." When a folder IS resolved the caption is
unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: MINOR — ONEDRIVE-SELFTEST resolves the real sync root at runtime; adds relaunch + rapid-toggle sub-steps 8121738188

realOneDriveSyncRoot was a hardcoded /Users/benjaminhippler/... literal.
Now resolved via OneDriveLocator.syncRoots().first at runtime (MMD-named
root still preferred, matching production); when no OneDrive sync root
exists at all, prints "ONEDRIVE-SELFTEST SKIP no OneDrive sync root" and
exits non-zero — never a false PASS.

Adds two sub-steps to the same phase, both required by the BLOCKER fix's
review: (1) rapid transport toggling (chooseTransport(.airDrop) immediately
followed by chooseTransport(.oneDrive)) must still end with the watcher
watching the OneDrive folder — proves the generation-guarded reconcile in
SettingsView.swift really lets the last choice win. (2) relaunch simulation
— OneDrive still persisted from sub-step 1, a FRESH model built via the
exact same AppDelegate.makeLaunchModel() function real launch uses (now
internal + an appSupportRoot override for this purpose, temp-rooted so this
never touches the real ~/Library/Application Support/Shotdeck), bootstrapped,
then a PDF marked up in place — the relaunched watcher must report it. This
is the exact BLOCKER scenario the review flagged, proven end to end.

Factored the ink-annotation and unmarked-PDF-writing code into
addInkMark(to:)/writeUnmarkedRedlinePDF(to:) so both new sub-steps and the
original markup check share it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

test: launch-paths BLOCKER regression + isWritableDirectory unit tests 70231574c9

ReturnWatcherTests.swift: two new tests bracket the BLOCKER fix — one
characterizes the old bug (FolderSettings.resolvedAppSupportPaths(), AirDrop-
only, ignores the persisted OneDrive transport; the watcher ends up watching
a stale isolated folder and misses a marked PDF dropped into the real
OneDrive-mode folder), the other proves the fix (the exact launch/bootstrap
construction — TransportSettings.resolvedAppSupportPaths() +
watcher.updateWatchFolder() before start — detects it). Both isolated to
temp dirs, including an explicit FolderSettings watch-folder override so the
"bug" test's found.isEmpty assertion never depends on what's actually in
Ben's real ~/Downloads (it does, in fact, already contain real marked-up
Redline PDFs from prior testing — an earlier version of this test read the
REAL Downloads folder and failed for exactly that reason).

TransportSettingsTests.swift: three tests for
OneDriveLocator.isWritableDirectory — true for an ordinary directory, false
for one chmod'd 500 (permissions restored in teardown before removal), false
for a plain file and for a nonexistent path.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

kua-agent added 5 commits 2026-09-05 05:55:37 +00:00

fix(core): File Provider write probe — OneDriveLocator.probeWritable(at:) 723cd7dcea

isWritableDirectory (permissions bits) is not enough: a OneDrive
Files-On-Demand directory whose provider domain is signed out can report as
existing and POSIX-writable while an actual write fails. probeWritable
writes a small ".redline-probe-<uuid>" file into the folder via
AtomicFile.write (open+write+fsync+rename+directory-fsync), then removes it;
any failure at write, fsync, or removal means false.

Three unit tests: an ordinary writable directory (true, and no probe file
left behind), a chmod 500 directory (false; permissions restored in
teardown), and a plain file path (false).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: send() probes real writability before composing; write/rename failures map to oneDriveFolderUnavailable d7984add2d

send()'s OneDrive pre-flight check now also calls OneDriveLocator.probeWritable(at:)
alongside isWritableDirectory — closing the File Provider edge case where a
signed-out OneDrive domain reports its folder as existing and writable while
a real write fails.

composePDFForSend(outbox:transport:) now takes the frozen transport too (not
just the folder): a write/rename failure specifically at the destination
folder — Darwin.rename, AtomicFile.fsyncDirectory, or the post-write
existence check — is reported as ShotdeckError.oneDriveFolderUnavailable
instead of the generic pdfCompositionFailed when transport is .oneDrive.
composer.compose()'s own session/image-content failures are left as generic
pdfCompositionFailed regardless of transport — those aren't about the
destination folder.

Also: send() now `await`s `pendingReconcileTask` (AppModel.swift, set by
chooseTransport/chooseOneDriveFolder in SettingsView.swift) before
snapshotting transport/folder, closing the toggle-then-immediate-send race —
without this, a Send issued right after a transport toggle could run before
the watcher's recordUncommented flag finished catching up.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix: store pendingReconcileTask handle; skip real Carbon hotkey binding on self-test runs 04d1e73532

AppModel gains pendingReconcileTask (the most recent watcher-reconcile Task
spawned by chooseTransport/chooseOneDriveFolder), which send() now awaits —
see the SendController.swift commit in this series. chooseTransport/
chooseOneDriveFolder store their Task's handle into it instead of firing an
untracked `Task { }`.

bootstrap() now also skips binding the real, process-wide Carbon global
capture hotkey on the same env-var-flagged self-test/headless runs that
already skip the update-check schedule (PickerSelfTest's phases,
PanelSnapshot, and the new ShotdeckTests launch-wiring regression test).
Real Carbon hotkey registration is not safe to exercise in an automated test
process — it can collide with ShotdeckCoreTests' own
HotkeyCenterCarbonTests running in the same test binary — and bootstrap()'s
hotkey step had never actually been exercised by any self-test before (none
of them call bootstrap() directly) until the new real-wiring test in this
series does. A real user launch never sets these env vars, so production
behavior is unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

test(selftest): ONEDRIVE-SELFTEST sub-step 1c — toggle immediately followed by Send 8d68c836cd

Adds a third rapid-toggle assertion alongside the existing folder-reconcile
check: chooseTransport(.airDrop) immediately followed by
chooseTransport(.oneDrive), with NO sleep, then an immediate send(anchor: nil)
— proving send() correctly awaits the pending reconcile Task
(SendController.swift/AppModel.swift in this series) rather than racing
ahead with a stale recordUncommented flag. Asserts the freshly-sent,
still-unmarked PDF is never itself reported as an already-returned document.

Also updates composePDFForSend's call site for its new transport: parameter.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

test: add ShotdeckTests target — real launch/bootstrap wiring regression (coverage gap) 3abb8dc6ca

The Core-level regression tests added for the launch-paths BLOCKER
(ReturnWatcherTests.swift) hand-replicate what AppDelegate.makeLaunchModel()
and AppModel.bootstrap() do, rather than calling them — a future revert of
either would not fail `swift test`. Neither lives in ShotdeckCore, so
ShotdeckCoreTests cannot reach them; this new test target depends on the
Shotdeck executable target itself and uses @testable import (confirmed this
works cleanly with SwiftPM despite Shotdeck's main.swift top-level-code entry
point — no separate main-symbol conflict).

realLaunchModelAndBootstrapDetectAMarkedOneDriveReturn persists
transport=.oneDrive (UserDefaults.standard, snapshot-and-restore — the same
established pattern PickerSelfTest's ONEDRIVE-SELFTEST phase already uses,
since neither of these real call sites has any defaults-threading to plug an
isolated suite into), calls AppDelegate.makeLaunchModel(appSupportRoot: <temp>)
and awaits model.bootstrap() UNMODIFIED, then drops a marked-up Redline PDF
into the temp OneDrive folder and asserts the watcher reports it.

Verified this test actually catches the original blocker: temporarily
reverted makeLaunchModel() to the AirDrop-only resolver, and separately
reverted bootstrap()'s updateWatchFolder reconcile — both reproduce the
failure (the discarded revert is not part of this commit).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

kua-agent referenced this pull request

2026-09-05 06:03:26 +00:00

Redline updater hardening: signed-update verification, atomic install + revert, update visibility, notarization pipeline (MMDB-2681) #24

kua-agent commented

2026-09-05 06:10:13 +00:00

Heads-up: PR #24 (updater hardening) and #25 (release 0.3.0) merged to main on 2026-09-05. Main now changes AppModel.swift, MenuBarView.swift, PickerSelfTest.swift, main.swift and Info.plist (0.3.0). Please rebase this branch onto main before merging; the UPDATE-SELFTEST phase now has four sub-phases that must keep printing their PASS lines.

kua-agent added 2 commits 2026-09-05 06:10:20 +00:00

fix(core): probeWritable(at:) always cleans up the probe file, even on partial failure e1f569cc3e

Two leak paths: (a) AtomicFile.write renames the temp file onto the probe
path and THEN fsyncs the containing directory — if that last fsync throws,
the probe file already exists on disk but the old code returned false
without ever attempting removal; (b) if the explicit removeItem call itself
threw, there was no retry, so a transient File Provider removal failure left
the file behind permanently.

Fix: an unconditional `defer` now checks fileExists and retries removeItem
regardless of which branch returned early. The function only reports true
when the explicit write, fsync (inside AtomicFile.write), AND removal all
succeeded AND the file is confirmed gone afterward.

New test: a FileManager subclass whose removeItem(at:) throws on its first
call (AtomicFile.write itself never touches this injected FileManager — it
uses raw Darwin/POSIX calls, not FileManager, so this only intercepts the
explicit removal + the defer's retry) asserts the function returns false AND
no probe file remains — verified this actually needs the defer by
temporarily removing it and confirming the same test then fails with a
leftover ".redline-probe-<uuid>" file (see this branch's history for the
discarded revert). The directory-fsync failure path has no injectable seam
(raw fsync(2) on an already-open fd, not parameterized by any FileManager or
other substitutable dependency, and not reproducible via chmod or other
standard test techniques) — documented in the test rather than simulated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

fix(test): LaunchWiringTests was empirically vacuous for the makeLaunchModel path 706726a3d4

The reviewer patched main.swift back to FolderSettings.resolvedAppSupportPaths()
(the AirDrop-only resolver) and `swift test --filter LaunchWiringTests` STILL
PASSED, because the only thing the test asserted — model.watchFolderURL — is
computed independently by AppModel.init() via TransportSettings.effectiveFolders(),
not from the `paths` makeLaunchModel() built. bootstrap()'s own unconditional
updateWatchFolder reconcile then papered over the reverted resolver, so the
test only ever proved the bootstrap reconcile, never the launch resolver
itself. The "verified this catches the blocker" claim in the previous
commit was empirically false.

Fix: added ReturnWatcher.currentWatchFolder (public var, actor-isolated —
the folder a watcher is CURRENTLY seeded to scan, readable without calling
scanNow()/updateWatchFolder first). The test now asserts, BEFORE
bootstrap() runs: model.paths.watchFolder/outbox (already internal-visible
via @testable import, no production API change needed there) equal the
OneDrive folder, AND the watcher's currentWatchFolder equals it too — both
of which genuinely depend on what makeLaunchModel() built.

Verified properly this time (both outputs below are verbatim from
`swift test --filter LaunchWiringTests`, main.swift's makeLaunchModel()
temporarily reverted to FolderSettings.resolvedAppSupportPaths() then
restored — the revert itself is not part of this commit):

FAILURE (reverted resolver):
    Expectation failed: (model.paths.watchFolder.path -> "/Users/benjaminhippler/Downloads")
      == (oneDriveFolder.path -> ".../shotdeck-real-wiring-onedrive-<uuid>")
    Expectation failed: (model.paths.outbox.path -> "/Users/benjaminhippler/Desktop")
      == (oneDriveFolder.path -> ".../shotdeck-real-wiring-onedrive-<uuid>")
    Expectation failed: (seededWatchFolder.path -> "/Users/benjaminhippler/Downloads")
      == (oneDriveFolder.path -> ".../shotdeck-real-wiring-onedrive-<uuid>")
    Test ... failed after 0.324 seconds with 3 issues.

PASS (resolver restored):
    Test "Real wiring: AppDelegate.makeLaunchModel() + AppModel.bootstrap()
      detect a marked OneDrive return" passed after 0.295 seconds.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp

kua-agent merged commit eb1af5bf18 into main

2026-09-05 06:17:29 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mmd-it/shotdeck#23