348 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	5e8c6dc7bf	android: detekt — check the link before loading shares, and NoteAccess gets its own file ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:52:21 -04:00
bvandeusenandClaude Opus 5.5	2e7db21b21	android: share a note, and read or edit one shared with you ... The editor's menu has Share…, which opens a sheet of who the note is shared with and lets you add someone at view or edit, change it, or stop sharing; unlinked, it says sharing needs a server. A note shared to view opens read-only; at edit only its text can change. Cards say who shared a note ("From Robin") or that yours is shared, and a view-only note's boxes don't tick. Also: two core store tests used unwrap_err on a Result<Note>, which needs Note: Debug; they use err().expect() now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:42:30 -04:00
bvandeusenandClaude Opus 5.5	aa36b43dc3	core: shared notes on the desktop and phone, and Share from the desktop ... The core pulls with shares from a server offering them (protocol 6): a note says how it is held (owner, edit, view) and who shared it, and a revoked note leaves the device. The first such pull starts the feed over once, so notes shared before this build arrive. The store refuses what a share doesn't allow (view: everything; edit: anything but the text), push sends only the text of someone else's note, and their notes stay out of trash, reminders and reordering. Unlinking drops them. The Share dialog's calls go to the linked server over the device token, as Tauri commands and through the FFI. The desktop now offers Share and "Shared with me"; unlinked, the dialog says sharing needs a server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:33:16 -04:00
bvandeusenandClaude Opus 5.5	75928c7afd	sync: shared notes in the feed, revocations, and text pushes from an edit share ... The change feed answers `?shares=1` with every note the caller can see, each saying how it is held, plus a `revoked` list of notes that left them. Granting a share moves the note past the recipient's cursor; ending one, or the owner deleting the note, leaves a revocation on the same cursor. A recipient at edit may push the note's text, and nothing else. Protocol 6, feature `shares`; opt-in, so the floor stays at 3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:25:13 -04:00
bvandeusenandClaude Opus 5.5	2e2d8667dd	password reset by email: Settings → Email, Forgot password?, and a test-email button ... The operator asked for self-service reset over SMTP. It reuses #5173's password_resets table, /reset-password page, one-hour single-use token and sign-out-everywhere. - Settings (rule 25, not env): a new Email group (SMTP server, port, encryption as a choice, username, password, from), General → Public address, and Security → Reset emails per account. The registry gains `choices`, `secret` (the value is never sent back, `is_set` says one is saved, an empty save keeps it) and `url` (http(s), trailing slash stripped). - mailer.py: stdlib smtplib on a worker thread, 20 s timeout, starttls | tls | none. mail_settings() is None until a server, a sender and the public address are set. Links are built from the public address because the Host header can be forged. - POST /api/auth/forgot-password: the same answer at the same speed for any address. The link is made and mailed off the request (send_later). It is throttled like a sign-in per visitor address, and capped per typed email by reset_emails_per_account; past the cap it answers the same and sends nothing. - POST /api/settings/test-email: mails the admin with the saved settings and shows the server's error if it fails. - Public config `password_reset_by_email`. Sign-in shows "Forgot password?" only then, linking to a new /forgot-password page. - docs/public-hosting.md: an "Email and forgotten passwords" section. Tests: the secret stays server-side; emailed link → reset; the same answer for unknown addresses; the cap; test email success and failure; validation units. #5266. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:15:43 -04:00
bvandeusenandClaude Opus 5.5	ca242e59a6	tests: adding a checklist item answers 201 ... The edit-share test expected 200 from POST …/items, which creates. #5174. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:06:39 -04:00
bvandeusenandClaude Opus 5.5	f53d377766	sharing: share a note from the web, at view or edit, with anyone on the instance ... The ACL has gated every read since M0, but nothing could write a share. Server: - shares_api: GET /api/users/directory (everyone but you, signed-in only), GET/POST /api/notes/<id>/shares and DELETE …/shares/<share_id>, owner only. Sharing again with the same person changes the permission (ON CONFLICT on the new unique index). - acl.visible_to_user takes permission=; granted_to and shared_ids feed the serializer. - Edit covers body and checklist (_get_editable). Everything else stays _get_owned. A view share's write is a 404 like a stranger's (#1984). An editor's PATCH naming anything but body is a 403. - Serialized notes carry permission, shared and shared_by. A recipient never gets the owner's labels, and a #tag an editor types files under the owner's (it always went to note.owner_id). - ?shared=with_me, also allowed in saved views. Trash and reminders are the owner's. purge_note drops the note's shares. - Migration 0034: one share per note and person (and per group), permission limited to view and edit, an index for "shared with me". Web: - ShareDialog (one, mounted by the shell): pick a member, Can view or Can edit, change or remove existing shares, with loading, error and empty states. - Card: "Shared by X" or "Shared" chip; owner-only actions and reminder buttons hidden for recipients; checkboxes inert at view. - Editor: read-only at view; text and checklist only at edit; Share button for the owner. - FilterBar: Shared with me. Repo seam gains `shares`; the offline desktop shows none of it (#5175 brings sharing there). Tests: owner, recipient and stranger across reads, every write at view and edit, tag filing, unshare, trash, delete and validation; web unit tests for the facet and permission helpers. #5174. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:01:53 -04:00
bvandeusenandClaude Opus 5.5	f100e5ef85	tests: the self-revoke routing check reads the URL map; its 400 moves to Postgres ... test_devices signed a fake account into a session and relied on login_required answering without the database. Since 3dd0b44 the session path reads the account's epoch, so the fake account hit an unreachable database and 500ed. The routing property (the static /devices/self rule beats /devices/<device_id>) is now asserted on the URL map, and the view's 400 for a web session is an integration test with a real account. #5173. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 14:41:44 -04:00
bvandeusenandClaude Opus 5.5	3dd0b44cb9	password reset: an admin makes a one-hour link, and using it signs the account out everywhere ... There is no mail path, so a forgotten password needed a hand on the database (#2939 §2). Settings → People lists the accounts; Reset password makes a link that works once within an hour, shown once for the admin to hand over. Making another link for the same account closes the earlier one. Using it (/reset-password) sets the password, deletes the account's device tokens, and moves users.session_epoch on. Sessions are signed cookies the server can't delete, so each now carries the epoch it signed in under and login_required reads the account's epoch by primary key. A cookie from before this has no epoch and reads as 0, the starting value, so the upgrade signs nobody out. A deleted account's session now stops working too. The one-time link reveal moves out of InviteList into OneTimeLink, and the link-building into router/links.ts, shared by invites and resets. Migration 0033. #5173. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 14:35:58 -04:00
bvandeusenandClaude Opus 5.5	28fa8badcb	invites: an admin lets one person register while registration stays closed ... Until now adding a second person meant re-opening registration to the whole internet while they signed up (#2939 §1). An admin now makes an invite in Settings: a link that works once, expires (7 days by default, 1 to 30), and can be pinned to one email address. Only the token's hash is stored, so the link is shown once. POST /api/auth/register takes `invite`. Redemption is one conditional UPDATE inside the transaction that creates the account, so two people racing one link can't both get in, and a taken email leaves the invite unused. Every refusal says "invalid or expired invite". The register page reads ?invite= and opens even while registration is closed. Refs #5172 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 13:13:03 -04:00
bvandeusenandClaude Opus 5.5	df85535ea2	desktop: reminders reach you when the window isn't in front ... A Rust worker reads due reminders from the local store every 15 s and announces each occurrence once: always to the main window as a toast, and as a system notification (tauri-plugin-notification) when that window isn't focused. The page no longer polls on the desktop; its Notification went nowhere in WebKitGTK and its timer stopped with the window. The Reminders page says what each surface actually does. Core gains store::due_reminders, compared by instant, not by string. Refs #5171 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 12:46:02 -04:00
bvandeusenandClaude Opus 5.5	5989ffc1c6	desktop: Import and Export work offline; the menu toggle is reachable; errors say why ... Export and Import were a link to the server and a reject("needs a server") on the desktop. Both now run in the core with no server: - core/src/local/portable.rs builds the same zip the server writes (notes.json, a Markdown file per note, each attachment this device holds) and reads either export marker or a Google Keep Takeout zip, with the server's decompression budget and an all-or-nothing transaction. Export saves to Downloads (no new plugin) and the sidebar says where; Import takes the archive as raw IPC bytes. - core/testdata/portable.json pins the format for both copies: the server runs its Keep and native readers against it (test_portable_fixture.py) and checks its real export's keys (test_integration.py); the core runs the same cases. - Found on the way: both importers skipped a Keep note that is only a photo as "empty". It now imports, on the server and in the core. - New dependency, approved: `zip` (deflate only) plus `flate2` on its pure-Rust backend, both already in the lockfile. The AppImage applications-menu toggle moves from Account, which the desktop never shows, to the Sync page; the first-run prompt now says so. errorMessage (#5236) replaces the hand-rolled `.error ?? …` / `.message ?? e` reads at the remaining catch sites, so a desktop failure shows its real reason. Task #5170. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 11:36:42 -04:00
bvandeusenandClaude Opus 5.5	ac4427f834	android: shows and attaches files, and the share sheet takes images ... The phone downloaded every attachment and drew none of them, so a photo note looked empty. Now: - Cards show a note's first image and name its other files; the editor shows every image at full width and every file as a row. Tapping one opens it in whatever app handles its type (a cache copy under its real name, through a FileProvider that serves only those copies). Each can be removed, and a file the server refused says why under it. - The editor's toolbar has an Attach button (any type, several at once). Files are stored on the phone straight away and upload on the next sync that reaches a server, through the core's step-6 path. Link previews show in the editor too, and can be dismissed. - Share → Inkwell accepts one or several images, with or without a caption, finishing #1899's deferred image/* target. - The FFI gains add_attachment, delete_attachment, delete_preview and blob_path. The sync summary counts uploads and failed uploads. Images decode at the size they are drawn (BitmapFactory sampling plus EXIF rotation, small LRU cache), so no image library is added. Files over 50 MB are refused on the phone before they are read whole into memory. Task #5169. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:59:36 -04:00
bvandeusenandClaude Opus 5.5	5b11490858	core: the compat forward-compat test builds its feature list from the constants ... A literal list went stale the moment attachment_sync was added (run 8513), the same way pinned version numbers did at v2 — for a reason unrelated to what the test checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:13:17 -04:00
bvandeusenandClaude Opus 5.5	2b2ceaa82e	attachments sync: attach offline, upload when linked, removals stick (#5168) ... Desktop could not create an attachment at all, and a removed attachment or dismissed preview came back on the next pull. Now: - core: add_attachment keeps the bytes in the blob store and queues the row (schema v10: attachments.uploaded / upload_error). Push uploads it once its note has landed. A refusal that retrying won't fix (too large, id clash, hash mismatch) is recorded on the file and not re-sent every cycle; the editor shows it. - core: removing a synced attachment or dismissing a preview leaves a tombstone in pending_deletes; push sends it as an `attachment`/`preview` delete, and a pull while it waits doesn't put the row back. A pull also keeps files still waiting to upload instead of replacing them wholesale. - server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent, size-capped) and child deletes in push, which apply regardless of LWW and answer noop for rows the caller can't see. One store_attachment helper for the upload route, the importer and sync. Protocol 5, feature attachment_sync; the client sends neither to a server without it. - server: migration 0031 makes a link preview's insert/delete bump its note, so background-fetched previews and web dismissals reach linked devices. - desktop: Attach and paste-image work offline (raw-bytes IPC command). - SVG is served as a download by the desktop blob scheme too (as #1981 did for the web), and drawn as a file chip on both. - autosync: drop the catch_unwind; release builds abort on panic, so it only ever worked in debug builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:07:52 -04:00
bvandeusenandClaude Opus 5.5	efb141e555	desktop: syncs on its own — at launch, soon after an edit, every few minutes and on focus ... Until now the only caller of the sync engine was the "Sync now" button. A worker thread now owns every cycle (the button's included, so two never overlap): - launch: one cycle as the app opens; - edit: every 10s it reads a fingerprint of the pending set and sends when that moved. A fingerprint rather than "anything pending", because a rejected change stays pending and would otherwise be resent every tick forever; - timer: a pull every 5 minutes with nothing to send; - focus: at most once per 30s. Failed automatic cycles back off (doubling from 10s to 5 minutes). A panicking cycle counts as a failed one rather than ending the thread. Every cycle is emitted as inkwell://synced: the board reloads when the pull changed something, and the Sync screen shows the last automatic failure. No final push on quit; the launch cycle sends whatever was left. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:40:27 -04:00
bvandeusenandClaude Opus 5.5	09239ee3c7	web: the app's type-check leaves the unit tests out; CI checks them separately ... Run 8478 passed every test lane and then failed `Build & push image`. The Dockerfile's frontend stage copies only frontend/, and `npm run build` type-checks with tsconfig.json, which covered grammar.test.ts. Its import of ../core/testdata/grammar.json doesn't exist inside that stage. Nothing was published: the build is the publish and it stopped. tsconfig.json now excludes `*.test.ts`. The new tsconfig.test.json extends it with the tests included, and ci.yml's typecheck lane runs that one, so the tests are still type-checked before anything ships. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:34:14 -04:00
bvandeusenandClaude Opus 5.5	38da5160a0	grammar: a #tag starts after whitespace and with a letter, on every surface ... The shared fixture went red on the server (run 8468: 5 failed), because the three tag rules disagreed: - core and web: any non-tag character counts as a boundary, so `(#todo)` and `end.#tag` are tags, and so is the `/#section` of a pasted URL; - server: only whitespace counts, but `#1st` and `#_x` are tags. A note's labels could therefore change every time it synced. All three now share the strict rule: start of line or whitespace, then a letter, then letters, digits, `_` and `-`. Nothing becomes a tag that wasn't already one everywhere, and URL anchors stop becoming labels on desktop and Android. The server's existing `http://x/#nope` test already expected this. derive.rs's boundary, markdown.ts's lookbehind and tags.py's regex change together; `_is_tag` goes because the regex now requires the letter. The fixture flips `(#todo)`, `end.#tag` and its lift case, and adds the URL case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:22:53 -04:00
bvandeusenandClaude Opus 5.5	535331c5b2	tests: one fixture for the note grammar, run by the core, the server and the web ... The checklist grammar and the #tag rule are implemented three times (derive.rs, checklist.py/tags.py, markdown.ts), and the tag colour twice (colors.ts, DerivedTint.kt). Only Rust and Kotlin had tests. core/testdata/grammar.json now holds one set of cases (task lines, rendered items, tags, standalone-tag lifts and the tint hashes), and every suite reads it. - web: vitest, a dev dependency approved for #5166, with `npm test`. grammar.test.ts runs the fixture, and titles.test.ts pins #5165's palette fix. - ci.yml runs the web tests in the job the image build needs. desktop.yml's verify job runs them too, because the installers embed this frontend and can't see ci.yml's verdict (rule 177). - core: derive.rs reads the fixture. server: tests/test_grammar_fixture.py. - Android keeps its hand-written tint values; its doc now points at the fixture. The server is expected red here, on purpose. tags.py only takes a tag after whitespace and lets it start with a digit or `_`, while the core (the definition) takes any non-tag boundary and needs a letter. So `(#todo)` is a label on the phone and plain text on the server. The fix follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:11:26 -04:00
bvandeusenandClaude Opus 5.5	af0389ed13	web: the command palette finds notes written since it was first opened ... The palette's note list loaded once per session behind a `loaded` flag, and the `reload()` that would have cleared it had no caller. So a note written after the first open couldn't be found by name until the page reloaded (#5165, audit B4). The list is now fetched again on every open, and the last list stays visible meanwhile. The input takes focus before the fetch, and a failed fetch keeps the old list instead of breaking the palette. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 22:51:36 -04:00
bvandeusenandClaude Opus 5.5	8db9f3685b	server: one save path for a note's text, so a restored link gets its preview ... A body edit is a sequence: keep a revision, rename the note, lift #tags, commit, queue link previews. It was written out in PATCH, the item routes, restore and sync push, and the copies had drifted. Now they all call `notes/body.py: write_body`, which says how the old text is kept ("session", "always" for restore, "never" for a new note) and returns whether the text changed. The routes commit through `_commit_note`, which queues previews after the commit. Fixes, both red on 1a2f71e (run 8441): - restoring a revision queues previews for its links (#5164, audit B5); - a pushed note keeps the client's edit time when a standalone #tag is lifted. The lift's extra flush used to let `onupdate` stamp the server clock over it. Sync push also queues its previews after the batch commits, not mid-batch, where a fast fetch could look for a note that wasn't committed yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:31:41 -04:00
bvandeusenandClaude Opus 5.5	86409e02b0	ci: drop the deliberate failure — the gate held on run 8437 ... Run 8437 failed `verify` on purpose, and the Linux build, the Windows installer and the update manifest all reported skipped. This removes the red step, so this push is the other direction: a green verify still publishes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:26:48 -04:00
bvandeusenandClaude Opus 5.5	1a2f71e381	tests: every note-text write path is pinned, and two of them fail today ... Integration tests for the edit sequence at each door: create, PATCH, ticking an item, restoring a revision and sync push. Two fail on today's code, on purpose: - restoring a revision never queues link previews, so a restored link stays a bare URL (#5164, audit B5); - a pushed note whose standalone #tag gets lifted stores the server's clock as its edit time instead of the client's, because the lift's second flush lets the column's onupdate overwrite it. The fix follows in the next commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:26:15 -04:00
bvandeusenandClaude Opus 5.5	4d61b34b85	ci: the Windows installer waits for the Rust checks, like the Linux bundles do ... Clippy, the workspace tests and rustfmt move out of the Linux `build` job into their own `verify` job, and both publishing jobs need it. Before this, `windows` needed only `decide`, so on run 8411 a red clippy stopped the Linux lane while the Windows installer built and published to dev-rolling (#5184, rule 177). This commit also carries a deliberately failing step at the end of `verify`. It is the red half of the proof: both publishers must report `skipped`. The next commit removes it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 21:22:28 -04:00
bvandeusenandClaude Opus 5.5	be200641cd	core: notes show their real created and edited times, and desktop search works ... Both bugs were caught red by the tests in 732fd7a (run 8418: 5 failed, 147 passed) before this fix. - load_note reads columns by NAME. Dropping `color` (fa89da1) shifted every column after it and the two timestamps were missed, so created_at showed the last edit and updated_at showed the trash time — null on any live note. Only the read was wrong; nothing stored is, so no data needs repairing. - The board's text facet binds its pattern once for its one placeholder. It pushed it twice after the title column went (95aa10c), and rusqlite refused every query with InvalidParameterCount — every desktop search failed. Android searches through store::search and was never affected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:42:51 -04:00
bvandeusenandClaude Opus 5.5	732fd7a827	core: the store tests pass clippy and rustfmt, so they reach the test step ... 7bc8e04 never got as far as running them: clippy's cloned_ref_to_slice_refs rejected four `&[x.clone()]` slices, and the file wasn't rustfmt-formatted. Still tests only — the expected RED is the two timestamp tests and the text-search tests, ahead of the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:35:10 -04:00
bvandeusenandClaude Opus 5.5	7bc8e04518	core: the local store has tests, and two of them fail on today's code ... store.rs had none, which is how two bugs reached desktop and Android unseen. These exercise every board facet, the timestamps, tags, revisions, items, trash, reminders and label merges against a real migrated schema. Two are expected RED on this commit, on purpose, so CI shows they catch what they were written for: - each_timestamp_comes_from_its_own_column / a_new_note_carries_both_timestamps: load_note reads created_at and updated_at one column too far right since fa89da1 dropped `color`. - text_search_*: the text facet binds its LIKE pattern twice for one `?`, left over from title+body (95aa10c). The fix follows in the next commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:29:33 -04:00
bvandeusenandClaude Opus 5.5	c5f93cf9f1	rename: the sign-in screen shows Inkwell's mark, and every tab says Inkwell ... The login and register screens still drew a hard-coded "TS" tile. They now use /icon.svg, the same mark the shell's header shows. Browser tabs took index.html's static <title> and never changed it, so every tab read the same, and some browsers showed the URL instead. usePageTitle, mounted once in App.vue, sets "<page> · <site name>". Routes outside the shell name themselves with meta.title. Board lenses use the lens name the header already shows, now in useLensName so the tab and the header read from one place. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 17:52:50 -04:00
bvandeusenandClaude Opus 5.5	6d082b2ad8	rename: the docs say Inkwell, and nothing else still says ThoughtSync by accident ... Step 6 of milestone 481. README, docs/*, ci-requirements.md, the desktop and Arch READMEs, alembic.ini, .gitignore, the frontend package name, the service worker's cache name (its activate handler deletes any cache by another name, so the old one is cleaned up), and the Android names in the release body. What still says thoughtsync does so on purpose (Scribe note 5071): - the desktop data crossover (crossover.rs) and its startup log - the old-export import marker - the "Upgrading from ThoughtSync" block in .env.example, and compose's pointer to it - the packages being retired: deb conflicts/replaces thought-sync, pacman thoughtsync and thoughtsync-desktop - the Android signing keyAlias, which names a key in the existing keystore - history: shipped alembic migrations, and the test-binary hashes that ci-requirements.md records from 2026-08-18 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:35:02 -04:00
bvandeusenandClaude Opus 5.5	81cd719327	rename: Android is Inkwell — package, applicationId, uniffi class, assets ... Step 4 of milestone 481 (Scribe note 5071: a full rename). - namespace and applicationId com.fabledsword.inkwell; the Kotlin package moves with them, and ktlint re-sorted the imports the rename reordered (checked locally with CI's ktlint 1.4.0 and detekt 1.23.7, both clean) - uniffi: class Inkwell in com.fabledsword.inkwell.core, InkwellApplication, InkwellTheme, Theme.Inkwell, log tags, prefs and work names, client agent inkwell-android - the lane publishes inkwell.apk / inkwell-android.json; fetch-clients, guard-forward, publish-release and write-manifest read the same names A new applicationId is a new app. The old ThoughtSync app keeps its own store and stays installed beside it. Notes cross over by syncing, and the old app is then removed by hand. Kept: the signing keyAlias is still "thoughtsync". It names the key inside the existing keystore, and the key, and so the certificate, are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:34:02 -04:00
bvandeusenandClaude Opus 5.5	256fba3610	icon: Inkwell's mark is a black inkpot and quill on the brand yellow ... Step 5 of milestone 481. Replaces the linked-notes constellation, which had been stale since note links were dropped (alembic 0024). The colour scheme stays. packaging/icons.py draws the mark once and renders every variant from it: the rounded tile (web, desktop), the maskable full-bleed web icon, and the Android adaptive foreground. The detail (shaft, vane splits, glint) is cut out of the ink with a mask rather than painted on in yellow, because the Android foreground is now transparent and its alpha is also the themed-icon silhouette. The old foreground was the opaque maskable tile, which a themed icon would have drawn as a solid square. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:30:51 -04:00
bvandeusenandClaude Opus 5.5	fe6f0746b2	rename: the desktop is Inkwell — crates, Tauri identity, data move, packaging ... Step 3 of milestone 481 (Scribe note 5071: a full rename). - crates thoughtsync-{core,desktop,ffi,uniffi-bindgen} → inkwell-*, the Cargo.lock entries moved to match (checked with `cargo metadata --locked`) - Tauri: productName "Inkwell", identifier com.fabledsword.inkwell, binary `inkwell`, updater feed on bvandeusen/inkwell, store file inkwell.db - client agent inkwell-desktop, headers X-Inkwell-Client/-Protocol (the server reads neither), capture event inkwell://captured, display-version env - .deb: conflicts + replaces thought-sync, so the updater's install retires the old package instead of colliding on it. kebab-case("Inkwell") is `inkwell`, so the package name finally matches the command and verify.sh now asserts it - pacman: inkwell, conflicting with and replacing thoughtsync and thoughtsync-desktop - AppImage ~/Applications/Inkwell.AppImage, menu entry inkwell.desktop, installer, release titles, desktop asset names in fetch-clients.sh The one shim, chosen by the operator because it is the only copy of a local-first user's notes: crossover.rs moves the old com.fabledsword.thoughtsync app-data dir's contents into the new one on startup, before the store opens, renaming thoughtsync.db and its -wal/-shm with it. It skips when the new dir already has a store, and anything already in the new dir wins (the installer writes its channel marker there first). Tested. Android's Kotlin side (package, applicationId, uniffi class) is step 4. Its release asset names stay thoughtsync.* until then. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:27:26 -04:00
bvandeusenandClaude Opus 5.5	a706644455	rename: the server is Inkwell — package, env vars, image, compose, export marker ... Step 2 of milestone 481. The operator chose a full rename (Scribe note 5071), so this goes past the display strings into the identities: - src/thoughtsync → src/inkwell; every import, the Dockerfile and both compose commands, alembic env, pyproject - THOUGHTSYNC_* → INKWELL_* (database URL, secret key, log level, tag/port/bind) - container data dir /var/thoughtsync → /var/inkwell - image git.fabledsword.com/bvandeusen/inkwell; Postgres user/db default inkwell; CI's integration service follows - the files the image serves are inkwell.*. fetch-clients.sh still fetches the thoughtsync-named release assets, because the lanes that publish them are renamed in steps 3 and 4 - exports are written with app "inkwell" Two deliberate exceptions, both because data rides on them: - compose volumes are now named explicitly and overridable (INKWELL_DB_VOLUME, INKWELL_DATA_VOLUME), so a deployment installed as ThoughtSync points at the volumes and DB identity it already has. .env.example says exactly what to set - import still accepts app "thoughtsync", because exports written before the rename are backups. Tested both ways Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:18:49 -04:00
bvandeusenandClaude Opus 5.5	f806e35d41	rename: the apps say Inkwell — web, desktop, Android and server strings ... ThoughtSync is renamed Inkwell ("Fabled Inkwell" in full; Scribe note 5071). This is step 1 of milestone 481: every string a person reads in the running apps. Identities installed clients depend on are deliberately untouched — the Tauri productName (it derives the .deb Package: field), identifier and binary name, applicationId, X-ThoughtSync-* headers, the export's app marker, env vars, module and crate names. - web: title, PWA manifest (name "Fabled Inkwell", short_name "Inkwell"), offline page, icon labels, build labels, prompts, notification title - server: site_name default, import error, link-preview User-Agent - 0030: a stored site_name of exactly the old default follows the rename. The Settings page saves every key, so most servers hold "ThoughtSync" without an admin ever having chosen it; a name they typed is left alone - desktop: window title, default device name, local-mode site name, log line - android: app_name and the strings that name the app - core: probe and compatibility messages Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 13:16:14 -04:00
bvandeusenandClaude Opus 5	fb469ed73a	update: wrap the dev-rolling feed assertion the way rustfmt wants ... 7296889 lengthened `/dev/latest.json` to `/dev-rolling/latest.json` in each_channel_has_its_own_fixed_feed, which pushed the assert past the line width. `cargo fmt --all --check` failed the Linux desktop job (run 6358) after Clippy and the tests had passed, so that build, its publish and the manifest job never ran. Layout taken verbatim from the diff rustfmt printed; no behaviour change. Scribe #2184. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwoKYuw3qJmUUYsJeNherB	2026-09-10 18:44:02 -04:00
bvandeusenandClaude Opus 5	72968897ab	channels: the dev channel publishes on dev-rolling, so its tag stops shadowing the branch ... The rolling dev release lived on a tag named `dev`, beside the branch named `dev`. Once a clone had fetched tags, `git push origin dev` failed with "src refspec dev matches more than one" (Scribe #2184, note #3042), and every session had to know to spell out refs/heads/dev. The channel is still `dev` everywhere a person sees it: the app's setting, `install.sh --channel dev`, the stored pref. Only the release tag moves, to `dev-rolling`, matching roundtable-android. `stable` has no branch to collide with and keeps its name. - packaging/channel-tag.sh is the one channel -> tag mapping CI reads: the publish steps in android.yml and desktop.yml, the manifest job, fetch-clients.sh and guard-forward.sh. guard-forward exits 2 on an unmapped channel instead of fetching an empty URL and passing. - update.rs and install.sh carry their own copy because neither can run it; update.rs gains a test that no channel feed is named like a branch. - tests/test_channel_tag.py runs the script: no tag is a branch name, dev is exactly dev-rolling, an unknown channel fails with no output. - publish-release.sh titles the release "ThoughtSync dev (rolling)", so the tag name does not leak into what people read. TEMPORARY bridge: desktop apps installed before this have .../download/dev/latest.json compiled in. The dev manifest job sets BRIDGE_TAG=dev, and write-manifest.sh writes the same latest.json to the old `dev` release. Its URLs name dev-rolling assets, so those apps update once into a build that reads the new tag. The bridge, and the old release and tag, are removed once installed apps have crossed over. Until then the push still needs the explicit refspec, as ci-requirements.md now says. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwoKYuw3qJmUUYsJeNherB	2026-09-10 18:34:11 -04:00
bvandeusenandClaude Opus 5	53d51ce01c	ci: artifact uploads move to stock upload-artifact@v7 ... The Android APK upload and both desktop bundle uploads (Linux and Windows) went through the bvandeusen fork mirror, with comments saying stock upload-artifact throws GHESNotSupportedError on this hostname. That stopped being true when the runner moved to gitea/runner 3.x, which edits the refusal out of the action bundle; stock upload v4-v7 and download v4-v8 were proven on 2026-09-10 (Scribe spike #3843) and the same swap is verified on four other repos. Artifact names, paths, if-no-files-found: error and the no continue-on-error stance are unchanged. ci-requirements.md now says stock v7 and keeps what is still true: @v3 uploads are invisible. Scribe snippet #2271, milestone 395. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DwoKYuw3qJmUUYsJeNherB	2026-09-10 17:32:55 -04:00
bvandeusenandClaude Opus 5	cf2854a029	ktlint: a multiline .border() left the next '.' orphaned, exactly as #3110 records ... `standard:chain-method-continuation` on `LinkPreviewRow.kt:83`. The `.border(…)` call took three arguments across four lines, and the `.padding(…)` after it then began a line with a `.` — which the rule only accepts glued to the closing paren, `).padding(…)`. Issue #3110 hit this same rule in `NoteCard.kt` and recorded the fix: do not write the multiline element. Naming `shape`, `padH` and `padV` first collapses `.border` back to one line and removes the duplicated RoundedCornerShape at the same time, which is better than what ktlint was willing to accept. Also did what #3110's verification note says to do rather than fixing only the line the linter named: scanned every Kotlin file this branch touched for the same shape — a multiline chain element followed by a `.` on a new line — and found no others. ktlint reports one violation and stops, so a second would have cost another full Android lane. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 19:01:09 -04:00
bvandeusenandClaude Opus 5	62338bb0a4	android: a link in a note renders as a link card, not a bare URL ... The web and desktop have shown link previews since #2898; the phone showed the raw address. The data was already on the device — `Note.previews` is populated by the core and carried through the FFI — and nothing under `app/src/main` read the field. The three presentation rules are copied from `NoteCard.vue` rather than re-decided, so the same note reads the same way on every surface: * A note that is NOTHING but a URL renders as its preview and nothing else. Printing the address under a card that already says where it goes is saying the same thing twice, badly. * Links mentioned INSIDE a note get a compact strip at the FOOT of the card. Above the body would put a stranger's headline where the note's first line should be; the web learned that in M13. * Several stack. `LONE_URL` mirrors the web's `LONE_URL_RE` including the tolerated whitespace — if the two regexes disagree, one note reads as a card here and a paragraph there. Falling back to the URL is deliberate in all three of the cases that produce no preview: not a lone URL, not unfurled yet, or never unfurlable. A note written on the phone and not yet synced is permanently in the middle one, because the unfurl is server-side (`unfurl_queue.py`) and arrives on a later pull — so that state has to look deliberate, and showing the link does. No unfurl fetch was added here, and none should be: a phone fetching OG tags would be a second SSRF-hardened fetcher on the surface least able to afford the call. ## No image, and that is a question rather than an omission `LinkPreview.image_url` is a REMOTE third-party address — the web renders it straight from whatever host the link points at. Matching that here would have this app fetch images from arbitrary hosts, on a phone, on possibly metered data, and would make it the first image loading anywhere in this client: there is no loader, no cache, and not one `Image(` in the whole app today. That is a decision about privacy and data use, not a rendering detail, so the text card ships and the image is asked about rather than assumed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 18:51:51 -04:00
bvandeusenandClaude Opus 5	1a41373347	board: a note trashed from search results now leaves the results ... Search for something, long-press a hit, Move to trash: the snackbar said it happened and the card sat there until the query next ran. Reachable from the editor's overflow too — both go through `mutate`. `mutate` kept the existing list whenever a search was running, with the reasoning recorded in place: search results are the answer to a query, not a live view, and running the BOARD query underneath them would replace the hits with the whole board. That is right about the board query and wrong about the note. A hit that no longer matches has left the answer, not just moved within it — pinning one and watching it not re-sort is fine; trashing one and watching it stay is not. So the search is re-run instead of the destination loaded. The results are still the answer to the query, just a current one, and it costs one local SQLite query — the same argument the surrounding comment already makes for reloading the board. Creating a note while searching still leaves the list alone: a new note that does not match the query has no business appearing in its results. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 18:51:51 -04:00
bvandeusenandClaude Opus 5	729d0dadf1	editor: collect the refund — the web editor autosaves on an idle pause ... #2971's engine work was already done and its benefit was never taken up here. Both engines coalesce revision snapshots to one per editing session — `src/thoughtsync/revisions.py::should_snapshot` and `store.rs`'s namesake, the server's applied on the PATCH path AND in `sync.py`, with four integration tests covering it. So a write has cost a write, not a write plus a revision, for some time. But this editor still wrote only on `close()`. That save-on-close existed BECAUSE writes were expensive; with the reason gone, all that was left was the cost — a tab closed mid-paragraph lost the paragraph, which is the one thing a notes app must not do. Android already debounces (`BoardViewModel`); the shared Vue editor did not, so web and desktop kept paying for a trade that had been cancelled. Now: a 1s idle pause writes. EDIT MODE ONLY, deliberately. In compose, `dismiss` discards a note that was never persisted so an accidental keystroke or a type-to-compose never litters the board. An autosave there would create the row and quietly take that behaviour away. Materialising a compose on first keystroke is a separate decision (#2967), not a side effect of this one. Three details that decide whether it is safe rather than merely present: * `flush` returns without writing while a save is in flight, so an autosave landing there would silently drop everything typed since that save began. It RE-ARMS instead of skipping. * Errors are swallowed and retried on the next pause. An autosave that interrupts typing with a message is worse than one that waits, and `close` still surfaces a real failure where the person is looking. * The timer is cancelled by `close`, by `dismiss` and on unmount, so nothing fires through a component during its leave animation or after it is gone. Checked and found harmless rather than assumed: `notes.reconcile` replaces the store's item but never touches `useNoteEditor`'s `editing` ref, so the `watch(() => props.note)` that calls `setBody` does not fire on a save. Were that not true, autosaving would have reset the field and the caret every second. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 18:26:05 -04:00
bvandeusenandClaude Opus 5	23a61365da	capture: the suggested shortcut is a UI affordance, so it lives in the UI ... `-D warnings` failed the Linux lane on `constant SUGGESTED is never used`, and it was right — the suggestion is implemented in `bridge.ts` as SUGGESTED_CAPTURE_SHORTCUT, and nothing in Rust ever read the copy here. Deleted rather than exposed through a command. This side accepts any combination the OS will take; picking one to put in front of someone as a starting point is a UI decision, and a constant here would only be a second copy of a string one layer reads and the other does not. Worth noting what this run DID prove, since the previous one proved nothing: the lockfile gate passed and the Windows job built the NSIS installer end to end. So `tauri-plugin-global-shortcut`'s handler signature — the thing I could not verify without a toolchain — is correct, and the feature compiles. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 18:13:31 -04:00
bvandeusenandClaude Opus 5	6c0153be1e	desktop: a global hotkey opens a small window to write in, now with its lockfile ... Restores 42e06da, which was reverted only because Cargo.lock had not been updated for the new crate and every cargo invocation in CI passes `--locked`. Both desktop jobs failed on that line before compiling anything, so nothing about the code had been judged. The lockfile was generated in CI's own `ci-tauri:1.97` image — one container, `cargo fetch`, nothing built. `cargo fetch` and NOT `generate-lockfile`: the latter re-resolves from scratch and would have churned versions across the whole workspace to add one dependency. The diff is 67 insertions, zero deletions, six packages — tauri-plugin-global-shortcut plus global-hotkey, x11rb, x11rb-protocol, xkeysym and gethostname. Nothing existing moved. The feature itself, unchanged from 42e06da: Press the combination anywhere and a small window arrives over whatever you were doing; type, Ctrl/Cmd+Enter, gone. The board never comes forward. There is no default shortcut on purpose — any default is a key combination taken away from something else on somebody's machine, silently, at install time. CommandOrControl+Shift+N is offered as a one-click suggestion. Stored and live are separate fields because they disagree: a combination another app holds is saved and does nothing when pressed, and a Wayland compositor may refuse global grabs outright. `capture_shortcut_set` registers before storing, so a refused combination is never written down as if it worked. The window hides rather than closes and keeps its text, so an interrupted capture is still there next press — which is what makes Escape safe. A failed save keeps it open too, rather than discarding the only copy of something just written in order to report a retryable problem. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 18:05:20 -04:00
bvandeusenandClaude Opus 5	10ea15bef0	Revert the desktop hotkey: a new crate needs a Cargo.lock this machine cannot write ... `42e06da` added `tauri-plugin-global-shortcut` to Cargo.toml without updating Cargo.lock, and every cargo invocation in CI passes `--locked`. Both desktop jobs failed on the same line before compiling anything: error: cannot update the lock file ... because --locked was passed So this says nothing about whether the code is right — clippy never ran. The gate did exactly its job. There is no Rust toolchain on this workstation (rule 10 — CI verifies), and a lockfile is the one artifact CI is deliberately forbidden to generate. Hand- writing the entries is not a real option: it needs the exact checksum and the whole transitive tree, and a wrong checksum fails harder than a missing one. Reverted rather than left red, because a red `dev` blocks everything behind it and the Android half of #1899 is green and unaffected at c8318c3. The work is intact in 42e06da and comes back with `git revert 5e0c...` once the lockfile exists — nothing here needs rewriting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 09:10:33 -04:00
bvandeusenandClaude Opus 5	42e06da576	desktop: a global hotkey opens a small window to write in, and nothing else ... The other half of #1899. Press the combination anywhere and a 520x220 window arrives over whatever you were doing; type, Ctrl/Cmd+Enter, it is gone. The board never comes forward, which is the whole point — bringing the app up to write one line is the friction this removes. ## There is no default shortcut, deliberately A global shortcut is the one setting here that can collide with software this app knows nothing about. Any default is a key combination taken away from something on somebody's machine, silently, at install time. So the feature is OFF until a combination is chosen, and choosing one is how it turns on. CommandOrControl+Shift+N is offered as a one-click suggestion, never applied on the user's behalf. ## Stored and live are reported separately `CaptureShortcut` carries both `shortcut` and `registered`, because they genuinely disagree: a combination another app grabbed first is saved and does nothing when pressed, and on Wayland a compositor may refuse global grabs outright. Saying only "your shortcut is X" would be a lie with a keystroke attached, so the settings row says "saved but isn't active — something else is holding it". `capture_shortcut_set` registers BEFORE storing, so a combination the system refuses is never written down as though it worked. Registration at startup is best-effort and logged: a shortcut that worked when it was chosen can be taken by something installed later, and the app must still open. ## Two windows, one database, no shared store The capture window runs a second copy of the frontend with its own Pinia stores, so a note saved there is invisible to the board until it is told. It is told — `capture_done(saved)` emits to `main`, and BoardView reloads. The emit failing is cosmetic (the note is already in SQLite) so it is logged, not raised. The window is opened at `index.html?capture=1` rather than at `/capture` because the bundled assets are served as FILES: a path with no file behind it 404s in the production build while routing fine under the dev server. The router turns the query into the route. It is hidden rather than closed on the way out, and it keeps its text. A capture interrupted by something more urgent is still there on the next press, which is what makes Escape safe to press. A failed save also keeps the window open holding the text — hiding it would throw away the only copy of something just written in order to report a problem you could retry your way out of. ## Where the setting lives Rule 25 says a tunable belongs in the UI, and this one has to be. It sits in the desktop's Sync screen beside the update channel, not in admin Settings: that screen is the SERVER's and bounces on desktop anyway, while this is a property of one installation on one machine. Persisted with the same `store::set_pref` the update channel uses. No @tauri-apps/api dependency was added — everything routes through `invoke` and the `withGlobalTauri` global, as the rest of the bridge does. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 09:02:39 -04:00
bvandeusenandClaude Opus 5	c8318c323a	android: Share → ThoughtSync, and a "New note" entry in the selection toolbar ... Capture without opening the app first — the input half of #1899. Two ways in: the share sheet from anywhere, and the text-selection toolbar in any app's text field. ## The note is created, not pre-filled The obvious build is "open the editor on a draft holding the shared text". That silently loses it. `NoteEditorScreen`'s flush is guarded by `bodyText != note.body`, so a draft handed the text already has nothing to save — share a link, press back without typing, and it is gone. Which is exactly the shape of a share: the common case is walking away. So `captureShared` makes the row first and opens the editor on the real note. A share has already said "keep this"; creating it is what honours that, and back then leaves a saved note rather than a decision. ## launchMode="singleTop" The reminder notification adds FLAG_ACTIVITY_SINGLE_TOP to its own intent, which is why `onNewIntent` already worked there. A share intent is built by the OTHER app and nothing here can add a flag to it, so the activity has to declare it. Without that, every share while the app was running would stack a second MainActivity — a second view model, a second board, and a back press landing on a stale copy of the same app. ## Subject and text, both A browser sends EXTRA_SUBJECT as the page title and EXTRA_TEXT as the URL. Keeping both makes the note read as its title, because the core names a note by its first line — the difference between a board you can scan and a column of identical links. `distinct` because plenty of senders put the same string in both. The extras are removed on read, like the reminder's note id and for the same reason: the activity keeps its launch intent, so without consuming them a rotation would replay the share and mint the note again. ## Not included: images `image/*` is deliberately absent from the filter. Nothing in this app can create an attachment — the core has `delete_attachment` and no counterpart, and the FFI exposes neither. Declaring the mime type would put ThoughtSync in front of people in the share sheet for a job it cannot do, and fail after they had already chosen it. Adding it needs an attachment-creation path through the core, the FFI and sync, which is its own piece of work. The desktop half of #1899 — a global hotkey — is not in this commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-09-01 08:53:38 -04:00
bvandeusenandClaude Opus 5	cc50812a86	ktlint: the Tags imports landed after SyncScreen, and SyncState sorts after that ... `standard:import-ordering`. The two new imports were inserted by anchoring on `com.fabledsword.thoughtsync.ui.SyncScreen`, which looked like the right neighbour and is not — `SyncState` and `SyncViewModel` both sort after it, so Tags* wedged into the middle of the Sync block. Moved below `SyncViewModel`. Every import block in the five files this branch touched is now confirmed sorted, not just the one ktlint happened to reach first — it reports one violation and stops, so a second would have cost another full Android lane. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-08-31 19:53:08 -04:00
bvandeusenandClaude Opus 5	1e54b80f15	android: a Tags screen, so the phone can do more than attach tags to a note ... Android could list tags and mint new ones. It could not rename, recolour, delete or merge one — and since the per-note colour picker was removed with 2949, tag colour is the ONLY colour control in the product, which meant an Android-only session had no way to change any colour anywhere. A destination reached from the drawer, not a modal. The web's LabelsModal is a modal because a desktop can float one over the board; on a phone this is a place you go to tidy up, and a full screen is what that is. The manage entry is an action ON the drawer's Tags header rather than a row in it, so it cannot be mistaken for a sixth lens. The header now renders even when there are no tags: this screen is where you make the first one, and hiding the way in until one exists is a door that only appears once you are already inside. ## The two calls this needed RENAME and MERGE deliberately do not follow the same rule, and the screen says so rather than hiding it. * A rename that lands on an existing name merges, older survives (3324). That path is accident-prone — it is a text field, and a typo reaches it — so it needs a rule that cannot depend on which way round it was typed. The screen catches the collision against the LIST, not from what the core returns: the survivor may be the tag being renamed, so an unchanged id afterwards proves nothing. Then it asks before merging. * An explicit merge keeps its direction. Here the person is choosing, and the direction IS the intent — folding #grocery into #groceries is a decision, and overriding it with age would refuse the thing they asked for. The price is that the direction has to be unmissable, so the body names the tag that stops existing and every row offered is the survivor. Delete quotes the note count, because "it is on 40 notes" is a different decision from "delete this tag?". The count comes from `list_labels`, the only call the core populates one on. It also says that a tag written as #tag in a body comes back on that note's next edit — deleting the row cannot un-write the word, and that is better said than discovered. ## The board had to learn something `Destination.WithLabel` holds an id, and deleting or merging a tag the board is currently LOOKING at would strand it on a lens that queries a row which no longer exists — permanently empty, escapable only via the drawer. So `loadLabels` became `refreshLabels`: public, and it drops back to Notes when the current lens is gone. A failed listing deliberately does NOT trigger that fallback — "I could not read the tags" is not evidence that this one went. Reused rather than rewritten: `ErrorBanner` (the board and editor already share it), `MenuItem` from Panel.kt (it closes the menu before acting so a dialog cannot open under a hanging menu), `PlainTextField`, and the `NOTE_TINTS` palette — the screen consumes it and does not fork a copy. `default` stays in the palette on purpose: a tag with that colour gets a hue derived from its name, so it means "let it pick", and removing it would leave no way back to that. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-08-31 19:44:54 -04:00
bvandeusenandClaude Opus 5	550a34d8e2	fmt: rustfmt budgets macro arguments at 60 chars, not the 100-char line ... Both new assertions fit well inside the 100-column limit and both were still rejected. The governing setting is `fn_call_width` (60), applied to a macro's argument list: `survivor.id, older.id, "the older row is the one that survives"` is 62 characters, so rustfmt breaks it and pairs the two values on one line with the message beneath. The neighbouring `assert_eq!(survivor.name, "Grocery", "spelled the way the caller asked")` was accepted at 59 characters of arguments, which is the same rule agreeing rather than a different one. rustfmt's own output, pasted back. Second time this lane has caught the same class of thing in one session — the other was a method chain, budgeted at 60 by `chain_width`. Recorded so the next person reaches for the 60, not the 100. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-08-31 16:52:00 -04:00
bvandeusenandClaude Opus 5	193dfb9e94	tags: renaming onto an existing tag merges them, and the older row survives ... The three surfaces did not agree on what renaming a tag onto a name another one already holds should do, and none of the three answers was good. I described this wrongly first time and the correction matters. The local store does NOT silently create a duplicate: `idx_labels_name` is unique on `lower(name)`, so the bare UPDATE in `rename_label` failed, and the user got a raw SQLite "UNIQUE constraint failed" as their error message. The server meanwhile answered 409 "a tag with that name already exists" — and only on an EXACT match, because its constraint is on the raw name while every client's index is on `lower(name)`. That last part is the sharper bug. The server would happily hold "Groceries" beside "groceries"; no synced client can store both. Creating that pair on the web armed a pull that fails later, on a phone, in a path with no UI. Operator's call: a rename onto an existing name means merge — typing an existing tag's name onto this one says they are the same thing. * `store::rename_label` and the server's PATCH now implement one rule. THE OLDER ROW SURVIVES and takes the new spelling. Age rather than "the one that already held the name", so that renaming A→B and B→A land on the same survivor; otherwise the outcome depends on which way round someone typed it, and two devices tidying the same pair disagree about which id still exists. Ties go to the incumbent, so it stays deterministic. * The core reuses `merge_labels` rather than reimplementing the move. That is the only place that knows to mark every affected NOTE dirty before the delete cascades the membership rows away, which is what makes a merge reach the server at all. * The server's rename and its `/merge` route now share one `_merge_into` helper, for the same reason. * Both server lookups became case-INSENSITIVE, matching every client. The create path is included: it was the one actually minting the unstorable pair, so fixing only the rename would have left the door open. * The web asks before merging, naming both note counts. A merge cannot be undone by repeating it and is now reachable by a typo in a text field — the same reasoning as the delete confirmation in #2116. The confirmation lives in the shared store, so the desktop gets it too; the FFI does not ask, because that belongs to the surface with a person in front of it. * The web store detects the merge from the LIST, not the response: the survivor may be the row we asked to rename, so an unchanged id proves nothing. Tests: three integration tests over a real database (both rename directions land on the older row; a case-varied create returns the existing tag) and two through the Android FFI, which is the binding the phone will use. Also fixes a straggler from 8c7553d — the delete confirmation still said "the label". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c	2026-08-31 16:46:15 -04:00