696 commits

Author	SHA1	Message	Date
andodeki	5e864498d5	test(cad): cover the GLB export entry points and every solid it collects, 75.48% -> 94.83% ... Same shape of gap as the SVG exporter, one file over. The mesh collector had an arm per solid and only boxes were ever walked through it; `scene_to_glb`, `export_scene_to_glb`, `export_scene_to_glb_with_cache` and `build_glb_sequential` -- every public entry point except the one the trait impl uses -- were at zero, along with both `From` conversions on the error type. 8 tests: - Nine solids exported one at a time, each asserted to produce a structurally valid GLB: the "glTF" magic, version 2, and a declared length that matches the file. A viewer rejects the file outright if any of those disagree, so checking "some bytes came back" would not have been worth writing. - The sequential fallback is asserted byte-identical to the parallel builder. It is documented as the path for environments without rayon; if it drifts, that fallback silently exports something else and only those environments see it. - An empty scene and a groups-only scene are both refused, with the two distinct messages. A GLB that opens to an empty stage is worse than a refusal, because the user reads it as "the export worked". - `export_scene_to_glb` creates the directory it was pointed at (the user picks the path, its parent may not exist), the shared-cache variant writes identical bytes, and both report a path they cannot create instead of dropping the export. - The error type's Display, plus its io and serde_json `From` conversions -- those exist so `?` works inside the export path, and an unexercised conversion is a `?` that fails to compile the day someone needs it. Floors: arch_gltf 72 -> 92, total 93 -> 94. Verified with: ./tools/test-cad-coverage.sh (530 tests green, total 95.42%)	2026-08-17 04:29:19 +00:00
andodeki	e16a6da5f5	test(cad): cover the real command context and the undo-stack housekeeping, 87.63% -> 96.23% ... The undo/redo tests all ran against a mock. The mock keeps its own Vec, so `CadCommandCtx` -- the implementation the editor actually uses -- had two methods that no test had ever called: `update_node`, the in-place property edit, and `insert_node_at`, the undo of a delete. `UndoRedoStack::clear`, its Debug impl, and the describe/as_any pair on half the command types were also at zero. 12 tests against the real context, with a real PartsStore: - `update_node` edits in place, bumps the store generation, and does NOT reorder the list. Order is what the layer panel and the draw order read; the same class of reordering defect is already called out in the mock's own comment. - `update_node` on a missing id reports NodeNotFound and does not run the edit closure -- otherwise a stale selection edits whatever node happens to be in that slot. - `insert_node_at` puts a deleted node back at its recorded index, not on the end, and clamps an out-of-range index instead of panicking. The index is captured before the delete and other commands may have shortened the list since. - DeleteNode and CreateNode are round-tripped through the real context, including DeleteNode's no-recorded-index arm (appends) and CreateNode's fallback from `assigned_id` to the snapshot id. Plus the trait and stack housekeeping: - The `Command` defaults: the generic "command" label, and `can_merge` returning false. A default of true would silently collapse unrelated undo steps. - `clear()` empties both stacks. The editor calls it when a document is closed; an entry surviving into the next document applies an edit to the wrong model. - The Debug impl prints depths and asserts the command list is NOT dumped -- a derived Debug over two stacks of boxed trait objects would put the whole edit history in a log line. - Every command type's describe/as_any, including that two commands with identical field shapes do not downcast into each other. That downcast is what `can_merge` runs on; a wrong one turns a drag into one undo entry per frame. Floors: commands 85 -> 94, total 92 -> 93. Verified with: ./tools/test-cad-coverage.sh (523 tests green, total 94.31%)	2026-08-17 04:27:54 +00:00
andodeki	15ef8a0447	feat(makepad-table): LaTeX cells (Phase 5) ... A column can now be declared as maths rather than text: TableColumn { kind: CellKind::Latex, ..Default::default() } Rendering goes through makepad's own `MathView`, which is already registered with the script VM and already owns a glyph cache and the `makepad-latex-math` parse/layout path. Reimplementing that inside the table would have been a second copy of the same logic with none of the same testing. The kind lives on the column, not the cell. Cells stay `String`, so a `TableData` built before this existed keeps working and a table still round-trips through plain text. A column of formulae is also the realistic case — a spreadsheet does not mix prose and LaTeX down one column — and it means the decision is made once per column rather than re-derived per cell per frame. `CellKind` defaults to `Text`, so nothing changes for existing callers except that the struct gained a field. One `MathView` is repositioned over each maths cell in turn, the same pattern `cell_editor` already uses. A widget per cell would allocate a glyph cache per cell. The walk is `Size::Fit` rather than fixed to the cell, because stretching a glyph run to fill a cell distorts the maths. An expression that does not parse is not blanked. `MathView` draws its own `[reason]` marker, so a mistyped formula is visible in the cell rather than silently erasing the content — the failure mode that makes a formula column untrustworthy. Also extracted `align_text_x`, which was inline in `draw_cells`. It counts characters rather than bytes; a multi-byte string measured with `len()` is pushed off the cell entirely. The 7px-per-character approximation is unchanged and still crude — correcting it needs a real text measurer, not a different guess — but it is now in one place and under test, so replacing it will be a visible diff rather than a silent shift. Tests 21 -> 26. New: kinds default to Text, a Latex column keeps its kind through a drag-reorder, left alignment ignores content, centre and right alignment against the stated approximation, and character-vs-byte counting. Verified by reintroducing two defects: measuring bytes fails the multi-byte test, and resetting kind during a reorder fails the kind-preservation test. The invoicer's six columns gained an explicit `kind`. That break was caught by the `Invoicer and demo compile` step added with the workflow in the previous commit, which is what it is there for.	2026-08-17 04:27:12 +00:00
andodeki	44bf7da725	test(cad): cover the shapes the SVG exporter never drew in a test, 82.48% -> 99.02% ... Only boxes were exercised. Cylinders, spheres, circles, arcs, polygons, extruded polygons and CSG results all had their own arm in the SVG visitor and not one of them was executed — 110 uncovered lines, in the exporter that produces the construction drawing. That is the worst shape for an exporter bug: a part whose arm is wrong does not fail anything, it just is not in the drawing. Nothing is red, the file opens, and the column is missing. 13 tests: - Every drawable variant is exported on its own and must produce exactly one path. Nine variants, nine assertions. - A round outline has one point per segment, and a sphere is drawn from segments_u, not segments_v. Both show up visually as a column faceted in the wrong axis rather than as an error. - An arc is sampled inclusively across its 32 segments (33 points) so it closes on the end angle instead of stopping a step short, and a half sweep must not return to its start. - A polygon with two vertices, and an empty CSG result, add no path. An empty `points=""` renders as a stray dot in some viewers. - The `Exporter` impl itself: the cacheless `export`, the cached one (asserted byte-identical), and the write-failure arm, whose message is what the status label shows. Only `build_svg` was covered before, so a broken `export` would have shipped. - A 90 degree yaw must change the projected outline of a polygon. The box arm had rotation covered; the polygonal and round arms use a different projection helper and had none. Floors: arch_svg 79 -> 97, total 89 -> 92. Verified with: ./tools/test-cad-coverage.sh (510 tests green, total 93.44%)	2026-08-17 04:25:04 +00:00
andodeki	a82916b006	test(cad): cover the scene-graph builder API, 81.73% -> 98.53% ... cad_scene.rs is the type every other CAD file is written against, and 388 of its lines had never been executed. The gap was not in exotic corners -- it was the fluent builder the whole editor and the script VM construct scenes through. `NodeBuilder`'s setters, `SceneBuilder`'s starters and domain builders, `push_raw`, `CadTransform`'s helpers, the 2-D solids' size/set_size arms, `ParamHash` over half the variants, `walk_scene`'s dispatch, and the `Exporter` default methods were all at zero. 32 tests, grouped by what they protect: - The setters are checked for what they must NOT touch as well as what they set. `.cube().radius(9.0)` has to be a no-op, not a silent solid swap; `.rotate_y(30).rotate_y(15)` has to be 45 degrees, because every one of these helpers is additive and a helper that assigned instead would drop the earlier call. - The domain sugar is pinned to its documented axes: length/width to size.x, domain_height to size.y, thickness/depth to size.z. Getting one onto the wrong axis gives a wall 0.2 m long and 6 m thick, which reads as a modelling mistake rather than a code one. - The six domain builders are checked for layer, name and their documented default colour. Asserting the colour rather than "not the default material" is deliberate and was found the hard way: Column's grey IS the default colour, so it correctly shares the default material instead of registering a duplicate. - `set_size` is checked on every parametric solid. It is what the properties panel calls, and a missing arm is a control that does nothing -- the same class of defect the by-value-getter CI gate already guards. - `size()` on a CSG or extruded solid is checked against a real mesh bounding box, including the empty-result case. That arm used to return a hardcoded 1x1x1, which made those parts unpickable outside a 1 m box at their origin. - `ParamHash` is checked to move for every field of the 2-D and section variants. It keys the mesh cache AND the viewport's GPU buffers, so a field it does not hash is an edit that leaves stale geometry on screen. - `walk_scene` is checked to route all twelve `CadSolid` variants to their own callback, in order, with `leave_node` always firing. The exporters are all visitors: a variant landing in the wrong arm is a part that silently vanishes from the STL, the SVG or the PDF. A visitor overriding nothing is walked too, so the trait's default bodies are executed rather than assumed. - `export_to_vec`, `export_with_cache` and `spawn_export` -- the default methods an exporter gets for free, all on the async export path -- are driven through a counting stub, with the worker thread joined so the callback assertion is deterministic. Floors raised to lock it in: cad_scene 78 -> 96, total 85 -> 89. Remaining 44 lines are small accessors and defensive arms. Verified with: ./tools/test-cad-coverage.sh (499 tests green, total 92.44%)	2026-08-17 04:23:24 +00:00
andodeki	ab17c72c55	feat(makepad-table): drag-reorder columns, and the first tests this crate has ... Phase 4 of the README's table, plus the test infrastructure Phases 1-3 never had. The crate had zero tests before this; it now has 21. Drag-reorder: - A press on a column header no longer commits to an action. It arms a drag and resolves on release: travel more than 8px and it reorders, release without travelling and it opens the column menu as before. Without that ambiguity resolved, every menu open would jitter into a one-pixel drag. The threshold matches `TouchTracker::MOVE_THRESHOLD` so a mouse and a finger agree on what a drag is. - While dragging, the carried column is tinted full-height and a 2px bar marks the boundary it would land on. The bar is suppressed when the drop is a no-op, so no bar means nothing will happen rather than a bar sitting misleadingly at the source edge. - `TableAction::ColumnMoved { from, to }` fires only when the index actually changed, so a host persisting column order is not asked to write on every wobble. An open cell editor is cancelled, because it addresses a cell by index and the indices just moved underneath it. `draw_drag: DrawVector` — declared, never used anywhere — is replaced by two `DrawColor` layers. `DrawVector` is a full tessellator with path, vertex, index and paint state; a translucent rectangle and a vertical bar do not need any of it. Testability, which needed a structural change rather than a test file: `Table` derives `Script` and `Widget`, so it has no `Default` and cannot be constructed without a live `Cx`. Nothing about it was unit-testable. The logic worth testing does not need a widget, so it moved off it — `ColumnGeometry` owns boundary and drop-position arithmetic, and a free `reorder_columns` owns the move. `Table` forwards to both, and `compute_layout` now goes through `ColumnGeometry` too, so there is one implementation rather than two that can drift. The 21 tests cover column geometry at even and uneven widths and at a non-zero origin, drop-position resolution including the exact-midpoint case and clamping outside the table, the index shift in both directions, no-op drops, out-of-range refusal, cells travelling with their header, ragged rows, a permutation property over repeated drags, and the Phase 3 menu's geometry and hit-testing. Verified by reintroducing three defects separately: removing the shift for the removed source column fails 7 tests, dropping the no-op guard fails 1, and moving headers without their cells fails 3. Phase 3 was marked "scaffolds only" in the README and was in fact substantially complete — menu state, open, hit-test, apply, and drawing all present, with 15 row and column actions wired. Corrected to done, with its geometry now under test. Also adds `.forgejo/workflows/makepad-table.yml`, the first CI this tree has had. Every step passes `--manifest-path` explicitly: the crate is excluded from the root workspace, so `-p` from the repo root cannot reach it and `--workspace` skips it — omitting the flag does not fail loudly, it silently tests nothing. The workflow gates tests, clippy at `-D warnings` and fmt, and asserts three invariants that would otherwise regress quietly: that the exclusion still holds from both sides, that no manifest tracks a git branch instead of pinning a revision, and that monetary fields stay integer. Each gate was checked by breaking what it protects. The exclusion check caught a defect in itself while being tested: a bare grep for the path also matched the explanatory comment above the exclude list, so deleting the entry and keeping the comment passed. It now anchors on the quoted entry. Two pre-existing clippy warnings fixed so the new `-D warnings` gate starts from zero.	2026-08-17 04:22:22 +00:00
arena-agent	d62cc13d34	style(nigig-build): cargo fmt the two test targets left unformatted ... tests/ui.rs and tests/cost_estimator.rs drifted out of rustfmt shape in the recent feature/merge series, failing the whole-crate fmt gate (cargo fmt -p nigig-build -- --check). Mechanical reformat only.	2026-08-17 04:17:36 +00:00
arena-agent	ff0cba1b80	fix(project): replace retired SpreadsheetGrid::select_cell with set_selection_pair ... spreadsheet-ui 6a3c467 removed the direct selection helper, leaving apply_spreadsheet_op calling a method that no longer exists — the nigig-build lib (and therefore every cargo gate) stopped compiling. set_selection_pair((r, c), (r, c)) is the API the same migration series already adopted (8fe7db2); both call sites redraw the view right after, covering the paint the removed helper used to trigger.	2026-08-17 04:17:36 +00:00
arena-agent	5e5adf962d	fix(doc): boot the CRDT editor with content and migrate persistence to the app-data store ... The Android APK (pageflipnav) booted the doc workspace to a blank page. Two compounding causes, both invisible to sandbox gates: - CrdtDocEditor (the active editor since the navigation switch) had no boot init: it starts from DocumentController::default() and only the legacy DocEditor seeded the showcase document behind its initialized gate. The first event on a factory-fresh editor now runs init_document: load the on-disk save when it decodes as #MP_CRDT_V1 wire (initial_document_source gates that so classic-format saves stay with the legacy workspace's first-edit migration), otherwise seed_demo_doc builds a CRDT mirror of demo_doc_blocks() -- styled headings, accent runs, divider, image node, the 4x3 table with bold header, and the closing hint. set_engine flips the same flag so a host-installed document is never overwritten. - persistence.rs resolved its save file under env!("CARGO_MANIFEST_DIR"), baking the build machine's absolute source path into the binary; on device that path does not exist, so Open read nothing and Save wrote nowhere (the errors were swallowed), and on desktop the app polluted its own checkout. Writes now go only to app_data_dir()/nigig_build_store/generated/current.doc.json (the crate-wide convention the CAD store already uses); reads keep a one-way fallback to the legacy source-tree file so an unreplicated developer save is honored once. Boot and migration emit [DOC_TRACE] lines so a device logcat session names the branch that fired. Tests (8 new): boot-source gate (CRDT wire boots verbatim; classic JSON and None route to the demo seed), runtime boot on first event (source-agnostic non-empty projection + flag), host-installed-engine no-overwrite guard, full structural assertion of the seeded showcase, and four temp-dir persistence tests (round trip, store-beats-manifest precedence, manifest fallback, empty-file rejection). DEVICE_VERIFICATION.md gains the matching section-9 hardware rows (9.0 fresh-install demo boot, 9.3 classic-save coexistence).	2026-08-17 04:17:36 +00:00
andodeki	ea98d4d95c	fix(makepad-table): exclude from the workspace, pin makepad, fix money defects ... `crates/apps/makepad_table` is a nested workspace that has never been compiled — its README says as much: "written without a local cargo/rust toolchain, so the first compile on your machine is the verification step." This is that step. Four crates, all of which build, and three defects in the money code that only a compiler and a test runner could have found. Workspace containment, which is what was asked for: - The root manifest now names `crates/apps/makepad_table` in `exclude`. Cargo already declined to absorb it, because the crate carries its own `[workspace]` table — but that made the isolation a property of someone else's manifest. Deleting that table would have pulled four crates and a second makepad checkout into every workspace-wide build. Verified: the root workspace resolves 58 members and none of them are these. - `examples/table_demo` belonged to no workspace at all and had no `[workspace]` table of its own, so `cargo metadata` failed outright in that directory. It is now a member of the nested workspace. Kept rather than deleted: it is the template the README's "drop into makepad" section refers to. - All three manifests pinned to the fork revision the rest of the repo uses (`gitdab.com/andodeki/makepad` @ ecf5a57) instead of tracking `github.com/makepad/makepad` branch `dev`. A floating branch means the same commit of this repo builds against a different makepad from one day to the next, and against a different makepad from every other crate here. All four crates verified to compile against the pin. The defects, in the order they surfaced — each was hidden by the one before it: 1. `format_with_thousands` computed `(i - first_group_len)` before the `i >= first_group_len` guard that protects it. `&&` short-circuits left to right, so the check never ran in time. Any number whose leading group is short of three digits — 2, 3, 5, 6, 8, 9, 11, 12 digits wide — underflowed a usize: a panic in debug, silent wrapping and misplaced commas in release. Every currency string in the application went through it. The two existing tests used 1234 and 1234567, the two widths that happen to work. 2. With the panic gone, `Currency::format` was visibly wrong on negatives. The symbol was emitted before a signed whole part, giving "$-12.34" instead of "-$12.34"; and `whole` truncated toward zero while `frac` used `rem_euclid`, so the two disagreed below zero. -1234 formatted as "$-12.66" and -1 as "$0.99" — the wrong sign, the wrong place, and the wrong amount. 3. `invoice_totals_arithmetic` asserted `1_840_00` where the sample data totals 1_840_000 minor units. The prose in the same comment said 18,400.00, which is right; the literals were a factor of ten low. The arithmetic was never wrong, the expectations were. The two loose range assertions on tax and grand total are now exact equalities. Tests 12 -> 16 across the two crates, and all 16 pass; previously 6 of 12 failed. Each fix was verified by reintroducing the defect on its own: the guard-order bug fails 5 tests, the sign bug fails 4 with the overflow fix left in place, and dropping the per-line discount from the tax calculation fails the arithmetic test by 71.32 — an error the old range assertions were wide enough to have accepted.	2026-08-17 04:10:26 +00:00
andodeki	5cb1bfe9f3	test(spreadsheet): cover the branches the report named ... Nine tests against `workbook_api.rs`, the weakest file in the engine at 77.80%. Now 88.80%; engine total 88.97% -> 90.09%, tests 259 -> 260. One of them pins a trap rather than a bug. `set_cell` calls `begin_recording()` before `apply()`; the other eight public mutators (`remove_cell`, `put_cell`, `set_col_width`, `set_row_height`, `toggle_bold`, `set_number_format`, `set_alignment`, `set_bg_color`) do not. Calling one of those directly and then `undo()` reverts the *previous* recorded edit, not the one just made. Nothing ships broken: every `spreadsheet-ui` call site takes its own `data.snapshot()` first, checked one by one in `grid.rs`. But the asymmetry is invisible at the call site and the next caller will not know to snapshot. `only_set_cell_records_its_own_undo_step` states the current contract so a change to it is a deliberate decision rather than an accident.	2026-08-17 04:05:36 +00:00
andodeki	83839ea0a3	test(spreadsheet): coverage for the UI controllers, and fix a 0% report ... The coverage script measured the engine only, and it cherry-picked four source files to report on, which flattered the number: 91.15% against a hand-picked subset versus 88.97% for the whole of `src/`. Rewritten to cover both crates honestly, with per-crate floors and a listing of uncovered lines. Two bugs in the script itself: - The ignore regex contained the work-directory name, so it excluded the very sources being measured and reported a confident 0%. The work dir also cannot live inside the repo, or Cargo treats the copied crates as workspace members and refuses to build them. - `llvm-cov show` filename headers carry no trailing colon, so the awk matcher never fired and the uncovered-line listing was always empty. `spreadsheet-ui/src/{grid,ui,workspace}.rs` and `src/bin/` are excluded: the first three are `script_mod!` generated DSL and the last is desktop startup, neither of which a unit test can reach. UI controllers now measure 94.55%: `event_router.rs` 70.59% -> 97.96%, `selection.rs` 80.65% -> 100%. UI tests 9 -> 17.	2026-08-17 04:05:29 +00:00
andodeki	6f05c47f20	fix(pay): restore visible:false on pin_input, and gate it (0.3 regression) ... An upstream commit removed `visible: false` from `pin_input` in the shared pay sheet while leaving it on `pin_eye_btn`. Every existing gate still passed, because they all probe the *compile* surface: they prove the field is absent from a packaging build. None of them read the DSL, where the field legitimately exists in a default build and the hiding is what keeps the control off screen until a demo build unhides it on init. That is the DSL-reload hole review item 0.3 asks to close: a live reload re-reads the DSL, so a control that is visible by default there is visible on screen regardless of what init did. `check-no-pin-capture.sh` now walks the DSL for both PIN controls before it runs the compile probe. Verified it fails on the unfixed sheet and passes on the fixed one.	2026-08-17 04:05:21 +00:00
andodeki	8701f5df51	feat(pdf): image embedding and header/footer stamping — Phase 4 complete ... The last gap in Phase 4: dart-pdf's header_footer_test, image_stamp_test and image_pdf_test had no counterpart here. What was missing is worth stating precisely, because it is the shape of bug ADR 0017 exists to catch. ContentWriter::draw_image has emitted `q w 0 0 h x y cm /Name Do Q` since Phase 2, and was tested. But nothing in the stack could *create* the image XObject that /Name resolves to. So every Do operator ever written named a resource that did not exist, no document could contain a raster image, and nothing anywhere returned an error. The writing half was present, the reading half faithfully reported the content stream, and the image was simply never there. stamp.rs adds: image XObject embedding, header/footer banners with left/centre/right alignment, image stamp content, and stream composition. A JPEG is embedded as-is with /DCTDecode — PDF's image model is the same DCT data the file already holds, so re-encoding would lose quality for nothing — and its geometry is read from its own SOF marker rather than trusted from the caller, because a /Width that disagrees with the codestream renders as diagonal garbage in every viewer. Raw samples embed as Flate. Embedding an image then adding the page that draws it exposed a live defect in PdfDocBuilder. add_object derived its number from `3 + 2 * pages.len()`, so every add_page after an add_object silently shifted a number already handed out. Embedding an image and then adding its page — the natural order, since the page's content stream has to name the image — produced a page whose /XObject entry pointed at the page object itself: 3 0 obj <</Type /Page ... /XObject <</Im0 3 0 R>>>> The file parsed. The reference resolved. The resource was the page. This is the same positional-numbering defect already fixed once for fonts, one layer out — the comment above first_extra_object_number describes the font version, where /ToUnicode pointed at the descriptor and /FontFile2 at the Type0 wrapper. Both come from deriving object numbers from collections that are still growing. Fixed at the root: the page count is frozen when the first extra number is issued, and pages added afterwards are allocated past the fixed block instead of colliding with it. Non-contiguous page numbers are legal — /Kids is an explicit array — and 952 tests confirm nothing depended on the order. The integration tests parse the generated file back with PdfDocument and assert the image appears in `page.xobjects` with subtype Image, that its /Width and /Height match the SOF marker, and that the header and footer baselines are at opposite ends of the page. Reading the resource back is the assertion that matters: a substring check for "/Im0 Do" passed throughout the entire period when no image could be embedded at all. Verified by mutation, five injected defects, each confirmed red: numbering fix reverted 4 fail JPEG width/height transposed 5 fail header positioned from bottom 3 fail sample-count check removed 1 fail attach_image_to_page a no-op 5 fail One test needed correcting rather than the code: three assertions grepped the output for operators, which are Flate-compressed by default, so they were asserting against compressed bytes. They now disable compression explicitly — the structure is identical either way, and the alternative was a test of miniz_oxide. Engine suite 920 -> 952. Coverage 86.16% -> 86.40%; stamp.rs at 94.64% with a floor at 90. Phase 4 is complete and the plan records it, including the numbering defect, since a status table that lists only features would not have told the next reader why the object numbers look the way they do.	2026-08-16 22:27:32 +00:00
andodeki	32b8decc1e	feat(email): real inbox, compose and More pages (C4b/C5/C7, D1/D2/D3) ... C4b: the inbox fetches real mail via spawn_fetch_inbox (backend-agnostic) and renders loading / error / empty states; sample_thread() is test-only. C5: Compose is a real form -- to/subject/body, build_without_config validation, two-tap confirm, spawn_send_message (branches on backend). C7: a Refresh button re-fetches (worker -> InboxFetched -> drained on the UI thread). D1: the last placeholder, more.rs, is now the account page (status, backend, sign-out) -- there is no duplicated scaffold left to extract. D2: the lib.rs compatibility shims are deleted; imports go straight to nigig_core/nigig_uikit and NavigationBarAction lives in a real module. D3: the CachedWidget decision is documented in email.rs.	2026-08-16 22:22:55 +00:00
andodeki	c792ec5a30	feat(email): SMTP transport pool (D4) and drop the dead action variant (D5) ... D4: a one-slot transport pool reuses the SMTP connection across sends instead of rebuilding a transport (TCP+TLS+AUTH) per operation. Safe because SEND_IN_FLIGHT already serialises sends, so a single reused transport is exactly the right size. The entry is moved out of the pool while held (a MutexGuard is !Send and would poison the spawned future), and the reuse-vs-rebuild keying -- server/port/username AND password -- is a pure, tested function. Connection-level reuse is a read of lettre's contract, not an observed handshake (no live relay in CI). D5: EmailWorkerAction::None is gone, with its Default and ActionDefaultRef impls. The action is consumed only via downcast_ref() (needs 'static + Debug), so no default was ever required. Also: EmailSessionAction (SignedIn/SignedOut) so the More page's sign-out reaches the inbox across the sibling-page PageFlip boundary.	2026-08-16 22:22:55 +00:00
andodeki	78d4a52e6f	feat(email): complete Phase C domain — IMAP, keystore seam, cache, pacing, dispatch ... C1e: imap_client.rs — ImapTransport trait, ImapClient (verify + list_inbox), a pure INTERNALDATE parser and envelope mapping, and a feature-gated async-imap transport (native only; wasm never compiles it). C1f: credential_store.rs — CredentialStore trait and a fail-closed default; the platform keystore (AndroidKeyStore, per the SMS precedent) is the follow-on that cannot be host-tested. C3: email_cache.rs — a local mail cache whose bodies are pushed through a BodyCipher before hitting disk; PlaintextBodyCipher is the honest default until C1f lands a real key. C6: email_pacing.rs — SendRateLimiter + SendPacing ported from robius-sms with email-shaped limits (100/hour); fixes a zero-capacity panic in the port. C5/C4b plumbing: email_session.rs (shared signed-in account), InboxFetched action, spawn_fetch_inbox and spawn_send_message (backend-aware dispatch), and EmailSendRequest::build_without_config for the proxy send path. Domain tests 154 -> 193.	2026-08-16 22:22:55 +00:00
andodeki	d15a034797	test(cad): cover the async export path and the model-name env read ... exporters.rs 76.30% -> 91.17%, constants.rs 82.69% -> 97.30%. `spawn_export_to_target` was 0% -- the entire function. It exists because every export used to serialise on the UI thread into a fixed path, so a 1,000-part GLB froze the editor and the second export of a session destroyed the first. The replacement had never been executed by a test: not the worker thread, not the BufWriter flush, not the callback. Four tests, driven by a stub Exporter over an empty scene, each blocking on the callback through a channel so the assertion is that `on_done` actually fires on the worker thread: - success: the bytes land at the path, and the status message names the byte count and the destination. The old fixed-path exports had nothing to assert here -- the destination was not a parameter. - exporter failure: reported as "export failed: ...", and NO file is created. A half-written export that reports success is worse than no export. - undeliverable: parent is a regular file, so create_dir_all fails and the message says so. - a directory in the file's place: the other side of the create_dir_all guard, where the write itself fails. Still uncovered in exporters.rs: the ExportTarget::Prompt arm, 28 lines. It raises a native save dialog; there is no windowing system in a coverage run and the harness's picker stub deliberately refuses rather than faking a save, so those lines are reported as uncovered instead of being reached by a test that proves nothing. constants.rs: local_openai_model was the one endpoint-configuration reader with no test, while local_openai_url next to it had five. A blank model name now has to be None -- passing "" to the endpoint produces a rejected request that surfaces to the user as an AI failure rather than as missing configuration. Verified with: ./tools/test-cad-coverage.sh (466 tests green)	2026-08-16 22:22:26 +00:00
andodeki	34d47f4479	test(cad): cover persistence.rs, 0.00% -> 94.51% of lines ... persistence.rs owns every byte the CAD editor writes: the saved script, the baked OBJ mesh, the thread-local slot the script VM uses to hand a Solid back to the UI, and the pending-image mutex. It had no tests. Not low coverage -- zero. It could not have had any. `save_cad_state` and `load_saved_cad_script` resolve their directory through `cad_data_dir()`, which is the real per-user application data directory. A test that called them would write into the developer's (or the CI runner's) actual data dir, and two tests would fight over the same file. So the save/load pair is split: save_cad_state_in(dir, source, solid) load_saved_cad_script_in(dir) with the existing public functions delegating to them through `cad_generated_dir_path()`. No caller changes, no behaviour changes -- viewport.rs, workspace.rs and workspace_actions.rs keep calling exactly what they called before. 14 tests, on the failures rather than the happy path: - A save that cannot create its directory returns the "could not create generated directory" error. This is the path that used to be `.ok();` at the call site, which is how a "Saved" label appeared over a write that never landed. - A failed OBJ write still leaves the script on disk, and the test asserts the script is readable back afterwards. The write order is load-bearing: losing the baked mesh costs a rebuild, losing the source costs the user's session. - An empty or whitespace-only script file loads as None, not as Some(""). Some("") would open the editor blank and then overwrite a script the user still had. - The script-output slot must empty on take. A stale Solid re-applied on the next tick would silently undo whatever the user did in between. - The generated paths are asserted to hang off the runtime data dir and to contain no build-time source path -- the CI gate for that rule greps for one macro, this pins the actual result. Uncovered: 6 lines, the two public wrappers. Calling them means writing to the real data dir, which is the thing this commit is avoiding. Verified with: ./tools/test-cad-coverage.sh (459 tests green)	2026-08-16 22:20:55 +00:00
andodeki	2ea5a7424e	fix(cad): mat4_inverse was wrong for every matrix that rotates and translates ... 3-D picking has been unprojecting clicks to the wrong world point. The coverage run in the previous commit left seven lines uncovered -- the success tail of mat4_inverse -- and the round-trip test written to reach them failed on element 12. mat4_inverse is a cofactor expansion transcribed from the standard MESA gluInvertMatrix. Comparing all sixteen expressions term by term against the reference, EVERY ONE of them had at least one mistyped index: inv[0] a[9]*a[11]*a[14] should be a[9]*a[7]*a[14] inv[12] a[8]*a[10]*a[13] should be a[8]*a[6]*a[13] inv[13] a[8]*a[10]*a[13] should be a[8]*a[2]*a[13] inv[14] a[0]*a[7]*a[13] should be a[0]*a[6]*a[13] inv[14] a[4]*a[7]*a[13] should be a[4]*a[2]*a[13] ... and one each in the other eleven. The wrong terms all carry a[3], a[7], a[11] or a[15] -- the bottom row. For a pure translation or a pure rotation those are 0, 0, 0, 1 and the mistyped products cancel, which is why the function looks correct in isolation and why nothing caught this. It stops cancelling the moment a matrix rotates AND translates. Which is what the two callers pass in: - CadViewport::camera_eye inverts self.last_view. - CadViewport::unproject_point inverts self.last_proj, whose element 11 is -1 for a perspective camera, and then self.last_view. Measured on a view matrix with a 35 deg yaw and eye (3, -1, 2), the old code's inv * m came back with 0.4698 and -0.7988 in the translation row instead of zero: a click resolved to a point roughly one unit away from where the user clicked, growing with camera distance. Selection, snap and the measure tool all read that point. Fixed by transcribing the reference again, this time verified: the tests assert inv*m AND m*inv against the identity for a translation, a rotation, translate*rot_y, translate*rot_zyx, a perspective matrix, an orthographic matrix, and a dense matrix with no zero entries -- the last because a wrong index cannot cancel when nothing is zero. math.rs is now 99.60% of lines. The three remaining are the `det.abs() < 1e-8` early return's own arm, covered by mat4_inverse_of_a_singular_matrix_is_none but not attributed to it. Verified with: ./tools/test-cad-coverage.sh (445 tests green)	2026-08-16 22:18:57 +00:00
andodeki	500489c2f0	test(cad): cover math.rs, 20.40% -> 99.00% of lines ... math.rs had no tests at all. Every other engine file in the CAD module carries its own #[cfg(test)] block; this one -- the file that decides where a click lands in 3-D, whether a point is inside a picked polygon, and how a part's model matrix is built -- had none, and the coverage harness added in the previous commit put a number on it: 20.40%. 39 tests, written against the behaviour that is easy to get wrong rather than the happy path: - The two normalize functions disagree on purpose. DVec3::normalize returns -Z for a degenerate vector, vec3_normalize returns zero. Both are pinned, because "fixing" either to match the other would change picking behaviour silently. - point_in_polygon is exercised on a concave L-shape, not just a square. The picking path projects a bounding box to screen space and can produce a concave outline; a convex-only test passes on a ray-casting implementation that is broken for exactly that case. - point_on_segment_nearest is checked past both endpoints, where the projection parameter is clamped, and on a zero-length segment, where the 1e-12 guard is the only thing between the caller and a NaN. - ray_triangle_intersect is checked on each rejection branch separately: parallel, u < 0, v < 0, u + v > 1, and a triangle behind the origin. - ray_aabb_intersect is checked from outside, from inside (where it returns the exit parameter, not the entry), behind the ray, parallel to a slab both inside and outside it, with a negative direction component (the t1/t2 swap), and on a diagonal miss -- which is the only way to reach the `tmin > tmax` return, since an axis-aligned miss leaves through the parallel-slab branch first. - segment_intersection is checked parallel, crossing, and crossing off the end of one segment and of both. Remaining uncovered: 7 lines, the success tail of mat4_inverse. The next commit reaches them, and finds out why they were never reached. Run: ./tools/test-cad-coverage.sh	2026-08-16 22:18:16 +00:00
andodeki	674b2be66d	feat(pdf): JPEG 2000 decoding — Phase 3 complete, all three codecs ... The last codec ADR 0015 deferred. The plan recorded the blocker as a dependency decision, not an algorithm: openjpeg would add a C dependency that breaks the Android cross-compile. This is pure Rust and adds no dependency at all. It shares the MQ arithmetic decoder with JBIG2 — T.800 and T.88 specify the same coder — so the previous tranche paid for most of this one. Context::with_state moved onto the shared type because JPEG 2000 starts three of its nineteen contexts away from state 0 and JBIG2 starts all of them at 0. Implemented: codestream and JP2 container parsing, packet headers with tag trees and the bit-stuffing rule, EBCOT tier-1 (all three passes, four zero-coding context tables, run-length mode), both 5/3 reversible and 9/7 irreversible wavelets, RCT and ICT, arbitrary decomposition levels, and multiple components. Refused by name: multiple tiles, custom precinct partitions, code-block style options, COC/QCC/RGN/POC overrides, subsampled components. Each error says which feature the file needs. This matters more here than anywhere else in the stack, because a JPEG 2000 decoder that quietly skips something does not fail — it returns a slightly soft or banded image that looks entirely fine. That property also dictates how this is tested. Fixtures are produced by OpenJPEG via Pillow and compared **exactly**, sample for sample: the fixtures are lossless 5/3 so no tolerance is needed, and a tolerance is where a subtly wrong decoder hides. Four images — grayscale raw codestream, the same in a JP2 container, a larger one whose tag trees actually branch, and RGB. A generator script is checked in beside them so CI can prove the fixtures still match what produced them. Verified by mutation. The first round was misleading and is worth recording, because it is the same lesson as ADR 0017: DC level shift dropped 3 fail 5/3 lifting rounding changed 2 fail RCT sign flipped PASSED <- survived RCT components swapped PASSED <- survived cleanup run-length disabled PASSED <- survived sign-context XOR dropped PASSED <- survived Four mutations survived because Pillow writes MCT=0 by default, so the RGB fixture coded its three components independently and never reached the colour transform at all. The RCT branch was completely untested while appearing covered — an untested branch that looks tested is worse than one that looks missing. Added rgb8_mct.j2k with mct=1; all four now fail. The header bit-stuffing mutation is caught by the unit test rather than the round-trip. Two real defects found while writing the tests: - A corrupt marker length in a tile-part header walked the read cursor past the codestream and panicked on a slice. Found by the corruption sweep, not by review. The sweep now truncates at every length and flips every byte of a real file, and asserts only that nothing panics. - The 9/7 flat-signal test initially asserted an amplitude I had derived from my own arithmetic. That is a test agreeing with the code by construction. It now asserts flatness — a ripple means the lifting or the edge extension is wrong — and the amplitude is pinned by the OpenJPEG round-trips instead, which use pixels this code did not produce. Also removed two dead fields and an unused parameter that clippy found: Subband::x0/y0 are always zero in the single-tile case this supports, and dead state implying multi-tile support exists is worse than no state. JPX decodes on the image path, like JBIG2, because the codestream carries its own geometry; it stays in REFUSED_CODECS with a reason string saying where it is decoded rather than that it is missing. Engine suite 866 -> 920. Coverage 85.66% -> 86.16%; jpx.rs at 93.72% with a floor at 88. Phase 3 is complete: CCITT, JBIG2 and JPX all land, and the plan is updated to say so and to record how the two gating questions — JBIG2's CVE record and JPX's C dependency — were actually answered.	2026-08-16 22:17:40 +00:00
andodeki	81e846ae35	feat(pdf): JBIG2 generic-region decoding, and the bitonal image path ... The second codec Phase 3 deferred. ADR 0015 made a threat review the precondition for implementing JBIG2 rather than an effort estimate, so the review's conclusion is encoded in what this does and does not do. What is implemented: the MQ arithmetic decoder (T.88 Annex E), generic region decoding with templates 0-3 and AT pixels, TPGDON typical prediction, and MMR-coded regions. Segment header and region info parsing, and page composition. What is refused, by name: symbol dictionary, text region, halftone region, refinement region, and a non-empty /JBIG2Globals. Those are the segment types that carry the composition machinery, and shipping them means shipping an interpreter over untrusted input — it is what FORCEDENTRY built its computer out of. A file needing them gets a typed error naming the segment type, exactly as the whole codec used to. The MQ coder itself is pure arithmetic with no file-controlled addressing, which is why it is safe to run and the composition parts are not. Every bound is checked against the declared region size before a buffer is indexed: region dimensions against MAX_DIMENSION and a pixel budget before allocation, segment lengths against the remaining stream, and the region's declared position against the page before a single pixel is written. That last one is the format's actual exploit surface and it has its own test saying so. MMR regions delegate to ccitt.rs rather than carrying a second G4 decoder, so the two cannot drift apart. A test decodes the same coded bits through both paths and requires identical pixels — that is what catches an inverted convention, and JBIG2 is natively 1=black where PDF is 0=black, so the inversion is real and easy to get backwards. JBIG2 is decoded on the image path, not in the filter facade, because it needs /Width and /Height from the image dictionary. It therefore stays in REFUSED_CODECS with a reason string that says where it *is* decoded, so a host showing that string does not tell a user the codec is missing when it is not. CCITT moved the other way for the same reason inverted: it derives its dimensions from /DecodeParms, so it decodes in the facade. Wiring both into ImageInfo::decode_to_rgba surfaced a defect in the parallel-array rule that the CCITT tranche had not reached. For /Filter [/FlateDecode /CCITTFaxDecode] the /DecodeParms array has one entry per filter, and the obvious implementation takes arr[0] — handing the Flate parameters to the fax decoder. ccitt_parms_of finds CCITT's own index instead. This is the same bug ADR 0015 records for the old chain code, in a new place. A declared-but-unresolved /JBIG2Globals returns None rather than decoding without it. Decoding anyway yields a blank or partial image that every caller reads as a success — the declared-versus-delivered failure of ADR 0017. Verified by mutation, six injected defects, each confirmed red: compose bounds check removed 1 fails pack() stops inverting 4 fails (both suites) globals silently ignored 1 fails refused segments silently skipped 1 fails declared-globals check dropped 1 fails ccitt_parms_of always takes slot 0 1 fails 29 unit tests and 12 integration tests, asserting pictures rather than buffer lengths. ADR 0016's stub JPEG decoder returned a correctly sized black rectangle and passed everything that checked a length; these say which colour they expect. Engine suite 825 -> 866. Coverage 85.15% -> 85.66%; jbig2.rs at 94.84% with a floor at 90, and image.rs 31.76% -> 44.77% so its floor rises 28 -> 40. JPX remains refused and is the next tranche.	2026-08-16 22:02:26 +00:00
andodeki	b26e6a1f14	feat(pdf): CCITT G3/G4 decoding — the codec Phase 3 deferred ... ADR 0015 refused CCITTFaxDecode by name and recorded it as the recommended next codec: well specified, no arithmetic coding, no C dependency. This implements it. T.4 and T.6, all three schemes selected by /K: G3 1D modified Huffman, G4 two-dimensional, and G3 mixed with a tag bit after each EOL. Both run-length code books, makeup and extended makeup codes, and the pass/horizontal/vertical mode codes. /Columns, /Rows, /BlackIs1 and /EncodedByteAlign are honoured; /Columns and /Rows are bounds-checked before anything is sized from them, because both are attacker-controlled in a hostile file. It decodes to real pixels, so unlike DCTDecode it belongs in the filter facade rather than the image path: the generic filter contract promises decoded bytes and this can honestly keep that promise. Removed from REFUSED_CODECS, added to SUPPORTED_FILTERS — the registry now describes what the crate actually does. Both existing data-driven registry tests pick this up without editing. Three defects were found by writing the tests rather than by reading the code: - A zero-length run recorded no transition. That is exactly how a row beginning with black is coded — a white run of zero, then the black run — so every such row came out with its colours shifted by one run: "####...." decoded as "....####". - Decoding stopped at bits_left() == 0, but encoders pad the final row to a byte boundary. The padding was fed to the decoder as though it were a code, failed to match, and lost the whole image. Now a trailing all-zero tail is recognised as padding, which is unambiguous because every code book needs a 1 bit. - A row of zero-length runs did not advance the pixel position and looped forever. Found by mutation, not by review. Bounded by the column count: a hang is a worse failure than an error. Verified by mutation, five injected defects, each confirmed to turn the suite red: a0 starts at 0 not -1 1 fails pack_row fills black 13 fails find_b1 parity dropped 1 fails short-/Rows check removed 1 fails read_run returns 0 2 fails Two of those did not fail on the first attempt and changed the tests: - a0 = 0 survived, because no fixture placed a colour change at column 0 — the one position where the off-by-one is visible. Added group4_codes_a_change_at_column_zero. - read_run returning 0 survived because the new run bound also errors, so an assertion of merely "some CCITT error" could not tell the two mechanisms apart. The assertions now name the specific failure. 30 unit tests in the codec, asserting decoded pictures rather than byte counts, plus 6 integration tests through the filter facade covering the chain case, truncation and the spec defaults. The facade test asserts output != input: ADR 0015 records DCTDecode "succeeding" by returning its own compressed input, and a test that only asserted Ok passed against that bug. Engine suite 796 -> 825. Coverage 84.82% -> 85.15%; ccitt.rs at 92.57% with a floor at 88. JBIG2 and JPX remain refused and are the next two tranches.	2026-08-16 21:50:46 +00:00
andodeki	47b2f72af0	feat(email): backend chooser + two setup forms (C1c) ... SetupDraft ties account identity to the backend choice and validates them together (the direct backend must also have a usable SMTP server; the proxy backend leaves SMTP fields unset). The setup form grows a chooser -- Direct (IMAP + SMTP) vs the Nigig mail service -- with an honest per-backend summary, and two forms swapped by the chooser. The inbox branches: proxy accounts verify against the mail service via spawn_proxy_verify instead of an SMTP handshake. Also pins the Proton Bridge provider default (local bridge, not a remote imap.protonmail.ch).	2026-08-16 21:49:12 +00:00
andodeki	2230933e4a	feat(email): ProxyApiBackend HTTP client (C1d) ... The proxy backend's network half: a thin client over a ProxyTransport trait (reqwest on native, fetch on wasm, mock in tests). verify, list_inbox and send build typed requests and map status+body onto structured errors, so the parsing logic -- where the bugs live -- is host-tested without a server. The token rides in an Authorization header and never in a request type that can be Debug-printed. Also: spawn_proxy_verify posts a ProxyVerifyResult action, and build_transport is pinned to construct for every port (A2/A3).	2026-08-16 21:49:12 +00:00
andodeki	df618c4091	fix(map): overlay DrawVector import and tile super::* paths ... - overlay.rs used makepad_draw::vector::DrawVector which does not exist; use makepad_widgets::DrawVector (as in top-level overlay.rs) - makepad_map/tile.rs: crate::label/style/geometry -> super::label/style/geometry so it resolves to makepad_map submodules (which have LABEL_CLASS_PIN, bag_year_color, TILE_SIZE, stroke_prof_take) not top-level crate modules - Now cargo check shows only wayland-sys native lib missing, no Rust errors	2026-08-16 21:27:26 +00:00
andodeki	e6702c3437	fix(map): repair nigig-map build — icons, imports, crate deps ... - makepad_map/icons.rs pointed at icons/ inside makepad_map/; icons live in src/icons, fix to ../icons. - drape.rs used crate::map:: prefix which does not exist in crate root; use super:: - tile.rs crate::map:: prefix broke after module rename; collapse to crate:: - overlay.rs DrawVector came from crate::; import from makepad_draw::vector instead - view.rs used crate::{makepad_derive_widget, makepad_draw, widget} which are external; switch to makepad_widgets:: - mvt_parser, tile_disk, makepad_map/tile, drape re-used makepad_widgets::makepad_fast_inflate/mbtile_reader which are not re-exported; depend on direct crates makepad-fast-inflate, makepad-mbtile-reader and import them directly - Add missing Cargo deps makepad-draw, makepad-platform, makepad-derive-widget, makepad-fast-inflate, makepad-mbtile-reader, makepad-script pinned to existing rev ecf5a572 Workspace now passes cargo check -p spreadsheet-engine (250 tests) and map crate no longer errors on include_str / unresolved import; remaining linux GUI link requires native libs.	2026-08-16 21:14:38 +00:00
andodeki	7d6fc4cbbe	feat(pdf): document creation — outlines, forms, attachments, font subsetting ... Phase 4 of NIGIG_PDF_FEATURE_PARITY_PLAN.md. ADR 0019. Almost none of it existed: Outlines, PageLabels, EmbeddedFiles and ViewerPreferences appeared nowhere in the workspace, in any crate. What did exist was a builder whose central method was pub fn add_page_with_content(&mut self, _width: f64, _height: f64, ...) which accepted a page size and discarded it. Asking for 200x400 and 300x500 gave two US Letter pages, because no /MediaBox was written at all. The test asserted the output contained the string "/Type /Page", which it did. Two more defects sat in the object writer, both producing files our own parser rejects: dictionary keys were written unescaped (a key with a space reparses as "expected number"), and f64::NAN was emitted as the literal token NaN, so one non-finite value anywhere made the document unreadable. Added: outline trees with the open/closed state in the sign of /Count, /PageLabels as a number tree with real roman and A..Z/AA..ZZ numbering, named destinations, attachments with file specs, /Info, XMP, viewer preferences, page mode and layout; AcroForm creation for text, checkbox, radio, choice and signature fields with generated appearances; and TrueType subsetting - DejaVu Sans goes from 759,720 bytes to 4,348 for twelve characters. cmap is deliberately not rebuilt: the subset is embedded as a CID font with Identity-H, so the content stream addresses glyphs by id and /ToUnicode serves extraction. A cmap disagreeing with the content stream is worse than none. CFF is refused by name rather than emitting a font with no glyphs. Nine real bugs, every one found by running the output through an independent tool rather than by reading the code: 1 page size discarded reading a generated file back 2 dict keys unescaped probing the writer 3 NaN written as a keyword probing the writer 4 subset zeroed the lsb fontTools outline compare 5 hmtx indexed by new gid fontTools outline compare 6 name table format read as count BaseFont came out "Embedded" 7 add_font shifted numbers already handed out 8 trees allocated over font numbers - object 29 written twice 9 widgets missing /F Print, /P and appearance /Resources 7 and 8 are the instructive pair: every reference resolved and every object existed, each simply named the wrong thing. pypdf reported correct field values from a file PDFium rendered blank. 9 is the one only a renderer could find - /F defaults to non-printable, and a form XObject naming a font its /Resources does not declare is discarded whole. Verified by three independent implementations: fontTools (0 outline mismatches of 12 against the source font), pypdf (metadata, page sizes, outline with resolved page numbers, all five fields, attachment byte-for-byte, labels ['i','1']) and PDFium, which renders both pages correctly. cargo run -p nigig-pdf-graphics --example generate_sample regenerates the sample. Fourteen mutations. Three survived and each exposed a weak test: the key test used an attachment name (written as a string, never a key), nothing read the outline open state, and /P could not be witnessed because page_index is supplied by the reader, which already knows the page. All three now killed. pdf: 789 passed (was 730). pdf-ui: 775. Coverage 85.17%.	2026-08-16 21:02:19 +00:00
nigig-ci	c0b27d0586	feat(email): MailBackend trait and BackendKind — both backends (C1a/C1b) ... You chose to support IMAP-on-device AND a server-side proxy, user selectable. This is the seam that makes that contained rather than two parallel apps. Why it is cheaper than it sounds: wasm cannot open a raw TCP socket, so a proxy always had to exist for the browser target. The second backend was never optional -- it was implied scope nobody had named. C1a, mail_backend.rs: BackendKind { ImapSmtp, ProxyApi } with three predicates that exist so the UI cannot get them wrong: is_available_on_wasm() IMAP is raw TCP; a browser cannot open one, so the chooser must not offer a dead option stores_reusable_password() IMAP keeps a REUSABLE mailbox password on the device. For most people that is the password-reset channel for every other account they own. A revocable proxy token is strictly safer, and the chooser must say so rather than presenting a free choice summary() the honest one-liner, asserted by test to actually mention "password" / "revoke" BackendSettings is the PERSISTABLE half and carries no secret, exactly as EmailAccount does for the password (S2). BackendDraft::validate returns (settings, Secret) and reports every problem in one pass. The trait is deliberately synchronous and tiny -- kind(), is_configured(), describe(). Anything computable above the line (grouping, previews, threading) is NOT a backend concern, which is why email_store did not change at all. I/O stays in the free functions that already own the async context, so this file is host-testable with no runtime. ImapSmtpBackend exists with validation but no protocol client yet; that is C1e and nothing here claims a connection works. C1b: EmailAccount gained `backend: BackendSettings`, #[serde(default)] so existing persisted accounts still load. A test asserts the serialised account -- including the backend section -- contains neither the token nor a field named password/token. Provider defaults now fill IMAP too, so a Gmail user still fills one field. Outlook is special-cased: its IMAP host is outlook.office365.com, not imap.outlook.com, so the naive smtp->imap rewrite would produce a name that does not resolve. New gate, negative-tested both ways: stores_reusable_password() and is_available_on_wasm() must exist, and the persisted settings structs must not declare password/token/secret fields. Domain tests 99 -> 126. Test floor 95 -> 120.	2026-08-16 20:30:33 +00:00
andodeki	5d7474f22c	test(spreadsheet): cover cached range errors	2026-08-16 20:26:57 +00:00
andodeki	29af564f79	test(spreadsheet): cover cycle coercion and mutation errors	2026-08-16 20:21:42 +00:00
andodeki	5fae4d6abd	test(spreadsheet): cover cached AST fallback branches	2026-08-16 20:11:35 +00:00
andodeki	6d2e3fb696	fix(pdf): repair the tree a hand-resolved merge left red ... Commit 258fa32 ("Merge origin/main: resolve xref/document conflicts") is not a merge - it has one parent - and it landed a PDF tree that does not pass its own gates. Found by running the suite, not by reading the diff. Four separate breakages: 1. xref_streams::a_wrong_type_at_startxref_is_named_not_guessed FAILED. The conflict resolution replaced the diagnostic error with a generic "expected xref or cross-reference stream". The fixture writes /Type /Frobnicate and the parser has that name in hand; throwing it away leaves the reader knowing only that this is not what we wanted, which is the least useful half of the story. Restored, and extended to name a stream with no /Type at all. This is an ADR 0013 merge criterion. 2. golden_render::golden_text_line_ops FAILED - the merge added the test but not its golden file. Verified the output by hand against the spec before blessing it: leading 14, lines at 700/684/670/656/642, which is correct for Td/TD/T*/'/". A golden file blessed without reading it locks in whatever bug exists. That golden cannot witness the " operator's two spacing operands: word and character spacing live in the graphics state and emit no render command, so dropping both would leave the file byte-identical. Added a test that asserts the state directly. Mutation-checked: removing the two set_*_spacing calls fails it, and leaves the golden untouched. 3. clippy -D warnings failed with 6 errors on pdf-cos and pdf-document, so CI's engine job could not have passed. Two unused imports, a dead read_be (superseded by the `field` closure in parse_xref_stream), a collapsible if-let, and - committed into the source - // ... keep the entire top of the file unchanged until the resolve_num function ... an editing instruction left in document.rs as a doc comment. 4. cargo fmt --check failed on document.rs and xref.rs. Mutation-checked both fixes: reverting the xref message fails 1 test, dropping the " spacing operands fails 1. pdf: 730 passed. pdf-ui: 775 passed. Coverage 84.15%, floors met; destinations.rs holds at 98.65%.	2026-08-16 20:09:48 +00:00
andodeki	bc387c26ae	test(spreadsheet): cover formula cells inside ranges	2026-08-16 20:05:03 +00:00
nigig-ci	901cddc716	fix(email): abandon_send shipped as dead code; wire it and gate it (B6) ... Auditing Phase B against the tree rather than against my own notes found that abandon_send() existed in nigig-core and NOTHING called it. The user had no way to stop waiting on a hung send. I had marked B6 "partial" for the right reason -- lettre cannot cancel mid-transaction -- and missed that the part I did implement was unreachable. A control the user cannot reach is not a control. It is dead code wearing a safety label, which is worse than an acknowledged gap because it reads as done. Now wired: while a send is in flight the Send button becomes "Stop waiting". The label is deliberately not "Cancel" -- this does not stop delivery, because once DATA is accepted the message is sent whether we wait for the reply or not. It frees the UI and suppresses a result the user has stopped caring about. The 20s timeout from A6 bounds the window. New gate: abandon_send() must exist in nigig-core AND be called from the UI. The wiring is the thing checked, not the function. That gate was ALSO broken when first written -- it grepped for `abandon_send()` across src/, and the comment block explaining why the control exists mentions it by name, so unwiring the call left the gate green. Same flaw as the B5 gate in the previous commit, found the same way: delete the fix, watch the gate. Now excludes comment lines. Twice in two commits I have written a gate that its own explanatory text satisfied. Worth stating rather than quietly fixing: a gate is only evidence if you have watched it fail. Phase B verified closed: B1-B6 all done, 11 gates pass, 99 domain tests, check --all-targets clean on both crates, fmt clean.	2026-08-16 20:04:41 +00:00
andodeki	1e40634e4d	test(spreadsheet): cover formula error and coercion branches	2026-08-16 20:02:00 +00:00
andodeki	258fa3259e	Merge origin/main: resolve xref/document conflicts, add makepad_table	2026-08-16 22:53:23 +03:00
nigig-ci	d889cbecd4	ci(email): gate multi-recipient send, and a gate that did not work ... Two new gates, and one of them was broken when I first wrote it. B1 gate: the send path must call email_send::parse_recipients, must NOT contain a single-Mailbox parse of the whole To field, and must add every accepted recipient. Three checks rather than one, because each failure mode is separately reachable. B5 gate: spawn_send_email must keep the SEND_IN_FLIGHT swap. THE B5 GATE DID NOT WORK AS FIRST WRITTEN. It grepped the whole file for `SEND_IN_FLIGHT.swap(true`, and the unit TESTS for the guard contain that same string -- so deleting the guard from production code left the gate green. I found it by negative-testing, which is the only reason I know. Now scoped to the text before `#[cfg(test)]`. That is worth recording rather than quietly fixing: a gate whose own test fixtures satisfy it is indistinguishable from a gate that works, and the only way to tell them apart is to break the thing on purpose. Negative tests, all confirmed firing: remove the list parse -> fires reintroduce `let to_mbox: Mailbox = ..` -> fires delete the in-flight guard -> fires (after the fix) and all 10 gates pass on the clean tree. Test floor 60 -> 95 (actual 99). Bulk page: builds through EmailSendRequest, so a partly-invalid list reports what was dropped instead of refusing everything, and requires a second tap before sending. The prompt quotes the recipient count and any duplicates or rejections, so the user knows what they are confirming. Editing the message after arming re-prompts rather than sending the old confirmation.	2026-08-16 19:51:21 +00:00
nigig-ci	fd88a70137	feat(email): multi-recipient send, which never worked (Phase B1/B2/B5/B6) ... B1 was the live Critical from the assessment. The recipient field is labelled "To (comma-separated)" and the worker did: let to_mbox: Mailbox = to.parse()?; // ONE address Mailbox parses a single address, so ANY comma-separated list failed with "Invalid to: ..." -- the user got an error for doing exactly what the placeholder told them to do. The tab named "Bulk" could reach exactly one person. The crate's headline feature did not work. B2: new email_send.rs, the seam the widget could not provide. parse_recipients accepts commas, semicolons and newlines, because a user pasting from a spreadsheet or a mail client produces any of them. It understands `Name <addr>` including a quoted name containing a comma -- "Doe, Jane" <jane@x.com> -- which a naive split(',') breaks in half and which is the normal shape when pasting a To: header. Partial failure does not fail the batch: bad entries are rejected with a reason and the good ones still send. Failing everything because one address had a typo is what made the directory CSV importer unusable. Duplicates are collapsed case-insensitively. Sending one person two copies of the same message is a bug that costs money and looks like spam. Addresses with control characters are rejected. lettre encodes headers so this is defence in depth today -- but the C1d proxy backend will NOT go through lettre (THREAT_MODEL T-E4), so the check belongs in the domain layer, not the transport. MAX_RECIPIENTS = 100. Not a protocol limit; providers cap RCPT TO per message and exceeding it fails the WHOLE message rather than the excess, so refusing locally with a number beats a provider error nobody can decode. B5: SEND_IN_FLIGHT, an AtomicBool swap. Both spawn_* functions used to fire unconditionally, so a double tap sent the message twice -- irreversible, to a real person. Same control robius-sms uses, and it lives in the domain layer so every entry point is covered rather than each page remembering. B6: partial, and named honestly. abandon_send() clears the guard and marks the pending result stale so it cannot overwrite what the user does next. It does NOT stop delivery: tokio's JoinHandle is not retained and lettre's async send is not cancel-safe mid-transaction -- once DATA is accepted the message is delivered whether we wait for the reply or not. Called abandon_send rather than cancel_send for that reason; a function called cancel that does not cancel is worse than no function. The 20s timeout from A6 bounds the window. Domain tests 72 -> 99.	2026-08-16 19:51:21 +00:00
nigig-ci	7a3c3c48e0	test(email): close the coverage gaps that are closable (Phase A follow-up) ... Measured line coverage with llvm-cov rather than assuming it: secret.rs 100.00% email_account.rs 100.00% (was 95.42%) email_store.rs 99.42% email_worker.rs 70.16% Four tests added to reach that: every_error_variant_has_a_usable_message AccountError::message() had uncovered match arms, which means a validation could fire and show the user nothing. Also asserts the messages are distinct -- if two errors share text the form cannot say which field is wrong -- and that each is a sentence rather than a token. a_malformed_address_is_reported_as_malformed_not_missing A present-but-wrong address takes a different path from a missing one, and it is the path an actual typo takes. states_without_an_account_return_none SignedOut/Verifying must not hand the form a stale account. an_empty_body_previews_as_empty_without_panicking A whitespace-only body must still yield a row. 68 -> 72 tests. On email_worker.rs staying at 70%: of its 80 uncovered lines, 30 are the network layer -- smtp_test_impl, send_email_impl, build_transport and the two spawn_* wrappers -- plus the whole #[cfg(target_arch = "wasm32")] block, which cannot execute on Linux at all. Every PURE function in that file is at 100%: is_incomplete, validate_send, config_warning, tls_mode_for_port, email_api_url_is_safe. Reaching 100% there needs a local SMTP sink, which is plan item E5. I am not mocking Cx::post_action to inflate the number: that would test the mock, not the send, and a coverage figure propped up by a fake is worse than an honest 70% with the reason recorded.	2026-08-16 19:51:21 +00:00
andodeki	1d8159e947	test(spreadsheet): cover remaining formula functions	2026-08-16 19:45:52 +00:00
andodeki	82eb6b9c73	feat(pdf): internal links that actually go somewhere ... ADR 0017 left destinations.rs at 0% coverage as an open item. The obvious reading is "an untested module". The real one is worse: nothing called it. It was pub use'd from lib.rs and referenced from nowhere else in the workspace. 0% was not a gap in the tests, it was the symptom of dead code, and nothing else was doing the job. Meanwhile PdfAnnotation read a link's target as dict.get_name("Dest") - a *name* /Dest and nothing else. Not /Dest [4 0 R /Fit], and not /A << /S /GoTo /D ... >>, which is how internal links are written in practically every real document. The corpus has had one since Phase 6, in annotations/links.pdf, and no test asserted where it went: Link { uri: None, dest: None } -> action=None Clicking it did nothing. No error, no warning - the viewer got no action and correctly performed none. A link to nowhere and a link the reader cannot parse look identical from outside. The viewer was already wired for this: PdfAction::GoToPage exists, is matched in test_host.rs, and was never constructed by anything. A complete delivery path with nothing at the source. Now: all three legal spellings parse, named destinations resolve through the /Names /Dests tree *and* the pre-1.2 /Root /Dests dictionary, and resolution happens in page_annotations where the catalogue is in reach. XYZ keeps Option per component because null is meaningful there and only there - it means "leave unchanged". Reading it as 0.0 scrolls to the origin at 0% magnification. Zoom 0 means the same as null and is normalised. Lookup uses a deliberate shallow resolve. Deep-resolving a destination array replaces [4 0 R /Fit] with the page dictionary and destroys the only thing identifying the target - the defect that once emptied every AcroForm (ADR 0006) and every annotation reference (ADR 0004). GoToAction now requires /S to be GoTo. The old code ignored /S and took /D from whatever it was handed, so a /GoToR (another file), /Launch (a program) or /JavaScript carrying a /D was reported as a local page jump. Refuse by verb, same policy as ADR 0012. An unresolvable destination is left unresolved, never defaulted to page 0: silently landing on page one is the worst outcome because it looks like the link worked. Seven mutations, all killed. M1 - removing the /S check - reported as surviving on the first attempt. It had not survived: the patch string omitted an interleaved comment so the mutation never applied and I measured the unmutated build. A harness that does not verify its own mutation says "weak test" when the truth is "never ran", and the conclusion would have been to delete a real security check. Every mutation now asserts it applied. destinations.rs 0% -> 98.65%; total 83.42% -> 83.86%. Floors added for destinations.rs and annotations.rs, verified to fail when breached. AnnotationType::Link changes shape (dest: Option<String> -> destination: Option<Destination>) and AnnotationAction gains GoToDestination; the old field could not express an explicit destination, so keeping it meant keeping the bug. AnnotationAction loses Eq because a destination carries f64 coordinates. pdf: 724 passed (was 695). pdf-ui: 769 passed (was 725). ADR 0018.	2026-08-16 19:34:01 +00:00
andodeki	0cee6be785	test(spreadsheet): cover computed boolean text and empty branches	2026-08-16 19:30:09 +00:00
andodeki	74b74bc4d5	test(spreadsheet): cover computed scalar value branches	2026-08-16 19:22:57 +00:00
nigig-ci	3786e7c1cf	docs(email): threat model, and mark Phase A complete (A6) ... New crates/apps/nigig-email/THREAT_MODEL.md. Separate from the root THREAT_MODEL.md, which is Nigig-Pay's and shares no assets with this feature. Nine threats with the control named for each, so a reader can check the claim rather than take it on trust. The two that matter: T-E2 (password leaked by our own code) was LIVE, not hypothetical -- SmtpConfig derived Serialize over a plaintext String and the whole struct was POSTed on wasm. T-E7 (DoS via a hostile message) is the SMS A3 bug class. One inbound message containing emoji took down the SMS list on every frame until it was deleted; email bodies are more hostile, not less. Sections that exist specifically to avoid overclaiming: * "Residual" notes on every mitigation. Secret does not zero on drop. We trust the platform root store; no certificate pinning. Header injection is handled by lettre, NOT by us -- which means the C1d proxy backend, which does not go through lettre, must sanitise or T-E4 becomes unmitigated. * "What has not been tested": no live SMTP server has been contacted, the wasm path has never been built, and no IMAP code exists, so T-E1/T-E2 cover the SMTP direction only. * Four open risks ranked, each tied to a plan item, including two (proxy auth, keystore storage) that MUST land with C1d/C1f rather than after -- the proxy is only safer than on-device IMAP if its token is revocable and scoped. Marks A1-A6 done in the plan. Phase A is complete.	2026-08-16 19:22:40 +00:00
nigig-ci	b3d562f4e2	ci(email): gate the Phase A security properties, and surface the warning ... Three new gates in email.yml, each negative-tested by reverting the fix and confirming the gate fires: 1. SmtpConfig.password must be a Secret, AND SmtpConfig must not derive Serialize/Deserialize. Two separate checks, because either alone re-opens S2: a Secret that gets serialised is still exposed, and a String that never gets serialised still Debug-prints. 2. set_email_api_url must call email_api_url_is_safe. Checks both that the validator exists and that the setter uses it -- a validator nobody calls is decoration. 3. tls_mode_for_port must exist, and Tls::None / Tls::Opportunistic must not appear. Opportunistic is the dangerous one: it silently accepts a downgrade, which is exactly the attack starttls_relay's Tls::Required prevents. Negative tests, all confirmed firing: password: Secret -> String gate fires re-add #[derive(.., Serialize)] gate fires remove the validator call gate fires introduce Tls::None gate fires and all 8 gates pass on the clean tree. Domain test floor raised 38 -> 60 (actual: 68) and the filter widened to include the secret:: module, so the new tests are actually covered by the floor rather than sitting outside it. Also surfaces config_warning() in the setup flow, so a from/username mismatch is shown while the user can still fix it, rather than becoming a silent provider rejection later. One YAML trap worth recording: the test filter ends in `secret::`, and a bare trailing colon makes YAML parse the line as a mapping. The run string has to be quoted. Caught by validating the workflow before committing, which is the only reason this is not a broken pipeline.	2026-08-16 19:22:40 +00:00
nigig-ci	e7ad44d429	feat(email): a password that cannot leak itself (Phase A1-A5) ... Assessment finding S2, the one Critical in Phase A. SmtpConfig carried #[derive(Clone, Debug, Serialize, Deserialize)] pub struct SmtpConfig { pub password: String, ... } so on wasm the ENTIRE struct -- password included -- was serde_json encoded and POSTed to /api/email. Every request carried the credential in clear text, and any reverse proxy or APM tool logging request bodies captured it. Nothing in the code said so. A1. New `Secret` type (nigig-core/src/secret.rs): * Debug always renders Secret("***"). No verbose mode. * Display is NOT implemented, so format!("{s}") will not compile. * Serialize/Deserialize are NOT implemented, and are REMOVED from SmtpConfig. A struct holding a secret cannot be serialised wholesale; the compiler stops it. That is the point -- a build failure rather than a code review someone has to remember to perform. * expose() is the only reader, named to be conspicuous in a diff. The wasm request body is now assembled field by field, so `password` appears at exactly ONE line and "what leaves the device?" is answerable by reading one function instead of trusting a derive. AccountDraft::validate now returns a Secret rather than a String, so the plaintext never lands back in a UI-held field. The inbox widget's session credential is a Secret too. A2. build_transport uses lettre's own relay() for port 465 instead of reassembling it from builder_dangerous + Tls::Wrapper. To be clear, since I flagged this as critical and was wrong: relay() is IMPLEMENTED as exactly those calls, and TlsParameters::new already sets accept_invalid_certs: false, accept_invalid_hostnames: false and a TLS 1.2 floor. Certificate validation was always on. It is still worth replacing -- a reviewer reading `builder_dangerous` assumes the worst (I did), and hand-rolling inherits nothing if upstream hardens relay(). A3. TLS policy is now named and asserted rather than inherited: tls_mode_for_port() maps every port to Implicit or StartTls, with NO cleartext arm, and it is unit tested. Previously the policy lived in a bare port match and a refactor could have removed encryption with no test failing. A4. validate_send() refuses locally what needs no server to know is wrong: incomplete config, empty recipient, subject over the RFC 5322 998-byte limit, body over 5 MB. Also config_warning(), which flags a from/username mismatch -- not an error, since some providers allow send-as aliases, but it is the commonest cause of a silent rejection. A5. set_email_api_url() now validates. It accepted any String, including http://, which sends the credential in clear text. Now same-origin relative or https:// only -- and it rejects protocol-relative //host/path, which is http on an http page and is easy to mistake for a relative path. Split into email_api_url_is_safe() so it is host-testable; the wasm target cannot run cargo test here, and an unvalidated validator is not a control. A6 (partial). SMTP timeout cut from lettre's 60s-per-command default to 20s. A mobile user on a bad connection needs an error, not a two-minute stall. Domain tests 38 -> 68. One thing I will not overclaim: `Secret` does NOT zero its buffer on drop. Without a zeroize-style crate the plaintext can persist in freed heap memory. It is a leak-through-code control, not an anti-forensics one, and it is recorded as an open risk rather than papered over.	2026-08-16 19:22:40 +00:00
andodeki	58b0bac062	fix(map): close unclosed delimiter in tile_disk.rs ... Added missing closing brace for the 'for key in &missing' loop. This fixes the compilation error: 'unclosed delimiter'.	2026-08-16 19:20:42 +00:00
andodeki	442c2c0fb3	test(spreadsheet): cover command mutation variants	2026-08-16 19:13:38 +00:00