rzen/lanework
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove the App Group wholesale — one sandbox, one bookmark, one flag

Browse Source 
Phase 2 of the one-app pivot (DESIGN 12 ▸ App-side state, re-ruled
2026-07-30; reworks 566deab). AppGroup retires; what remains is
AppStateHome — ordinary sandbox Application Support as the one home for
the registry, clipboard staging and template stores, keeping the
unit-test-host redirect (the test host is the app and would sweep real
state). Scalar defaults return to UserDefaults.standard.

BoardRecord's per-edition grant slots and openNow flags collapse to one
bookmark + one isOpenNow; the legacy-key decode and adopt-in-memory
paths go (nothing shipped with group-era records), while the founding
four-keys-required / defaults-for-everything-since decode policy stays —
a bookmarkless record decodes as the born-orphan row rather than
quarantining the list. needsReopen and the pre-anchored re-grant panel
are removed whole: the only state that flow served — a record granted by
a sibling sandbox — is unrepresentable now, and a dead bookmark of our
own was already the orphan case by explicit comment. The
indexOfRecord path fallback dies with it; path is never a key again.

The cross-process freshness stamp (mtime+size re-read) and
BoardEditionPresence with its popover "Also open in…" line retire; the
clipboard prune keeps its atomic .sweeping/ claim-then-delete, reframed
for crash residue and open -n copies rather than sibling editions. The
application-groups entitlement key is gone.

1880 tests in 317 suites green (13 cross-edition tests retired with
their subject).

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY
This commit is contained in:
rzen
2026-07-30 17:46:32 -04:00
parent 092300c7d2
commit 2c6b8fe63a
27 changed files with 385 additions and 1461 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Kanban/App/AppModel.swift
+9 -71
View File
@@ -29,22 +29,11 @@ public enum WindowID {
/// The keys are declared here rather than spelled at each `@AppStorage`, for the same reason
/// `WindowID` exists.
///
/// ### The domain is the group's, not `.standard`
///
/// 02 § Per-board app state sends these to "the group's shared `UserDefaults` suite where a scalar
/// fits" (ruled 2026-07-29; 12-editions.md), for the registry's reason exactly: a paying upgrader
/// launches Pro onto their own settings rather than onto defaults. `AppGroup.defaults` is that suite,
/// and it degrades to a plain named domain when the group is not provisioned — unshared, but working.
///
/// **Every reader and writer of these keys must name that suite.** A `@AppStorage` left to its own
/// devices reads `.standard`, which after this ruling is a *different* domain — so the two views that
/// bind one of these keys pass `store:` explicitly (`SettingsView`).
/// The domain is `UserDefaults.standard`, which the sandbox already scopes to this one app — the
/// same reason `AppStateHome` needs no bundle-id subfolder. A `@AppStorage` left to its own devices
/// reads exactly this domain, so nothing here has to be named at a binding site.
public enum AppPreferences {
/// The domain every key here lives in. A stored `let` would capture a suite at type-load time;
/// this is a lookup of an object `UserDefaults` itself caches.
public static var defaults: UserDefaults { AppGroup.defaults }
/// "Restore open boards at launch" (Settings, ⌘, — 11-command-nexus.md). **Default on.**
public static let restoreOpenBoardsAtLaunchKey = "restoreOpenBoardsAtLaunch"
@@ -52,7 +41,7 @@ public enum AppPreferences {
/// any scene exists. `object(forKey:)` rather than `bool(forKey:)` because the latter cannot
/// tell "off" from "never set", and this preference defaults to *on*.
public static var restoreOpenBoardsAtLaunch: Bool {
defaults.object(forKey: restoreOpenBoardsAtLaunchKey) as? Bool ?? true
UserDefaults.standard.object(forKey: restoreOpenBoardsAtLaunchKey) as? Bool ?? true
}
/// The last-used card-window size (05-card-window.md; 02 files it as app-wide, not per-board —
@@ -61,14 +50,14 @@ public enum AppPreferences {
public static let lastCardWindowSizeKey = "lastCardWindowSize"
public static var lastCardWindowSize: CGSize? {
guard let text = defaults.string(forKey: lastCardWindowSizeKey) else { return nil }
guard let text = UserDefaults.standard.string(forKey: lastCardWindowSizeKey) else { return nil }
let size = NSSizeFromString(text)
guard size.width > 0, size.height > 0 else { return nil }
return size
}
public static func setLastCardWindowSize(_ size: CGSize) {
defaults.set(NSStringFromSize(size), forKey: lastCardWindowSizeKey)
UserDefaults.standard.set(NSStringFromSize(size), forKey: lastCardWindowSizeKey)
}
/// The quick-style row's recently-used backgrounds — an array of palette names / hex strings,
@@ -434,9 +423,8 @@ public final class AppModel {
/// The app builds one of these with the real state home; a test passes its own for the reason
/// `BoardRegistry` takes a storage URL at all — "injecting it is how a test stays out of the real
/// Application Support directory", which after the 2026-07-29 ruling means **out of the shared App
/// Group container** (`AppGroup`). A suite that swept the real staging root would be sweeping the
/// developer's own clipboard, and now the sibling edition's too.
/// Application Support directory" (`AppStateHome`). A suite that swept the real staging root
/// would be sweeping the developer's own clipboard.
///
/// `clipboardStagingRoot` is a separate parameter rather than derived from `registryStorageURL`'s
/// folder because the two are injected for different reasons and by different callers: the UI-test
@@ -446,7 +434,7 @@ public final class AppModel {
public init(
registryStorageURL: URL = BoardRegistry.defaultStorageURL,
clipboardStagingRoot: URL = ClipboardStore.defaultStagingRoot,
preferences: UserDefaults = AppGroup.defaults
preferences: UserDefaults = .standard
) {
boardRegistry = BoardRegistry(storageURL: registryStorageURL)
styleRecents = StyleRecents(defaults: preferences)
@@ -553,56 +541,6 @@ public final class AppModel {
openBoard(at: url)
}
/// Opens a recents row — the one door for welcome's double-click, its Open item, and File ▸ Open
/// Recent, because a row has **two** ways of leading to a board now.
///
/// An ordinary available row opens its URL. A row awaiting this edition's grant
/// (`RecentBoard.needsReopen` — a board the other edition minted the only bookmark for) runs the
/// re-grant panel first: "the first click runs an open panel pre-anchored at the recorded path:
/// one click + Grant per board, once per edition" (12-editions.md ▸ Distribution).
///
/// Nothing else about the open differs. The granted URL goes through `openBoard(at:)` exactly as a
/// File ▸ Open… pick would, and `BoardRegistry.recordOpen` matches the *existing* shared record and
/// mints this edition's slot onto it — the other edition's grant, the frames, the counts and the
/// cached title all stay where they are.
/// Internal rather than `public` only because `WelcomeRow` is — the row derivation is a UI-layer
/// value, and nothing outside this module opens boards by row.
func open(_ row: WelcomeRow) {
if let url = row.url {
openBoard(at: url)
return
}
guard let anchor = row.regrantAnchor,
let granted = presentRegrantPanel(anchoredAt: anchor, boardName: row.displayName) else { return }
openBoard(at: granted)
}
/// The re-grant panel: an ordinary open panel, pre-anchored at the board's recorded path.
///
/// **A panel and not an alert**, because the panel *is* the mechanism: a sandboxed app gains access
/// to a folder by the user choosing it, so there is nothing an intermediate explanation could add
/// that the panel's own message does not say better while doing the job.
///
/// `directoryURL` is the recorded path itself, per the ruling. For a board that is a `.kanban`
/// package the panel therefore opens *inside* it — `treatsFilePackagesAsDirectories` is on for
/// `presentOpenPanel`'s reason (boards are packages *and* plain folders) — and Open with nothing
/// selected chooses the folder on display, which is the board. A board that has since moved leaves
/// the panel at the nearest surviving ancestor, which is the Finder behaviour and the honest one:
/// the user knows where their board went, and this app does not.
private func presentRegrantPanel(anchoredAt anchor: URL, boardName: String) -> URL? {
let panel = NSOpenPanel()
panel.canChooseDirectories = true
panel.canChooseFiles = false
panel.treatsFilePackagesAsDirectories = true
panel.allowsMultipleSelection = false
panel.directoryURL = anchor
panel.prompt = "Grant"
panel.message = "Choose “\(boardName)” to let this app open it."
guard panel.runModal() == .OK else { return nil }
return panel.url
}
/// The ref of the window already showing the board at `url`, if any — matched through the store,
/// which is identity-keyed, rather than through the path.
private func boardRef(forBoardAt url: URL) -> BoardWindowRef? {