Two leak paths: (a) AtomicFile.write renames the temp file onto the probe
path and THEN fsyncs the containing directory — if that last fsync throws,
the probe file already exists on disk but the old code returned false
without ever attempting removal; (b) if the explicit removeItem call itself
threw, there was no retry, so a transient File Provider removal failure left
the file behind permanently.
Fix: an unconditional `defer` now checks fileExists and retries removeItem
regardless of which branch returned early. The function only reports true
when the explicit write, fsync (inside AtomicFile.write), AND removal all
succeeded AND the file is confirmed gone afterward.
New test: a FileManager subclass whose removeItem(at:) throws on its first
call (AtomicFile.write itself never touches this injected FileManager — it
uses raw Darwin/POSIX calls, not FileManager, so this only intercepts the
explicit removal + the defer's retry) asserts the function returns false AND
no probe file remains — verified this actually needs the defer by
temporarily removing it and confirming the same test then fails with a
leftover ".redline-probe-<uuid>" file (see this branch's history for the
discarded revert). The directory-fsync failure path has no injectable seam
(raw fsync(2) on an already-open fd, not parameterized by any FileManager or
other substitutable dependency, and not reproducible via chmod or other
standard test techniques) — documented in the test rather than simulated.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp
isWritableDirectory (permissions bits) is not enough: a OneDrive
Files-On-Demand directory whose provider domain is signed out can report as
existing and POSIX-writable while an actual write fails. probeWritable
writes a small ".redline-probe-<uuid>" file into the folder via
AtomicFile.write (open+write+fsync+rename+directory-fsync), then removes it;
any failure at write, fsync, or removal means false.
Three unit tests: an ordinary writable directory (true, and no probe file
left behind), a chmod 500 directory (false; permissions restored in
teardown), and a plain file path (false).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp
ReturnWatcherTests.swift: two new tests bracket the BLOCKER fix — one
characterizes the old bug (FolderSettings.resolvedAppSupportPaths(), AirDrop-
only, ignores the persisted OneDrive transport; the watcher ends up watching
a stale isolated folder and misses a marked PDF dropped into the real
OneDrive-mode folder), the other proves the fix (the exact launch/bootstrap
construction — TransportSettings.resolvedAppSupportPaths() +
watcher.updateWatchFolder() before start — detects it). Both isolated to
temp dirs, including an explicit FolderSettings watch-folder override so the
"bug" test's found.isEmpty assertion never depends on what's actually in
Ben's real ~/Downloads (it does, in fact, already contain real marked-up
Redline PDFs from prior testing — an earlier version of this test read the
REAL Downloads folder and failed for exactly that reason).
TransportSettingsTests.swift: three tests for
OneDriveLocator.isWritableDirectory — true for an ordinary directory, false
for one chmod'd 500 (permissions restored in teardown before removal), false
for a plain file and for a nonexistent path.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp
TransportSettingsTests: default airDrop, set/get round-trip, garbage stored
value falls back to airDrop, oneDriveFolder store/reset, effectiveFolders for
both transports, oneDriveFolderUnavailable's errorDescription contains the path.
OneDriveLocatorTests: fake home tree under Library/CloudStorage — syncRoots
returns only real OneDrive-* directories (ignores a same-named plain file and
a GoogleDrive-* one), MMD-named root sorts first; no CloudStorage dir means
empty roots and a nil defaultRedlineFolder; resolveOneDriveFolder prefers an
existing stored override and falls back to the default when the stored path
no longer exists. All against temp dirs, never the real home.
ReturnWatcherTests: recordUncommended defaults to true and still records an
unmarked PDF (existing AirDrop tests are unaffected); with it set false, an
unmarked PDF is neither recorded nor returned by scanNow, and marking it up
in place with a real PDFKit ink annotation then re-scanning does record it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ZiTXPbPCSjzPVsfoweAbp
Claude Fable 5
kua-agentandClaude Fable 5.1