feature: sent-PDF history (10) + image retention (30) with pruning per Ben's 2026-09-02 ruling

Sources/Shotdeck/AppModel.swift

@@ -32,9 +32,6 @@ public final class AppModel {
     public private(set) var isSending: Bool = false
     public private(set) var outboxDisplayName: String
     public private(set) var watchFolderDisplayName: String
-    /// Live transport choice; WP-onedrive reads this to pick the send path and to drive
-    /// the Settings "Send via" picker and the menu's "Send…" label.
-    public private(set) var transport: SendTransport
     /// Live outbox; WP-4b reads this (not `paths.outbox`) so Settings folder changes take effect.
     public private(set) var outboxURL: URL
     /// Live watch folder; WP-4c updates this alongside `ReturnWatcher.updateWatchFolder`.
@@ -55,6 +52,7 @@ public final class AppModel {
     let picker: RegionPickerController
     let ledger: ReturnLedger
     let watcher: ReturnWatcher
+    let historyStore: HistoryStore
     let updateChecker: UpdateChecker
 
     public init(
@@ -66,7 +64,7 @@ public final class AppModel {
         picker: RegionPickerController,
         ledger: ReturnLedger,
         watcher: ReturnWatcher
-    ) {
+    ) throws {
         self.paths = paths
         self.spool = spool
         self.composer = composer
@@ -75,6 +73,7 @@ public final class AppModel {
         self.picker = picker
         self.ledger = ledger
         self.watcher = watcher
+        self.historyStore = try HistoryStore(paths: paths)
         self.session = CaptureSession(
             id: UUID(),
             createdAt: Date(),
@@ -84,15 +83,12 @@ public final class AppModel {
         )
         self.region = Self.loadPersistedRegion()
         self.screenRecordingGranted = ScreenCapturer.isScreenRecordingGranted
-        // Seeded from TransportSettings.effectiveFolders() — the one place that combines
+        // Seeded from FolderSettings.resolve() via resolvedAppSupportPaths — never .standard().
-        // the transport choice with FolderSettings/OneDriveLocator. Never call
+        let folders = FolderSettings.resolve()
-        // FolderSettings.resolve() directly outside that function.
-        let folders = TransportSettings.effectiveFolders()
         self.outboxURL = folders.outbox
         self.watchFolderURL = folders.watch
         self.outboxDisplayName = folders.outbox.lastPathComponent
         self.watchFolderDisplayName = folders.watch.lastPathComponent
-        self.transport = folders.transport
         self.captureHotkey = HotkeyPreference.load()
         self.updateChecker = UpdateChecker()
         self.updateChecker.onChecked = { [weak self] in
@@ -124,7 +120,6 @@ public final class AppModel {
         watchFolderURL = watch
         setFolderDisplayNames(outbox: outbox.lastPathComponent, watch: watch.lastPathComponent)
     }
-    func setTransport(_ value: SendTransport) { transport = value }
     func rememberLastComposedPDF(_ url: URL) { lastComposedPDFURL = url }
 
     /// True when a last-composed PDF path is known this run, or the newest
@@ -192,16 +187,6 @@ public final class AppModel {
             // Empty ledger on first run is not an error.
         }
 
-        // OneDrive mode: outbox == watch folder, so a freshly written, unmarked PDF must
-        // never show up as a return; only a document that already carries a mark does.
-        // Also make sure the resolved OneDrive folder actually exists before the
-        // watcher starts watching it (bootstrap is the other creation trigger besides
-        // chooseTransport/chooseOneDriveFolder — see TransportSettings.effectiveFolders).
-        if transport == .oneDrive {
-            try? FileManager.default.createDirectory(at: outboxURL, withIntermediateDirectories: true)
-        }
-        await watcher.setRecordUncommented(transport == .airDrop)
-
         do {
             try await watcher.start { [weak self] _ in
                 Task { @MainActor in
@@ -225,8 +210,7 @@ public final class AppModel {
             ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil
             || ProcessInfo.processInfo.environment["SHOTDECK_UPDATE_SELFTEST"] != nil
-            || ProcessInfo.processInfo.environment["SHOTDECK_ONEDRIVE_SELFTEST"] != nil
+            || ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"] != nil
-            || ProcessInfo.processInfo.environment["REDLINE_SELFTEST_PHASE"] != nil
         if !skipSchedule {
             updateChecker.startSchedule()
         }

Sources/Shotdeck/MenuBarView.swift

@@ -91,7 +91,7 @@ struct MenuBarView: View {
                     model.setStatus("Send is not available in this build.")
                 }
             } label: {
-                actionLabel(model.transport == .oneDrive ? "Send to OneDrive" : "Send…")
+                actionLabel("Send…")
             }
             .disabled(model.session.isEmpty || model.isSending)
 

Sources/Shotdeck/PanelSnapshot.swift

@@ -163,7 +163,7 @@ enum PanelSnapshot {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = AppModel(
+        let model = try AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),

Sources/Shotdeck/PickerSelfTest.swift

@@ -3,7 +3,6 @@ import CoreGraphics
 import Darwin
 import Foundation
 import ImageIO
-import PDFKit
 import ShotdeckCore
 
 /// In-process self-test for the region picker, driven by `SHOTDECK_PICKER_SELFTEST`.
@@ -31,6 +30,20 @@ enum PickerSelfTest {
         }
     }
 
+    /// Standalone HISTORY phase when `SHOTDECK_HISTORY_SELFTEST` is set without
+    /// the picker chain. Waits for NSApp like the other phases, then exits.
+    static func runHistoryIfRequested() {
+        guard let raw = ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"],
+              !raw.isEmpty
+        else { return }
+        _ = raw
+        DispatchQueue.main.async {
+            MainActor.assumeIsolated {
+                runHistoryPhase()
+            }
+        }
+    }
+
     private static func execute(outputDirectory: URL) {
         do {
             try FileManager.default.createDirectory(
@@ -118,7 +131,8 @@ enum PickerSelfTest {
         runRegionPersistPhase()
         // Hop off this MainActor job so the SEND-TRUTH Task can run; do not
         // exit(0) here — runSendTruthPhase prints its own PASS/FAIL, then
-        // chains to UPDATE-SELFTEST (or exits if that phase is not requested).
+        // chains to HISTORY, then UPDATE-SELFTEST (or exits if that phase is
+        // not requested).
         runSendTruthPhase()
     }
 
@@ -167,21 +181,166 @@ enum PickerSelfTest {
     /// Fail path must leave the session open in the temp spool; success path archives
     /// and mints a fresh empty session. Scheduled as a new MainActor job because this
     /// function is called from inside `execute()` — a nested run-loop wait would never
-    /// let the Task start. On success, chains to UPDATE-SELFTEST instead of exiting.
+    /// let the Task start. On success, chains to HISTORY instead of exiting.
     private static func runSendTruthPhase() {
         Task { @MainActor in
             do {
                 try await executeSendTruth()
                 print("SEND-TRUTH PASS")
                 fflush(stdout)
-                if !startUpdateSelfTestIfRequested(), !startOneDriveSelfTestIfRequested() {
-                    exit(0)
-                }
             } catch {
                 print("SEND-TRUTH FAIL \(error)")
                 fflush(stdout)
                 exit(1)
             }
+            runHistoryPhase()
+        }
+    }
+
+    /// Phase 4: drive HistoryStore record/prune in a temp root. Env-gated by
+    /// `SHOTDECK_HISTORY_SELFTEST` the same way UPDATE is gated, and also runs
+    /// whenever the picker self-test chain is already in flight so a full
+    /// self-test prints HISTORY PASS|FAIL. Chains to UPDATE-SELFTEST (or exits).
+    private static func runHistoryPhase() {
+        let historyRequested = ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"]
+        let pickerRequested = ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"]
+        let shouldRun = (historyRequested.map { !$0.isEmpty } ?? false)
+            || (pickerRequested.map { !$0.isEmpty } ?? false)
+        guard shouldRun else {
+            if !startUpdateSelfTestIfRequested() {
+                exit(0)
+            }
+            return
+        }
+
+        Task { @MainActor in
+            do {
+                try await executeHistorySelfTest()
+                print("HISTORY PASS")
+                fflush(stdout)
+                if !startUpdateSelfTestIfRequested() {
+                    exit(0)
+                }
+            } catch {
+                print("HISTORY FAIL \(error)")
+                fflush(stdout)
+                exit(1)
+            }
+        }
+    }
+
+    private static func executeHistorySelfTest() async throws {
+        let fm = FileManager.default
+        let root = fm.temporaryDirectory
+            .appendingPathComponent("shotdeck-history-selftest-\(UUID().uuidString)", isDirectory: true)
+        defer { try? fm.removeItem(at: root) }
+
+        let paths = try AppSupportPaths(
+            root: root.appendingPathComponent("root", isDirectory: true),
+            outbox: root.appendingPathComponent("outbox", isDirectory: true),
+            watchFolder: root.appendingPathComponent("watch", isDirectory: true)
+        )
+        let store = try HistoryStore(paths: paths)
+        let sources = root.appendingPathComponent("user-sources", isDirectory: true)
+        try fm.createDirectory(at: sources, withIntermediateDirectories: true)
+
+        var recorded: [HistoryEntry] = []
+        for i in 0..<12 {
+            let source = sources.appendingPathComponent("source-\(i).pdf")
+            try Data("%PDF-1.4\n%hist-\(i)\n%%EOF\n".utf8).write(to: source)
+            let entry = try await store.recordSentPDF(
+                sourceURL: source,
+                sessionID: UUID(),
+                pageCount: 1,
+                sentAt: Date(timeIntervalSince1970: 1_800_000_000 + TimeInterval(i))
+            )
+            recorded.append(entry)
+            let onDisk = try Data(contentsOf: source)
+            guard onDisk == Data("%PDF-1.4\n%hist-\(i)\n%%EOF\n".utf8) else {
+                throw HistorySelfTestError.detail("user source PDF was modified: \(source.path)")
+            }
+        }
+
+        let listed = await store.listPDFs()
+        guard listed.count == 10 else {
+            throw HistorySelfTestError.detail("listPDFs count \(listed.count) want 10")
+        }
+        let wantNewest = Array(recorded.suffix(10).reversed())
+        guard listed.map(\.id) == wantNewest.map(\.id) else {
+            throw HistorySelfTestError.detail("listPDFs did not return the 10 newest")
+        }
+        let pdfsDir = paths.root.appendingPathComponent("history/pdfs", isDirectory: true)
+        for entry in recorded.prefix(2) {
+            let gone = pdfsDir.appendingPathComponent(entry.fileName)
+            guard !fm.fileExists(atPath: gone.path) else {
+                throw HistorySelfTestError.detail("oldest PDF still on disk: \(gone.path)")
+            }
+        }
+
+        let same = sources.appendingPathComponent("same.pdf")
+        try Data("%PDF-1.4\n%same\n%%EOF\n".utf8).write(to: same)
+        let first = try await store.recordSentPDF(
+            sourceURL: same, sessionID: nil, pageCount: 1,
+            sentAt: Date(timeIntervalSince1970: 1_800_000_100)
+        )
+        let second = try await store.recordSentPDF(
+            sourceURL: same, sessionID: nil, pageCount: 1,
+            sentAt: Date(timeIntervalSince1970: 1_800_000_101)
+        )
+        guard first.id != second.id, first.fileURL.path != second.fileURL.path,
+              fm.fileExists(atPath: first.fileURL.path),
+              fm.fileExists(atPath: second.fileURL.path),
+              fm.fileExists(atPath: same.path)
+        else {
+            throw HistorySelfTestError.detail("re-record same source did not produce two distinct copies")
+        }
+
+        let spool = try SpoolStore(paths: paths)
+        let png = try makeTinyPNGData()
+        let base = Date(timeIntervalSince1970: 1_800_100_000)
+        var n = 0
+        var oldestSessionID: UUID?
+        for count in [5, 15, 15] {
+            if n == 0 {
+                oldestSessionID = try await spool.currentSession().id
+            }
+            for _ in 0..<count {
+                _ = try await spool.append(
+                    pngData: png, pixelWidth: 64, pixelHeight: 48, scale: 1,
+                    capturedAt: base.addingTimeInterval(TimeInterval(n))
+                )
+                n += 1
+            }
+            _ = try await spool.archiveCurrent(pdfFileName: "Redline-hist-\(n).pdf")
+        }
+        let openCapture = try await spool.append(
+            pngData: png, pixelWidth: 64, pixelHeight: 48, scale: 1,
+            capturedAt: Date(timeIntervalSince1970: 1_900_000_000)
+        )
+        let openSession = try await spool.currentSession()
+        let openPNG = paths.sessionDirectory(openSession.id).appendingPathComponent(openCapture.fileName)
+        let openBytes = try Data(contentsOf: openPNG)
+
+        try await store.pruneImages()
+
+        let images = try await store.listImages(limit: 50)
+        guard images.count == 30 else {
+            throw HistorySelfTestError.detail("listImages count \(images.count) want 30")
+        }
+        if let oldestSessionID {
+            let oldDir = paths.archiveDirectory(oldestSessionID)
+            guard !fm.fileExists(atPath: oldDir.path) else {
+                throw HistorySelfTestError.detail("emptied archive session still on disk")
+            }
+        }
+        guard fm.fileExists(atPath: openPNG.path), try Data(contentsOf: openPNG) == openBytes else {
+            throw HistorySelfTestError.detail("open session PNG was touched")
+        }
+        let remainingOpen = try await spool.currentSession()
+        guard remainingOpen.id == openSession.id,
+              remainingOpen.captures.map(\.id) == [openCapture.id]
+        else {
+            throw HistorySelfTestError.detail("open session manifest was touched")
         }
     }
 
@@ -197,7 +356,7 @@ enum PickerSelfTest {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = AppModel(
+        let model = try AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),
@@ -301,7 +460,7 @@ enum PickerSelfTest {
         exit(1)
     }
 
-    /// Phase 4: builds a fake 99.0.0 bundle, serves a local appcast, stages via
+    /// Phase 5: builds a fake 99.0.0 bundle, serves a local appcast, stages via
     /// `checkNow`, then `installStaged` into the env dir — never `/Applications`.
     /// Returns true when the async phase was scheduled (it calls `exit` itself).
     @discardableResult
@@ -316,9 +475,7 @@ enum PickerSelfTest {
                 try await runUpdateSelfTest(outputDirectory: output)
                 print("UPDATE-SELFTEST PASS version=99.0.0")
                 fflush(stdout)
-                if !startOneDriveSelfTestIfRequested() {
                 exit(0)
-                }
             } catch let error as UpdateSelfTestError {
                 updateFail(error.description)
             } catch {
@@ -442,7 +599,7 @@ enum PickerSelfTest {
             watchFolder: root.appendingPathComponent("watch", isDirectory: true)
         )
         let ledger = try ReturnLedger(paths: paths)
-        let model = AppModel(
+        let model = try AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),
@@ -476,194 +633,6 @@ enum PickerSelfTest {
         exit(1)
     }
 
-    /// Real sync root this Mac has; the phase proves the transport against the actual
-    /// OneDrive file provider, never a fake home tree (that is what
-    /// OneDriveLocatorTests in ShotdeckCoreTests are for).
-    private static let realOneDriveSyncRoot = URL(
-        fileURLWithPath: "/Users/benjaminhippler/Library/CloudStorage/OneDrive-MMDGROUP",
-        isDirectory: true
-    )
-
-    /// Phase 5: proves the OneDrive transport end to end against the real sync root.
-    /// Triggered by `SHOTDECK_ONEDRIVE_SELFTEST` when chained after PICKER/SEND-TRUTH/
-    /// UPDATE-SELFTEST — the exact pattern `startUpdateSelfTestIfRequested` uses for its
-    /// own env var. Returns true when the async phase was scheduled (it calls `exit` itself).
-    @discardableResult
-    private static func startOneDriveSelfTestIfRequested() -> Bool {
-        guard ProcessInfo.processInfo.environment["SHOTDECK_ONEDRIVE_SELFTEST"] != nil else {
-            return false
-        }
-        runOneDriveSelfTestAndExit()
-        return true
-    }
-
-    /// Entry point for running ONLY this phase, bypassing the on-screen picker chain
-    /// entirely. The harness has no other per-phase selector, so this is the escape
-    /// hatch: `REDLINE_SELFTEST_PHASE=onedrive`.
-    static func runOneDriveOnlyIfRequested() {
-        guard ProcessInfo.processInfo.environment["REDLINE_SELFTEST_PHASE"] == "onedrive" else {
-            return
-        }
-        // Same hop as runIfRequested(): a plain main-queue turn after NSApp starts, so
-        // AppKit/PDFKit calls inside the phase are not racing app launch.
-        DispatchQueue.main.async {
-            MainActor.assumeIsolated {
-                runOneDriveSelfTestAndExit()
-            }
-        }
-    }
-
-    private static func runOneDriveSelfTestAndExit() {
-        Task { @MainActor in
-            do {
-                let folder = try await executeOneDriveSelfTest()
-                print("ONEDRIVE-SELFTEST PASS path=\(folder.path)")
-                fflush(stdout)
-                exit(0)
-            } catch let error as OneDriveSelfTestError {
-                oneDriveFail(error.description)
-            } catch {
-                oneDriveFail(String(describing: error))
-            }
-        }
-    }
-
-    /// Builds a session, sends it through the OneDrive branch of `send(anchor: nil)`
-    /// against a NEW folder under the real OneDrive sync root, confirms the watcher does
-    /// NOT report the freshly-written unmarked PDF as a return, then adds a real PDFKit
-    /// ink annotation in place (what the iPad does) and confirms the watcher now reports
-    /// it as commented. Never deletes anything under OneDrive — the created folder and
-    /// PDF are left in place for Ben to inspect / for the real iPad round trip.
-    private static func executeOneDriveSelfTest() async throws -> URL {
-        let fm = FileManager.default
-        guard fm.fileExists(atPath: realOneDriveSyncRoot.path) else {
-            throw OneDriveSelfTestError.detail(
-                "real OneDrive sync root not found at \(realOneDriveSyncRoot.path)"
-            )
-        }
-
-        // UserDefaults.standard is the ONLY defaults instance send()/TransportSettings
-        // actually read at runtime (there is no defaults-threading through AppModel), so
-        // "isolated" here means snapshot-and-restore around the real keys — the same
-        // pattern runRegionPersistPhase already uses for CaptureRegion.defaultsKey.
-        let defaults = UserDefaults.standard
-        let previousTransport = defaults.string(forKey: TransportSettings.transportDefaultsKey)
-        let previousFolder = defaults.string(forKey: TransportSettings.oneDriveFolderDefaultsKey)
-        defer {
-            if let previousTransport {
-                defaults.set(previousTransport, forKey: TransportSettings.transportDefaultsKey)
-            } else {
-                defaults.removeObject(forKey: TransportSettings.transportDefaultsKey)
-            }
-            if let previousFolder {
-                defaults.set(previousFolder, forKey: TransportSettings.oneDriveFolderDefaultsKey)
-            } else {
-                defaults.removeObject(forKey: TransportSettings.oneDriveFolderDefaultsKey)
-            }
-        }
-
-        let stamp = DubaiTime.fileStamp(Date())
-        let selftestFolder = realOneDriveSyncRoot
-            .appendingPathComponent("Redline-selftest-\(stamp)", isDirectory: true)
-        try fm.createDirectory(at: selftestFolder, withIntermediateDirectories: true)
-
-        TransportSettings.setTransport(.oneDrive, defaults: defaults)
-        TransportSettings.setOneDriveFolder(selftestFolder, defaults: defaults)
-
-        // Local spool root only — the outbox/watch folder is the real OneDrive folder.
-        let spoolRoot = fm.temporaryDirectory
-            .appendingPathComponent("shotdeck-onedrive-selftest-\(UUID().uuidString)", isDirectory: true)
-        defer { try? fm.removeItem(at: spoolRoot) }
-
-        let paths = try AppSupportPaths(root: spoolRoot, outbox: selftestFolder, watchFolder: selftestFolder)
-        let ledger = try ReturnLedger(paths: paths)
-        let watcher = ReturnWatcher(paths: paths, ledger: ledger)
-        await watcher.setRecordUncommented(false)   // OneDrive mode: today's default is AirDrop's `true`.
-
-        let model = AppModel(
-            paths: paths,
-            spool: try SpoolStore(paths: paths),
-            composer: PDFComposer(),
-            capturer: ScreenCapturer(),
-            hotkeys: HotkeyCenter(),
-            picker: RegionPickerController(),
-            ledger: ledger,
-            watcher: watcher
-        )
-        model.setFolderURLs(outbox: selftestFolder, watch: selftestFolder)
-        model.setTransport(.oneDrive)
-
-        let png = try makeTinyPNGData()
-        _ = try await model.spool.append(
-            pngData: png, pixelWidth: 64, pixelHeight: 48, scale: 1, capturedAt: Date()
-        )
-        model.replaceSession(try await model.spool.currentSession())
-        guard !model.session.isEmpty else {
-            throw OneDriveSelfTestError.detail("seeded session was empty")
-        }
-
-        await model.send(anchor: nil)
-
-        guard let status = model.statusLine, status.hasPrefix("Saved to OneDrive") else {
-            throw OneDriveSelfTestError.detail(
-                "status did not start with 'Saved to OneDrive': \(model.statusLine ?? "nil")"
-            )
-        }
-        guard model.session.isEmpty else {
-            throw OneDriveSelfTestError.detail("session was not archived after the OneDrive send")
-        }
-
-        let written = (try? fm.contentsOfDirectory(at: selftestFolder, includingPropertiesForKeys: nil)) ?? []
-        guard let pdfURL = written.first(where: { $0.pathExtension.lowercased() == "pdf" }) else {
-            throw OneDriveSelfTestError.detail("no PDF found in \(selftestFolder.path)")
-        }
-
-        // Unmarked so far: the watcher must not treat it as a return.
-        let beforeMarkup = try await watcher.scanNow()
-        guard !beforeMarkup.contains(where: { $0.fileURL == pdfURL }) else {
-            throw OneDriveSelfTestError.detail("unmarked PDF was reported as returned by scanNow")
-        }
-        let commentedBefore = try await ledger.commented()
-        guard !commentedBefore.contains(where: { $0.fileURL == pdfURL }) else {
-            throw OneDriveSelfTestError.detail("unmarked PDF was recorded as commented in the ledger")
-        }
-
-        // What the iPad does: mark it up in place with a real ink annotation, then save.
-        guard let document = PDFDocument(url: pdfURL), let page = document.page(at: 0) else {
-            throw OneDriveSelfTestError.detail("could not reopen \(pdfURL.path) to annotate it")
-        }
-        let ink = PDFAnnotation(
-            bounds: CGRect(x: 20, y: 20, width: 60, height: 60),
-            forType: .ink,
-            withProperties: nil
-        )
-        let stroke = NSBezierPath()
-        stroke.move(to: NSPoint(x: 20, y: 20))
-        stroke.line(to: NSPoint(x: 80, y: 80))
-        ink.add(stroke)
-        page.addAnnotation(ink)
-        guard document.write(to: pdfURL) else {
-            throw OneDriveSelfTestError.detail("could not save the annotated PDF back to \(pdfURL.path)")
-        }
-
-        let afterMarkup = try await watcher.scanNow()
-        guard let recorded = afterMarkup.first(where: { $0.fileURL == pdfURL }), recorded.isCommented else {
-            throw OneDriveSelfTestError.detail("annotated PDF was not reported as commented by scanNow")
-        }
-        let commentedAfter = try await ledger.commented()
-        guard commentedAfter.contains(where: { $0.fileURL == pdfURL }) else {
-            throw OneDriveSelfTestError.detail("annotated PDF was not recorded in the ledger as commented")
-        }
-
-        return selftestFolder
-    }
-
-    private static func oneDriveFail(_ detail: String) -> Never {
-        print("ONEDRIVE-SELFTEST FAIL \(detail)")
-        fflush(stdout)
-        exit(1)
-    }
-
     private static func interpolate(_ step: Int) -> NSPoint {
         let t = CGFloat(step) / CGFloat(dragSteps)
         return NSPoint(
@@ -730,7 +699,7 @@ private enum UpdateSelfTestError: Error, CustomStringConvertible {
     }
 }
 
-private enum OneDriveSelfTestError: Error, CustomStringConvertible {
+private enum HistorySelfTestError: Error, CustomStringConvertible {
     case detail(String)
     var description: String {
         switch self {

Sources/Shotdeck/SendController.swift

@@ -16,31 +16,6 @@ extension AppModel: SendCapable {
         guard !session.isEmpty, !isSending else { return }
         setSending(true)
 
-        let transport = TransportSettings.transport()
-
-        // OneDrive mode: verify the real destination exists RIGHT NOW, before composing
-        // anything. `outboxURL` is kept in sync with the resolved OneDrive folder by
-        // bootstrap/chooseTransport/chooseOneDriveFolder, but this is re-resolved fresh
-        // here (never trusted stale) so a folder that vanished since then (OneDrive
-        // signed out, external volume unmounted, folder deleted) is caught instead of
-        // silently writing into whatever `outboxURL` happens to hold.
-        if transport == .oneDrive {
-            guard let folder = OneDriveLocator.resolveOneDriveFolder(),
-                  Self.directoryExists(at: folder)
-            else {
-                let path = OneDriveLocator.resolveOneDriveFolder()?.path
-                    ?? TransportSettings.storedOneDriveFolderPath()
-                    ?? "no OneDrive folder found"
-                setStatus(ShotdeckError.oneDriveFolderUnavailable(path: path).errorDescription)
-                setSending(false)
-                return
-            }
-            if outboxURL != folder || watchFolderURL != folder {
-                setFolderURLs(outbox: folder, watch: folder)
-                try? await watcher.updateWatchFolder(folder)
-            }
-        }
-
         let pending: ComposedSend
         do {
             pending = try await composePDFForSend()
@@ -52,18 +27,6 @@ extension AppModel: SendCapable {
             return
         }
 
-        switch transport {
-        case .oneDrive:
-            // No AirDrop, no anchor needed — the PDF is already in the watched
-            // OneDrive folder. Archive immediately; the iPad marks it up in place.
-            await handleDidShareItems(fileName: pending.fileName, pageCount: pending.pageCount)
-            let pageWord = pending.pageCount == 1 ? "page" : "pages"
-            setStatus(
-                "Saved to OneDrive — \(pending.pageCount) \(pageWord). Open it in Files on your iPad."
-            )
-            setSending(false)
-
-        case .airDrop:
         guard let anchor else {
             handleDidFailToShareItems(fileName: pending.fileName)
             setSending(false)
@@ -89,13 +52,6 @@ extension AppModel: SendCapable {
             setSending(false)
         }
     }
-    }
-
-    private static func directoryExists(at url: URL) -> Bool {
-        var isDirectory: ObjCBool = false
-        let exists = FileManager.default.fileExists(atPath: url.path, isDirectory: &isDirectory)
-        return exists && isDirectory.boolValue
-    }
 
     /// Writes the PDF to the outbox and records its path. Does not archive the session
     /// and does not present AirDrop — that happens only after the share completes.
@@ -144,6 +100,8 @@ extension AppModel: SendCapable {
     /// `NSSharingServiceDelegate.sharingService(_:didShareItems:)` seam.
     func handleDidShareItems(fileName: String, pageCount: Int) async {
         guard !session.isEmpty else { return }
+        let sentSessionID = session.id
+        let sourceURL = lastComposedPDFURL ?? outboxURL.appendingPathComponent(fileName)
         do {
             _ = try await spool.archiveCurrent(pdfFileName: fileName)
             replaceSession(try await spool.currentSession())
@@ -151,6 +109,20 @@ extension AppModel: SendCapable {
             setStatus("Sent — \(pageCount) \(pageWord).")
         } catch {
             setStatus((error as? ShotdeckError)?.errorDescription ?? "Could not archive the session.")
+            return
+        }
+        do {
+            _ = try await historyStore.recordSentPDF(
+                sourceURL: sourceURL,
+                sessionID: sentSessionID,
+                pageCount: pageCount,
+                sentAt: Date()
+            )
+            try await historyStore.pruneImages()
+        } catch {
+            Log.spool.error(
+                "Could not record sent PDF into history at \(sourceURL.path, privacy: .public): \(error.localizedDescription, privacy: .public)"
+            )
         }
     }
 

Sources/Shotdeck/SettingsView.swift

@@ -33,25 +33,6 @@ struct SettingsView: View {
                 .frame(minHeight: 22)
             }
 
-            GridRow {
-                Text("Send via")
-                    .font(.headline)
-                    .frame(maxWidth: .infinity, alignment: .leading)
-                    .gridCellColumns(2)
-                    .padding(.top, 6)
-            }
-
-            GridRow {
-                Picker("Send via", selection: transportBinding) {
-                    ForEach(SendTransport.allCases, id: \.self) { transport in
-                        Text(transport.displayName).tag(transport)
-                    }
-                }
-                .labelsHidden()
-                .pickerStyle(.segmented)
-                .gridCellColumns(2)
-            }
-
             GridRow {
                 Text("Folders")
                     .font(.headline)
@@ -60,7 +41,6 @@ struct SettingsView: View {
                     .padding(.top, 6)
             }
 
-            if model.transport == .airDrop {
             GridRow(alignment: .center) {
                 fieldLabel("Watch folder")
                 folderValue(path: model.watchFolderURL.path) {
@@ -74,36 +54,6 @@ struct SettingsView: View {
                     model.chooseOutboxFolder()
                 }
             }
-            } else {
-                GridRow(alignment: .center) {
-                    fieldLabel("OneDrive folder")
-                    if let folder = resolvedOneDriveFolder {
-                        folderValue(path: folder.path) {
-                            model.chooseOneDriveFolder()
-                        }
-                    } else {
-                        HStack(spacing: 8) {
-                            Text("No OneDrive folder found — sign in to OneDrive or choose a folder.")
-                                .font(.caption)
-                                .foregroundStyle(.secondary)
-                                .fixedSize(horizontal: false, vertical: true)
-                                .frame(maxWidth: .infinity, alignment: .leading)
-                            Button("Choose…") { model.chooseOneDriveFolder() }
-                        }
-                        .frame(minHeight: 22)
-                    }
-                }
-
-                GridRow {
-                    Text(
-                        "The PDF is saved here and this same folder is watched for the marked-up copy. On the iPad open it from Files > OneDrive."
-                    )
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-                    .fixedSize(horizontal: false, vertical: true)
-                    .gridCellColumns(2)
-                }
-            }
 
             GridRow {
                 Button("Reveal spool folder") { model.openSpoolFolder() }
@@ -118,17 +68,6 @@ struct SettingsView: View {
         .onDisappear { disarmHotkeyRecorder() }
     }
 
-    private var transportBinding: Binding<SendTransport> {
-        Binding(get: { model.transport }, set: { model.chooseTransport($0) })
-    }
-
-    /// Ground truth from OneDriveLocator, not `model.outboxURL` — the model may be
-    /// showing an AirDrop-folder fallback when no real OneDrive folder resolves, and
-    /// the Settings row must say so plainly rather than repeat that fallback path.
-    private var resolvedOneDriveFolder: URL? {
-        OneDriveLocator.resolveOneDriveFolder()
-    }
-
     private func armHotkeyRecorder() {
         guard !isRecordingHotkey else { return }
         isRecordingHotkey = true
@@ -251,53 +190,6 @@ extension AppModel: SettingsWindowPresenting {
         }
     }
 
-    /// Settings "Send via" picker action. Persists the choice, recomputes the effective
-    /// outbox/watch folder for the new transport, creates the OneDrive folder if it
-    /// doesn't exist yet, and re-points the running watcher (folder + recordUncommented)
-    /// at the new state. Switching back to AirDrop restores its own stored overrides
-    /// untouched, since AirDrop and OneDrive folder settings are stored under separate keys.
-    func chooseTransport(_ value: SendTransport) {
-        guard value != transport else { return }
-        TransportSettings.setTransport(value)
-        setTransport(value)
-        let folders = TransportSettings.effectiveFolders()
-        if value == .oneDrive {
-            try? FileManager.default.createDirectory(
-                at: folders.outbox, withIntermediateDirectories: true
-            )
-        }
-        setFolderURLs(outbox: folders.outbox, watch: folders.watch)
-        Task {
-            await watcher.setRecordUncommented(value == .airDrop)
-            do {
-                try await watcher.updateWatchFolder(folders.watch)
-            } catch {
-                setStatus(
-                    (error as? ShotdeckError)?.errorDescription ?? "Could not switch the watch folder."
-                )
-            }
-        }
-    }
-
-    func chooseOneDriveFolder() {
-        let start = OneDriveLocator.resolveOneDriveFolder() ?? FileManager.default.homeDirectoryForCurrentUser
-        guard let url = chooseDirectory(startingAt: start) else { return }
-        TransportSettings.setOneDriveFolder(url)
-        try? FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
-        guard transport == .oneDrive else { return }
-        setFolderURLs(outbox: url, watch: url)
-        Task {
-            do {
-                try await watcher.updateWatchFolder(url)
-                setStatus("OneDrive folder set to \(url.lastPathComponent).")
-            } catch {
-                setStatus(
-                    (error as? ShotdeckError)?.errorDescription ?? "Could not switch the watch folder."
-                )
-            }
-        }
-    }
-
     private func chooseDirectory(startingAt directory: URL) -> URL? {
         let panel = NSOpenPanel()
         panel.canChooseDirectories = true

Sources/Shotdeck/main.swift

@@ -7,11 +7,10 @@ import ShotdeckCore
 if ProcessInfo.processInfo.environment["SHOTDECK_SNAPSHOT_DIR"] != nil {
     MainActor.assumeIsolated { PanelSnapshot.runIfRequested() }
 }
-if ProcessInfo.processInfo.environment["REDLINE_SELFTEST_PHASE"] == "onedrive" {
-    MainActor.assumeIsolated { PickerSelfTest.runOneDriveOnlyIfRequested() }
-}
 if ProcessInfo.processInfo.environment["SHOTDECK_PICKER_SELFTEST"] != nil {
     MainActor.assumeIsolated { PickerSelfTest.runIfRequested() }
+} else if ProcessInfo.processInfo.environment["SHOTDECK_HISTORY_SELFTEST"] != nil {
+    MainActor.assumeIsolated { PickerSelfTest.runHistoryIfRequested() }
 }
 ShotdeckApp.main()
 
@@ -70,7 +69,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate {
 
     private static func makeModel(paths: AppSupportPaths) throws -> AppModel {
         let ledger = try ReturnLedger(paths: paths)
-        return AppModel(
+        return try AppModel(
             paths: paths,
             spool: try SpoolStore(paths: paths),
             composer: PDFComposer(),

Sources/ShotdeckCore/History/HistoryStore.swift

@@ -0,0 +1,446 @@
+import Foundation
+
+/// Retention ruling (2026-09-02). Ben's instruction is the authority that
+/// supersedes the earlier D-11 never-delete rule FOR THIS STORE only:
+///
+///     "the last 10 files are saved, and the past 30 images, and cleared up
+///     afterwards. user should be able to select from those and send again."
+///
+/// App-managed copies live under `AppSupportPaths.root/history/`. Pruning
+/// unlinks files under `history/pdfs/` and archived capture PNGs beyond the
+/// newest 30. It never deletes a user file, never touches the outbox PDF, and
+/// never touches the open spool session (D-11 still applies there).
+
+/// One sent-PDF copy retained for re-send. The file at `fileURL` is the
+/// app-managed copy under `history/pdfs/`, not the user's original.
+public struct HistoryEntry: Codable, Sendable, Equatable, Identifiable {
+    public let id: UUID
+    public let fileName: String
+    public let fileURL: URL
+    public let originalFileName: String
+    public let sessionID: UUID?
+    public let pageCount: Int
+    public let sentAt: Date
+
+    public init(
+        id: UUID,
+        fileName: String,
+        fileURL: URL,
+        originalFileName: String,
+        sessionID: UUID?,
+        pageCount: Int,
+        sentAt: Date
+    ) {
+        self.id = id
+        self.fileName = fileName
+        self.fileURL = fileURL
+        self.originalFileName = originalFileName
+        self.sessionID = sessionID
+        self.pageCount = pageCount
+        self.sentAt = sentAt
+    }
+}
+
+/// A capture PNG on disk under an archived session, listed for re-send.
+/// `path` is the real file; HistoryStore never copies images.
+public struct ImageRef: Sendable, Equatable {
+    public let path: URL
+    public let capturedAt: Date
+    public let sessionID: UUID
+
+    public init(path: URL, capturedAt: Date, sessionID: UUID) {
+        self.path = path
+        self.capturedAt = capturedAt
+        self.sessionID = sessionID
+    }
+}
+
+public actor HistoryStore {
+    public static let pdfRetentionCount = 10
+    public static let imageRetentionCount = 30
+
+    private let paths: AppSupportPaths
+    private let historyRoot: URL
+    private let pdfsDirectory: URL
+    private let manifestURL: URL
+    private var entries: [HistoryEntry]
+
+    public init(paths: AppSupportPaths) throws {
+        self.paths = paths
+        self.historyRoot = paths.root.appendingPathComponent("history", isDirectory: true)
+        self.pdfsDirectory = historyRoot.appendingPathComponent("pdfs", isDirectory: true)
+        self.manifestURL = historyRoot.appendingPathComponent("history.json")
+        do {
+            try FileManager.default.createDirectory(at: historyRoot, withIntermediateDirectories: true)
+            try FileManager.default.createDirectory(at: pdfsDirectory, withIntermediateDirectories: true)
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: historyRoot.path,
+                underlying: error.localizedDescription
+            )
+        }
+        self.entries = try Self.loadEntries(from: manifestURL, pdfsDirectory: pdfsDirectory)
+    }
+
+    /// Copies `sourceURL` into `history/pdfs/` (never moves or writes the
+    /// user's file), appends an entry, then keeps the 10 newest PDF copies.
+    public func recordSentPDF(
+        sourceURL: URL,
+        sessionID: UUID?,
+        pageCount: Int,
+        sentAt: Date
+    ) throws -> HistoryEntry {
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: sourceURL.path) else {
+            throw ShotdeckError.spoolWriteFailed(
+                path: sourceURL.path,
+                underlying: "source PDF does not exist"
+            )
+        }
+        let data: Data
+        do {
+            data = try Data(contentsOf: sourceURL)
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: sourceURL.path,
+                underlying: error.localizedDescription
+            )
+        }
+
+        let id = UUID()
+        let fileName = "\(DubaiTime.fileStamp(sentAt))-\(id.uuidString.lowercased()).pdf"
+        let destURL = pdfsDirectory.appendingPathComponent(fileName)
+        try AtomicFile.write(data, to: destURL)
+
+        let entry = HistoryEntry(
+            id: id,
+            fileName: fileName,
+            fileURL: destURL,
+            originalFileName: sourceURL.lastPathComponent,
+            sessionID: sessionID,
+            pageCount: pageCount,
+            sentAt: sentAt
+        )
+        entries.append(entry)
+        try prunePDFEntries()
+        return entry
+    }
+
+    /// Newest first, at most `pdfRetentionCount`.
+    public func listPDFs() -> [HistoryEntry] {
+        Array(sortedPDFs().prefix(Self.pdfRetentionCount))
+    }
+
+    /// The newest capture PNGs across `archive/` sessions (including
+    /// `removed/`). Does not copy files and does not look at the open spool.
+    public func listImages(limit: Int = 30) throws -> [ImageRef] {
+        let images = try collectArchivedImages()
+        return images.prefix(max(limit, 0)).map(\.ref)
+    }
+
+    /// Across archived sessions only: keep the 30 newest PNGs total (including
+    /// `removed/`); delete older PNGs, drop them from `session.json`, and
+    /// remove a session directory left with zero PNGs. Never touches spool/.
+    public func pruneImages() throws {
+        let fm = FileManager.default
+        let images = try collectArchivedImages()
+        let keepCount = Self.imageRetentionCount
+        let doomed = Array(images.dropFirst(keepCount))
+        guard !doomed.isEmpty else { return }
+
+        var remainingBySession: [UUID: CaptureSession] = [:]
+        var dirBySession: [UUID: URL] = [:]
+        for item in images {
+            remainingBySession[item.session.id] = item.session
+            dirBySession[item.session.id] = item.sessionDir
+        }
+
+        var droppedIDs: [UUID: Set<UUID>] = [:]
+        for item in doomed {
+            try deleteIfPrunableImage(item.ref.path)
+            if let captureID = item.captureID {
+                droppedIDs[item.session.id, default: []].insert(captureID)
+            }
+        }
+
+        for (sessionID, ids) in droppedIDs {
+            guard var session = remainingBySession[sessionID] else { continue }
+            for id in ids {
+                session = session.removing(captureID: id)
+            }
+            remainingBySession[sessionID] = session
+        }
+
+        let touchedIDs = Set(doomed.map(\.session.id))
+        for sessionID in touchedIDs {
+            guard let sessionDir = dirBySession[sessionID] else { continue }
+            guard isUnderArchive(sessionDir), !isUnderSpool(sessionDir) else { continue }
+
+            if pngsRemaining(in: sessionDir).isEmpty {
+                if fm.fileExists(atPath: sessionDir.path) {
+                    try fm.removeItem(at: sessionDir)
+                    Log.spool.warning("Pruned \(sessionDir.path, privacy: .public)")
+                }
+                try AtomicFile.fsyncDirectory(at: paths.archive)
+                continue
+            }
+
+            if let session = remainingBySession[sessionID], droppedIDs[sessionID] != nil {
+                try AtomicFile.writeJSON(
+                    session,
+                    to: sessionDir.appendingPathComponent("session.json")
+                )
+            }
+        }
+    }
+
+    // MARK: - PDF retention
+
+    private func prunePDFEntries() throws {
+        let sorted = sortedPDFs()
+        let kept = Array(sorted.prefix(Self.pdfRetentionCount))
+        let discarded = sorted.dropFirst(Self.pdfRetentionCount)
+        for entry in discarded {
+            let url = pdfsDirectory.appendingPathComponent(entry.fileName)
+            try deleteIfAppManagedPDF(url)
+        }
+        entries = kept
+        try persistEntries()
+    }
+
+    private func sortedPDFs() -> [HistoryEntry] {
+        entries.sorted { lhs, rhs in
+            if lhs.sentAt != rhs.sentAt { return lhs.sentAt > rhs.sentAt }
+            return lhs.id.uuidString > rhs.id.uuidString
+        }
+    }
+
+    private func persistEntries() throws {
+        try AtomicFile.writeJSON(entries, to: manifestURL)
+    }
+
+    private func deleteIfAppManagedPDF(_ url: URL) throws {
+        guard isUnderPDFs(url) else { return }
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: url.path) else { return }
+        do {
+            try fm.removeItem(at: url)
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: url.path,
+                underlying: error.localizedDescription
+            )
+        }
+        Log.spool.warning("Pruned \(url.path, privacy: .public)")
+        try AtomicFile.fsyncDirectory(at: pdfsDirectory)
+    }
+
+    // MARK: - Archived images
+
+    private struct ArchivedImage {
+        let ref: ImageRef
+        let session: CaptureSession
+        let sessionDir: URL
+        let captureID: UUID?
+    }
+
+    private func collectArchivedImages() throws -> [ArchivedImage] {
+        let dirs = try archivedSessionDirectories()
+        var collected: [ArchivedImage] = []
+        for dir in dirs {
+            let sessionID = UUID(uuidString: dir.lastPathComponent) ?? UUID()
+            let session = (try? loadSession(at: dir, id: sessionID))
+                ?? CaptureSession(
+                    id: sessionID,
+                    createdAt: fileDate(dir) ?? Date(),
+                    state: .archived,
+                    captures: [],
+                    pdfFileName: nil
+                )
+            var referenced = Set<String>()
+            for capture in session.captures {
+                let url = dir.appendingPathComponent(capture.fileName)
+                guard FileManager.default.fileExists(atPath: url.path) else { continue }
+                referenced.insert(capture.fileName)
+                collected.append(
+                    ArchivedImage(
+                        ref: ImageRef(path: url, capturedAt: capture.capturedAt, sessionID: session.id),
+                        session: session,
+                        sessionDir: dir,
+                        captureID: capture.id
+                    )
+                )
+            }
+            let removedDir = dir.appendingPathComponent("removed", isDirectory: true)
+            for url in pngFiles(in: dir) where !referenced.contains(url.lastPathComponent) {
+                collected.append(
+                    ArchivedImage(
+                        ref: ImageRef(
+                            path: url,
+                            capturedAt: fileDate(url) ?? .distantPast,
+                            sessionID: session.id
+                        ),
+                        session: session,
+                        sessionDir: dir,
+                        captureID: nil
+                    )
+                )
+            }
+            for url in pngFiles(in: removedDir) {
+                collected.append(
+                    ArchivedImage(
+                        ref: ImageRef(
+                            path: url,
+                            capturedAt: fileDate(url) ?? .distantPast,
+                            sessionID: session.id
+                        ),
+                        session: session,
+                        sessionDir: dir,
+                        captureID: nil
+                    )
+                )
+            }
+        }
+        return collected.sorted { lhs, rhs in
+            if lhs.ref.capturedAt != rhs.ref.capturedAt {
+                return lhs.ref.capturedAt > rhs.ref.capturedAt
+            }
+            return lhs.ref.path.path > rhs.ref.path.path
+        }
+    }
+
+    private func archivedSessionDirectories() throws -> [URL] {
+        let fm = FileManager.default
+        let entries: [URL]
+        do {
+            entries = try fm.contentsOfDirectory(
+                at: paths.archive,
+                includingPropertiesForKeys: [.isDirectoryKey],
+                options: []
+            )
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: paths.archive.path,
+                underlying: error.localizedDescription
+            )
+        }
+        return entries.filter { url in
+            let isDirectory = (try? url.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false
+            return isDirectory && UUID(uuidString: url.lastPathComponent) != nil
+        }
+    }
+
+    private func loadSession(at dir: URL, id: UUID) throws -> CaptureSession {
+        let url = dir.appendingPathComponent("session.json")
+        let data = try Data(contentsOf: url)
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        let session = try decoder.decode(CaptureSession.self, from: data)
+        guard session.id == id else {
+            throw ShotdeckError.manifestCorrupt(path: url.path)
+        }
+        return session
+    }
+
+    private func pngFiles(in dir: URL) -> [URL] {
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: dir.path) else { return [] }
+        let entries = (try? fm.contentsOfDirectory(
+            at: dir,
+            includingPropertiesForKeys: [.isDirectoryKey],
+            options: []
+        )) ?? []
+        return entries.filter { url in
+            let isDirectory = (try? url.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false
+            return !isDirectory && url.pathExtension.lowercased() == "png"
+        }
+    }
+
+    private func pngsRemaining(in sessionDir: URL) -> [URL] {
+        pngFiles(in: sessionDir)
+            + pngFiles(in: sessionDir.appendingPathComponent("removed", isDirectory: true))
+    }
+
+    private func deleteIfPrunableImage(_ url: URL) throws {
+        guard isUnderArchive(url), !isUnderSpool(url) else { return }
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: url.path) else { return }
+        do {
+            try fm.removeItem(at: url)
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: url.path,
+                underlying: error.localizedDescription
+            )
+        }
+        Log.spool.warning("Pruned \(url.path, privacy: .public)")
+        try AtomicFile.fsyncDirectory(at: url.deletingLastPathComponent())
+    }
+
+    private func fileDate(_ url: URL) -> Date? {
+        let values = try? url.resourceValues(forKeys: [.creationDateKey, .contentModificationDateKey])
+        return values?.creationDate ?? values?.contentModificationDate
+    }
+
+    // MARK: - Path guards
+
+    private func isUnderPDFs(_ url: URL) -> Bool {
+        isUnderDirectory(url, parent: pdfsDirectory)
+    }
+
+    private func isUnderArchive(_ url: URL) -> Bool {
+        isUnderDirectory(url, parent: paths.archive)
+    }
+
+    private func isUnderSpool(_ url: URL) -> Bool {
+        isUnderDirectory(url, parent: paths.spool)
+    }
+
+    private func isUnderDirectory(_ url: URL, parent: URL) -> Bool {
+        let parentPath = parent.standardizedFileURL.path
+        let path = url.standardizedFileURL.path
+        if path == parentPath { return true }
+        let prefix = parentPath.hasSuffix("/") ? parentPath : parentPath + "/"
+        return path.hasPrefix(prefix)
+    }
+
+    // MARK: - Manifest load
+
+    private static func loadEntries(from url: URL, pdfsDirectory: URL) throws -> [HistoryEntry] {
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: url.path) else { return [] }
+        let data: Data
+        do {
+            data = try Data(contentsOf: url)
+        } catch {
+            throw ShotdeckError.spoolWriteFailed(
+                path: url.path,
+                underlying: error.localizedDescription
+            )
+        }
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        do {
+            let decoded = try decoder.decode([HistoryEntry].self, from: data)
+            return decoded.map { entry in
+                HistoryEntry(
+                    id: entry.id,
+                    fileName: entry.fileName,
+                    fileURL: pdfsDirectory.appendingPathComponent(entry.fileName),
+                    originalFileName: entry.originalFileName,
+                    sessionID: entry.sessionID,
+                    pageCount: entry.pageCount,
+                    sentAt: entry.sentAt
+                )
+            }
+        } catch {
+            let corruptURL = url.deletingLastPathComponent()
+                .appendingPathComponent("history.json.corrupt-\(DubaiTime.fileStamp(Date()))")
+            try? fm.moveItem(at: url, to: corruptURL)
+            Log.spool.error(
+                "history.json could not be decoded; moved to \(corruptURL.path, privacy: .public): \(error.localizedDescription, privacy: .public)"
+            )
+            return []
+        }
+    }
+}

Sources/ShotdeckCore/Model/ShotdeckError.swift

@@ -10,7 +10,6 @@ public enum ShotdeckError: Error, LocalizedError, Sendable {
     case pdfCompositionFailed(reason: String)
     case airDropUnavailable
     case noCommentedReturns
-    case oneDriveFolderUnavailable(path: String)
 
     public var errorDescription: String? {
         switch self {
@@ -32,8 +31,6 @@ public enum ShotdeckError: Error, LocalizedError, Sendable {
             return "AirDrop is not available right now."
         case .noCommentedReturns:
             return "None of the returned PDFs have comments on them."
-        case .oneDriveFolderUnavailable(let path):
-            return "Your OneDrive folder is not available: \(path). Check that OneDrive is signed in, or choose another folder in Settings."
         }
     }
 }

Sources/ShotdeckCore/Returns/ReturnWatcher.swift

@@ -10,12 +10,6 @@ public actor ReturnWatcher {
     private var bridge: FSEventBridge?
     private var pendingScanTask: Task<Void, Never>?
     private let eventQueue = DispatchQueue(label: "ai.flowmaster.shotdeck.returns.fsevents")
-    /// When false, a document with zero human marks is neither recorded into the ledger
-    /// nor included in scanNow's/onChange's results — needed for OneDrive mode, where the
-    /// outbox and watch folder are the same folder and a freshly written, unmarked PDF
-    /// must not be treated as a return. Defaults to true (today's AirDrop behaviour).
-    /// A document that IS commented is always recorded, regardless of this flag.
-    public var recordUncommented: Bool = true
 
     /// Watch folder is `paths.watchFolder`, which production constructs from
     /// `FolderSettings.resolve().watch`. This type never calls FolderSettings;
@@ -35,12 +29,6 @@ public actor ReturnWatcher {
         onChange(found)
     }
 
-    /// Sets `recordUncommented`. A `func` (not a plain property set) only because
-    /// callers outside this actor must `await` it like any other actor mutation.
-    public func setRecordUncommented(_ value: Bool) {
-        recordUncommented = value
-    }
-
     /// Idempotent. Stops and releases the FSEventStream if one is running; safe to call
     /// when never started or already stopped. Cancels any pending debounced scan.
     public func stop() {
@@ -89,7 +77,6 @@ public actor ReturnWatcher {
             guard let document = PDFDocument(url: url),
                   AnnotationInspector.isShotdeckDocument(document) else { continue }
             guard let inspected = try? AnnotationInspector.inspect(fileURL: url) else { continue }
-            if !recordUncommented, !inspected.isCommented { continue }
             try await ledger.record(inspected)
             results.append(inspected)
         }

Sources/ShotdeckCore/Support/TransportSettings.swift

@@ -1,145 +0,0 @@
-import Foundation
-
-/// The two ways a composed PDF can reach the iPad and come back marked up.
-public enum SendTransport: String, Codable, Sendable, CaseIterable {
-    case airDrop
-    case oneDrive
-
-    public var displayName: String {
-        switch self {
-        case .airDrop: return "AirDrop"
-        case .oneDrive: return "OneDrive folder"
-        }
-    }
-}
-
-/// User-configurable transport choice plus the OneDrive folder override, backed by
-/// UserDefaults the same way `FolderSettings` is. See `FolderSettings` for why a plain
-/// path (not a security-scoped bookmark) is correct for this unsandboxed app.
-public enum TransportSettings {
-    public static let transportDefaultsKey = "ai.flowmaster.shotdeck.transport"
-    public static let oneDriveFolderDefaultsKey = "ai.flowmaster.shotdeck.oneDriveFolder"
-
-    /// Defaults to `.airDrop` when unset or when the stored value cannot be parsed.
-    public static func transport(defaults: UserDefaults = .standard) -> SendTransport {
-        guard let raw = defaults.string(forKey: transportDefaultsKey),
-              let value = SendTransport(rawValue: raw)
-        else { return .airDrop }
-        return value
-    }
-
-    public static func setTransport(_ value: SendTransport, defaults: UserDefaults = .standard) {
-        defaults.set(value.rawValue, forKey: transportDefaultsKey)
-    }
-
-    /// Raw stored path (or nil if never set / cleared). Does NOT validate that the
-    /// directory still exists.
-    public static func storedOneDriveFolderPath(defaults: UserDefaults = .standard) -> String? {
-        defaults.string(forKey: oneDriveFolderDefaultsKey)
-    }
-
-    public static func setOneDriveFolder(_ url: URL, defaults: UserDefaults = .standard) {
-        defaults.set(url.path, forKey: oneDriveFolderDefaultsKey)
-    }
-
-    public static func resetOneDriveFolder(defaults: UserDefaults = .standard) {
-        defaults.removeObject(forKey: oneDriveFolderDefaultsKey)
-    }
-
-    /// The outbox/watch folders Redline should actually use right now, for the current
-    /// transport. AirDrop mode delegates to `FolderSettings.resolve()` unchanged.
-    /// OneDrive mode uses the SAME folder for both outbox and watch — see
-    /// `OneDriveLocator.resolveOneDriveFolder`. When no OneDrive folder can be resolved
-    /// at all (no sync root, no override), this falls back to the AirDrop folders so the
-    /// app always has somewhere to write; `send(anchor:)` performs its own live
-    /// existence check before ever composing into a OneDrive send, so that fallback is
-    /// never mistaken for a valid OneDrive destination.
-    public static func effectiveFolders(
-        defaults: UserDefaults = .standard,
-        fileManager: FileManager = .default
-    ) -> (outbox: URL, watch: URL, transport: SendTransport) {
-        let transport = transport(defaults: defaults)
-        switch transport {
-        case .airDrop:
-            let folders = FolderSettings.resolve(defaults: defaults, fileManager: fileManager)
-            return (folders.outbox, folders.watch, transport)
-        case .oneDrive:
-            if let folder = OneDriveLocator.resolveOneDriveFolder(
-                defaults: defaults,
-                home: fileManager.homeDirectoryForCurrentUser,
-                fileManager: fileManager
-            ) {
-                return (folder, folder, transport)
-            }
-            let folders = FolderSettings.resolve(defaults: defaults, fileManager: fileManager)
-            return (folders.outbox, folders.watch, transport)
-        }
-    }
-}
-
-/// Pure path logic for locating a OneDrive sync root under
-/// `~/Library/CloudStorage` and the Redline folder inside it. No side effects — never
-/// creates a directory. Fully unit-testable with a fake home tree.
-public enum OneDriveLocator {
-    /// Every directory directly under `<home>/Library/CloudStorage` whose name starts
-    /// with "OneDrive-", sorted so a name containing "MMD" (case-insensitive) sorts
-    /// first, then alphabetically. Empty when CloudStorage does not exist.
-    public static func syncRoots(
-        home: URL = FileManager.default.homeDirectoryForCurrentUser,
-        fileManager: FileManager = .default
-    ) -> [URL] {
-        let cloudStorage = home.appendingPathComponent("Library/CloudStorage", isDirectory: true)
-        var isDirectory: ObjCBool = false
-        guard fileManager.fileExists(atPath: cloudStorage.path, isDirectory: &isDirectory),
-              isDirectory.boolValue
-        else { return [] }
-
-        let items = (try? fileManager.contentsOfDirectory(
-            at: cloudStorage,
-            includingPropertiesForKeys: [.isDirectoryKey],
-            options: [.skipsHiddenFiles]
-        )) ?? []
-
-        let roots = items.filter { url in
-            guard url.lastPathComponent.hasPrefix("OneDrive-") else { return false }
-            var itemIsDirectory: ObjCBool = false
-            let exists = fileManager.fileExists(atPath: url.path, isDirectory: &itemIsDirectory)
-            return exists && itemIsDirectory.boolValue
-        }
-
-        return roots.sorted { a, b in
-            let aName = a.lastPathComponent
-            let bName = b.lastPathComponent
-            let aIsMMD = aName.localizedCaseInsensitiveContains("MMD")
-            let bIsMMD = bName.localizedCaseInsensitiveContains("MMD")
-            if aIsMMD != bIsMMD { return aIsMMD }
-            return aName.localizedStandardCompare(bName) == .orderedAscending
-        }
-    }
-
-    /// First sync root's "Redline" subfolder, or nil when there is no sync root at all.
-    public static func defaultRedlineFolder(
-        home: URL = FileManager.default.homeDirectoryForCurrentUser,
-        fileManager: FileManager = .default
-    ) -> URL? {
-        guard let first = syncRoots(home: home, fileManager: fileManager).first else { return nil }
-        return first.appendingPathComponent("Redline", isDirectory: true)
-    }
-
-    /// The stored override when it is set AND still exists as a directory; otherwise
-    /// `defaultRedlineFolder`. Never creates anything.
-    public static func resolveOneDriveFolder(
-        defaults: UserDefaults = .standard,
-        home: URL = FileManager.default.homeDirectoryForCurrentUser,
-        fileManager: FileManager = .default
-    ) -> URL? {
-        if let storedPath = TransportSettings.storedOneDriveFolderPath(defaults: defaults) {
-            var isDirectory: ObjCBool = false
-            let exists = fileManager.fileExists(atPath: storedPath, isDirectory: &isDirectory)
-            if exists, isDirectory.boolValue {
-                return URL(fileURLWithPath: storedPath, isDirectory: true)
-            }
-        }
-        return defaultRedlineFolder(home: home, fileManager: fileManager)
-    }
-}

Tests/ShotdeckCoreTests/HistoryStoreTests.swift

@@ -0,0 +1,319 @@
+import CoreGraphics
+import Foundation
+import ImageIO
+import Testing
+import ShotdeckCore
+
+@Test
+func recordTwelvePDFsKeepsTenNewestAndDeletesOldestCopies() async throws {
+    let (root, paths) = try makeHistoryPaths()
+    defer { try? FileManager.default.removeItem(at: root) }
+
+    let store = try HistoryStore(paths: paths)
+    let sources = root.appendingPathComponent("user-sources", isDirectory: true)
+    try FileManager.default.createDirectory(at: sources, withIntermediateDirectories: true)
+
+    var recorded: [HistoryEntry] = []
+    for i in 0..<12 {
+        let source = sources.appendingPathComponent("source-\(i).pdf")
+        try writeDummyPDF(to: source, marker: "pdf-\(i)")
+        let sentAt = Date(timeIntervalSince1970: 1_800_000_000 + TimeInterval(i))
+        let entry = try await store.recordSentPDF(
+            sourceURL: source,
+            sessionID: UUID(),
+            pageCount: i + 1,
+            sentAt: sentAt
+        )
+        recorded.append(entry)
+    }
+
+    let listed = await store.listPDFs()
+    #expect(listed.count == 10)
+    #expect(listed.map(\.id) == recorded.suffix(10).reversed().map(\.id))
+    #expect(listed.map(\.sentAt) == recorded.suffix(10).reversed().map(\.sentAt))
+
+    let pdfsDir = paths.root.appendingPathComponent("history/pdfs", isDirectory: true)
+    for entry in recorded.prefix(2) {
+        #expect(!FileManager.default.fileExists(atPath: pdfsDir.appendingPathComponent(entry.fileName).path))
+    }
+    for entry in recorded.suffix(10) {
+        #expect(FileManager.default.fileExists(atPath: pdfsDir.appendingPathComponent(entry.fileName).path))
+    }
+}
+
+@Test
+func pruneImagesKeepsThirtyNewestAcrossThreeArchivedSessionsAndLeavesOpenSessionAlone() async throws {
+    let (root, paths) = try makeHistoryPaths()
+    defer { try? FileManager.default.removeItem(at: root) }
+
+    let spool = try SpoolStore(paths: paths)
+    let base = Date(timeIntervalSince1970: 1_800_100_000)
+    var captures: [(id: UUID, capturedAt: Date, sessionID: UUID)] = []
+
+    // 5 oldest + 15 + 15 = 35 archived PNGs. The oldest session is emptied by prune.
+    let perSession = [5, 15, 15]
+    var index = 0
+    for count in perSession {
+        let sessionID = try await spool.currentSession().id
+        for _ in 0..<count {
+            let capturedAt = base.addingTimeInterval(TimeInterval(index))
+            let capture = try await spool.append(
+                pngData: try makeHistoryPNGData(width: 6, height: 4, red: 0.2, green: 0.3, blue: 0.4),
+                pixelWidth: 6,
+                pixelHeight: 4,
+                scale: 1.0,
+                capturedAt: capturedAt
+            )
+            captures.append((capture.id, capturedAt, sessionID))
+            index += 1
+        }
+        _ = try await spool.archiveCurrent(pdfFileName: "Redline-hist-\(sessionID.uuidString).pdf")
+    }
+
+    let openBefore = try await spool.currentSession()
+    let openCapture = try await spool.append(
+        pngData: try makeHistoryPNGData(width: 8, height: 6, red: 0.9, green: 0.1, blue: 0.1),
+        pixelWidth: 8,
+        pixelHeight: 6,
+        scale: 1.0,
+        capturedAt: Date(timeIntervalSince1970: 1_900_000_000)
+    )
+    let openSession = try await spool.currentSession()
+    #expect(openSession.id == openBefore.id)
+    let openDir = paths.sessionDirectory(openSession.id)
+    let openPNG = openDir.appendingPathComponent(openCapture.fileName)
+    let openPNGBytes = try Data(contentsOf: openPNG)
+    let openManifest = try Data(contentsOf: openDir.appendingPathComponent("session.json"))
+
+    let store = try HistoryStore(paths: paths)
+    try await store.pruneImages()
+
+    let remaining = try await store.listImages(limit: 50)
+    #expect(remaining.count == 30)
+
+    let newestThirty = Array(captures.suffix(30))
+    let remainingDates = Set(remaining.map(\.capturedAt))
+    #expect(remainingDates == Set(newestThirty.map(\.capturedAt)))
+    #expect(remaining.map(\.sessionID).allSatisfy { $0 != openSession.id })
+
+    let oldestFive = Array(captures.prefix(5))
+    for old in oldestFive {
+        let archiveDir = paths.archiveDirectory(old.sessionID)
+        #expect(!FileManager.default.fileExists(atPath: archiveDir.path))
+    }
+
+    #expect(pngFiles(under: paths.archive).count == 30)
+    try assertManifestsMatchDisk(archiveRoot: paths.archive)
+
+    #expect(FileManager.default.fileExists(atPath: openPNG.path))
+    #expect(try Data(contentsOf: openPNG) == openPNGBytes)
+    #expect(try Data(contentsOf: openDir.appendingPathComponent("session.json")) == openManifest)
+    #expect(try await spool.currentSession().captures.map(\.id) == [openCapture.id])
+}
+
+@Test
+func recordSentPDFLeavesTheUserSourceUntouched() async throws {
+    let (root, paths) = try makeHistoryPaths()
+    defer { try? FileManager.default.removeItem(at: root) }
+
+    let source = root.appendingPathComponent("outside-appsupport.pdf")
+    let payload = Data("%PDF-1.4\n%user-original\n%%EOF\n".utf8)
+    try payload.write(to: source)
+
+    let store = try HistoryStore(paths: paths)
+    let entry = try await store.recordSentPDF(
+        sourceURL: source,
+        sessionID: UUID(),
+        pageCount: 2,
+        sentAt: Date(timeIntervalSince1970: 1_800_200_000)
+    )
+
+    #expect(FileManager.default.fileExists(atPath: source.path))
+    #expect(try Data(contentsOf: source) == payload)
+    #expect(entry.fileURL.path != source.path)
+    #expect(try Data(contentsOf: entry.fileURL) == payload)
+    #expect(entry.fileURL.path.hasPrefix(
+        paths.root.appendingPathComponent("history/pdfs", isDirectory: true).path
+    ))
+}
+
+@Test
+func recordingTheSameSourceTwiceMakesTwoDistinctCopies() async throws {
+    let (root, paths) = try makeHistoryPaths()
+    defer { try? FileManager.default.removeItem(at: root) }
+
+    let source = root.appendingPathComponent("resend.pdf")
+    try writeDummyPDF(to: source, marker: "same-source")
+
+    let store = try HistoryStore(paths: paths)
+    let first = try await store.recordSentPDF(
+        sourceURL: source,
+        sessionID: nil,
+        pageCount: 1,
+        sentAt: Date(timeIntervalSince1970: 1_800_300_000)
+    )
+    let second = try await store.recordSentPDF(
+        sourceURL: source,
+        sessionID: nil,
+        pageCount: 1,
+        sentAt: Date(timeIntervalSince1970: 1_800_300_001)
+    )
+
+    #expect(first.id != second.id)
+    #expect(first.fileName != second.fileName)
+    #expect(first.fileURL.path != second.fileURL.path)
+    #expect(FileManager.default.fileExists(atPath: first.fileURL.path))
+    #expect(FileManager.default.fileExists(atPath: second.fileURL.path))
+    let firstBytes = try Data(contentsOf: first.fileURL)
+    let secondBytes = try Data(contentsOf: second.fileURL)
+    #expect(firstBytes == secondBytes)
+    #expect(FileManager.default.fileExists(atPath: source.path))
+
+    let listed = await store.listPDFs()
+    #expect(listed.count == 2)
+    #expect(Set(listed.map(\.id)) == [first.id, second.id])
+}
+
+@Test
+func pruneImagesDeletesOlderPNGsInRemovedFolders() async throws {
+    let (root, paths) = try makeHistoryPaths()
+    defer { try? FileManager.default.removeItem(at: root) }
+
+    let spool = try SpoolStore(paths: paths)
+    let base = Date(timeIntervalSince1970: 1_800_400_000)
+    for i in 0..<30 {
+        _ = try await spool.append(
+            pngData: try makeHistoryPNGData(width: 4, height: 4, red: 0.1, green: 0.2, blue: 0.3),
+            pixelWidth: 4,
+            pixelHeight: 4,
+            scale: 1.0,
+            capturedAt: base.addingTimeInterval(TimeInterval(10 + i))
+        )
+    }
+    _ = try await spool.archiveCurrent(pdfFileName: "Redline-keep.pdf")
+
+    let oldSessionID = UUID()
+    let oldDir = paths.archiveDirectory(oldSessionID)
+    let removedDir = oldDir.appendingPathComponent("removed", isDirectory: true)
+    try FileManager.default.createDirectory(at: removedDir, withIntermediateDirectories: true)
+    let oldPNG = removedDir.appendingPathComponent("001-DEADBEEF.png")
+    try makeHistoryPNGData(width: 4, height: 4, red: 0.5, green: 0.5, blue: 0.5).write(to: oldPNG)
+    try FileManager.default.setAttributes(
+        [.creationDate: base],
+        ofItemAtPath: oldPNG.path
+    )
+    let oldSession = CaptureSession(
+        id: oldSessionID,
+        createdAt: base,
+        state: .archived,
+        captures: [],
+        pdfFileName: "Redline-old.pdf"
+    )
+    try AtomicFile.writeJSON(oldSession, to: oldDir.appendingPathComponent("session.json"))
+
+    let store = try HistoryStore(paths: paths)
+    try await store.pruneImages()
+
+    #expect(!FileManager.default.fileExists(atPath: oldPNG.path))
+    #expect(pngFiles(under: paths.archive).count == 30)
+}
+
+// MARK: - Fixtures
+
+private func makeHistoryPaths() throws -> (root: URL, paths: AppSupportPaths) {
+    let root = FileManager.default.temporaryDirectory
+        .appendingPathComponent("shotdeck-history-\(UUID().uuidString)", isDirectory: true)
+    let paths = try AppSupportPaths(
+        root: root.appendingPathComponent("root", isDirectory: true),
+        outbox: root.appendingPathComponent("outbox", isDirectory: true),
+        watchFolder: root.appendingPathComponent("watch", isDirectory: true)
+    )
+    return (root, paths)
+}
+
+private func writeDummyPDF(to url: URL, marker: String) throws {
+    try Data("%PDF-1.4\n%\(marker)\n%%EOF\n".utf8).write(to: url)
+}
+
+private func makeHistoryPNGData(
+    width: Int,
+    height: Int,
+    red: CGFloat,
+    green: CGFloat,
+    blue: CGFloat
+) throws -> Data {
+    let colorSpace = CGColorSpaceCreateDeviceRGB()
+    guard let context = CGContext(
+        data: nil,
+        width: width,
+        height: height,
+        bitsPerComponent: 8,
+        bytesPerRow: width * 4,
+        space: colorSpace,
+        bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
+    ) else {
+        throw HistoryFixtureError.pngGenerationFailed
+    }
+    context.setFillColor(red: red, green: green, blue: blue, alpha: 1)
+    context.fill(CGRect(x: 0, y: 0, width: width, height: height))
+    guard let image = context.makeImage() else {
+        throw HistoryFixtureError.pngGenerationFailed
+    }
+    let buffer = NSMutableData()
+    guard let destination = CGImageDestinationCreateWithData(buffer, "public.png" as CFString, 1, nil) else {
+        throw HistoryFixtureError.pngGenerationFailed
+    }
+    CGImageDestinationAddImage(destination, image, nil)
+    guard CGImageDestinationFinalize(destination) else {
+        throw HistoryFixtureError.pngGenerationFailed
+    }
+    return buffer as Data
+}
+
+private func pngFiles(under root: URL) -> [URL] {
+    let fm = FileManager.default
+    guard let enumerator = fm.enumerator(
+        at: root,
+        includingPropertiesForKeys: [.isRegularFileKey],
+        options: []
+    ) else { return [] }
+    var urls: [URL] = []
+    for case let url as URL in enumerator {
+        let isFile = (try? url.resourceValues(forKeys: [.isRegularFileKey]).isRegularFile) ?? false
+        if isFile, url.pathExtension.lowercased() == "png" {
+            urls.append(url)
+        }
+    }
+    return urls
+}
+
+private func assertManifestsMatchDisk(archiveRoot: URL) throws {
+    let fm = FileManager.default
+    let sessions = (try fm.contentsOfDirectory(
+        at: archiveRoot,
+        includingPropertiesForKeys: [.isDirectoryKey],
+        options: []
+    )).filter {
+        ((try? $0.resourceValues(forKeys: [.isDirectoryKey]).isDirectory) ?? false)
+            && UUID(uuidString: $0.lastPathComponent) != nil
+    }
+    let decoder = JSONDecoder()
+    decoder.dateDecodingStrategy = .iso8601
+    for dir in sessions {
+        let manifestURL = dir.appendingPathComponent("session.json")
+        #expect(fm.fileExists(atPath: manifestURL.path))
+        let session = try decoder.decode(CaptureSession.self, from: Data(contentsOf: manifestURL))
+        for capture in session.captures {
+            let url = dir.appendingPathComponent(capture.fileName)
+            #expect(fm.fileExists(atPath: url.path))
+        }
+        let topLevelPNGs = (try fm.contentsOfDirectory(at: dir, includingPropertiesForKeys: nil, options: []))
+            .filter { $0.pathExtension.lowercased() == "png" }
+        let manifestNames = Set(session.captures.map(\.fileName))
+        #expect(Set(topLevelPNGs.map(\.lastPathComponent)) == manifestNames)
+    }
+}
+
+private enum HistoryFixtureError: Error {
+    case pngGenerationFailed
+}

Tests/ShotdeckCoreTests/OneDriveLocatorTests.swift

@@ -1,125 +0,0 @@
-import Foundation
-import Testing
-import ShotdeckCore
-
-@Test
-func syncRootsFindsOneDriveDirsMMDFirstIgnoresNonDirsAndOtherProviders() throws {
-    let home = try makeFakeHome()
-    defer { try? FileManager.default.removeItem(at: home) }
-    let cloudStorage = home.appendingPathComponent("Library/CloudStorage", isDirectory: true)
-    try FileManager.default.createDirectory(at: cloudStorage, withIntermediateDirectories: true)
-
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-Flowmaster", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-MMDGROUP", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("GoogleDrive-x", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-    // A plain FILE (not a directory) named like a OneDrive root must be ignored.
-    FileManager.default.createFile(
-        atPath: cloudStorage.appendingPathComponent("OneDrive-notadir").path,
-        contents: Data("not a directory".utf8)
-    )
-
-    let roots = OneDriveLocator.syncRoots(home: home, fileManager: .default)
-
-    #expect(roots.map(\.lastPathComponent) == ["OneDrive-MMDGROUP", "OneDrive-Flowmaster"])
-}
-
-@Test
-func syncRootsEmptyAndDefaultFolderNilWithNoCloudStorageDirectory() throws {
-    let home = try makeFakeHome()
-    defer { try? FileManager.default.removeItem(at: home) }
-    // No Library/CloudStorage created at all.
-
-    let roots = OneDriveLocator.syncRoots(home: home, fileManager: .default)
-    #expect(roots.isEmpty)
-
-    let defaultFolder = OneDriveLocator.defaultRedlineFolder(home: home, fileManager: .default)
-    #expect(defaultFolder == nil)
-}
-
-@Test
-func defaultRedlineFolderIsFirstSyncRootPlusRedline() throws {
-    let home = try makeFakeHome()
-    defer { try? FileManager.default.removeItem(at: home) }
-    let cloudStorage = home.appendingPathComponent("Library/CloudStorage", isDirectory: true)
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-MMDGROUP", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-Flowmaster", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-
-    let defaultFolder = try #require(
-        OneDriveLocator.defaultRedlineFolder(home: home, fileManager: .default)
-    )
-    // Derive "expected" from syncRoots() itself (already covered by its own dedicated
-    // test) rather than hand-building the path string — FileManager's directory
-    // enumeration can canonicalize /var -> /private/var and the two constructions
-    // otherwise disagree on that even for a URL that already exists.
-    let expectedRoot = try #require(OneDriveLocator.syncRoots(home: home, fileManager: .default).first)
-    let expected = expectedRoot.appendingPathComponent("Redline", isDirectory: true)
-    #expect(defaultFolder.path == expected.path)
-}
-
-@Test
-func resolveOneDriveFolderPrefersAnExistingStoredOverride() throws {
-    let home = try makeFakeHome()
-    defer { try? FileManager.default.removeItem(at: home) }
-    let cloudStorage = home.appendingPathComponent("Library/CloudStorage", isDirectory: true)
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-MMDGROUP", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-    let override = try makeTransportTemporaryDirectory(prefix: "shotdeck-onedrive-override")
-    defer { try? FileManager.default.removeItem(at: override) }
-    TransportSettings.setOneDriveFolder(override, defaults: suite.defaults)
-
-    let resolved = OneDriveLocator.resolveOneDriveFolder(
-        defaults: suite.defaults, home: home, fileManager: .default
-    )
-    #expect(resolved?.path == override.path)
-}
-
-@Test
-func resolveOneDriveFolderIgnoresAStoredPathThatNoLongerExists() throws {
-    let home = try makeFakeHome()
-    defer { try? FileManager.default.removeItem(at: home) }
-    let cloudStorage = home.appendingPathComponent("Library/CloudStorage", isDirectory: true)
-    try FileManager.default.createDirectory(
-        at: cloudStorage.appendingPathComponent("OneDrive-MMDGROUP", isDirectory: true),
-        withIntermediateDirectories: true
-    )
-
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-    let goneOverride = try makeTransportTemporaryDirectory(prefix: "shotdeck-onedrive-gone")
-    TransportSettings.setOneDriveFolder(goneOverride, defaults: suite.defaults)
-    try FileManager.default.removeItem(at: goneOverride)
-
-    let resolved = OneDriveLocator.resolveOneDriveFolder(
-        defaults: suite.defaults, home: home, fileManager: .default
-    )
-    let expectedRoot = try #require(OneDriveLocator.syncRoots(home: home, fileManager: .default).first)
-    let expected = expectedRoot.appendingPathComponent("Redline", isDirectory: true)
-    #expect(resolved?.path == expected.path)
-}
-
-private func makeFakeHome() throws -> URL {
-    let home = FileManager.default.temporaryDirectory
-        .appendingPathComponent("shotdeck-fake-home-\(UUID().uuidString)", isDirectory: true)
-    try FileManager.default.createDirectory(at: home, withIntermediateDirectories: true)
-    return home
-}

Tests/ShotdeckCoreTests/ReturnWatcherTests.swift

@@ -230,55 +230,3 @@ func w27_fsEventsCallbackFiresOnRealArrival() async throws {
         await watcher.stop()
     }
 }
-
-@Test("recordUncommended defaults to true: an unmarked PDF is still recorded (AirDrop behaviour unchanged)")
-func recordUncommendedDefaultTrueRecordsAnUnmarkedPDF() async throws {
-    let (paths, cleanup) = try makeCasePaths()
-    defer { try? FileManager.default.removeItem(at: cleanup) }
-
-    let ledger = try ReturnLedger(paths: paths)
-    let watcher = ReturnWatcher(paths: paths, ledger: ledger)
-    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260905-090000.pdf")
-
-    try makePDF(at: pdfURL, pageCount: 1, creator: "Redline", annotations: [])
-
-    let found = try await watcher.scanNow()
-    #expect(found.count == 1)
-    #expect(found.first?.isCommented == false)
-
-    let all = try await ledger.all()
-    #expect(all.count == 1)
-}
-
-@Test("recordUncommended=false: an unmarked PDF is not recorded or returned; marking it up in place gets it recorded")
-func recordUncommendedFalseSkipsUnmarkedThenRecordsAfterInPlaceMarkup() async throws {
-    let (paths, cleanup) = try makeCasePaths()
-    defer { try? FileManager.default.removeItem(at: cleanup) }
-
-    let ledger = try ReturnLedger(paths: paths)
-    let watcher = ReturnWatcher(paths: paths, ledger: ledger)
-    await watcher.setRecordUncommented(false)
-    let pdfURL = paths.watchFolder.appendingPathComponent("Redline-20260905-091500.pdf")
-
-    // OneDrive mode: the PDF is freshly written here (by "send"), unmarked so far.
-    try makePDF(at: pdfURL, pageCount: 1, creator: "Redline", annotations: [])
-
-    let beforeMarkup = try await watcher.scanNow()
-    #expect(beforeMarkup.isEmpty)
-    let allBefore = try await ledger.all()
-    #expect(allBefore.isEmpty)
-
-    // What the iPad does: mark it up in place, in the SAME folder, then save.
-    let document = try #require(PDFDocument(url: pdfURL))
-    let page = try #require(document.page(at: 0))
-    page.addAnnotation(makeAnnotation(.ink, bounds: CGRect(x: 100, y: 100, width: 120, height: 50)))
-    #expect(document.write(to: pdfURL))
-
-    let afterMarkup = try await watcher.scanNow()
-    #expect(afterMarkup.count == 1)
-    #expect(afterMarkup.first?.isCommented == true)
-
-    let commented = try await ledger.commented()
-    #expect(commented.count == 1)
-    #expect(commented.first?.fileURL.resolvingSymlinksInPath().path == pdfURL.resolvingSymlinksInPath().path)
-}

Tests/ShotdeckCoreTests/TransportSettingsTests.swift

@@ -1,114 +0,0 @@
-import Foundation
-import Testing
-import ShotdeckCore
-
-@Test
-func transportDefaultsToAirDropWhenUnset() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-
-    #expect(TransportSettings.transport(defaults: suite.defaults) == .airDrop)
-}
-
-@Test
-func setTransportRoundTrips() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-
-    TransportSettings.setTransport(.oneDrive, defaults: suite.defaults)
-    #expect(TransportSettings.transport(defaults: suite.defaults) == .oneDrive)
-
-    TransportSettings.setTransport(.airDrop, defaults: suite.defaults)
-    #expect(TransportSettings.transport(defaults: suite.defaults) == .airDrop)
-}
-
-@Test
-func garbageStoredTransportFallsBackToAirDrop() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-
-    suite.defaults.set("not-a-real-transport", forKey: TransportSettings.transportDefaultsKey)
-    #expect(TransportSettings.transport(defaults: suite.defaults) == .airDrop)
-}
-
-@Test
-func oneDriveFolderStoreAndReset() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-    let folder = try makeTransportTemporaryDirectory(prefix: "shotdeck-onedrive-folder")
-    defer { try? FileManager.default.removeItem(at: folder) }
-
-    #expect(TransportSettings.storedOneDriveFolderPath(defaults: suite.defaults) == nil)
-
-    TransportSettings.setOneDriveFolder(folder, defaults: suite.defaults)
-    #expect(TransportSettings.storedOneDriveFolderPath(defaults: suite.defaults) == folder.path)
-
-    TransportSettings.resetOneDriveFolder(defaults: suite.defaults)
-    #expect(TransportSettings.storedOneDriveFolderPath(defaults: suite.defaults) == nil)
-}
-
-@Test
-func effectiveFoldersForAirDropMatchesFolderSettings() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-    let outbox = try makeTransportTemporaryDirectory(prefix: "shotdeck-effective-outbox")
-    defer { try? FileManager.default.removeItem(at: outbox) }
-    FolderSettings.setOutbox(outbox, defaults: suite.defaults)
-
-    let effective = TransportSettings.effectiveFolders(defaults: suite.defaults)
-    let expected = FolderSettings.resolve(defaults: suite.defaults)
-
-    #expect(effective.transport == .airDrop)
-    #expect(effective.outbox.path == expected.outbox.path)
-    #expect(effective.watch.path == expected.watch.path)
-}
-
-@Test
-func effectiveFoldersForOneDriveWithAResolvableFolderUsesItForBoth() throws {
-    let suite = try makeTransportDefaultsSuite()
-    defer { tearDownTransportSuite(suite) }
-    let folder = try makeTransportTemporaryDirectory(prefix: "shotdeck-effective-onedrive")
-    defer { try? FileManager.default.removeItem(at: folder) }
-
-    TransportSettings.setTransport(.oneDrive, defaults: suite.defaults)
-    TransportSettings.setOneDriveFolder(folder, defaults: suite.defaults)
-
-    let effective = TransportSettings.effectiveFolders(defaults: suite.defaults)
-
-    #expect(effective.transport == .oneDrive)
-    #expect(effective.outbox.path == folder.path)
-    #expect(effective.watch.path == folder.path)
-    #expect(effective.outbox.path == effective.watch.path)
-}
-
-@Test
-func oneDriveFolderUnavailableErrorDescriptionContainsThePath() throws {
-    let path = "/Users/example/Library/CloudStorage/OneDrive-Example/Redline"
-    let error = ShotdeckError.oneDriveFolderUnavailable(path: path)
-    let description = try #require(error.errorDescription)
-    #expect(!description.isEmpty)
-    #expect(description.contains(path))
-}
-
-struct TransportDefaultsSuite {
-    let name: String
-    let defaults: UserDefaults
-}
-
-func makeTransportDefaultsSuite() throws -> TransportDefaultsSuite {
-    let name = "shotdeck-transport-test-\(UUID().uuidString)"
-    let defaults = try #require(UserDefaults(suiteName: name))
-    defaults.removePersistentDomain(forName: name)
-    return TransportDefaultsSuite(name: name, defaults: defaults)
-}
-
-func tearDownTransportSuite(_ suite: TransportDefaultsSuite) {
-    suite.defaults.removePersistentDomain(forName: suite.name)
-}
-
-func makeTransportTemporaryDirectory(prefix: String) throws -> URL {
-    let url = FileManager.default.temporaryDirectory
-        .appendingPathComponent("\(prefix)-\(UUID().uuidString)", isDirectory: true)
-    try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
-    return url
-}