desktop_e2e.rs

//! Desktop-shell acceptance: two app backends driven through exactly the
//! layer the Tauri commands wrap ([`Session`]) — pairing via the bundle
//! *hex* a user pastes or scans, honest delivery states arriving as the
//! `node-event` payloads the webview would receive, verification,
//! settings persistence, and the backup → mnemonic → restore flow.
//!
//! No webview is involved: `commands.rs` is one-line wrappers over these
//! same methods, so this pins the whole behavior a UI click reaches.

use std::path::Path;
use std::sync::{Arc, Mutex};
use std::time::{Duration, Instant};

use base64::Engine;
use komms_desktop::commands;
use komms_desktop::session::{
    hex_decode, NetworkSettings, Session, UiCustomIconCrop, UiCustomIconTarget,
    UiDeviceLinkSelection, UiEvent, UiFolderSelection, UiFolderTarget, UiHint, UiImageCrop,
    UiImageEditRecipe, UiImageRegion, UiLabelTarget, UiMentionSpan, UiPinTarget,
    UiTextFormatHighlight, UiThemePreference,
};
use kult_ffi::{
    edit_image, ImageCrop, ImageEditRecipe, ImageEditRegion, ImageEditRegionKind, KdfChoice,
};

fn image_recipe() -> (UiImageEditRecipe, ImageEditRecipe) {
    (
        UiImageEditRecipe {
            crop: Some(UiImageCrop {
                x: 1,
                y: 0,
                width: 23,
                height: 16,
            }),
            rotation_quarter_turns: 1,
            regions: vec![
                UiImageRegion {
                    kind: "pixelate".to_owned(),
                    x: 0,
                    y: 0,
                    width: 8,
                    height: 8,
                    strength: 4,
                },
                UiImageRegion {
                    kind: "blur".to_owned(),
                    x: 8,
                    y: 0,
                    width: 8,
                    height: 12,
                    strength: 2,
                },
            ],
        },
        ImageEditRecipe {
            crop: Some(ImageCrop {
                x: 1,
                y: 0,
                width: 23,
                height: 16,
            }),
            rotation_quarter_turns: 1,
            regions: vec![
                ImageEditRegion {
                    kind: ImageEditRegionKind::Pixelate,
                    x: 0,
                    y: 0,
                    width: 8,
                    height: 8,
                    strength: 4,
                },
                ImageEditRegion {
                    kind: ImageEditRegionKind::Blur,
                    x: 8,
                    y: 0,
                    width: 8,
                    height: 12,
                    strength: 2,
                },
            ],
        },
    )
}

fn canonical_audio(samples: usize) -> Vec<u8> {
    let data_len = (samples * 2) as u32;
    let mut bytes = Vec::with_capacity(44 + data_len as usize);
    bytes.extend_from_slice(b"RIFF");
    bytes.extend_from_slice(&(36 + data_len).to_le_bytes());
    bytes.extend_from_slice(b"WAVEfmt ");
    bytes.extend_from_slice(&16u32.to_le_bytes());
    bytes.extend_from_slice(&1u16.to_le_bytes());
    bytes.extend_from_slice(&1u16.to_le_bytes());
    bytes.extend_from_slice(&16_000u32.to_le_bytes());
    bytes.extend_from_slice(&32_000u32.to_le_bytes());
    bytes.extend_from_slice(&2u16.to_le_bytes());
    bytes.extend_from_slice(&16u16.to_le_bytes());
    bytes.extend_from_slice(b"data");
    bytes.extend_from_slice(&data_len.to_le_bytes());
    for index in 0..samples {
        bytes.extend_from_slice(&((index as i16 % 2_000) - 1_000).to_le_bytes());
    }
    bytes
}

fn native_audio_with_metadata(canonical: &[u8]) -> Vec<u8> {
    let mut bytes = Vec::with_capacity(canonical.len() + 12);
    bytes.extend_from_slice(b"RIFF");
    bytes.extend_from_slice(&((canonical.len() + 4) as u32).to_le_bytes());
    bytes.extend_from_slice(&canonical[8..36]);
    bytes.extend_from_slice(b"LIST\x04\0\0\0leak");
    bytes.extend_from_slice(&canonical[36..]);
    bytes
}

/// Collects `node-event` payloads exactly as the webview would.
#[derive(Clone, Default)]
struct Events(Arc<Mutex<Vec<UiEvent>>>);

impl Events {
    fn sink(&self) -> komms_desktop::session::EventSink {
        let events = self.0.clone();
        Box::new(move |event| events.lock().unwrap().push(event))
    }

    fn wait(&self, what: &str, pred: impl Fn(&UiEvent) -> bool) -> UiEvent {
        let deadline = Instant::now() + Duration::from_secs(30);
        loop {
            if let Some(hit) = self.0.lock().unwrap().iter().find(|e| pred(e)) {
                return hit.clone();
            }
            assert!(Instant::now() < deadline, "timed out waiting for {what}");
            std::thread::sleep(Duration::from_millis(50));
        }
    }

    fn count(&self, pred: impl Fn(&UiEvent) -> bool) -> usize {
        self.0
            .lock()
            .unwrap()
            .iter()
            .filter(|event| pred(event))
            .count()
    }
}

/// Hermetic settings: loopback QUIC only, no mDNS — hints are explicit.
fn test_settings() -> NetworkSettings {
    NetworkSettings {
        listen: vec!["/ip4/127.0.0.1/udp/0/quic-v1".to_owned()],
        mdns: false,
        ..NetworkSettings::default()
    }
}

fn open(dir: &Path, name: &str, events: &Events) -> Session {
    // Mirror the unlock command: persist settings, then boot.
    let data_dir = dir.join(name);
    let settings = test_settings();
    settings.save(&data_dir).expect("settings save");
    Session::open(
        &data_dir,
        "test-passphrase".to_owned(),
        &settings,
        KdfChoice::Mobile,
        events.sink(),
    )
    .expect("session opens")
}

fn complete_group_security(session: &Session, group: &str) {
    let deadline = Instant::now() + Duration::from_secs(30);
    let mut upgrade_requested = false;
    loop {
        let security = session.group_security(group.to_owned()).unwrap();
        match security.level {
            "recipient_authenticated" => {
                assert!(security.pending_devices.is_empty());
                return;
            }
            "upgrade_required" if !upgrade_requested => {
                session.upgrade_group_security(group.to_owned()).unwrap();
                upgrade_requested = true;
            }
            "upgrade_required" | "upgrading" => {}
            level => panic!("unexpected group security level: {level}"),
        }
        assert!(
            Instant::now() < deadline,
            "group origin exchange did not complete: {security:?}"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
}

fn accept_group_invitation(session: &Session, events: &Events, group: &str, what: &str) {
    events.wait(
        what,
        |event| matches!(event, UiEvent::GroupInvitationReceived { group: id, .. } if id == group),
    );
    let invitation = session
        .group_invitations()
        .unwrap()
        .into_iter()
        .find(|invitation| invitation.group == group)
        .expect("group invitation is listed");
    assert_eq!(
        session.accept_group_invitation(invitation.id).unwrap(),
        group
    );
    events.wait(
        "group invitation acceptance",
        |event| matches!(event, UiEvent::GroupInvitationAccepted { group: id, .. } if id == group),
    );
}

#[test]
fn desktop_message_request_inbox_keeps_unknown_senders_separate() {
    let directory = tempfile::tempdir().unwrap();
    let bob_events = Events::default();
    let bob = open(directory.path(), "request-bob", &bob_events);
    let accept = open(directory.path(), "request-accept", &Events::default());
    let delete = open(directory.path(), "request-delete", &Events::default());
    let block = open(directory.path(), "request-block", &Events::default());
    let bob_addr = listen_addr(&bob);
    for (sender, preview) in [
        (&accept, "please accept"),
        (&delete, "please delete"),
        (&block, "please block"),
    ] {
        let _ = listen_addr(sender);
        let _ = sender.my_bundle().unwrap();
        let bundle = bob.my_bundle().unwrap();
        let peer = sender
            .add_contact(
                "Bob".to_owned(),
                &bundle.hex,
                &multiaddr_hint(bob_addr.clone()),
            )
            .unwrap();
        sender.send(peer, preview.to_owned()).unwrap();
    }
    bob_events.wait("message request", |event| {
        matches!(event, UiEvent::MessageRequestReceived { .. })
    });
    let deadline = Instant::now() + Duration::from_secs(30);
    let requests = loop {
        let requests = bob.message_requests().unwrap();
        if requests.len() == 3 {
            break requests;
        }
        assert!(Instant::now() < deadline, "three requests were not listed");
        std::thread::sleep(Duration::from_millis(50));
    };
    assert!(bob.contacts().unwrap().is_empty());
    let request_id = |preview: &str| {
        requests
            .iter()
            .find(|request| request.preview == preview)
            .unwrap()
            .id
            .clone()
    };
    let peer = bob
        .accept_message_request(request_id("please accept"), "Accepted sender".to_owned())
        .unwrap();
    bob.delete_message_request(request_id("please delete"))
        .unwrap();
    bob.block_message_request(request_id("please block"))
        .unwrap();
    assert!(bob.message_requests().unwrap().is_empty());
    assert_eq!(bob.contacts().unwrap()[0].name, "Accepted sender");
    assert_eq!(bob.messages(peer).unwrap()[0].body, "please accept");
    bob_events.wait("request accepted", |event| {
        matches!(event, UiEvent::MessageRequestAccepted { .. })
    });
    bob_events.wait("request deleted", |event| {
        matches!(event, UiEvent::MessageRequestDeleted { .. })
    });
    bob_events.wait("request blocked", |event| {
        matches!(event, UiEvent::MessageRequestBlocked { .. })
    });

    accept.stop();
    delete.stop();
    block.stop();
    bob.stop();
}

#[test]
fn desktop_linked_device_ceremony_and_sync_use_only_session_surface() {
    let directory = tempfile::tempdir().unwrap();
    let source_events = Events::default();
    let target_events = Events::default();
    let source = open(directory.path(), "device-source", &source_events);
    let target = open(directory.path(), "device-target", &target_events);
    source
        .send_note_to_self("source-only history".to_owned())
        .unwrap();

    let source_device = source.device_id().unwrap();
    let target_device = target.device_id().unwrap();
    let offer = source.begin_device_link().unwrap();
    assert!(offer.qr_svg.contains("<svg"));
    let accepted = target
        .accept_device_link(offer.hex, "Laptop".to_owned())
        .unwrap();
    assert_eq!(accepted.confirmation_code.len(), 6);
    assert_eq!(
        source
            .device_link_confirmation_code(accepted.response_hex.clone())
            .unwrap(),
        accepted.confirmation_code
    );
    let package = source
        .approve_device_link(
            accepted.response_hex,
            UiDeviceLinkSelection {
                contacts: false,
                organization: false,
                history: false,
            },
            true,
        )
        .unwrap();
    target.complete_device_link(package, true).unwrap();
    assert_eq!(source.status().unwrap().peer, target.status().unwrap().peer);
    assert_ne!(source_device, target_device);
    assert!(target.note_to_self_messages().unwrap().is_empty());
    assert_eq!(source.linked_devices().unwrap().len(), 2);
    target_events.wait("device link completion", |event| {
        matches!(event, UiEvent::DeviceLinkCompleted { device, .. } if device == &target_device)
    });

    let tablet = open(directory.path(), "device-tablet", &Events::default());
    let offer = source.begin_device_link().unwrap();
    let accepted = tablet
        .accept_device_link(offer.hex, "Tablet".to_owned())
        .unwrap();
    let quorum = source
        .approve_device_link(
            accepted.response_hex,
            UiDeviceLinkSelection {
                contacts: false,
                organization: false,
                history: false,
            },
            true,
        )
        .unwrap_err();
    assert!(quorum.contains("additional active-device approval"));
    let request = source.device_link_approval_request().unwrap();
    let approval = target.approve_device_link_request(request).unwrap();
    let package = source
        .accept_device_link_approval(approval)
        .unwrap()
        .expect("quorum finalizes link");
    tablet.complete_device_link(package, true).unwrap();
    let authority_sync = source.export_device_sync(target_device.clone()).unwrap();
    target.import_device_sync(authority_sync).unwrap();

    let quorum = source
        .rename_linked_device(target_device.clone(), "Travel laptop".to_owned())
        .unwrap_err();
    assert!(quorum.contains("additional active-device approval"));
    let request = source.device_authority_approval_request().unwrap();
    let approval = target.approve_device_authority_request(request).unwrap();
    assert!(source.accept_device_authority_approval(approval).unwrap());
    let sync = source.export_device_sync(target_device.clone()).unwrap();
    target.import_device_sync(sync).unwrap();
    assert!(target
        .linked_devices()
        .unwrap()
        .iter()
        .any(|device| device.id == target_device && device.name == "Travel laptop"));
    assert!(source.device_authority_conflicts().unwrap().is_empty());
    assert!(source.contact_authority_conflicts().unwrap().is_empty());

    source.stop();
    target.stop();
    tablet.stop();
}

fn wait_authority_generation(
    session: &Session,
    group: &str,
    generation: u64,
) -> komms_desktop::session::UiGroupAuthority {
    let deadline = Instant::now() + Duration::from_secs(30);
    loop {
        let authority = session.group_authority(group.to_owned()).unwrap();
        if authority.signed && authority.generation >= generation {
            return authority;
        }
        assert!(
            Instant::now() < deadline,
            "desktop authority generation did not converge"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
}

fn wait_closed_poll(
    session: &Session,
    group: &str,
    poll_id: &str,
) -> komms_desktop::session::UiGroupPoll {
    let deadline = Instant::now() + Duration::from_secs(30);
    loop {
        if let Some(poll) = session
            .group_polls(group.to_owned())
            .unwrap()
            .into_iter()
            .find(|poll| poll.id == poll_id && poll.closed)
        {
            return poll;
        }
        assert!(
            Instant::now() < deadline,
            "desktop poll closure did not converge"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
}

#[test]
fn desktop_ephemeral_controls_match_shared_honesty_and_block_render_bypasses() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/c4-ephemeral-parity.json"
    ))
    .unwrap();
    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    for lifetime in fixture["text_lifetimes"].as_array().unwrap() {
        assert!(html.contains(&format!("value=\"{}\"", lifetime.as_u64().unwrap())));
    }
    assert!(html.contains("recipients and other devices may retain copies"));
    assert!(frontend.contains("send_disappearing"));
    assert!(frontend.contains("send_group_disappearing"));
    assert!(frontend.contains("consume_view_once_attachment"));
    assert!(frontend.contains("if (!attachment.view_once) actions.append"));
    assert!(frontend.contains("preview && !attachment.view_once"));
    assert!(frontend.contains("!attachment.view_once && isAudio"));
}

#[test]
fn desktop_first_run_authority_uses_native_save_and_retryable_errors() {
    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    let authority_template = html
        .split("<template id=\"tpl-recovery-authority\">")
        .nth(1)
        .unwrap()
        .split("</template>")
        .next()
        .unwrap();

    assert!(!authority_template.contains("data-f=\"path\""));
    assert!(authority_template.contains("Save offline authority…"));
    assert!(authority_template.contains("data-l10n=\"recovery_authority_save\""));
    assert!(authority_template.contains("data-l10n=\"recovery_authority_required_body\""));
    assert!(frontend.contains("const path = await savePath({"));
    assert!(frontend.contains("defaultPath: l10n(\"recovery_authority_filename\")"));
    assert!(frontend.contains("recovery_authority_destination_exists"));
    assert!(frontend.contains("recovery_authority_export_failed"));
}

#[test]
fn startup_wait_is_explained_and_kept_modal_across_apps() {
    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    assert!(html.contains("id=\"startup-dialog\""));
    assert!(html.contains("starting the node can take up to 30 seconds"));
    assert!(html.contains("<progress aria-label=\"Decrypting the store and starting the node\""));
    assert!(frontend.contains("startupDialog.showModal()"));
    assert!(frontend.contains("event.preventDefault()"));
    assert!(frontend.contains("startupDialog.close()"));

    let android =
        include_str!("../../../android/app/src/main/kotlin/komms/android/GateActivity.kt");
    let android_strings = include_str!("../../../android/app/src/main/res/values/strings.xml");
    assert!(android.contains(".setCancelable(false)"));
    assert!(android.contains("showStartupDialog()"));
    assert!(android_strings.contains("starting the node can take up to 30 seconds"));

    let ios = include_str!("../../../ios/KommsApp/Sources/GateView.swift");
    assert!(ios.contains("if working"));
    assert!(ios.contains("Starting Komms"));
    assert!(ios.contains("starting the node can take up to 30 seconds"));
}

#[test]
fn desktop_macos_bundle_declares_libp2p_local_network_access() {
    let plist = include_str!("../Info.plist");
    assert!(plist.contains("<key>NSLocalNetworkUsageDescription</key>"));
    assert!(plist.contains("<key>NSBonjourServices</key>"));
    assert!(plist.contains("<string>_p2p._udp</string>"));
}

#[test]
fn desktop_status_poll_is_bounded_and_never_leaves_loading_placeholders() {
    let ffi = include_str!("../../../../crates/kult-ffi/src/lib.rs");
    let frontend = include_str!("../../ui/main.js");
    assert!(ffi.contains("rt.block_on(async {"));
    assert!(ffi.contains("tokio::time::timeout(Duration::from_secs(1), rt.net.nat_status()).await"));
    assert!(frontend.contains("l10n(\"status_discovery_unavailable\")"));
    assert!(frontend.contains("l10n(\"status_nat_unavailable\")"));
    assert!(frontend.contains("l10n(\"status_unavailable\")"));
}

#[test]
fn operating_mode_contract_and_familiar_status_are_present_in_every_shell() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/operating-mode-settings-v1.json"
    ))
    .unwrap();
    assert_eq!(fixture["mode"], "private");
    assert_eq!(fixture["rendezvous"][0]["private_via_tor"], true);
    assert_eq!(fixture["wake"][0]["private_via_tor"], true);

    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    for value in ["standard", "private", "sovereign"] {
        assert!(html.contains(&format!("name=\"set-mode\" value=\"{value}\"")));
    }
    for field in [
        "set-provider-directory",
        "set-provider-roots",
        "set-rendezvous",
        "set-wake",
        "set-tor-proxy",
        "set-standard-disclosure",
        "set-sovereign-direct",
    ] {
        assert!(html.contains(&format!("id=\"{field}\"")));
    }
    for status in [
        "connection_connected",
        "connection_fallback_ready",
        "connection_waiting",
    ] {
        assert!(frontend.contains(status));
    }
    assert!(frontend.contains("set_mode_private_disclosure"));
    assert!(frontend.contains("sovereign-direct-row"));

    let android_layout =
        include_str!("../../../android/app/src/main/res/layout/activity_settings.xml");
    let android_strings = include_str!("../../../android/app/src/main/res/values/strings.xml");
    for field in [
        "set_mode_standard",
        "set_mode_private",
        "set_mode_sovereign",
        "set_provider_directory",
        "set_provider_roots",
        "set_rendezvous",
        "set_tor_proxy",
    ] {
        assert!(android_layout.contains(&format!("@+id/{field}")));
    }
    for status in ["Connected", "Fallback ready", "Waiting for a route"] {
        assert!(android_strings.contains(status));
    }
    assert!(android_strings.contains("does not claim non-collusion"));

    let ios_settings = include_str!("../../../ios/KommsApp/Sources/SettingsView.swift");
    let ios_status = include_str!("../../../ios/KommsApp/Sources/MainView.swift");
    for mode in ["mode_standard", "mode_private", "mode_sovereign"] {
        assert!(ios_settings.contains(mode));
    }
    for status in [
        "connection_connected",
        "connection_fallback_ready",
        "connection_waiting",
    ] {
        assert!(ios_status.contains(status));
    }
    assert!(ios_settings.contains("set_mode_private_disclosure"));
}

#[test]
fn desktop_share_dialog_surfaces_generation_errors_and_scopes_its_listener() {
    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    assert!(html.contains("data-f=\"share-status\" role=\"status\""));
    assert!(frontend.contains("l10n(\"share_unavailable\")"));
    assert!(frontend.contains("[bundle, addrSvg, nodeStatus] = await Promise.all(["));
    assert!(frontend.contains("invoke(\"my_bundle\")"));
    assert!(frontend.contains("invoke(\"address_qr\")"));
    assert!(frontend.contains("invoke(\"status\")"));
    assert!(frontend.contains("nodeStatus.connect_code"));
    assert!(frontend.contains("nodeStatus.address"));
    assert!(frontend.contains("view.addEventListener(\"click\""));
}

#[test]
fn android_shell_uses_the_shared_light_and_dark_brand_tokens() {
    let light = include_str!("../../../android/app/src/main/res/values/colors.xml");
    let dark = include_str!("../../../android/app/src/main/res/values-night/colors.xml");
    for token in [
        "<color name=\"background\">#FAFAFA</color>",
        "<color name=\"surface\">#FFFFFF</color>",
        "<color name=\"surface_raised\">#FFF8DC</color>",
        "<color name=\"accent\">#B83431</color>",
    ] {
        assert!(light.contains(token), "missing light brand token: {token}");
    }
    for token in [
        "<color name=\"background\">#0F2633</color>",
        "<color name=\"surface\">#153746</color>",
        "<color name=\"surface_raised\">#193F4F</color>",
        "<color name=\"accent\">#F2B705</color>",
    ] {
        assert!(dark.contains(token), "missing dark brand token: {token}");
    }

    let main = include_str!("../../../android/app/src/main/res/layout/activity_main.xml");
    let chat = include_str!("../../../android/app/src/main/res/layout/activity_chat.xml");
    assert!(main.contains("@color/toolbar_background"));
    assert!(main.contains("@drawable/bg_brand_panel"));
    assert!(chat.contains("@drawable/bg_compose_input"));
    assert!(chat.contains("@style/ThemeOverlay.Komms.Toolbar"));
}

#[test]
fn desktop_poll_ui_keeps_visibility_policy_and_uses_inert_exact_text() {
    let html = include_str!("../../ui/index.html");
    let frontend = include_str!("../../ui/main.js");
    assert!(html.contains("Votes are visible to every member. This is not anonymous."));
    assert!(html.contains("The poll creator can close it"));
    assert!(html.contains("a group owner can also commit a signed moderation snapshot"));
    assert!(frontend.contains("create_group_poll"));
    assert!(frontend.contains("vote_group_poll"));
    assert!(frontend.contains("close_group_poll"));
    assert!(frontend.contains("moderate_group_poll_close"));
    assert!(frontend.contains("new TextEncoder().encode(value).length"));
    let renderer = frontend
        .split("function renderPolls")
        .nth(1)
        .unwrap()
        .split("async function renderMessages")
        .next()
        .unwrap();
    assert!(renderer.contains("textContent = poll.question"));
    assert!(renderer.contains("textContent = option.text"));
    assert!(!renderer.contains("innerHTML"));

    let android =
        include_str!("../../../android/app/src/main/kotlin/komms/android/GroupChatActivity.kt");
    let android_strings = include_str!("../../../android/app/src/main/res/values/strings.xml");
    assert!(android.contains("is Event.PollUpdated -> event.group == groupId"));
    assert!(android.contains("session.createGroupPoll(groupId, exactQuestion, exactChoices)"));
    assert!(android.contains("session.voteGroupPoll(groupId, poll.author, poll.id, option.id)"));
    assert!(android_strings.contains("This is not anonymous"));

    let ios = include_str!("../../../ios/KommsApp/Sources/GroupChatView.swift");
    let ios_model = include_str!("../../../ios/KommsApp/Sources/AppModel.swift");
    assert!(ios.contains("private struct GroupPollCard"));
    assert!(ios.contains("Create visible-vote poll"));
    assert!(ios.contains("This is not anonymous"));
    assert!(ios_model.contains(".pollUpdated"));
    assert!(ios_model.contains("try session.createGroupPoll"));
}

#[test]
fn desktop_text_formatting_matches_shared_corpus_and_uses_inert_dom_only() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/b9-text-formatting-parity.json"
    ))
    .unwrap();
    let directory = tempfile::tempdir().unwrap();
    let session = open(directory.path(), "text-formatting", &Events::default());
    for case in fixture["cases"].as_array().unwrap() {
        let highlights = case["highlights"]
            .as_array()
            .unwrap()
            .iter()
            .map(|highlight| UiTextFormatHighlight {
                start: highlight["start"].as_u64().unwrap() as u32,
                end: highlight["end"].as_u64().unwrap() as u32,
            })
            .collect();
        let formatted = session
            .format_text(case["source"].as_str().unwrap().to_owned(), highlights)
            .unwrap();
        assert_eq!(formatted.source, case["source"].as_str().unwrap());
        assert_eq!(formatted.plain_text, case["plain_text"].as_str().unwrap());
        assert_eq!(
            formatted.used_fallback,
            case["used_fallback"].as_bool().unwrap()
        );
        assert_eq!(
            formatted
                .blocks
                .iter()
                .map(|block| block.kind.as_str())
                .collect::<Vec<_>>(),
            case["block_kinds"]
                .as_array()
                .unwrap()
                .iter()
                .map(|kind| kind.as_str().unwrap())
                .collect::<Vec<_>>()
        );
    }
    let frontend = include_str!("../../ui/main.js");
    assert!(frontend.contains("appendFormattedBody"));
    assert!(frontend.contains("document.createTextNode(run.text)"));
    assert!(frontend.contains("formatted.plain_text"));
    let formatter = frontend
        .split("function styledRun")
        .nth(1)
        .unwrap()
        .split("async function refreshGroups")
        .next()
        .unwrap();
    assert!(!formatter.contains("innerHTML"));
    assert!(!formatter.contains(".src ="));
    assert!(!formatter.contains(".href ="));

    let android =
        include_str!("../../../android/app/src/main/kotlin/komms/android/TextFormatting.kt");
    assert!(android.contains("output.toString() == formatted.plainText"));
    assert!(!android.contains("URLSpan"));
    for source in [
        include_str!("../../../android/app/src/main/kotlin/komms/android/ChatActivity.kt"),
        include_str!("../../../android/app/src/main/kotlin/komms/android/GroupChatActivity.kt"),
        include_str!("../../../android/app/src/main/kotlin/komms/android/NoteToSelfActivity.kt"),
        include_str!("../../../android/app/src/main/kotlin/komms/android/ScheduledMessageUi.kt"),
    ] {
        assert!(source.contains("showFormattedText"));
    }
    let swift_renderer = include_str!("../../../ios/KommsApp/Sources/FormattedTextView.swift");
    assert!(swift_renderer.contains("formatted.plainText"));
    assert!(!swift_renderer.contains("NSDataDetector"));
    for source in [
        include_str!("../../../ios/KommsApp/Sources/ChatView.swift"),
        include_str!("../../../ios/KommsApp/Sources/GroupChatView.swift"),
        include_str!("../../../ios/KommsApp/Sources/NoteToSelfView.swift"),
        include_str!("../../../ios/KommsApp/Sources/ScheduledMessageView.swift"),
    ] {
        assert!(source.contains("FormattedTextView"));
    }
    session.stop();
}

#[test]
fn desktop_private_contact_rename_is_normalized_warned_duplicate_capable_and_durable() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/b5-contact-rename-parity.json"
    ))
    .unwrap();
    let directory = tempfile::tempdir().unwrap();
    let events = Events::default();
    let mut alice = open(directory.path(), "contact-rename-alice", &events);
    let bob = open(directory.path(), "contact-rename-bob", &Events::default());
    alice
        .add_contact(
            fixture["duplicate_name"].as_str().unwrap().to_owned(),
            &alice.my_bundle().unwrap().hex,
            &[],
        )
        .unwrap();
    let bob_peer = alice
        .add_contact("Bob".to_owned(), &bob.my_bundle().unwrap().hex, &[])
        .unwrap();
    let queued_before = alice.status().unwrap().queued;

    let normalized = alice
        .rename_contact(
            bob_peer.clone(),
            fixture["decomposed_name"].as_str().unwrap().to_owned(),
            false,
        )
        .unwrap();
    assert_eq!(
        normalized.normalized_name,
        fixture["normalized_name"].as_str().unwrap()
    );
    assert!(normalized.changed_by_normalization);
    let duplicate = alice
        .assess_contact_name(
            bob_peer.clone(),
            fixture["duplicate_name"].as_str().unwrap().to_owned(),
        )
        .unwrap();
    assert_eq!(duplicate.duplicate_count, 1);
    assert_eq!(duplicate.warnings, ["duplicate_name"]);
    assert!(alice
        .rename_contact(
            bob_peer.clone(),
            fixture["duplicate_name"].as_str().unwrap().to_owned(),
            false,
        )
        .is_err());
    alice
        .rename_contact(
            bob_peer.clone(),
            fixture["duplicate_name"].as_str().unwrap().to_owned(),
            true,
        )
        .unwrap();
    assert_eq!(
        alice
            .contacts()
            .unwrap()
            .into_iter()
            .filter(|contact| contact.name == fixture["duplicate_name"].as_str().unwrap())
            .count(),
        2
    );
    events.wait("contact renamed", |event| {
        matches!(event, UiEvent::ContactRenamed { peer, name }
            if peer == &bob_peer && name == fixture["duplicate_name"].as_str().unwrap())
    });
    assert_eq!(alice.status().unwrap().queued, queued_before);
    alice.stop();

    alice = open(directory.path(), "contact-rename-alice", &Events::default());
    assert_eq!(
        alice
            .contacts()
            .unwrap()
            .into_iter()
            .find(|contact| contact.peer == bob_peer)
            .unwrap()
            .name,
        fixture["duplicate_name"].as_str().unwrap()
    );
    alice.stop();
    bob.stop();
}

#[test]
fn desktop_screen_security_is_always_on_best_effort_with_rapid_lock() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/b14-screen-security-parity.json"
    ))
    .unwrap();
    let policy = commands::screen_security_policy();
    assert!(policy.always_on);
    assert_eq!(
        policy.capture_prevention,
        fixture["platforms"]["desktop"]["capture_prevention"]
    );
    assert_eq!(
        policy.background_obscuring,
        fixture["platforms"]["desktop"]["background_obscuring"]
    );
    assert_eq!(policy.rapid_lock, "platform_enforced");
    assert!(!policy.limitations.is_empty());

    let config = include_str!("../tauri.conf.json");
    let frontend = include_str!("../../ui/main.js");
    assert!(config.contains(r#""contentProtected": true"#));
    assert!(frontend.contains("event.ctrlKey || event.metaKey"));
    assert!(frontend.contains("event.shiftKey"));
    assert!(frontend.contains("rapidLock()"));
    assert_eq!(fixture["desktop_shortcut"], "Ctrl/Cmd+Shift+L");
}

#[test]
fn desktop_incognito_keyboard_covers_every_editable_text_field_before_unlock() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/b15-incognito-keyboard-parity.json"
    ))
    .unwrap();
    let policy = commands::incognito_keyboard_policy();
    assert!(policy.always_on);
    assert!(policy.applies_before_unlock);
    assert_eq!(
        policy.personalized_learning,
        fixture["platforms"]["desktop"]["personalized_learning"]
    );
    assert_eq!(
        policy.protected_fields,
        fixture["protected_fields"]
            .as_array()
            .unwrap()
            .iter()
            .map(|value| value.as_str().unwrap().to_owned())
            .collect::<Vec<_>>()
    );
    assert!(policy
        .limitations
        .iter()
        .any(|text| text.contains("webview")));

    let html = include_str!("../../ui/index.html");
    let javascript = include_str!("../../ui/main.js");
    let editable_text_fields = html.matches("type=\"text\"").count()
        + html.matches("type=\"password\"").count()
        + html.matches("<textarea").count()
        - html.matches("type=\"text\" readonly").count()
        - html
            .matches("<textarea class=\"share-hex\" rows=\"4\" readonly")
            .count();
    assert_eq!(50, editable_text_fields);
    assert_eq!(
        editable_text_fields,
        html.matches("data-incognito-input=").count()
    );
    assert!(html.contains("type=\"password\" id=\"gate-mnemonic\""));
    assert!(html
        .contains("type=\"text\" id=\"gate-recovery-package\" data-incognito-input=\"technical\""));
    assert!(html.contains(
        "type=\"password\" id=\"gate-recovery-mnemonic\" data-incognito-input=\"mnemonic\""
    ));
    for attribute in [
        "autocomplete",
        "autocorrect",
        "autocapitalize",
        "spellcheck",
    ] {
        assert!(
            javascript.contains(&format!("setAttribute(\"{attribute}\", \"off\")"))
                || javascript.contains(&format!("setAttribute(\"{attribute}\", \"false\")"))
        );
    }
    assert!(javascript.contains("applyIncognitoInputPrivacy(body)"));
}

#[test]
fn private_theme_defaults_persists_restarts_and_emits_one_local_event() {
    let fixture: serde_json::Value =
        serde_json::from_str(include_str!("../../../../fixtures/b12-theme-parity.json")).unwrap();
    assert_eq!(
        fixture["preferences"],
        serde_json::json!(["system", "light", "dark"])
    );
    let directory = tempfile::tempdir().unwrap();
    let events = Events::default();
    let session = open(directory.path(), "theme", &events);
    let queued = session.status().unwrap().queued;
    assert_eq!(
        session.theme().unwrap().preference,
        UiThemePreference::System
    );
    assert!(!session.theme().unwrap().persisted);
    assert!(session.set_theme(UiThemePreference::Dark).unwrap());
    assert!(!session.set_theme(UiThemePreference::Dark).unwrap());
    events.wait("theme changed", |event| {
        matches!(event, UiEvent::ThemeChanged)
    });
    assert_eq!(session.status().unwrap().queued, queued);
    session.stop();

    let reopened = open(directory.path(), "theme", &Events::default());
    assert_eq!(
        reopened.theme().unwrap().preference,
        UiThemePreference::Dark
    );
    assert!(reopened.theme().unwrap().persisted);
    reopened.stop();
}

#[test]
fn desktop_custom_icons_render_from_local_data_urls_and_survive_restart() {
    let fixture: serde_json::Value = serde_json::from_str(include_str!(
        "../../../../fixtures/b13-custom-icon-parity.json"
    ))
    .unwrap();
    let directory = tempfile::tempdir().unwrap();
    let events = Events::default();
    let session = open(directory.path(), "icons", &events);
    let queued = session.status().unwrap().queued;
    let note = UiCustomIconTarget {
        kind: "note_to_self".to_owned(),
        id: None,
    };
    assert!(session.custom_icon(note.clone()).unwrap().is_none());
    let note_icon = session
        .set_bundled_custom_icon(note.clone(), "compass".to_owned())
        .unwrap();
    assert_eq!(note_icon.media_type, "image/png");
    assert_eq!((note_icon.width, note_icon.height), (256, 256));
    assert!(note_icon.data_url.starts_with("data:image/png;base64,"));
    events.wait("custom icons changed", |event| {
        matches!(event, UiEvent::CustomIconsChanged)
    });

    let folder = session.create_folder("Icon target".to_owned()).unwrap();
    let folder_target = UiCustomIconTarget {
        kind: "folder".to_owned(),
        id: Some(folder.id),
    };
    let source = directory.path().join("desktop-icon.png");
    let pixels = image::ImageBuffer::from_fn(8, 6, |x, y| {
        image::Rgba([(x * 23) as u8, (y * 37) as u8, 120, 255])
    });
    image::DynamicImage::ImageRgba8(pixels)
        .save(&source)
        .unwrap();
    let folder_icon = session
        .set_custom_icon_from_path(
            folder_target.clone(),
            source.display().to_string(),
            Some(UiCustomIconCrop {
                x: 1,
                y: 0,
                width: 6,
                height: 6,
            }),
        )
        .unwrap();
    assert_ne!(folder_icon.data_url, note_icon.data_url);
    let usage = session.custom_icon_usage().unwrap();
    assert_eq!(usage.records, 2);
    assert_eq!(
        usage.bytes,
        note_icon.encoded_bytes + folder_icon.encoded_bytes
    );
    assert_eq!(session.status().unwrap().queued, queued);
    assert_eq!(
        fixture["network_behavior"]["transport_work"],
        serde_json::json!(0)
    );
    assert!(session.clear_custom_icon(folder_target.clone()).unwrap());
    assert!(!session.clear_custom_icon(folder_target.clone()).unwrap());
    assert!(session.custom_icon(folder_target).unwrap().is_none());
    session.stop();

    let reopened = open(directory.path(), "icons", &Events::default());
    assert_eq!(
        reopened.custom_icon(note).unwrap().unwrap().data_url,
        note_icon.data_url
    );
    reopened.stop();
}

/// Poll status until a listen address is bound.
fn listen_addr(session: &Session) -> String {
    let deadline = Instant::now() + Duration::from_secs(5);
    loop {
        let status = session.status().expect("status");
        if let Some(addr) = status.listen.into_iter().next() {
            return addr;
        }
        assert!(Instant::now() < deadline, "no listen address within 5s");
        std::thread::sleep(Duration::from_millis(50));
    }
}

fn multiaddr_hint(addr: String) -> Vec<UiHint> {
    vec![UiHint {
        kind: "multiaddr".to_owned(),
        value: addr,
    }]
}

#[test]
fn two_desktops_pair_by_bundle_hex_and_message() {
    let dir = tempfile::tempdir().unwrap();
    let a_ev = Events::default();
    let b_ev = Events::default();
    let alice = open(dir.path(), "alice", &a_ev);
    let bob = open(dir.path(), "bob", &b_ev);

    // The status bar's first snapshot is honest: nothing queued, nothing
    // bridged, no contacts, and a kult address to show.
    let status = alice.status().unwrap();
    assert!(status.address.starts_with("kk1"));
    assert_eq!((status.queued, status.transit, status.contacts), (0, 0, 0));
    assert_eq!(status.nat, "unknown");

    // Pairing exactly as the UI does it: compact QR input is accepted while
    // pasteable and legacy hex remains interoperable.
    let a_bundle = alice.my_bundle().unwrap();
    let b_bundle = bob.my_bundle().unwrap();
    assert!(a_bundle.qr_svg.contains("<svg"));
    assert!(hex_decode(&a_bundle.hex).is_some());
    let scanned = komms_desktop::qr::bundle_text(&hex_decode(&b_bundle.hex).unwrap());

    let a_addr = listen_addr(&alice);
    let b_addr = listen_addr(&bob);
    let bob_peer = alice
        .add_contact("bob".to_owned(), &scanned, &multiaddr_hint(b_addr))
        .unwrap();
    let alice_peer = bob
        .add_contact("alice".to_owned(), &a_bundle.hex, &multiaddr_hint(a_addr))
        .unwrap();

    // The desktop command/session surface exposes the distinct scheduled
    // state and edit/cancel lifecycle without entering the delivery queue.
    let future = std::time::SystemTime::now()
        .duration_since(std::time::SystemTime::UNIX_EPOCH)
        .unwrap()
        .as_secs()
        + 3_600;
    let scheduled_id = alice
        .schedule(bob_peer.clone(), "first draft".to_owned(), future)
        .unwrap();
    a_ev.wait(
        "scheduled update",
        |event| matches!(event, UiEvent::ScheduledMessageUpdated { id } if *id == scheduled_id),
    );
    assert_eq!(alice.status().unwrap().scheduled, 1);
    assert_eq!(alice.status().unwrap().queued, 0);
    let scheduled = alice.scheduled_messages().unwrap();
    assert_eq!(scheduled[0].state, "scheduled");
    assert_eq!(scheduled[0].conversation, "peer");
    alice
        .edit_scheduled(scheduled_id.clone(), "final draft".to_owned(), future + 60)
        .unwrap();
    assert_eq!(alice.scheduled_messages().unwrap()[0].body, "final draft");
    alice.cancel_scheduled(scheduled_id).unwrap();
    assert!(alice.scheduled_messages().unwrap().is_empty());

    // Send → the webview's event stream walks the honest ladder.
    let formatted_source = "**hello** from the desktop ![pixel](https://invalid.test/p.png)";
    let msg_id = alice
        .send(bob_peer.clone(), formatted_source.to_owned())
        .unwrap();
    let got = b_ev.wait("bob's message event", |e| {
        matches!(e, UiEvent::MessageReceived { .. })
    });
    match got {
        UiEvent::MessageReceived { peer, body, .. } => {
            assert_eq!(peer, alice_peer);
            assert_eq!(body, formatted_source);
        }
        other => panic!("wrong event: {other:?}"),
    }
    a_ev.wait(
        "alice's delivered event",
        |e| matches!(e, UiEvent::DeliveryUpdated { id, state: "delivered" } if *id == msg_id),
    );

    // History rows carry what the bubbles render: direction, state, body.
    let history = alice.messages(bob_peer.clone()).unwrap();
    assert_eq!(history.len(), 1);
    assert!(history[0].outbound);
    assert_eq!(history[0].state, "delivered");
    assert_eq!(history[0].body, formatted_source);
    let inbox = bob.messages(alice_peer.clone()).unwrap();
    assert_eq!(inbox.len(), 1);
    assert!(!inbox[0].outbound);
    assert_eq!(inbox[0].state, "received");
    assert_eq!(inbox[0].body, formatted_source);

    // Live calls use the same session surface as Tauri commands. The button
    // gate is exact, media carries bounded Opus packets, and no call control
    // or media record becomes a chat-history row.
    let call_deadline = Instant::now() + Duration::from_secs(10);
    loop {
        let availability = alice.call_availability(bob_peer.clone()).unwrap();
        if availability.available {
            assert!(availability.unavailable.is_none());
            break;
        }
        assert!(
            Instant::now() < call_deadline,
            "call never became available"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
    assert!(alice.calls().unwrap().is_empty());
    let call = alice.start_call(bob_peer.clone()).unwrap();
    b_ev.wait("desktop incoming call", |event| {
        matches!(event, UiEvent::CallUpdated { call: snapshot }
            if snapshot.id == call && snapshot.phase == "ringing")
    });
    bob.answer_call(call.clone()).unwrap();
    a_ev.wait("desktop outgoing call active", |event| {
        matches!(event, UiEvent::CallUpdated { call: snapshot }
            if snapshot.id == call && snapshot.phase == "active")
    });
    b_ev.wait("desktop incoming call active", |event| {
        matches!(event, UiEvent::CallUpdated { call: snapshot }
            if snapshot.id == call && snapshot.phase == "active")
    });
    for (index, packet) in [vec![0xf8, 1], vec![0xf8, 2], vec![0xf8, 3]]
        .into_iter()
        .enumerate()
    {
        assert!(alice
            .send_call_audio(call.clone(), 1_000 + index as u64 * 20, packet)
            .unwrap());
    }
    for (index, packet) in [vec![0xf9, 1], vec![0xf9, 2], vec![0xf9, 3]]
        .into_iter()
        .enumerate()
    {
        assert!(bob
            .send_call_audio(call.clone(), 2_000 + index as u64 * 20, packet)
            .unwrap());
    }
    let audio_deadline = Instant::now() + Duration::from_secs(5);
    let at_alice = loop {
        if let Some(frame) = alice.take_call_audio(call.clone()).unwrap() {
            break frame;
        }
        assert!(Instant::now() < audio_deadline, "Alice heard no call audio");
        std::thread::sleep(Duration::from_millis(10));
    };
    let audio_deadline = Instant::now() + Duration::from_secs(5);
    let at_bob = loop {
        if let Some(frame) = bob.take_call_audio(call.clone()).unwrap() {
            break frame;
        }
        assert!(Instant::now() < audio_deadline, "Bob heard no call audio");
        std::thread::sleep(Duration::from_millis(10));
    };
    assert_eq!(at_alice.opus_packet, vec![0xf9, 1]);
    assert_eq!(at_bob.opus_packet, vec![0xf8, 1]);
    alice.hangup_call(call.clone()).unwrap();
    b_ev.wait("desktop remote hangup", |event| {
        matches!(event, UiEvent::CallUpdated { call: snapshot }
            if snapshot.id == call
                && snapshot.phase == "ended"
                && snapshot.end_reason == Some("hung_up"))
    });
    assert_eq!(alice.messages(bob_peer.clone()).unwrap().len(), 1);
    assert_eq!(bob.messages(alice_peer.clone()).unwrap().len(), 1);

    let temporary = alice
        .send_disappearing(bob_peer.clone(), "temporary desktop text".to_owned(), 3_600)
        .unwrap();
    let temporary_event = b_ev.wait("desktop disappearing event", |event| {
        matches!(
            event,
            UiEvent::MessageReceived {
                id,
                content_kind: "disappearing_text",
                expires_at: Some(_),
                ..
            } if id == &temporary
        )
    });
    let event_expiry = match temporary_event {
        UiEvent::MessageReceived { expires_at, .. } => expires_at.unwrap(),
        other => panic!("wrong event: {other:?}"),
    };
    let row = bob
        .messages(alice_peer.clone())
        .unwrap()
        .into_iter()
        .find(|message| message.id == temporary)
        .unwrap();
    assert_eq!(row.content_kind, "disappearing_text");
    assert_eq!(row.expires_at, Some(event_expiry));

    std::thread::sleep(Duration::from_millis(300));
    let editable = alice
        .send(bob_peer.clone(), "desktop edit original".to_owned())
        .unwrap();
    b_ev.wait("bob's canonical desktop Text", |event| {
        matches!(
            event,
            UiEvent::MessageReceived {
                id,
                content_kind: "text",
                ..
            } if id == &editable
        )
    });
    a_ev.wait("editable desktop delivery", |event| {
        matches!(
            event,
            UiEvent::DeliveryUpdated { id, state: "delivered" } if id == &editable
        )
    });
    let edit = alice
        .edit_message(
            bob_peer.clone(),
            alice_peer.clone(),
            editable.clone(),
            "desktop edit revised".to_owned(),
        )
        .unwrap();
    b_ev.wait("desktop pairwise edit refresh", |event| {
        matches!(
            event,
            UiEvent::MessageEdited {
                peer,
                target_content_id,
            } if peer == &alice_peer && target_content_id == &editable
        )
    });
    a_ev.wait("desktop edit delivery", |event| {
        matches!(
            event,
            UiEvent::DeliveryUpdated { id, state: "delivered" } if id == &edit
        )
    });
    for history in [
        alice.messages(bob_peer.clone()).unwrap(),
        bob.messages(alice_peer.clone()).unwrap(),
    ] {
        assert_eq!(history.len(), 3, "edit events are not standalone bubbles");
        let message = history
            .iter()
            .find(|message| message.id == editable)
            .unwrap();
        assert_eq!(message.body, "desktop edit revised");
        assert!(message.edited);
        assert_eq!(message.edit_revision, 1);
        assert_eq!(message.versions.len(), 2);
    }

    // The verify screen: identical digits and QR on both ends, and the
    // "mark verified" button reflects into the contact list badge.
    let sn_a = alice.safety_number(bob_peer.clone()).unwrap();
    let sn_b = bob.safety_number(alice_peer.clone()).unwrap();
    assert_eq!(sn_a.digits, sn_b.digits);
    assert_eq!(sn_a.qr_svg, sn_b.qr_svg);
    alice.mark_verified(bob_peer.clone()).unwrap();
    let contacts = alice.contacts().unwrap();
    assert_eq!(contacts.len(), 1);
    assert_eq!(contacts[0].name, "bob");
    assert!(contacts[0].verified);

    // The hints editor accepts a replacement and rejects garbage honestly.
    alice
        .set_hints(
            bob_peer.clone(),
            &[UiHint {
                kind: "mesh".to_owned(),
                value: "broadcast".to_owned(),
            }],
        )
        .unwrap();
    let err = alice
        .set_hints(
            bob_peer.clone(),
            &[UiHint {
                kind: "mesh".to_owned(),
                value: "over-the-rainbow".to_owned(),
            }],
        )
        .unwrap_err();
    assert!(err.contains("node number"), "got: {err}");

    // Errors the composer surfaces are the node's own words.
    let err = alice.send("00".repeat(32), "x".to_owned()).unwrap_err();
    assert!(err.contains("not a stored contact"), "got: {err}");
    let err = alice
        .add_contact("mallory".to_owned(), "not hex!", &[])
        .unwrap_err();
    assert!(err.contains("hex"), "got: {err}");

    alice.stop();
    bob.stop();
}

#[test]
fn desktop_attachment_ux_pairwise_and_group_lifecycle() {
    let dir = tempfile::tempdir().unwrap();
    let a_ev = Events::default();
    let b_ev = Events::default();
    let alice = open(dir.path(), "attachment-alice", &a_ev);
    let bob = open(dir.path(), "attachment-bob", &b_ev);

    let alice_addr = listen_addr(&alice);
    let bob_addr = listen_addr(&bob);
    let alice_bundle = alice.my_bundle().unwrap();
    let bob_bundle = bob.my_bundle().unwrap();
    let bob_peer = alice
        .add_contact(
            "Bob".to_owned(),
            &bob_bundle.hex,
            &multiaddr_hint(bob_addr.clone()),
        )
        .unwrap();
    let alice_peer = bob
        .add_contact(
            "Alice".to_owned(),
            &alice_bundle.hex,
            &multiaddr_hint(alice_addr),
        )
        .unwrap();

    // Attachment support is an authenticated session capability. Establish
    // the session first, exactly as the UI does through ordinary messaging.
    let hello = alice
        .send(bob_peer.clone(), "attachment setup".to_owned())
        .unwrap();
    b_ev.wait("attachment setup message", |event| {
        matches!(event, UiEvent::MessageReceived { body, .. } if body == "attachment setup")
    });
    a_ev.wait(
        "attachment setup delivered",
        |event| matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" } if *id == hello),
    );
    let capability_reply = bob
        .send(
            alice_peer.clone(),
            "attachment capability confirmation".to_owned(),
        )
        .unwrap();
    a_ev.wait("attachment capability confirmation", |event| {
        matches!(event, UiEvent::MessageReceived { body, .. }
            if body == "attachment capability confirmation")
    });
    b_ev.wait("attachment capability confirmation delivered", |event| {
        matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" }
            if id == &capability_reply)
    });

    // The path chosen by the desktop dialog stays a path across the shell
    // boundary. The render model carries only honest object metadata and
    // verified-byte progress.
    let source = dir.path().join("desktop-source.png");
    image::RgbaImage::from_fn(24, 16, |x, y| {
        image::Rgba([(x * 9) as u8, (y * 13) as u8, 120, 255])
    })
    .save(&source)
    .unwrap();
    let original_bytes = std::fs::read(&source).unwrap();
    let direct = dir.path().join("desktop-edited-direct.png");
    let (ui_recipe, ffi_recipe) = image_recipe();
    edit_image(
        source.display().to_string(),
        direct.display().to_string(),
        ffi_recipe,
    )
    .unwrap();
    let review = alice
        .begin_image_edit(source.display().to_string())
        .unwrap();
    let review = alice.update_image_edit(review.token, ui_recipe).unwrap();
    let bytes = base64::engine::general_purpose::STANDARD
        .decode(review.data_url.split_once(',').unwrap().1)
        .unwrap();
    assert_eq!(bytes, std::fs::read(&direct).unwrap());
    assert_ne!(
        bytes, original_bytes,
        "the selected original must not be imported"
    );
    let carrier = alice
        .attachment_carrier_explanation("pairwise".to_owned(), bob_peer.clone())
        .unwrap();
    let content_id = alice
        .send_image_edit(
            review.token,
            "pairwise".to_owned(),
            bob_peer,
            Some("field-photo.png".to_owned()),
            carrier,
            false,
            86_400,
        )
        .unwrap();
    let outbound = alice.attachments().unwrap();
    assert_eq!(outbound.len(), 1);
    assert_eq!(outbound[0].content_id, content_id);
    assert_eq!(outbound[0].conversation, "pairwise");
    assert_eq!(outbound[0].direction, "outbound");
    assert_eq!(outbound[0].objects.len(), 1);
    assert_eq!(
        outbound[0].objects[0].filename.as_deref(),
        Some("field-photo.png")
    );
    assert_eq!(outbound[0].objects[0].total_bytes, bytes.len() as u64);
    assert_eq!(outbound[0].objects[0].media_type, "image/png");

    alice
        .pause_attachment(outbound[0].transfer_id.clone())
        .unwrap();
    assert_eq!(alice.attachments().unwrap()[0].state, "paused");
    alice
        .resume_attachment(outbound[0].transfer_id.clone())
        .unwrap();

    let offered = b_ev.wait("pairwise attachment offer", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.content_id == content_id
                && attachment.direction == "inbound"
                && attachment.peer == alice_peer)
    });
    let inbound_transfer = match offered {
        UiEvent::AttachmentUpdated { attachment } => {
            assert_eq!(attachment.state, "awaiting_consent");
            assert_eq!(attachment.objects[0].verified_bytes, 0);
            attachment.transfer_id
        }
        other => panic!("wrong event: {other:?}"),
    };
    bob.accept_attachment(inbound_transfer.clone()).unwrap();
    b_ev.wait("pairwise attachment completion", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == inbound_transfer && attachment.state == "complete")
    });
    let inbound = bob
        .attachments()
        .unwrap()
        .into_iter()
        .find(|attachment| attachment.transfer_id == inbound_transfer)
        .unwrap();
    assert_eq!(inbound.objects[0].verified_bytes, bytes.len() as u64);
    let protected_preview = bob.attachment_image(inbound_transfer.clone()).unwrap();
    assert!(protected_preview.starts_with("data:image/png;base64,"));
    let preview_bytes = base64::engine::general_purpose::STANDARD
        .decode(protected_preview.split_once(',').unwrap().1)
        .unwrap();
    assert_eq!(preview_bytes, bytes);

    // Export is caller-selected, exact, protected, and refuses overwrite.
    let exported = dir.path().join("desktop-export.bin");
    bob.export_attachment(inbound_transfer.clone(), exported.display().to_string())
        .unwrap();
    assert_eq!(std::fs::read(&exported).unwrap(), bytes);
    let err = bob
        .export_attachment(inbound_transfer.clone(), exported.display().to_string())
        .unwrap_err();
    assert!(err.contains("exist"), "got: {err}");
    assert_eq!(std::fs::read(&exported).unwrap(), bytes);

    bob.reject_attachment(inbound_transfer).unwrap();
    assert_eq!(bob.attachments().unwrap()[0].state, "rejected");
    a_ev.wait("sender observes attachment rejection", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == outbound[0].transfer_id
                && attachment.state == "rejected")
    });
    alice
        .cancel_attachment(outbound[0].transfer_id.clone())
        .unwrap();
    assert_eq!(alice.attachments().unwrap()[0].state, "cancelled");
    let file_source = dir.path().join("desktop-generic.bin");
    let file_bytes = b"generic file exact bytes\0private";
    std::fs::write(&file_source, file_bytes).unwrap();
    let stale = alice
        .send_confirmed_attachment(
            "pairwise".to_owned(),
            outbound[0].peer.clone(),
            file_source.display().to_string(),
            "application/octet-stream".to_owned(),
            Some("field-notes.bin".to_owned()),
            "stale explanation".to_owned(),
        )
        .unwrap_err();
    assert!(stale.starts_with("carrier_changed:"));
    let file_carrier = alice
        .attachment_carrier_explanation("pairwise".to_owned(), outbound[0].peer.clone())
        .unwrap();
    assert!(file_carrier.contains("fresh realtime or bulk link"));
    let file_content = alice
        .send_confirmed_attachment(
            "pairwise".to_owned(),
            outbound[0].peer.clone(),
            file_source.display().to_string(),
            "application/octet-stream".to_owned(),
            Some("field-notes.bin".to_owned()),
            file_carrier,
        )
        .unwrap();
    let file_offer = b_ev.wait("generic file offer", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.content_id == file_content && attachment.direction == "inbound")
    });
    let file_transfer = match file_offer {
        UiEvent::AttachmentUpdated { attachment } => attachment.transfer_id,
        other => panic!("wrong event: {other:?}"),
    };
    bob.accept_attachment(file_transfer.clone()).unwrap();
    b_ev.wait("generic file completion", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == file_transfer && attachment.state == "complete")
    });
    let generic = bob
        .attachments()
        .unwrap()
        .into_iter()
        .find(|attachment| attachment.transfer_id == file_transfer)
        .unwrap();
    assert_eq!(generic.objects[0].presentation.kind, "other");
    assert_eq!(generic.objects[0].presentation.open_policy, "export_only");
    assert_eq!(
        generic.objects[0].presentation.warnings,
        vec!["unrecognized_type"]
    );
    let err = bob.open_attachment(file_transfer.clone()).unwrap_err();
    assert!(err.contains("export only"), "got: {err}");
    let file_export = dir.path().join("desktop-generic-received.bin");
    bob.export_attachment(file_transfer, file_export.display().to_string())
        .unwrap();
    assert_eq!(std::fs::read(file_export).unwrap(), file_bytes);

    let once_content = alice
        .send_view_once_attachment(
            outbound[0].peer.clone(),
            file_source.display().to_string(),
            "application/octet-stream".to_owned(),
            Some("reveal-once.bin".to_owned()),
            3_600,
        )
        .unwrap();
    let once_offer = b_ev.wait("desktop view-once offer", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.content_id == once_content
                && attachment.direction == "inbound"
                && attachment.view_once)
    });
    let once_transfer = match once_offer {
        UiEvent::AttachmentUpdated { attachment } => {
            assert!(attachment.expires_at.is_some());
            attachment.transfer_id
        }
        other => panic!("wrong event: {other:?}"),
    };
    bob.accept_attachment(once_transfer.clone()).unwrap();
    b_ev.wait("desktop view-once completion", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == once_transfer && attachment.state == "complete")
    });
    assert!(bob
        .export_attachment(
            once_transfer.clone(),
            dir.path()
                .join("desktop-view-once-forbidden.bin")
                .display()
                .to_string(),
        )
        .is_err());
    let once_output = dir.path().join("desktop-view-once-output.bin");
    bob.consume_view_once_attachment(once_transfer.clone(), once_output.display().to_string())
        .unwrap();
    assert_eq!(std::fs::read(&once_output).unwrap(), file_bytes);
    assert!(bob
        .consume_view_once_attachment(
            once_transfer,
            dir.path()
                .join("desktop-view-once-second.bin")
                .display()
                .to_string(),
        )
        .is_err());

    let audio_bytes = canonical_audio(1_600);
    let encoded =
        base64::engine::general_purpose::STANDARD.encode(native_audio_with_metadata(&audio_bytes));
    let audio_content = alice
        .send_recorded_audio(outbound[0].peer.clone(), encoded)
        .unwrap();
    let audio_offer = b_ev.wait("pairwise audio offer", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.content_id == audio_content && attachment.direction == "inbound")
    });
    let audio_transfer = match audio_offer {
        UiEvent::AttachmentUpdated { attachment } => attachment.transfer_id,
        other => panic!("wrong event: {other:?}"),
    };
    bob.accept_attachment(audio_transfer.clone()).unwrap();
    b_ev.wait("pairwise audio completion", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == audio_transfer && attachment.state == "complete")
    });
    let audio = bob.attachment_audio(audio_transfer).unwrap();
    assert_eq!(audio.duration_ms, 100);
    assert_eq!(audio.waveform.len(), 64);
    assert!(audio.data_url.starts_with("data:audio/wav;base64,"));
    let received = base64::engine::general_purpose::STANDARD
        .decode(audio.data_url.split_once(',').unwrap().1)
        .unwrap();
    assert_eq!(received, audio_bytes, "native metadata must be stripped");

    // The same thin shell methods cover an encrypt-once group offer and
    // consent/completion/export flow without adding group-specific protocol.
    let group = alice
        .create_group("Attachment crew".to_owned(), vec![outbound[0].peer.clone()])
        .unwrap();
    accept_group_invitation(&bob, &b_ev, &group, "group invite");
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);
    let group_review = alice
        .begin_image_edit(source.display().to_string())
        .unwrap();
    let (group_recipe, _) = image_recipe();
    let group_review = alice
        .update_image_edit(group_review.token, group_recipe)
        .unwrap();
    let group_carrier = alice
        .attachment_carrier_explanation("group".to_owned(), group.clone())
        .unwrap();
    let group_content_id = alice
        .send_image_edit(
            group_review.token,
            "group".to_owned(),
            group.clone(),
            Some("edited-image.png".to_owned()),
            group_carrier,
            false,
            86_400,
        )
        .unwrap();
    let group_offer = b_ev.wait("group attachment offer", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.content_id == group_content_id
                && attachment.conversation == "group"
                && attachment.group.as_deref() == Some(group.as_str()))
    });
    let group_transfer = match group_offer {
        UiEvent::AttachmentUpdated { attachment } => attachment.transfer_id,
        other => panic!("wrong event: {other:?}"),
    };
    bob.accept_attachment(group_transfer.clone()).unwrap();
    b_ev.wait("group attachment completion", |event| {
        matches!(event, UiEvent::AttachmentUpdated { attachment }
            if attachment.transfer_id == group_transfer && attachment.state == "complete")
    });
    let group_image = bob.attachment_image(group_transfer).unwrap();
    let group_bytes = base64::engine::general_purpose::STANDARD
        .decode(group_image.split_once(',').unwrap().1)
        .unwrap();
    assert_eq!(group_bytes, bytes);

    alice.stop();
    bob.stop();
}

#[test]
fn desktop_group_mentions_preserve_exact_utf8_spans_and_notify_only_the_target() {
    let dir = tempfile::tempdir().unwrap();
    let a_ev = Events::default();
    let b_ev = Events::default();
    let alice = open(dir.path(), "mention-alice", &a_ev);
    let bob = open(dir.path(), "mention-bob", &b_ev);

    let alice_addr = listen_addr(&alice);
    let bob_addr = listen_addr(&bob);
    let alice_bundle = alice.my_bundle().unwrap();
    let bob_bundle = bob.my_bundle().unwrap();
    let bob_peer = alice
        .add_contact(
            "Same name".to_owned(),
            &bob_bundle.hex,
            &multiaddr_hint(bob_addr),
        )
        .unwrap();
    let alice_at_bob = bob
        .add_contact(
            "Same name".to_owned(),
            &alice_bundle.hex,
            &multiaddr_hint(alice_addr),
        )
        .unwrap();
    let group = alice
        .create_group("Unicode crew".to_owned(), vec![bob_peer.clone()])
        .unwrap();
    accept_group_invitation(&bob, &b_ev, &group, "mention group invite");

    let handshake = alice
        .send(bob_peer.clone(), "mention capability handshake".to_owned())
        .unwrap();
    b_ev.wait("mention capability handshake", |event| {
        matches!(event, UiEvent::MessageReceived { peer, body, .. }
            if peer == &alice_at_bob && body == "mention capability handshake")
    });
    a_ev.wait("mention capability receipt", |event| {
        matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" }
            if id == &handshake)
    });
    complete_group_security(&alice, &group);

    let deadline = Instant::now() + Duration::from_secs(5);
    let capability = loop {
        let capability = alice.group_mention_capability(group.clone()).unwrap();
        if capability.supported {
            break capability;
        }
        assert!(
            Instant::now() < deadline,
            "mention capability did not become supported: {:?}",
            capability.issues
        );
        std::thread::sleep(Duration::from_millis(50));
    };
    assert!(capability.issues.is_empty());

    let text = "Meet 👩🏽‍🚀 @Same name by e\u{301}ast";
    let visible = "@Same name";
    let start = text.find(visible).unwrap() as u32;
    let end = start + visible.len() as u32;
    let expected_spans = vec![UiMentionSpan {
        start,
        end,
        target: bob_peer.clone(),
    }];
    let mention_id = alice
        .send_group_mention(
            group.clone(),
            text.to_owned(),
            expected_spans.clone(),
            capability.review_token,
        )
        .unwrap();
    let received = b_ev.wait("semantic mention", |event| {
        matches!(event, UiEvent::GroupMessageReceived {
            group: received_group,
            id,
            body,
            content_kind: "mention",
            mention_spans,
            ..
        } if received_group == &group && id == &mention_id && body == text
            && mention_spans == &expected_spans)
    });
    b_ev.wait("local mention signal", |event| {
        matches!(
            (event, &received),
            (
                UiEvent::MentionReceived { id },
                UiEvent::GroupMessageReceived { id: received_id, .. }
            ) if id == received_id
        )
    });
    let stored = bob
        .group_messages(group.clone())
        .unwrap()
        .into_iter()
        .find(|message| message.id == mention_id)
        .unwrap();
    assert_eq!(stored.body, text);
    assert_eq!(stored.content_kind, "mention");
    assert_eq!(stored.mention_spans, expected_spans);

    let plain_id = alice.send_group(group.clone(), text.to_owned()).unwrap();
    b_ev.wait("plain fallback", |event| {
        matches!(event, UiEvent::GroupMessageReceived {
            id,
            body,
            content_kind: "text",
            mention_spans,
            ..
        } if id == &plain_id && body == text && mention_spans.is_empty())
    });
    a_ev.wait("plain fallback receipt", |event| {
        matches!(event, UiEvent::GroupDeliveryUpdated {
            id,
            peer,
            state: "delivered",
        } if id == &plain_id && peer == &bob_peer)
    });
    std::thread::sleep(Duration::from_millis(100));
    assert_eq!(
        b_ev.count(|event| matches!(event, UiEvent::MentionReceived { .. })),
        1
    );

    alice.stop();
    bob.stop();
}

#[test]
fn desktop_group_ux_create_roster_message_and_partial_delivery() {
    let dir = tempfile::tempdir().unwrap();
    let a_ev = Events::default();
    let b_ev = Events::default();
    let c_ev = Events::default();
    // Keep the full three-member roster online through the recipient-origin
    // exchange, then stop Carol to verify independent delivery state.
    let alice = open(dir.path(), "group-alice", &a_ev);
    let alice_addr = listen_addr(&alice);

    let bob = open(dir.path(), "group-bob", &b_ev);
    let bob_addr = listen_addr(&bob);
    let alice_bundle = alice.my_bundle().unwrap();
    let bob_bundle = bob.my_bundle().unwrap();
    let bob_peer = alice
        .add_contact(
            "Bob".to_owned(),
            &bob_bundle.hex,
            &multiaddr_hint(bob_addr.clone()),
        )
        .unwrap();
    let alice_at_bob = bob
        .add_contact(
            "Alice".to_owned(),
            &alice_bundle.hex,
            &multiaddr_hint(alice_addr.clone()),
        )
        .unwrap();
    let bob_handshake = alice
        .send(bob_peer.clone(), "group origin setup for Bob".to_owned())
        .unwrap();
    b_ev.wait("Bob's capability handshake", |event| {
        matches!(event, UiEvent::MessageReceived { body, .. }
            if body == "group origin setup for Bob")
    });
    a_ev.wait("Bob's capability receipt", |event| {
        matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" }
            if id == &bob_handshake)
    });
    let carol = open(dir.path(), "group-carol", &c_ev);
    let carol_addr = listen_addr(&carol);
    let alice_bundle = alice.my_bundle().unwrap();
    let carol_bundle = carol.my_bundle().unwrap();
    let carol_peer = alice
        .add_contact(
            "Carol".to_owned(),
            &carol_bundle.hex,
            &multiaddr_hint(carol_addr.clone()),
        )
        .unwrap();
    let alice_at_carol = carol
        .add_contact(
            "Alice".to_owned(),
            &alice_bundle.hex,
            &multiaddr_hint(alice_addr.clone()),
        )
        .unwrap();
    assert_eq!(alice_at_carol, alice_at_bob);
    let carol_handshake = alice
        .send(
            carol_peer.clone(),
            "group origin setup for Carol".to_owned(),
        )
        .unwrap();
    c_ev.wait("Carol's capability handshake", |event| {
        matches!(event, UiEvent::MessageReceived { body, .. }
            if body == "group origin setup for Carol")
    });
    a_ev.wait("Carol's capability receipt", |event| {
        matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" }
            if id == &carol_handshake)
    });
    let bob_bundle = bob.my_bundle().unwrap();
    let carol_bundle = carol.my_bundle().unwrap();
    let carol_at_bob = bob
        .add_contact(
            "Carol".to_owned(),
            &carol_bundle.hex,
            &multiaddr_hint(carol_addr),
        )
        .unwrap();
    let bob_at_carol = carol
        .add_contact("Bob".to_owned(), &bob_bundle.hex, &multiaddr_hint(bob_addr))
        .unwrap();
    assert_eq!(carol_at_bob, carol_peer);
    assert_eq!(bob_at_carol, bob_peer);
    let member_mesh_handshake = bob
        .send(
            carol_at_bob,
            "Bob and Carol establish the group mesh".to_owned(),
        )
        .unwrap();
    c_ev.wait("Bob and Carol's capability handshake", |event| {
        matches!(event, UiEvent::MessageReceived { body, .. }
            if body == "Bob and Carol establish the group mesh")
    });
    b_ev.wait("Bob and Carol's capability receipt", |event| {
        matches!(event, UiEvent::DeliveryUpdated { id, state: "delivered" }
            if id == &member_mesh_handshake)
    });
    let group = alice
        .create_group(
            "Trail crew".to_owned(),
            vec![bob_peer.clone(), carol_peer.clone()],
        )
        .unwrap();
    accept_group_invitation(&carol, &c_ev, &group, "Carol's group invite");
    accept_group_invitation(&bob, &b_ev, &group, "Bob's group invite");
    alice.upgrade_group_security(group.clone()).unwrap();
    let bob_origin_nudge = bob
        .send(
            alice_at_bob.clone(),
            "Bob confirms the group upgrade".to_owned(),
        )
        .unwrap();
    let carol_origin_nudge = carol
        .send(
            alice_at_carol,
            "Carol confirms the group upgrade".to_owned(),
        )
        .unwrap();
    a_ev.wait(
        "Bob's group-upgrade nudge",
        |event| matches!(event, UiEvent::MessageReceived { id, .. } if id == &bob_origin_nudge),
    );
    a_ev.wait(
        "Carol's group-upgrade nudge",
        |event| matches!(event, UiEvent::MessageReceived { id, .. } if id == &carol_origin_nudge),
    );
    let listed = alice.groups().unwrap();
    assert_eq!(listed.len(), 1);
    assert_eq!(listed[0].name, "Trail crew");
    assert_eq!(listed[0].members.len(), 3);
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);
    complete_group_security(&carol, &group);
    carol.stop();

    // Only the creator gets roster controls; the shell surfaces the core's
    // explicit error to a non-creator instead of pretending it succeeded.
    let err = bob
        .add_group_member(group.clone(), carol_peer.clone())
        .unwrap_err();
    assert!(err.contains("creator"), "got: {err}");

    // Group conversation history is identical across the shell boundary.
    // Bob receives while offline Carol remains queued/sent: outbound rows
    // expose a distinct truthful state for each member rather than one
    // misleading group-level checkmark.
    let first = alice
        .send_group(group.clone(), "Meet at the north trailhead".to_owned())
        .unwrap();
    b_ev.wait("Bob's group message", |event| {
        matches!(event, UiEvent::GroupMessageReceived { body, .. }
            if body == "Meet at the north trailhead")
    });
    a_ev.wait("Bob's group copy delivered", |event| {
        matches!(event, UiEvent::GroupDeliveryUpdated { id, peer, state: "delivered" }
            if *id == first && *peer == bob_peer)
    });
    let history = alice.group_messages(group.clone()).unwrap();
    assert_eq!(history.len(), 1);
    assert!(history[0].outbound);
    assert_eq!(history[0].deliveries.len(), 2);
    assert_eq!(
        history[0]
            .deliveries
            .iter()
            .find(|delivery| delivery.peer == bob_peer)
            .unwrap()
            .state,
        "delivered"
    );
    assert_ne!(
        history[0]
            .deliveries
            .iter()
            .find(|delivery| delivery.peer == carol_peer)
            .unwrap()
            .state,
        "delivered"
    );
    let bob_history = bob.group_messages(group.clone()).unwrap();
    assert_eq!(bob_history[0].sender, alice_at_bob);
    assert!(!bob_history[0].outbound);
    assert!(bob_history[0].deliveries.is_empty());

    // Remove the intentionally offline legacy member before exercising a
    // capability-gated content type. The exact current roster must support
    // polls; an unreachable member cannot honestly advertise that support.
    alice
        .remove_group_member(group.clone(), carol_peer)
        .unwrap();
    assert_eq!(alice.groups().unwrap()[0].members.len(), 2);
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);

    // Polls use the same authenticated encrypted group path, but render as
    // dedicated visible-vote cards rather than misleading chat bubbles.
    let poll_id = alice
        .create_group_poll(
            group.clone(),
            "Which route? 🗻".to_owned(),
            vec!["North ridge".to_owned(), "River path".to_owned()],
        )
        .unwrap();
    b_ev.wait("Bob's desktop poll", |event| {
        matches!(event, UiEvent::PollUpdated { group: event_group, poll_id: event_poll, .. }
            if event_group == &group && event_poll == &poll_id)
    });
    let bob_poll = bob.group_polls(group.clone()).unwrap().remove(0);
    assert_eq!(bob_poll.question, "Which route? 🗻");
    assert!(bob_poll.votes_visible);
    assert!(!bob_poll.anonymous);
    assert_eq!(bob_poll.close_policy, "manual_creator_snapshot");
    assert!(!bob_poll.can_close);
    let poll_author = bob_poll.author.clone();
    let north = bob_poll.options[0].id.clone();
    let river = bob_poll.options[1].id.clone();
    bob.vote_group_poll(group.clone(), poll_author.clone(), poll_id.clone(), north)
        .unwrap();
    a_ev.wait("Bob's first desktop poll vote", |event| {
        matches!(event, UiEvent::PollUpdated { poll_id: event_poll, .. } if event_poll == &poll_id)
    });
    bob.vote_group_poll(
        group.clone(),
        poll_author.clone(),
        poll_id.clone(),
        river.clone(),
    )
    .unwrap();
    let poll_change_deadline = Instant::now() + Duration::from_secs(30);
    while alice.group_polls(group.clone()).unwrap()[0]
        .votes
        .first()
        .map(|vote| vote.option_id.as_str())
        != Some(river.as_str())
    {
        assert!(
            Instant::now() < poll_change_deadline,
            "timed out waiting for changed desktop poll vote"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
    let changed = alice.group_polls(group.clone()).unwrap().remove(0);
    assert_eq!(changed.votes.len(), 1);
    assert_eq!(changed.votes[0].option_id, river);
    assert!(changed.can_close);
    alice
        .close_group_poll(group.clone(), poll_author, poll_id.clone())
        .unwrap();
    let poll_close_deadline = Instant::now() + Duration::from_secs(30);
    while !bob.group_polls(group.clone()).unwrap()[0].closed {
        assert!(
            Instant::now() < poll_close_deadline,
            "timed out waiting for closed desktop poll"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
    assert!(bob.group_polls(group.clone()).unwrap()[0].closed);
    assert_eq!(alice.group_messages(group.clone()).unwrap().len(), 1);
    assert_eq!(bob.group_messages(group.clone()).unwrap().len(), 1);

    // C6 authority stays typed through Session, exactly as Tauri commands
    // and the members/poll dialogs consume it.
    let legacy = alice.group_authority(group.clone()).unwrap();
    assert!(!legacy.signed);
    assert_eq!(legacy.owner, alice_at_bob);
    assert_eq!(legacy.my_role, Some("owner"));
    let upgrade_generation = legacy.generation + 1;
    alice.upgrade_group_authority(group.clone()).unwrap();
    let upgraded = wait_authority_generation(&bob, &group, upgrade_generation);
    assert_eq!(upgraded.owner, alice_at_bob);
    assert_eq!(upgraded.my_role, Some("member"));
    assert_eq!(upgraded.members.len(), 2);
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);

    alice
        .set_group_role(group.clone(), bob_peer.clone(), "admin".to_owned())
        .unwrap();
    let admin_generation = upgrade_generation + 1;
    assert_eq!(
        wait_authority_generation(&bob, &group, admin_generation).my_role,
        Some("admin")
    );
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);
    let err = bob
        .set_group_role(group.clone(), alice_at_bob.clone(), "member".to_owned())
        .unwrap_err();
    assert!(err.contains("owner"), "got: {err}");

    let rename_request = bob
        .rename_group(group.clone(), "Authority trail crew".to_owned())
        .unwrap();
    let rename_generation = admin_generation + 1;
    b_ev.wait("desktop admin rename result", |event| {
        matches!(event, UiEvent::GroupAdminRequestResolved {
            request_id,
            accepted: true,
            generation,
            state_id: Some(_),
            reason: 0,
            ..
        } if request_id == &rename_request && *generation == rename_generation)
    });
    wait_authority_generation(&bob, &group, rename_generation);
    let rename_deadline = Instant::now() + Duration::from_secs(30);
    loop {
        if bob
            .groups()
            .unwrap()
            .iter()
            .any(|candidate| candidate.id == group && candidate.name == "Authority trail crew")
        {
            break;
        }
        assert!(
            Instant::now() < rename_deadline,
            "desktop admin rename did not converge"
        );
        std::thread::sleep(Duration::from_millis(50));
    }
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);

    let moderated_poll = alice
        .create_group_poll(
            group.clone(),
            "Close for weather?".to_owned(),
            vec!["Keep open".to_owned(), "Close".to_owned()],
        )
        .unwrap();
    b_ev.wait(
        "desktop moderated poll",
        |event| matches!(event, UiEvent::PollUpdated { poll_id, .. } if poll_id == &moderated_poll),
    );
    let moderation_request = bob
        .moderate_group_poll_close(group.clone(), alice_at_bob.clone(), moderated_poll.clone())
        .unwrap();
    let moderation_generation = rename_generation + 1;
    b_ev.wait("desktop moderation result", |event| {
        matches!(event, UiEvent::GroupAdminRequestResolved {
            request_id,
            accepted: true,
            generation,
            reason: 0,
            ..
        } if request_id == &moderation_request && *generation == moderation_generation)
    });
    let moderated = wait_closed_poll(&bob, &group, &moderated_poll);
    assert_eq!(moderated.moderated_by, Some(alice_at_bob.clone()));
    assert_eq!(moderated.close_policy, "signed_owner_snapshot");
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);

    alice
        .transfer_group_owner(group.clone(), bob_peer.clone())
        .unwrap();
    let bob_owner_generation = moderation_generation + 1;
    let bob_owner = wait_authority_generation(&bob, &group, bob_owner_generation);
    assert_eq!(bob_owner.owner, bob_peer);
    assert_eq!(bob_owner.owner_epoch, 1);
    assert_eq!(bob_owner.my_role, Some("owner"));
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);
    let err = bob.leave_group(group.clone()).unwrap_err();
    assert!(err.contains("owner"), "got: {err}");

    bob.transfer_group_owner(group.clone(), alice_at_bob.clone())
        .unwrap();
    let alice_owner_generation = bob_owner_generation + 1;
    let alice_owner = wait_authority_generation(&alice, &group, alice_owner_generation);
    assert_eq!(alice_owner.owner, alice_at_bob);
    assert_eq!(alice_owner.owner_epoch, 2);
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);
    alice
        .set_group_role(group.clone(), bob_peer.clone(), "member".to_owned())
        .unwrap();
    wait_authority_generation(&bob, &group, alice_owner_generation + 1);
    complete_group_security(&alice, &group);
    complete_group_security(&bob, &group);

    // A member can leave; their live group disappears locally and the
    // creator converges too.
    let editable = alice
        .send_group(group.clone(), "desktop group edit original".to_owned())
        .unwrap();
    b_ev.wait("Bob's editable group Text", |event| {
        matches!(
            event,
            UiEvent::GroupMessageReceived {
                id,
                content_kind: "text",
                ..
            } if id == &editable
        )
    });
    a_ev.wait("editable group copy delivered", |event| {
        matches!(
            event,
            UiEvent::GroupDeliveryUpdated { id, peer, state: "delivered" }
                if id == &editable && peer == &bob_peer
        )
    });
    let edit = alice
        .edit_group_message(
            group.clone(),
            alice_at_bob.clone(),
            editable.clone(),
            "desktop group edit revised".to_owned(),
        )
        .unwrap();
    b_ev.wait("desktop group edit refresh", |event| {
        matches!(
            event,
            UiEvent::GroupMessageEdited {
                group: event_group,
                sender,
                target_content_id,
            } if event_group == &group && sender == &alice_at_bob
                && target_content_id == &editable
        )
    });
    a_ev.wait("desktop group edit delivery", |event| {
        matches!(
            event,
            UiEvent::GroupDeliveryUpdated { id, peer, state: "delivered" }
                if id == &edit && peer == &bob_peer
        )
    });
    for history in [
        alice.group_messages(group.clone()).unwrap(),
        bob.group_messages(group.clone()).unwrap(),
    ] {
        let message = history
            .iter()
            .find(|message| message.id == editable)
            .unwrap();
        assert_eq!(message.body, "desktop group edit revised");
        assert!(message.edited);
        assert_eq!(message.edit_revision, 1);
        assert_eq!(message.versions.len(), 2);
    }
    bob.leave_group(group.clone()).unwrap();
    assert!(bob.groups().unwrap().is_empty());
    let deadline = Instant::now() + Duration::from_secs(30);
    loop {
        if alice.groups().unwrap()[0].members.len() == 1 {
            break;
        }
        assert!(
            Instant::now() < deadline,
            "creator did not apply Bob's leave"
        );
        std::thread::sleep(Duration::from_millis(50));
    }

    alice.stop();
    bob.stop();
}

#[test]
fn note_to_self_is_local_sealed_and_durable() {
    let dir = tempfile::tempdir().unwrap();
    let events = Events::default();
    let session = open(dir.path(), "notes", &events);

    assert_eq!(session.note_to_self_id(), "note_to_self");
    let id = session
        .send_note_to_self("remember the glacier map".to_owned())
        .unwrap();
    let added = events.wait("local note event", |event| {
        matches!(event, UiEvent::NoteToSelfMessageAdded { id: event_id, .. } if *event_id == id)
    });
    match added {
        UiEvent::NoteToSelfMessageAdded {
            conversation, body, ..
        } => {
            assert_eq!(conversation, "note_to_self");
            assert_eq!(body, "remember the glacier map");
        }
        other => panic!("wrong event: {other:?}"),
    }
    let status = session.status().unwrap();
    assert_eq!((status.queued, status.contacts), (0, 0));
    assert_eq!(
        session.note_to_self_messages().unwrap()[0].body,
        "remember the glacier map"
    );
    session.stop();

    let session = open(dir.path(), "notes", &Events::default());
    let history = session.note_to_self_messages().unwrap();
    assert_eq!(history[0].conversation, "note_to_self");
    assert_eq!(history[0].body, "remember the glacier map");
    assert_eq!(session.status().unwrap().queued, 0);
    session.stop();
}

#[test]
fn legacy_backup_reset_preparation_exposes_fresh_reviewed_authority() {
    let directory = tempfile::tempdir().unwrap();
    let authority = directory
        .path()
        .join("legacy-archive-authority.kra")
        .display()
        .to_string();
    let prepared = Session::prepare_legacy_backup_authority_reset(authority.clone()).unwrap();
    assert!(std::path::Path::new(&authority).is_file());
    assert!(!prepared.new_address.is_empty());
    assert_eq!(prepared.recovery_mnemonic.split_whitespace().count(), 24);
    assert!(Session::prepare_legacy_backup_authority_reset(authority).is_err());
}

#[test]
fn backup_mnemonic_restore_flow() {
    let dir = tempfile::tempdir().unwrap();
    let a_ev = Events::default();
    let b_ev = Events::default();
    let alice = open(dir.path(), "alice", &a_ev);
    let bob = open(dir.path(), "bob", &b_ev);
    let recovery = dir
        .path()
        .join("komms-account-authority.kra")
        .display()
        .to_string();
    let recovery_mnemonic = alice
        .export_account_recovery_authority(recovery.clone())
        .unwrap();
    assert_eq!(recovery_mnemonic.split_whitespace().count(), 24);

    let a_addr = listen_addr(&alice);
    let b_addr = listen_addr(&bob);
    let bob_peer = alice
        .add_contact(
            "bob".to_owned(),
            &bob.my_bundle().unwrap().hex,
            &multiaddr_hint(b_addr),
        )
        .unwrap();
    let alice_peer = bob
        .add_contact(
            "alice".to_owned(),
            &alice.my_bundle().unwrap().hex,
            &multiaddr_hint(a_addr),
        )
        .unwrap();
    let msg_id = alice
        .send(bob_peer.clone(), "before the backup".to_owned())
        .unwrap();
    a_ev.wait(
        "delivered",
        |e| matches!(e, UiEvent::DeliveryUpdated { id, state: "delivered" } if *id == msg_id),
    );
    alice
        .send_note_to_self("packed in the backup".to_owned())
        .unwrap();

    // The backup dialog: mnemonic comes back exactly once, 24 words; an
    // existing file is refused, not clobbered.
    let backup = dir.path().join("komms-backup.kkr").display().to_string();
    let mnemonic = alice.export_backup(backup.clone()).unwrap();
    assert_eq!(mnemonic.split_whitespace().count(), 24);
    assert!(alice.export_backup(backup.clone()).is_err());

    let address_before = alice.address();
    alice.stop();

    // The gate's restore tab: wrong mnemonic refused at startup…
    let bad = Session::restore(
        &dir.path().join("alice-wrong"),
        "new-pass".to_owned(),
        backup.clone(),
        "abandon ".repeat(23) + "art",
        recovery.clone(),
        recovery_mnemonic.clone(),
        &test_settings(),
        KdfChoice::Mobile,
        Events::default().sink(),
    );
    assert!(bad.is_err());

    // …right mnemonic restores identity, contacts, and history.
    let a_ev = Events::default();
    let alice = Session::restore(
        &dir.path().join("alice-new"),
        "new-pass".to_owned(),
        backup,
        mnemonic,
        recovery,
        recovery_mnemonic,
        &test_settings(),
        KdfChoice::Mobile,
        a_ev.sink(),
    )
    .expect("restore succeeds");
    assert_eq!(alice.address(), address_before);
    assert_eq!(alice.contacts().unwrap()[0].name, "bob");
    let history = alice.messages(bob_peer.clone()).unwrap();
    assert_eq!(history.len(), 1);
    assert_eq!(history[0].body, "before the backup");
    assert_eq!(
        alice.note_to_self_messages().unwrap()[0].body,
        "packed in the backup"
    );

    // The restored node re-handshakes automatically; after Bob learns the
    // new address, messaging resumes in both directions.
    let deadline = Instant::now() + Duration::from_secs(30);
    loop {
        let rekeys = b_ev
            .0
            .lock()
            .unwrap()
            .iter()
            .filter(|e| matches!(e, UiEvent::SessionEstablished { peer } if *peer == alice_peer))
            .count();
        if rekeys >= 2 {
            break;
        }
        assert!(Instant::now() < deadline, "timed out waiting for re-key");
        std::thread::sleep(Duration::from_millis(50));
    }
    let a_addr_new = listen_addr(&alice);
    bob.set_hints(alice_peer.clone(), &multiaddr_hint(a_addr_new))
        .unwrap();
    bob.send(alice_peer, "glad you're back".to_owned()).unwrap();
    let got = a_ev.wait("alice's message event", |e| {
        matches!(e, UiEvent::MessageReceived { .. })
    });
    match got {
        UiEvent::MessageReceived { body, .. } => assert_eq!(body, "glad you're back"),
        other => panic!("wrong event: {other:?}"),
    }
    let reply = alice
        .send(bob_peer, "new machine, same me".to_owned())
        .unwrap();
    a_ev.wait(
        "reply delivered",
        |e| matches!(e, UiEvent::DeliveryUpdated { id, state: "delivered" } if *id == reply),
    );

    alice.stop();
    bob.stop();
}

#[test]
fn recovery_authority_export_failure_keeps_desktop_session_retryable() {
    let directory = tempfile::tempdir().unwrap();
    let events = Events::default();
    let session = open(directory.path(), "authority-path", &events);

    assert!(session
        .export_account_recovery_authority(String::new())
        .is_err());

    let destination = directory
        .path()
        .join("account-authority.kra")
        .display()
        .to_string();
    let mnemonic = session
        .export_account_recovery_authority(destination.clone())
        .unwrap();
    assert_eq!(mnemonic.split_whitespace().count(), 24);
    assert!(std::path::Path::new(&destination).is_file());
    session.stop();
}

#[test]
fn unlock_refuses_wrong_passphrase_and_persists() {
    let dir = tempfile::tempdir().unwrap();
    let events = Events::default();
    let alice = open(dir.path(), "alice", &events);
    let address = alice.address();
    alice.stop();

    // Wrong passphrase at the gate: an honest startup error.
    let err = Session::open(
        &dir.path().join("alice"),
        "wrong".to_owned(),
        &test_settings(),
        KdfChoice::Mobile,
        Events::default().sink(),
    )
    .map(|_| ())
    .unwrap_err();
    assert!(err.contains("startup"), "got: {err}");

    // Right passphrase: same identity. Settings persisted alongside.
    let alice = open(dir.path(), "alice", &Events::default());
    assert_eq!(alice.address(), address);
    let saved = NetworkSettings::load(&dir.path().join("alice")).unwrap();
    assert!(!saved.mdns);
    alice.stop();
}

#[test]
fn desktop_private_label_manager_assignment_filters_and_restart() {
    let dir = tempfile::tempdir().unwrap();
    let events = Events::default();
    let bob_events = Events::default();
    let alice = open(dir.path(), "alice-labels", &events);
    let bob = open(dir.path(), "bob-labels", &bob_events);
    let bob_peer = alice
        .add_contact(
            "Same visible target".to_owned(),
            &bob.my_bundle().unwrap().hex,
            &multiaddr_hint(listen_addr(&bob)),
        )
        .unwrap();
    let group = alice
        .create_group("Same visible target".to_owned(), vec![bob_peer.clone()])
        .unwrap();
    let peer = UiLabelTarget {
        kind: "peer".to_owned(),
        id: Some(bob_peer),
    };
    let group_target = UiLabelTarget {
        kind: "group".to_owned(),
        id: Some(group),
    };
    let note = UiLabelTarget {
        kind: "note_to_self".to_owned(),
        id: None,
    };
    let queued_before = alice.status().unwrap().queued;

    let first = alice
        .create_label("\u{2067}e\u{301} 🧭\u{2069}".to_owned(), "blue".to_owned())
        .unwrap();
    let duplicate = alice
        .create_label("\u{2067}e\u{301} 🧭\u{2069}".to_owned(), "pink".to_owned())
        .unwrap();
    assert_ne!(first.id, duplicate.id);
    assert_eq!((first.order, duplicate.order), (0, 1));
    assert!(alice.assign_label(first.id.clone(), peer.clone()).unwrap());
    assert!(!alice.assign_label(first.id.clone(), peer.clone()).unwrap());
    assert!(alice
        .assign_label(first.id.clone(), group_target.clone())
        .unwrap());
    assert!(alice
        .assign_label(duplicate.id.clone(), peer.clone())
        .unwrap());
    assert!(alice
        .assign_label(duplicate.id.clone(), note.clone())
        .unwrap());

    let any = alice
        .filter_labels(
            vec![first.id.clone(), duplicate.id.clone()],
            "any".to_owned(),
        )
        .unwrap();
    assert_eq!(any.conversations.len(), 3);
    let all = alice
        .filter_labels(
            vec![duplicate.id.clone(), first.id.clone(), first.id.clone()],
            "all".to_owned(),
        )
        .unwrap();
    assert_eq!(all.selected, vec![duplicate.id.clone(), first.id.clone()]);
    assert_eq!(
        all.conversations,
        vec![komms_desktop::session::UiLabelConversation {
            target: peer.clone(),
            display_name: Some("Same visible target".to_owned()),
        }]
    );

    let renamed = alice
        .update_label(
            first.id.clone(),
            " exact\tname ".to_owned(),
            "teal".to_owned(),
        )
        .unwrap();
    assert_eq!((renamed.id, renamed.order), (first.id.clone(), 0));
    assert_eq!(alice.label_membership(first.id.clone()).unwrap().len(), 2);
    assert!(alice.delete_label(first.id.clone(), false).is_err());
    assert_eq!(
        alice
            .label_delete_assignment_count(first.id.clone())
            .unwrap(),
        2
    );
    assert_eq!(alice.delete_label(first.id, true).unwrap(), 2);
    assert_eq!(alice.status().unwrap().queued, queued_before);
    events.wait("local label change", |event| {
        matches!(event, UiEvent::LabelsChanged)
    });
    assert!(events.count(|event| matches!(event, UiEvent::LabelsChanged)) >= 1);

    alice.stop();
    let alice = open(dir.path(), "alice-labels", &Events::default());
    let restored = alice.labels().unwrap();
    assert_eq!(
        (&restored[0].id, &restored[0].name, &restored[0].color),
        (&duplicate.id, &duplicate.name, &duplicate.color)
    );
    assert_eq!(restored[0].order, 0);
    assert_eq!(alice.labels_for_conversation(note).unwrap(), restored);
    assert!(alice.stale_labels().unwrap().is_empty());
    alice.stop();
    bob.stop();
}

#[test]
fn desktop_private_folder_manager_navigation_composition_and_restart() {
    let dir = tempfile::tempdir().unwrap();
    let events = Events::default();
    let bob_events = Events::default();
    let alice = open(dir.path(), "alice-folders", &events);
    let bob = open(dir.path(), "bob-folders", &bob_events);
    let bob_peer = alice
        .add_contact(
            "Same visible target".to_owned(),
            &bob.my_bundle().unwrap().hex,
            &multiaddr_hint(listen_addr(&bob)),
        )
        .unwrap();
    let group = alice
        .create_group("Same visible target".to_owned(), vec![bob_peer.clone()])
        .unwrap();
    let peer = UiFolderTarget {
        kind: "peer".to_owned(),
        id: Some(bob_peer.clone()),
    };
    let group_target = UiFolderTarget {
        kind: "group".to_owned(),
        id: Some(group.clone()),
    };
    let note = UiFolderTarget {
        kind: "note_to_self".to_owned(),
        id: None,
    };
    let queued_before = alice.status().unwrap().queued;

    let first = alice
        .create_folder("\u{2067}e\u{301} 🧭\u{2069}".to_owned())
        .unwrap();
    let second = alice
        .create_folder("\u{2067}e\u{301} 🧭\u{2069}".to_owned())
        .unwrap();
    assert_ne!(first.id, second.id);
    assert_eq!((first.order, second.order), (0, 1));
    assert_eq!(
        alice
            .reorder_folders(vec![second.id.clone(), first.id.clone()])
            .unwrap()
            .iter()
            .map(|folder| folder.id.clone())
            .collect::<Vec<_>>(),
        vec![second.id.clone(), first.id.clone()]
    );
    assert!(alice
        .move_to_folder(first.id.clone(), peer.clone())
        .unwrap());
    assert!(alice
        .move_to_folder(first.id.clone(), group_target.clone())
        .unwrap());
    assert!(alice
        .move_to_folder(second.id.clone(), note.clone())
        .unwrap());
    assert!(!alice
        .move_to_folder(second.id.clone(), note.clone())
        .unwrap());

    let label = alice
        .create_label("folder composition".to_owned(), "teal".to_owned())
        .unwrap();
    alice
        .assign_label(
            label.id.clone(),
            UiLabelTarget {
                kind: "peer".to_owned(),
                id: Some(bob_peer.clone()),
            },
        )
        .unwrap();
    alice
        .assign_label(
            label.id.clone(),
            UiLabelTarget {
                kind: "group".to_owned(),
                id: Some(group.clone()),
            },
        )
        .unwrap();
    let composed = alice
        .folder_conversations(
            UiFolderSelection {
                kind: "folder".to_owned(),
                id: Some(first.id.clone()),
            },
            vec![label.id.clone()],
            "any".to_owned(),
        )
        .unwrap();
    assert_eq!(composed.conversations.len(), 2);
    let peer_pin = UiPinTarget {
        kind: "peer".to_owned(),
        id: Some(bob_peer),
    };
    let group_pin = UiPinTarget {
        kind: "group".to_owned(),
        id: Some(group),
    };
    assert!(alice.pin_conversation(peer_pin.clone()).unwrap());
    assert!(alice.pin_conversation(group_pin.clone()).unwrap());
    assert!(!alice.pin_conversation(peer_pin.clone()).unwrap());
    alice
        .reorder_pins(vec![group_pin.clone(), peer_pin.clone()])
        .unwrap();
    let pinned = alice
        .pin_conversations(
            UiFolderSelection {
                kind: "folder".to_owned(),
                id: Some(first.id.clone()),
            },
            vec![label.id.clone()],
            "any".to_owned(),
        )
        .unwrap();
    assert_eq!(
        pinned
            .conversations
            .iter()
            .map(|row| (row.target.kind.as_str(), row.pinned))
            .collect::<Vec<_>>(),
        vec![("group", true), ("peer", true)]
    );
    assert!(alice.cleanup_stale_pin(group_pin.clone()).is_err());
    events.wait("local pin change", |event| {
        matches!(event, UiEvent::PinsChanged)
    });
    assert!(alice.unfile_conversation(peer.clone()).unwrap());
    assert!(!alice.unfile_conversation(peer).unwrap());
    assert_eq!(
        alice
            .folder_delete_assignment_count(first.id.clone())
            .unwrap(),
        1
    );
    assert!(alice.delete_folder(first.id.clone(), false).is_err());
    assert_eq!(alice.status().unwrap().queued, queued_before);
    events.wait("local folder change", |event| {
        matches!(event, UiEvent::FoldersChanged)
    });

    alice.stop();
    let alice = open(dir.path(), "alice-folders", &Events::default());
    assert_eq!(
        alice
            .folders()
            .unwrap()
            .iter()
            .map(|folder| folder.id.clone())
            .collect::<Vec<_>>(),
        vec![second.id.clone(), first.id.clone()]
    );
    assert_eq!(
        alice.conversation_folder(note).unwrap().unwrap().id,
        second.id
    );
    assert_eq!(alice.folder_membership(first.id.clone()).unwrap().len(), 1);
    assert_eq!(
        alice
            .pins()
            .unwrap()
            .iter()
            .map(|pin| pin.target.clone())
            .collect::<Vec<_>>(),
        vec![group_pin, peer_pin]
    );
    assert_eq!(alice.delete_folder(first.id.clone(), true).unwrap(), 1);
    let replacement = alice.create_folder(first.name).unwrap();
    assert_ne!(replacement.id, first.id);
    assert!(alice.folder_membership(replacement.id).unwrap().is_empty());
    assert!(alice.stale_folders().unwrap().is_empty());
    alice.stop();
    bob.stop();
}