fix: refuse unaudited denies, restore last connection, and colour environments

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Trung Nguyen

PLAN.md

@@ -532,12 +532,16 @@ Removed material included retired application source, tests, project files, runt
 
 In progress since 2026-08-21. Slice 10.1 is implemented and locally
 release-verified: activation is additive, each window owns and releases its own
-connection, and the single-connection limit is gone. Slice 10.2 is implemented:
-groups, tags, favourites, search, and URL import. Welcome rows still do not
-show an environment colour. Slice 10.3 has a capability-declared TSV activity
-dialog whose in-flight query is cancelled when the dialog closes. The typed
-sessions console and blocking trees are not started. Structure edit tabs now
-restore with the rest of the workspace. Slices 10.4 through 10.7 are not started.
+connection, and the single-connection limit is gone. Startup reopens the last
+connection this window used; a failed reconnect leaves the welcome page up and
+does not attach those tabs to another connection. Restoring every connection
+that still has saved tabs, including other windows, is not started. Slice 10.2
+is implemented: groups, tags, favourites, search, URL import, and an
+environment colour on each saved-connection row. Slice 10.3 has a
+capability-declared TSV activity dialog whose in-flight query is cancelled when
+the dialog closes. The typed sessions console and blocking trees are not
+started. Structure edit tabs now restore with the rest of the workspace.
+Slices 10.4 through 10.7 are not started.
 
 The product is strong on safety and thin on operations. A DBA who manages many
 servers gets one active connection per process, an activity dialog that renders

linux/CHANGELOG.md

@@ -80,6 +80,9 @@
 
 ### Fixed
 
+- A denied statement or dismissed approval is refused if that denial cannot be written to the audit journal
+- The last open connection is reopened when the app starts. If it cannot connect, its tabs stay with that connection instead of attaching to another database
+- Saved connection rows show the environment as a colour
 - Measuring how many rows an UPDATE or DELETE would touch now uses the same timeout and cancellation as the write itself, instead of running an unbounded count first
 - Reading a table's indexes and foreign keys now stops at the query timeout, and a failed read no longer pretends the table has none
 - Structure tabs reopen after a reconnect, and the saved workspace no longer points at the wrong tab when a draft was skipped

linux/ROADMAP.md

@@ -125,7 +125,7 @@ Phase 5 documentation is current as of 2026-08-18. Keeping it current is a stand
 - [ ] SQL file open/save with external-change detection
 - [ ] PostgreSQL objects, users/roles, and administration
 - [ ] Import/export and backup/restore
-- [x] Connection groups, tags, favourites, search, and URL import (Phase 10.2)
+- [x] Connection groups, tags, favourites, search, URL import, and environment colour (Phase 10.2)
 - [ ] Reusable SSH and transport profiles
 - [ ] True result streaming and optional Parquet export
 
@@ -152,7 +152,7 @@ The repository extraction completed on 2026-08-17. Product planning now follows
 ### 10: DBA operations at scale
 
 - [x] Several connections open at once, with fail-closed per-tab ownership across all of them
-- [x] Connection groups, tags, favorites, search, and URL import
+- [x] Connection groups, tags, favorites, search, URL import, and environment colour on each row
 - [ ] A typed sessions and locks console with capability-declared driver support and governed session termination
 - [ ] A PostgreSQL server health panel that degrades cleanly when a statistics extension is absent
 - [ ] Configurable pool size and timeouts per saved connection, honoured by the driver

linux/crates/app/src/services/window_state.rs

@@ -1,12 +1,21 @@
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicBool, Ordering};
+
 use serde::{Deserialize, Serialize};
+use uuid::Uuid;
 
 use super::config_io::{atomic_write_json, xdg_config_path};
 
+static FILE_LOCK: Mutex<()> = Mutex::new(());
+static SESSION_RESTORE_ATTEMPTED: AtomicBool = AtomicBool::new(false);
+
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 pub struct WindowState {
     pub width: i32,
     pub height: i32,
     pub maximized: bool,
+    #[serde(default)]
+    pub last_connection_id: Option<Uuid>,
 }
 
 impl Default for WindowState {
@@ -15,11 +24,12 @@ impl Default for WindowState {
             width: 1200,
             height: 760,
             maximized: false,
+            last_connection_id: None,
         }
     }
 }
 
-pub fn load() -> WindowState {
+fn load_locked() -> WindowState {
     let Some(path) = xdg_config_path("window.json") else {
         return WindowState::default();
     };
@@ -29,11 +39,78 @@ pub fn load() -> WindowState {
         .unwrap_or_default()
 }
 
-pub fn save(state: WindowState) {
+fn save_locked(state: &WindowState) {
     let Some(path) = xdg_config_path("window.json") else {
         return;
     };
-    if let Err(e) = atomic_write_json(&path, &state) {
+    if let Err(e) = atomic_write_json(&path, state) {
         tracing::warn!(path = %path.display(), error = %e, "window_state: write failed");
     }
 }
+
+pub fn load() -> WindowState {
+    let _guard = FILE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    load_locked()
+}
+
+pub fn save_geometry(width: i32, height: i32, maximized: bool) {
+    let _guard = FILE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    let mut state = load_locked();
+    state.width = width;
+    state.height = height;
+    state.maximized = maximized;
+    save_locked(&state);
+}
+
+pub fn set_last_connection_id(id: Option<Uuid>) {
+    let _guard = FILE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    let mut state = load_locked();
+    state.last_connection_id = id;
+    save_locked(&state);
+}
+
+pub fn take_session_restore_turn() -> bool {
+    !SESSION_RESTORE_ATTEMPTED.swap(true, Ordering::SeqCst)
+}
+
+pub fn connection_id_to_restore(last_connection_id: Option<Uuid>, available: &[Uuid]) -> Option<Uuid> {
+    let id = last_connection_id?;
+    available.contains(&id).then_some(id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_missing_last_connection_id_deserializes_as_none() {
+        let parsed: WindowState =
+            serde_json::from_str(r#"{"width":800,"height":600,"maximized":false}"#).expect("legacy window.json");
+        assert_eq!(parsed.last_connection_id, None);
+        assert_eq!(parsed.width, 800);
+    }
+
+    #[test]
+    fn last_connection_id_round_trips() {
+        let id = Uuid::new_v4();
+        let state = WindowState {
+            width: 1,
+            height: 2,
+            maximized: true,
+            last_connection_id: Some(id),
+        };
+        let parsed: WindowState =
+            serde_json::from_slice(&serde_json::to_vec(&state).expect("serialize")).expect("deserialize");
+        assert_eq!(parsed.last_connection_id, Some(id));
+        assert!(parsed.maximized);
+    }
+
+    #[test]
+    fn restore_skips_an_unknown_or_absent_connection() {
+        let id = Uuid::new_v4();
+        assert_eq!(connection_id_to_restore(None, &[id]), None);
+        assert_eq!(connection_id_to_restore(Some(id), &[]), None);
+        assert_eq!(connection_id_to_restore(Some(Uuid::new_v4()), &[id]), None);
+        assert_eq!(connection_id_to_restore(Some(id), &[id]), Some(id));
+    }
+}

linux/crates/app/src/ui/app/connection.rs

@@ -72,6 +72,7 @@ impl App {
         // Restore tabs (browse + editor) persisted from the prior session
         // for this connection.
         if let Some(connection_id) = self.connection_id {
+            crate::services::window_state::set_last_connection_id(Some(connection_id));
             self.restore_workspace_tabs(connection_id, sender.clone());
             // Stamp `last_opened_at = now()` then reload connections so
             // the popover + welcome view re-sort with the fresh
@@ -148,6 +149,9 @@ impl App {
         // different connection would target a non-existent table.
         self.clear_closed_tabs_stack();
         if let Some(id) = self.connection_id.take() {
+            if crate::services::window_state::load().last_connection_id == Some(id) {
+                crate::services::window_state::set_last_connection_id(None);
+            }
             database_service::instance().close(id);
         }
         self.schema_buffer.set_text(crate::ui::editor::SQL_KEYWORDS);
@@ -197,8 +201,24 @@ impl App {
             ));
         self.prune_connection_organization(sender.clone());
         if !self.connected {
-            self.show_welcome_page(sender);
+            self.show_welcome_page(sender.clone());
+            self.restore_last_connection(connections, sender);
+        }
+    }
+
+    fn restore_last_connection(&mut self, connections: &[SavedConnection], sender: ComponentSender<Self>) {
+        if !crate::services::window_state::take_session_restore_turn() {
+            return;
         }
+        let last = crate::services::window_state::load().last_connection_id;
+        let available: Vec<Uuid> = connections.iter().map(|saved| saved.id).collect();
+        let Some(id) = crate::services::window_state::connection_id_to_restore(last, &available) else {
+            return;
+        };
+        let Some(saved) = connections.iter().find(|saved| saved.id == id).cloned() else {
+            return;
+        };
+        self.on_open_saved(saved, sender);
     }
 
     pub(super) fn on_poll_health(&mut self) {
@@ -538,6 +558,9 @@ fn execute_delete_connection(id: Uuid, sender: ComponentSender<App>) {
                 let _ = tablepro_storage::delete_password(id).await;
                 let _ = tablepro_storage::delete_ssh_password(id).await;
                 let _ = tablepro_storage::delete_ssh_passphrase(id).await;
+                if crate::services::window_state::load().last_connection_id == Some(id) {
+                    crate::services::window_state::set_last_connection_id(None);
+                }
                 sender_clone.input(AppMsg::ReloadConnections);
             })
             .drop_on_shutdown()

linux/crates/app/src/ui/app/init_css.rs

@@ -53,7 +53,17 @@ pub(super) fn install_pending_change_css() {
             }\
             .tp-row-leftmost-error-flash {\
                 animation: tp-flash-error 1.8s ease-out;\
-            }",
+            }\
+            .tp-env-swatch {\
+                min-width: 6px;\
+                border-radius: 3px;\
+                margin-top: 8px;\
+                margin-bottom: 8px;\
+            }\
+            .tp-env-local { background-color: @success_color; }\
+            .tp-env-dev { background-color: @accent_color; }\
+            .tp-env-staging { background-color: @warning_color; }\
+            .tp-env-prod { background-color: @error_color; }",
         );
         gtk::style_context_add_provider_for_display(&display, &provider, gtk::STYLE_PROVIDER_PRIORITY_APPLICATION);
     }

linux/crates/app/src/ui/app/init_window.rs

@@ -173,11 +173,7 @@ pub(super) fn install_window_lifecycle(
         } else {
             (w.width(), w.height())
         };
-        crate::services::window_state::save(crate::services::window_state::WindowState {
-            width,
-            height,
-            maximized: w.is_maximized(),
-        });
+        crate::services::window_state::save_geometry(width, height, w.is_maximized());
         glib::Propagation::Proceed
     });
 

linux/crates/app/src/ui/connection_row.rs

@@ -3,7 +3,7 @@ use relm4::factory::{DynamicIndex, FactoryComponent, FactorySender};
 use relm4::{adw, gtk};
 use uuid::Uuid;
 
-use tablepro_core::AuthMode;
+use tablepro_core::{AuthMode, Environment};
 use tablepro_storage::{ConnectionOrganization, SavedConnection};
 
 /// What a row needs to render: the saved record plus its organisation
@@ -61,6 +61,15 @@ impl FactoryComponent for ConnectionRow {
             set_activatable: true,
             connect_activated => ConnectionRowMsg::Open,
 
+            add_prefix = &gtk::Box {
+                add_css_class: "tp-env-swatch",
+                add_css_class: environment_css_class(self.saved.environment),
+                set_valign: gtk::Align::Fill,
+                set_hexpand: false,
+                set_width_request: 6,
+                set_tooltip_text: Some(self.saved.environment.display_name()),
+            },
+
             add_prefix = &gtk::Button {
                 set_icon_name: if self.organization.favorite {
                     "starred-symbolic"
@@ -169,6 +178,15 @@ impl FactoryComponent for ConnectionRow {
     }
 }
 
+pub(crate) fn environment_css_class(environment: Environment) -> &'static str {
+    match environment {
+        Environment::Local => "tp-env-local",
+        Environment::Dev => "tp-env-dev",
+        Environment::Staging => "tp-env-staging",
+        Environment::Prod => "tp-env-prod",
+    }
+}
+
 fn subtitle_for(saved: &SavedConnection, organization: &ConnectionOrganization) -> String {
     let mut subtitle = endpoint_for(saved);
     if let Some(group) = organization.group.as_deref() {
@@ -260,4 +278,12 @@ mod tests {
             endpoint_for(&saved("sa", AuthMode::Password))
         );
     }
+
+    #[test]
+    fn each_environment_has_its_own_colour_class() {
+        assert_eq!(environment_css_class(Environment::Local), "tp-env-local");
+        assert_eq!(environment_css_class(Environment::Dev), "tp-env-dev");
+        assert_eq!(environment_css_class(Environment::Staging), "tp-env-staging");
+        assert_eq!(environment_css_class(Environment::Prod), "tp-env-prod");
+    }
 }

linux/crates/policy/src/guard.rs

@@ -471,13 +471,9 @@ impl PolicyGuard {
         let Err(error) = result else {
             return Ok(());
         };
-        if self.ctx.principal.is_agent() {
-            return Err(DriverError::PolicyDenied(format!(
-                "operation denied because audit recording failed: {error}"
-            )));
-        }
-        tracing::warn!(error = %error, "audit outcome could not be persisted");
-        Ok(())
+        Err(DriverError::PolicyDenied(format!(
+            "operation denied because audit recording failed: {error}"
+        )))
     }
 
     fn handle_read_audit_failure(&self, result: Result<(), AuditError>) -> Result<(), DriverError> {

linux/crates/policy/src/guard_tests_audit.rs

@@ -432,3 +432,74 @@ async fn null_sink_denies_production_write() {
 
     assert_eq!(executes.load(Ordering::SeqCst), 0);
 }
+
+#[tokio::test]
+async fn human_policy_deny_fails_closed_when_outcome_cannot_be_recorded() {
+    let executes = Arc::new(AtomicUsize::new(0));
+    let mut ctx = context(
+        Principal::human_gui(),
+        Environment::Local,
+        PolicyConfig::default(),
+        Arc::new(AutoApproveSink),
+        Arc::new(SequenceAuditSink::new(vec![AuditRecordPhase::Outcome])),
+        Arc::new(AuditState::new()),
+    );
+    ctx.read_only = true;
+    let guard = PolicyGuard::new(connection(executes.clone(), Arc::new(AtomicUsize::new(0))), ctx);
+
+    let error = guard
+        .execute("INSERT INTO jobs(id) VALUES (1)")
+        .await
+        .expect_err("unaudited deny must fail closed");
+
+    assert!(error.to_string().contains("audit recording failed"));
+    assert_eq!(executes.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn human_approval_deny_fails_closed_when_outcome_cannot_be_recorded() {
+    let executes = Arc::new(AtomicUsize::new(0));
+    let guard = PolicyGuard::new(
+        connection(executes.clone(), Arc::new(AtomicUsize::new(0))),
+        context(
+            Principal::human_gui(),
+            Environment::Prod,
+            PolicyConfig::default(),
+            Arc::new(DenyApprovalSink),
+            Arc::new(SequenceAuditSink::new(vec![AuditRecordPhase::Outcome])),
+            Arc::new(AuditState::new()),
+        ),
+    );
+
+    let error = guard
+        .execute("INSERT INTO jobs(id) VALUES (1)")
+        .await
+        .expect_err("unaudited approval deny must fail closed");
+
+    assert!(error.to_string().contains("audit recording failed"));
+    assert_eq!(executes.load(Ordering::SeqCst), 0);
+}
+
+#[tokio::test]
+async fn human_policy_deny_keeps_the_policy_message_when_audit_succeeds() {
+    let executes = Arc::new(AtomicUsize::new(0));
+    let mut ctx = context(
+        Principal::human_gui(),
+        Environment::Local,
+        PolicyConfig::default(),
+        Arc::new(AutoApproveSink),
+        Arc::new(SequenceAuditSink::new(vec![])),
+        Arc::new(AuditState::new()),
+    );
+    ctx.read_only = true;
+    let guard = PolicyGuard::new(connection(executes.clone(), Arc::new(AtomicUsize::new(0))), ctx);
+
+    let error = guard
+        .execute("INSERT INTO jobs(id) VALUES (1)")
+        .await
+        .expect_err("read-only write must be denied");
+
+    assert!(error.to_string().contains("read-only"));
+    assert!(!error.to_string().contains("audit recording failed"));
+    assert_eq!(executes.load(Ordering::SeqCst), 0);
+}