fix(app): no-cache Unavailable crypto + per-account notify dedup + cancellable pause + deep-link scheme

V5-P2-1 / C5-P2-2: KeystoreCryptoProvider no longer caches the
CryptoResolution::Unavailable verdict (a transient keychain-locked /
missing-key condition). It caches only the stable Plaintext + Suite
verdicts; Unavailable is returned without memoizing so the next op
re-attempts the unwrap once the keychain unlocks. Fail-closed is
preserved.

V5-P2-2 / C5-P2-4: tray notification dedup is now per-account
(Mutex<Option<HashMap<AccountId, NotifyState>>>); account_id is threaded
from the assembly event bridge into apply_state/notify_for_state so
first_sync_notified + last_error_code are per account (one account's
first-sync toast no longer silences another's; cross-account errors are
no longer suppressed).

C5-P2-1: the timed-pause auto-resume timer is now cancellable via a
per-account pause-generation token on AppState. A newer pause/resume
bumps the generation; the detached timer auto-resumes only if the token
still matches, so a pause(None) issued before the old timer fires is no
longer clobbered.

C5-P2-3: declare the `driven` scheme under
plugins.deep-link.desktop.schemes in tauri.conf.json and drain any
cold-start deep link via app.deep_link().get_current() in setup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CyiRqk2DVwmJjEu5gcD1m

Author: pmaxhogan

src-tauri/src/commands/sync.rs

@@ -10,10 +10,10 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use serde::{Deserialize, Serialize};
-use tauri::State;
+use tauri::{AppHandle, Manager, State};
 
 use driven_core::orchestrator::{Orchestrator, TickSource};
-use driven_core::types::{OrchestratorState, SourceId};
+use driven_core::types::{AccountId, OrchestratorState, SourceId};
 
 use crate::app_state::AppState;
 use crate::commands::{CommandError, CommandResult};
@@ -90,38 +90,56 @@ pub async fn sync_now(
 /// `duration_secs = Some` is a timed pause (e.g. the tray "Pause for 30m");
 /// `None` is pause-until-manual-resume. Sets the manual-pause signal on every
 /// account orchestrator (DESIGN s5.7: manual pause persists across restarts).
-/// For a timed pause, a detached timer flips the pause back off after the
-/// window. If the user manually resumes (or re-pauses) before the timer fires,
-/// the timer's `set_paused(false)` is a harmless idempotent re-assert of the
-/// already-cleared signal; a fresh `pause_sync(None)` after the timer is armed
-/// is NOT auto-cancelled here (an accepted V1 simplicity - the rare
-/// timed-then-indefinite race re-pauses on the next user action / restart,
-/// which loads the persisted manual-pause).
+///
+/// C5-P2-1: a timed pause spawns a CANCELLABLE auto-resume timer. Each
+/// pause/resume bumps a per-account pause "generation"; the timer captures the
+/// generation at arm time and only auto-resumes if it STILL matches when it
+/// wakes. So a later `pause_sync(None)` (indefinite) issued before the old
+/// timer fires bumps the generation and CANCELS the stale timer's auto-resume -
+/// the indefinite pause is no longer clobbered.
 #[tauri::command]
 pub async fn pause_sync(
+    app: AppHandle,
     state: State<'_, AppState>,
     duration_secs: Option<u64>,
 ) -> CommandResult<()> {
-    // Snapshot the orchestrator handles up front so the resume timer does not
-    // need to borrow `State` (which is not `'static`).
-    let orchestrators: Vec<Arc<dyn Orchestrator>> = state
+    // Snapshot (account_id, orchestrator) so the resume timer does not need to
+    // borrow `State` (which is not `'static`); bump each account's pause
+    // generation so any in-flight timer is superseded.
+    let entries: Vec<(AccountId, Arc<dyn Orchestrator>)> = state
         .accounts()
-        .map(|(_id, handle)| handle.orchestrator.clone())
+        .map(|(id, handle)| (*id, handle.orchestrator.clone()))
         .collect();
 
-    for orch in &orchestrators {
+    let mut tokens: Vec<(AccountId, Arc<dyn Orchestrator>, u64)> =
+        Vec::with_capacity(entries.len());
+    for (id, orch) in entries {
         orch.set_paused(true).await;
+        let token = state.bump_pause_generation(id);
+        tokens.push((id, orch, token));
     }
 
     if let Some(secs) = duration_secs {
         // Detached timed-resume: sleep the window, then clear the manual pause
-        // on each account. `tokio::time::sleep` (no FakeClock here - this is a
-        // real wall-clock UI affordance) keeps the task off the IPC path so the
+        // ONLY for accounts whose pause generation is unchanged (no newer
+        // pause/resume superseded this timer). `tokio::time::sleep` (real
+        // wall-clock UI affordance) keeps the task off the IPC path so the
         // command returns immediately.
         tauri::async_runtime::spawn(async move {
             tokio::time::sleep(Duration::from_secs(secs)).await;
-            for orch in &orchestrators {
-                orch.set_paused(false).await;
+            let Some(state) = app.try_state::<AppState>() else {
+                return;
+            };
+            for (id, orch, token) in &tokens {
+                if state.pause_generation_matches(*id, *token) {
+                    orch.set_paused(false).await;
+                } else {
+                    tracing::debug!(
+                        target: "driven::app::sync",
+                        account_id = %id,
+                        "timed-resume superseded by a newer pause/resume; not auto-resuming"
+                    );
+                }
             }
         });
     }
@@ -130,10 +148,15 @@ pub async fn pause_sync(
 }
 
 /// `resume_sync()` - clear the manual pause on every account (SPEC s11.3).
+///
+/// C5-P2-1: bumps each account's pause generation too, so an outstanding timed
+/// auto-resume timer for that account is cancelled (the manual resume already
+/// did its job; the stale timer must not later re-resume a fresh pause).
 #[tauri::command]
 pub async fn resume_sync(state: State<'_, AppState>) -> CommandResult<()> {
-    for (_id, handle) in state.accounts() {
+    for (id, handle) in state.accounts() {
         handle.orchestrator.set_paused(false).await;
+        let _ = state.bump_pause_generation(*id);
     }
     Ok(())
 }

src-tauri/src/crypto_provider_impl.rs

@@ -114,6 +114,17 @@ impl KeystoreCryptoProvider {
 
         let resolution = Arc::new(self.resolve_uncached(source_id));
 
+        // V5-P2-1 / C5-P2-2: cache ONLY the STABLE verdicts (Plaintext, Suite).
+        // Do NOT memoize `Unavailable`: it is a TRANSIENT condition (keychain /
+        // Secret-Service locked at autostart, a temporarily missing key). Caching
+        // it would strand an encrypted source as un-backupable until the app
+        // restarts, even after the keychain unlocks. Returning it WITHOUT caching
+        // makes the next op re-attempt the unwrap (fail-closed is preserved -
+        // the op still errors `crypto.key_missing` until the key is available).
+        if matches!(*resolution, CachedResolution::Unavailable) {
+            return resolution;
+        }
+
         // Store under the lock. A concurrent resolver for the same id may have
         // raced us; keep whichever landed first (both compute the same verdict
         // from the same immutable row + keystore, so either is correct).

src-tauri/src/tray.rs

@@ -26,9 +26,10 @@
 //! APPROXIMATES the yellow-with-`!` badge - no glyph is drawn into the tile.
 //! The state machine, tooltip text, and notification routing are all real.
 
+use std::collections::HashMap;
 use std::sync::Mutex;
 
-use driven_core::types::{ErrorCode, OrchestratorState, PauseReason};
+use driven_core::types::{AccountId, ErrorCode, OrchestratorState, PauseReason};
 use tauri::image::Image;
 use tauri::menu::{Menu, MenuBuilder, MenuItem};
 use tauri::tray::{MouseButton, MouseButtonState, TrayIconBuilder, TrayIconEvent};
@@ -274,10 +275,15 @@ fn tooltip_for_error(code: ErrorCode) -> String {
 // Notification dedup state
 // -----------------------------------------------------------------------------
 
-/// Module-level notification dedup state (DESIGN s117/s247): fire the
-/// first-sync-complete toast exactly once, and fire one error toast per
-/// ENTRY into an error code (not once per `StateChanged` event - the
-/// orchestrator broadcast can replay the current state after a `Lagged`).
+/// Per-account notification dedup state (DESIGN s117/s247): fire the
+/// first-sync-complete toast exactly once PER ACCOUNT, and fire one error toast
+/// per ENTRY into an error code PER ACCOUNT (not once per `StateChanged` event -
+/// the orchestrator broadcast can replay the current state after a `Lagged`).
+///
+/// V5-P2-2 / C5-P2-4: keyed per account so one account's first-sync toast does
+/// not silence another's, and an error on account B is not suppressed by the
+/// same code already toasted for account A.
+#[derive(Default)]
 struct NotifyState {
     /// True once a sync cycle has been observed running this process (so the
     /// next `Idle` transition is a genuine completion, not the boot `Idle`).
@@ -289,22 +295,17 @@ struct NotifyState {
     last_error_code: Option<ErrorCode>,
 }
 
-impl NotifyState {
-    const fn new() -> Self {
-        Self {
-            saw_active_cycle: false,
-            first_sync_notified: false,
-            last_error_code: None,
-        }
-    }
-}
-
-static NOTIFY: Mutex<NotifyState> = Mutex::new(NotifyState::new());
-
-/// Lock the dedup state, recovering a poisoned lock (HARD RULE: no panic on
-/// a poisoned mutex).
-fn notify_state() -> std::sync::MutexGuard<'static, NotifyState> {
-    NOTIFY.lock().unwrap_or_else(|e| e.into_inner())
+/// Process-global map of per-account dedup state. Keyed by [`AccountId`] so the
+/// dedup latches are independent across accounts (V5-P2-2).
+static NOTIFY: Mutex<Option<HashMap<AccountId, NotifyState>>> = Mutex::new(None);
+
+/// Run `f` against the dedup state for `account`, creating it on first use.
+/// Recovers a poisoned lock instead of panicking (HARD RULE).
+fn with_notify_state<R>(account: AccountId, f: impl FnOnce(&mut NotifyState) -> R) -> R {
+    let mut guard = NOTIFY.lock().unwrap_or_else(|e| e.into_inner());
+    let map = guard.get_or_insert_with(HashMap::new);
+    let entry = map.entry(account).or_default();
+    f(entry)
 }
 
 // -----------------------------------------------------------------------------
@@ -396,7 +397,7 @@ fn on_menu_event(app: &AppHandle, id: &str) {
             let Some(state) = app.try_state::<crate::app_state::AppState>() else {
                 return missing_state_err();
             };
-            crate::commands::sync::pause_sync(state, Some(30 * 60)).await
+            crate::commands::sync::pause_sync(app.clone(), state, Some(30 * 60)).await
         }),
         menu_id::RESUME => spawn_command(app, |app| async move {
             let Some(state) = app.try_state::<crate::app_state::AppState>() else {
@@ -479,7 +480,7 @@ fn navigate_hint(app: &AppHandle, route: &str) {
 /// Best-effort: a missing tray or a failed icon/tooltip set is logged, never
 /// panicked. `apply_state` returns `()` (the committed signature) so all
 /// errors are swallowed with a `tracing` line.
-pub fn apply_state(app: &AppHandle, state: OrchestratorState) {
+pub fn apply_state(app: &AppHandle, account_id: AccountId, state: OrchestratorState) {
     let icon = TrayIcon::for_state(&state);
 
     if let Some(tray) = app.tray_by_id(TRAY_ID) {
@@ -497,7 +498,7 @@ pub fn apply_state(app: &AppHandle, state: OrchestratorState) {
         tracing::warn!(target: TARGET, "tray {TRAY_ID} not found; cannot apply state");
     }
 
-    notify_for_state(app, &state);
+    notify_for_state(app, account_id, &state);
 }
 
 /// Raise the DESIGN s117/s247 OS notifications for a state transition.
@@ -509,7 +510,7 @@ pub fn apply_state(app: &AppHandle, state: OrchestratorState) {
 ///   case (`auth.invalid_grant` / `auth.consent_required`) is deliberately
 ///   skipped here - it is covered by [`notify_needs_reauth`], which the shell
 ///   calls with the account + email the state cannot carry.
-fn notify_for_state(app: &AppHandle, state: &OrchestratorState) {
+fn notify_for_state(app: &AppHandle, account_id: AccountId, state: &OrchestratorState) {
     match state {
         OrchestratorState::PowerCheck
         | OrchestratorState::Scanning { .. }
@@ -518,19 +519,23 @@ fn notify_for_state(app: &AppHandle, state: &OrchestratorState) {
         | OrchestratorState::Verifying { .. }
         | OrchestratorState::Backoff { .. } => {
             // A cycle is underway; the next Idle is a genuine completion.
-            let mut s = notify_state();
-            s.saw_active_cycle = true;
-            // Leaving any error state clears the dedup latch so a recurrence
-            // notifies again.
-            s.last_error_code = None;
+            with_notify_state(account_id, |s| {
+                s.saw_active_cycle = true;
+                // Leaving any error state clears the dedup latch so a recurrence
+                // notifies again.
+                s.last_error_code = None;
+            });
         }
         OrchestratorState::Idle { .. } => {
-            let mut s = notify_state();
-            s.last_error_code = None;
-            let should_fire = s.saw_active_cycle && !s.first_sync_notified;
+            let should_fire = with_notify_state(account_id, |s| {
+                s.last_error_code = None;
+                let fire = s.saw_active_cycle && !s.first_sync_notified;
+                if fire {
+                    s.first_sync_notified = true;
+                }
+                fire
+            });
             if should_fire {
-                s.first_sync_notified = true;
-                drop(s);
                 show_notification(
                     app,
                     rust_i18n::t!("notifications.first_sync_complete.title").into_owned(),
@@ -541,8 +546,9 @@ fn notify_for_state(app: &AppHandle, state: &OrchestratorState) {
         OrchestratorState::Paused { .. } => {
             // Pauses (battery / metered / network) are icon+tooltip only, no
             // toast on every blip (DESIGN s117/s247).
-            let mut s = notify_state();
-            s.last_error_code = None;
+            with_notify_state(account_id, |s| {
+                s.last_error_code = None;
+            });
         }
         OrchestratorState::Error { detail } => {
             // Reauth is handled by notify_needs_reauth (needs account/email).
@@ -557,18 +563,22 @@ fn notify_for_state(app: &AppHandle, state: &OrchestratorState) {
             if TrayIcon::for_state(state) != TrayIcon::Error {
                 return;
             }
-            let mut s = notify_state();
-            if s.last_error_code == Some(detail.code) {
-                return; // already toasted this error; suppress the replay
+            let should_fire = with_notify_state(account_id, |s| {
+                if s.last_error_code == Some(detail.code) {
+                    false // already toasted this error; suppress the replay
+                } else {
+                    s.last_error_code = Some(detail.code);
+                    true
+                }
+            });
+            if should_fire {
+                let body = error_notification_body(detail.code);
+                show_notification(
+                    app,
+                    rust_i18n::t!("notifications.error.title").into_owned(),
+                    body,
+                );
             }
-            s.last_error_code = Some(detail.code);
-            drop(s);
-            let body = error_notification_body(detail.code);
-            show_notification(
-                app,
-                rust_i18n::t!("notifications.error.title").into_owned(),
-                body,
-            );
         }
     }
 }

src-tauri/tauri.conf.json

@@ -31,6 +31,13 @@
       "csp": "default-src 'self'; img-src 'self' data:; connect-src 'self' ipc: tauri:"
     }
   },
+  "plugins": {
+    "deep-link": {
+      "desktop": {
+        "schemes": ["driven"]
+      }
+    }
+  },
   "bundle": {
     "active": true,
     "createUpdaterArtifacts": true,