feature fixes

.github/workflows/ci.yml

@@ -52,14 +52,27 @@ jobs:
       - name: Stub the build inputs
         run: mkdir -p dist && touch dist/index.html
 
-      # Every target except `no_write_on_open`, which is skipped rather than run and failing.
-      # That suite checks the promise the whole project rests on, that the editor writes nothing
-      # the user did not edit, and it checks it against a real git repository rather than a
-      # TempDir. The repository is hand built at a hardcoded path under /tmp, so there is nothing
-      # here to create it and macOS reaps it after three days without access. It is not skipped
-      # because it is unimportant. It is skipped because it currently cannot run anywhere, and a
-      # CI that is permanently red says less than one that is green about a named subset.
-      # Making the fixture reproducible is tracked in the issue.
+      # Every target except `no_write_on_open`, which gets the step below to itself.
       - name: Test
         working-directory: src-tauri
         run: cargo test --lib --bins --test fs --test fts5 --test watch --test watch_payload
+
+      # The suite that checks the promise the whole project rests on, that the editor writes
+      # nothing the user did not edit. It runs against a real git repository rather than against a
+      # TempDir, because the evidence it wants is a folder somebody could plausibly have opened
+      # coming back from `git status` with no lines in it, and a bag of files in a TempDir cannot
+      # say that. The repository used to be built by hand at a fixed path under /tmp, which meant
+      # the suite ran on one machine until macOS reaped the folder and then ran nowhere, and that
+      # is why it spent a while excluded from this file. It is now built from scratch by
+      # `tests/support/notes_repo.rs` on the first test that asks for it: the documents are copied
+      # out of the markdown corpus, the vendored node_modules is generated, and a git init and one
+      # commit turn the result into the oracle. Nothing has to exist on the runner beforehand
+      # except git itself, and the suite says so plainly if git is missing rather than passing on a
+      # folder nobody checked.
+      #
+      # It gets its own step because the tests share that one folder and several of them mutate it,
+      # so they have to run one at a time. Passing `--test-threads=1` to the command above would
+      # slow the other suites to the same pace for no reason.
+      - name: Test no_write_on_open
+        working-directory: src-tauri
+        run: cargo test --test no_write_on_open -- --test-threads=1

.github/workflows/release.yml

@@ -81,41 +81,16 @@ jobs:
 
   build:
     needs: prepare
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: macos-26
-            args: "--target universal-apple-darwin --config src-tauri/tauri.release.conf.json"
-            rust-targets: "aarch64-apple-darwin,x86_64-apple-darwin"
-          # Ubuntu 22.04 is the glibc baseline: the bundle will not run on anything older than the
-          # glibc it was linked against, so build on the oldest supported.
-          - os: ubuntu-22.04
-            args: "--config src-tauri/tauri.release.conf.json"
-            rust-targets: ""
-    runs-on: ${{ matrix.os }}
+    # One runner, no matrix. The app is macOS only, and a universal build links the aarch64 and
+    # x86_64 slices into a single bundle, so there is exactly one thing to build and nothing for a
+    # matrix to vary. A matrix of one is where the Linux row survived long after the app stopped
+    # shipping on Linux; if a second target ever arrives, putting the matrix back is a small change.
+    runs-on: macos-26
     steps:
       - uses: actions/checkout@v7
         with:
           ref: ${{ needs.prepare.outputs.tag }}
 
-      - name: Install Linux dependencies
-        if: startsWith(matrix.os, 'ubuntu')
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libwebkit2gtk-4.1-dev \
-            libgtk-3-dev \
-            libayatana-appindicator3-dev \
-            librsvg2-dev \
-            patchelf \
-            libxdo-dev \
-            libssl-dev \
-            build-essential \
-            curl \
-            wget \
-            file
-
       - uses: actions/setup-node@v6
         with:
           node-version: 26
@@ -127,7 +102,7 @@ jobs:
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
         with:
-          targets: ${{ matrix.rust-targets }}
+          targets: aarch64-apple-darwin,x86_64-apple-darwin
 
       - uses: swatinem/rust-cache@v2
         with:
@@ -144,7 +119,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
           releaseId: ${{ needs.prepare.outputs.release_id }}
-          args: ${{ matrix.args }}
+          args: "--target universal-apple-darwin --config src-tauri/tauri.release.conf.json"
 
   publish:
     needs: [prepare, build]
@@ -159,7 +134,14 @@ jobs:
           gh release download "$TAG" --repo "$REPO" --pattern latest.json --output latest.json --clobber
           echo "Platforms in latest.json:"
           jq '.platforms | keys' latest.json
-          for key in darwin-aarch64 darwin-x86_64 linux-x86_64; do
+          # A universal build emits one .app.tar.gz, but tauri-action writes it into latest.json
+          # under both darwin-aarch64 and darwin-x86_64, pointing them at the same file and the same
+          # signature. It has to: an installed copy asks the manifest for the architecture it is
+          # running on and never for the universal key, so a manifest that only carried
+          # darwin-universal would offer nobody an update. Those two keys are the whole manifest for
+          # this app, and a release that is missing either one is a release half the users cannot
+          # take.
+          for key in darwin-aarch64 darwin-x86_64; do
             if ! jq -e ".platforms[\"$key\"].url" latest.json > /dev/null; then
               echo "::error::latest.json is missing platform '$key': refusing to publish a partial update manifest. Re-run the release."
               exit 1