fix: the UI kept reporting successes that never happened

[Johnserf-Seed]

An audit of every falsifiable claim in the app — the code, the settings, the docs — turned up almost no crashes. Nearly every real defect was the same shape:

something reported a success that had not happened, or asked for a confirmation that could not be given.

And the tests were pinning the lies. loopback_pairing_mutually_trusts…, untrusted_text_…_is_dropped_but_acked, and "migrates trust to the new key when the codes match" each named and guarded the broken behaviour. A green suite meant nothing.

---

The security ones

Pairing granted trust inside the handshake, before any human compared the SAS — and only the host could see that SAS. The joiner got it back from join_by_code and threw it away, while the host's screen said "compare this with the other device". A code only one side can read is not a check; it is a formality that ends in a yes.

Both ends now show the same SAS, and trust is recorded only once a person confirms it — through the same set_trusted path the trust circle uses, so a paired device is trusted and auto-accepting, exactly like one dragged into the ring, and the two notions of trust can no longer drift apart. trust::grant() is deleted outright: leaving a backend-side "trust without asking" helper lying around is leaving a door for someone to wire it back up.

The fingerprint-changed alert offered to "re-verify and restore trust" by dialling the suspect key and showing the SAS that handshake produced — while the other device displayed nothing at all. There was no second number to compare, so pressing they match migrated trust onto the very key the alert existed to make you suspicious of. That flow is gone; the alert now reports, and offers the two honest exits (delete the old record, or pair with the new key like the new device it is).

It also fired on a name match — and the default device name is the machine's hostname, so two un-renamed installs raised an impersonation alarm at each other.

You could file yourself as a peer by dialling your own address, and a self-entry is uniquely un-removable: discovery drops its own announces, so it can never be expired away. Refused on every path, filtered from the device list, and evicted from the trust store at startup.

Things that could not be deleted

forget_device — "delete" used to clear the trust row while the peer sat untouched in the manual address table, back on the very next list, with nothing anywhere able to take it out.

Quiet failures

• A checksum mismatch deleted the whole batch, verified siblings included, while the message spoke of one file.
• Quick text from an untrusted sender was dropped and ACKed, so send_text — whose contract is "resolves only once the peer confirms it received it" — resolved successfully for a message thrown away on arrival.
• Transfer failures were silent; only "the peer declined" toasted, while success got a toast and an OS notification.
• Batch-forward swallowed every failure and reported "forwarded N items".
• The backend's pause is bounded — it un-parks itself after 50s and emits transfer_resumed. Nothing listened, so the row read "Paused" while the progress bar crept along underneath it.
• TransferDetail fell back to the backend's raw English diagnostic, local absolute paths and all.

Controls that did nothing

• "Open the folder when done" — persisted, commanded, exported in the diagnostics bundle, and acted on by nothing. It defaults ON.
• "History retention" and "Effective network" were wired to nothing. Retention is now real; the SSID dropdown is removed (its only honest implementation is a Windows-only WLAN call that would be silently dead elsewhere — a new lie for an old one).
• Conflict policy "ask" never asked under auto-accept — which, under the default settings, is the only path.

Browser share

A live share is files being served over HTTP on your LAN. Closing the panel doesn't stop it (deliberately — a link you handed someone shouldn't die because you closed the panel you copied it from), but reopening minted a new share instead of adopting the live one, so the only Stop button in the app could never reach the old one again. A forgotten share went on serving: invisible, and unstoppable.

Also: "LAN only" was a claim, not a rule (now enforced per request, in middleware); and a single-file share skipped the branded landing page — in the most common case there is.

Cross-platform

keyring was compiled with windows-native and nothing else, so on macOS and Linux it fell back to keyring's in-memory mock store: a brand-new device identity on every launch, silently, invalidating every fingerprint every peer had pinned.

The repo's own identity_is_stable_across_loads proves that in one second. It had simply never been run anywhere but Windows — which is why CI now runs the backend suite on Windows, macOS and Linux, with a real dbus + gnome-keyring on the Linux job so the identity tests can't "pass" against nothing.

Plus: bundle.targets was hard-coded to nsis (no macOS/Linux artifact at all, and lanbeam:// could never be registered on macOS); Cargo metadata was still authors = ["you"].

Also

• Data and logs move out of %LOCALAPPDATA%\app.lanbeam.desktop\ into a product-named folder — with a real migration, so the trust store comes along.
• A <select> is a native widget and macOS means it: WKWebView draws an Aqua popup and ignores the border/background/radius, so every dropdown looked lifted from another program. Chromium honours them — which is exactly why it was invisible from the machine this was built on.
• Interface scale (80–150%), applied to the webview and to the window's minimum size: a zoom shrinks the CSS viewport, so a floor that ignored it would let you scale the UI off the edge of its own window.
• Status dots go through one place — colour is the decision, fill is presence. "Away" used to paint over "trusted", so a sleeping laptop you trust looked identical to a stranger, on the one page whose job is showing trust.

---

Verification

Rust 266 tests (250 unit + 13 integration + the new ones) · clippy 0 · fmt clean
Frontend 376 tests / 29 files · tsc clean · biome clean · build passes

Notes for review

• The code is one commit. store.ts, commands.rs, transfer.rs, lib.rs and both i18n files are touched by nearly every fix; splitting them into "atomic" commits would take hunk-level surgery and produce intermediate trees that don't compile and were never green. Inventing a history that never existed is worse than one honest commit.
• tauri dev must be restarted — the Rust side changed. On first launch the app migrates settings.json / trusted.json to the new folder and logs what it moved, and evicts any self-record from the trust store.
• Deliberately not done: the updater (blocked on a release server + signing keys) and code signing / notarisation.