Isolate development builds from the release installation

[fastducduc]

The Development configuration now produces nvALT Development.app, which runs alongside nvALT.app with its own settings and default notes library.

• Separate preferences, default notes, support/backups, caches, external-editor temporary folders, and encryption keychain service. Development skips automatic legacy database import.
• Separate bundle identity, URL schemes, Services name, and ODB signature, plus a DEV Dock badge. The release configuration retains its existing identity and locations.
• Development adds an nvALT Development subfolder inside custom backup destinations. This separates histories even when a copied library retains its UUID.
• CI builds both configurations, validates their identities, and packages the release app. Active desktop test launchers use the renamed Development app.

Use a separate custom notes folder for each app; simultaneous writes to one library are not coordinated. Import source files or restore a backup into the development folder to try existing notes.

Validation on macOS 26.5.2 (25F84), Xcode 26.6 (17F113): both unsigned Intel configurations build, both identity checks and release archive validation pass, and all 23 CI unit tests pass. Complete applications passed 252 isolation/custom-backup assertions across concurrent launches and relaunches, including a rerun after the final correction. The backup store passed 390 assertions, and the coordinator suite passed. Validation and content screenshots.

The required desktop suites retain their documented baseline failures: the Multiple Windows suite exits after opening the replacement library, and the regression suite stops at the FuzzySearch/UI active-browser assertion. Later aggregate tests did not run after the first failure.

Three rounds of six code-writing subagent reviews are complete. All four P2 findings were addressed after their respective rounds: repeated wiki-link prefix lookup, shared custom-backup histories, first-use namespace creation, and selected-parent canonicalization. These are engineering perspectives inspired by the requested reviewers, not reviews by the named people. Review records · Round 1 · Round 2 · Round 3.

[fastducduc]

Round 1 of 3 — six independent code-writing reviews

Reviewed 2dbfd46. These are subagent engineering perspectives inspired by the requested reviewers, not reviews by the named people.

• Ousterhout: no actionable finding. Four compiled probes checked configuration/runtime agreement, copied-bundle identity, and default-directory failures. Evidence.
• Luu — P2: each wiki link repeated bundle metadata lookup and URL-prefix creation. Dense 10,000-link scans increased from 27.5 ms to 51.5 ms on the background analysis queue. Report and runnable comparison.
• Torvalds: no actionable finding. Native bundle/signature and localization checks passed across both architectures; the release creator signature stayed unchanged. Evidence.
• Kingsbury — P2: copied libraries retained the same UUID across independent preference domains. Selecting one custom backup parent made both resolve to the same backup directory, including after relaunch. Nine process checks confirmed the collision and the same-domain control. Evidence.
• Contrarian UX: no actionable finding. Both flavors passed 34 native link-generation/routing checks. Explicit stable URL aliases remain OS-dispatched targets; the probe makes no runtime menu-label claim. Evidence.
• Contrarian platform: no actionable finding. Build/archive settings, CI failure propagation, actual ZIP packaging, and metadata negative controls passed. Evidence.

Addressed before round 2 in 3a3dc4f: wiki scans now resolve the prefix once, when the first valid link appears. Development now adds an nvALT Development subfolder within custom backup parents, separating copied-UUID histories. The active native-dependencies fixture now expects its app's link scheme.

The corrected destination fixture, backup coordinator, 63 source-analysis checks, and 2,060 Org-link checks passed. Separate original-startup integration also passed 138 in-app checks across concurrent first launches and relaunches. Validation and content screenshots. Both required desktop suites retain their recorded baseline failures. Individual reports describe test limits.

[fastducduc]

Round 2 of 3 — six independent code-writing reviews

Reviewed 3a3dc4f.

• Ousterhout — P2: first use of a custom development backup parent failed before snapshot capture because the namespace folder did not exist. Native preflight checks covered manual/automatic starts, unavailable folders, invalid bookmarks, and lazy wiki-prefix behavior (352 assertions). Evidence.
• Luu: no remaining performance finding. At 10,000 links, Development scan medians were 26.391 / 48.381 / 26.485 ms for original / first implementation / corrected code. Release results were similar. Comparison.
• Torvalds: no new finding. Eight native processes passed 54,017 checks each over Unicode ranges, URL escaping, and scheme selection. Hoisting preserved exact link ranges and contents. Evidence.
• Kingsbury: no new finding. Nine process commands preserved independent destinations/settings through relaunch. The actual store passed 61 retention checks; pruning either flavor preserved sibling snapshot IDs and bytes. Namespace parents were prepared explicitly, so this did not cover first-use creation. Evidence.
• Contrarian UX: no new finding. Each flavor passed 72 checks for Unicode/empty note titles, command routing, copied UUID links, and documented paths. Evidence.
• Contrarian platform: no new finding. Both architectures/flavors passed 80 total assertions: runtime metadata agreed with built apps, and an unavailable captured root blocked writes, retention, and deletion without recreating it. Evidence.

Addressed before round 3 in 47d18f4: the coordinator captures the selected parent's identity. The worker then creates the fixed Development namespace and UUID folder below that pinned parent. Publication, retention, and deletion retain the unavailable/replaced-root checks. This avoids creating directories merely to display the destination.

Both configurations rebuild successfully. The maintained backup-store suite passed 390 assertions, including first-use namespace creation, private directory permissions, separate deletion for a copied UUID, rejected invalid namespaces, and unavailable parents. The backup coordinator suite passed. Round 3 will check the complete custom-destination path and the corrected worker contract.

[fastducduc]

Round 3 of 3 — six independent code-writing reviews

Reviewed 47d18f4. These are subagent engineering perspectives inspired by the requested reviewers, not reviews by the named people.

• Ousterhout: no new finding. Complete applications passed 252 assertions across concurrent first launches and relaunches, including first manual and automatic custom backups with an absent Development namespace and decoded snapshot payloads. Evidence.
• Luu: no performance finding. All traced namespace filesystem operations ran on the worker; the main timer fired 20 times while namespace synchronization was held. An existing namespace adds one child open and close. This is a bounded worker-path check, not an application-latency benchmark. Evidence.
• Torvalds — P2: the coordinator canonicalized the namespace together with the selected custom parent before deriving the parent's identity. Canonicalize only the selected parent, then append the namespace so the worker validates that child. This finding follows source data flow; no redirection fixture was constructed. Separate descriptor checks passed 1,603 assertions per architecture with no leak. Finding and verification.
• Kingsbury: no new finding. Five reopened store processes passed 169 checks. First publication created the absent namespace; interleaved retention and deletion preserved every peer snapshot identifier and archive byte for a copied UUID. Evidence.
• Contrarian UX: no new finding. Ten isolated processes passed 74 assertions. Development preference changes, browser-state changes, and a domain reset left Release's saved state unchanged. Evidence.
• Contrarian platform: no new finding. Both architectures and metadata layouts passed 444 assertions. Absent or stale selected roots blocked publication, retention, and deletion before namespace creation; existing snapshot bytes stayed unchanged. Evidence.

Addressed after this round in 9a69037: canonicalize the selected backup parent before appending the Development namespace. The reviewer verified both publication and deletion paths from source. Release behavior is unchanged.

Both Intel configurations rebuilt and passed identity checks; the release ZIP passed its archive check. The backup store passed 390 assertions, and the coordinator suite passed. The complete-app custom-backup test passed all 252 assertions again after the correction. Post-fix validation.

All three rounds and 18 reviews are complete. All four P2 findings were addressed after their respective rounds. Validation and known desktop-suite limits.