Audit fixes for R6.6/R6.7/R6.8: 4 real bugs + 3 tests that could not fail

[dovvnloading]

A 6-dimension adversarial audit of the last four shipped commits (autosave, crash recovery, PNG export, npm audit fix) produced 24 findings. Each was handed to an independent skeptic told to refute it; 14 survived. This fixes every survivor that was a real defect.

Every fix is mutation-tested: a harness reverts each one and confirms the test claiming to cover it actually fails. 14/14 mutants killed.

Export PNG (R6.8)

The exported image silently depended on the viewer's live zoom. Node views derive collapse from React Flow's live store zoom (lodCollapsed = zoom < 0.5), so a user zoomed out to see their whole graph — the natural thing to do right before exporting it — got a PNG of title bars with no content. Overriding the clone's CSS transform can't fix that: the clone comes from DOM React already rendered collapsed. Now sets the live viewport to the export framing, waits a double-rAF for the repaint, captures, and restores the user's viewport in a finally. Cost is one frame of visible movement.

No error handling at all. toPng genuinely rejects when a node's image asset is unreachable (a state ImageNodeView already renders a placeholder for), and both call sites void the promise — so the button silently did nothing, with no way to tell a failed export from a slow one. Now caught and logged, matching ImageNodeView's own handleExportImage.

Output wasn't the documented size — 1920×devicePixelRatio (2880×1620 on a 150%-scaled Windows display). pixelRatio pinned to 1.

Autosave (R6.6)

Deleting the currently-open chat silently ended autosave protection. The change-guard compared content only, and deleting a row leaves the document's digest unchanged — so every later tick short-circuited and the recovery path was unreachable. The guard now compares chat_id too, and deleteChat clears the dangling current_chat_id.

The docstring described a mechanism that didn't exist. It claimed the guard covered "auto OR manual" via "register_autosave's own last_hash argument" — there was no such argument, and no manual path could reach the cell. Consequence: every manual Save and every loadChat was followed by a byte-identical rewrite that bumped updated_at and re-sorted the Chat Library. The cell is now genuinely shared — owned by register_chat_library, seeded by saveChat/loadChat, invalidated by deleteChat/newChat, and passed to register_autosave as a real argument.

Tick loop had no exception guard. Defence in depth, not a known bug — the audit walked every unguarded line and found no reachable escape today. But the task is never awaited and holds a strong reference for the process's life, so an escape would kill autosave with no signal anywhere.

Crash recovery (R6.7)

• configure_logging replaced basicConfig without a StreamHandler, so python graphlink_desktop.py with a missing SPA build printed nothing and exited 1. stderr is back alongside the file handler.
• mark_clean_exit unlinked unconditionally, so two concurrent instances corrupted each other's sentinel and a later crash went unreported. Only the pid that wrote it may remove it. The other half — a false crash notice while a sibling is live — is documented as knowingly unfixed: it needs a pid-liveness check with no safe portable form (os.kill signal-0 is POSIX-only; on Windows it would terminate the other process).
• install_exception_handlers latched its idempotency flag before doing the work, so one failure disabled the hooks permanently with no retry. Set last now, matching configure_logging.

Three tests that looked like coverage but weren't

All verified by mutation:

• test_autosave_tick_never_regenerates_an_existing_chats_title changed only a code node between ticks, which _resolve_seed_message ignores — so the regenerated title was byte-identical and the test passed whether or not the implementation preserved it.
• No autosave test observed the bus: all three await bus.publish(...) calls could be replaced with pass and the file stayed green.
• commands.test.ts asserted expect(() => run()).not.toThrow() on a voided async call — which holds for every implementation, including run: () => {}.

Verification

2370 pytest (+12), 1053 vitest (+4), tsc/eslint/build/codegen clean, Qt burn-down gate unchanged at 152.

Also live-driven against a scratch copy of a real ~/.graphlink/chats.db: 5 real legacy chats (up to 15 nodes) load and then tick without a rewrite, confirming the seeded digest survives a real load/save round trip — the one thing the unit tests couldn't prove. Real chats.db verified untouched.

Knowingly not fixed

An autosave tick holds the same mutation_guard user intents use, so a manual Save landing in that window is dropped with an "already in progress" warning. Verified real but measured at ~10-50ms once per 30s, with no data loss (the tick writes the same document). Fixing it properly means an awaited handoff rather than a reject — out of scope here.