Merge: recover a damaged catalog, and capture a crash locally

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/darkroom-android/Cargo.toml

@@ -19,6 +19,10 @@ dr-ui.workspace = true
 # For `account::set_data_dir`: only the platform entry point knows where Android
 # lets this app keep files, and it must be set before any store is opened.
 dr-sync.workspace = true
+# For the panic hook, and for `crash::set_state_dir` — Android has no XDG
+# directories, so the entry point is the only place that knows where a crash
+# record may be written.
+dr-plat.workspace = true
 # Directly, not just through dr-ui: `android_main` takes an `AndroidApp` and
 # calls `slint::android::init`, both of which come from this crate. The backend
 # feature comes from dr-ui's target-specific dependency.

apps/darkroom-android/src/lib.rs

@@ -39,9 +39,18 @@ fn android_main(app: slint::android::AndroidApp) {
     // worker thread that panics is invisible: the process survives, the
     // channel it was writing to closes, and the UI reports only that
     // something "failed unexpectedly" with no way to find out what.
-    std::panic::set_hook(Box::new(|info| {
-        log::error!("panic: {info}");
-    }));
+    //
+    // This used to be one `log::error!` of the raw panic, which had two
+    // problems: logcat is a ring buffer that is gone by the time a user
+    // reports anything, and the raw message can carry a document URI naming
+    // their library or a credential a library interpolated into an error
+    // (NFR-SEC-2). `dr_plat::crash` writes a redacted record to disk and logs
+    // the redacted form. Nothing uploads it.
+    //
+    // Before `set_state_dir` on purpose: the hook resolves the directory when
+    // it fires, so installing it first covers the startup below rather than
+    // leaving it uncovered.
+    dr_plat::crash::install(env!("CARGO_PKG_VERSION"));
 
     log::info!("DarkRoom v{}", env!("CARGO_PKG_VERSION"));
 
@@ -54,6 +63,10 @@ fn android_main(app: slint::android::AndroidApp) {
     match app.internal_data_path() {
         Some(dir) => {
             log::info!("data dir: {}", dir.display());
+            // Crash records go beside the account data rather than under it:
+            // both are app-private and neither is a cache, which is the whole
+            // distinction that matters here (see `dr_plat::crash::state_dir`).
+            dr_plat::crash::set_state_dir(dir.join("state"));
             dr_sync::account::set_data_dir(dir);
         }
         None => log::error!("no internal data path; settings will not persist"),

apps/darkroom-desktop/Cargo.toml

@@ -7,6 +7,10 @@ license.workspace = true
 
 [dependencies]
 dr-ui.workspace = true
+# For the panic hook alone. Directly rather than through dr-ui, because it has
+# to be installed before `dr_ui::run` — a panic during startup is exactly the
+# one this exists to catch.
+dr-plat.workspace = true
 anyhow.workspace = true
 env_logger.workspace = true
 log.workspace = true

apps/darkroom-desktop/src/main.rs

@@ -10,6 +10,14 @@ fn main() -> anyhow::Result<()> {
     ))
     .init();
 
+    // Immediately after the logger and before anything that could fail. Until
+    // now a panic on desktop went to stderr and died with the terminal, which
+    // means every panic a user has ever hit was unreportable: the process
+    // survives (the panicking worker does not), a control goes dead, and there
+    // is nothing on disk to say why. The record is local and stays local —
+    // there is no upload path, by design; see `dr_plat::crash`.
+    dr_plat::crash::install(env!("CARGO_PKG_VERSION"));
+
     log::info!("DarkRoom v{}", env!("CARGO_PKG_VERSION"));
 
     let paths: Vec<PathBuf> = std::env::args().skip(1).map(PathBuf::from).collect();