Tier 0: render what the services already decided, honestly

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/settings-commit-reset-contract

@@ -14,12 +14,22 @@
 #     store would leave a customized Home accessory arrangement in place while
 #     claiming to have restored Panama's defaults. That is worse than having no
 #     reset at all, because it is silent.
+#
+#     It is also the only irreversible action Panama offers, and the confirm
+#     promises it is undoable because a backup is taken first. That promise is
+#     only worth something if the backup contains the settings being replaced.
+#     The backup is written by a separate process reading settings.json, so
+#     "the call returned" is not "the file is safe": this contract holds the
+#     snapshot open and proves that NOTHING is wiped until it completes, and
+#     that a snapshot which fails -- or cannot start -- aborts the reset
+#     entirely rather than proceeding without an undo.
 
 set -euo pipefail
 
 repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 harness="$repo_dir/config/dot/quickshell/settings-system-harness.qml"
 system_settings="$repo_dir/config/dot/quickshell/services/SystemSettings.qml"
+settings_backup="$repo_dir/config/dot/quickshell/services/SettingsBackup.qml"
 wallpaper_service="$repo_dir/config/dot/quickshell/services/Wallpaper.qml"
 
 # Preferences are committed to $XDG_CONFIG_HOME, and the Home store lives under
@@ -52,6 +62,11 @@ rg -Fq 'const effectivePath = path === "" ? root.shippedPath : path;' "$wallpape
 rg -Fq 'storedPath: rawGlobal === root.shippedPath ? "" : rawGlobal' "$wallpaper_service" \
     || fail 'the shipped wallpaper cannot remain represented by the default empty preference'
 
+# The completion signal is the whole mechanism: without it the caller has no way
+# to know the helper finished, and the only thing left to wait for is nothing.
+rg -Fq 'signal saveFinished(bool success)' "$settings_backup" \
+    || fail 'SettingsBackup.save() reports no completion, so a caller cannot wait for the backup'
+
 qs_for_harness() {
     XDG_CONFIG_HOME="$config_home" XDG_STATE_HOME="$state_home" \
         PANAMA_SETTINGS_TEST_ISOLATE_COMPOSITOR=1 qs -p "$harness" "$@"
@@ -131,19 +146,89 @@ jq -e '.count == 1 and .initialized == true' <<<"$home_before" >/dev/null \
 [[ "$(qs_for_harness ipc call settings-system-test stored dockHideDelayMs)" == "900" ]] \
     || fail 'the dock fixture did not apply'
 
+# Everything below leans on the fixtures still being in place, so each aborted
+# case re-asserts that they are.
+fixtures_intact() {
+    local why="$1" home dock
+    home="$(qs_for_harness ipc call settings-system-test homeState)"
+    dock="$(qs_for_harness ipc call settings-system-test stored dockHideDelayMs)"
+    jq -e '.count == 1 and .initialized == true' <<<"$home" >/dev/null \
+        || fail "$why (Home store was cleared: $home)"
+    [[ "$dock" == "900" ]] || fail "$why (schema store was cleared: dockHideDelayMs=$dock)"
+    [[ "$(qs_for_harness ipc call settings-system-test stored displays | jq -cS .)" != '{}' ]] \
+        || fail "$why (display records were cleared)"
+}
+
+last_error() {
+    qs_for_harness ipc call settings-system-test status | jq -r .lastError
+}
+
+# ── A snapshot that cannot even start refuses the reset ──────────────────────
+# The user was promised an undo. Without one, the honest answer is to do
+# nothing and say so, not to wipe the stores anyway.
+qs_for_harness ipc call settings-system-test clearError >/dev/null
+qs_for_harness ipc call settings-system-test snapshotCanStart false >/dev/null
+[[ "$(qs_for_harness ipc call settings-system-test restoreDefaults)" == "false" ]] \
+    || fail 'reset proceeded although no safety backup could be started'
+sleep 0.5
+fixtures_intact 'a reset with no safety backup still wiped the stores'
+refused_state="$(qs_for_harness ipc call settings-system-test resetState)"
+jq -e '.calls == ["snapshot.start"] and .displayBlocked == false' <<<"$refused_state" >/dev/null \
+    || fail "a refused reset still began its work: $refused_state"
+[[ -n "$(last_error)" ]] || fail 'a refused reset said nothing about why nothing happened'
+[[ "$(qs_for_harness ipc call settings-system-test resetPending)" == "false" ]] \
+    || fail 'a refused reset left the page believing a reset is under way'
+qs_for_harness ipc call settings-system-test snapshotCanStart true >/dev/null
+
+# ── Nothing is wiped while the snapshot is still being written ───────────────
+# This is the race the old code lost: takeSafetySnapshot() returned at launch
+# and the reset rewrote settings.json in the same frame, so the helper read back
+# the defaults it had just been handed and called them the user's settings.
+qs_for_harness ipc call settings-system-test clearError >/dev/null
 [[ "$(qs_for_harness ipc call settings-system-test restoreDefaults)" == "true" ]] \
     || fail 'restoreDefaults refused a safe reset'
+sleep 0.5
+[[ "$(qs_for_harness ipc call settings-system-test resetPending)" == "true" ]] \
+    || fail 'the reset did not stay pending while the safety backup was being written'
+fixtures_intact 'the stores were wiped while the safety backup was still being written'
+inflight_state="$(qs_for_harness ipc call settings-system-test resetState)"
+jq -e '.calls == ["snapshot.start"] and .displayBlocked == false' <<<"$inflight_state" >/dev/null \
+    || fail "the reset began before its safety backup finished: $inflight_state"
+
+# ── A snapshot that fails aborts the reset ──────────────────────────────────
+[[ "$(qs_for_harness ipc call settings-system-test finishSnapshot false)" == "true" ]] \
+    || fail 'no snapshot was waiting to be failed'
+sleep 0.5
+fixtures_intact 'a failed safety backup still let the reset wipe the stores'
+failed_state="$(qs_for_harness ipc call settings-system-test resetState)"
+jq -e '.calls == ["snapshot.start", "snapshot.finish:false"] and .displayBlocked == false' \
+    <<<"$failed_state" >/dev/null \
+    || fail "a failed safety backup did not abort the reset: $failed_state"
+[[ -n "$(last_error)" ]] || fail 'a reset aborted by a failed backup said nothing'
+[[ "$(qs_for_harness ipc call settings-system-test resetPending)" == "false" ]] \
+    || fail 'an aborted reset stayed pending, so the page can never offer the reset again'
+
+# ── The reset happens in the snapshot's success path, and only there ─────────
+qs_for_harness ipc call settings-system-test clearError >/dev/null
+[[ "$(qs_for_harness ipc call settings-system-test restoreDefaults)" == "true" ]] \
+    || fail 'restoreDefaults refused a safe reset'
+sleep 0.3
+fixtures_intact 'the stores were wiped while the safety backup was still being written'
+[[ "$(qs_for_harness ipc call settings-system-test finishSnapshot true)" == "true" ]] \
+    || fail 'no snapshot was waiting to be completed'
 sleep 0.6
 
 reset_state="$(qs_for_harness ipc call settings-system-test resetState)"
-# The snapshot must come FIRST. Restoring defaults is the only irreversible
-# action Panama offers, and a snapshot taken after the stores were cleared would
-# faithfully record the wiped state as if it were the user's.
-jq -e '.calls[0] == "snapshot"' <<<"$reset_state" >/dev/null \
-    || fail "reset did not snapshot before wiping the stores: $reset_state"
+# The snapshot must COMPLETE first. Restoring defaults is the only irreversible
+# action Panama offers, and a snapshot that read the stores after they were
+# cleared would faithfully record the wiped state as if it were the user's.
+jq -e '.calls[0] == "snapshot.start" and .calls[1] == "snapshot.finish:true"' \
+    <<<"$reset_state" >/dev/null \
+    || fail "reset did not wait for the snapshot to finish before wiping the stores: $reset_state"
 
 jq -e '.calls == [
-    "snapshot",
+    "snapshot.start",
+    "snapshot.finish:true",
     "display.block:true",
     "keybinds.reload",
     "wallpaper.set:",