2 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Fable 5	6bba420845	app: the history row was naming the wrong document's privacy level ... A row read "22 kB · full" directly beneath "uploaded to fmr", while the status line above said the upload went as BALANCED. Both were true and they described different documents: the row showed ArchivedRun.anonymization, which describes the *archived* copy - deliberately unredacted, so always "full" - and the status line described the *uploaded* copy. Read together, that says the complete data was uploaded when a redacted copy was sent. A privacy display that overstates what left the device is worse than none, and telling the user what left the device is the one thing this screen is for. The level a run was uploaded at is now recorded separately (uploaded_as) and the row says "kept complete on this device" / "uploaded to fmr as balanced" - each label naming the copy it belongs to. Two more from the same screenshot: - Every row showed no verdict. The archive read summary.verdict; the schema calls it summary.overall. Silently null on every run, so the list's most prominent element was blank while everything else looked fine. The test fixture had the same wrong field name, which is why it passed. - The status line rendered the server's raw JSON index entry into the UI. Verified on device: a fresh run archives with verdict "yellow" and uploaded_as "balanced" beside anonymization "full". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 15:37:05 +02:00
mrambossekandClaude Fable 5	ce1aaa332a	server: send granted traffic from the address the session actually used ... fmr binds two IPv4 addresses. connFor picked whichever socket of the right family came first in the bind list, so a downtrain for a session established on .150 went out from .151 — and every packet was dropped by the client's NAT, which has no mapping for that pair. tcpdump on the server showed all 50 leaving; the client saw none. Read as "100% downstream loss", which is the worst kind of wrong: a confident measurement of something that never happened. Sessions now record which of our own bound addresses received their traffic, and granted sends (and delayed echo) go back out through that socket. The fallback to a family match is kept for the case where nothing has been received yet, and the test pins both paths — a single-homed lab can never reproduce this. Also: the client-side halves of the same work — anonymizer (core-privacy), local run archive with retention (core-archive), upload client, and the app's settings and history screens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 10:45:43 +02:00