notes: write and commit failures are reported, not assumed

A review of the branch found four ways the page could report success for
work that never happened, all reachable in ordinary use.

Writes: setText is asynchronous unless blockWrites, and its
saved()/saveFailed() do not fire for every write (a second setText to the
same path loses the signal, which stranded the callback), so a save was
reported before it landed and a failed db.json or body write was never
seen. Both views now block and carry the outcome, so writeDb and writeBody
know the result when they return; a failed create therefore leaves no index
entry. The create path also loads the body before the index, so a failed
body write cannot leave an entry with no text.

Commits: the sync chain swallowed every commit failure with '|| true', so a
failing pre-commit hook or a signing failure pushed an unchanged HEAD and
reported success. It now stages, commits only when something is staged, and
lets 'set -e' fail the chain, with stderr folded in for the whole chain
rather than just the push.

Duplicate notes: the 'awaiting commit' state lived only in a 3 second
timer, so a slower second click re-entered create() and appended a second
note. It is now a page property that outlives the timer, and the button
follows it.

Preview: the shared Switch writes checked itself, dropping the binding, so
the switch stopped following page.preview; resynced on change, the way
StatusRow.qml does.

Also validates a note's file name as digits before read, write or rm, and
clears the index error once the index reads again.

1 files changed, 9 insertions, 0 deletions

diff --git a/desktop/modules/notes/Notes.js b/desktop/modules/notes/Notes.js
index 6bc8c88..4e2ef3d 100644
--- a/desktop/modules/notes/Notes.js
+++ b/desktop/modules/notes/Notes.js
@@ -44,6 +44,15 @@ function parse(text) {
     return valid(text) || { notes: [] };
 }
 
+// A note's file name as db.json should hold it: digits only, the epoch second
+// notes.sh names the file with. Anything else is refused, because the page
+// builds a read path, a write path and an rm path from it, and a db.json that
+// came off a git remote is not entirely under this user's control.
+function validFile(file) {
+    const f = String(file === undefined || file === null ? "" : file);
+    return /^\d+$/.test(f) ? f : "";
+}
+
 // Pretty, 2-space, trailing newline. notes.sh reads db.json through jq, which
 // does not care about the layout.
 function stringify(db) {