notes: write and commit failures are reported, not assumed

A review of the branch found four ways the page could report success for
work that never happened, all reachable in ordinary use.

Writes: setText is asynchronous unless blockWrites, and its
saved()/saveFailed() do not fire for every write (a second setText to the
same path loses the signal, which stranded the callback), so a save was
reported before it landed and a failed db.json or body write was never
seen. Both views now block and carry the outcome, so writeDb and writeBody
know the result when they return; a failed create therefore leaves no index
entry. The create path also loads the body before the index, so a failed
body write cannot leave an entry with no text.

Commits: the sync chain swallowed every commit failure with '|| true', so a
failing pre-commit hook or a signing failure pushed an unchanged HEAD and
reported success. It now stages, commits only when something is staged, and
lets 'set -e' fail the chain, with stderr folded in for the whole chain
rather than just the push.

Duplicate notes: the 'awaiting commit' state lived only in a 3 second
timer, so a slower second click re-entered create() and appended a second
note. It is now a page property that outlives the timer, and the button
follows it.

Preview: the shared Switch writes checked itself, dropping the binding, so
the switch stopped following page.preview; resynced on change, the way
StatusRow.qml does.

Also validates a note's file name as digits before read, write or rm, and
clears the index error once the index reads again.

1 files changed, 12 insertions, 1 deletions

diff --git a/desktop/modules/notes/test_notes.js b/desktop/modules/notes/test_notes.js
index 6a316ce..3f91a5e 100644
--- a/desktop/modules/notes/test_notes.js
+++ b/desktop/modules/notes/test_notes.js
@@ -18,7 +18,7 @@ const assert = require("assert");
 
 const src = fs.readFileSync(__dirname + "/Notes.js", "utf8")
     .replace(/^\.pragma library$/m, "");
-const N = new Function(src + "\nreturn { parse, valid, stringify, sorted, formatDate, nextId,"
+const N = new Function(src + "\nreturn { parse, valid, validFile, stringify, sorted, formatDate, nextId,"
     + " filter, addNote, updateNote, removeNote, setLastpull };")();
 
 const db = {
@@ -63,6 +63,17 @@ assert.strictEqual(N.valid('{"a":1}'), null);
 assert.strictEqual(N.valid("<<<<<<< HEAD\n{}\n=======\n{}\n>>>>>>> other\n"), null);
 assert.deepStrictEqual(N.parse("not json"), { notes: [] });   // display stays tolerant
 
+// validFile(): the epoch-second name, or "" for anything else. The page builds
+// a read path, a write path and an rm path from a note's file, and a db.json
+// that came off a git remote is not entirely under this user's control.
+assert.strictEqual(N.validFile("1750000000"), "1750000000");
+assert.strictEqual(N.validFile(""), "");
+assert.strictEqual(N.validFile(undefined), "");
+assert.strictEqual(N.validFile("../../.bashrc"), "");
+assert.strictEqual(N.validFile("1750000000\n"), "");
+assert.strictEqual(N.validFile("1e9"), "");
+assert.strictEqual(N.validFile("notes/1750000000"), "");
+
 // pure transforms preserve everything else and do not mutate
 const added = N.addNote(db, "T", "1750");
 assert.strictEqual(added.notes.length, 4);