[m2na7]

What changes

The free version and the App Store version keep their data separately. Moving to the paid version now has a way to carry notes across: export a JSON file in the free version, quit it, then import that file in the App Store version.

• Settings › Data can export and import notes. Complete text, dates and pin state travel together. Existing notes stay, and importing the same file again skips matching notes. Clipboard history is excluded.
• Storage problems are visible. The panel and Settings report failed writes, temporary storage and recovery files. The recovery notice stays until dismissed, including after reopening the app, and its button opens the data folder.
• Recovery backups roll back partial moves. A failed backup does not open a new store alongside only part of the old data.
• Long notes are fully searchable. Search no longer stops at the first 10,000 characters. Notes imported from a Mac with a clock ahead of this one also remain correctly ordered after later edits and additions.
• Delayed automatic paste checks its destination again. Before sending ⌘V, it verifies the target process, clipboard generation, setting and Accessibility permission.

Behaviour details

Situation	What happens
A valid JSON archive is imported	Notes merge in one save, retaining their original text, dates and pins
Matching notes already exist	They are skipped without overwriting existing notes; distinct identical notes within an archive are preserved
The file is malformed, unsupported or exceeds 256 MiB	Import is rejected before changing the store
Saving the imported batch fails	The changes roll back and an error is shown
The file picker is cancelled	Nothing changes
Storage is temporary	Import is unavailable; notes can still be exported before quitting
Focus or clipboard contents change during the paste delay	The synthetic paste is cancelled

• Import uses a native sheet attached to Settings and decodes the file outside the main actor. The sandbox entitlement allows reading and writing only user-selected locations.
• Test bundles have identifiers unique to each run. Without DEBUG probe flags they exit before normal startup, so they cannot register the global shortcut. The runner stops its exact test apps after success, failure or interruption.

Tests

• swift test: 592 tests pass in each of the direct and App Store (BACKPOCKET_MAS=1) variants. Regression coverage includes:
  • note text, dates and pins across separate disk stores and reopening
  • repeated imports, identical notes and preserving existing notes
  • malformed or unsupported archives and failed-save rollback
  • temporary storage, recovery notices and partial backup failures
  • search beyond the old text cap and ordering with future timestamps
  • delayed paste identity checks and reserved test-bundle identities
• make lint: clean; 144 localization keys match across all four languages.
• Direct and App Store release builds pass; the transfer probe and its launch flags compile out.
• make test-sandbox-transfer and repeated runs pass with locally signed, sandboxed App Store variant processes and real file panels. Checked denied JSON access before selection, successful import afterward, a long Korean/emoji note, repeated imports, restart persistence, malformed input, cancellation, sandbox export and unchanged source data/JSON.
• Checked both launch guards, cleanup after an injected driver failure and SIGTERM, and refusal to drive the actual installed app. No transfer test app remained running.
• Checked Settings › Data before and after in isolated DEBUG builds. Captures and integration reports are retained locally under build/pr-review/ and build/sandbox-transfer/<UUID>/.
• Not done: installation and receipt verification with the downloaded App Store package. The integration checks local App Sandbox behaviour; it requires a macOS desktop and Accessibility permission for the invoking terminal, so it runs separately from headless CI. The installed app was not replaced.

Docs

• README (EN/KO): export/import instructions and the free-to-App-Store migration flow.
• CHANGELOG: entries under Unreleased.
• CONTRIBUTING and ARCHITECTURE: transfer format, shared file panels and the sandbox integration runner.
• SECURITY: the explicit notes-only export and recovery backup behaviour.
• User-visible messages added in EN, KO, JA and simplified Chinese.

🤖 Generated with Codex