fix: address audit findings - atomic guards, toast lifecycle, cancelable debounce, and more

Author: VariableThe

AUDIT_LOG.md

@@ -30,7 +30,7 @@ Major graph view overhaul and cross-platform fixes:
 
 ---
 
-## 2026-06-24 - (Uncommitted)
+## 2026-06-24 - Native Notifications, Timers, DSL Engine, WebGL Graph
 **Change:** feat: native notifications, timers, DSL regex engine, WebGL graph with folder attraction
 
 **Details/Why:**

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Lazy-Loaded Graph**: `GraphView` is dynamically imported with `React.lazy()` so the Three.js bundle (~1.3 MB) loads only when the graph is opened.
 - **Smooth Graph Fade-in**: The graph overlay animates in with a 250ms CSS keyframe fade.
 - **Persistent Node Positions**: After closing the graph view, node positions are cached and restored on next open, preserving manual arrangement.
+- **Native OS Reminder Notifications**: Task reminders (`/task`) now fire native OS notifications via the Rust backend using `tokio::time::sleep` + `tauri_plugin_notification`. Notifications fire reliably even when the app is minimized or out of focus, and gracefully handle OS-level permission denials.
+- **Countdown Timers**: New timer panel (accessible via the action menu or `/timer` command) lets you create, view, pause/resume, and cancel countdown timers. Timers display a live countdown using drift-corrected `setTimeout` chains and trigger both a native OS notification and an in-app alert on completion — even if you're viewing a different note.
+- **DSL Regex Parsing Engine**: New `createRegexPlugin()` factory in `dslPlugin.ts` enables flexible, regex-based Domain Specific Language parsing in the editor. Scans only visible ranges for O(visible lines) performance — lag-free at any document size. Supports custom mark decorations, widget injections, and match callbacks.
+- **WebGL Graph View**: The Graph View has been rewritten using Three.js WebGL via `react-force-graph-3d`. Notes in the same folder are attracted to shared centroid positions via custom `d3-force` simulation rules, causing them to cluster together naturally. The graph is lazy-loaded to avoid impacting editor startup time.
 
 ### Changed
 - **Cmd+Shift+N Behavior**: The global new-note shortcut no longer hides the app if it's already visible. It only shows the window when hidden. The shortcut always creates a new note regardless.
@@ -37,10 +41,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Slash Command Autosuggest**: Added an inline ghost text autosuggest widget for slash commands (e.g., `/check`, `/ai`). Pressing `Tab` instantly completes the command without interrupting typing flow.
 - **Auto-Open Version Notes**: Upon updating, PaperCache now automatically opens a summary note detailing the new features in the latest release and silently cleans up previous version notes from the workspace.
 - **Tag Context Menu**: Right-clicking a tag pill now reveals a beautifully styled inline action menu allowing users to easily delete all notes under that tag, or export them concatenated together into a single Markdown file directly via native system dialogs.
-- **Native OS Reminder Notifications**: Task reminders (`/task`) now fire native OS notifications via the Rust backend using `tokio::time::sleep` + `tauri_plugin_notification`. Notifications fire reliably even when the app is minimized or out of focus, and gracefully handle OS-level permission denials.
-- **Countdown Timers**: New timer panel (accessible via the action menu or `/timer` command) lets you create, view, pause/resume, and cancel countdown timers. Timers display a live countdown using drift-corrected `setTimeout` chains and trigger both a native OS notification and an in-app alert on completion — even if you're viewing a different note.
-- **DSL Regex Parsing Engine**: New `createRegexPlugin()` factory in `dslPlugin.ts` enables flexible, regex-based Domain Specific Language parsing in the editor. Scans only visible ranges for O(visible lines) performance — lag-free at any document size. Supports custom mark decorations, widget injections, and match callbacks.
-- **WebGL Graph View**: The Graph View has been rewritten using Three.js WebGL via `react-force-graph-3d`. Notes in the same folder are attracted to shared centroid positions via custom `d3-force` simulation rules, causing them to cluster together naturally. The graph is lazy-loaded to avoid impacting editor startup time.
 
 ### Fixed
 - Fixed an issue where the unified search view layout could overlap with the context menu or hide important tag management options.

src-tauri/src/commands/notifications.rs

@@ -30,22 +30,11 @@ pub async fn schedule_reminders(
         .map(|d| d.as_millis() as i64)
         .unwrap_or(0);
 
-    // Cancel all existing reminder handles
-    {
-        let mut handles = state
-            .reminder_handles
-            .write()
-            .map_err(|e| e.to_string())?;
-        for (_, handle) in handles.drain() {
-            handle.abort();
-        }
-    }
+    let mut new_handles: HashMap<String, JoinHandle<()>> = HashMap::new();
 
-    // Schedule new reminders
     for reminder in reminders {
         let delay_ms = reminder.due_at - now_ms;
         if delay_ms < 0 {
-            // Already past – skip (already notified logic is on frontend)
             continue;
         }
 
@@ -55,22 +44,27 @@ pub async fn schedule_reminders(
 
         let handle = tokio::spawn(async move {
             sleep(Duration::from_millis(delay_ms as u64)).await;
-
             let _ = app_clone
                 .notification()
                 .builder()
                 .title("PaperCache Reminder")
                 .body(&label)
                 .show();
-
             let _ = app_clone.emit("reminder-fired", &key);
         });
 
-        state
+        new_handles.insert(reminder.key, handle);
+    }
+
+    {
+        let mut handles = state
             .reminder_handles
             .write()
-            .map_err(|e| e.to_string())?
-            .insert(reminder.key, handle);
+            .map_err(|e| e.to_string())?;
+        for (_, handle) in handles.drain() {
+            handle.abort();
+        }
+        handles.extend(new_handles);
     }
 
     Ok(())
@@ -98,38 +92,30 @@ pub async fn schedule_timer(
     label: String,
     state: tauri::State<'_, NotificationState>,
 ) -> Result<(), String> {
-    // Cancel any existing timer with the same id
-    {
-        let mut handles = state
-            .timer_handles
-            .write()
-            .map_err(|e| e.to_string())?;
-        if let Some(existing) = handles.remove(&id) {
-            existing.abort();
-        }
-    }
-
     let app_clone = app.clone();
     let id_clone = id.clone();
 
     let handle = tokio::spawn(async move {
         sleep(Duration::from_millis(duration_ms)).await;
-
         let _ = app_clone
             .notification()
             .builder()
             .title("PaperCache Timer")
             .body(&format!("⏱ Timer finished: {}", label))
             .show();
-
         let _ = app_clone.emit("timer-complete", &id_clone);
     });
 
-    state
-        .timer_handles
-        .write()
-        .map_err(|e| e.to_string())?
-        .insert(id, handle);
+    {
+        let mut handles = state
+            .timer_handles
+            .write()
+            .map_err(|e| e.to_string())?;
+        if let Some(existing) = handles.remove(&id) {
+            existing.abort();
+        }
+        handles.insert(id, handle);
+    }
 
     Ok(())
 }

src-tauri/src/lib.rs

@@ -10,7 +10,7 @@ mod tray;
 
 use commands::shortcuts::GlobalShortcutState;
 use commands::notifications::NotificationState;
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::Arc;
 
 pub struct DialogState {
@@ -69,12 +69,12 @@ pub fn run() {
                 let dialog_state = app.state::<crate::DialogState>();
                 let is_dialog_open = dialog_state.is_open.clone();
                 #[cfg(not(target_os = "macos"))]
-                let pending_hide = Arc::new(AtomicBool::new(false));
+                let focus_gen = Arc::new(AtomicU64::new(0));
 
                 window.on_window_event({
                     let w = window.clone();
                     #[cfg(not(target_os = "macos"))]
-                    let pending = pending_hide.clone();
+                    let gen = focus_gen.clone();
                     move |event| match event {
                         tauri::WindowEvent::CloseRequested { api, .. } => {
                             api.prevent_close();
@@ -83,21 +83,21 @@ pub fn run() {
                         tauri::WindowEvent::Focused(focused) => {
                             if *focused {
                                 #[cfg(not(target_os = "macos"))]
-                                pending.store(false, Ordering::SeqCst);
+                                { gen.fetch_add(1, Ordering::SeqCst); }
                             } else if !is_dialog_open.load(Ordering::SeqCst) {
                                 #[cfg(target_os = "macos")]
                                 let _ = w.hide();
 
                                 #[cfg(not(target_os = "macos"))]
                                 {
-                                    pending.store(true, Ordering::SeqCst);
+                                    let gen_at_spawn = gen.fetch_add(1, Ordering::SeqCst) + 1;
                                     let w2 = w.clone();
-                                    let p2 = pending.clone();
+                                    let g2 = gen.clone();
                                     std::thread::spawn(move || {
                                         std::thread::sleep(
                                             std::time::Duration::from_millis(200),
                                         );
-                                        if p2.swap(false, Ordering::SeqCst) {
+                                        if g2.load(Ordering::SeqCst) == gen_at_spawn {
                                             let _ = w2.hide();
                                         }
                                     });

src/App.tsx

@@ -59,11 +59,28 @@ function App() {
   }, [])
 
   // Auto-dismiss toasts after 5 seconds
+  const toastTimersRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(new Map())
   useEffect(() => {
-    if (toasts.length === 0) return undefined
-    const ids = toasts.map((t) => t.id)
-    const timers = ids.map((id) => setTimeout(() => removeToast(id), 5000))
-    return () => timers.forEach(clearTimeout)
+    const timers = toastTimersRef.current
+    const currentIds = new Set(toasts.map((t) => t.id))
+
+    // Clear timers for removed toasts
+    for (const [id, timer] of timers) {
+      if (!currentIds.has(id)) {
+        clearTimeout(timer)
+        timers.delete(id)
+      }
+    }
+
+    // Set timers for new toasts
+    for (const toast of toasts) {
+      if (!timers.has(toast.id)) {
+        timers.set(
+          toast.id,
+          setTimeout(() => removeToast(toast.id), 5000)
+        )
+      }
+    }
   }, [toasts, removeToast])
 
   useEffect(() => {

src/GraphView.tsx

@@ -142,41 +142,44 @@ export default function GraphView({
   }, [notes])
 
   useEffect(() => {
-    const fg = fgRef.current
-    if (!fg) return
-
-    const folders = Array.from(new Set(graphData.nodes.map((n) => n.folder).filter(Boolean)))
-    const centroids = buildFolderCentroids(folders)
-
-    fg.d3Force('centerX', d3.forceX<GraphNode>(0).strength(0.008))
-
-    fg.d3Force('centerY', d3.forceY<GraphNode>(0).strength(0.008))
-
-    fg.d3Force(
-      'folderX',
-      d3
-        .forceX<GraphNode>((node) => {
-          const c = centroids.get(node.folder)
-          return c ? c.cx : 0
-        })
-        .strength((node) => (node.folder && !draggedNodesRef.current.has(node.id) ? 0.008 : 0))
-    )
-
-    fg.d3Force(
-      'folderY',
-      d3
-        .forceY<GraphNode>((node) => {
-          const c = centroids.get(node.folder)
-          return c ? c.cy : 0
-        })
-        .strength((node) => (node.folder && !draggedNodesRef.current.has(node.id) ? 0.008 : 0))
-    )
-
-    fg.d3Force('charge')?.strength(-120)
-
-    fg.d3Force('collision', d3.forceCollide<GraphNode>(22))
-
-    fg.d3ReheatSimulation()
+    let attempts = 0
+    const id = setInterval(() => {
+      const fg = fgRef.current
+      if (!fg) {
+        attempts++
+        if (attempts > 20) clearInterval(id)
+        return
+      }
+      clearInterval(id)
+
+      const folders = Array.from(new Set(graphData.nodes.map((n) => n.folder).filter(Boolean)))
+      const centroids = buildFolderCentroids(folders)
+
+      fg.d3Force('centerX', d3.forceX<GraphNode>(0).strength(0.008))
+      fg.d3Force('centerY', d3.forceY<GraphNode>(0).strength(0.008))
+      fg.d3Force(
+        'folderX',
+        d3
+          .forceX<GraphNode>((node) => {
+            const c = centroids.get(node.folder)
+            return c ? c.cx : 0
+          })
+          .strength((node) => (node.folder && !draggedNodesRef.current.has(node.id) ? 0.008 : 0))
+      )
+      fg.d3Force(
+        'folderY',
+        d3
+          .forceY<GraphNode>((node) => {
+            const c = centroids.get(node.folder)
+            return c ? c.cy : 0
+          })
+          .strength((node) => (node.folder && !draggedNodesRef.current.has(node.id) ? 0.008 : 0))
+      )
+      fg.d3Force('charge')?.strength(-120)
+      fg.d3Force('collision', d3.forceCollide<GraphNode>(22))
+      fg.d3ReheatSimulation()
+    }, 50)
+    return () => clearInterval(id)
   }, [graphData])
 
   const handleNodeClick = useCallback(
@@ -202,10 +205,7 @@ export default function GraphView({
     if (!fg) return
     const node = fg.graphData().nodes.find((n: GraphNode) => n.id === nodeId)
     if (!node || node.x == null || node.y == null) return
-    fg.centerAt(node.x, node.y, 400)
-    setTimeout(() => {
-      fg.cameraPosition({ x: node.x, y: node.y, z: 120 }, { x: node.x, y: node.y, z: 0 }, 400)
-    }, 200)
+    fg.cameraPosition({ x: node.x, y: node.y, z: 120 }, { x: node.x, y: node.y, z: 0 }, 400)
   }, [])
 
   const nodeThreeObject = useCallback(
@@ -376,7 +376,14 @@ export default function GraphView({
             </h2>
           )}
           <button
-            onClick={onClose}
+            onClick={() => {
+              if (showSearch) {
+                setShowSearch(false)
+                setSearchQuery('')
+              } else {
+                onClose()
+              }
+            }}
             style={{
               background: 'transparent',
               border: 'none',

src/api.ts

@@ -1,6 +1,6 @@
 import { invoke } from '@tauri-apps/api/core'
 import { listen } from '@tauri-apps/api/event'
-import type { ElectronAPI } from './types'
+import type { ElectronAPI, ReminderPayload } from './types'
 
 export const tauriApi: ElectronAPI = {
   // Implemented Phase 2 Commands
@@ -23,8 +23,7 @@ export const tauriApi: ElectronAPI = {
   quitApp: () => invoke('quit_app'),
   openExternal: (url) => invoke('open_external', { url }),
   openFile: (path) => invoke('open_file', { path }),
-  scheduleReminders: (reminders) =>
-    invoke('schedule_reminders', { reminders: reminders as unknown[] }),
+  scheduleReminders: (reminders: ReminderPayload[]) => invoke('schedule_reminders', { reminders }),
   cancelReminders: () => invoke('cancel_all_reminders'),
   scheduleTimer: (id, durationMs, label) => invoke('schedule_timer', { id, durationMs, label }),
   cancelTimer: (id) => invoke('cancel_timer', { id }),

src/components/TimersPage.tsx

@@ -157,7 +157,7 @@ export function TimersPage({ onClose }: TimersPageProps) {
     return () => window.removeEventListener('keydown', handler)
   }, [onClose])
 
-  const handleCreate = () => {
+  const handleCreate = async () => {
     const h = parseInt(hInput) || 0
     const m = parseInt(mInput) || 0
     const s = parseInt(sInput) || 0
@@ -168,18 +168,26 @@ export function TimersPage({ onClose }: TimersPageProps) {
       labelInput.trim() ||
       `${h > 0 ? `${h}h ` : ''}${m > 0 ? `${m}m ` : ''}${s > 0 ? `${s}s` : ''}`.trim()
     const id = addTimer(label, durationMs)
-    window.electronAPI.scheduleTimer(id, durationMs, label)
-    setLabelInput('')
+    try {
+      await window.electronAPI.scheduleTimer(id, durationMs, label)
+      setLabelInput('')
+    } catch {
+      removeTimer(id)
+    }
   }
 
   const handleRemove = (id: string) => {
     window.electronAPI.cancelTimer(id).catch(() => {})
     removeTimer(id)
   }
 
-  const handlePreset = (ms: number, presetLabel: string) => {
+  const handlePreset = async (ms: number, presetLabel: string) => {
     const id = addTimer(presetLabel, ms)
-    window.electronAPI.scheduleTimer(id, ms, presetLabel)
+    try {
+      await window.electronAPI.scheduleTimer(id, ms, presetLabel)
+    } catch {
+      removeTimer(id)
+    }
   }
 
   return (