@hasna/recordings 0.3.2 → 0.3.9

package/scripts/migrate.ts

@@ -34,11 +34,11 @@ async function main() {
     getCloudPg,
     migrateCloudSchema,
     pingCloudConnectivity,
-    resolveCloudDatabaseUrl,
+    resolveDatabaseUrl,
   } = await import("../src/server/cloud.js");
   const { assertCloudSchemaContract } = await import("../src/server/cloud-readiness.js");
   const { runCloudMigration } = await import("../src/server/migrate-command.js");
-  const url = resolveCloudDatabaseUrl();
+  const url = resolveDatabaseUrl();
   if (!url) {
     console.error(
       "migrate: no database URL (HASNA_RECORDINGS_DATABASE_URL / RECORDINGS_DATABASE_URL / DATABASE_URL)",

package/scripts/release-suite-gate.ts

@@ -0,0 +1,174 @@
+#!/usr/bin/env bun
+/**
+ * Release-suite gate (wired into `prepublishOnly`).
+ *
+ * Runs the app's own Linux-CI-partitioned suite — `test:gated`, which covers
+ * every discovered `*.test.ts` (the quarantine file is empty by design) — and
+ * fails on ANY failure.
+ *
+ * The allowlist is SELF-INVALIDATING, the same property as
+ * `.github/linux-quarantine.txt`: if an allowlisted failure stops failing
+ * (the owning lane lands its fix, or a quarantined package ages out of the
+ * 7-day window), the gate exits 1 and demands the entry be removed. Any
+ * failure outside the allowlist fails the gate.
+ *
+ * Allowlist history (both entries removed 2026-08-23 by the 0.3.9 release
+ * lane, publish-all-recordings, per this gate's own self-invalidation
+ * contract — each failure stopped failing at head 15b6181c6):
+ *   - service-contract-manifest.test.ts (credential_seam_compliance): the
+ *     contracts-surface migration landed in hasna/apps PR #957
+ *     (resolveStorageClient now imported from @hasna/contracts/client), so
+ *     the conformance check passes; the entry's own reason said "Remove this
+ *     entry when the lane lands."
+ *   - native-app-companion-contract.test.ts (release supply-chain policy):
+ *     the companion build's --minimum-release-age=604800 quarantine no longer
+ *     bites because @hasna/contracts is on the fleet minimumReleaseAgeExcludes
+ *     list (the sanctioned mechanism for fresh publishes); the test passes.
+ * Both removals are the gate's designed behaviour, not a weakening: any
+ * future failure now fails the gate with zero allowlisted exceptions.
+ *
+ * The gate FAILS CLOSED on abnormal termination: a non-zero suite exit is
+ * acceptable only when it is fully explained by allowlisted failures — the
+ * runner completed (its summary line is present), every parsed failure is
+ * allowlisted, at least one allowlisted failure fired, and the runner's
+ * reported failure count equals the parsed count. A crash, signal kill,
+ * timeout, or runner error that produces a non-zero exit without a complete
+ * summary fails the gate (remediation cycle 2 of PR hasna/apps#826).
+ */
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const SEP = "::";
+
+const GATED_KEYS: Array<{ file: string; test: string; owner: string; reason: string }> = [];
+
+function run(argv: string[], env: Record<string, string>): { status: number; stdout: string; stderr: string } {
+  const res = spawnSync(process.execPath, argv, { encoding: "utf8", env: { ...process.env, ...env } });
+  return { status: res.status ?? -1, stdout: res.stdout ?? "", stderr: res.stderr ?? "" };
+}
+
+// 1. Validate the partition (quarantine file must be consistent).
+const check = run(["scripts/ci-linux-suite.ts", "--check"], {});
+if (check.status !== 0) {
+  console.error("release-suite-gate: partition check failed:\n" + (check.stderr || check.stdout));
+  process.exit(1);
+}
+
+// 2. Collect the gated file list.
+const gated = run(["scripts/ci-linux-suite.ts", "--gated"], {});
+if (gated.status !== 0) {
+  console.error("release-suite-gate: could not enumerate gated files:\n" + (gated.stderr || gated.stdout));
+  process.exit(1);
+}
+const gatedFiles = gated.stdout.split("\n").filter(Boolean);
+if (gatedFiles.length === 0) {
+  console.error("release-suite-gate: zero gated files - refusing to pass on an empty suite.");
+  process.exit(1);
+}
+
+// 3. Run the gated suite exactly like `test:gated`.
+const logDir = mkdtempSync(join(tmpdir(), "recordings-release-gate-"));
+const logPath = join(logDir, "suite.log");
+const suite = spawnSync(
+  process.execPath,
+  ["test", "--timeout", "120000", ...gatedFiles],
+  {
+    encoding: "utf8",
+    env: { ...process.env, RECORDINGS_TEST_TIMEOUT_MS: "120000" },
+    maxBuffer: 64 * 1024 * 1024,
+  },
+);
+const output = (suite.stdout ?? "") + (suite.stderr ?? "");
+try {
+  writeFileSync(logPath, output);
+} catch {
+  /* log capture is best-effort */
+}
+const suiteStatus = suite.status ?? -1;
+
+// 4. Parse failing tests as (file, description) pairs, in output order.
+const failPairs: Array<{ file: string; test: string }> = [];
+let currentFile = "";
+for (const line of output.split("\n")) {
+  const fileMatch = /^(?:\.\/)?(src\/[^\s:]+\.test\.ts):$/.exec(line);
+  if (fileMatch) {
+    currentFile = fileMatch[1];
+    continue;
+  }
+  const failMatch = /^\(fail\) (.+) \[\d+.*\]$/.exec(line);
+  if (failMatch) {
+    failPairs.push({ file: currentFile, test: failMatch[1].trim() });
+  }
+}
+
+// 5. Classify.
+const failuresByKey = new Map<string, number>();
+for (const key of GATED_KEYS) {
+  failuresByKey.set(key.file + SEP + key.test, 0);
+}
+const unexpected: Array<{ file: string; test: string }> = [];
+for (const pair of failPairs) {
+  const key = pair.file + SEP + pair.test;
+  if (failuresByKey.has(key)) {
+    failuresByKey.set(key, (failuresByKey.get(key) ?? 0) + 1);
+  } else {
+    unexpected.push(pair);
+  }
+}
+
+if (unexpected.length > 0) {
+  console.error(
+    "release-suite-gate: FAIL - unexpected test failures:\n" +
+      unexpected.map((u) => "  " + u.file + " :: " + u.test).join("\n"),
+  );
+  console.error("Full suite log: " + logPath);
+  process.exit(1);
+}
+
+// 6. Fail closed on abnormal termination. A non-zero suite exit is only
+// acceptable when it is fully explained by the allowlisted failures: the
+// runner completed (summary line present), every parsed failure is
+// allowlisted, at least one allowlisted failure fired, and the runner's
+// reported failure count equals the parsed count (no unparsed failures).
+// A crash, signal kill, timeout, or runner error produces a non-zero exit
+// without a complete summary and must fail the gate.
+if (suiteStatus !== 0) {
+  const summaryMatch = /Ran (\d+) tests across (\d+) files/.exec(output);
+  // The tally is "N pass[,/ ] M fail" in the runner's closing summary. The
+  // LAST match is taken (bun prints the tally once, but a naive first match
+  // can hit "0.13.3 failed to resolve" -> "3 fail" inside a version string).
+  const tallyMatches = [...output.matchAll(/(\d+) pass[\s,/]+(\d+) fail/g)];
+  const failCountMatch = tallyMatches.length > 0 ? tallyMatches[tallyMatches.length - 1] : null;
+  const reportedFails = failCountMatch ? Number(failCountMatch[2]) : null;
+  const anyAllowlistedFired = failPairs.length > 0;
+  const complete = summaryMatch !== null && reportedFails !== null && reportedFails === failPairs.length;
+  if (!anyAllowlistedFired || !complete) {
+    console.error(
+      "release-suite-gate: FAIL - suite exited " + suiteStatus +
+        " with " + failPairs.length + " parsed failure(s) but the run is incomplete or unexplained:" +
+        "\n  summary line present: " + (summaryMatch !== null) +
+        "\n  reported failure count: " + String(reportedFails) +
+        "\n  parsed failure count: " + failPairs.length,
+    );
+    console.error("Full suite log: " + logPath);
+    process.exit(1);
+  }
+}
+
+// 7. Self-invalidation: an allowlisted failure that no longer fails must be removed.
+const stale = GATED_KEYS.filter((key) => (failuresByKey.get(key.file + SEP + key.test) ?? 0) === 0);
+if (stale.length > 0) {
+  console.error(
+    "release-suite-gate: FAIL - allowlisted failure no longer fails; remove the entry from scripts/release-suite-gate.ts:\n" +
+      stale.map((s) => "  " + s.file + " :: " + s.test + " - " + s.owner).join("\n"),
+  );
+  process.exit(1);
+}
+
+console.log(
+  "release-suite-gate: PASS - " + failPairs.length + " classified pre-existing failure(s) allowlisted:" +
+    failPairs.map((p) => "\n  " + p.file + " :: " + p.test).join(""),
+);
+process.exit(0);

package/scripts/set-version.ts

@@ -16,17 +16,17 @@ export type VersionSite = {
   pattern: RegExp;
 };
 
+// src/version.ts is deliberately NOT a site: it derives VERSION from
+// package.json at import time (see src/version.ts), so it holds no literal
+// this writer could keep in sync, and a monorepo changesets bump can no
+// longer leave it stale. The remaining sites are the native bundle surfaces,
+// which cannot derive and must be written here.
 export const versionSites: VersionSite[] = [
   {
     file: "package.json",
     label: "package.json version",
     pattern: /("version"\s*:\s*")([^"]+)(")/,
   },
-  {
-    file: "src/version.ts",
-    label: "src/version.ts VERSION",
-    pattern: /(export const VERSION = ")([^"]+)(")/,
-  },
   {
     file: "src/native/Recordings/RecordingsLib/Info.plist",
     label: "Info.plist CFBundleShortVersionString",

package/scripts/smoke_macos_app.sh

@@ -9,7 +9,7 @@ if [ "$#" -ge 3 ]; then
       SMOKE_VARIANT="${4:-full}"
       ;;
     *)
-      echo "Usage: $0 <Recordings.app> <explicit absolute Bun executable path> [--variant full|bar]" >&2
+      echo "Usage: $0 <HasnaRecordings.app> <explicit absolute Bun executable path> [--variant full|bar]" >&2
       exit 2
       ;;
   esac
@@ -51,7 +51,7 @@ HOST_PLATFORM="$("$HOST_UNAME_EXECUTABLE" -s)"
 readonly HOST_PLATFORM
 
 if [ "$HOST_PLATFORM" != "Darwin" ] && [ "${RECORDINGS_TEST_SMOKE_ALLOW_NON_DARWIN:-0}" != "1" ]; then
-  echo "Recordings.app runtime smoke is only supported on macOS." >&2
+  echo "HasnaRecordings.app runtime smoke is only supported on macOS." >&2
   exit 1
 fi
 
@@ -123,12 +123,12 @@ HOME_DIRECTORY="${HOME:-}"
 case "$HOME_DIRECTORY" in
   /*) ;;
   *)
-    echo "Recordings.app runtime smoke requires an absolute HOME path." >&2
+    echo "HasnaRecordings.app runtime smoke requires an absolute HOME path." >&2
     exit 1
     ;;
 esac
 if [ ! -d "$HOME_DIRECTORY" ]; then
-  echo "Recordings.app runtime smoke HOME is not a directory: $HOME_DIRECTORY" >&2
+  echo "HasnaRecordings.app runtime smoke HOME is not a directory: $HOME_DIRECTORY" >&2
   exit 1
 fi
 
@@ -136,7 +136,7 @@ APP_PARENT="$(cd -P "$("$DIRNAME_EXECUTABLE" "$1")" && "$PWD_EXECUTABLE" -P)"
 APP_PATH="$APP_PARENT/$("$BASENAME_EXECUTABLE" "$1")"
 EXECUTABLE="$APP_PATH/Contents/MacOS/Recordings"
 if [ ! -x "$EXECUTABLE" ]; then
-  echo "Recordings.app runtime smoke executable is missing: $EXECUTABLE" >&2
+  echo "HasnaRecordings.app runtime smoke executable is missing: $EXECUTABLE" >&2
   exit 1
 fi
 
@@ -317,7 +317,7 @@ cleanup() {
     fi
     if [ -n "$SMOKE_APP_PID" ] && [ -n "$SMOKE_APP_PID_START_IDENTITY" ]; then
       terminate_verified_process \
-        "Recordings.app" \
+        "HasnaRecordings.app" \
         "$SMOKE_APP_PID" \
         "$EXECUTABLE" \
         "$SMOKE_APP_PID_START_IDENTITY" || true
@@ -377,7 +377,7 @@ run_smoke() {
   if ! SMOKE_APP_IDENTITIES_BEFORE_LAUNCH="$(
     process_records_for_exact_executable "$EXECUTABLE"
   )"; then
-    echo "Recordings.app runtime smoke ${mode} could not inventory exact app processes before launch." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} could not inventory exact app processes before launch." >&2
     return 1
   fi
 
@@ -399,24 +399,24 @@ run_smoke() {
       result_pid="$("$ENV_EXECUTABLE" -i HOME="$HOME_DIRECTORY" PATH="$SANITIZED_PATH" TMPDIR="$WORK_DIR" \
         "$BUN_EXECUTABLE" -e 'const value = await Bun.file(process.argv[1]).json(); console.log(value.processIdentifier)' "$output")"
       if ! [[ "$result_pid" =~ ^[1-9][0-9]*$ ]] || ! kill -0 "$result_pid" 2>/dev/null; then
-        echo "Recordings.app runtime smoke ${mode} reported a process that is not running." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported a process that is not running." >&2
         return 1
       fi
       if ! result_pid_start_identity="$(
         capture_process_start_identity "$result_pid" "$EXECUTABLE"
       )"; then
-        echo "Recordings.app runtime smoke ${mode} reported a process outside the exact app path." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported a process outside the exact app path." >&2
         return 1
       fi
       if process_identity_existed_before_launch "$result_pid" "$result_pid_start_identity"; then
-        echo "Recordings.app runtime smoke ${mode} reported an app process that predated this launch." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} reported an app process that predated this launch." >&2
         return 1
       fi
       if [ -n "$SMOKE_APP_PID" ] && {
         [ "$result_pid" != "$SMOKE_APP_PID" ] ||
           [ "$result_pid_start_identity" != "$SMOKE_APP_PID_START_IDENTITY" ];
       }; then
-        echo "Recordings.app runtime smoke ${mode} evidence did not match the exact launched app process." >&2
+        echo "HasnaRecordings.app runtime smoke ${mode} evidence did not match the exact launched app process." >&2
         return 1
       fi
       SMOKE_APP_PID="$result_pid"
@@ -429,19 +429,19 @@ run_smoke() {
       break
     fi
     if ! kill -0 "$SMOKE_PID" 2>/dev/null; then
-      echo "Recordings.app runtime smoke ${mode} exited without evidence." >&2
+      echo "HasnaRecordings.app runtime smoke ${mode} exited without evidence." >&2
       "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
       return 1
     fi
     "$SLEEP_EXECUTABLE" 0.1
   done
   if [ ! -f "$output" ]; then
-    echo "Recordings.app runtime smoke ${mode} timed out." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} timed out." >&2
     "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
     return 1
   fi
   if [ -z "$SMOKE_APP_PID" ]; then
-    echo "Recordings.app runtime smoke ${mode} did not bind evidence to the exact app process." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} did not bind evidence to the exact app process." >&2
     return 1
   fi
 
@@ -546,7 +546,7 @@ run_smoke() {
   ' "$output"
 
   if [ -e "$completion" ]; then
-    echo "Recordings.app runtime smoke ${mode} produced completion before the challenge." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} produced completion before the challenge." >&2
     return 1
   fi
   challenge="$("$ENV_EXECUTABLE" -i HOME="$HOME_DIRECTORY" PATH="$SANITIZED_PATH" TMPDIR="$WORK_DIR" \
@@ -554,7 +554,7 @@ run_smoke() {
   if ! rechecked_start_identity="$(
     capture_process_start_identity "$result_pid" "$EXECUTABLE"
   )" || [ "$rechecked_start_identity" != "$result_pid_start_identity" ]; then
-    echo "Recordings.app runtime smoke ${mode} process identity changed before completion challenge." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} process identity changed before completion challenge." >&2
     return 1
   fi
   write_atomic_text_file "$acknowledgement" "$challenge"
@@ -564,7 +564,7 @@ run_smoke() {
     "$SLEEP_EXECUTABLE" 0.1
   done
   if kill -0 "$SMOKE_PID" 2>/dev/null; then
-    echo "Recordings.app runtime smoke ${mode} completion handshake timed out." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} completion handshake timed out." >&2
     return 1
   fi
   if wait "$SMOKE_PID" 2>/dev/null; then
@@ -577,7 +577,7 @@ run_smoke() {
   SMOKE_APP_PID=""
   SMOKE_APP_PID_START_IDENTITY=""
   if [ "$wrapper_status" -ne 0 ]; then
-    echo "Recordings.app runtime smoke ${mode} open -W wrapper exited unsuccessfully (${wrapper_status})." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} open -W wrapper exited unsuccessfully (${wrapper_status})." >&2
     "$SED_EXECUTABLE" -n '1,120p' "$log" >&2
     return 1
   fi
@@ -602,7 +602,7 @@ run_smoke() {
         process.exit(1);
       }
     ' "$completion"; then
-    echo "Recordings.app runtime smoke ${mode} did not provide a valid completion response." >&2
+    echo "HasnaRecordings.app runtime smoke ${mode} did not provide a valid completion response." >&2
     return 1
   fi
 
@@ -613,7 +613,7 @@ run_smoke normal
 run_smoke permission-helper
 run_smoke resolver
 if [ "$SMOKE_VARIANT" = "bar" ]; then
-  echo "Recordings.app runtime smoke passed (bar variant): menu bar, windowless launch, helper isolation, and packaged resolver."
+  echo "HasnaRecordings.app runtime smoke passed (bar variant): menu bar, windowless launch, helper isolation, and packaged resolver."
 else
-  echo "Recordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
+  echo "HasnaRecordings.app runtime smoke passed: menu bar, retained window, helper isolation, and packaged resolver."
 fi

package/scripts/vacuity-manifests/version-sites.tsv

@@ -15,9 +15,13 @@
 # manifest is not wired into a package.json aggregate script.
 #
 # --- every version site agrees with package.json. Models 8de7068: one site bumped, the rest not.
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/version.ts	.15	1
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.2.15	1
-duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.2.15	2
+# I38-00553 (2026-08-21): src/version.ts now DERIVES from package.json and holds no literal, so it
+# is no longer a writer site (see set-version.ts) and cannot be mutated here. The residual drift
+# class is the mirror direction: the package.json authority corrupted while the native sites stay
+# put. Rows below were re-needled to the 0.3.5 tree.
+delete	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	package.json	0.3.5	1
+duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.3.5	1
+duplicate	src/__tests__/version-site-guard.test.ts	agree in the working tree, on the version package.json declares	src/native/Recordings/RecordingsLib/Info.plist	0.3.5	2
 # --- a stale site is reported, not silently accepted: the mismatch filter removed.
 delete	src/__tests__/version-site-guard.test.ts	a single stale site is reported rather than silently accepted	scripts/set-version.ts	.filter((reading) => reading.version !== expected)	1
 # --- applyVersion writes every site in one pass: the per-file grouping removed.
@@ -58,4 +62,4 @@ delete	src/__tests__/version-site-guard.test.ts	applyVersion rewrites every site
 #
 # The generated SDK's version stamp -- a fifth copy of the release version that `versionSites`
 # deliberately does not write -- goes stale again.
-delete	src/__tests__/version-site-guard.test.ts	the generated SDK header carries the version package.json declares	src/sdk/v1.generated.ts	.15	1
+delete	src/__tests__/version-site-guard.test.ts	the generated SDK header carries the version package.json declares	src/sdk/v1.generated.ts	0.3.5	1

package/src/native/Recordings/RecordingsLib/Info.plist

@@ -11,17 +11,17 @@
     <key>CFBundleName</key>
     <string>Recordings</string>
     <key>CFBundleDisplayName</key>
-    <string>Recordings</string>
+    <string>Hasna Recordings</string>
     <key>CFBundleExecutable</key>
     <string>Recordings</string>
     <key>CFBundleIdentifier</key>
     <string>com.hasna.recordings</string>
     <key>CFBundleVersion</key>
-    <string>0.3.2</string>
+    <string>0.3.9</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.3.2</string>
+    <string>0.3.9</string>
     <key>LSMinimumSystemVersion</key>
     <string>26.0</string>
     <key>NSMicrophoneUsageDescription</key>

package/src/native/Recordings/RecordingsTests/CLIRunnerTests.swift

@@ -8,7 +8,7 @@ struct CLIRunnerTests {
     func bundledCLIIsPreferred() throws {
         let root = FileManager.default.temporaryDirectory
             .appendingPathComponent("recordings-bundled-cli-\(UUID().uuidString)")
-        let app = root.appendingPathComponent("Recordings.app")
+        let app = root.appendingPathComponent("HasnaRecordings.app")
         let helper = app.appendingPathComponent("Contents/Helpers/recordings")
         let home = root.appendingPathComponent("home")
         let external = home.appendingPathComponent(".bun/bin/recordings")
@@ -34,7 +34,7 @@ struct CLIRunnerTests {
     func packagedAppDoesNotUseGlobalFallback() throws {
         let root = FileManager.default.temporaryDirectory
             .appendingPathComponent("recordings-missing-companion-\(UUID().uuidString)")
-        let app = root.appendingPathComponent("Recordings.app")
+        let app = root.appendingPathComponent("HasnaRecordings.app")
         let home = root.appendingPathComponent("home")
         let external = home.appendingPathComponent(".bun/bin/recordings")
         try FileManager.default.createDirectory(at: app, withIntermediateDirectories: true)

package/src/native/Recordings/RecordingsTests/RecordingStartGateTests.swift

@@ -6,7 +6,7 @@ struct RecordingStartGateTests {
     @Test("permission-only launch skips global handlers and terminates after handling")
     func permissionHelperLaunchPlan() {
         let plan = PermissionRequestLaunchPlan(arguments: [
-            "/Applications/Recordings.app/Contents/MacOS/Recordings",
+            "/Applications/HasnaRecordings.app/Contents/MacOS/Recordings",
             "--request-permissions",
             "--open-permission-settings",
         ])

package/src/native/Recordings/Updater/BootstrapPreflight/BootstrapPreflightMain.swift

@@ -51,7 +51,7 @@ enum RecordingsBootstrapPreflight {
         let manifest = try JSONDecoder().decode(ReleaseManifest.self, from: manifestData)
         try validateManifest(manifest, payload: payload)
 
-        let app = arguments.payloadRoot + "/Applications/Recordings.app"
+        let app = arguments.payloadRoot + "/Applications/HasnaRecordings.app"
         let client = app + "/" + RecordingsUpdateConstants.updateClientRelativePath
         let broker = arguments.payloadRoot + "/Library/PrivilegedHelperTools/com.hasna.recordings.updater"
         let artifactVerifier = arguments.payloadRoot

package/src/native/Recordings/Updater/Broker/ApplicationNamespace.swift

@@ -7,7 +7,7 @@ import RecordingsUpdateProtocol
 /// operation; first installs use exclusive rename semantics and can never replace a
 /// leaf created concurrently in `/Applications`.
 final class ApplicationNamespace {
-    private static let liveLeaf = "Recordings.app"
+    private static let liveLeaf = "HasnaRecordings.app"
     private static let previousLeaf = "previous.app"
     private static let failedCandidateLeaf = "failed-candidate.app"
 
@@ -22,7 +22,7 @@ final class ApplicationNamespace {
             .deletingLastPathComponent
         guard journal.applicationPath == RecordingsUpdateConstants.applicationPath,
               journal.candidateApplicationPath == expectedTransactionDirectory
-                + "/candidate/Recordings.app",
+                + "/candidate/HasnaRecordings.app",
               journal.previousApplicationPath == nil ||
                 journal.previousApplicationPath == expectedTransactionDirectory + "/previous.app"
         else {

package/src/native/Recordings/Updater/Broker/BrokerMain.swift

@@ -276,7 +276,7 @@ final class UpdateBrokerSession: NSObject, RecordingsUpdateXPCProtocol {
         guard mkdir(candidateRoot, 0o700) == 0 else {
             throw BrokerOperationError.candidateRejected
         }
-        let candidateApplication = candidateRoot + "/Recordings.app"
+        let candidateApplication = candidateRoot + "/HasnaRecordings.app"
         let verifierIDs = try verifierAccountIDs()
         try CanonicalTreeCopier.copyApplication(
             from: verifierOutput,

package/src/native/Recordings/Updater/Broker/CanonicalTreeCopy.swift

@@ -22,7 +22,7 @@ enum CanonicalTreeCopier {
         }
         defer { Darwin.close(source) }
         let destinationRoot = URL(fileURLWithPath: rootCandidatePath).deletingLastPathComponent().path
-        guard URL(fileURLWithPath: rootCandidatePath).lastPathComponent == "Recordings.app" else {
+        guard URL(fileURLWithPath: rootCandidatePath).lastPathComponent == "HasnaRecordings.app" else {
             throw CanonicalCopyError.nonCanonicalRoot
         }
         let destination = Darwin.open(

package/src/native/Recordings/Updater/Broker/InstallJournal.swift

@@ -253,7 +253,7 @@ struct DurableInstallJournal {
         let leaf = URL(fileURLWithPath: transactionDirectory).lastPathComponent
         guard leaf.hasPrefix("transaction-") else { throw InstallJournalError.invalidJournal }
         let transactionID = String(leaf.dropFirst("transaction-".count))
-        let expectedCandidate = transactionDirectory + "/candidate/Recordings.app"
+        let expectedCandidate = transactionDirectory + "/candidate/HasnaRecordings.app"
         let activationPhases: Set<String> = [
             "prepared", "launch-barrier-pending", "launch-barrier-held",
             "swap-pending", "swapped", "previous-retaining",

package/src/native/Recordings/Updater/BrokerTests/ActivationRecoveryPolicyTests.swift

@@ -201,8 +201,8 @@ struct ActivationRecoveryPolicyTests {
             "Contents/Helpers/recordings": 493,
             "Contents/Helpers/recordings-update-client": 493
           },
-          "candidate_application_path": "/Library/Application Support/Hasna/Recordings/Updates/transaction-00000000-0000-0000-0000-000000000001/candidate/Recordings.app",
-          "application_path": "/Applications/Recordings.app"
+          "candidate_application_path": "/Library/Application Support/Hasna/Recordings/Updates/transaction-00000000-0000-0000-0000-000000000001/candidate/HasnaRecordings.app",
+          "application_path": "/Applications/HasnaRecordings.app"
         }
         """#.utf8)
         let journal = try JSONDecoder().decode(BrokerInstallJournal.self, from: legacyJSON)

package/src/native/Recordings/Updater/Protocol/UpdateProtocol.swift

@@ -7,7 +7,7 @@ public enum RecordingsUpdateConstants {
     public static let rootMaintenanceSupported = false
     public static let keyRotationSupported = false
     public static let machServiceName = "com.hasna.recordings.updater"
-    public static let applicationPath = "/Applications/Recordings.app"
+    public static let applicationPath = "/Applications/HasnaRecordings.app"
     public static let brokerExecutablePath = "/Library/PrivilegedHelperTools/com.hasna.recordings.updater"
     public static let stateRoot = "/Library/Application Support/Hasna/Recordings/Updates"
     public static let trustRoot = "/Library/Application Support/Hasna/Recordings/Trust"

package/src/native/Recordings/Updater/VerifierLauncher/RecordingsVerifierLauncher.c

@@ -729,7 +729,7 @@ int recordings_copy_canonical_application_tree(
         if (entry == NULL) break;
         if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) continue;
         visible_entries += 1;
-        if (strcmp(entry->d_name, "Recordings.app") != 0) only_application = false;
+        if (strcmp(entry->d_name, "HasnaRecordings.app") != 0) only_application = false;
     }
     int status = errno;
     closedir(directory);
@@ -739,7 +739,7 @@ int recordings_copy_canonical_application_tree(
     status = copy_directory_at(
         verifier_output_directory_descriptor,
         root_candidate_directory_descriptor,
-        "Recordings.app",
+        "HasnaRecordings.app",
         verifier_user_id,
         &budget
     );

package/src/native/Recordings/build.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Build, sign, notarize, and finalize a Recordings.app artifact.
+# Build, sign, notarize, and finalize a HasnaRecordings.app artifact.
 # Usage: ./build.sh [debug|local] | ./build.sh release <initial-bootstrap|app-update>
 
 set -euo pipefail
@@ -119,16 +119,12 @@ if [ "$VARIANT" = "bar" ]; then
     VARIANT_SWIFT_FLAGS=(-Xswiftc -DRECORDINGS_BAR_ONLY)
 fi
 # Fleet naming rule (knowledge k_msxd5rz3_jfvl3i): every Hasna macOS app is
-# Hasna<Name>.app with 'Hasna' at the beginning. The full app keeps its historical
-# Recordings.app name (its rename is the rule's recorded follow-up decision); the
-# bar-only artifact is named per the rule NOW — HasnaRecordings.app. The 'bar' is the
-# variant, never a separate app name: bundle identifier stays com.hasna.recordings so
-# TCC keeps keying on bundle id + signing identity, and the executable inside the
-# bundle stays "Recordings".
-APP_BUNDLE_NAME="Recordings.app"
-if [ "$VARIANT" = "bar" ]; then
-    APP_BUNDLE_NAME="HasnaRecordings.app"
-fi
+# Hasna<Name>.app with 'Hasna' at the beginning. The bundle is named
+# HasnaRecordings.app for BOTH variants (full and bar); the 'bar' is a variant, never
+# a separate app name. Bundle identifier stays com.hasna.recordings so TCC keeps
+# keying on bundle id + signing identity, and the executable inside the bundle stays
+# "Recordings".
+APP_BUNDLE_NAME="HasnaRecordings.app"
 readonly APP_BUNDLE_NAME
 APP_BASENAME="${APP_BUNDLE_NAME%.app}"
 PLIST_BUDDY="$(select_executable "/usr/libexec/PlistBuddy" "${RECORDINGS_TEST_PLIST_BUDDY_EXECUTABLE:-${PLIST_BUDDY:-}}")"
@@ -1260,7 +1256,7 @@ fi
 
 generate_and_verify_native_fs_guard
 
-echo "Building Recordings.app ($MODE)..."
+echo "Building HasnaRecordings.app ($MODE)..."
 if [ "$MODE" = "release" ]; then
     OUTPUT_BUILD_DIR="$BUILD_ROOT/release-output"
 else
@@ -1426,15 +1422,15 @@ if [ "$MODE" = "release" ] && [ "$HOST_PLATFORM" = "Darwin" ]; then
     fi
 fi
 "$CP_EXECUTABLE" "$SOURCE_NATIVE_DIR/RecordingsLib/Info.plist" "$CONTENTS/Info.plist"
+# Bundle display name per the fleet naming rule (knowledge k_msxd5rz3_jfvl3i):
+# "Hasna Recordings" with 'Hasna' at the beginning, for both variants.
+"$PLIST_BUDDY" -c 'Set :CFBundleDisplayName Hasna Recordings' "$CONTENTS/Info.plist"
 if [ "$VARIANT" = "bar" ]; then
     # The bar is an accessory app: LSUIElement keeps it out of the Dock and the app
     # switcher, and the app's window-declaring control flow (RECORDINGS_BAR_ONLY)
     # keeps the workspace window absent. The bundle identifier stays com.hasna.recordings
-    # so TCC grants continue to key on bundle id + signing identity, and the bundle is
-    # named per the fleet rule (knowledge k_msxd5rz3_jfvl3i) — HasnaRecordings.app with
-    # the display name "Hasna Recordings"; 'Hasna' at the beginning of the name.
+    # so TCC grants continue to key on bundle id + signing identity.
     "$PLIST_BUDDY" -c 'Add :LSUIElement bool true' "$CONTENTS/Info.plist"
-    "$PLIST_BUDDY" -c 'Set :CFBundleDisplayName Hasna Recordings' "$CONTENTS/Info.plist"
 fi
 VERSION="$("$PLIST_BUDDY" -c 'Print :CFBundleShortVersionString' "$CONTENTS/Info.plist")"
 
@@ -1670,8 +1666,6 @@ run_signed_helper_contract() {
         HOME="$contract_home"
         PATH="/usr/bin:/bin:/usr/sbin:/sbin"
         TMPDIR="$contract_home"
-        HASNA_RECORDINGS_CLIENT_STORE="sqlite"
-        RECORDINGS_CLIENT_STORE="sqlite"
         HASNA_RECORDINGS_DB_PATH="$contract_home/recordings.db"
         RECORDINGS_AUDIO_DIR="$contract_home/audio"
     )
@@ -1998,7 +1992,7 @@ if [ "$MODE" = "local" ]; then
 fi
 
 verify_signed_code "$HELPERS/recordings" "Companion CLI"
-verify_signed_code "$APP_DIR" "Recordings.app"
+verify_signed_code "$APP_DIR" "HasnaRecordings.app"
 ARTIFACT_BASENAME="${APP_BASENAME}-${VERSION}-macos-${RELEASE_SUBTYPE}"
 NOTARY_ARCHIVE="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}-notarization.zip"
 FINAL_ARCHIVE="$OUTPUT_BUILD_DIR/${ARTIFACT_BASENAME}.zip"
@@ -2050,7 +2044,7 @@ run_xcrun stapler validate "$APP_DIR"
 run_release_sensitive_tool "$SPCTL_EXECUTABLE" --assess --type execute --verbose=2 "$APP_DIR"
 run_release_sensitive_tool "$SYSPOLICY_CHECK_EXECUTABLE" distribution "$APP_DIR"
 verify_signed_code "$HELPERS/recordings" "Companion CLI"
-verify_signed_code "$APP_DIR" "Recordings.app"
+verify_signed_code "$APP_DIR" "HasnaRecordings.app"
 run_codesign --verify --deep --strict --verbose=2 "$APP_DIR"
 
 run_release_sensitive_tool "$DITTO_EXECUTABLE" -c -k --sequesterRsrc --keepParent "$APP_DIR" "$FINAL_ARCHIVE"