# Inkhaven 1.3.36 — Every snapshot, and a lock on the door

_The snapshot **browser** finally lets you look across your whole project's history, not
just the open paragraph's. Alongside it, the first slice of the road-to-1.4.0
**hardening sweep**: never-panic fuzz coverage for the parsers that read untrusted
files, and an advisory **project lock** that guards the store against two sessions at
once — informing, never blocking. Plus two fixes to the 1.3.35 goals editor. All pure
additions over existing infrastructure; the lock reuses a dependency already present._

_Plan: [SNAPSHOT_HARDENING_PLAN.md](../PROPOSALS/SNAPSHOT_HARDENING_PLAN.md) · Roadmap:
[ROADMAP-1.4.0.md](../PROPOSALS/ROADMAP-1.4.0.md)_

## The project-wide snapshot browser

`F6` has always shown the open paragraph's snapshots. **`Ctrl+F6`** now opens a
**project-wide browser** — every snapshot across *all* paragraphs, newest first, one
row each (timestamp · words · paragraph · annotation):

- `↑↓` moves; the list scrolls with a cursor-following window.
- `/` filters by **paragraph title or annotation** (case-insensitive; Enter/Esc leaves
  the filter, a second Esc closes).
- `V` diffs the selection against its paragraph's **current** text — the same
  side-by-side diff modal `F6` uses, returning to the browser on Esc.
- `Enter` opens that paragraph and drops you into its `F6` picker, where load / restore /
  pin live.

Built on the existing snapshot engine: a new `Store::list_all_snapshots()` (the
per-paragraph query minus its parent filter) feeding the proven `compute_line_diff` +
diff modal. Available from any pane; self-lists in the command palette.

## Hardening — parser fuzzing

The importers that read **untrusted external files** now carry never-panic property
tests, in the same style as the existing calendar/config sweeps:

- **Scrivener RTF** (`rtf_to_typst` + the plain-text fallback) — arbitrary bytes and an
  RTF control-word/brace/prose token-salad.
- **Typst syntax check** (`check`) — arbitrary Unicode source and a markup-delimiter
  salad, exercising the byte-offset → line/col mapping over multibyte input.
- **Scrivener `.scrivx` binder XML** (`parse_scrivx`) — arbitrary bytes and an XML
  tag/attribute salad with unbalanced and mis-nested tags through `quick_xml`.

Seven new proptests, ~256 cases each. They surfaced **no panics** — so the parsers were
already robust; this locks that in against regressions.

## Hardening — the advisory project lock

Two `inkhaven` sessions open on the same project both write `metadata.db` and
`.session.json`; interleaved writes can corrupt the store. A new lock guards against
that **without ever hard-blocking** — true to Inkhaven's permissive principle, it
*informs* and the author decides:

- An **OS advisory lock** (`flock` / `LockFileEx`) on `<project>/.inkhaven.lock`. The
  kernel releases it on exit, crash, or `kill -9`, so there is **no stale-lock cleanup**
  to get wrong — a dead session never locks anyone out.
- On launch, if another live session holds it, you get a clear warning naming the other
  process and an **"Open anyway? [y/N]"** prompt. Decline leaves the existing session
  untouched; accept proceeds. A filesystem without advisory locks, or any lockfile
  error, simply proceeds — infrastructure never blocks you.

CLI subcommands stay unlocked: they're short-lived and intentional.

## Goals-editor fixes (from 1.3.35)

- **Backspace now deletes** in the goals editor. Some terminals report the Backspace key
  as a control char rather than `KeyCode::Backspace`; the editor now accepts all the
  encodings (and `Delete`).
- A `0` ("disabled") field seeds as **empty** (still rendered as `0`), so you type the
  new target cleanly instead of deleting a stuck `0` first.
- The `Ctrl+B Shift+G` heatmap now opens the goals editor on **`e`** too — the natural
  place to want to adjust a target.

## Dependencies & compatibility

**No external application or binary dependencies; no new runtime crates** — the lock
reuses `fs2`, already in the tree. No on-disk shape moved; `.inkhaven.lock` is a new,
self-managing dotfile. The fuzz tests are dev-only. Tests 1813 → 1825.
