N1.1 — mutation-proof document output guards

docs/tally/compatibility/compatibility-matrix.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "6b8b8ab6ed23d0e70d44b79bf497e23a1ebc32422911b19cdc213cac7dcd6c82",
+  "compatibility_surface_sha256": "95e55d137ec3ef4b4de570dc0dab554bc926ca75435284342629312ed2d7725e",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",

docs/tally/compatibility/compatibility-surface.json

@@ -219,7 +219,7 @@
     },
     {
       "path": "src-tauri/src/commands.rs",
-      "sha256": "052b45f94751a01a1b7960cd861d1c122b49f0b80088b0434fc33e958396992d"
+      "sha256": "8d13e54b487bf27984ed988abee126d90e63a21a72d12aa21a819796bff4c569"
     },
     {
       "path": "src-tauri/src/db/encrypted.rs",
@@ -434,5 +434,5 @@
       "sha256": "a27f294ee15e407b69fdfc73609e8708ac0509b6e6a8872daef5451fde61a8db"
     }
   ],
-  "manifest_sha256": "6b8b8ab6ed23d0e70d44b79bf497e23a1ebc32422911b19cdc213cac7dcd6c82"
+  "manifest_sha256": "95e55d137ec3ef4b4de570dc0dab554bc926ca75435284342629312ed2d7725e"
 }

src-tauri/src/commands.rs

@@ -2843,8 +2843,7 @@ fn save_report_download_bytes(
     contents: &[u8],
 ) -> Result<String, String> {
     use tauri::Manager as _;
-    let file_name = portable_export_file_name(file_name)?;
-
+    let file_name = checked_export_file_name(file_name)?;
     // Tauri's own path resolver, so this needs no extra crate and no
     // capability grant.
     let downloads = app
@@ -2857,6 +2856,10 @@ fn save_report_download_bytes(
     Ok(path.to_string_lossy().into_owned())
 }
 
+fn checked_export_file_name(file_name: &str) -> Result<String, String> {
+    portable_export_file_name(file_name)
+}
+
 /// Reveals an exported file in the OS file manager.
 ///
 /// Only ever called with a path this process just wrote, and the path is
@@ -3244,6 +3247,32 @@ mod party_statement_export_tests {
         let pdf: ExportPartyStatementRequest = serde_json::from_value(pdf).unwrap();
         assert!(matches!(pdf.format, PartyStatementFormat::Pdf));
     }
+
+    #[test]
+    fn local_export_file_names_reject_path_like_and_hidden_values() {
+        assert_eq!(
+            checked_export_file_name(" statement.csv ").unwrap(),
+            "statement.csv"
+        );
+        for name in [
+            "",
+            ".hidden.csv",
+            "../statement.csv",
+            "nested/report.csv",
+            "nested\\report.csv",
+        ] {
+            assert!(
+                checked_export_file_name(name).is_err(),
+                "{name:?} must be rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn statement_party_slug_is_portable_and_nonempty() {
+        assert_eq!(statement_filename_slug("  ../Aarav & Sons  "), "aarav-sons");
+        assert_eq!(statement_filename_slug("///"), "party");
+    }
 }
 
 #[derive(Debug, Deserialize)]

src-tauri/src/reports/bulk_party_statement.rs

@@ -301,6 +301,10 @@ mod tests {
         let file = destination.path().join(&result.written[0].file_name);
         assert!(file.starts_with(destination.path()));
         assert!(file.is_file());
+        assert_eq!(
+            fs::read(&file).expect("statement bytes are readable"),
+            b"synthetic workbook"
+        );
         assert_eq!(
             result.written[0].file_name,
             "statement-etc-passwd-20260808.xlsx"
@@ -369,6 +373,29 @@ mod tests {
         assert_eq!(result.written[0].payable_amount, "7");
     }
 
+    #[test]
+    fn per_party_file_creation_failure_is_retained_in_the_manifest() {
+        let destination = tempfile::tempdir().expect("temporary destination");
+        let result = write_bulk_party_statements(
+            destination.path(),
+            "Synthetic Books Pvt Ltd",
+            "20260808",
+            "pdf/invalid",
+            &[bill("Write Failure", "10.00")],
+            &[],
+            |_| Ok(b"synthetic PDF".to_vec()),
+        )
+        .expect("a partial batch result is returned");
+
+        assert!(result.written.is_empty());
+        assert_eq!(result.failures.len(), 1);
+        assert_eq!(result.failures[0].party, "Write Failure");
+        assert!(result.failures[0].error.contains("could not create"));
+        let manifest = fs::read_to_string(&result.manifest_path).expect("manifest is written");
+        assert!(manifest.contains("Write Failure"));
+        assert!(manifest.contains("could not create"));
+    }
+
     #[test]
     fn colliding_safe_names_are_written_to_distinct_files() {
         let destination = tempfile::tempdir().expect("temporary destination");

src-tauri/src/reports/party_statement_pdf.rs

@@ -587,6 +587,23 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn invalid_statement_date_fails_instead_of_using_a_default() {
+        let statement = build_party_statement(
+            "Synthetic Books Pvt Ltd",
+            "not-a-date",
+            "Synthetic Party",
+            &[bill("INV-1", "10.00", 5)],
+            &[],
+        )
+        .expect("the renderer owns document-date validation");
+
+        assert!(matches!(
+            render_party_statement_pdf(&statement),
+            Err(PartyStatementPdfError::InvalidDate(value)) if value == "not-a-date"
+        ));
+    }
+
     #[test]
     fn an_unrepresentable_amount_fails_instead_of_becoming_zero() {
         assert_eq!(