Harden DropPoint receiver lifecycle and storage

docs/guide/drop-point.md

@@ -35,7 +35,7 @@ Set these environment variables before starting Procnote:
 
 | Variable                         | Required | Description                                                                                                                  |
 | -------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| `PROCNOTE_DROPPOINT_URL`         | Yes      | Base URL of your DropPoint instance, for example `https://drop.example.com`. Must not include query, fragment, or user info. |
+| `PROCNOTE_DROPPOINT_URL`         | Yes      | Root origin of your DropPoint instance, for example `https://drop.example.com`. Must not include a path prefix, query, fragment, or user info. |
 | `PROCNOTE_DROPPOINT_API_TOKEN`   | Yes      | Plaintext DropPoint API token used by Procnote to create receiver-side drop points.                                          |
 | `PROCNOTE_DROPPOINT_TTL_SECONDS` | No       | Requested lifetime, in seconds, for each upload session. Must be a positive integer.                                         |
 | `PROCNOTE_DROPPOINT_MAX_BYTES`   | No       | Requested maximum encrypted upload size, in bytes. Must be a positive integer and within the server's configured limit.      |
@@ -50,7 +50,7 @@ PROCNOTE_DROPPOINT_MAX_BYTES=52428800 \
 procnote /path/to/my-workspace
 ```
 
-Both required variables must be set. If only one of them is set, Procnote disables DropPoint and logs a configuration warning.
+Both required variables must be set to create new DropPoint sessions. If only one is set, Procnote disables new session creation and logs a configuration warning. A previously persisted receiver session can still resume pickup or close from its owner-only private state without retaining the API creation token.
 
 ## Use DropPoint During an Execution
 
@@ -60,6 +60,10 @@ When DropPoint is configured, attachment inputs show an **Upload via QR Code** b
 2. Ask the sender to scan the QR code with their device.
 3. Confirm that the sender's upload page shows the same human-readable drop name shown in Procnote.
 4. Wait while the sender selects and uploads files.
-5. Procnote imports the uploaded files as local attachments and closes the remote drop point.
+5. Procnote authenticates the complete encrypted bundle, installs all files atomically as local attachments, durably records them in the execution log, and only then closes the remote drop point.
 
-If local import fails after upload, Procnote keeps the DropPoint session open until it is cancelled, retried, closed, or expires, so the import can be retried without asking the sender to upload again.
+If pickup, local installation, execution-log recording, or remote close fails, Procnote retains resumable private session state and leaves recoverable remote ciphertext available. Use **Retry** (or reopen the same attachment upload after restarting Procnote) to continue without reinstalling an already verified bundle. A relay-reported `expired`, `failed`, or prematurely `closed` state is terminal.
+
+Recovered files are published together beneath the execution's `attachments/bundle-dp_…/` directory. The directory includes an owner-only `.droppoint-receipt.json` identity receipt used only for crash recovery and conflict detection; the receipt is not shown as an attachment. Procnote never merges into or overwrites a different pre-existing bundle directory.
+
+Pickup capabilities and recipient private keys are stored atomically with owner-only access in the operating system's application-local data directory, outside the git-friendly procedure workspace. Procnote removes those secrets from private state only after remote close succeeds or a terminal remote outcome has been durably recorded.

docs/guide/running-an-execution.md

@@ -82,7 +82,10 @@ my-workspace/
             ├── template.md
             └── attachments/
                 ├── a1b2c3d-report.pdf
-                └── d4e5f6a-photo.jpg
+                ├── d4e5f6a-photo.jpg
+                └── bundle-dp_…/          # Atomically installed DropPoint bundle
+                    ├── .droppoint-receipt.json
+                    └── scan-01.jpg
 ```
 
-The `events.jsonl` file is the single source of truth. It is append-only and never modified after creation.
+The `events.jsonl` file is the single source of truth. It is append-only and never modified after creation. DropPoint bundle receipts support local crash recovery and are not attachment records themselves.

src-tauri/Cargo.toml

@@ -40,10 +40,12 @@ tauri-plugin-log.workspace = true
 tauri-plugin-opener.workspace = true
 thiserror.workspace = true
 ts-rs.workspace = true
+unicode-general-category = "1.1.0"
+unicode-normalization = "0.1.25"
 url = "2.5.8"
 uuid.workspace = true
 x25519-dalek = { version = "3.0.0", features = ["static_secrets", "getrandom"] }
-zeroize = "1.9.0"
+zeroize = { version = "1.9.0", features = ["serde"] }
 
 [build-dependencies]
 tauri-build.workspace = true
@@ -52,4 +54,11 @@ tauri-build.workspace = true
 workspace = true
 
 [dev-dependencies]
+proptest = "1.11.0"
 tempfile.workspace = true
+
+[target."cfg(windows)".dependencies]
+windows-sys = { version = "0.61.2", features = ["Win32_Storage_FileSystem"] }
+
+[target."cfg(unix)".dependencies]
+rustix = { version = "1.1.4", features = ["fs"] }