Module mode 

The one runtime decision between a release run and a test run (M21), and the only sanctioned reader of a test or override selector (M23).

Design rule: the strongest guarantee is that a release binary contains no code that reads a test or override selector. So there are two builds of this module:

• Without the test-mode cargo feature (the default, and the only thing a release build may use): decide returns Mode::Release and performs no environment or argument read at all. [test_selector!] expands to None and drops its name literal. The binary carries no selector name and no [TEST_MODE_MARKER]. roots resolves from the operating system’s account database (Suite::per_user_default), never from the environment.
• With test-mode (QA and dev builds only): decide reads the activation selector. A run is a test run only when the activation selector AND a root that passes every check below are present; anything partial is a Refusal before any store, log, credential or service opens. The root must be absolute, an existing directory, not itself a symlink, disjoint from the real per-user suite root and the user’s Documents/Pictures-style folders (equal, ancestor, descendant, or reached through a symlinked ancestor), outside cloud-sync folders, private to the current user on Unix, and carry the binding file (.rightkit-app.json, {"app": "<id>"}) that rightkit-qa writes when it creates an isolated home, naming this app.

@rightkit/release (release-switch-scan.mjs) refuses a release build that enables test-mode, and refuses a native binary that contains [TEST_MODE_MARKER] text or any selector name. Selector names therefore live only behind the feature, and no message in this module that is compiled into a release build names one.

The decision is deliberately injectable (ModeInput) so tests can prove the “reads nothing” and “refuses” properties without touching the real process environment.

Structs

AppId

The app asking for a mode. id is the binding key ("viewright"); dir_name is the folder under Orthic Labs that holds the app’s own data ("ViewRight").

AppRoots

Resolved roots a store must come through.

ProcessInput

The real process environment.

TestRoot

A verified test root: canonical, symlink-free at the leaf, disjoint from real user data, private, and bound to one app by the runner. Constructible only by decide in a build that compiled test-mode.

Enums

Mode

How a run was decided. Release is the only value a build without test-mode can produce.

Refusal

Why a test run was refused. Each variant names its rule through Refusal::rule. Messages never name an environment variable: this enum is compiled into release builds too.

Constants

TEST_CAPABILITY

Whether this build compiled the test capability (cargo feature test-mode).

Traits

ModeInput

Where decide reads from. The default implementation of the provided methods is the real operating system. A test supplies a fake, including one that panics on any read.

Functions

decide

Decide once, before any store, log, credential or service starts.

default_protected_paths

Protected paths derived from the real suite root: the whole Orthic Labs folder and the user’s content folders under the home.

init_or_exit

decide against the real process, once per process. Prints one line to stderr and exits with status 2 on a Refusal; hosts call it first in main.

roots

The roots every store must come through, against the real process.

roots_with

roots with an injectable source for the real per-user root.