Round 4's review confirmed the commit() guard genuinely closes every
project-save path (keyboard shortcuts included), but caught the fix's own
comment overreaching: "every mutating path in this module funnels through
here" is false. store.js's shortcut/category/transition CRUD functions
(saveShortcut, deleteShortcut, addCategory, importShortcuts,
clearShortcuts, saveTransition, deleteTransition, importTransitions,
clearTransitions) each call their own real, unmocked API.* endpoint
directly and never touch commit() at all -- a second, separate funnel the
guard doesn't cover.
Currently dormant (no Settings > Shortcuts panel is wired up in v5 yet,
confirmed by grep -- these functions have no caller anywhere outside
store.js/api.js today), same shape as the saveClipToMediaBin landmine
rounds 2-3 already closed pre-emptively rather than waiting for it to go
live. These write GLOBAL state (the on-disk shortcut/transition library),
not sandboxed per-project state like everything commit() guards, so if
left open they'd be worse than a stray project PUT once a Shortcuts UI
ships.
Fixed with the same block-list pattern, and corrected both comments
(store.js's commit() guard, tour.js's blocklist) to state their actual
scope instead of the overclaim.
Verified live: all nine now return the block toast instead of reaching
Store's real implementation; full tour sequence still completes with zero
thrown errors.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
