Retry USB approval notifications after delivery failure

bin/omarchy-usb-authorization-event

@@ -68,11 +68,16 @@ jq -n \
 chmod 600 "$temporary"
 mv -f "$temporary" "$request"
 
-omarchy-notification-send \
+if ! omarchy-notification-send \
   --app-name omarchy-action \
   --urgency critical \
   --glyph 󰖀 \
   "USB accessory blocked" \
   "Click to review it. Keep it blocked unless you recognize the device." \
   --exec omarchy-launch-floating-terminal-with-presentation \
-  omarchy-usb-authorization-review "$token"
+  omarchy-usb-authorization-review "$token"; then
+  # Only a delivered notification may suppress subsequent attempts. Keep the
+  # lock until failure cleanup so another event cannot skip an unsent request.
+  rm -f "$request"
+  exit 1
+fi

test/shell.d/usb-authorization-test.sh

@@ -123,6 +123,7 @@ cat >"$stub_bin/omarchy-notification-send" <<'STUB'
 printf 'notification' >>"$CALLS"
 printf ' <%s>' "$@" >>"$CALLS"
 printf '\n' >>"$CALLS"
+exit "${NOTIFICATION_FAIL:-0}"
 STUB
 chmod +x "$stub_bin"/*
 
@@ -439,6 +440,18 @@ fi
 [[ ! -e $request ]] || fail "a stale review request is discarded"
 pass "USB review binds approval to the device snapshot"
 
+notification_count=$(grep -c '^notification' "$calls")
+if NOTIFICATION_FAIL=1 USBGUARD_IPC_SIGNAL=IPC.Connected \
+  "$ROOT/bin/omarchy-usb-authorization-event"; then
+  fail "a failed notification must report failure"
+fi
+[[ ! -e $request ]] || fail "a failed notification must not suppress retries"
+USBGUARD_IPC_SIGNAL=IPC.Connected "$ROOT/bin/omarchy-usb-authorization-event"
+[[ -f $request ]] || fail "reconnection retries a failed notification"
+[[ $(grep -c '^notification' "$calls") == $((notification_count + 2)) ]] ||
+  fail "reconnection must attempt delivery after an earlier send failure"
+pass "failed USB notifications can be retried on reconnection"
+
 sysfs="$scratch/sys/bus/usb/devices"
 mkdir -p "$sysfs/usb1" "$sysfs/1-2"
 echo 0 >"$sysfs/usb1/authorized_default"