Bundle 49B: desktop library read model and safe renderer UX

[nulleimy]

Value

Complete the safe, user-visible half of Bundle 49 by rendering the already-returned imported track DTOs and import issues without expanding renderer authority.

Canonical base

• repository: nulleimy/APPLAYLIST
• base branch: feature/bundle-0-bootstrap
• exact base SHA: bc6fd0ab2fa88c21af3f2bddeb8df28b641b92bd
• predecessor: merged PR Bundle 49: secure desktop library import vertical slice #98 + rustfmt follow-up Bundle 49: apply rustfmt to sidecar bridge #99

Schema tree

native LibraryRootCapability
  -> existing library_import_root command
  -> existing DesktopLibraryImportResult
  -> safe renderer DTO validation
  -> library table + empty state + issue list

Deliverables

• validate tracks[] and issues[] before rendering;
• render title, artist, file format, duration and import state;
• render skipped/import/persistence issues without absolute paths;
• explicit empty/loading/error/result states;
• accessible semantic table and status regions;
• static renderer security contract tests;
• no new Tauri command or permission.

Security boundary

• no filesystem API in renderer;
• no shell/network authority;
• no raw canonical path rendering;
• no direct SQLite access;
• DOM writes use safe text sinks / created nodes only;
• authorized invoke set remains exactly library_choose_root and library_import_root.

Out of scope

• progress streaming;
• active import cancellation command;
• analysis jobs;
• provider authority changes;
• release/signing/notarization;
• merge authorization.

Acceptance

• representative populated result renders deterministic rows;
• empty result has a clear empty state;
• issues are visible and bounded to safe DTO fields;
• renderer security contract still rejects generic host/network authority;
• applicable CI passes on the exact PR head.

Follow-up: Bundle 49C adds bounded progress/cancellation lifecycle before Bundle 50 starts.