Changelog

PluginLoadContext now resolves assemblies from sibling plugin directories

when the plugin's own directory and host don't have them. This fixes the

Tasks plugin failing to load in client mode with FileNotFoundException

for PrivStack.Plugin.Tasks.Headless — the Headless DLL is deployed to

its own sibling directory (plugins/PrivStack.Plugin.Tasks.Headless/)

and the Tasks plugin depends on it for shared models and services.

Also guard Emergency Kit regeneration in client mode — SetupRecovery()

requires the native runtime which isn't initialized when running as a

client. Shows a clear message directing users to the server instance.

Migrate Journal, Finance, Habits, WebClips, Canvas, Data, and Email

from local ErrorMessage/StatusMessage patterns to the shell's unified

IToastService. Email was the most involved — removed _errorMessage

ObservableProperty, ClearStatusAfterDelay helper, and converted all

ErrorMessage/StatusMessage completion notifications across 8 partial

class files to _toast?.Show() calls. StatusMessage retained for

in-progress indicators (sync status text). Sub-ViewModels (Compose,

AccountSetup, AccountSettings) keep their own ErrorMessage for inline

form validation.

Two root causes fixed:

1. PluginRegistry logging silently dead after workspace switch:

The static readonly ILogger field was captured from the old Serilog logger.

When ReconfigureForWorkspace calls Log.CloseAndFlush(), the ForContext child

becomes bound to a disposed logger — all subsequent messages silently vanish.

Changed to a property that always reads from the current Serilog.Log instance.

Added Console.Error fallback in plugin init catch blocks so errors are always

visible regardless of Serilog state.

2. No UI for any plugin in client mode:

MainWindowViewModel.SelectTab() guards on _service.IsInitialized, where

_service is IPrivStackRuntime (native Rust/DuckDB runtime). In client mode

the native runtime is intentionally NOT initialized — the headless server

owns DuckDB and the desktop routes all SDK calls through HTTP transport.

This caused SelectTab to abort with "Not initialized" for every plugin,

preventing any plugin view from being created or displayed.

Added IsServiceReady property that checks either native init OR client mode,

and replaced all 4 guard sites in the ViewModel.

• Add IToastService to NotesViewModel constructor (injected from Host.Toast via NotesPlugin)
• Replace all ~45 ErrorMessage assignments with Toast() calls using ToastType.Error
• Remove [ObservableProperty] string? _errorMessage field (toast auto-dismisses)
• Remove inline ErrorMessage border from NotesView.axaml (toast UI is shell-provided)
• Add success toasts for key operations: wiki push, page duplicate, trash, restore, empty trash, template applied
• Clean up double blank lines left by ErrorMessage = null removal
• Leave SaveAsTemplate and WikiSources ErrorMessage untouched (form-level validation, separate VMs)

• PluginRegistry: Skip *.Headless.dll during assembly scan in Desktop mode.

Headless plugin DLLs are server-only but were being loaded by the Desktop's

ScanAssemblyPlugins, creating type identity conflicts and duplicate plugin

IDs (both TasksPlugin and TasksHeadlessPlugin share ID "privstack.tasks").

• SettingsViewModel: Guard ToggleApiServerAsync with App.IsClientMode.

Setting ApiEnabled in the constructor triggered OnApiEnabledChanged which

called StartAsync on the local API server — even in client mode where

the remote server already owns port 9720.

• MainWindowViewModel: Skip SubscriptionValidationService.ValidateAsync

in client mode. The service calls ILicensingService.GetLicenseStatus()

which hits the uninitialized native runtime. License status is already

proxied from the server during client mode detection.

• SyncPairingViewModel: Skip LoadInitialState in client mode. The method

calls IPairingService FFI methods (GetSyncCode, SetDeviceName, etc.)

that require the native runtime. Server handles sync in client mode.