From f52c04fa954213529f0e800969406baa82ab0b2a Mon Sep 17 00:00:00 2001
From: Stuart Meeks <stuart.meeks@stuartmeeks.net>
Date: Sat, 30 May 2026 10:20:45 +0000
Subject: [PATCH 1/5] Add change-storage-location with move / adopt / restart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Settings → Storage location gains a "Change…" button. Picking a folder
classifies the change (Core StorageRelocationService):
- target already has a store -> adopt it (current store left in place; this
  is the conflict/warn case, surfaced in the confirm copy)
- target empty, current has a store -> move store + icons there
- neither -> just adopt the empty target

On confirm, the new path is persisted and the app restarts (IAppRestartService
-> AppInstance.Restart). The storage path is only read at startup, so
apply-and-restart keeps the immutable startup singletons consistent and avoids
the running app writing snips to the old location after the switch (a
live-repoint would need a store-indirection refactor + Windows runtime
verification — deferred deliberately).

New Core: IStorageRelocationService/StorageRelocationService,
IFolderPickerService, IAppRestartService; SettingsViewModel gains
ChangeStoragePathCommand and an observable StorageDirectory. App:
WindowsFolderPickerService, WindowsAppRestartService, DI + XAML wiring.
20 new Core tests (relocation outcomes + move; VM move/adopt/cancel/picker-cancel).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   7 +
 src/Snipdeck.App/Bootstrap.cs                 |   3 +
 .../Services/WindowsAppRestartService.cs      |  16 ++
 .../Services/WindowsFolderPickerService.cs    |  33 +++++
 src/Snipdeck.App/Views/ShellPage.xaml         |  15 +-
 .../Abstractions/IAppRestartService.cs        |  12 ++
 .../Abstractions/IFolderPickerService.cs      |  11 ++
 .../Abstractions/IStorageRelocationService.cs |  41 ++++++
 .../Services/StorageRelocationService.cs      |  85 +++++++++++
 .../ViewModels/SettingsViewModel.cs           |  85 ++++++++++-
 .../Services/StorageRelocationServiceTests.cs | 100 +++++++++++++
 .../Support/FakeAppRestartService.cs          |  11 ++
 .../Support/FakeFolderPickerService.cs        |  11 ++
 .../ViewModels/SettingsViewModelTests.cs      | 139 +++++++++++++++++-
 .../ViewModels/ShellViewModelTests.cs         |   5 +
 15 files changed, 567 insertions(+), 7 deletions(-)
 create mode 100644 src/Snipdeck.App/Services/WindowsAppRestartService.cs
 create mode 100644 src/Snipdeck.App/Services/WindowsFolderPickerService.cs
 create mode 100644 src/Snipdeck.Core/Abstractions/IAppRestartService.cs
 create mode 100644 src/Snipdeck.Core/Abstractions/IFolderPickerService.cs
 create mode 100644 src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
 create mode 100644 src/Snipdeck.Core/Services/StorageRelocationService.cs
 create mode 100644 tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
 create mode 100644 tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
 create mode 100644 tests/Snipdeck.Core.Tests/Support/FakeFolderPickerService.cs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6be3a53..e8bb1af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   IL2104 on the WinAppSDK/WinRT/Jdenticon assemblies, which aren't trim-safe.
 
 ### Added
+- **Change the storage location.** A "Change…" button on Settings → Storage
+  location lets you pick a new folder for your snips. If the folder already
+  contains a Snipdeck store it's adopted (your current snips are left where
+  they are); otherwise your store and icons are moved there. The choice is
+  confirmed first, and Snipdeck restarts to apply it — the storage path is
+  read at startup, so restarting keeps everything consistent and avoids
+  writing to the old location after the switch.
 - **Rebindable global hotkey.** The global hotkey is now editable from
   Settings: click the capture box and press a shortcut (at least one of
   Ctrl/Alt/Shift plus a key). The new binding registers and persists
diff --git a/src/Snipdeck.App/Bootstrap.cs b/src/Snipdeck.App/Bootstrap.cs
index 52bc1f4..d2e976b 100644
--- a/src/Snipdeck.App/Bootstrap.cs
+++ b/src/Snipdeck.App/Bootstrap.cs
@@ -42,6 +42,9 @@ public static IServiceProvider Build()
                 .AddSingleton<IClipboardService, WindowsClipboardService>()
                 .AddSingleton<IIconNormaliser, WindowsIconNormaliser>()
                 .AddSingleton<IFilePickerService, WindowsFilePickerService>()
+                .AddSingleton<IFolderPickerService, WindowsFolderPickerService>()
+                .AddSingleton<IAppRestartService, WindowsAppRestartService>()
+                .AddSingleton<IStorageRelocationService>(new StorageRelocationService(_snipStoreFileName))
                 .AddSingleton<IHotkeyService, WindowsHotkeyService>()
                 .AddSingleton<ITrayService, HNotifyIconTrayService>()
                 .AddSingleton<IShellInteractions, WindowsShellInteractions>()
diff --git a/src/Snipdeck.App/Services/WindowsAppRestartService.cs b/src/Snipdeck.App/Services/WindowsAppRestartService.cs
new file mode 100644
index 0000000..a62978b
--- /dev/null
+++ b/src/Snipdeck.App/Services/WindowsAppRestartService.cs
@@ -0,0 +1,16 @@
+using Snipdeck.Core.Abstractions;
+
+using Microsoft.Windows.AppLifecycle;
+
+namespace Snipdeck.App.Services
+{
+    internal sealed class WindowsAppRestartService : IAppRestartService
+    {
+        public void Restart()
+        {
+            // Windows App SDK gracefully terminates and relaunches the current
+            // instance. Used to apply a storage-location change cleanly.
+            _ = AppInstance.Restart(string.Empty);
+        }
+    }
+}
diff --git a/src/Snipdeck.App/Services/WindowsFolderPickerService.cs b/src/Snipdeck.App/Services/WindowsFolderPickerService.cs
new file mode 100644
index 0000000..3a7116f
--- /dev/null
+++ b/src/Snipdeck.App/Services/WindowsFolderPickerService.cs
@@ -0,0 +1,33 @@
+using Snipdeck.Core.Abstractions;
+
+using Windows.Storage.Pickers;
+
+namespace Snipdeck.App.Services
+{
+    internal sealed class WindowsFolderPickerService : IFolderPickerService
+    {
+        private readonly IServiceProvider _services;
+
+        public WindowsFolderPickerService(IServiceProvider services)
+        {
+            ArgumentNullException.ThrowIfNull(services);
+            _services = services;
+        }
+
+        public async Task<string?> PickFolderAsync()
+        {
+            var picker = new FolderPicker
+            {
+                SuggestedStartLocation = PickerLocationId.DocumentsLibrary,
+            };
+            picker.FileTypeFilter.Add("*");
+
+            var mainWindow = (MainWindow)_services.GetService(typeof(MainWindow))!;
+            var hwnd = WinRT.Interop.WindowNative.GetWindowHandle(mainWindow);
+            WinRT.Interop.InitializeWithWindow.Initialize(picker, hwnd);
+
+            var folder = await picker.PickSingleFolderAsync();
+            return folder?.Path;
+        }
+    }
+}
diff --git a/src/Snipdeck.App/Views/ShellPage.xaml b/src/Snipdeck.App/Views/ShellPage.xaml
index 55bd998..e4f81df 100644
--- a/src/Snipdeck.App/Views/ShellPage.xaml
+++ b/src/Snipdeck.App/Views/ShellPage.xaml
@@ -187,11 +187,16 @@
                     </tk:SettingsCard>
 
                     <tk:SettingsCard Header="Storage location"
-                                     Description="Where snips and backups live. Move support lands in a future phase.">
-                        <TextBlock Text="{x:Bind StorageDirectory}"
-                                   Style="{ThemeResource CaptionTextBlockStyle}"
-                                   TextTrimming="CharacterEllipsis"
-                                   MaxWidth="320" />
+                                     Description="Where your snips live. Changing it restarts Snipdeck to load the new location.">
+                        <StackPanel Orientation="Horizontal" Spacing="8" VerticalAlignment="Center">
+                            <TextBlock Text="{x:Bind StorageDirectory, Mode=OneWay}"
+                                       Style="{ThemeResource CaptionTextBlockStyle}"
+                                       VerticalAlignment="Center"
+                                       TextTrimming="CharacterEllipsis"
+                                       MaxWidth="260" />
+                            <Button Content="Change…"
+                                    Command="{x:Bind ChangeStoragePathCommand}" />
+                        </StackPanel>
                     </tk:SettingsCard>
 
                     <tk:SettingsCard Header="Backups to keep"
diff --git a/src/Snipdeck.Core/Abstractions/IAppRestartService.cs b/src/Snipdeck.Core/Abstractions/IAppRestartService.cs
new file mode 100644
index 0000000..747d4ed
--- /dev/null
+++ b/src/Snipdeck.Core/Abstractions/IAppRestartService.cs
@@ -0,0 +1,12 @@
+namespace Snipdeck.Core.Abstractions
+{
+    /// <summary>
+    /// Restarts the running application. Used to apply changes that are only
+    /// read at startup (e.g. the storage location), so the app reloads cleanly
+    /// rather than continuing against stale, immutable startup state.
+    /// </summary>
+    public interface IAppRestartService
+    {
+        void Restart();
+    }
+}
diff --git a/src/Snipdeck.Core/Abstractions/IFolderPickerService.cs b/src/Snipdeck.Core/Abstractions/IFolderPickerService.cs
new file mode 100644
index 0000000..55803e8
--- /dev/null
+++ b/src/Snipdeck.Core/Abstractions/IFolderPickerService.cs
@@ -0,0 +1,11 @@
+namespace Snipdeck.Core.Abstractions
+{
+    /// <summary>
+    /// Lets the user pick a directory (e.g. a new storage location). Returns the
+    /// absolute path, or null if the picker was cancelled.
+    /// </summary>
+    public interface IFolderPickerService
+    {
+        Task<string?> PickFolderAsync();
+    }
+}
diff --git a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
new file mode 100644
index 0000000..bce219d
--- /dev/null
+++ b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
@@ -0,0 +1,41 @@
+namespace Snipdeck.Core.Abstractions
+{
+    /// <summary>
+    /// What changing the storage directory to a given target implies.
+    /// </summary>
+    public enum StorageChangeOutcome
+    {
+        /// <summary>Target is the current directory — nothing to do.</summary>
+        NoChange,
+
+        /// <summary>Neither current nor target holds a store — just adopt the empty target.</summary>
+        SetEmptyTarget,
+
+        /// <summary>Current holds a store and the target is empty — move the store there.</summary>
+        MoveToTarget,
+
+        /// <summary>The target already holds a store — adopt it (the current store is left in place).</summary>
+        AdoptTarget,
+    }
+
+    /// <summary>
+    /// Decides what a storage-directory change means and performs the on-disk
+    /// relocation. UI-free and filesystem-only so it can be unit-tested against
+    /// real temp directories.
+    /// </summary>
+    public interface IStorageRelocationService
+    {
+        /// <summary>The store file name within a storage directory (e.g. "store.json").</summary>
+        string StoreFileName { get; }
+
+        /// <summary>Classifies a proposed change from <paramref name="currentDirectory"/> to <paramref name="targetDirectory"/>.</summary>
+        StorageChangeOutcome Inspect(string currentDirectory, string targetDirectory);
+
+        /// <summary>
+        /// Moves the store file and the icons subdirectory from the current
+        /// directory to the target (copy-then-remove). Only valid for
+        /// <see cref="StorageChangeOutcome.MoveToTarget"/>.
+        /// </summary>
+        void MoveStore(string currentDirectory, string targetDirectory);
+    }
+}
diff --git a/src/Snipdeck.Core/Services/StorageRelocationService.cs b/src/Snipdeck.Core/Services/StorageRelocationService.cs
new file mode 100644
index 0000000..ee1a4d9
--- /dev/null
+++ b/src/Snipdeck.Core/Services/StorageRelocationService.cs
@@ -0,0 +1,85 @@
+using Snipdeck.Core.Abstractions;
+
+namespace Snipdeck.Core.Services
+{
+    /// <summary>
+    /// Filesystem implementation of <see cref="IStorageRelocationService"/>.
+    /// Relocates the store file plus the icons subdirectory and leaves the
+    /// settings/backups alone (those have their own locations).
+    /// </summary>
+    public sealed class StorageRelocationService : IStorageRelocationService
+    {
+        private const string _iconsSubdirectory = "icons";
+
+        public StorageRelocationService(string storeFileName = "store.json")
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(storeFileName);
+            StoreFileName = storeFileName;
+        }
+
+        public string StoreFileName { get; }
+
+        public StorageChangeOutcome Inspect(string currentDirectory, string targetDirectory)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(currentDirectory);
+            ArgumentException.ThrowIfNullOrWhiteSpace(targetDirectory);
+
+            return PathsEqual(currentDirectory, targetDirectory) ? StorageChangeOutcome.NoChange
+                : File.Exists(StorePath(targetDirectory)) ? StorageChangeOutcome.AdoptTarget
+                : File.Exists(StorePath(currentDirectory)) ? StorageChangeOutcome.MoveToTarget
+                : StorageChangeOutcome.SetEmptyTarget;
+        }
+
+        public void MoveStore(string currentDirectory, string targetDirectory)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(currentDirectory);
+            ArgumentException.ThrowIfNullOrWhiteSpace(targetDirectory);
+
+            _ = Directory.CreateDirectory(targetDirectory);
+
+            var sourceStore = StorePath(currentDirectory);
+            if (File.Exists(sourceStore))
+            {
+                File.Copy(sourceStore, StorePath(targetDirectory), overwrite: true);
+            }
+
+            var sourceIcons = Path.Combine(currentDirectory, _iconsSubdirectory);
+            var targetIcons = Path.Combine(targetDirectory, _iconsSubdirectory);
+            if (Directory.Exists(sourceIcons))
+            {
+                CopyDirectory(sourceIcons, targetIcons);
+            }
+
+            // Only remove the originals once everything is safely copied across.
+            if (File.Exists(sourceStore))
+            {
+                File.Delete(sourceStore);
+            }
+            if (Directory.Exists(sourceIcons))
+            {
+                Directory.Delete(sourceIcons, recursive: true);
+            }
+        }
+
+        private string StorePath(string directory) => Path.Combine(directory, StoreFileName);
+
+        private static bool PathsEqual(string a, string b) =>
+            string.Equals(
+                Path.TrimEndingDirectorySeparator(Path.GetFullPath(a)),
+                Path.TrimEndingDirectorySeparator(Path.GetFullPath(b)),
+                StringComparison.OrdinalIgnoreCase);
+
+        private static void CopyDirectory(string source, string destination)
+        {
+            _ = Directory.CreateDirectory(destination);
+            foreach (var file in Directory.EnumerateFiles(source))
+            {
+                File.Copy(file, Path.Combine(destination, Path.GetFileName(file)), overwrite: true);
+            }
+            foreach (var directory in Directory.EnumerateDirectories(source))
+            {
+                CopyDirectory(directory, Path.Combine(destination, Path.GetFileName(directory)));
+            }
+        }
+    }
+}
diff --git a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
index 55fdb8f..120b99f 100644
--- a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
+++ b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
@@ -19,6 +19,11 @@ public sealed partial class SettingsViewModel : ObservableObject
         private readonly IThemeApplier _themeApplier;
         private readonly IUpdateService _updateService;
         private readonly IHotkeyService _hotkeyService;
+        private readonly IFolderPickerService _folderPicker;
+        private readonly IStorageRelocationService _relocation;
+        private readonly IAppRestartService _restart;
+        private readonly IShellInteractions _interactions;
+        private readonly IPathProvider _pathProvider;
         private readonly AppConfig _config;
         private bool _suppressPersist;
 
@@ -27,6 +32,10 @@ public SettingsViewModel(
             IThemeApplier themeApplier,
             IUpdateService updateService,
             IHotkeyService hotkeyService,
+            IFolderPickerService folderPicker,
+            IStorageRelocationService relocation,
+            IAppRestartService restart,
+            IShellInteractions interactions,
             IPathProvider pathProvider,
             AppConfig config)
         {
@@ -34,6 +43,10 @@ public SettingsViewModel(
             ArgumentNullException.ThrowIfNull(themeApplier);
             ArgumentNullException.ThrowIfNull(updateService);
             ArgumentNullException.ThrowIfNull(hotkeyService);
+            ArgumentNullException.ThrowIfNull(folderPicker);
+            ArgumentNullException.ThrowIfNull(relocation);
+            ArgumentNullException.ThrowIfNull(restart);
+            ArgumentNullException.ThrowIfNull(interactions);
             ArgumentNullException.ThrowIfNull(pathProvider);
             ArgumentNullException.ThrowIfNull(config);
 
@@ -41,6 +54,11 @@ public SettingsViewModel(
             _themeApplier = themeApplier;
             _updateService = updateService;
             _hotkeyService = hotkeyService;
+            _folderPicker = folderPicker;
+            _relocation = relocation;
+            _restart = restart;
+            _interactions = interactions;
+            _pathProvider = pathProvider;
             _config = config;
 
             _suppressPersist = true;
@@ -72,7 +90,8 @@ public SettingsViewModel(
 
         public string CopyrightDisplay { get; }
 
-        public string StorageDirectory { get; }
+        [ObservableProperty]
+        public partial string StorageDirectory { get; set; } = string.Empty;
 
         public string BackupDirectory { get; }
 
@@ -196,6 +215,70 @@ private void ResetHotkey()
             RebindHotkey(HotkeyBinding.Default);
         }
 
+        [RelayCommand]
+        private async Task ChangeStoragePathAsync()
+        {
+            var target = await _folderPicker.PickFolderAsync().ConfigureAwait(true);
+            if (string.IsNullOrWhiteSpace(target))
+            {
+                return;
+            }
+
+            var current = _config.StoragePath ?? _pathProvider.DefaultStorageDirectory;
+            var outcome = _relocation.Inspect(current, target);
+
+            // The storage path is only read at startup, so apply-then-restart keeps
+            // the immutable startup state consistent and avoids the running app
+            // writing snips to the old location after the switch.
+            switch (outcome)
+            {
+                case StorageChangeOutcome.NoChange:
+                    return;
+
+                case StorageChangeOutcome.AdoptTarget:
+                    if (!await _interactions.ConfirmAsync(
+                        "Use this folder?",
+                        $"“{target}” already contains a Snipdeck store. Snipdeck will use it from now on; the snips in your current folder won't be moved. Snipdeck will restart to apply this.",
+                        "Use it",
+                        "Cancel").ConfigureAwait(true))
+                    {
+                        return;
+                    }
+                    break;
+
+                case StorageChangeOutcome.MoveToTarget:
+                    if (!await _interactions.ConfirmAsync(
+                        "Move storage?",
+                        $"Move your snips to “{target}”? Snipdeck will restart to apply this.",
+                        "Move",
+                        "Cancel").ConfigureAwait(true))
+                    {
+                        return;
+                    }
+                    _relocation.MoveStore(current, target);
+                    break;
+
+                case StorageChangeOutcome.SetEmptyTarget:
+                    if (!await _interactions.ConfirmAsync(
+                        "Change storage location?",
+                        $"Use “{target}” as the storage location? Snipdeck will restart to apply this.",
+                        "Change",
+                        "Cancel").ConfigureAwait(true))
+                    {
+                        return;
+                    }
+                    break;
+
+                default:
+                    return;
+            }
+
+            _config.StoragePath = target;
+            await PersistAsync().ConfigureAwait(true);
+            StorageDirectory = target;
+            _restart.Restart();
+        }
+
         private async Task PersistAsync()
         {
             if (_suppressPersist)
diff --git a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
new file mode 100644
index 0000000..51d637f
--- /dev/null
+++ b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
@@ -0,0 +1,100 @@
+using Snipdeck.Core.Abstractions;
+using Snipdeck.Core.Services;
+
+namespace Snipdeck.Core.Tests.Services
+{
+    public class StorageRelocationServiceTests
+    {
+        private static string NewTempDir() => Directory.CreateTempSubdirectory("snipdeck-reloc-").FullName;
+
+        [Fact]
+        public void Inspect_returns_NoChange_for_the_same_directory()
+        {
+            var dir = NewTempDir();
+            try
+            {
+                Assert.Equal(StorageChangeOutcome.NoChange, new StorageRelocationService().Inspect(dir, dir));
+            }
+            finally
+            {
+                Directory.Delete(dir, recursive: true);
+            }
+        }
+
+        [Fact]
+        public void Inspect_returns_AdoptTarget_when_the_target_already_has_a_store()
+        {
+            var current = NewTempDir();
+            var target = NewTempDir();
+            try
+            {
+                File.WriteAllText(Path.Combine(target, "store.json"), "{}");
+                Assert.Equal(StorageChangeOutcome.AdoptTarget, new StorageRelocationService().Inspect(current, target));
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
+        [Fact]
+        public void Inspect_returns_MoveToTarget_when_only_the_current_has_a_store()
+        {
+            var current = NewTempDir();
+            var target = NewTempDir();
+            try
+            {
+                File.WriteAllText(Path.Combine(current, "store.json"), "{}");
+                Assert.Equal(StorageChangeOutcome.MoveToTarget, new StorageRelocationService().Inspect(current, target));
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
+        [Fact]
+        public void Inspect_returns_SetEmptyTarget_when_neither_has_a_store()
+        {
+            var current = NewTempDir();
+            var target = NewTempDir();
+            try
+            {
+                Assert.Equal(StorageChangeOutcome.SetEmptyTarget, new StorageRelocationService().Inspect(current, target));
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
+        [Fact]
+        public void MoveStore_copies_store_and_icons_then_removes_the_originals()
+        {
+            var current = NewTempDir();
+            var target = NewTempDir();
+            try
+            {
+                File.WriteAllText(Path.Combine(current, "store.json"), "{\"snips\":[]}");
+                _ = Directory.CreateDirectory(Path.Combine(current, "icons"));
+                File.WriteAllText(Path.Combine(current, "icons", "abc.png"), "icon-bytes");
+                Directory.Delete(target);
+
+                new StorageRelocationService().MoveStore(current, target);
+
+                Assert.Equal("{\"snips\":[]}", File.ReadAllText(Path.Combine(target, "store.json")));
+                Assert.Equal("icon-bytes", File.ReadAllText(Path.Combine(target, "icons", "abc.png")));
+                Assert.False(File.Exists(Path.Combine(current, "store.json")));
+                Assert.False(Directory.Exists(Path.Combine(current, "icons")));
+            }
+            finally
+            {
+                if (Directory.Exists(current)) { Directory.Delete(current, recursive: true); }
+                if (Directory.Exists(target)) { Directory.Delete(target, recursive: true); }
+            }
+        }
+    }
+}
diff --git a/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs b/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
new file mode 100644
index 0000000..9bb3098
--- /dev/null
+++ b/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
@@ -0,0 +1,11 @@
+using Snipdeck.Core.Abstractions;
+
+namespace Snipdeck.Core.Tests.Support
+{
+    public sealed class FakeAppRestartService : IAppRestartService
+    {
+        public int RestartCount { get; private set; }
+
+        public void Restart() => RestartCount++;
+    }
+}
diff --git a/tests/Snipdeck.Core.Tests/Support/FakeFolderPickerService.cs b/tests/Snipdeck.Core.Tests/Support/FakeFolderPickerService.cs
new file mode 100644
index 0000000..6285f1c
--- /dev/null
+++ b/tests/Snipdeck.Core.Tests/Support/FakeFolderPickerService.cs
@@ -0,0 +1,11 @@
+using Snipdeck.Core.Abstractions;
+
+namespace Snipdeck.Core.Tests.Support
+{
+    public sealed class FakeFolderPickerService : IFolderPickerService
+    {
+        public string? NextFolder { get; set; }
+
+        public Task<string?> PickFolderAsync() => Task.FromResult(NextFolder);
+    }
+}
diff --git a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
index 6bac819..b863003 100644
--- a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
+++ b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
@@ -1,4 +1,5 @@
 using Snipdeck.Core.Models;
+using Snipdeck.Core.Services;
 using Snipdeck.Core.Tests.Support;
 using Snipdeck.Core.ViewModels;
 
@@ -11,17 +12,47 @@ private static SettingsViewModel Build(
             out FakeSettingsStore store,
             AppConfig? config = null)
         {
-            hotkey = new FakeHotkeyService();
             store = new FakeSettingsStore();
+            hotkey = new FakeHotkeyService();
             return new SettingsViewModel(
                 store,
                 new FakeThemeApplier(),
                 new FakeUpdateService(),
                 hotkey,
+                new FakeFolderPickerService(),
+                new StorageRelocationService(),
+                new FakeAppRestartService(),
+                new FakeShellInteractions(),
                 new FakePathProvider(),
                 config ?? new AppConfig());
         }
 
+        private static SettingsViewModel BuildForStorage(
+            string currentDirectory,
+            out FakeFolderPickerService folderPicker,
+            out FakeShellInteractions interactions,
+            out FakeAppRestartService restart,
+            out FakeSettingsStore store,
+            AppConfig? config = null)
+        {
+            folderPicker = new FakeFolderPickerService();
+            interactions = new FakeShellInteractions();
+            restart = new FakeAppRestartService();
+            store = new FakeSettingsStore();
+            var pathProvider = new FakePathProvider { DefaultStorageDirectory = currentDirectory };
+            return new SettingsViewModel(
+                store,
+                new FakeThemeApplier(),
+                new FakeUpdateService(),
+                new FakeHotkeyService(),
+                folderPicker,
+                new StorageRelocationService(),
+                restart,
+                interactions,
+                pathProvider,
+                config ?? new AppConfig());
+        }
+
         [Fact]
         public void Initial_hotkey_display_reflects_config()
         {
@@ -86,5 +117,111 @@ public void ResetHotkey_rebinds_to_the_default_chord()
             Assert.Equal(HotkeyBinding.Default.Modifiers, hotkey.LastRegistered!.Modifiers);
             Assert.Equal("S", hotkey.LastRegistered.Key);
         }
+
+        [Fact]
+        public async Task ChangeStoragePath_moves_the_store_to_an_empty_target_then_restarts()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            var target = Directory.CreateTempSubdirectory("snipdeck-tgt-").FullName;
+            try
+            {
+                await File.WriteAllTextAsync(Path.Combine(current, "store.json"), "{}");
+                _ = Directory.CreateDirectory(Path.Combine(current, "icons"));
+                await File.WriteAllTextAsync(Path.Combine(current, "icons", "a.png"), "x");
+                Directory.Delete(target); // target must not exist yet for a clean "move"
+
+                var vm = BuildForStorage(current, out var picker, out var ix, out var restart, out var store);
+                picker.NextFolder = target;
+                ix.NextConfirmResult = true;
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                Assert.True(File.Exists(Path.Combine(target, "store.json")));
+                Assert.True(File.Exists(Path.Combine(target, "icons", "a.png")));
+                Assert.False(File.Exists(Path.Combine(current, "store.json")));
+                Assert.Equal(target, store.Current.StoragePath);
+                Assert.Equal(target, vm.StorageDirectory);
+                Assert.Equal(1, restart.RestartCount);
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                if (Directory.Exists(target)) { Directory.Delete(target, recursive: true); }
+            }
+        }
+
+        [Fact]
+        public async Task ChangeStoragePath_adopts_an_existing_store_without_moving_the_current_one()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            var target = Directory.CreateTempSubdirectory("snipdeck-tgt-").FullName;
+            try
+            {
+                await File.WriteAllTextAsync(Path.Combine(current, "store.json"), "{}");
+                await File.WriteAllTextAsync(Path.Combine(target, "store.json"), "{}"); // target already has a store
+
+                var vm = BuildForStorage(current, out var picker, out var ix, out var restart, out var store);
+                picker.NextFolder = target;
+                ix.NextConfirmResult = true;
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                // Adopt: current store is left in place, target's store untouched.
+                Assert.True(File.Exists(Path.Combine(current, "store.json")));
+                Assert.Equal(target, store.Current.StoragePath);
+                Assert.Equal(1, restart.RestartCount);
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
+        [Fact]
+        public async Task ChangeStoragePath_does_nothing_when_the_user_cancels()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            var target = Directory.CreateTempSubdirectory("snipdeck-tgt-").FullName;
+            try
+            {
+                await File.WriteAllTextAsync(Path.Combine(current, "store.json"), "{}");
+
+                var vm = BuildForStorage(current, out var picker, out var ix, out var restart, out var store);
+                picker.NextFolder = target;
+                ix.NextConfirmResult = false; // cancelled
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                Assert.Null(store.Current.StoragePath);
+                Assert.Equal(0, restart.RestartCount);
+                Assert.True(File.Exists(Path.Combine(current, "store.json")));
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
+        [Fact]
+        public async Task ChangeStoragePath_no_ops_when_the_picker_is_cancelled()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            try
+            {
+                var vm = BuildForStorage(current, out var picker, out _, out var restart, out var store);
+                picker.NextFolder = null; // user cancelled the folder picker
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                Assert.Equal(0, restart.RestartCount);
+                Assert.Equal(0, store.SaveCount);
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+            }
+        }
     }
 }
diff --git a/tests/Snipdeck.Core.Tests/ViewModels/ShellViewModelTests.cs b/tests/Snipdeck.Core.Tests/ViewModels/ShellViewModelTests.cs
index 1332cc9..098a292 100644
--- a/tests/Snipdeck.Core.Tests/ViewModels/ShellViewModelTests.cs
+++ b/tests/Snipdeck.Core.Tests/ViewModels/ShellViewModelTests.cs
@@ -1,5 +1,6 @@
 using Snipdeck.Core.Abstractions;
 using Snipdeck.Core.Models;
+using Snipdeck.Core.Services;
 using Snipdeck.Core.Tests.Support;
 using Snipdeck.Core.ViewModels;
 
@@ -30,6 +31,10 @@ private static SettingsViewModel NewSettingsViewModel()
                 new FakeThemeApplier(),
                 new FakeUpdateService(),
                 new FakeHotkeyService(),
+                new FakeFolderPickerService(),
+                new StorageRelocationService(),
+                new FakeAppRestartService(),
+                new FakeShellInteractions(),
                 new FakePathProvider(),
                 new AppConfig());
         }

From 83c499b78fd22f4a6625832ac6d226a1383de514 Mon Sep 17 00:00:00 2001
From: Stuart Meeks <stuart.meeks@stuartmeeks.net>
Date: Sat, 30 May 2026 10:25:11 +0000
Subject: [PATCH 2/5] Reject storage targets nested in the current folder

Picking a folder inside the current storage directory (e.g. its icons/
subfolder) would make MoveStore copy a directory into itself and could
delete the just-copied store. Inspect now returns a new Invalid outcome for
either-way nesting, and the change command notifies and aborts.

Found by codex review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../Abstractions/IStorageRelocationService.cs |  7 +++++
 .../Services/StorageRelocationService.cs      | 18 ++++++++++---
 .../ViewModels/SettingsViewModel.cs           |  6 +++++
 .../Services/StorageRelocationServiceTests.cs | 18 +++++++++++++
 .../ViewModels/SettingsViewModelTests.cs      | 26 +++++++++++++++++++
 5 files changed, 71 insertions(+), 4 deletions(-)

diff --git a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
index bce219d..0123a3a 100644
--- a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
+++ b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
@@ -8,6 +8,13 @@ public enum StorageChangeOutcome
         /// <summary>Target is the current directory — nothing to do.</summary>
         NoChange,
 
+        /// <summary>
+        /// Target is nested inside the current storage directory (or vice
+        /// versa) — relocating would copy a directory into itself / delete the
+        /// copy. Reject it.
+        /// </summary>
+        Invalid,
+
         /// <summary>Neither current nor target holds a store — just adopt the empty target.</summary>
         SetEmptyTarget,
 
diff --git a/src/Snipdeck.Core/Services/StorageRelocationService.cs b/src/Snipdeck.Core/Services/StorageRelocationService.cs
index ee1a4d9..72359bb 100644
--- a/src/Snipdeck.Core/Services/StorageRelocationService.cs
+++ b/src/Snipdeck.Core/Services/StorageRelocationService.cs
@@ -25,6 +25,7 @@ public StorageChangeOutcome Inspect(string currentDirectory, string targetDirect
             ArgumentException.ThrowIfNullOrWhiteSpace(targetDirectory);
 
             return PathsEqual(currentDirectory, targetDirectory) ? StorageChangeOutcome.NoChange
+                : IsNested(targetDirectory, currentDirectory) || IsNested(currentDirectory, targetDirectory) ? StorageChangeOutcome.Invalid
                 : File.Exists(StorePath(targetDirectory)) ? StorageChangeOutcome.AdoptTarget
                 : File.Exists(StorePath(currentDirectory)) ? StorageChangeOutcome.MoveToTarget
                 : StorageChangeOutcome.SetEmptyTarget;
@@ -64,10 +65,19 @@ public void MoveStore(string currentDirectory, string targetDirectory)
         private string StorePath(string directory) => Path.Combine(directory, StoreFileName);
 
         private static bool PathsEqual(string a, string b) =>
-            string.Equals(
-                Path.TrimEndingDirectorySeparator(Path.GetFullPath(a)),
-                Path.TrimEndingDirectorySeparator(Path.GetFullPath(b)),
-                StringComparison.OrdinalIgnoreCase);
+            string.Equals(Normalize(a), Normalize(b), StringComparison.OrdinalIgnoreCase);
+
+        // True when "descendant" is a proper subdirectory of "ancestor".
+        private static bool IsNested(string descendant, string ancestor)
+        {
+            var d = Normalize(descendant);
+            var a = Normalize(ancestor);
+            return d.Length > a.Length
+                && d.StartsWith(a + Path.DirectorySeparatorChar, StringComparison.OrdinalIgnoreCase);
+        }
+
+        private static string Normalize(string path) =>
+            Path.TrimEndingDirectorySeparator(Path.GetFullPath(path));
 
         private static void CopyDirectory(string source, string destination)
         {
diff --git a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
index 120b99f..b905091 100644
--- a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
+++ b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
@@ -235,6 +235,12 @@ private async Task ChangeStoragePathAsync()
                 case StorageChangeOutcome.NoChange:
                     return;
 
+                case StorageChangeOutcome.Invalid:
+                    await _interactions.NotifyAsync(
+                        "Can't use that folder",
+                        "Choose a folder that isn't inside (or a parent of) your current storage folder.").ConfigureAwait(true);
+                    return;
+
                 case StorageChangeOutcome.AdoptTarget:
                     if (!await _interactions.ConfirmAsync(
                         "Use this folder?",
diff --git a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
index 51d637f..26fe4c5 100644
--- a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
+++ b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
@@ -71,6 +71,24 @@ public void Inspect_returns_SetEmptyTarget_when_neither_has_a_store()
             }
         }
 
+        [Fact]
+        public void Inspect_returns_Invalid_when_the_target_is_nested_inside_the_current()
+        {
+            var current = NewTempDir();
+            try
+            {
+                var nested = Path.Combine(current, "icons");
+                _ = Directory.CreateDirectory(nested);
+                Assert.Equal(StorageChangeOutcome.Invalid, new StorageRelocationService().Inspect(current, nested));
+                // ...and the reverse nesting (current inside target) is also rejected.
+                Assert.Equal(StorageChangeOutcome.Invalid, new StorageRelocationService().Inspect(nested, current));
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+            }
+        }
+
         [Fact]
         public void MoveStore_copies_store_and_icons_then_removes_the_originals()
         {
diff --git a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
index b863003..6d650f2 100644
--- a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
+++ b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
@@ -204,6 +204,32 @@ public async Task ChangeStoragePath_does_nothing_when_the_user_cancels()
             }
         }
 
+        [Fact]
+        public async Task ChangeStoragePath_rejects_a_folder_nested_in_the_current_store()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            try
+            {
+                await File.WriteAllTextAsync(Path.Combine(current, "store.json"), "{}");
+                var nested = Path.Combine(current, "icons");
+                _ = Directory.CreateDirectory(nested);
+
+                var vm = BuildForStorage(current, out var picker, out var ix, out var restart, out var store);
+                picker.NextFolder = nested;
+                ix.NextConfirmResult = true; // even if confirmed, the guard fires first
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                Assert.Equal(1, ix.NotifyCount);
+                Assert.Equal(0, restart.RestartCount);
+                Assert.Null(store.Current.StoragePath);
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+            }
+        }
+
         [Fact]
         public async Task ChangeStoragePath_no_ops_when_the_picker_is_cancelled()
         {

From 1a0a6336c25ac44b2fa6c2a7f5b0c28b9958d3f1 Mon Sep 17 00:00:00 2001
From: Stuart Meeks <stuart.meeks@stuartmeeks.net>
Date: Sat, 30 May 2026 11:43:52 +0000
Subject: [PATCH 3/5] Persist new storage path before deleting the old store
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the move case, copy the store/icons, persist the new StoragePath, and only
then remove the originals. Previously the old store was deleted before the
config was saved, so a failed PersistAsync (locked settings file, full disk)
could leave the app pointing at an emptied old location — snips appearing lost.
Split MoveStore into CopyStore + RemoveStore to allow the safe ordering.

Found by codex review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../Abstractions/IStorageRelocationService.cs | 12 +++++---
 .../Services/StorageRelocationService.cs      | 22 +++++++++-----
 .../ViewModels/SettingsViewModel.cs           | 11 ++++++-
 .../Services/StorageRelocationServiceTests.cs | 30 ++++++++++++++++---
 4 files changed, 58 insertions(+), 17 deletions(-)

diff --git a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
index 0123a3a..41cb997 100644
--- a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
+++ b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
@@ -39,10 +39,14 @@ public interface IStorageRelocationService
         StorageChangeOutcome Inspect(string currentDirectory, string targetDirectory);
 
         /// <summary>
-        /// Moves the store file and the icons subdirectory from the current
-        /// directory to the target (copy-then-remove). Only valid for
-        /// <see cref="StorageChangeOutcome.MoveToTarget"/>.
+        /// Copies the store file and the icons subdirectory from the current
+        /// directory to the target. Non-destructive — the originals are left in
+        /// place so the new config can be persisted durably before
+        /// <see cref="RemoveStore"/> removes them.
         /// </summary>
-        void MoveStore(string currentDirectory, string targetDirectory);
+        void CopyStore(string currentDirectory, string targetDirectory);
+
+        /// <summary>Removes the store file and icons subdirectory from a directory.</summary>
+        void RemoveStore(string directory);
     }
 }
diff --git a/src/Snipdeck.Core/Services/StorageRelocationService.cs b/src/Snipdeck.Core/Services/StorageRelocationService.cs
index 72359bb..022e073 100644
--- a/src/Snipdeck.Core/Services/StorageRelocationService.cs
+++ b/src/Snipdeck.Core/Services/StorageRelocationService.cs
@@ -31,7 +31,7 @@ public StorageChangeOutcome Inspect(string currentDirectory, string targetDirect
                 : StorageChangeOutcome.SetEmptyTarget;
         }
 
-        public void MoveStore(string currentDirectory, string targetDirectory)
+        public void CopyStore(string currentDirectory, string targetDirectory)
         {
             ArgumentException.ThrowIfNullOrWhiteSpace(currentDirectory);
             ArgumentException.ThrowIfNullOrWhiteSpace(targetDirectory);
@@ -45,20 +45,26 @@ public void MoveStore(string currentDirectory, string targetDirectory)
             }
 
             var sourceIcons = Path.Combine(currentDirectory, _iconsSubdirectory);
-            var targetIcons = Path.Combine(targetDirectory, _iconsSubdirectory);
             if (Directory.Exists(sourceIcons))
             {
-                CopyDirectory(sourceIcons, targetIcons);
+                CopyDirectory(sourceIcons, Path.Combine(targetDirectory, _iconsSubdirectory));
             }
+        }
 
-            // Only remove the originals once everything is safely copied across.
-            if (File.Exists(sourceStore))
+        public void RemoveStore(string directory)
+        {
+            ArgumentException.ThrowIfNullOrWhiteSpace(directory);
+
+            var store = StorePath(directory);
+            if (File.Exists(store))
             {
-                File.Delete(sourceStore);
+                File.Delete(store);
             }
-            if (Directory.Exists(sourceIcons))
+
+            var icons = Path.Combine(directory, _iconsSubdirectory);
+            if (Directory.Exists(icons))
             {
-                Directory.Delete(sourceIcons, recursive: true);
+                Directory.Delete(icons, recursive: true);
             }
         }
 
diff --git a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
index b905091..cf25902 100644
--- a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
+++ b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
@@ -230,6 +230,7 @@ private async Task ChangeStoragePathAsync()
             // The storage path is only read at startup, so apply-then-restart keeps
             // the immutable startup state consistent and avoids the running app
             // writing snips to the old location after the switch.
+            var isMove = false;
             switch (outcome)
             {
                 case StorageChangeOutcome.NoChange:
@@ -261,7 +262,11 @@ await _interactions.NotifyAsync(
                     {
                         return;
                     }
-                    _relocation.MoveStore(current, target);
+                    // Copy now; the originals are removed only after the new path
+                    // is durably persisted, so a failed save can't leave the
+                    // config pointing at an emptied old location.
+                    _relocation.CopyStore(current, target);
+                    isMove = true;
                     break;
 
                 case StorageChangeOutcome.SetEmptyTarget:
@@ -281,6 +286,10 @@ await _interactions.NotifyAsync(
 
             _config.StoragePath = target;
             await PersistAsync().ConfigureAwait(true);
+            if (isMove)
+            {
+                _relocation.RemoveStore(current);
+            }
             StorageDirectory = target;
             _restart.Restart();
         }
diff --git a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
index 26fe4c5..0c24ad3 100644
--- a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
+++ b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
@@ -90,7 +90,7 @@ public void Inspect_returns_Invalid_when_the_target_is_nested_inside_the_current
         }
 
         [Fact]
-        public void MoveStore_copies_store_and_icons_then_removes_the_originals()
+        public void CopyStore_copies_store_and_icons_and_leaves_the_originals()
         {
             var current = NewTempDir();
             var target = NewTempDir();
@@ -101,12 +101,13 @@ public void MoveStore_copies_store_and_icons_then_removes_the_originals()
                 File.WriteAllText(Path.Combine(current, "icons", "abc.png"), "icon-bytes");
                 Directory.Delete(target);
 
-                new StorageRelocationService().MoveStore(current, target);
+                new StorageRelocationService().CopyStore(current, target);
 
                 Assert.Equal("{\"snips\":[]}", File.ReadAllText(Path.Combine(target, "store.json")));
                 Assert.Equal("icon-bytes", File.ReadAllText(Path.Combine(target, "icons", "abc.png")));
-                Assert.False(File.Exists(Path.Combine(current, "store.json")));
-                Assert.False(Directory.Exists(Path.Combine(current, "icons")));
+                // Non-destructive: originals remain until RemoveStore runs.
+                Assert.True(File.Exists(Path.Combine(current, "store.json")));
+                Assert.True(Directory.Exists(Path.Combine(current, "icons")));
             }
             finally
             {
@@ -114,5 +115,26 @@ public void MoveStore_copies_store_and_icons_then_removes_the_originals()
                 if (Directory.Exists(target)) { Directory.Delete(target, recursive: true); }
             }
         }
+
+        [Fact]
+        public void RemoveStore_deletes_the_store_and_icons()
+        {
+            var dir = NewTempDir();
+            try
+            {
+                File.WriteAllText(Path.Combine(dir, "store.json"), "{}");
+                _ = Directory.CreateDirectory(Path.Combine(dir, "icons"));
+                File.WriteAllText(Path.Combine(dir, "icons", "abc.png"), "x");
+
+                new StorageRelocationService().RemoveStore(dir);
+
+                Assert.False(File.Exists(Path.Combine(dir, "store.json")));
+                Assert.False(Directory.Exists(Path.Combine(dir, "icons")));
+            }
+            finally
+            {
+                Directory.Delete(dir, recursive: true);
+            }
+        }
     }
 }

From 7cb77931389f3be25f788725c8dd2ff17b9a69aa Mon Sep 17 00:00:00 2001
From: Stuart Meeks <stuart.meeks@stuartmeeks.net>
Date: Sat, 30 May 2026 11:50:41 +0000
Subject: [PATCH 4/5] Handle restart failure and keep the old store as a backup

AppInstance.Restart returns a failure reason rather than guaranteeing
termination, so IAppRestartService.Restart now returns bool. The change-path
flow never deletes the old store from the running process (left as a backup);
on a failed restart it notifies the user to restart manually, so the app
stays consistent against the still-intact old store. Removed the now-unused
RemoveStore.

Found by codex review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 10 +++---
 .../Services/WindowsAppRestartService.cs      |  8 +++--
 .../Abstractions/IAppRestartService.cs        |  8 ++++-
 .../Abstractions/IStorageRelocationService.cs | 11 +++----
 .../Services/StorageRelocationService.cs      | 17 ----------
 .../ViewModels/SettingsViewModel.cs           | 21 +++++++------
 .../Services/StorageRelocationServiceTests.cs | 20 ------------
 .../Support/FakeAppRestartService.cs          |  9 +++++-
 .../ViewModels/SettingsViewModelTests.cs      | 31 ++++++++++++++++++-
 9 files changed, 73 insertions(+), 62 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8bb1af..67a1f27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,10 +20,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Change the storage location.** A "Change…" button on Settings → Storage
   location lets you pick a new folder for your snips. If the folder already
   contains a Snipdeck store it's adopted (your current snips are left where
-  they are); otherwise your store and icons are moved there. The choice is
-  confirmed first, and Snipdeck restarts to apply it — the storage path is
-  read at startup, so restarting keeps everything consistent and avoids
-  writing to the old location after the switch.
+  they are); otherwise your store and icons are copied there (the old folder
+  is kept as a backup). The choice is confirmed first, and Snipdeck restarts
+  to apply it — the storage path is read at startup, so restarting keeps
+  everything consistent and avoids writing to the old location after the
+  switch. If the automatic restart can't run, you're prompted to restart
+  manually.
 - **Rebindable global hotkey.** The global hotkey is now editable from
   Settings: click the capture box and press a shortcut (at least one of
   Ctrl/Alt/Shift plus a key). The new binding registers and persists
diff --git a/src/Snipdeck.App/Services/WindowsAppRestartService.cs b/src/Snipdeck.App/Services/WindowsAppRestartService.cs
index a62978b..4084942 100644
--- a/src/Snipdeck.App/Services/WindowsAppRestartService.cs
+++ b/src/Snipdeck.App/Services/WindowsAppRestartService.cs
@@ -6,11 +6,13 @@ namespace Snipdeck.App.Services
 {
     internal sealed class WindowsAppRestartService : IAppRestartService
     {
-        public void Restart()
+        public bool Restart()
         {
-            // Windows App SDK gracefully terminates and relaunches the current
-            // instance. Used to apply a storage-location change cleanly.
+            // On success Windows App SDK terminates the process and this never
+            // returns. If it returns, it failed (it yields a failure reason
+            // rather than throwing), so report that to the caller.
             _ = AppInstance.Restart(string.Empty);
+            return false;
         }
     }
 }
diff --git a/src/Snipdeck.Core/Abstractions/IAppRestartService.cs b/src/Snipdeck.Core/Abstractions/IAppRestartService.cs
index 747d4ed..17478e0 100644
--- a/src/Snipdeck.Core/Abstractions/IAppRestartService.cs
+++ b/src/Snipdeck.Core/Abstractions/IAppRestartService.cs
@@ -7,6 +7,12 @@ namespace Snipdeck.Core.Abstractions
     /// </summary>
     public interface IAppRestartService
     {
-        void Restart();
+        /// <summary>
+        /// Requests an application restart. On success the process is terminated
+        /// and this does not return; it returns <c>false</c> if the restart
+        /// could not be initiated, so the caller can fall back (e.g. ask the
+        /// user to restart manually).
+        /// </summary>
+        bool Restart();
     }
 }
diff --git a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
index 41cb997..b315cd7 100644
--- a/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
+++ b/src/Snipdeck.Core/Abstractions/IStorageRelocationService.cs
@@ -40,13 +40,12 @@ public interface IStorageRelocationService
 
         /// <summary>
         /// Copies the store file and the icons subdirectory from the current
-        /// directory to the target. Non-destructive — the originals are left in
-        /// place so the new config can be persisted durably before
-        /// <see cref="RemoveStore"/> removes them.
+        /// directory to the target. Non-destructive: the originals are left in
+        /// place as a safety copy. We never delete the old store from the
+        /// running process — the storage path is only re-read after the restart,
+        /// and a failed restart would otherwise leave the app writing to a
+        /// directory we'd already emptied.
         /// </summary>
         void CopyStore(string currentDirectory, string targetDirectory);
-
-        /// <summary>Removes the store file and icons subdirectory from a directory.</summary>
-        void RemoveStore(string directory);
     }
 }
diff --git a/src/Snipdeck.Core/Services/StorageRelocationService.cs b/src/Snipdeck.Core/Services/StorageRelocationService.cs
index 022e073..7849ea6 100644
--- a/src/Snipdeck.Core/Services/StorageRelocationService.cs
+++ b/src/Snipdeck.Core/Services/StorageRelocationService.cs
@@ -51,23 +51,6 @@ public void CopyStore(string currentDirectory, string targetDirectory)
             }
         }
 
-        public void RemoveStore(string directory)
-        {
-            ArgumentException.ThrowIfNullOrWhiteSpace(directory);
-
-            var store = StorePath(directory);
-            if (File.Exists(store))
-            {
-                File.Delete(store);
-            }
-
-            var icons = Path.Combine(directory, _iconsSubdirectory);
-            if (Directory.Exists(icons))
-            {
-                Directory.Delete(icons, recursive: true);
-            }
-        }
-
         private string StorePath(string directory) => Path.Combine(directory, StoreFileName);
 
         private static bool PathsEqual(string a, string b) =>
diff --git a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
index cf25902..fd95216 100644
--- a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
+++ b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
@@ -230,7 +230,6 @@ private async Task ChangeStoragePathAsync()
             // The storage path is only read at startup, so apply-then-restart keeps
             // the immutable startup state consistent and avoids the running app
             // writing snips to the old location after the switch.
-            var isMove = false;
             switch (outcome)
             {
                 case StorageChangeOutcome.NoChange:
@@ -262,11 +261,10 @@ await _interactions.NotifyAsync(
                     {
                         return;
                     }
-                    // Copy now; the originals are removed only after the new path
-                    // is durably persisted, so a failed save can't leave the
-                    // config pointing at an emptied old location.
+                    // Copy the snips to the target; the originals are left as a
+                    // safety copy and never deleted from the running process (a
+                    // failed restart must not leave us writing to a removed dir).
                     _relocation.CopyStore(current, target);
-                    isMove = true;
                     break;
 
                 case StorageChangeOutcome.SetEmptyTarget:
@@ -286,12 +284,17 @@ await _interactions.NotifyAsync(
 
             _config.StoragePath = target;
             await PersistAsync().ConfigureAwait(true);
-            if (isMove)
+            StorageDirectory = target;
+
+            // On success the process terminates here; if it returns, the restart
+            // failed, so ask the user to restart manually. The old store is still
+            // intact, so the app stays consistent until they do.
+            if (!_restart.Restart())
             {
-                _relocation.RemoveStore(current);
+                await _interactions.NotifyAsync(
+                    "Restart needed",
+                    "Snipdeck couldn't restart automatically. Please restart it to start using the new storage location.").ConfigureAwait(true);
             }
-            StorageDirectory = target;
-            _restart.Restart();
         }
 
         private async Task PersistAsync()
diff --git a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
index 0c24ad3..fbf2df0 100644
--- a/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
+++ b/tests/Snipdeck.Core.Tests/Services/StorageRelocationServiceTests.cs
@@ -116,25 +116,5 @@ public void CopyStore_copies_store_and_icons_and_leaves_the_originals()
             }
         }
 
-        [Fact]
-        public void RemoveStore_deletes_the_store_and_icons()
-        {
-            var dir = NewTempDir();
-            try
-            {
-                File.WriteAllText(Path.Combine(dir, "store.json"), "{}");
-                _ = Directory.CreateDirectory(Path.Combine(dir, "icons"));
-                File.WriteAllText(Path.Combine(dir, "icons", "abc.png"), "x");
-
-                new StorageRelocationService().RemoveStore(dir);
-
-                Assert.False(File.Exists(Path.Combine(dir, "store.json")));
-                Assert.False(Directory.Exists(Path.Combine(dir, "icons")));
-            }
-            finally
-            {
-                Directory.Delete(dir, recursive: true);
-            }
-        }
     }
 }
diff --git a/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs b/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
index 9bb3098..274ea0c 100644
--- a/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
+++ b/tests/Snipdeck.Core.Tests/Support/FakeAppRestartService.cs
@@ -6,6 +6,13 @@ public sealed class FakeAppRestartService : IAppRestartService
     {
         public int RestartCount { get; private set; }
 
-        public void Restart() => RestartCount++;
+        /// <summary>Simulates whether the restart could be initiated.</summary>
+        public bool NextRestartResult { get; set; } = true;
+
+        public bool Restart()
+        {
+            RestartCount++;
+            return NextRestartResult;
+        }
     }
 }
diff --git a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
index 6d650f2..1d2741f 100644
--- a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
+++ b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
@@ -138,7 +138,8 @@ public async Task ChangeStoragePath_moves_the_store_to_an_empty_target_then_rest
 
                 Assert.True(File.Exists(Path.Combine(target, "store.json")));
                 Assert.True(File.Exists(Path.Combine(target, "icons", "a.png")));
-                Assert.False(File.Exists(Path.Combine(current, "store.json")));
+                // The original is left as a safety copy (never deleted from the running process).
+                Assert.True(File.Exists(Path.Combine(current, "store.json")));
                 Assert.Equal(target, store.Current.StoragePath);
                 Assert.Equal(target, vm.StorageDirectory);
                 Assert.Equal(1, restart.RestartCount);
@@ -204,6 +205,34 @@ public async Task ChangeStoragePath_does_nothing_when_the_user_cancels()
             }
         }
 
+        [Fact]
+        public async Task ChangeStoragePath_notifies_when_the_restart_cannot_be_initiated()
+        {
+            var current = Directory.CreateTempSubdirectory("snipdeck-cur-").FullName;
+            var target = Directory.CreateTempSubdirectory("snipdeck-tgt-").FullName;
+            try
+            {
+                await File.WriteAllTextAsync(Path.Combine(target, "store.json"), "{}"); // adopt path, no file ops
+
+                var vm = BuildForStorage(current, out var picker, out var ix, out var restart, out var store);
+                picker.NextFolder = target;
+                ix.NextConfirmResult = true;
+                restart.NextRestartResult = false; // restart denied
+
+                await vm.ChangeStoragePathCommand.ExecuteAsync(null);
+
+                // Path still persisted, but the user is told to restart manually.
+                Assert.Equal(target, store.Current.StoragePath);
+                Assert.Equal(1, restart.RestartCount);
+                Assert.Equal(1, ix.NotifyCount);
+            }
+            finally
+            {
+                Directory.Delete(current, recursive: true);
+                Directory.Delete(target, recursive: true);
+            }
+        }
+
         [Fact]
         public async Task ChangeStoragePath_rejects_a_folder_nested_in_the_current_store()
         {

From 13bf2c4b50df978c160532fc57704ca12499f2ac Mon Sep 17 00:00:00 2001
From: Stuart Meeks <stuart.meeks@stuartmeeks.net>
Date: Sat, 30 May 2026 11:55:01 +0000
Subject: [PATCH 5/5] Roll back the storage-path switch when restart fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If AppInstance.Restart can't restart, the running app stays bound to the old
store while the persisted setting would point future launches at the new one —
so edits before a manual restart would be lost. On restart failure, revert the
persisted StoragePath to the previous value so this session and future launches
stay consistent on the old store, and notify the user it didn't take. The
copied target files remain as a harmless backup.

Found by codex review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../ViewModels/SettingsViewModel.cs            | 18 +++++++++++++-----
 .../ViewModels/SettingsViewModelTests.cs       |  6 ++++--
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
index fd95216..42346dd 100644
--- a/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
+++ b/src/Snipdeck.Core/ViewModels/SettingsViewModel.cs
@@ -282,18 +282,26 @@ await _interactions.NotifyAsync(
                     return;
             }
 
+            var previousPath = _config.StoragePath;
             _config.StoragePath = target;
             await PersistAsync().ConfigureAwait(true);
             StorageDirectory = target;
 
-            // On success the process terminates here; if it returns, the restart
-            // failed, so ask the user to restart manually. The old store is still
-            // intact, so the app stays consistent until they do.
+            // On success the process terminates inside Restart() and nothing below
+            // runs. If it returns false the relaunch didn't happen, so the running
+            // app is still bound to the old location — roll the persisted switch
+            // back so this session and future launches stay on the old store
+            // (otherwise edits made before a manual restart would land in the old
+            // store and vanish once the new one loads). The copied target files are
+            // left as a harmless backup.
             if (!_restart.Restart())
             {
+                _config.StoragePath = previousPath;
+                await PersistAsync().ConfigureAwait(true);
+                StorageDirectory = previousPath ?? _pathProvider.DefaultStorageDirectory;
                 await _interactions.NotifyAsync(
-                    "Restart needed",
-                    "Snipdeck couldn't restart automatically. Please restart it to start using the new storage location.").ConfigureAwait(true);
+                    "Couldn't change storage location",
+                    "Snipdeck couldn't restart, so the storage location is unchanged. Please try again.").ConfigureAwait(true);
             }
         }
 
diff --git a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
index 1d2741f..263c102 100644
--- a/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
+++ b/tests/Snipdeck.Core.Tests/ViewModels/SettingsViewModelTests.cs
@@ -221,8 +221,10 @@ public async Task ChangeStoragePath_notifies_when_the_restart_cannot_be_initiate
 
                 await vm.ChangeStoragePathCommand.ExecuteAsync(null);
 
-                // Path still persisted, but the user is told to restart manually.
-                Assert.Equal(target, store.Current.StoragePath);
+                // Restart failed, so the switch is rolled back: config stays on the
+                // old location (here: unset/default) and the user is notified.
+                Assert.Null(store.Current.StoragePath);
+                Assert.Equal(current, vm.StorageDirectory);
                 Assert.Equal(1, restart.RestartCount);
                 Assert.Equal(1, ix.NotifyCount);
             }