feat(settings): add random notification sound options

[pauldambra]

Summary

Adds two options to the notification "Sound effect" dropdown in Settings > Notifications:

• Random (all) — picks a fresh sound per notification from the built-in sounds plus any installed custom sounds
• Random (custom) — picks from the user's custom sounds only; the option is shown once at least one custom sound is installed (same condition as the existing Custom group)

Details

• New CompletionSound values random-all / random-custom live alongside the custom:<id> sentinel rather than in BuiltInCompletionSound, which keys the SOUND_URLS asset record
• Resolution happens in resolveSoundUrl, which is called per notification (and per press of the "Test sound" button), so each firing draws a fresh random pick with no extra plumbing
• random-custom with an empty pool resolves to null and plays nothing, matching the existing deleted-custom-sound behaviour; removing the last custom sound while random-custom is active falls back to "None", extending the existing fallback in removeCustomSound

Testing

• Extended sounds.test.ts: pool membership for both modes, null for random-custom with nothing installed, and a Math.random spy at both extremes proving custom sounds are reachable in the random-all pool
• Extended the parameterised removeCustomSound test in settingsStore.test.ts with the random-custom fallback, plus a case verifying it stays active while other custom sounds remain

---

Created with PostHog Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 729b5ea.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "feat(settings): add random notification ..." | Re-trigger Greptile}

[pauldambra]

QA Swarm review complete. See inline comments.

[pauldambra]

Note

🤖 Automated comment by QA Swarm — not written by a human

Multi-perspective review: qa-team (specialists + generalists), paul-reviewer, xp-reviewer, security-audit

Verdict: ✅ APPROVE

Small, well-tested feature with zero critical/high/medium findings across all four review perspectives. Everything flagged is a low-severity polish item or nit; nothing blocks merge.

Key findings

🟢 Low

• random-custom can persist with an empty custom-sound library outside the guarded removeCustomSound path (rehydrate / downgrade window), leaving a blank Select trigger with orphaned volume/scale rows — normalize on rehydrate (convergent: 3 reviewers)
• resolveSoundUrl is now nondeterministic and NotificationBus.notify resolves twice per native notification; only null-ness is consumed today so behaviour is correct, but the played and checked URLs are different rolls — a latent trap

⚪ Nits

• customUrls is mapped on every call including paths that never use it (negligible)
• Silent fallback to "None" when the last custom sound is removed could use a toast
• customSounds.length > 0 guard now appears twice in the JSX — small local hasCustomSounds const

Convergence

• The orphaned random-custom + empty-library state was flagged independently by qa-team/frontend, qa-team/generalist-b, and paul-reviewer — highest confidence finding
• The per-call customUrls allocation was flagged independently by qa-team/performance and xp-reviewer

Reviewer summaries

Reviewer	Assessment
🔍 qa-team	Overall LOW: correct branch ordering, safe empty pools, solid tests; one convergent low-severity ghost-state gap
👤 paul	"nice little feature, and honestly the tests carry it... perfetto. ship as you see fit"
📐 xp	Clean work at "make it right"; strong parameterized tests, only minor duplication and incidental allocation
🛡 security-audit	No exploitable vulnerabilities: pool is build-time assets + user's own local data URLs into a media-fetch sink; no trust boundary crossed

---

Automated by QA Swarm — not a human review

[pauldambra]

QA Swarm follow-up review of the new commits (81b8e58, fca242c). See inline comments.

[pauldambra]

Note

🤖 Automated comment by QA Swarm — not written by a human

Follow-up review of commits 81b8e58 + fca242c (merge() normalization fix, comment removal)

Verdict: ✅ APPROVE

The delta is a correct, well-targeted fix for the prior convergent finding — it handles missing-key, null, and empty-array shapes, correctly leaves random-all alone, and security review confirms it strictly narrows reachable state. Two low-severity follow-ups flagged, nothing blocking.

Key findings

🟢 Low

• The new merge() normalization has no test, despite the test file having the exact rehydrate pattern needed (convergent: 4 reviewers)
• The fix closes the random-custom ghost but not the equally-reachable orphaned custom:<id> ghost (pre-existing, convergent: 2 reviewers)

Reviewer summaries

Reviewer	Assessment
🔍 qa-team	LOW — fix verified correct across all persisted-state permutations; missing test is the one gap
👤 paul	"nice fix... no correctness bugs in the delta. ship as you see fit"
📐 xp	Clean, minimal, in the right place; two-place guard logic is acceptable divergence, not a OnceAndOnlyOnce violation
🛡 security-audit	Zero findings — writes a hardcoded literal, strictly reduces reachable state

---

Automated by QA Swarm — not a human review

[pauldambra]

QA Swarm follow-up review of the rehydrate-test commits (d9f0155, 729b5ea). One optional nit; verdict unchanged (APPROVE).

[github-actions]

Additive UI/settings feature with no production risk — new sound type values, proper edge-case guards at both runtime and rehydration, and good test coverage. All review comments are resolved.