Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src-tauri/src/adapters/driven/notification/notification_bridge.rs`:
- Around line 129-134: The code incorrectly derives transfer statistics from
created_at (variables: created_at, now_secs, duration) which inflates durations
for queued/paused downloads; remove or guard the avg_speed and duration
formatting (the lines that push format_speed(total / duration.max(1)) and
format_duration(duration) into parts) and instead only show those fields when a
real active-transfer metric is available (e.g., a transfer_start or
active_duration field on d) or omit them entirely until the read model exposes
them; update the logic around d.total_bytes and parts.push(...) in
notification_bridge.rs to check for an explicit transfer-start/active-duration
metric or skip adding speed/duration.
- Around line 151-157: The truncate_error function currently takes
MAX_ERROR_BODY_CHARS characters then appends the ellipsis, producing a string
one char longer than the stated cap; change the logic in truncate_error to
return the original string when error.chars().count() <= MAX_ERROR_BODY_CHARS,
otherwise collect only MAX_ERROR_BODY_CHARS - 1 characters and then append '…'
so the final length is at most MAX_ERROR_BODY_CHARS (also guard against the
edge-case where MAX_ERROR_BODY_CHARS is 0 or 1 by handling those sizes
explicitly before subtracting).

In `@src-tauri/src/domain/notification/format.rs`:
- Around line 17-23: The formatting chooses the unit before rounding, so values
like 1024*1024-1 can display as "1024.0 KB"; adjust the logic in the function(s)
(e.g., format_bytes and format_speed) to perform rounding-aware unit selection:
after computing value and idx as shown, round the value to one decimal (or
compute the rounded_value that would be displayed) and if the rounded_value >=
1024.0 then divide value by 1024.0 and increment idx (ensuring idx stays within
UNITS bounds) before formatting; this ensures boundary cases roll over to the
next unit correctly.

In `@src-tauri/src/domain/notification/grouper.rs`:
- Around line 75-81: Detect and handle wall-clock backwards jumps in record():
if the incoming now_secs is less than the deque's back (most recent) timestamp,
clear or reset the timestamps deque and the burst_aggregated flag before pushing
the new time so stale "future" entries can't corrupt the 5-second window; update
the same logic in the sibling method that mirrors 99-107 (the other notification
recording/aggregation path) to perform the same check (compare now_secs with
timestamps.back(), clear timestamps and reset burst_aggregated when now_secs <
back) and then proceed to call prune(now_secs) and push_back(now_secs).

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src-tauri/src/adapters/driven/notification/notification_bridge.rs">

<violation number="1" location="src-tauri/src/adapters/driven/notification/notification_bridge.rs:129">
P1: Don't compute transfer duration from `created_at`; it includes queue/paused time and can misreport both duration and average speed in completion notifications. Use an actual transfer-duration metric (or omit these fields until one is available).</violation>

<violation number="2" location="src-tauri/src/adapters/driven/notification/notification_bridge.rs:155">
P2: This truncation exceeds the configured 200-character cap once the ellipsis is appended; reserve one character for `…` before collecting.</violation>
</file>

<file name="src-tauri/src/domain/notification/format.rs">

<violation number="1" location="src-tauri/src/domain/notification/format.rs:23">
P3: Promote to the next unit when rounding crosses `1024.0`; values just below a boundary can currently render as `1024.0 KB/MB` instead of `1.0 MB/GB`.</violation>
</file>

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src-tauri/src/adapters/driven/notification/notification_bridge.rs`:
- Around line 57-59: The match arm handling DomainEvent::DownloadFailed
currently logs the raw error (error = %error) which can leak sensitive payload;
replace that structured field with a sanitized summary instead (e.g.,
error_summary = %sanitize_error_summary(&error) or call
summarize_download_error(&error)) and implement a small helper
(sanitize_error_summary / summarize_download_error) referenced from
notification_bridge.rs that strips URLs/tokens/headers, collapses large bodies,
and limits length before returning a safe string for logging; update the
tracing::error! call in the DomainEvent::DownloadFailed arm to use that helper.