OpenOrder

The hymn and liturgy slides come from purchased presentation editions of two licensed hymnal collections, sold on a USB drive or as a download, in a binary format python-pptx can’t open.

A 92-line PowerShell script drives the real PowerPoint application over COM and saves each file as .pptx, skipping cloud-sync conflict copies. A 347-line extractor then finds the lyrics by where shapes sit, not what they say, because the wording varies from file to file and the layout doesn’t:

• shapes parked off the slide are dropped;
• title and hymn-number boxes are skipped by position;
• the lyric is the tallest shape below the 1.5-inch line;
• copyright lines become metadata.

The 1,158 entries live on the user’s machine and are gitignored in the repo. The Windows build carries no lyrics and finds the hymnal through a folder setting. With none configured, the app says so, instead of returning searches that look like “no such hymn”.

Every translation was once fetched over the network. With no connection, a deck came out looking complete with the reading missing, and nothing warned anyone.

The fix has two halves. The public-domain Berean Standard Bible now ships inside the app, in the publisher’s own plain-text format, so the default needs no network. When a networked translation fails, the bundled text stands in and the app says why (no connection, a rejected key, or a passage that translation lacks), in the preview and after generation.

One interface fronts three sources: the bundled text, a free API for KJV, ASV and WEB, and API.Bible with the congregation’s own key, validated before it’s stored and never returned. Traps found on the way:

• “John 14:15-17, 25-27” splits into contiguous runs, so the gap isn’t swallowed, and a semicolon starts a second reading;
• slides are titled from the passage the API actually returned, not the one requested, because paraphrases come back as whole paragraphs;
• two book names differ from the parsing library’s, and one of them is Psalms;
• one cache policy (30 days, under 500 verses) meets the strictest provider’s terms.

1. Revisions. A snapshot at every point where work could be lost (opening a service, switching congregation, generating, starting a new one), 20 deep, behind a Revert button.
2. Refusals in words. A failed save returns a 409 with a reason and blocks the move to another service. An empty form can’t overwrite a saved one unless the clear was deliberate.
3. The date comes first. “New service” once cleared the form but kept the date, so autosave blanked a finished service. Now a new service asks for its date, a taken date is refused, and the clearing function is gone.
4. Optimistic concurrency, in 1.17.1. Two windows or two computers can share one data folder, so reads carry a modification token and each autosave sends it back. A mismatch gets a 412, and nothing is written until the person chooses.

Generation never overwrites either: a taken name becomes “name (2)”. Each file’s receipt is read back, so a save that didn’t happen raises an error instead of a success message.

I built it in four feature releases, 1.5.0 to 1.8.0, over two days. Each congregation is a folder in the user’s data directory, never in the package, holding its Word template, palette, seven art slots, communion template and calendar. A built-in default makes a fresh install work, and a broken profile or a bad colour falls back without costing a Sunday.

Three defects surfaced that a single congregation had never triggered:

• the bulletin’s calendar block was drawn in a hard-coded accent colour;
• python-pptx and python-docx each define an RGBColor that fails isinstance against the other’s, so theming silently fell back; colours now cross between them as hex;
• backdrops sat on top of the text, hidden only by translucent art; z-order is now explicit.

Section titles are composited in Pillow in 11 title styles, several of them true frosted glass, because a PowerPoint shape can’t blur what’s behind it. In the same two days, service titles began coming from the church year, computed in code from the date: Easter by the Meeus/Jones/Butcher algorithm, Advent counted back from Christmas, and a three-tier precedence for days with more than one name.

The real work is in Python: document generation, the hymnal, scripture. So the app is a PyInstaller bundle that starts FastAPI on a background thread and opens a native pywebview window on it: one process, no sidecar.

One script runs the release. It gates on a build-mode typecheck (the solution-style tsconfig means the plain command checks nothing) and a spelling check over every tracked file, then refuses a dirty tree. The macOS leg claims the build number before the frontend compiles, so the number in the app’s footer is never off by one; a separate Windows machine builds the same commit under the same number. Its 976 files travel as one zip, so one SHA‑256, checked on every copy, proves the whole artifact arrived.

Each fix is a postmortem turned into a step: the PyInstaller work directory is cleared (cached builds kept shipping a stale icon), the macOS bundle is re-signed last and verified, and pushes name their remote and branch.