BatteryControl 1.3.2
Bug-fix and safety-hardening release. Every fix was found by operating the app end-to-end on real hardware (M3 MacBook Air, macOS 15.8) or by an external review of the CLI, and fixed at the root with regression tests. No new features.
Fixed
Duplicate app instances are now impossible. Two copies of BatteryControl could run at once (two menu-bar icons, doubled polling). A single-instance guard now hands off to the running app and exits, including the relaunch-after-update path.
batterycontrol limit off now requires --confirm when a limit is active. A cron job, stale script, or agent could previously silently remove a deliberate charge limit. Without the flag the command is refused (exit 6) and nothing changes; with no limit active it remains a harmless no-op. limit set, status commands, and bounded sessions like discharge are unchanged.
The menu bar no longer lies about platform support. It reported "Active & verified" on unsupported Macs because it hardcoded the supported flag; it now shows the same honest state as the dashboard.
The dead "Custom" preset button is gone. Clicking it did nothing; the custom controls live directly below where it was.
Discharge consent can no longer leak between sessions. A cancelled safety-floor dialog left the floor-removal toggle stuck on for the next session's UI. The consent state now resets correctly (pure, unit-tested decision).
Honest banner when the app was updated while running. A GUI process opened before an upgrade showed a contradictory "helper required" banner while the dashboard reported an active, verified limit. Stale processes now show a "reopen the app" banner, real version mismatches show update-the-app guidance, and the two states can't contradict each other anymore.
Banner copy matches real verification timing. The "not verified" banner now reflects the actual ~2-minute firmware taper window instead of implying failure sooner.
Safety model
The CLI now documents and enforces a pinned classification: read-only commands (status, diagnostics, compatibility) stay frictionless for scripts and agents; persistent policy removal (limit off, uninstall) and below-floor discharge require explicit flags; bounded, self-terminating sessions and safe-direction changes stay ungated.
Validation
308 tests passing, zero compiler warnings, Debug and Release builds clean. Physically verified on the development M3 MacBook Air: duplicate-launch guard, limit gate refusal + confirm + restore, SMC readback 80/78 active. Hardware support remains capability-based; only the author's configuration is physically validated.
SHA256SUMS is attached; verify your download against it. Note: builds are ad-hoc/development signed, so macOS Gatekeeper will ask you to approve the app on first launch.