v0.4.3

tio-gui 0.4.3 — resilient settings snapshots

This release includes self-contained Linux x86-64 AppImage, DEB, RPM, Arch
binary package, portable tarball and sideloadable Flatpak, signed/notarized
Apple Silicon macOS DMG and ZIP, and a Windows x86-64 per-user NSIS installer.
It keeps GPL-3.0-only licensing. These are upstream downloads, not acceptance
into Debian, Fedora, AUR, Flathub or Nixpkgs repositories.

The immutable v0.4.3 tag retains application source e69f5f6. The macOS
assets use packaging revision 86c6fe1, which redirects Nix's build-machine
Apple iconv to the system library with the same ABI. This fixes charset
conversion without requiring Nix or Homebrew on the destination Mac; GNU
iconv is not substituted. The macOS application implementation is unchanged.

The Linux assets additionally fix GTK transient-dialog cleanup during the last
logged tab's close confirmation, preserve explicit language selection during
GTK initialization, and follow the system language for new workspaces. The
portable runtime includes MIME data, a UTF-8 locale and Latin/CJK fonts so icons
and translations work without the builder's desktop libraries. Exact Linux
source revision and asset hashes are recorded in release-provenance.json and
SHA256SUMS.txt; the corresponding application and runtime sources are supplied
in the linux-runtime-sources.tar.xz asset. GitHub's automatic tag source archive
remains the original immutable tag, not these later Linux fixes.

The Windows installer uses packaging revision d2b0b6e, which includes GLib's
two subprocess helper executables. These are required by bundled pixbuf setup
and are not discovered by DLL-import scanning. The installer is unsigned and
does not require MSYS2 on the destination. The Windows frontend remains a
smaller native serial console; it does not claim the full macOS tools workspace.

Settings integrity and recovery

• Normal saves alternate between the primary settings file and a peer .bk
  slot, preserving one previously validated snapshot during replacement.
• Each slot carries a version, unsigned 64-bit sequence number, and SHA-256
  digest over the exact serialized payload. Startup validates both slots and
  selects the newest valid snapshot, including across sequence wraparound.
• Missing, truncated, or damaged slots recover from the other valid copy.
  Ambiguous counters and stores with no valid copy fail closed without
  overwriting the files.
• Cross-process locking serializes writers, replacement is atomic and durable
  where the platform supports those guarantees, and POSIX snapshots are kept at
  mode 0600.
• Existing single-file settings migrate on the next successful save. Import now
  commits the new store before replacing the visible workspace, and native
  editions back up the complete in-memory workspace before importing.
• Closing the application now persists the workspace before sessions are torn
  down. If locking or storage fails, the window and its live tabs remain open so
  the user can retry or export them instead of silently losing the workspace.

The .bk path is a peer slot and may contain the newest settings; it is not
always an older backup. See settings storage for the
format, recovery procedure, and filesystem limits.

Validation scope

The final settings implementation adds thirteen store scenarios covering
alternation, every truncation point, corruption, legacy migration, backup-only
recovery, sequence wraparound and ambiguity, write failure, import/export,
permissions, cross-process locking, and interrupted writers.

At the release candidate commit, Linux, Windows, and macOS CI passed. Native
x86-64 Linux builds on both pk4 and wpc passed all 15 registered CTest groups in
an isolated X11 session, including settings storage and workspace restart. The
Nix package and the complete pk4/wpc system configurations are validated
separately before the mynix pin is delivered.

The Linux release runtime passed all 15 CTest groups in the pinned Ubuntu 24.04
builder, with critical GTK/GLib warnings fatal in workspace-close regression
tests. A minimal Ubuntu 22.04 container without GTK development/runtime
packages and without networking exercised the bundled GUI, tio PTY transmit,
receive/logging and normal last-tab close. Chinese and system/C-locale English
screenshots were checked for translations, fonts and SVG icons. The bundled Lua
and QuickJS plugin tests passed on a native Linux host with network, process,
filesystem and output limits retained. A sideloaded Flatpak passed the same X11
PTY/logging/normal-close test in a task-owned installation and configuration.

DEB (Ubuntu 22.04), RPM (Fedora 44) and Arch binary packages were checked for
installation, replacement, CLI identity, desktop metadata, removal and user
settings preservation in offline disposable containers. They share the same
portable runtime; these checks are not full desktop/hardware certification for
every distribution. Direct AppImage FUSE mounting, Wayland, real USB/BLE and
nested Flatpak plugin behavior remain separate acceptance work.

On the physical Apple Silicon Mac, all 16 native CTest groups passed. The final
ZIP passed Developer ID signature, notarization and Gatekeeper checks, plus
an isolated PTY test receiving/logging 2,065 exact bytes and sending text with
a CR terminator. Development-library paths were denied during that test.
The packager now also requires actual bundled GLib conversions from ASCII,
ISO-8859-1 and GB18030 to UTF-8 with Nix/Homebrew paths denied, covering runtime
data dependencies that a dylib/signature audit alone does not detect.

The final Windows installer was installed over SSH on a physical GPD Win Mini
running Windows 11, then launched in its logged-in desktop session. Its Chinese
window was visually checked. All four native test executables passed using only
the installed runtime and Windows system paths: settings storage, native serial
error handling, payloads, and highlighting (24 cases: 22 passed, 2 explicitly
skipped platform/external-shell cases). The settings test includes child-process
locking and interrupted writers. No COM device was attached for this check.

These checks do not replace physical USB adapter, unplug/replug, electrical line
control, or long-running serial-session acceptance. Existing running sessions
are not stopped or migrated by the package build.