SupportOS+ 1.9.1

[1.9.1] — 2026-10-30

Fixed — the Gate-G4 rejection fix wave (RS-4-1..RS-4-11), on the accepted state

v1.9.0 was tagged at the R4 STOP before the owner's live-use rejection was
diagnosed; every fix below lives first in this release. The owner re-tested the
fixed build, administered the acceptance instruments and closed GATE G4 with
the verdict accepted (2026-10-30; blind test + SUS records under
docs/audit/acceptance/).

• The copilot panel rendered as a 42.5 px sliver overlapped by the reader
  (the reported defect, at the owner's live 1625×828 aspect): egui lays
  widgets inside ui.horizontal out in EXTEND mode — text never wraps there —
  so a 369-character suggested reply laid out at full single-line width, blew
  the card's frame rect past the window edge, and the panel's size guard
  re-clamped the 320 px panel at that blown-out right edge, leaving the reader
  and composer to fill wrongly-reserved space. Root cause fixed:
  cop_suggest bullets now wrap explicitly with break_long_tokens
  (RS-4-4); rich-span body text token-breaks too (RS-4-3); the fix is locked
  by pixel tests, not by assertion.
• HTML fragments could leak into the copilot summary — <br>/<p> from
  raw ticket bodies reached the analyzer output. The analyzer now consumes
  strip_html'd bodies; core richtext gains strip_html + break_long_tokens
  with unit tests (RS-4-1/RS-4-2).
• Cc/Bcc fields span the full composer width instead of the narrower
  legacy box (RS-4-5).
• The Ctrl+Enter send hint sits in the composer foot — where the shortcut
  acts — instead of the views rail (RS-4-6).
• Blank-name customers no longer render a headerless row: conversation
  list and detail queries fall back to the email local-part, then
  customer (the Judy-row evidence; unit-tested, RS-4-7).
• The dashboard/reports goldens never drift at midnight again (RS-4-11
  clock seam): the chart subtitle and the reports builder date inputs derived
  their 30-day window from the wall clock, so their snapshot locks carried
  disclosed 120-px drift budgets — both budgets are DELETED and both suites
  lock byte-exact with zero tolerance; the 7d-stale backlog predicate reads
  the anchored window instead of the DB engine's now (production semantics
  unchanged; regression-tested both ways).
• New permanent snapshot lock: kittest_inbox_copilot locks the
  copilot-open state class — never locked before — at the owner's live aspect
  1625×828 light + dark, plus closed (RS-4-8). The verified set is 24 suites /
  175 tests / 171 goldens, all green over lavapipe+Xvfb; the tag is cut on the
  main commit CI's snapshots job already diffed, and the Release workflow
  re-runs fmt, clippy and the workspace tests before publishing.

---

Install-ready Linux packages for SupportOS+ (SupportOS-Plus) 1.9.1.

Built and verified by CI from commit acd557a on ubuntu:22.04
(glibc 2.35 baseline); artifacts are byte-identical to the files tested below.

Downloads

File	SHA-256
SupportOS-Plus-1.9.1-x86_64.AppImage	a3ae307f84382c315183a40306a19a4519ff5a53c7e688793181bdbdbb1c5022
supportos-plus_1.9.1_amd64.deb	093f7d057fc309eaff73aa6f78ec9f4fd81366c7c9f5854194f90bcd3a3bd824

Install

.deb — Ubuntu 22.04 LTS / 24.04 LTS, Debian 12+ (x86_64):

sudo apt install ./supportos-plus_1.9.1_amd64.deb

APT downloads and resolves every declared dependency automatically.
Launch from the desktop application menu as SupportOS+, or run
supportos-plus. The first run initializes the local database
($XDG_DATA_HOME/supportos-plus) by itself — nothing to configure.

Upgrading from 0.2.x: your existing data moves automatically from
the pre-1.0.0 supportos-plusplus directory on first launch — no
manual steps, nothing lost.

AppImage — any modern x86_64 desktop (glibc >= 2.35):

chmod +x SupportOS-Plus-1.9.1-x86_64.AppImage
./SupportOS-Plus-1.9.1-x86_64.AppImage

Runs without installation; bundles everything except the host display
server and GL/Vulkan driver. Use AppImageLauncher for desktop-menu
integration, or launch it directly.

System requirements

• CPU: x86_64 (amd64); OS: glibc 2.35+ (Ubuntu 22.04 LTS+, Debian 12+)
• A desktop session (X11 or Wayland); Mesa or any GPU driver
• ~200 MB free disk space; no compilation, no dev tools, no manual setup

Verified in CI for this release

• fmt + clippy (-D warnings) + the full workspace test suite,
  including the Landlock/seccomp parse-sandbox feature
• .deb installed through APT on clean ubuntu:22.04, ubuntu:24.04 and
  debian:12 containers: dependency resolution, desktop entry + icons,
  boot-chain smoke, a 0.2.x-to-1.x data-directory upgrade
  (in-place migration, database preserved), GUI launch under Xvfb with
  only declared dependencies, reinstall, uninstall (user data
  preserved), purge
• AppImage: boot-chain smoke + GUI launch under Xvfb
• SHA-256 checksums in SHA256SUMS.txt; every download link checked live

SupportOS+ 1.9.0

[1.9.0] — 2026-10-29

Changed — Design-System reskin (the presentation layer, rebuilt on DC v1.0)

The owner-approved reskin (decisions.md D6: "everything is working fine, we need
to reskin only according to the new design system") ships in full. Every one of
the app's 23 routes now renders through the Design Contract v1.0 widget set —
the contract was extracted from the owner-approved design lab (Gate G1, commit
af5bc2a), and the Rust port never leads it. No feature, data, workflow,
shortcut or page-set change: every query, write, dialog and key binding is
byte-identical to 1.8.x; data-layer defects surfaced during the rebuild are
footnoted as receipt-cited quirks (DC C-1) and stay visible.

• R1 — tokens (RS-12): every --ds-* design token ported 1:1 into
  design.rs (LIGHT + DARK); DS.TONE is the single status→color map; the
  style lint (CI) bans raw color sites and off-scale spacing.
• R2 — widget sets (RS-13/14/15): the 17 canonical DS-C components (cards,
  tables, tabs, chips, buttons, forms, empty states, callout roles, toasts,
  detail panel, avatars, role-typed message cards, composer, AI identity set,
  console hero) as typed egui widgets — one DC sheet, one widget.
• R3 — page waves (RS-16..RS-20): all 23 routes rebuilt onto the six DS-A
  archetype recipes, with the archetype's presentation fixes applied (counter
  pills, filter bars, bar lists, danger zones, hero band) and every interactive
  control carrying its visible label for accessibility (Response::labelled_by
  / widget_info) — zero visual change from the lab.
• Locked against drift: 23 kittest suites / 152 tests / 168 goldens lock the
  real pages (not mocks) at 1440/1024/800 × 900, light + dark, diff-locked
  twice; CI now runs them on every push (the new snapshots job, lavapipe
  software Vulkan) — a visual regression on any page fails the build.
• Traceability gate (RS-21): the R4 matrix
  (docs/audit/acceptance/traceability-matrix.md, screen region → DS-C id →
  DC row) is machine-checked in CI against the frozen contract and the route
  list; the acceptance records are folded into the printable report series
  (docs/audit/SupportOS-Plus-Reskin-Acceptance-Report.pdf).
• Acceptance instruments (RS-21): the 5-second AI-identification blind-test
  protocol and the SUS questionnaire (target ≥ 68) ship under
  docs/audit/acceptance/ for the G4 final-acceptance administration.

---

Install-ready Linux packages for SupportOS+ (SupportOS-Plus) 1.9.0.

Built and verified by CI from commit 464000d on ubuntu:22.04
(glibc 2.35 baseline); artifacts are byte-identical to the files tested below.

Downloads

File	SHA-256
SupportOS-Plus-1.9.0-x86_64.AppImage	b6f5dcc4251980a93b995347d134abdd14541ef4d8881a05717699f9e83b2f2d
supportos-plus_1.9.0_amd64.deb	fa6dd7bf5aba85bc4cd005ead8d21b06e995c881aa2658143b611c4139b74e81

Install

.deb — Ubuntu 22.04 LTS / 24.04 LTS, Debian 12+ (x86_64):

sudo apt install ./supportos-plus_1.9.0_amd64.deb

APT downloads and resolves every declared dependency automatically.
Launch from the desktop application menu as SupportOS+, or run
supportos-plus. The first run initializes the local database
($XDG_DATA_HOME/supportos-plus) by itself — nothing to configure.

Upgrading from 0.2.x: your existing data moves automatically from
the pre-1.0.0 supportos-plusplus directory on first launch — no
manual steps, nothing lost.

AppImage — any modern x86_64 desktop (glibc >= 2.35):

chmod +x SupportOS-Plus-1.9.0-x86_64.AppImage
./SupportOS-Plus-1.9.0-x86_64.AppImage

Runs without installation; bundles everything except the host display
server and GL/Vulkan driver. Use AppImageLauncher for desktop-menu
integration, or launch it directly.

System requirements

• CPU: x86_64 (amd64); OS: glibc 2.35+ (Ubuntu 22.04 LTS+, Debian 12+)
• A desktop session (X11 or Wayland); Mesa or any GPU driver
• ~200 MB free disk space; no compilation, no dev tools, no manual setup

Verified in CI for this release

• fmt + clippy (-D warnings) + the full workspace test suite,
  including the Landlock/seccomp parse-sandbox feature
• .deb installed through APT on clean ubuntu:22.04, ubuntu:24.04 and
  debian:12 containers: dependency resolution, desktop entry + icons,
  boot-chain smoke, a 0.2.x-to-1.x data-directory upgrade
  (in-place migration, database preserved), GUI launch under Xvfb with
  only declared dependencies, reinstall, uninstall (user data
  preserved), purge
• AppImage: boot-chain smoke + GUI launch under Xvfb
• SHA-256 checksums in SHA256SUMS.txt; every download link checked live

SupportOS+ 1.8.3

[1.8.3] — 2026-10-28

Fixed — Diagnostics event log

• The event log could be permanently empty in perfect silence — a
  database that reached the current version with the pre-m050 table
  shape (a skipped or renumbered boot step, a restored backup) made
  every diagnostics write die with "no column named level" — an error
  every call site swallows — while every read returned an honest-looking
  empty list. "The event log reports nothing" was the visible result.
  ensure_tables now guarantees the full schema on every write,
  read and clear: new installs get the level column from the first
  CREATE, older shapes are self-healed in place (ALTER), and the m050
  migration shares the same one canonical guarantee. A write that still
  fails is now audible in the stdout log instead of vanishing.
• Webhook-health failures never reached the event log — the Diagnostics
  page promises "webhook rejections", but the health check only ever
  wrote its outcome to the Sync Health snapshot. Failed checks (error)
  and healed hooks (info) are now persisted to the event log too.
• Seventeen zombie sync runs — runs killed mid-flight (app closed
  during a sync) kept their sync_runs row in INITIALIZING forever, so
  Sync reports read as if nothing ever finished. At worker start, before
  any sync can be running, orphaned INITIALIZING/BACKFILLING rows are
  closed out as CANCELLED with a finished timestamp, and the cleanup is
  announced in the event log.

---

Install-ready Linux packages for SupportOS+ (SupportOS-Plus) 1.8.3.

Built and verified by CI from commit 535dc4d on ubuntu:22.04
(glibc 2.35 baseline); artifacts are byte-identical to the files tested below.

Downloads

File	SHA-256
SupportOS-Plus-1.8.3-x86_64.AppImage	d368f294793748834a55afb41a681479952190293ab1b7ebf83585a118419181
supportos-plus_1.8.3_amd64.deb	f691feb40d2bbf954e30cc563d730e5b347435b03fbd7373b8b7639ea7d0ed34

Install

.deb — Ubuntu 22.04 LTS / 24.04 LTS, Debian 12+ (x86_64):

sudo apt install ./supportos-plus_1.8.3_amd64.deb

APT downloads and resolves every declared dependency automatically.
Launch from the desktop application menu as SupportOS+, or run
supportos-plus. The first run initializes the local database
($XDG_DATA_HOME/supportos-plus) by itself — nothing to configure.

Upgrading from 0.2.x: your existing data moves automatically from
the pre-1.0.0 supportos-plusplus directory on first launch — no
manual steps, nothing lost.

AppImage — any modern x86_64 desktop (glibc >= 2.35):

chmod +x SupportOS-Plus-1.8.3-x86_64.AppImage
./SupportOS-Plus-1.8.3-x86_64.AppImage

Runs without installation; bundles everything except the host display
server and GL/Vulkan driver. Use AppImageLauncher for desktop-menu
integration, or launch it directly.

System requirements

• CPU: x86_64 (amd64); OS: glibc 2.35+ (Ubuntu 22.04 LTS+, Debian 12+)
• A desktop session (X11 or Wayland); Mesa or any GPU driver
• ~200 MB free disk space; no compilation, no dev tools, no manual setup

Verified in CI for this release

• fmt + clippy (-D warnings) + the full workspace test suite,
  including the Landlock/seccomp parse-sandbox feature
• .deb installed through APT on clean ubuntu:22.04, ubuntu:24.04 and
  debian:12 containers: dependency resolution, desktop entry + icons,
  boot-chain smoke, a 0.2.x-to-1.x data-directory upgrade
  (in-place migration, database preserved), GUI launch under Xvfb with
  only declared dependencies, reinstall, uninstall (user data
  preserved), purge
• AppImage: boot-chain smoke + GUI launch under Xvfb
• SHA-256 checksums in SHA256SUMS.txt; every download link checked live

UX Recovery & Reskin Plan (v1.0)

Forensic UX audit (file:line receipts) + Intercom-grade reskin plan R0-R5 with embedded R0 design specification. Presentation layer only - zero feature/DB/sync changes. Companion to deep-audit-v1.

Design Lab v3 — Design System v1.0

Design System v1.0 added to the UX Design Lab (Task 22).

• ds.html — living registry: canonical --ds-* tokens (both themes), 17 components (DS-C-xx), 6 page archetypes (DS-A-xx), DS.TONE status-to-color map, 7 governance rules, live mismatch register
• ds.css / ds.js — the only component vocabulary pages may compose from; 1:1 egui mapping for R1-R4
• mismatch-register.md — DS-0 audit: 8 Class-A unifications, 3 Class-B rationalizations, 2 Class-C keeps, with page/file evidence
• Lab entry point: 'Design System v1.0' in the header; 23-page replicas untouched

Scope contract unchanged: presentation only, no Rust/schema/sync/feature changes.

UX Design Lab v2 — all 23 pages

The HTML/CSS/JS design lab now covers all 23 navigation pages (app.rs NAV_GROUPS), not just the Inbox.

• Before: faithful replica of the current v1.8.0 shell for every page — including honest quirks (raw UTC stamps, Load/Pressure swap, seven-zero Outreach report, empty Freshness tab)
• After: token-v3 reskin proposal for every page — underline tabs, severity bands, AI violet identity, status dots, isolated danger zones
• Per-page Reskin notes with FIX / WAS / file:line receipts (2-3 per page)
• Cross-iframe page sync in Side-by-side mode; Inbox golden path unchanged; zero console errors verified

Presentation-only: zero changes to the Rust program. Unzip and open index.html.

UX Design Lab v1 — before/after replica

Interactive HTML/CSS/JS design lab for the approved reskin plan (Tasks 15-18).

• Before: pixel-faithful replica of the current v1.8.0 egui shell (zinc tokens, 66px rows, 300px thread keyhole, flat thread entries).
• After: reskin proposal — token v3 semantic surfaces, role-typed message cards, AI identity (violet), collapsed quoted history, Reply|Note composer with saved replies + AI-draft insert, typed Copilot cards, unread/assignee triage, j/k keyboard navigation.
• Design notes: toggle in the After view pins every change to its forensic file:line receipt.

Unzip and open mockups/design-lab/index.html. Zero program code changes — presentation-only reference (scope contract in the UX Plan PDF, chapters 7-9).

Deep Audit Report - October 2026

Independent deep audit of SupportOS-Plus: reviewer-claim re-verification with file:line receipts, 12 hidden findings, 2026 industry landscape digest (50 live searches, 16 primary sources), EU EAA/CRA compliance clocks, SeaORM verdict, and the merged roadmap. Printable 20-page PDF.

SupportOS+ 1.8.2

[1.8.2] — 2026-10-28

Fixed — Help Scout integration

• Webhook registration rejected with 400 (path: "url" — must be a valid URL.) — the platform's url validator refused the relay URL the
  health check sent (the live account hit this on 2026-10-27). The check
  now normalizes the relay URL before anything is sent: surrounding
  whitespace is trimmed, a missing scheme becomes https (the classic
  "funnel address pasted without the prefix"), and plain http is upgraded
  to https as in 1.8.1.
• Undeliverable relay URLs are refused with the fix, not echoed as an
  opaque 400 — loopback, private, link-local and CGNAT hosts (127.0.0.1,
  192.168.x, 10.x, 100.64/10 — including Tailscale node IPs) never reach
  the API; the outcome instead names the stored value and says exactly
  what to set in Settings (a public https relay address such as
  https://your-host.ts.net/webhook).
• Registration failures name the url they sent — if the platform
  still rejects a registration, the error now carries (the url we sent: …) so any future rejection can be diagnosed from the Sync Health
  outcome alone.

---

Install-ready Linux packages for SupportOS+ (SupportOS-Plus) 1.8.2.

Built and verified by CI from commit e1cbd59 on ubuntu:22.04
(glibc 2.35 baseline); artifacts are byte-identical to the files tested below.

Downloads

File	SHA-256
SupportOS-Plus-1.8.2-x86_64.AppImage	d1b4bc746ea086e97a793d1612d68168e66cf58e07ba4c113d29899786551a3a
supportos-plus_1.8.2_amd64.deb	d966111b2c22f541c0d027925ebc5a8a71f8fde40e0e95f2aa1cca1185fb15e7

Install

.deb — Ubuntu 22.04 LTS / 24.04 LTS, Debian 12+ (x86_64):

sudo apt install ./supportos-plus_1.8.2_amd64.deb

APT downloads and resolves every declared dependency automatically.
Launch from the desktop application menu as SupportOS+, or run
supportos-plus. The first run initializes the local database
($XDG_DATA_HOME/supportos-plus) by itself — nothing to configure.

Upgrading from 0.2.x: your existing data moves automatically from
the pre-1.0.0 supportos-plusplus directory on first launch — no
manual steps, nothing lost.

AppImage — any modern x86_64 desktop (glibc >= 2.35):

chmod +x SupportOS-Plus-1.8.2-x86_64.AppImage
./SupportOS-Plus-1.8.2-x86_64.AppImage

Runs without installation; bundles everything except the host display
server and GL/Vulkan driver. Use AppImageLauncher for desktop-menu
integration, or launch it directly.

System requirements

• CPU: x86_64 (amd64); OS: glibc 2.35+ (Ubuntu 22.04 LTS+, Debian 12+)
• A desktop session (X11 or Wayland); Mesa or any GPU driver
• ~200 MB free disk space; no compilation, no dev tools, no manual setup

Verified in CI for this release

• fmt + clippy (-D warnings) + the full workspace test suite,
  including the Landlock/seccomp parse-sandbox feature
• .deb installed through APT on clean ubuntu:22.04, ubuntu:24.04 and
  debian:12 containers: dependency resolution, desktop entry + icons,
  boot-chain smoke, a 0.2.x-to-1.x data-directory upgrade
  (in-place migration, database preserved), GUI launch under Xvfb with
  only declared dependencies, reinstall, uninstall (user data
  preserved), purge
• AppImage: boot-chain smoke + GUI launch under Xvfb
• SHA-256 checksums in SHA256SUMS.txt; every download link checked live

SupportOS+ 1.8.1

[1.8.1] — 2026-10-28

Fixed — Help Scout integration

• Webhook registration rejected with 400 ("Expected array of values
  from this list") — Help Scout retired four event names the app
  subscribed to (convo.updated, beacon.chat.agent.replied,
  beacon.chat.assigned, beacon.chat.ended), and the platform rejects
  the whole registration when even one name is stale, leaving the webhook
  health check stuck "failed" forever. The shipped list now matches the
  platform's 2026-10 catalogue (and re-subscribes convo.tags /
  convo.custom-fields, documented valid again), and registration
  self-heals: if the platform ever retires a name again, the accepted
  values are read straight out of the 400 body and the subscription
  retries with the intersection — no release needed. The outcome names
  what was dropped.
• Plain-http relay URLs are upgraded to https:// before registering
  — Tailscale Funnel (and every other TLS relay) redirects http, and a
  hook registered against a redirecting URL would be disabled by Help
  Scout after ten bounced deliveries. Loopback URLs are exempt.

---

Install-ready Linux packages for SupportOS+ (SupportOS-Plus) 1.8.1.

Built and verified by CI from commit 3c60506 on ubuntu:22.04
(glibc 2.35 baseline); artifacts are byte-identical to the files tested below.

Downloads

File	SHA-256
SupportOS-Plus-1.8.1-x86_64.AppImage	2fe688ffb8aeed8b812e3578c9d5627df89fbdb8e136ee34b437ee22242ef3ea
supportos-plus_1.8.1_amd64.deb	50767eb66b8a5724f57ddfd5a529df3601e4f053dbc00b72743cf631a5453de3

Install

.deb — Ubuntu 22.04 LTS / 24.04 LTS, Debian 12+ (x86_64):

sudo apt install ./supportos-plus_1.8.1_amd64.deb

APT downloads and resolves every declared dependency automatically.
Launch from the desktop application menu as SupportOS+, or run
supportos-plus. The first run initializes the local database
($XDG_DATA_HOME/supportos-plus) by itself — nothing to configure.

Upgrading from 0.2.x: your existing data moves automatically from
the pre-1.0.0 supportos-plusplus directory on first launch — no
manual steps, nothing lost.

AppImage — any modern x86_64 desktop (glibc >= 2.35):

chmod +x SupportOS-Plus-1.8.1-x86_64.AppImage
./SupportOS-Plus-1.8.1-x86_64.AppImage

Runs without installation; bundles everything except the host display
server and GL/Vulkan driver. Use AppImageLauncher for desktop-menu
integration, or launch it directly.

System requirements

• CPU: x86_64 (amd64); OS: glibc 2.35+ (Ubuntu 22.04 LTS+, Debian 12+)
• A desktop session (X11 or Wayland); Mesa or any GPU driver
• ~200 MB free disk space; no compilation, no dev tools, no manual setup

Verified in CI for this release

• fmt + clippy (-D warnings) + the full workspace test suite,
  including the Landlock/seccomp parse-sandbox feature
• .deb installed through APT on clean ubuntu:22.04, ubuntu:24.04 and
  debian:12 containers: dependency resolution, desktop entry + icons,
  boot-chain smoke, a 0.2.x-to-1.x data-directory upgrade
  (in-place migration, database preserved), GUI launch under Xvfb with
  only declared dependencies, reinstall, uninstall (user data
  preserved), purge
• AppImage: boot-chain smoke + GUI launch under Xvfb
• SHA-256 checksums in SHA256SUMS.txt; every download link checked live