Rivet 0.6.0

• Add raco rivet manifest-compose: folds the per-platform signed
  update manifests from a multi-platform release into ONE family-wide
  signed manifest (one artifact per platform/architecture, identity
  fields verified identical across legs, Ed25519 wrapper unchanged) —
  replacing the per-product hand-rolled merge scripts. Fixes #175.

• raco rivet release now emits a portable zip beside every installer
  (family naming, sha256 alongside) — the family update feed and
  locked-down machines consume it directly.

• Document the multi-platform release matrix convention (runner labels,
  per-arch Racket installs, family artifact naming, the compose step) in
  docs/release-and-updates.md.

• Windows and macOS hosts now shut the embedded backend down orderly on
  session end. The Windows system adapter gains InstallShutdownHook
  (SetConsoleCtrlHandler: CTRL_C/CLOSE/LOGOFF/SHUTDOWN) and the scaffold
  wires it plus the window-close path to a thread-safe backend stop; the
  macOS scaffold installs an NSApplicationDelegate whose
  applicationShouldTerminate stops the backend for Cmd-Q, logout, and OS
  shutdown. Mirrors the Linux InstallShutdownHook shipped by #128 and
  wired into the scaffold by #168. Fixes #120.

• Document the large-payload conventions (docs/large-payloads.md): cursor
  pagination with fail-closed limit caps for report-shaped RPCs, stable-id
  tree nodes with windowed children for virtualized trees, and typed
  progress records instead of stringly-typed events, including the current
  scope of cancellation. Fixes #133; covers the convention layer of #131
  and #132.

• Add rivet/testing: an ephemeral-port HTTP listener (racket/tcp cannot
  report the bound port; this probes once and returns both the port and
  the listener) plus a sequential request-capture fake server with
  loopback close-race handling. Test suites only; never enters an embedded
  payload. Fixes #98.

• Cut ~100 MB (48%) from Windows release payloads. The packaged app no
  longer ships MSBuild debug symbols (*.pdb, 60+ MB) or the ONNX and
  DirectML inference runtimes (~40 MB) that Windows App SDK
  self-contained deployment drags beside every app; Rivet hosts link no
  Windows AI APIs, and the exclusion is pinned by an explicit list plus
  a launch smoke on every package. Fixes #144.

• Windows hosts now compile a VERSIONINFO resource into the exe. The
  generated app-icon.rc always carries the project identity
  (ProductName/FileDescription/Company from rivet.rktd, versions as
  version.build) so Explorer, Task Manager, and installer UX show the
  product instead of a bare framework binary; the icon line still rides
  along when windows-icon is declared. The WiX missing-tool hint now
  points at dotnet tool install with a 5.x pin (WiX 7 aborts on the
  Open Source Maintenance Fee EULA). Closes the identity half of #166.

• Linux hosts now terminate on SIGTERM/SIGINT. The host scaffold and the
  Taskboard example install Rivet's shutdown hook so a termination signal
  runs the same orderly backend shutdown as the GTK shutdown signal and
  then exits; previously the embedded backend died on the signal while the
  GTK process stayed up, leaving a window that could not search or run
  anything (observed on Fulcrum 0.4.1: kill left a half-dead app that
  only SIGKILL would remove).

• Honor linux-binary-name in rivet.rktd: the Linux build stage, package
  staging, verification, and launch smoke now use the configured executable
  name instead of the hardcoded scaffold name RivetHost (default
  unchanged). Apps ship as their product name — fulcrum, not a generic
  host binary — matching what the docs and desktop entries already say.
  Partially addresses #169.

• Build native Linux system installers from raco rivet release: a deb
  (dpkg-deb, unprivileged, installs under /opt with a desktop entry and
  pixmaps icon), an rpm (rpmbuild BUILDROOT, no distro-specific macros), and
  an AppImage carrying the GTK4 dependency closure with compiled GSettings
  schemas and pixbuf loaders so one file runs on older distributions. The
  set is selectable via linux-formats; the signed tar.gz update payload
  remains unchanged. Production verification validates each format with
  its own tooling (dpkg-deb -x, rpm -qpl, --appimage-extract), and the
  Linux CI matrix smoke-builds and verifies all three end to end.

• Add a supported WinUI 3-to-HWND bridge. Generated Windows hosts expose
  WindowHandle() through the first-party system adapter, centralizing the
  Windows App SDK IWindowNative ABI and removing the need for title-based
  FindWindowW workarounds.

• Load raco rivet subcommand modules lazily. A stale bytecode cache in a
  linked checkout now fails inside the command entry point, which detects the
  instantiate-linklet mismatch and prints the working remedy (clear
  compiled/ + raco setup rivet) instead of crashing raco dispatch with a
  raw linklet dump. Partially addresses #145.

• Align Swift and Kotlin state accessors with the generated RPC naming: they
  are now get_<state>/set_<state> instead of a camelCase prefix glued to a
  snake body (getRepo_root). This is a breaking rename for Swift/Kotlin call
  sites; C++ was already snake_case and is unchanged.

• Scope generated Swift Records and Enums under RivetTypes. Common domain
  names such as Task and Result no longer shadow Swift concurrency or
  standard-library types across the application module; native Swift call
  sites now use RivetTypes.<SchemaName>.

• Add a reusable checksum-pinned Linux embeddable-Racket setup action and a
  bilingual native-host CI guide. The guide requires WinUI, SwiftUI/AppKit,
  and GTK4 hosts to compile before release on matching runner image classes,
  and the resource guide now shows the verified cross-platform app/ layout
  for shared product data.- Add a first-party plain-GTK4 theme resolver. Linux hosts now reconcile the
  desktop color-scheme signal with the effective gtk-theme-name variant
  before creating widgets, preventing application CSS and native controls from
  landing on opposite light/dark palettes; pure resolution cases run in CI.

• Add raco rivet release --without-updates for products that deliberately
  ship without an online update channel. The release still produces and
  verifies its platform installer, SBOM, and third-party notices while update
  credentials and the signed channel manifest are omitted explicitly.

• Follow HTTP redirections (10 hops) in fetch-update-manifest and
  download-update. GitHub release assets — the dominant update origin —
  answer with a 302 to their CDN, so an updater pointing at
  releases/latest/download/… previously verified an empty body and every
  check failed.

• Ensure isolated RPCs sent after an idle interval run immediately in embedded
  Racket CS hosts instead of waiting for a later frame to wake request dispatch.

• Prefer native 64-bit MSBuild when discovering Visual Studio, preventing the
  32-bit host compiler from exhausting its address space on WinUI ARM64 builds.

• Add an opt-in Linux InstallShutdownHook for SIGTERM/SIGINT. Its
  async-signal-safe self-pipe hands graceful state flushing to a normal watcher
  thread, while a repeated signal still terminates a stuck shutdown.

• Compile the Racket backend dependency graph with raco make before creating
  core.zo, so a same-length edit to a transitive source module cannot leave
  stale bytecode in a successful native build.

• Add the Linux tray contract: rivet::system::TrayIcon hosts an
  org.kde.StatusNotifierItem with a com.canonical.dbusmenu menu over the
  session bus (GDBus), the pairing every desktop watcher serves (GNOME via
  the AppIndicator extension, KDE natively). The opt-in stays an application
  decision — TrayIcon::available() and the tray capability report a
  reachable watcher; the icon, tooltip, and flat menu update in place, and
  the watcher is re-registered automatically when GNOME Shell or the
  extension reloads. Verified end to end against the real desktop watcher
  (registration, property reads, menu layout, click dispatch) plus the
  graceful no-watcher path in an isolated D-Bus session.

• Add optional human-readable publisher project metadata and use it for the
  Windows MSI Manufacturer/Apps & Features Publisher value. Legacy projects
  fall back to display-name instead of exposing a reverse-DNS identifier.

• Keep macOS development and test executables outside an .app bundle from
  entering UNUserNotificationCenter, whose missing bundle identity otherwise
  raises an uncatchable Objective-C exception. Notification availability is now
  explicit; authorization returns false and delivery throws a catchable error.

• Normalize Swift declaration keywords such as init and public before
  emitting client APIs, and put both source declarations plus the generated
  identifier in the first line of native-name collision errors.

• Add provider-neutral, layer-attributed JSONL diagnostics across the Racket
  backend, C++/Swift native clients, transports, and embedding bridges. Records
  identify lifecycle/RPC boundaries, status, last RVT1 event, and request id;
  stderr defaults and injectable sinks keep logging dependencies out of the
  runtime and leave the RVT1 wire contract unchanged.

• Launch packaged GUI artifacts as the final verification gate when a graphical
  session is available. The executable starts from an unrelated temporary
  directory, must remain alive for five seconds, and is then terminated;
  premature exit reports bounded stdout/stderr. Headless environments report
  an explicit skip, and package/verify --skip-launch-smoke provide an
  intentional override without disabling structural or signature checks.

• Generate application identity from rivet.rktd for every native client and
  stage the same values for Racket through rivet/app-info. Swift, C++, and
  Kotlin now receive display name, version, build, identifier, and release
  channel without app-local copies; the generated macOS window title uses the
  display name instead of the RivetHost process name.

• Make the centralized macOS embedded-runtime configuration select its staged
  resource root before Racket starts, so packaged backends can load foreign
  dependencies such as libgmp, libcrypto, and libssl regardless of the launch
  process's original working directory. The real embedded round-trip now loads
  rivet/distribution to keep this dependency path covered in CI.

• Generate a default-deny Apple companion API from the shared Racket schema.
  Projects explicitly list device-rpcs; Rivet emits Codable request/response
  types, typed RivetDeviceClient methods, and phone-side
  registerGeneratedBackend routing, records export compatibility in schema
  snapshots, rejects Any, and cross-compiles the generated surface for iOS
  and watchOS in CI.

• Centralize the canonical macOS embedded-runtime layout probe in
  EmbeddedRacketConfiguration.resolvedDefault. Generated and reference hosts
  now select packaged Contents/Resources or staged development layouts
  without duplicating app-side boot/core path discovery.