Rivet 0.8.0

• Reject self-contradictory signed update manifests before publication or
  client acceptance: artifact sets must be non-empty and positive-size,
  minimum/previous versions must precede the release, and artifact
  platform/architecture/installer identities must be unique. Signed wrappers
  and payloads also reject trailing JSON values and fields outside their
  versioned schemas.

• Add an opaque managed updater for the check/select/download lifecycle shared
  by downstream applications. It copies mutable configuration inputs and
  provides deeply immutable, synchronized JSON-safe state,
  one background worker, progress, explicit cancellation, monotonic manifest,
  stall, and total deadlines, deterministic destinations, and terminal cleanup
  while leaving installation and restart with the native host.

• download-update reports download progress: an optional #:on-progress
  callback receives cumulative bytes from zero through the final downloaded
  size. Intermediate reports are throttled to about one per percent of the
  signed artifact size by default, with an optional byte cadence for activity
  watchdogs. In-app updaters can drive progress bars without copying Rivet's
  bounded, redirect-aware downloader. Interrupted or cancelled downloads
  remove their partial file as reliably as ordinary failures.

• Authenticate signed update-manifest payload bytes before parsing their JSON.
  Malformed, unauthenticated payloads now fail at the Ed25519 boundary instead
  of entering semantic validation and contradicting the documented trust
  order. read-signed-manifest remains an explicitly unauthenticated
  inspection API; update clients use verify-signed-manifest.

• Serialize portable update execution and recovery with an installation-scoped
  in-process semaphore plus a target-derived operating-system file lock, even
  when callers configure different backup paths. A competing updater now fails
  before it can remove or rename shared staging, backup, marker, or journal
  state; the persistent empty lock file is not a crash marker. The prepared
  installation handle is opaque so callers cannot forge its lock identity.

• Make settings-store an opaque synchronized handle. The pre-1.0 API no
  longer exports its constructor, path/lock/data fields, or mutation setters,
  which allowed callers to bypass atomic persistence and replace the store's
  lock. Transactions refresh under shared in-process and operating-system
  locks to prevent stale handles from losing updates; stored JSON trees and
  snapshots are deeply immutable. Use make-settings-store and the existing
  controlled operations; settings-store? remains public.

• Add a Windows rivet::system::TrayController that owns tray window
  subclassing, localized native menu presentation, command dispatch, and
  automatic TaskbarCreated recovery. The reference Taskboard now exercises
  the blessed tray-resident host pattern instead of leaving every application
  to rediscover TrackPopupMenu's foreground-window requirement.

• The Windows tray icon (rivet::system::TrayIcon) can update its tooltip
  (SetTooltip) and re-register itself after an Explorer restart
  (Readd, called from the host's TaskbarCreated broadcast handler) —
  state-aware tray apps no longer re-allocate the icon to relabel it and no
  longer lose it the first time the shell restarts. TrayIcon owns an icon
  copy so recovery does not impose a new lifetime requirement on callers.

• Document one reproducible downstream install contract: pin Rivet's Git
  package source and setup-embed-racket action to the same revision, and
  install the package only after the minimal embeddable runtime is active.

• Add Wayland-safe Linux global shortcuts through the XDG Desktop Portal,
  including asynchronous consent/binding results, compositor activation tokens,
  runtime capability discovery, and a hermetic mock-portal integration test.
  Rivet deliberately provides no X11 XGrabKey fallback.

• Bound and retry Ubuntu runner package-manager operations so a stalled mirror
  cannot consume an entire desktop validation job without a useful failure.

• Removed the misleading rivet-type runtime descriptors from the pre-1.0
  public surface. Schema type identifiers are declaration grammar, while Keel
  is the canonical runtime-inspection model.

• Added an exact public-export contract and a Racket 9.0 CI lane so accidental
  API drift and minimum-version regressions fail before merge.

• Make Keel's validated app-schema the canonical in-memory input to Swift,
  C++, and Kotlin client generation. Rivet now keeps only a fail-closed
  Keel-to-RVT1 type adapter instead of reconstructing a parallel codegen schema
  model, while preserving generated source and schema snapshot compatibility.

• Synchronize the English and Chinese CI guide with the pinned Ubuntu 24.04
  runner and remove a stale comment about the now-opaque State descriptor.