MoveBit 0.0.9

Release-qualification build. No product behaviour changes since 0.0.8: this
is the published N+1 target for the real 0.0.8 → 0.0.9 signed AppImage
update, GUI relaunch with persisted data, and rollback/rejected-downgrade
qualification tracked in #96.

MoveBit 0.0.8

The AppImage update-fix release, and the clean baseline for the released
N→N+1 update qualification.

Fixed

• AppImage updates no longer report failure after a successful swap.
  The verified download replaced the running image and kept .previous, then
  start-download! passed the $APPIMAGE string to path->string and ended
  in phase=error, so the UI offered no relaunch. The path is normalized only
  when it is a path, and a Linux-only regression test drives start-download!
  end to end against a locally served signed artifact.

MoveBit 0.0.7

Release-qualification build. There are no product behaviour changes since
0.0.6: this release exists so the fixed signed-AppImage updater can be
exercised across a real published pair (0.0.6 → 0.0.7) on x64 and arm64,
including a full GUI relaunch with persisted data and an executed
rollback/rejected-downgrade pass.

Fixed

• Linux placement acceptance waits for the previous instance to release the
  single-instance name before launching the measured one.
• User-facing checksum instructions point at the published SHA256SUMS
  file used since 0.0.6.

MoveBit 0.0.6

The trustworthy-companion slice: reminders you can shape, outcomes that never
pretend to be more than they are, and a Mubi you can place by hand on every
desktop.

Added

• Named reminder rhythms. Balanced (default), Gentle and Frequent presets with exact, visible values; per-kind on/off switches; a local quiet-hours window that pauses reminders and resumes on its own; and config schema v3 with a one-time migration of 0.0.1 settings plus a config.json.v2.bak copy.
• Guided micro-breaks, strictly opt-in. While an eye cue is open you can start a 20-second look-away card; while a stand cue is open, a two-minute, self-paced movement invitation. Nothing counts down until Start, Done is an explicit self-report, and stopping records abandoned instead of pretending the break happened.
• Place Mubi where you want it. A temporary placement mode (macOS, Windows, and Linux X11) turns the character into a draggable surface for up to 30 seconds, then restores pointer-through. The normalized position is remembered per display, clamped after monitor/DPI changes, and honored on every desktop.
• Honest per-kind outcomes. The Today view shows how many invitations were actually presented next to how many you marked done; days or kinds without evidence stay unknown instead of becoming zero.

Changed

• First run is one screen. The real character, one sentence, and Start — no cadence wizard, no license promotion. Everyday settings are rhythm and sound; per-kind tuning, quiet hours, character size/motion/dock and language sit behind one Customize disclosure.
• Sound now defaults to off for fresh installs; existing choices are preserved.
• The eye-rest card no longer starts a countdown automatically, and finishing a timer no longer acknowledges anything.

Fixed

• History continuity. The device id was validated with a POSIX regexp that never matched, so every launch minted a new id and this device could not read its own previous history shards. Fixed with a pregexp and regression coverage.
• Move Aside during a cue visit now cancels the in-flight travel on macOS and Windows, so the character cannot be carried back to its old home.
• Windows portable updates stop safely after a two-minute old-process exit deadline instead of polling indefinitely. Failure to confirm exit leaves the install unchanged, records the unapplied update and never kills the running application. Native Windows coverage includes a real process surviving the update deadline.
• Windows portable updates restore and relaunch the old installation when the OS rejects the new executable, instead of deleting the backup after an unchecked start command. Copy retries are bounded, failures retain their original exit code, and failed restores retain the old directory for recovery. Native Windows helper fixtures exercise successful launch, copy failure and rejected-executable recovery.
• launchd label migration. The retired com.turinglambdaai.movebit agent is re-registered as com.turlamai.movebit on first launch, preserving autostart, without orphaning existing installs.

Security

• Signed Linux AppImage updates. AppImage installs now verify a first-class, per-architecture artifact from the Ed25519-signed manifest (URL, architecture, size and SHA-256) before the atomic swap; an unsigned sibling sidecar is never trusted, and a feed missing the platform AppImage fails closed.

Tests and release engineering

• X11 placement acceptance runs in CI: pointer-through by default, a bounded input region while placing, a real drag that moves the window, persisted coordinates, and the timeout restoring the empty region.
• The release matrix validates the exact 18 desktop assets and refuses to publish when the signed AppImage feed does not match the shipped bytes.

MoveBit v0.0.5

v0.0.5 — the desktop-fusion slice

Mubi melts into the desktop on every platform: Windows renders the
character through a GDI+ layered window (per-pixel alpha, click-through
for free), Linux drops the card and clears its opaque region, and the
header bar reaches title-bar parity with the mac host. History shard
writes gain a two-writer concurrency fix, and the Linux host builds
warning-free again. Flatpak sandbox execution is verified in CI on
both architectures.

MoveBit v0.0.4

v0.0.4 — the presence-polish slice

The application icon becomes Mubi on every platform (one source: the
canonical tokens.json art, rendered to icns/ico/PNG by
scripts/gen-app-icons.sh). The macOS menu bar presents states — droplet
at rest, Mubi's silhouette while a reminder is on screen, a slim moon
for Focus/paused. Linux gains its StatusNotifierItem tray with full
menu parity (rivet's TrayIcon; header buttons stay the honest fallback
without a watcher). The release contract grows Flatpak bundles for
x64 and arm64, validated end to end by the new flatpak-smoke leg.
Also: four HTML-escaped ampersands in native menu strings.

MoveBit v0.0.3

v0.0.3 — the companion-presence slice

Mubi visible from launch on every platform. Windows: the first-cue crash
pair root-caused from WER dumps, launch-visible fixed-size card, DPI-
correct sizing, live language switch. Linux: Xwayland backend preference
brings the docked companion to Wayland sessions, canvas scale fix.
Shared: i18n pipeline migration with a CI sync gate, settings parity.

MoveBit v0.0.2

v0.0.2 — the audit slice

MoveBit v0.0.1

0.0.1 — the fresh start (2026-10-27)

The first real MoveBit. The owner decided the rebooted product ships as
v0.0.1 — a deliberate restart of the version line; the content is the
complete v1 reboot (#55/#56): reminders-first character delivery (Mubi),
the explicit cue lifecycle, the removed fullscreen contract, the v1 config
schema, companion settings, tray Done/Later/Hide/Focus, milestone cheers,
and the completed gesture-motion story on all three hosts. See the
[Unreleased] section below for the full slice-by-slice detail.

MoveBit v0.5.0

Rollout note: this is the release where in-app updates meet every install
shape on every platform. Downloads can be cancelled (all three hosts), and
Windows joins the update flow with no dead ends: MSI installs (Program Files)
now take the feed's signed .msi through a passive msiexec upgrade, and
per-user installs gained backup + rollback around the file swap. The feed
also grows a real staged-rollout lever and every install keeps a JSONL
diagnostic log a bug report can point at.

Added

• Downloads can be cancelled. The start-download RPC doubles as the
  cancel gesture (the family toggle contract — no schema change): a second
  call while a download runs breaks the worker and lands the phase back on
  idle with the offer intact, because a cancel is not a failure. All three
  hosts grew the Cancel button, the cancelled state (「更新已取消，当前版本
  保持不变」), and a one-click way back to 更新并重启.
• Windows MSI installs self-update. Until now an MSI install (Program
  Files, per-machine) could never pass the writability probe — the only
  Windows update path was the portable zip swap. The feed now carries the
  signed .msi alongside the zip; installs under the Program Files prefixes
  (the taskly IsMsiInstall signal) select it by install-kind and hand off
  to one passive msiexec /passive /norestart /i — one UAC consent, and a
  failure leaves the old install working.
• Windows update swaps are backed up. The zip handoff used to overlay
  the payload in place; it now moves the old install aside first, copies
  into a fresh directory, and restores the old install when the copy fails
  — the update can no longer leave a half-swapped install behind. Both
  failure paths (backup rename, robocopy) write an update-failed.txt
  marker that the next launch surfaces once and deletes.
• Staged rollout is real. The updater config carried a hardcoded bucket
  0 with a "ships to everyone today" comment; the bucket is now generated
  once per machine (crypto-random-bytes — racket/base's fixed-seed PRNG
  would put every fresh install in the same lockstep bucket) and persisted
  in bootstrap.json, so a manifest can narrow its rollout without any
  client change.
• Diagnostics land in a file. Rivet's diagnostic sink wrote to stderr,
  which on a Windows GUI process means a black console window and then the
  void. Diagnostics now append as JSONL to <data-dir>/diagnostics.log —
  a bug report starts from the copyable failure text and can attach real
  backend records.
• Host-side download watchdog. The backend's watchdog (stall 120 s /
  total 30 min) already bounded every download; each host now also holds a
  30-minute ceiling of its own, so even a wedged backend can never leave
  the UI resting on an endless progress bar.

Changed

• macOS: the menu bar shows the droplet icon — a template image that
  follows light/dark — instead of the "MoveBit" text label the app's own
  copy never mentioned. Tray menu labels now swap in place on pause instead
  of rebuilding the status item.
• The macOS DMG is the branded one. The release leg used to hand-roll
  hdiutil create, leaving the declared dmg-background artwork unused;
  it now runs the same raco rivet release the other legs use, so the DMG
  ships the background artwork and icon layout. The release validator also
  refuses to start without the update signing secret — a missing key stops
  the pipeline with a readable reason, not a garbled DER failure three jobs
  later.

Fixed

• 检查更新 died with updater-config: arity mismatch. Rivet main added a
  trailing component discriminator to the updater structs; dev builds
  linked to rivet main constructed the config with the old field count, so
  every manual update check failed at the RPC. The config is now built for
  whichever struct shape the linked rivet provides, selecting the plain
  component-less artifact — the v0.11.0 release pin and rivet main both
  work, and the updater tests cover both shapes.
• macOS: no more stray empty "MoveBit Settings" window. A SwiftUI scene
  placeholder presented its own empty window at every launch (current macOS
  auto-presents Settings and Window scenes), so finishing the first-run
  wizard still left an untouchable-looking window behind. The host now boots
  as a pure AppKit tray app: first run shows only the wizard, afterwards
  launch shows no window at all — MoveBit lives in the menu bar. The
  standard menu bar (app/edit/window, localized) is rebuilt in AppKit to
  keep Cmd+Q, the selectable update-failure text (Cmd+C), and Cmd+W/M
  working.