[turinglambdaai]

Ubuntu startup, Linux Settings parity, and opt-in startup on all 3 platforms

User-reported bugs addressed as narrowly as possible, preserving the explicit find <query> file-search product contract:

• Linux startup first frame: avoid mapping the empty GTK search shell before the embedded Racket backend returns its first native result rows. Preserve visible boot error diagnostics. Unit UI test asserts the pending-summon gate and first-result reveal.
• Linux Settings: replace the former 760px-tall all-in-one scroll form with 5 native GTK StackSidebar sections matching macOS/Windows: General, Features, AI, Commands, Sync & Updates. The Commands page saves aliases through the shared bindings RPC and has functional Save/Clear controls. General's global summon hotkey supports direct GTK keyboard capture. Linux per-command global hotkeys are not registered/executed yet: that specific Commands control is deliberately disabled instead of accepting an ineffective binding. This remains an explicit native X11/Wayland capability gap, not a claim of total platform parity.
• Start at login on all three hosts (OFF by default, per-device only; do not sync): Ubuntu/Linux writes/removes its own $XDG_CONFIG_HOME/autostart/site.jrtx.fulcrum.desktop with escaped, actual executable path and --background; Windows toggles HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Fulcrum to the current EXE with --background; macOS toggles system SMAppService.mainApp with failure and system-approval feedback. All expose a native setting in General. Windows/Linux silent login launches stay resident and do not summon or toggle an already running foreground launcher; macOS production already starts with no panel.
• Tests: Linux native UI fixture asserts no blank first frame, all 5 Settings pages and real temporary XDG autostart enable/disable; Windows packaged WinUI acceptance exercises Start at login and checks/reverts HKCU Run; macOS packaged Accessibility checks the Login Items control exists. Source-level fixes and docs are submitted, but final-head builds/package acceptance have NOT yet been confirmed green. Keep all exact-head gates + signing/release approval.

Windows explicit find <query> repair (product UX unchanged)

• User clarification honored: File search is and remains an explicit find <filename> command. Plain launcher input still searches applications, clipboard, snippets, commands etc., without automatically mixing in files. The earlier unauthorized unified filename results, startup indexing, placeholder edits and tests have been fully reverted to the Linux-fix commit f31bc7c state.
• Actual Windows defect under repair: The existing find PowerShell fallback could spend its entire 3-second budget in Windows Search OLE DB or broad USERPROFILE recursion, yielding no file results on otherwise normal machines. Explicit Windows find now checks shell-known Desktop and Documents, Downloads, and OneDrive directories first, before querying SYSTEMINDEX and finally the bounded full-profile fallback; its timeout is now 9 seconds only for the user-invoked file command. PowerShell outputs UTF-8, including Chinese filenames.
• Regression requirements: tests/files-test.rkt checks the generated script, Windows timeout and runs an actual Windows fixture via the production PowerShell runner; scripts/e2e/e2e-windows.ps1 creates a real file under Windows Documents before boot and explicitly types find fulcrum-find-acceptance-... into packaged WinUI. Confirm actual result row and complete latest-head CI/packaged acceptance before release.
• No premature success claim: The change is submitted but live Windows E2E checks have not yet passed for this latest SHA. Preserve the existing release approval and signing requirements.

Linux GTK4 launcher polish (Ubuntu / X11 / Wayland)

• Search magnifier alignment: replace GtkSearchEntry's internally padded icon with a native centered GtkImage and normal GtkEntry in one horizontal row, keeping the existing editable query, IME, focus, search debounce and FulcrumQuery accessibility identity.
• Remove permanent ready banner: the normal resident Ready — hotkey or fulcrum --toggle status hides completely while the launcher is visible. Actionable status/errors (startup, hotkey conflict, update check/download) remain selectable and visible.
• Regression coverage: tests/linux-ui-test.cpp measures real icon/input bounds and tests status visibility, while packaged Wayland/AT-SPI acceptance now waits for backend-owned Settings… search results and rejects the redundant ready banner instead of depending on it. Update the release notes, cross-platform UI contract and English/Chinese user guides.
• This is a native GTK host correction, not a backend/business-rule change. Exact-final-SHA Linux native build + GTK4 packaged acceptance must pass along with the other OS gates before v0.14.1 release.

Windows update regression scope (October 27)

Windows can discover and verify an update, yet the installed experience was misleading: the tray's Check for Updates wrote to a hidden launcher footer, update results were not refreshed when the backend candidate changed, download hid the only progress surface, and the verified MSI Install row did not automatically appear on completion. Portable ZIP builds could additionally install a separate MSI and then relaunch the old ZIP binary. These are now fixed product-side:

• Tray update check opens the visible native update search flow and refreshes actions after the signed-feed RPC finishes; errors remain visible and copyable.
• Download stays visible with live progress; completion/error refreshes the available native rows. The installer still uses Rivet's signed Ed25519 manifest, verified size+SHA-256, and external MsiHandoff quit/install/relaunch, never an unchecked installer.
• MSI handoff only auto-relaunches from the official Program Files installed executable. Portable ZIP copies get a clear manual-install error rather than a fake successful upgrade of a different copy.
• Packaged Windows UI acceptance invokes the actual hidden tray CheckForUpdates handler, asserts that the launcher opens on update with an actionable check row, and preserves the clean lifecycle tests.
• The independent Windows signed-feed + MSI upgrade workflow now exercises the published v0.13.3 → v0.14.0 path (manifest verification, verified MSI download, installed upgrade, failure preservation and downgrade refusal) instead of stale v0.13.1 → v0.13.2 fixtures. This is not a claim of an in-app handoff E2E; a successful MSI install test and a successful packaged UI test are distinct evidence.

All checks must pass on the latest PR head SHA, not an earlier green version-only commit. No release until the signed/explicitly approved unsigned channel and main branch release gates pass.

Scope update — Windows settings parity and window icon

• fix(windows): prevent blank startup frame and lingering Fulcrum processes #103 has now passed full CI + Product Acceptance and merged into main (merge commit cb9f23cb8b586bd142df3a8a201185906c3b8ff6).
• Replace the Windows single-scroll Settings surface with a native WinUI 3 five-section NavigationView matching macOS (General, Features, AI, Commands, Sync & Updates). Commands is backed by bindings-commands, bindings-list, binding-set, and binding-clear RVT1, not a decorative tab.
• Windows hotkeys can be recorded by focusing the shortcut field and pressing a key combination; Esc cancels and backend validity/collision rejection remains authoritative.
• Fix secondary Settings window's missing titlebar icon by loading Rivet's compiled numeric resource ID 1 and calling AppWindow.SetIcon(IconId); sending the EXE path to SetIcon(String) was incorrect. Framework-wide regression prevention is tracked in Rivet #333.
• Extend Windows packaged-native acceptance to open the actual Settings window, navigate all five sections, expose the editable Commands pane and global hotkey field, and check a native window icon. Keep existing first-frame/single-instance/tray-Quit/relaunch checks.
• Update release notes, product cross-platform contract (with explicit existing GTK settings-page limitation) and both user guides.

Goal

Publish v0.14.1 with the Windows lifecycle regression fixes in #103. This is a stacked release prep branch based on #103; merge #103 first, then recheck this PR against updated main.

Versioned changes

• Bump VERSION + rivet.rktd to 0.14.1, monotonic package build 21.
• Align Racket backend headless fallback and the three Rivet-generated native clients with the version/build metadata (no wire shape change).
• Update English and Chinese README badges and add the Windows fixes to CHANGELOG.

Must complete before merging this release PR

• fix(windows): prevent blank startup frame and lingering Fulcrum processes #103 Windows packaged acceptance, all three platform CI, and packaged Product Acceptance green on its exact final SHA.
• Recheck version PR diff and pass full exact-commit CI and Product Acceptance on the latest v0.14.1 commit including Windows settings and icons.
• Confirm the repository's FULCRUM_STABLE_RELEASE_APPROVED=true and current production-signed or explicitly authorized unsigned distribution posture. Signing/verification secrets, Ed25519 update and Linux artifact keys, and Windows timestamp config must pass the fail-closed release preflight.
• Authorize installed artifact and updater acceptance per the release runbook; do not equate a native build with installation/relaunch verification.
• Only then merge the version PR to main: .github/workflows/version-release.yml waits for main CI/acceptance for the version commit before creating immutable v0.14.1 and starting release.yml.
• Confirm the actual GitHub Release was published with verified SHA256SUMS and signed update manifest. Do not claim completion on workflow dispatch alone.

No tag or published release is created by this PR. v0.14.0 used an explicitly approved unsigned desktop channel; do not automatically assume that approval persists for this patch.

[turinglambdaai]

Release gate checkpoint (2026-10-27 UTC): inspected the actual failed Windows packaged WinUI job log on Product Acceptance run 40461782619. The failure was scripts/e2e/e2e-windows.ps1:231: Commands tab selected but the editor is not visible: UI Automation found the Commands title immediately after SelectionItemPattern.Select(), before WinUI's asynchronous NavigationView layout made it visible. The test now waits for visible Commands content and a visible functional Save button, and uploads a Settings accessibility snapshot on timeout; it does not bypass the product assertion.

Merged the newer main tip 08e597375cf8fb2632325078433dceb3d6f15d22 into this PR with a two-parent merge, preserving byte-for-byte the app/core/bindings.rkt atomic-persistence fix, tests/bindings-test.rkt regression tests, and site/index.html updates. PR is now 0 commits behind main.

Current exact PR HEAD: 6ed2d0dd546023d11c868205b42c6c66d601f351. New exact-head runs triggered: CI, Product Acceptance, Windows MSI Upgrade Lifecycle, and macOS Native Signed Update E2E. Pending: not release-ready. No merge, tag, or release until all four complete green for this exact SHA, production signing prerequisites are verified, and FULCRUM_STABLE_RELEASE_APPROVED=true is explicitly authorized. Linux per-command global hotkey execution remains unsupported/disabled (issue #110).