turinglambdaai · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
@@ -12,7 +12,7 @@ permissions:
 env:
   # Unified immutable upstream revision containing AppImage handoff,
   # branded-DMG signature preservation, and macOS update rollback safety.
-  RIVET_PIN: a92877c02b6453b1826bfd061d7bbe70647ce5fa
+  RIVET_PIN: e18c28e6b6b18ab0f59559e82e30c51c4229d91f
 
 jobs:
   windows:
@@ -106,7 +106,7 @@ jobs:
       - name: Remember full Racket command path
         run: echo "FULL_RACKET_BIN=$(dirname "$(command -v raco)")" >> "$GITHUB_ENV"
       - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@a92877c02b6453b1826bfd061d7bbe70647ce5fa
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@e18c28e6b6b18ab0f59559e82e30c51c4229d91f
       - name: Run executable product acceptance
         run: PATH="$FULL_RACKET_BIN:$PATH" dbus-run-session -- raco rivet acceptance --json
       - name: Require generated Linux client to be current

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ concurrency:
 env:
   # Unified immutable upstream revision containing AppImage handoff,
   # branded-DMG signature preservation, and macOS update rollback safety.
-  RIVET_PIN: a92877c02b6453b1826bfd061d7bbe70647ce5fa
+  RIVET_PIN: e18c28e6b6b18ab0f59559e82e30c51c4229d91f
 jobs:
   backend:
     name: Backend tests (${{ matrix.os }})
@@ -108,14 +108,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@a92877c02b6453b1826bfd061d7bbe70647ce5fa
-      # Installed after the embeddable runtime so Rivet's catalog closure and
-      # Fulcrum's SQLite dependency (db-lib) resolve against the minimal build.
-      - name: Install Rivet (catalog)
+      # Match packaged Linux acceptance: install dependencies in full Racket,
+      # then configure the embeddable runtime used in staged applications.
+      # Minimal embedded Racket's db-lib catalog fetch has timed out in CI.
+      - name: Install full Racket CS 9.3
+        uses: Bogdanp/setup-racket@v1.15
+        with:
+          version: '9.3'
+          architecture: x64
+          distribution: full
+          variant: CS
+      - name: Install Rivet and SQLite dependencies in full Racket
+        shell: bash
         run: |
           racket -e '(dynamic-require (quote db) #f)' || raco pkg install --auto --no-docs db-lib
           raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#${{ env.RIVET_PIN }}'
+      - name: Remember full Racket command path
+        shell: bash
+        run: echo "FULL_RACKET_BIN=$(dirname "$(command -v raco)")" >> "$GITHUB_ENV"
+      - name: Set up embeddable Racket CS
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@e18c28e6b6b18ab0f59559e82e30c51c4229d91f
       - name: Install Linux toolchain
         run: |
           sudo apt-get update
@@ -126,10 +138,10 @@ jobs:
         run: python3 tests/run-linux-hotkey-tests.py
       - name: raco rivet doctor
         shell: bash
-        run: raco rivet doctor
+        run: PATH="$FULL_RACKET_BIN:$PATH" raco rivet doctor
       - name: raco rivet build
         shell: bash
-        run: raco rivet build
+        run: PATH="$FULL_RACKET_BIN:$PATH" raco rivet build
       - name: Generated Linux client is current
         shell: bash
         run: git diff --exit-code -- linux/GeneratedBackend.hpp

diff --git a/.github/workflows/linux-appimage-upgrade-smoke.yml b/.github/workflows/linux-appimage-upgrade-smoke.yml
@@ -13,7 +13,7 @@ permissions:
   contents: read
 
 env:
-  RIVET_PIN: a92877c02b6453b1826bfd061d7bbe70647ce5fa
+  RIVET_PIN: e18c28e6b6b18ab0f59559e82e30c51c4229d91f
 
 jobs:
   installed-upgrade:
@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@a92877c02b6453b1826bfd061d7bbe70647ce5fa
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@e18c28e6b6b18ab0f59559e82e30c51c4229d91f
       - name: Install Rivet (pinned source)
         run: |
           racket -e '(dynamic-require (quote db) #f)' || raco pkg install --auto --no-docs db-lib

diff --git a/.github/workflows/macos-native-update-e2e.yml b/.github/workflows/macos-native-update-e2e.yml
@@ -15,7 +15,7 @@ permissions:
   contents: read
 
 env:
-  RIVET_PIN: a92877c02b6453b1826bfd061d7bbe70647ce5fa
+  RIVET_PIN: e18c28e6b6b18ab0f59559e82e30c51c4229d91f
   FULCRUM_UPDATE_E2E_TESTING: "1"
 
 jobs:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ env:
   # lockstep by hand.
   # Unified immutable upstream revision containing AppImage handoff,
   # branded-DMG signature preservation, and macOS update rollback safety.
-  RIVET_PIN: a92877c02b6453b1826bfd061d7bbe70647ce5fa
+  RIVET_PIN: e18c28e6b6b18ab0f59559e82e30c51c4229d91f
 permissions:
   contents: write
   actions: read
@@ -148,7 +148,7 @@ jobs:
             rpm desktop-file-utils
       - name: Set up embeddable Racket CS (Linux)
         if: matrix.platform == 'linux'
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@a92877c02b6453b1826bfd061d7bbe70647ce5fa
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@e18c28e6b6b18ab0f59559e82e30c51c4229d91f
       # Installed after the embeddable runtime so Rivet's catalog closure and
       # Fulcrum's SQLite dependency (db-lib) resolve against the minimal build.
       - name: Install Rivet (catalog)

diff --git a/.github/workflows/windows-msi-upgrade-smoke.yml b/.github/workflows/windows-msi-upgrade-smoke.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   installed-upgrade:
-    name: Installed MSI 0.13.1 to 0.13.2
+    name: Installed MSI 0.13.3 to 0.14.0
     runs-on: windows-latest
     timeout-minutes: 30
     steps:
@@ -28,7 +28,7 @@ jobs:
         shell: bash
         run: |
           racket -e '(dynamic-require (quote db) #f)' || raco pkg install --auto --no-docs db-lib
-          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#a92877c02b6453b1826bfd061d7bbe70647ce5fa'
+          raco pkg install --auto --no-docs 'https://github.com/turinglambdaai/rivet.git#e18c28e6b6b18ab0f59559e82e30c51c4229d91f'
       - name: Verify official signed update discovery and MSI payload
         shell: bash
         run: racket scripts/acceptance/windows-signed-feed-smoke.rkt

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,87 @@ independently per platform packaging run.
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-10-27
+
+### Fixed
+
+- **Windows launcher no longer flashes an empty search panel.** It waits for
+  the embedded backend's first search result and builds the native rows before
+  showing the window. Startup failures surface a visible diagnostic instead.
+- **Windows second-launch behavior is recoverable.** Launching Fulcrum again
+  summons the resident panel and exits the secondary process cleanly, rather
+  than accumulating headless copies; activation respects the exact lease ID.
+- **Windows Quit releases the background process.** The tray Quit and verified
+  MSI installation paths unregister native hooks, shut down the embedded
+  Racket/RVT1 backend, and terminate WinUI. Esc and Alt+F4 still hide the
+  launcher without quitting the resident service.
+
+- **Windows Settings now matches the macOS navigation model.** A native WinUI
+  NavigationView exposes General, Features, AI, Commands, and Sync & Updates
+  as individual pages; users can edit command aliases and shortcuts, and
+  record the global summon shortcut without typing the backend key grammar.
+- **Windows updater remains visible from the tray.** Check for Updates now opens
+  the launcher directly in its update workflow, refreshes authenticated
+  download actions after checks, keeps native download progress visible,
+  and presents the verified MSI Install action immediately after download.
+  The existing signed Ed25519 manifest, bounded download/SHA-256 checks, and
+  external MSI quit/install/relaunch handoff remain the trust boundary.
+- **Windows Settings shows Fulcrum's brand icon in the title bar.** The window
+  now installs the embedded resource ID 1 through `SetIcon(IconId)` instead of
+  passing `RivetHost.exe` to the `.ico`-path overload.
+- **Windows explicit `find <filename>` search works even if Windows Search is
+  unavailable.** The PowerShell command now searches the user's actual
+  Documents, Desktop, Downloads and redirected OneDrive locations before
+  trying the Windows Search index or a bounded profile fallback; it handles
+  UTF-8 paths. File results remain behind the explicit `find` command —
+  plain searches and the search placeholder are deliberately unchanged.
+
+- **Linux GTK search icon aligns with the search placeholder.** The themed
+  magnifying-glass glyph and editable query now occupy one vertically centered
+  horizontal row instead of relying on GtkSearchEntry's internally padded icon.
+- **Linux hides the redundant resident-ready banner.** The normal `Ready —
+  hotkey or fulcrum --toggle` status no longer sits permanently above search
+  results when the launcher is visible. Actual startup failures, hotkey
+  conflicts, download errors, and progress notices remain discoverable.
+
+- **Linux no longer flashes an empty startup search window.** Initial
+  launcher presentation waits for native search results from the embedded
+  backend. Failed boot still shows a visible diagnostic instead of hiding it.
+- **Linux Settings uses native five-section navigation.** General, Features,
+  AI, Commands and Sync & Updates now share one GTK sidebar/stack, matching
+  the information architecture of macOS and Windows; Commands uses the same
+  bindings-commands/list/set/clear backend API for aliases; desktop-wide
+  command hotkey execution is explicitly disabled on Linux until a native
+  binding runner is implemented.
+- **Start at login is available as an opt-in per-device control on all hosts.**
+  Linux uses XDG Autostart, Windows uses the current-user Run key, and macOS
+  uses SMAppService's main-app Login Item with system approval. No automatic
+  sync or default enablement; Windows/Linux login launches stay resident
+  without popping open the launcher.
+
+### Regression coverage
+
+- Ubuntu 26.04 GNOME 50 Wayland portal identity: native installs now
+  register their reverse-DNS `site.jrtx.fulcrum.desktop` app id on
+  a retained shared GDBus connection
+  before requesting shortcuts; the fallback remains visible if registration
+  or permission fails. Full stock-desktop verification remains open in #111.
+- Linux widget tests cover the deferred first frame, five Settings sections,
+  and enable/disable round-trip of a temporary XDG login entry. Windows and
+  macOS host checks and packaged acceptance remain release gates.
+- Windows backend tests and packaged WinUI acceptance seed a real user file
+  and require `find <name>` to return its actual path, not simply invoke a
+  search subprocess. This check is a release gate on the final commit.
+- Linux GTK widget regression checks image/input vertical alignment and
+  routine-ready visibility while preserving actionable status messages; its
+  packaged Wayland/AT-SPI acceptance uses backend result readiness rather than
+  depending on a permanent idle status row.
+- Windows packaged native-UI acceptance exercises ready-on-first-frame,
+  duplicate-launch handoff, normal process exit, and clean restart. Stable
+  release remains subject to the exact-commit CI, installer, signing, and
+  publishing gates documented in the release runbook.
+
+
 ## [0.14.0] - 2026-10-27
 
 ### Added

diff --git a/README.md b/README.md
@@ -2,7 +2,7 @@
 
 One keystroke. Everything within reach. A keyboard-first launcher for macOS, Windows, and Linux — one Racket brain, three first-party native UIs, no WebView anywhere.
 
-[![CI](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml/badge.svg)](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml) ![Windows](https://img.shields.io/badge/Windows-WinUI_3-0078D4?logo=windows11&logoColor=white) ![macOS](https://img.shields.io/badge/macOS-SwiftUI-000000?logo=apple&logoColor=white) ![Linux](https://img.shields.io/badge/Linux-GTK4-F9A03C?logo=linux&logoColor=white) [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE) ![Version](https://img.shields.io/badge/version-0.14.0-C15F3C)
+[![CI](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml/badge.svg)](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml) ![Windows](https://img.shields.io/badge/Windows-WinUI_3-0078D4?logo=windows11&logoColor=white) ![macOS](https://img.shields.io/badge/macOS-SwiftUI-000000?logo=apple&logoColor=white) ![Linux](https://img.shields.io/badge/Linux-GTK4-F9A03C?logo=linux&logoColor=white) [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE) ![Version](https://img.shields.io/badge/version-0.14.1-C15F3C)
 
 **English** · [中文](README.zh-CN.md)
 

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -2,7 +2,7 @@
 
 一次按键，直达一切。macOS、Windows、Linux 三平台的键盘优先启动器——一个 Racket 大脑，三套第一方原生 UI，全程无 WebView。
 
-[![CI](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml/badge.svg)](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml) ![Windows](https://img.shields.io/badge/Windows-WinUI_3-0078D4?logo=windows11&logoColor=white) ![macOS](https://img.shields.io/badge/macOS-SwiftUI-000000?logo=apple&logoColor=white) ![Linux](https://img.shields.io/badge/Linux-GTK4-F9A03C?logo=linux&logoColor=white) [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE) ![Version](https://img.shields.io/badge/version-0.14.0-C15F3C)
+[![CI](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml/badge.svg)](https://github.com/turinglambdaai/fulcrum/actions/workflows/ci.yml) ![Windows](https://img.shields.io/badge/Windows-WinUI_3-0078D4?logo=windows11&logoColor=white) ![macOS](https://img.shields.io/badge/macOS-SwiftUI-000000?logo=apple&logoColor=white) ![Linux](https://img.shields.io/badge/Linux-GTK4-F9A03C?logo=linux&logoColor=white) [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE) ![Version](https://img.shields.io/badge/version-0.14.1-C15F3C)
 
 [English](README.md) · **中文**
 

diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-0.14.0
+0.14.1
diff --git a/app/backend.rkt b/app/backend.rkt
@@ -72,7 +72,7 @@
 ;; update check: drift here means every install believes it is outdated
 ;; (0.2.0 shipped believing it was 0.1.0).
 (define app-version
-  (with-handlers ([exn:fail? (lambda (_) "0.14.0")])
+  (with-handlers ([exn:fail? (lambda (_) "0.14.1")])
     (string-append (rivet-info:app-version))))
 
 ;; The updater learns the running version from here (the packaged app reads

diff --git a/app/core/files.rkt b/app/core/files.rkt
@@ -3,9 +3,9 @@
 ;; File search — per-platform, always available on desktop:
 ;;   macOS: Spotlight (`mdfind -name`) — millisecond responses, deep index
 ;;   Linux: `locate -i` (the mlocate/plocate index) or `find` as fallback
-;;   Windows: the Windows Search index (SYSTEMINDEX) when the service is
-;;     up, falling back in-process to a bounded `Get-ChildItem -Recurse`
-;;     scan when it is not
+;;   Windows: scan the user's actual known folders first (including redirected
+;;     OneDrive locations), then query Windows Search (SYSTEMINDEX) for broader
+;;     indexed results; a bounded profile walk is the last resort.
 ;; Claims `find <query>` queries so it never clutters unrelated searches.
 ;; Opening a result uses the platform opener, the same side-effect path
 ;; application launches use.
@@ -232,7 +232,7 @@
             void
             (lambda ()
               (runner program args
-                      #:timeout-ms 3000
+                      #:timeout-ms (if (eq? os 'windows) 9000 3000)
                       #:cancel-evt (semaphore-peek-evt cancel)))
             (lambda () (release-file-search! cancel))))
         (cond
@@ -268,12 +268,16 @@
 
 ;; ---- windows: index-first search script -----------------------------------
 
-;; One PowerShell invocation, two tiers inside the same 3-second budget:
-;;   1. the Windows Search index (SYSTEMINDEX) — filename prefix match,
-;;      then FREETEXT for the mid-word case; millisecond-fast when the
-;;      service is healthy
-;;   2. a bounded Get-ChildItem scan of the user profile — the honest
-;;      fallback when the index is off, empty or errors
+;; One PowerShell invocation, three tiers inside a bounded explicit-find
+;; request (9 seconds on Windows, not on ordinary launcher typing):
+;;   1. Windows known folders — Desktop, Documents and Downloads (including
+;;      shell-redirected and OneDrive directories), before probing OLE DB.
+;;      A broken Windows Search service must not prevent common-file results.
+;;   2. Windows Search (SYSTEMINDEX) for other indexed scopes.
+;;   3. A bounded user-profile walk only if the first two tiers found nothing.
+;; The former index-first chain frequently spent its entire three-second
+;; deadline in OLE DB or an enormous USERPROFILE recursion, yielding zero
+;; results for files that were plainly present under Documents.
 ;; The script is defensive on purpose: any index failure lands in the
 ;; catch and the scan still answers. Two query spellings travel in the
 ;; script: $q is the raw text (the scan's -Filter wants it literal) and
@@ -287,10 +291,23 @@
   (define sql-q (string-replace raw-q "'" "''"))
   (string-append
    "$ErrorActionPreference='SilentlyContinue';"
+   "[Console]::OutputEncoding=[System.Text.UTF8Encoding]::new($false);"
    "$out=@();"
    "$q='" (ps-literal raw-q) "';"
    "$qs='" (ps-literal sql-q) "';"
-   "try{"
+   "$roots=@([Environment]::GetFolderPath('DesktopDirectory'),"
+   "[Environment]::GetFolderPath('MyDocuments'),"
+   "(Join-Path $env:USERPROFILE 'Downloads'));"
+   "foreach($cloud in @($env:OneDriveConsumer,$env:OneDrive)){"
+   "if($cloud){$roots+=@((Join-Path $cloud 'Desktop'),"
+   "(Join-Path $cloud 'Documents'))}};"
+   "foreach($root in ($roots|Where-Object{$_ -and (Test-Path -LiteralPath $_ -PathType Container)}|Select-Object -Unique)){"
+   "try{$out+=@(Get-ChildItem -LiteralPath $root -Recurse -Depth 4 -File "
+   "-Filter ('*'+$q+'*') -ErrorAction SilentlyContinue|"
+   "Select-Object -First 128 -ExpandProperty FullName)}catch{};"
+   "if($out.Count -ge 128){break}"
+   "};"
+   "if($out.Count -eq 0){try{"
    "$c=New-Object System.Data.OleDb.OleDbConnection(\"Provider=Search.CollatorDSO;Extended Properties='Application=Windows'\");"
    "$c.Open();$cmd=$c.CreateCommand();"
    "$cmd.CommandText=\"SELECT TOP 128 System.ItemUrl FROM SYSTEMINDEX WHERE CONTAINS(System.FileName,'`\"$qs*`\"') AND SCOPE='file:'\";"
@@ -300,9 +317,11 @@
    "$r=$cmd.ExecuteReader();while($r.Read()){$out+=$r.GetString(0)};$r.Close()"
    "}"
    "$c.Close()"
-   "}catch{};"
+   "}catch{}};"
    "if($out.Count -gt 0){"
-   "$out|Select-Object -First 128|ForEach-Object{[System.Uri]::UnescapeDataString($_ -replace '^file:/+','')}"
+   "$out|Select-Object -Unique -First 128|ForEach-Object{"
+   "if($_ -like 'file:*'){[System.Uri]::UnescapeDataString($_ -replace '^file:/+','')}"
+   "else{$_}}"
    "}else{"
    "Get-ChildItem -Path $env:USERPROFILE -Recurse -Depth 3 -Filter ('*'+$q+'*') -File -ErrorAction SilentlyContinue|Select-Object -First 128 -ExpandProperty FullName"
    "}"))