Replace session-long account failure pauses with classified 15, 30, 60, and 120 minute cooldowns for temporary account problems. Keep credential, OTP, banned, and disabled states manual while ignoring unknown, file, network, hoster, and bare WAF errors. Reset escalation after confirmed uploads, deduplicate parallel failures, publish revisioned pause snapshots, and show a stable localized countdown with automatic reactivation.
Bump the desktop package and lockfile to v2.1.32 after the encrypted online backup key management, recovery hardening, and upload-speed graph fixes passed the complete release verification. Update the public README download version to match the new release.
Require both the current record ID and decrypted full key to match a prepared removal plan before deleting local state.
Invalidate mismatched plans before returning KEYRING_REMOVE_PLAN_INVALID so a replacement with the same canonical ID cannot be deleted and the stale plan cannot be reused.
Cover normal, idempotent, rebased, duplicate-ID, and same-ID replacement removal behavior while preserving the replacement generation.
Keep a fully validated v1 primary authoritative over differing legacy recovery snapshots, recover missing or unusable v1 primaries from the best valid legacy candidate, and migrate the next mutation to v2 generation one.
Rebase prepared removals onto the current serialized keyring state so intervening creates survive, generations remain monotonic, and already absent targets complete idempotently.
Restrict canonical same-generation conflict blocking to true v2 documents and add separate legacy and v2 regression coverage without exposing key material.
Read strict v1 keyrings as generation zero and write strict v2 documents with monotonically increasing safe integer generations. Select the highest fully validated generation and reject conflicting canonical payloads at the same generation.
Make a hidden, file-synced, disk-revalidated recovery staging file the rollback boundary. Publish it as a visible recovery candidate before treating the local transaction as committed, then keep primary, backup, and cleanup work best-effort.
Remove mtime and directory-fsync truth from recovery decisions and cover rollback-safe staging failures, post-commit publication failures, stale candidates, v1 migration, and generation conflicts.
Fsync the keyring directory after both complete temporary files are written and synced, before replacing the primary document. Pre-publication directory failures now preserve the prior primary state and remain rollback-safe.
Keep the durable recovery temporary file available when later directory or backup publication work fails, and verify that it restores the committed keyring.
Rank equal-time recovery candidates deterministically with recovery temps before primary temps and backups, and consider equal-time commit temps alongside a valid primary.
Recover from structurally valid but undecryptable primary keyrings by selecting a fully cryptographically validated backup or recovery temp and reporting KEYRING_RECOVERED.
Keep committed primary writes successful when best-effort post-publication cleanup fails, preventing ambiguous retries after durable local publication.
Intercept clipboard writes inside the hidden Electron Main-process integration probe, remove the duplicate key-created toast, and make authoritative refresh coverage differ from optimistic state.
Require canonical encrypted envelopes and surface typed sanitized keyring corruption states.
Persist crash-durable primary and recovery files, prevalidate removal plans, isolate renderer refresh authority, and cover the real hidden Windows DPAPI and IPC composition.
Separate navigation and authoritative load generations so view refreshes cannot invalidate in-flight create or delete refreshes. Ignore navigation responses started during active operations, while allowing a later successful view load to replace old error state after the operation ends.
Bind list state and status updates to matching load generations and operation contexts so delayed settings-navigation responses cannot clear newer busy or error states or replace newer managed-key data. Keep create and delete post-success refreshes authoritative and single-shot.
Queue copy and delete operations by sanitized backup ID so confirmations survive renderer refreshes and deletes follow in-flight copies without silent cancellation. Reload the managed list exactly once after successful create and delete mutations, and invalidate stale UI state when the authoritative refresh fails.
Use compact German key labels and a shared fixed label column so both online-backup inputs and actions align consistently across languages. Restore the narrow one-column breakpoint after later settings overrides and cover translations plus real hidden CSS geometry.
Keep the static first-paint speed line only until the canvas renders its first frame, then remove the placeholder so active upload telemetry shows one curve. Extend the hidden real-renderer regression to verify the transition without opening a visible window.
Carry the validated Windows Server and Remote Desktop compositor correction into the publishable release while calibrating the hidden regression to the actual CI display work area. Preserve the strict greater-than-2048 assertion on capable displays and update public version metadata.
Keep the hard greater-than-2048 surface assertion on displays that can provide it while allowing smaller hosted CI desktops to verify renderer command-line safety, exact viewport geometry, and both painted edges at their available resolution.
Publish the Windows Server and Remote Desktop compositor correction after 20 successful launches on the affected Windows Server 2022 host. Update package metadata and the public README release pointer while keeping the verified startup regression gates in place.
Remove the RDP-specific hardware acceleration shutdown that forced Chromium renderers into software compositing on Windows Server sessions. Add a production-wide startup invariant and a hidden full-width Electron compositor regression covering renderer switches, viewport geometry, and both painted edges.
Set the application, lockfile, and public README version to 2.1.29 for the update experience, queue filtering, account status, and diagnostics release.
Expose a contextual copy action only for failed uploads, target the exact right-clicked job during multi-selection, and defensively redact URLs and credential-shaped values from clipboard diagnostics.
Carry session-local check timestamps through bulk, single, OTP, and save validation paths, terminate missing responses cleanly, and render localized checked times on account cards.
Capture real batch duration and show a dedicated localized completion summary with success, failure, and skipped counts plus a direct action to open failed uploads.
Add a fixed filter summary that counts sidebar, filename, host, and status constraints, highlighting nonzero counts without changing the toolbar geometry.
Reserve the reset action permanently inside the filter group, disabling and dimming it when no filter is active so typing never changes the toolbar width.
Move search, host, status, and reset controls into one framed filter group beside the upload actions, preserving responsive wrapping within the same toolbar.
Add one contextual reset action that clears the upload sidebar, filename search, host filter, and status filter in a single render while restoring selection and scroll state consistently.
Display the primary release heading as What's new?, render the install and active download states in the success palette, and reserve red exclusively for cancellation and failure.
Render release-note headings, categories, items, and body lines as safe structured text with larger typography for section labels and compact spacing for details.
Increase the release-notes area by another twenty percent while constraining it to the viewport so more changelog content remains visible without hiding update controls.
Render size, speed, and ETA in dedicated fixed-width columns with tabular numerals so rapidly changing values no longer shift neighboring metrics horizontally.
Calculate download throughput and remaining time from verified installer bytes and display downloaded size, total size, speed, and ETA beneath the progress track while retaining the last values after cancellation.
Give the release-notes viewport a responsive 220-pixel target height so the update dialog gains visible vertical room while remaining bounded on smaller windows.
Open known updates directly without redundant searching or found toasts, retain failure and no-update feedback, and render the update dialog close action in red with a destructive hover state.
Collapse the header update action completely when no update exists and animate the green action outward to the left of the fixed bandwidth widget only after a real update is detected.
Keep the available target version visible throughout download, verification, cancellation, and failure states while reserving the progress footer for runtime status. Add the requested emphasis to the update dialog heading.
Keep the availability subtitle exclusive to the pre-download state and show download, cancellation, and detailed failure status only below the progress track.
Use a full-width green download track, preserve completed progress in red when cancellation or failure occurs, move status copy below the track, and smooth percentage transitions.
Keep the dialog cancel action available during update downloads, abort the active network stream, and surface a clean canceled state with retry support. Normalize cancellation across updater, main process, renderer, and translations with regression coverage.
Use the verified manifest size for percentage calculations, suppress duplicate percentage events, and yield between buffered download updates so Electron can paint intermediate progress before completion. Add a regression test that proves renderer-observable progress during an immediately buffered download.
Use the success palette and black text for the available-update header action, including its hover state. Add regression coverage for the visual state.
Keep BrowserWindow hidden until both ready-to-show and did-finish-load are complete, preventing the incomplete header from reaching the screen.
Render a static upload-speed baseline beneath the transparent canvas so the zero line exists independently of renderer timers.
Add regression coverage for both reveal event orders, load failures, and the script-independent header baseline.
Pass the installed version with the startup language so the renderer can display it before asynchronous initialization.
Seed and start the upload sparkline immediately, keep a fixed update-action slot across all update states, and remove the delayed automatic update check.
Add first-frame regression coverage for version, speed baseline, update geometry, and startup query behavior.
Refresh release metadata immediately before downloading an update and keep automatic checks current while the app remains open.
Accept desktop file drops from the first renderer frame, preserve early and rapid drops until initialization completes, and show the live remaining upload size in the sidebar.
Add regression coverage for update freshness, startup drag-and-drop ordering, localization, and remaining-byte retry behavior. Bump the application to v2.1.25.
Restore the v2.1.19 application baseline and retain only the focused import preflight summary with duplicate, unavailable, destination, job, and size-limit visibility.
Allow updater manifests from the Gitea and GitHub release pipelines to use different separator characters in the same installer filename while preserving exact version, size, checksum, and executable validation.
Add local weekly upload windows with overnight support, live settings updates, and a shared abortable upload gate.
Keep active transfers running while queued jobs wait outside the window without consuming attempts or parallel slots. Validate and localize the automation settings in German and English, including next-start status and hidden Electron coverage.
Refresh host health from the persisted retention-filtered history after batch completion, allowing the existing generation guard to reject stale responses and removing the competing local merge path.
Keep the complete loaded history snapshot, sample only valid non-future recent batches, count seven-day failures independently, ignore disabled accounts in issue counters, and preserve loading and error states across batch completion.
Summarize up to fifty recent batches and current account state into a local host health table with success rates, effective historical throughput, recent failures, last success, and bilingual accessible empty states.
Disable and guard host selection confirmation whenever the current preflight produces zero jobs, preserving pending files and plan state for empty destination and fully size-limited selections.
Inspect every manual file, folder, and drag-and-drop import before queue admission. Report exact duplicate, filename-filter, filesystem, destination, configured size-limit, and resulting job counts in the host selection dialog with live bilingual updates.
Add smooth account editor transitions with immediate input release, keep the cursor visible in development and production windows, align host option descriptions, and ensure localized settings search placeholders fit at narrow widths. Bump the application to v2.1.22 and extend hidden Electron regression coverage.
Add include and exclude filename conditions across every new import path, show accepted and excluded counts before destination selection, and keep restored queues unchanged.
Refine the settings layout and reorder upload telemetry for faster status reading.
Preserve uncertain remote commits and destructive source-cleanup requirements across cancellation, persistence failures, retries, and restart recovery. Revalidate account availability after admission waits and prevent late upload results from bypassing cancellation state. Strengthen release argument, CI tag, source allowlist, and secret scanning gates. Run the Electron smoke suite in a fully hidden offscreen harness that cannot reveal, focus, or elevate native windows.
Treat fallback result fetch and body failures as uncertain Doodstream commits, and coordinate interval timing with slot acquisition so upload starts remain spaced without occupying another host's global slot during the wait.
Use stable Doodstream API identities across separate Web and API profiles, serialize ambiguous VOE and Doodstream mixed-auth recovery paths, and fail closed after uncertain post-upload response failures. Enforce host upload intervals only after recovery and concurrency admission, and clear batch-scoped recovery caches when the batch settles.
Keep a bounded FIFO of drop payloads while the startup or recovery document is not validated. Flush each payload exactly once only after the generation-checked renderer Ready signal, retain immediate delivery for a ready renderer, and discard stale payloads when the main window is destroyed or replaced.
Wire renderer block, Ready, and window-close transitions through main and cover recovery, safe failure visibility, stale Ready signals, ordered multi-drop delivery, queue bounds, lifecycle cleanup, and duplicate prevention.
Route VOE API and login uploads through one batch-scoped account claim registry so direct identities and uncertain outcomes are shared across authentication paths.
Fail closed for ambiguous Doodstream web uploads after POST, use canonical account identities across web and API paths, and singleflight derived API-key resolution outside upload semaphore admission.
Preserve distinct symbol-only recovery titles with a stable code-point fallback while matching Unicode-equivalent presentation forms. Add deterministic regression coverage for duplicate identities, uncertain successors, concurrent key resolution, and mixed auth paths.
Route second-instance activation, tray clicks, tray menu activation, and drop-target restores through one startup reveal gate. External focus and restore requests now remain queued until the active renderer generation reports Ready or the coordinator exposes the branded failure surface.
Block the gate and reset close-handshake readiness synchronously before every renderer recovery navigation and failure-document load. This keeps early loadFile rejection from leaving the terminal failure surface subject to the normal renderer close-preparation handshake.
Add production-like event binding regressions for all four external reveal paths, authorized Ready and failsafe reveals, and direct closing of the safe failure surface after an early recovery rejection.
The strict ConfigStore readers previously propagated native filesystem and JSON parser errors. On Node 24, malformed JSON can be quoted in the parser message, so an opaque value from a corrupt history file could cross the collector and diagnostics-agent boundary unchanged when it was not one of the configured secrets.
Map strict config and history read, parse, and shape failures to a closed set of constant content-free errors. Keep separate invalid, read-failed, and history-not-found codes so the pre-migration history fallback remains limited to a genuinely absent dedicated file. Do not retain native errors or raw input as causes, while leaving credential decryption failures and the recovery-oriented UI readers unchanged.
Add boundary coverage for corrupt config JSON, invalid shapes, and read failures, plus an end-to-end ConfigStore-to-collectors-to-agent regression proving get_history, list_errors, and server_health never return a planted opaque history value.
Diagnostics previously reused the recovery-oriented ConfigStore readers. A missing, unreadable, or corrupt primary config could therefore be replaced by cached, backup, or default data, leaving diagnostics without a trustworthy decrypted secret set. Dedicated history failures and invalid payloads could likewise become a healthy empty result or stale config history.
Add explicit diagnostic config and history reader contracts. The config path bypasses caches and recovery fallbacks, validates the primary document, decrypts its current credentials, and propagates read, parse, validation, and decryption failures. The history path accepts a valid empty array, rejects unreadable or malformed dedicated data, and uses strict legacy config history only when no dedicated file exists. Keep the normal UI recovery readers unchanged and wire diagnostics to the strict contracts.
Cover primary recovery isolation, decryption failure propagation, valid empty history, corrupt and unreadable history, stale-history fallback prevention, pre-migration compatibility, and main-process wiring. Existing collector tests continue to prove successful responses, response-boundary redaction, shared history semantics, and snapshot non-mutation.
Scope remote code ownership to normalized hoster and account identities while retaining title-only recovery serialization and canonical Unicode title matching.
Mark post-upload ambiguity and duplicate identities as uncertain so retries, account fallback, and later same-title jobs fail closed instead of reporting unsafe success.
Acquire recovery title leases before hoster and global semaphores, revalidate failed-account overrides before upload, and clear claim state at batch boundaries.
Add deterministic concurrent coverage for same-code rejection, distinct-code parallel success, uncertainty propagation, semaphore fairness, account isolation, Unicode equivalence, and registry lifetime.
Bind renderer Ready and initialization-failure IPC to per-navigation document URLs and main-frame identity so stale documents cannot cancel the active deadline or reset the recovery budget.
Serialize initial-load retries with crash, initialization, and timeout recovery behind one bounded navigation budget. Keep the main window hidden until a validated Ready signal while allowing the branded failsafe to become visible.
Move production lifecycle wiring into the startup handlers and add event-driven regressions for stale Ready signals, pre-finish initialization failures, timeout recovery, visibility, and crashes during the initial navigation.
Require the decrypted configuration and its complete secret set before loading or returning any diagnostic history data. Propagate configuration failures so the agent response boundary falls back to its generic safe error instead of emitting unredacted history content.
Reject thrown and non-array dedicated history reader failures as unhealthy operations without consulting stale config history. Preserve redaction of reader errors at the agent boundary.
Keep caller-owned history snapshots unchanged by isolating the per-hoster summarizer from the reader array, and cover get_history, list_errors, and server_health with focused red-green regressions.
Allow the committed remote input regression test in the positive-list source verifier. The verifier still rejects every unlisted path and now accepts the complete v2.1.20 source snapshot without broadening any directory or extension rules.
Share account-scoped recovery claims with login uploader instances and serialize same-title recovery windows. Reserve direct and recovered file codes consistently, reject reused identities, and cover concurrent singleton recovery plus distinct-code and parallel-success cases.
Resolve diagnostic history through the injected loadHistory dependency whenever it is available, retaining config history only for legacy collectors without a dedicated reader.
Build server_health error and batch summaries from one validated snapshot so migrated installations cannot combine current batches with stale errors or parse the external history twice.
Add focused regressions for migrated history consistency and fail-closed handling of invalid dedicated history results.
Require a bounded Ready signal after each main-document load, cancel the deadline on successful readiness or window disposal, and keep recovery limited to one reload before the branded failure surface.
Route renderer initialization failures through production startup handlers and reject malformed authenticated remote keyboard payloads without throwing or logging.
Sucukdeluxe