feat: self-update, and the release-readiness QoL batch

[evangress]

Movement I branch 5 (feat/release-readiness). Two commits: the update path, then the QoL batch.

Why this before vault search

The roadmap's printed pointer said branch 6, with branch 5 unstarted. That was overtaken by v1.0.0 shipping: the version ladder ties release-readiness to v0.2.0-alpha, and the tag ran past it. The consequence is concrete — every 1.0.0 install has no way to receive anything built after it, so the next feature could not have reached anyone who already has Toril. §7's trust before reach settles the order. ROADMAP.md now records this rather than leaving the stale pointer.

Self-update

Three official Tauri plugins, pinned (updater 2.10.1, process 2.3.1, window-state 2.4.1). No new invoke commands — they ship their own JS API, wrapped in ipc.ts so nothing else reaches past that seam.

Toril notifies; it never installs on its own. The plugin can download-and-replace silently and we deliberately never call it that way — this is an editor holding unsaved buffers, and §3 outranks saving someone two clicks. The restart is the one path in the feature that could destroy a buffer, so it is the one path that refuses: it will not relaunch over a dirty tab, and says the update applies next launch instead. The install is already on disk by then, so waiting is free.

No telemetry — the check is a plain GET for a static manifest.

The policy is split from the network call and the toast so it is gated without a release server. tests/update.test.ts pins the asymmetry that makes an updater tolerable: a startup check is rate-limited, skippable and silent; a direct question via Help → Check for Updates always gets an answer. Two rules there are not obvious:

• A lastCheckedAt in the future fails open. A corrected clock or timezone jump would otherwise park the timestamp years ahead and disable update checks permanently, with no symptom anyone could notice.
• Skipping a version means "stop telling me", not "never let me have it" — a later version still surfaces, and a manual check still shows the skipped one.

The notice is a fixed-position toast rather than another row in the layout, which is the opposite of conflictbar.ts on purpose: a conflict is about the document in front of you and must be impossible to miss; an update is ambient news and is never worth reflowing a sentence for.

QoL batch

Editor zoom, Ctrl-click to open links, drag-and-drop open, recent files, and a real first-run note. Three of these are decisions about untrusted input rather than conveniences, so each has a gate.

• Zoom scales the writing surface and deliberately not the chrome — the OS already scales the whole UI. That moves editor.css heading sizes and the measure from rem to em. The ladder is fixed rather than "multiply by 1.1": free scaling drifts, so five steps in and five out would not land back on 100% and "reset" would quietly stop meaning "the size I had". A persisted 0 snaps to the default rather than clamping, because it would otherwise render the editor unreadable and unfixable — every step from zero is still zero.
• Link opening (src/links.ts) is a §3.3 boundary. sanitize.ts already stops a hostile href executing in the webview; this stops it executing outside, which is strictly worse because the shell is not sandboxed. So it is an allowlist of three schemes parsed through URL, not a blocklist matched against raw text — the OS folds case and strips control characters before it acts, so jAvAsCrIpT: and a tab-separated java<TAB>script: are the same link to it and a different string to us. A blocklist would also need to have heard of ms-msdt: and search-ms: in advance.
• Drag-and-drop gets its own allowlist for the same reason: it is the one open path with no file-type filter in front of it. formatForPath is not a substitute — it answers "how do I parse this", and answering "markdown" is right for an unknown text file and wrong for a dropped binary.
• Recent files rebuild the native menu wholesale (muda submenus are built, not mutated). Items carry an index, never a path: a path is arbitrary user data, menu ids are matched as strings, and encoding one into the other makes the mapping depend on data neither side controls.
• First run vs. empty state used to be the same two-line stub, so an existing user got the tour every time they closed their last tab. firstRun now comes from the settings file having never been written, not from "nothing was restored".

The welcome note is a round-trip fixture, because it claims in its own text that Toril does not rewrite your files — if saving it produced a diff, the first thing a new user does would contradict the paragraph they just read. That gate earned itself immediately: it caught unpadded table pipes, and a bold span ending in a backslash, where the backslash escapes its own closing marker and mangles the text. Neither was visible by reading.

Two signatures, kept apart

docs/RELEASE-SIGNING.md is new because these are easy to confuse.

Minisign signs the update artifacts and is required. createUpdaterArtifacts is on and the bundler refuses to emit an unsigned update, so release.yml checks up front and fails in five seconds with an explanation rather than twenty minutes into a Rust build. That preflight is a hard stop rather than "skip the updater and carry on": silently cutting another release with no update path is exactly how v1.0.0 stranded itself.

Authenticode (Azure Trusted Signing) is what stops SmartScreen warning, is optional, and needs an account that takes business days to provision. Its signCommand lives in src-tauri/tauri.signing.conf.json, an overlay applied in CI only when the AZURE_* secrets exist — a fork, or a local pnpm tauri build, must not need an Azure subscription to produce a working installer.

⚠️ This blocks releases until one manual step is done

plugins.updater.pubkey is empty, so release.yml will refuse to build any v* tag until:

1. pnpm tauri signer generate -w ~/.tauri/toril-updater.key
2. Paste the public key into src-tauri/tauri.conf.json → plugins.updater.pubkey (it must be committed — installed builds verify against it).
3. Add the private key's contents as the repo secret TAURI_SIGNING_PRIVATE_KEY.

I did not generate the keypair: it is the project's signing identity, and there is no rotation — every installed copy verifies against the public key it shipped with, so losing the private key strands all of them permanently. Back it up like a password-manager export.

Gates

• 537 frontend tests (up from 498), across 4 new suites: update, zoom, links, recent, plus the drop allowlist in paths and the welcome fixture in roundtrip.
• pnpm typecheck / pnpm build clean; cargo fmt --check, cargo clippy --workspace --all-targets, and cargo test --workspace clean (including 3 new menu.rs unit tests).

Not verified, and not claimed to be

12 new items in §D of docs/ON-DEVICE-VERIFICATION.md. Nothing headless can prove a signed artifact downloads, verifies, and replaces a running binary — that needs two real releases.

Two honest gaps worth calling out:

• D4 (toast layout) is genuinely unverified. §12b says measure rectangles rather than eyeball screenshots; the browser harness could not be driven in the authoring session, so the toast's non-overlap with the status bar has not been measured. dev-harness.html?update serves a fixture (including a long unbroken URL) for exactly this sweep.
• body is still a grid declaring rows and no columns — the §12b rule-2 shape behind two past cross-engine overlap bugs. #workspace and #main were converted to flex; body was not. I routed the toast out of flow instead of refactoring it mid-branch, but it is worth its own change.

🤖 Generated with Claude Code