ledgrab/RELEASE_NOTES.md

v0.8.0 (2026-05-28)

User-facing changes

Features

Android TV — production-readiness pass

• Security: per-install random API key (persisted, threaded into the embedded server via env, embedded in the pairing QR as a URL-fragment so it never reaches HTTP logs); root-shell injection eliminated via POSIX-quoted runAsRoot(argv) overload; broadcast receivers locked to the app package; release builds refuse to silently sign with the debug keystore; crash log retention capped at 10 entries
• Performance: single reusable RGBA buffer in ScreenCapture / RootScreenrecord (eliminates ~15 MB/s GC churn at 30 fps); frame pacer switched to elapsedRealtimeNanos with catch-up accumulator (fixes ~30.3 fps drift); capture dimensions derived from source aspect ratio so non-16:9 displays aren't squashed; QR bitmap cached by URL
• Compatibility: compileSdk/targetSdk → 35 (Play Store requirement); armeabi-v7a build path; foreground service type declared as mediaProjection|specialUse with proper ServiceCompat.startForeground promotion; Ethernet > Wi-Fi > VPN > cellular selection in NetworkUtils; Android 15 predictive-back via enableOnBackInvokedCallback; splash screen API hides Chaquopy cold-start delay
• UI/UX: all hardcoded English strings localised across en/ru/zh; monochrome notification icon; 320×180 TV banner; ViewStub-based running panel; pulse animator on Running dot; "Starting…" button while probing root; autostart checkbox hidden on unrooted devices
• Lifecycle hardening: processLock serialises EOF respawn vs stop() to prevent orphaned screenrecord; publish-before-start under @Synchronized in CaptureService.restartRootPipeline closes the orphan window during watchdog restarts; watchdog give-up bound corrected (ef1f9ea)

Backup format — bundled DB + assets ZIP

• Auto-backups now produce a .zip containing ledgrab.db plus every file from the assets directory under assets/ — matching the manual GET /api/v1/system/backup download. Restore accepts both .zip and legacy .db interchangeably
• Partial-write hardening: writes stage to <name>.partial then os.replace into place — a crash mid-write never leaves a corrupt backup masquerading as valid. Stale .partial files from prior crashes are swept on the next run
• Symlinks inside the assets directory are skipped (security guard against link targets outside the dir)
• Backups over 500 MB log a warning so operators notice unbounded asset growth before disk fills up
• restart.py redirects spawned restart script stdout/stderr to restart.log and bails out early if the script is missing — silent failures used to vanish into a detached child (85da2e5)

Spectrum-aperture icon set

• Regenerated icon family from a single Pillow script: rounded-square aperture traced by a continuous RGB color-wheel stroke over a vignette canvas with chromatic bloom. 4× supersampled then downsampled per output for crispness
• New 256 px transparent-background tray variant — taskbar icon reads cleanly against light themes instead of showing a dark tile
• icon.ico now embeds 16/24/32/48/64/128/256 frames sourced from the transparent master (fixes the dark-square halo on light Windows themes)
• Maskable 512 variant safe-area padded for PWA round-crops (3645216)

Bug Fixes

• Notification sound dropdowns: both the per-app override list and the main row now always render the EntitySelect (was silently inert before any sound assets were registered) and offer "no sound" as a first-class option via allowNone (1f95993)
• CSS editor: notification_sound and notification_volume are now persisted on save — they were silently dropped from the payload before (66b85b0)
• Python 3.13 ctypes: Win32 message-pump prototypes (GetMessageW / TranslateMessage / DispatchMessageW) now share a single LPMSG = POINTER(wintypes.MSG) class across WindowsShutdownGuard and PlatformDetector — fixes the expected LP_MSG instance instead of pointer to _MSG error and the resulting shutdown-guard / display-power-monitor failure on 3.13 (e4d24a0, 0d840ad)

---

Development / Internal

CI/Build

• release.yml now creates the Gitea release as a draft and only flips draft=false once every build job (Windows, Linux, Docker) has uploaded its artifacts and sha256 sidecars — users never see a release page that's missing assets, which would have broken the in-app updater (bc42604)

Refactoring

• Shared API client + automations registry (audit M7, H8): new core/api-client.ts wraps fetchWithAuth with typed apiGet / apiPost / apiPut / apiPatch / apiDelete; 35 feature/core files migrated. FastAPI validation-array detail unwrap hardened. Automations editor's two hand-rolled RuleType dispatch ladders converted to Record<RuleType, ...> registries with an import-time exhaustiveness check (bb3a316)
• types.ts split (audit H6): 1140 LOC types.ts split into 18 per-entity files under types/, original file kept as a pure re-export barrel — 102 type exports preserved with no import sites changed (49c35a2)

Documentation

• REVIEW_RECONCILE_NOTES.md — design doc for the dashboard innerHTML reconciliation work: bug-class analysis, latent-site inventory, decision ladder (helper / hand-rolled cells / Lit), and recommendation to migrate polling-heavy modules to Lit with entity-events.ts tab reconciliation sequenced first (10eb24b)

---

All Commits (11)

Hash	Message	Author
0d840ad	fix(ctypes): share wintypes.MSG with platform_detector to avoid argtype races	alexei.dolgolyov
1f95993	fix(notification): allow clearing the sound on per-app overrides and main row	alexei.dolgolyov
10eb24b	docs: dashboard innerHTML reconciliation review notes	alexei.dolgolyov
66b85b0	fix(css-editor): persist notification_sound + notification_volume	alexei.dolgolyov
bc42604	ci(release): publish release only after every build job uploads assets	alexei.dolgolyov
3645216	feat(icons): spectrum aperture icon set + dedicated tray variant	alexei.dolgolyov
85da2e5	feat(backup): bundle assets in ZIP + partial-write hardening + restart log	alexei.dolgolyov
e4d24a0	fix(ctypes): pin LPMSG across MSG-pump prototypes for Python 3.13	alexei.dolgolyov
bb3a316	refactor(frontend): shared API client + automations registry (audit M7, H8)	alexei.dolgolyov
49c35a2	refactor(frontend): split types.ts into 18 per-entity files (audit H6)	alexei.dolgolyov
ef1f9ea	feat(android): production-readiness pass — security, perf, compat, UI/UX	alexei.dolgolyov