[codex] Refresh BenchVault visual design

CITATION.cff

@@ -1,8 +1,8 @@
 cff-version: 1.2.0
 message: "If BenchVault helps your lab, cite the software release you used."
 title: "BenchVault"
-version: "1.0.18"
-date-released: "2026-05-25"
+version: "1.0.19"
+date-released: "2026-05-27"
 type: software
 doi: "10.5281/zenodo.20329338"
 abstract: >-

codemeta.json

@@ -2,7 +2,7 @@
   "@context": "https://doi.org/10.5063/schema/codemeta-2.0",
   "@type": "SoftwareSourceCode",
   "name": "BenchVault",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "identifier": "https://doi.org/10.5281/zenodo.20329338",
   "description": "BenchVault is a public-beta desktop app for full-size LabArchives backup, offline read-only notebook review, attachment previews, local integrity checks, and optional AI-assisted search over backed-up content.",
   "codeRepository": "https://github.com/felizvida/elnla",
@@ -42,7 +42,7 @@
     }
   ],
   "copyrightYear": "2026",
-  "datePublished": "2026-05-25",
+  "datePublished": "2026-05-27",
   "developmentStatus": "active",
   "operatingSystem": [
     "macOS",

docs/README.md

@@ -45,7 +45,7 @@ The public Sphinx documentation site is deployed through GitHub Pages at
 - `developer/reference_project_lessons.md`: reference-project lessons and the
   rules BenchVault follows before borrowing those ideas.
 - `releases/`: tracked release notes used for GitHub release entries.
-  Latest local notes: `releases/v1.0.14.md`.
+  Latest local notes: `releases/v1.0.19.md`.
 - Backup reading/search files are generated locally under each backup run in
   `readable/`; they are not tracked repository documents.
 

docs/releases/v1.0.19.md

@@ -0,0 +1,61 @@
+# BenchVault v1.0.19
+
+This prerelease combines the refreshed BenchVault desktop/docs presentation
+with a focused privacy and backup-hardening patch from the latest audit.
+
+## Changes
+
+- Refreshes the desktop shell visual design, including clearer hierarchy for
+  backup status, schedule controls, notebook browsing, and AI search surfaces.
+- Updates the documentation front page styling and current screenshots to match
+  the refreshed app experience.
+- Keeps AI-assisted notebook search from sending fallback notebook excerpts to
+  OpenAI when local search has no matching excerpt.
+- Rejects backup destinations that point at filesystem, drive, or network-share
+  roots instead of a dedicated backup folder.
+- Narrows configured external backup-root scanning to BenchVault notebook
+  records while preserving legacy project-backup discovery.
+- Prevents recursive latest-run discovery from following symlinked manifests
+  outside configured backup roots.
+- Hardens backup archives, extracted files, readable/search sidecars, audit
+  exports, integrity manifests, run manifests, and created backup directories to
+  owner-only permissions or ACLs where the platform supports it.
+- Adds regression tests for no-match AI search privacy, backup-root validation,
+  symlink-safe run discovery, scoped backup-record discovery, and generated file
+  permissions.
+
+## Verification
+
+- `dart format --output=none --set-exit-if-changed lib test`
+- `flutter analyze`
+- `flutter test`
+- `scripts/release_smoke_check.sh`
+- GitHub CI for macOS, Windows, and iPadOS validation builds
+
+## Release Assets
+
+The tag workflow uploads:
+
+- `BenchVault-macOS-v<version>-prerelease.zip`
+- `SHA256SUMS-macOS.txt`
+- `BenchVault-Windows-v<version>-prerelease.zip`
+- `SHA256SUMS-Windows.txt`
+- `BenchVault-iPadOS-v<version>-unsigned-validation.zip`
+- `SHA256SUMS-iPadOS-validation.txt`
+
+The macOS prerelease zip is unsigned and not notarized yet. macOS may show
+`BenchVault.app Not Opened` or say it cannot verify the app. Download the zip
+only from this GitHub release, compare it with `SHA256SUMS-macOS.txt` when
+possible, then use `System Settings` > `Privacy & Security` > `Open Anyway` or
+Control-click `BenchVault.app` > `Open` if you decide to run the beta.
+
+The iPadOS artifact is an unsigned validation build for Apple signing review. It
+is not installable on iPad without Apple Developer signing, provisioning, and an
+approved distribution path such as TestFlight or managed app deployment.
+
+Zenodo is enabled for this repository. After GitHub publishes the release,
+Zenodo should archive the tag and assign the version-specific DOI.
+
+## License
+
+Apache-2.0.