chore(release): prepare v0.10.0

CHANGELOG.md

@@ -7,8 +7,13 @@ and release versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-10-09
+
 ### Added
 
+- Go back from later welcome steps with a new Back button; Skip and the manual
+  paste fallback stay available.
+
 - Explicit, off-by-default meaning suggestions in a separate panel section, with
   cancellation and index-coverage status while conventional results remain
   intact.
@@ -32,6 +37,46 @@ and release versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Keep a board you deleted gone while iCloud sync is still sending the
+  deletion, instead of letting an incoming copy of the board, or a clip that
+  was still in it, bring it back. The clip's other boards are kept.
+
+- Never let a generated title or a background semantic vector computed for
+  older text land on a clip whose text has since changed.
+
+- Queue snippet edits made through the public snippet API for sync, and drop
+  the stale semantic vector when the text changes.
+
+- Paste with Return or ⌘V from the results of the search you just typed, never
+  from rows left over from the previous query.
+
+- State on the website that the iPhone and iPad apps are not available yet,
+  and make its secondary text easier to read.
+
+- Preview CSV imports without keeping an extra copy of every row in memory.
+
+- Keep a clip's image from being deleted as an orphan while another process is
+  saving the same image, and recover an unreadable store by setting aside the
+  whole database, its journals and its images together, resuming safely after
+  an interruption.
+
+- Build each backup in a private folder and publish it only once it is
+  complete, so a failed export never damages a previous backup, and replace
+  only a folder that is already a Gancho backup or is empty.
+
+- Re-activate a Pro license after signing out or a revocation without
+  restarting Gancho, ignore late replies from superseded license requests and
+  release the seat a superseded activation used.
+
+- Fail safely on a malformed database key in the Keychain instead of deleting
+  it, which could also remove a valid synced key and force store recovery.
+
+- Keep MCP search inside the exact reviewed clip revisions. Changed clips no
+  longer expose new previews or displace unchanged matches from a limited search.
+
+- Read MCP clip policy and content from one database snapshot, so an intervening
+  edit cannot pair previously approved metadata with an unreviewed body.
+
 - Detect a credit card even when an earlier order or reference number fails
   its checksum, or when the card is followed by its security code or preceded
   by a phone number, so mixed clipboard text still gets masking and short
@@ -52,10 +97,6 @@ and release versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0
   report a settings file that couldn't be imported. Toasts and the shortcuts
   sheet follow the solid panel preference.
 
-- Keep a board you deleted gone while iCloud sync is still sending the
-  deletion, instead of letting an incoming copy of the board, or a clip that
-  was still in it, bring it back. The clip's other boards are kept.
-
 - Keep a stopped iCloud sync engine stopped, order sync restarts and resets, and
   tombstone already-synced clips and boards deleted while sync is off so they
   don't come back.
@@ -153,11 +194,6 @@ and release versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0
   Physical-device acceptance remains pending; the published app, tag and
   checksum are unchanged.
 
-- Keep MCP search inside the exact reviewed clip revisions. Changed clips no
-  longer expose new previews or displace unchanged matches from a limited search.
-- Read MCP clip policy and content from one database snapshot, so an intervening
-  edit cannot pair previously approved metadata with an unreviewed body.
-
 ## [0.9.1] - 2026-09-29
 
 ### Fixed

README.md

@@ -17,13 +17,18 @@
 ![Swift 6.2](https://img.shields.io/badge/Swift-6.2-orange)
 
 **Status: public v0.9.1; in active development toward 1.0.**
-**Source version: v0.9.1.** The published direct download requires macOS 15.4+
-(build 18). Local history and manual OCR are Free; Pro activation through
-Lemon Squeezy is included. The on-device model tier requires macOS 26.
-
-![The Gancho panel at the Large text size: bigger rows, peek and dock](site/assets/v0.9.1-release.png)
-
-*v0.9.1 at the Large text size, with synthetic fixtures: the Text size preference now scales the panel.*
+**Source version: v0.10.0 (unreleased).** The published v0.9.1 direct download
+requires macOS 15.4+ (build 18). Local history and manual OCR are Free; Pro
+activation through Lemon Squeezy is included. The on-device model tier requires
+macOS 26. The v0.10.0 source adds text recipes, off-by-default meaning
+suggestions, selected context for AI tools and translation with installed
+languages on macOS 26, opens a solid panel on the newest clip, and hardens
+privacy and sync; it is not yet a published build. See its
+[release notes](docs/releases/v0.10.0.md).
+
+![The Gancho panel, solid by default, with a link peek and developer actions collapsed](site/assets/v0.10.0-release.png)
+
+*v0.10.0 candidate with synthetic fixtures; not evidence of a published release.*
 
 [Download v0.9.1](https://github.com/johnny4young/gancho/releases/tag/v0.9.1)
 for the redesigned Mac panel with a Text size preference that scales it — one toolbar, a peek with a hero card and an

docs/PRODUCT-TRUTH.md

@@ -28,7 +28,7 @@ security, architecture, release notes, and App Store copy.
 | Batch panel workflow | `PanelSelection`, `DeletionCoordinator`, `ClipDragPayload` | macOS supports range or discontiguous selection, batch stack/board/delete actions with shared Undo, and a de-duplicated multi-file drag when every selected clip is a safe file reference | Selection, deletion, drag-payload, and focused macOS UI tests |
 | Panel display preferences | `PanelController`, `PanelDisplayPreferences`, macOS General Settings | The Mac panel is solid by default with an optional translucent Liquid Glass background, edge-resizable, offers a Compact/Standard/Large Panel size picker that shows the active preset, remembers manual geometry, and scales its text, tiles and dock glyphs with a persistent three-level preference | Display-preference unit tests, a macOS UI test that measures row height per level, and the persistence smoke |
 | Package topology | `Packages/GanchoKit/Package.swift` | One package exposes eight libraries plus the `gancho` CLI | `ReleaseMetadataTests`, `scripts/check-product-truth.sh` |
-| Current direct download | GitHub release `v0.9.1` and `docs/releases/v0.9.1.md` | The published build 18 requires macOS 15.4; a fresh direct install is Free and local-only until eligible Pro activation. Manual OCR, visual Library cards, saved filters, combined text, secure direct-channel Pro activation, outbound privacy, durable shares, sync receive/upload fixes, the redesigned Mac panel (one toolbar, hero peek with an action dock, motion behind Reduce Motion, optional ambient colour, ⌘G gallery), snippet drafts that survive Library refreshes, a Text size preference that scales the panel, and content-free diagnostics for two formerly silent sync failures are included | Published tag/assets and release record, checked separately from source-version and candidate QA gates |
+| Current direct download | GitHub release `v0.9.1` and `docs/releases/v0.9.1.md` | The published build 18 requires macOS 15.4; a fresh direct install is Free and local-only until eligible Pro activation. Manual OCR, visual Library cards, saved filters, combined text, secure direct-channel Pro activation, outbound privacy, durable shares, sync receive/upload fixes, the redesigned Mac panel (one toolbar, hero peek with an action dock, motion behind Reduce Motion, optional ambient colour, ⌘G gallery), snippet drafts that survive Library refreshes, a Text size preference that scales the panel, and content-free diagnostics for two formerly silent sync failures are included. The unreleased v0.10.0 source adds text recipes, meaning suggestions, selected context, installed-pair translation, the solid newest-first panel and the review's privacy and sync hardening; it is not yet a published build | Published tag/assets and release record, checked separately from source-version and candidate QA gates |
 | Direct-download artifact gate | Production entitlements, Developer ID profile validator, release workflow | A sync-capable DMG must embed a non-expired production CloudKit/Push profile whose capabilities match the final signed app; the tag fails if signing, notarization, profile validation, artifact QA, or Sparkle signing is missing | `validate-macos-release-profile.sh`, `qa-release.sh`, and signed artifact checks |
 | Direct-download sync entitlement | `SyncEnablement`, `LicenseActivationService`, `LicenseKeyPurchaseHandler`, public release configuration | Sync requires Pro. Activation, validation, revocation, and seat limits are delegated to Lemon Squeezy without embedding a payments secret. In the published v0.9.1 build, `shouldEnable` (`tier == .pro && iCloudAvailable && hasCloudKitEntitlement`) can turn on live CloudKit for an activated direct install; production schema compatibility and the signed two-Mac matrix remain pending after publication. | Sync enablement truth table, activation-service tests, clean-install activation, packaged-secret checks, and signed two-Mac matrix |
 | Cross-device confidence | Sync tests and completed development-build hardware smoke | The source sync path has passed real-device smoke; repeat the full two-device matrix with a usable entitlement on the signed, profile-backed v0.9.1 release before claiming verified convergence | Tests plus the manual release checklist |

docs/releases/v0.10.0.md

@@ -0,0 +1,96 @@
+# Gancho v0.10.0 — Reuse more, with less in the way
+
+Gancho 0.10.0 adds reviewed ways to reuse what you copied: text recipes,
+optional meaning suggestions, selected context for AI tools, and translation
+with the languages already installed on your Mac. The panel opens solid by
+default, starts on your newest clip, and keeps developer actions one click
+away. An app-wide review also tightens privacy, sync and keyboard handling.
+
+## Highlights
+
+- **Text recipes.** Chain up to eight deterministic steps (clean OCR text,
+  dedupe lines, redact personal data) and preview the result before copying.
+  Recipes are encrypted on the Mac and never synced; three presets ship, and
+  deleted presets can be restored.
+- **Meaning suggestions, off by default.** Turn on **By meaning** in the panel
+  to add a separate "Related by meaning" section under your search. Regular
+  search results are unchanged. Suggestions draw on the on-device semantic
+  index, which is built only with Pro; on Free the panel reports that clips are
+  not indexed.
+- **Selected context for AI.** Select clips and prepare them as reviewed,
+  bounded Markdown, or grant an AI tool read-only access to exactly those clips
+  for one hour. A clip that changes after review stops being served.
+- **Translation with installed languages.** On macOS 26, Translate uses
+  Apple's on-device Translation framework for language pairs already
+  installed, even without Apple Intelligence.
+- **A calmer panel.** The panel is solid by default (Settings › General ›
+  Translucent background brings the glass back), every open starts on the
+  newest clip with the search field focused, arrows move without a cross-fade,
+  and developer actions sit behind **More actions**, which is remembered.
+- **Privacy and sync hardening.** Expired clips disappear everywhere at once,
+  metadata-only MCP access can no longer search clip bodies, deletions made
+  while sync is off no longer return, images and semantic vectors are removed
+  with their clip, and the `gancho` CLI refuses to save or copy secrets
+  unless you ask it to. A board you delete stays deleted while sync is still
+  sending the deletion, and credit cards are detected inside mixed text.
+- **Safer storage, backups and licensing.** A failed backup export never
+  damages the previous backup, a malformed Keychain key fails safely instead of
+  being replaced, store recovery sets aside the whole database generation
+  together, and a Pro license can be re-activated after signing out without
+  restarting Gancho.
+
+See the complete
+[changelog](https://github.com/johnny4young/gancho/blob/main/CHANGELOG.md)
+for all changes and fixes, including those in the iPhone and iPad apps, which
+this release does not distribute.
+
+## Install or update
+
+Download the [signed DMG](https://github.com/johnny4young/gancho/releases/download/v0.10.0/Gancho-0.10.0.dmg)
+and its [SHA-256 sidecar](https://github.com/johnny4young/gancho/releases/download/v0.10.0/Gancho-0.10.0.dmg.sha256).
+Compare the downloaded bytes with the sidecar before installing. Existing direct
+installs can use the signed Sparkle update; Homebrew's cask follows the published
+artifact. If assets or the update feed are not available yet, publication is not
+complete—do not substitute an older candidate from another source.
+
+Gancho requires macOS 15.4 or later; the on-device model tier, translation
+with installed languages and Liquid Glass additionally require macOS 26. The
+iPhone and iPad targets require iOS 26 or later and are not distributed by the
+DMG or Homebrew cask.
+
+## Availability
+
+Local history remains free. Pro is a separate direct purchase and unlocks the
+documented higher limits, on-device intelligence, and encrypted iCloud sync.
+The App Store and TestFlight channels remain in preparation.
+
+## Release verification
+
+This note describes a prepared candidate; v0.10.0 is not published until the
+tagged release workflow completes and this section records the published
+commit, build number, workflow run and DMG checksum.
+
+The release workflow must pass lint, unit tests and both app builds before
+packaging. Publication requires Developer ID signing, hardened runtime,
+notarization/stapling, Gatekeeper acceptance, the production CloudKit/Push
+profile, a SHA-256 sidecar and an EdDSA-signed Sparkle appcast. These automated
+checks do not certify physical-device behavior.
+
+Two local database migrations run on first launch: one adds the encrypted text
+recipe table, the other removes semantic vectors left behind by deleted clips
+and keeps them in step from then on. No CloudKit schema change is required.
+The signed two-Mac matrix, real Sequoia, VoiceOver and screen-OCR
+permission/display checks remain pending; run them on the released bytes with
+synthetic or disposable data and keep backups.
+
+## Known limitations
+
+- Text recognized in images (OCR) stays on the Mac that recognized it; it is
+  not synced to your other devices.
+- Backups made with Settings › General › Back up history… do not include
+  boards, board membership or text recipes yet. Recipes are also never synced,
+  so a recipe you created exists only on the Mac where you made it.
+- Back up history… replaces an existing folder only when it is a previous
+  Gancho backup or is empty; pick a new name for any other folder.
+- This DMG distributes macOS only. iPhone/iPad installation requires a separate
+  distribution path; App Store and TestFlight availability is not implied.

project.yml

@@ -27,8 +27,8 @@ options:
 # Project-wide build settings.
 settings:
   base:
-    MARKETING_VERSION: "0.9.1"
-    CURRENT_PROJECT_VERSION: "18"
+    MARKETING_VERSION: "0.10.0"
+    CURRENT_PROJECT_VERSION: "19"
     # Swift 6 language mode + "approachable concurrency": app modules default to
     # @MainActor isolation. Engine-room packages (GanchoKit/ClipboardCore/GanchoAI)
     # stay nonisolated + Sendable — see docs/ARCHITECTURE.md.

scripts/check-site.sh

@@ -51,7 +51,7 @@ grep -q '<details class="release-detail" id="release-0-7-0">' site/index.html \
 
 previous_line=0
 for release_id in \
-	release-0-9-0 release-0-8-4 release-0-8-3 release-0-8-2 release-0-8-1 release-0-8-0 \
+	release-0-9-1 release-0-9-0 release-0-8-4 release-0-8-3 release-0-8-2 release-0-8-1 release-0-8-0 \
 	release-0-7-0 release-0-6-0 release-0-5-0 release-0-4-1 release-0-4-0 \
 	release-0-3-2 release-0-3-1 release-0-3-0 release-0-2-0 release-0-1-0; do
 	release_line="$(grep -n "id=\"${release_id}\"" site/index.html | head -1 | cut -d: -f1 || true)"

scripts/homebrew/gancho.rb

@@ -10,7 +10,7 @@
 class Gancho < Formula
   desc "Privacy-first clipboard CLI and local MCP server for Gancho"
   homepage "https://gancho.app/"
-  version "0.9.1"
+  version "0.10.0"
   url "https://github.com/johnny4young/gancho/archive/refs/tags/v#{version}.tar.gz"
   sha256 "0000000000000000000000000000000000000000000000000000000000000000"
   license "MIT"