Publish Tokmeter 1.10.0 auto-update feed

docs/release/1.10.0.md

@@ -1,8 +1,8 @@
-# Tokmeter 1.10.0 — release preparation
+# Tokmeter 1.10.0 — release record
 
-Status: local release candidate. Public publishing, notarization, invitations, and user-trial results are not complete.
+Published: [v1.10.0](https://github.com/sriinnu/tokmeter/releases/tag/v1.10.0). [PR #73](https://github.com/sriinnu/tokmeter/pull/73) merged as `c09b441981ae2635d12fdf34c27cb6157f06ef14`; the signed tag points to that commit. Both npm packages are published at 1.10.0. The Apple Silicon app is Developer ID signed, notarized, stapled, and installed locally as build 46.
 
-## Release description draft
+## Release behavior
 
 Tokmeter now opens on today's usage: tokens first, estimated API cost and tool-reported amounts shown separately, followed by today's models and projects. Expand Usage details for historical totals and secondary gauges.
 
@@ -16,12 +16,12 @@ Release packaging now includes the AGPL application license, MPL core license, a
 
 The final local test/build results are recorded in `validation.md` next to this file. They describe this candidate only. Older sealed days have not been globally re-audited or rewritten.
 
-## Public-release handoff
+## Distribution and follow-up
 
-- Review the source diff and prepare a signed commit; preserve unrelated workspace changes.
-- Check the npm and macOS package contents and versions against the candidate.
-- Developer ID signing, notarization, and Sparkle update verification are separate gates. The local ad-hoc build is not a substitute for them.
-- Publish npm packages and the GitHub release only after explicit authorization. Verify both install paths from a clean machine before sending trial invitations.
+- The source commit and tag are signed; PR and merged-main CI passed.
+- The release ZIP's SHA-256 is `99ba228bae715a289175f0cb8d83549c63b12d7d2fdb9d41c3c6a1b7d799ad3d`.
+- This follow-up publishes the Sparkle feed entry for the exact released ZIP. Homebrew uses the same version and checksum.
+- A fresh-directory install checks the published npm packages; this is not a clean-machine or Intel macOS test. A week-long user trial is still outstanding.
 - Use the [trial invitation draft](../trial/outreach-draft.md) and [roster](../trial/roster.md) after selecting recipients. No messages have been sent by this work.
 
 See the existing [macOS release process](../../packages/macos-bar/RELEASE.md) for signing and publishing commands. Do not run its combined ship command merely to perform a local build.

docs/release/validation.md

@@ -1,6 +1,6 @@
 # 1.10.0 local validation
 
-Checked on 2026-09-06 on Apple Silicon macOS. These results describe the uncommitted local candidate, not a published release or a signed source revision.
+Initial checks on 2026-09-06 on Apple Silicon macOS described the then-uncommitted local candidate. The publication follow-up below records the later signed and published release.
 
 | Check | Result |
 |---|---|
@@ -19,7 +19,7 @@ Checked on 2026-09-06 on Apple Silicon macOS. These results describe the uncommi
 
 The accounting work reconciled newer Codex receipts and repaired the specifically inspected September 5 totals with a backup. This does not establish correctness of every older sealed day. See [compatibility](../compatibility.md) for per-integration evidence and [number semantics](../how-the-numbers-work.md) for accounting limits.
 
-## Remaining release and trial gates
+## Gates outstanding at the initial local checkpoint
 
 - Review and signed source commit; changes remain local and uncommitted.
 - Developer ID signing, notarization, Sparkle update validation, and a 1.10.0 release archive.
@@ -40,3 +40,9 @@ The original candidates omitted the application/core license texts, and the app
 - The isolated npm installation's package license declarations were MIT, MIT OR CC0-1.0, ISC, BSD-2-Clause, BSD-3-Clause, or AGPL-3.0-only. No non-private installed package lacked a declaration. This is a metadata inventory, not a source-ownership or exhaustive dependency legal audit.
 
 See [licenses and source](../licensing.md). Signing a source commit and public publishing remain pending.
+
+## Publication follow-up
+
+The release work subsequently completed the source/signing/publication gates: signed source commit `76fbfe4`, [PR #73](https://github.com/sriinnu/tokmeter/pull/73) merged as `c09b441`, and signed tag `v1.10.0` on that merged commit. PR and main CI passed. Both npm packages were published at 1.10.0, and [the GitHub release](https://github.com/sriinnu/tokmeter/releases/tag/v1.10.0) carries the Developer ID signed, notarized, stapled 1.10.0 (46) app and its checksum.
+
+Gatekeeper accepted the installed app as Notarized Developer ID, the ticket validated, and the final secret guard covered the actual 1.10.0 ZIP. The new appcast entry identifies that exact signed archive. The hardware/platform and real-user trial limitations above still apply.

packages/macos-bar/appcast.xml

@@ -5,6 +5,15 @@
         <link>https://github.com/sriinnu/tokmeter</link>
         <description>Auto-update feed for TokmeterBar.app</description>
         <language>en</language>
+        <item>
+            <title>TokmeterBar 1.10.0</title>
+            <pubDate>Sun, 06 Sep 2026 19:20:36 +0000</pubDate>
+            <sparkle:version>46</sparkle:version>
+            <sparkle:shortVersionString>1.10.0</sparkle:shortVersionString>
+            <sparkle:minimumSystemVersion>14.0</sparkle:minimumSystemVersion>
+            <description>&lt;p&gt;See release notes on GitHub.&lt;/p&gt;</description>
+            <enclosure url="https://github.com/sriinnu/tokmeter/releases/download/v1.10.0/TokmeterBar-1.10.0.zip" length="5357874" type="application/octet-stream" sparkle:edSignature="DYwfEeOyZSB9B5unkomVlr5pSdvjqds6k3s6NsaIocjLhoViZzmkQf6jGi3Fw9Pljf64IceMsSb681mxU+BbBw==" />
+        </item>
         <item>
             <title>TokmeterBar 1.9.2</title>
             <pubDate>Wed, 15 Jul 2026 14:47:31 +0000</pubDate>