Development journal ·
Recovery writes under file locks and low disk space
Betas 28–30 harden recovery writes, make failed checkpoints visible and prevent partial checkpoints for sessions larger than 200 tabs. Website cache validation and branded update emails were also corrected. The public site now has a focused homepage, searchable documentation and private tester boards.
One write path for recovery data
In plain language
Temporary file locks get a short retry. If saving still fails, the old saved session remains available. A damaged journal does not replace the useful backup during repair. This preserves tab and workspace records, not arbitrary unsaved website content.
Engineering notes
The session journal now uses the shared atomic-file writer with a unique temporary name, write and fsync before replacement, and bounded retries for EPERM, EACCES and EBUSY. Backup validation prevents a corrupt primary journal from overwriting the last valid recovery copy. A finally block now covers the initial write and sync, so those failures also clean up temporary files. Permanent failure remains visible through the journal’s failed state.
Checkpoint failure inside the running browser
In plain language
The browser was tested with a deliberately blocked save. It kept the page open instead of pausing it. Once saving worked again, a new review completed normally. Restart tests also restored tab order and the selected tab without loading every recovered page at once.
Engineering notes
Five new unit checks inject ENOSPC during write and fsync, exercise transient and permanent sharing failures, and verify backup retention during repair. The packaged Airlock suite injects an EPERM on session.json replacement: apply returns a checkpoint error, leaves the native WebContentsView loaded, and leaves no session temporary file. A fresh review succeeds after restoring the filesystem operation. The full unit suite passed 57 checks; packaged Airlock, safety and abrupt-exit recovery suites passed 10, 8 and 2 checks respectively. These are controlled fixtures, not a physical power-loss test.
Correcting website cache validation
In plain language
Some visitors kept seeing the old guide even after refreshing. The server was incorrectly treating the old copy as current. The delivery fix makes it send the updated page, including the corrected heading, focused warning images and new footer.
Engineering notes
Deployment archives had assigned updated marketing files the ZIP default timestamp of January 1980. Conditional HTTP requests with a later If-Modified-Since received 304 responses and retained stale content. Republishing with current timestamps changed the same request to HTTP 200. HTML, CSS and JavaScript now use no-cache revalidation headers, and the packaging helpers preserve current timestamps. The corrected layout was verified in an existing public browser tab.
Visible checkpoint status in beta29
In plain language
You can now see whether your tab and workspace checkpoint was saved. A failed save explains whether storage is full or file access is blocked, keeps the last successful time visible and offers a retry. This is separate from opted-in website drafts and does not recover every page’s unsaved work.
Engineering notes
The session writer exposes a sanitized status object: failure flag, last successful in-process save time and an allowlisted error code. Main-process checkpoint writes push a dedicated shell event without scheduling another save. The trusted shell IPC provides a manual retry. Sill Desk and the settings search share the recovery card. Packaged fault injection blocks session.json replacement and exercises the actual retry button after removing the lock. 58 unit tests, four recovery-interface checks and ten Airlock checks passed.
Checkpoint limits and the quit path in beta30
In plain language
A large session will no longer look safely saved when only some tabs were recorded. Sill explains the current 200-tab recovery limit and keeps the previous save. If saving fails when you quit, you can stay in the browser and resolve the problem first. No tabs are closed automatically.
Engineering notes
The journal previously normalized writes by slicing the tab list at 200, which could report success for a partial session. Write-time validation now rejects an oversized list before touching the primary journal or its backup. Sanitized status includes the attempted tab count and limit. The close handler runs a checkpoint preflight and includes failed recovery in the branded quit decision. A boundary test verifies all 200 records and the selected index, byte-for-byte retention on a 201-tab attempt, and successful retry after reducing the list. Seven packaged interface checks exercise the real recovery retry and Keep working actions. Ten Airlock and 23 general functional checks passed. The general suite’s final graphics capture failed; focused recovery captures succeeded through the developer protocol. Synthetic records are used, not 201 loaded pages.
Branded transactional and development emails
In plain language
Future Sill and Hamelton Software emails carry their respective logo and colors, fit phone screens and keep confirmation and unsubscribe links. Messages already in your inbox cannot be changed.
Engineering notes
Sill confirmation, devlog and beta messages now use inline HTML and base64 multipart/alternative transport. Company verification, password reset and contact messages use the Hamelton Software layout. Existing purchase and license-change messages retain their branding. Escaped URLs preserve confirmation and unsubscribe queries, with a plain-text alternative. Local MIME checks and seven captured-transport subscription checks passed. Owner-requested inbox appearance tests were sent through Gmail; that does not verify the website sender pipeline.
A clearer public site and private tester discussions
In plain language
The website now makes the main features easier to find. Beta signup sits directly below the feature slider, guides live in a dedicated documentation area, and the homepage shows recent development news. Public support boards offer practical help; signed-in beta testers have a separate private area. No tester email addresses are displayed on those boards.
Engineering notes
The public homepage now uses a four-feature carousel, IntersectionObserver reveals and requestAnimationFrame scroll progress, with reduced-motion behavior. Documentation is generated for the current beta and has client-side full-text topic search. Support discussions use server-side SQLite storage outside the document root, hashed one-use email sign-in tokens, CSRF protection, escaped plain-text posts, rate limits and authorization checks on board lists, topic reads and writes. Private beta access is checked against the tester list on each request. Seventeen access checks and nineteen isolated HTTP checks cover visitors, non-testers, testers, administrator actions, token expiry/reuse and content escaping.