## 2026.6.6

### Highlights

- Added Windows desktop packaging support for Dictate, including Tauri MSI/NSIS bundle targets and a Windows build script that stages the Python engine before bundling.
- Added Microsoft Store MSIX packaging for the reserved Partner Center product identity `ArcForgeLabs.ArcForgeDictate`.
- Moved public install messaging toward Microsoft Store as the primary Windows distribution path, with website/GitHub download artifacts treated as a signed secondary path.
- Fixed the Linux Settings launcher flow so reopening Dictate focuses the existing hidden Settings window instead of starting a disconnected shell.
- Added a Linux update action for the Settings About screen: source checkouts can run `update.sh`, while packaged installs open the GitHub release flow.
- Fixed the Linux Tauri shell startup path so stale `ui-server.json` handshakes are ignored and removed instead of preventing the shell from spawning a live engine.

### Changes

- Switched the local Linux workstation config from `faster-whisper/turbo` to `faster-whisper/base` on CPU to reduce release-to-text latency when CUDA is unavailable.
- Added Windows desktop packaging support for Dictate, including Tauri MSI/NSIS bundle targets and a Windows build script that stages the Python engine before bundling.
- Added an opt-in Windows Authenticode signing script and release workflow step for direct-download `.msi` and `.exe` artifacts. Public release upload still requires signature validation, and unsigned artifacts remain internal.
- Added Microsoft Store MSIX packaging for the reserved Partner Center product identity `ArcForgeLabs.ArcForgeDictate`.
- Added Microsoft Store API smoke automation with repository variables for non-secret IDs and `MSSTORE_CLIENT_SECRET` stored as a GitHub Actions secret.
- Added a guarded manual Microsoft Store MSIX publish workflow. It can check status, upload a generated MSIX as an uncommitted draft, or explicitly commit a draft after the first manual submission is accepted.
- Added Dictate as a first-class Arc Forge ClawSweeper target with a Dictate dispatcher workflow for issue, pull request, and command-comment events.
- Added ClawSweeper default-branch fallback handling so dispatches that omit `target_branch` resolve the target repository default branch instead of assuming `main`.
- Moved public install messaging toward Microsoft Store as the primary Windows distribution path, with website/GitHub download artifacts treated as a signed secondary path.
- Updated Microsoft Store readiness docs to use the dedicated Dictate privacy policy URL, `https://arcforge.au/privacy/dictate`, after Partner Center rejected the prior general privacy URL.
- Reclassified hosted PowerShell bootstrap instructions as developer/source install guidance rather than the normal public Windows install path.
- Preserved the deprecated personal npm package path only as a compatibility landing point; new package and install paths use `@arcforgelabs/dictate`.
- Kept Dictate ClawSweeper automation conservative: review/comment only, with scheduled/background runs and auto-close policy disabled while the integration is being proven.
- Updated pinned official GitHub Actions to Node 24-compatible majors while preserving SHA pinning: `actions/checkout` v6, `actions/setup-python` v6, and `actions/setup-node` v5, and `actions/upload-artifact` v5.
- Opted workflows into GitHub's Node 24 JavaScript action runtime ahead of the June 2026 runner default change.
- Updated the UI development toolchain to remediate public Dependabot alerts: `vite` v8, `vitest` v4, and `@vitejs/plugin-react` v6.

### Fixes

- Fixed the Linux Settings launcher flow so reopening Dictate focuses the existing hidden Settings window instead of starting a disconnected shell.
- Added a Linux update action for the Settings About screen: source checkouts can run `update.sh`, while packaged installs open the GitHub release flow.
- Hardened the Tauri shell bridge refresh path so stale UI handshakes are recovered after the engine restarts.
- Fixed the Linux Tauri shell startup path so stale `ui-server.json` handshakes are ignored and removed instead of preventing the shell from spawning a live engine.
- Updated side-specific shortcut labels to use Linux-style names such as `Ctrl (R)` while preserving the existing `ctrl_r` engine token.

### Complete contribution record

This audited record covers the complete a165d71ee839a2e9012d7f39895d27faa573c886..ce1ecc21ba0d12c6782b2326ba434f1f53a7a5b9 history: 0 in-range PRs + 0 retained seed-only PRs = 0 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

#### Pull requests