CHANGELOG.md

# Changelog

## 1.0.0

### New

- **The QuillVille menu — one standard cross-app switcher in every app.** QUILL, Quill Radio, and Quill Weather each carry the same top-level **QuillVille** menu (Alt+Q), listing "Open QUILL / Quill Radio / Quill Weather / Quill Cast / Audio Studio" so you can jump to any family member — each opening in its own window — from the same place everywhere. Functional menus keep their descriptive names (the **Weather** menu stays "Weather", which a screen reader can find by its first letter); QuillVille is the family-navigation menu, which is what a brand name should label. Quill Weather is a fully separate, independently-distributed app now (its own `standalone/weather` build folder, versioned 2.2.0 in lockstep with Quill Radio but updated on its own feed), and Quill Radio's Weather menu also offers **Open the Quill Weather App**. Built on a small, tested launcher (`core/app_launcher.py`) that runs the sibling's own exe in a frozen build or `python -m quill.apps.<app>` from source; because each app is single-instance, opening one that is already running just brings it forward. The `app.open_radio` / `app.open_weather` commands are also in QUILL's command palette (rebindable). (`core/app_launcher.py`, `ui/quillville_menu.py`, `ui/app_shell.py`, `apps/radio.py`, `apps/weather.py`)
- **Show or hide any app with one global hotkey — each app its own unique chord.** QUILL, Quill Radio, and Quill Weather each register a **system-wide** keystroke that tucks the window to the system tray, or brings it back and focuses it, even while another program has focus — so a family that lives in the tray (Quill Weather watching for alerts, Quill Radio playing in the background) is always one key away without hunting for the tray icon. The chords never collide: **QUILL is Ctrl+Alt+Shift+Q, Quill Radio is Ctrl+Alt+Shift+R, Quill Weather is Ctrl+Alt+Shift+W.** Hiding leaves the app fully running (playback, recording, and alert monitoring continue); the toggle speaks "hidden to the tray" or "shown" so a press from another window still tells you what happened. It is Windows-only (built on `RegisterHotKey`, the same mechanism Quill Radio already uses for the hardware media keys) and best-effort: if another program already owns a chord, that chord stays theirs and the app simply doesn't grab it — nothing breaks, and QUILL's press is a low-risk **window-visibility** command that can never touch a document. In QUILL the Ctrl+Alt+Shift+Q default is a normal, rebindable global hotkey you can change or clear in **Tools > Global Hotkeys...**. Built on a shared, unit-tested chord parser (`ui/tray_hotkey.py`). (`ui/tray_hotkey.py`, `ui/app_shell.py`, `ui/main_frame_hotkeys.py`, `apps/radio.py`, `apps/weather.py`)
- **Customize Features — turn whole areas of Quill Radio and Quill Weather on or off (like QUILL).** A new **View/Options > Customize Features...** in the standalone apps lists each app's switchable areas — Quill Radio's **Recording** and **Weather** menus, Quill Weather's **Alert Monitoring** and **NOAA Weather Radio** — each with a description; unchecking one omits its whole menu (and every command under it) the next time the app opens, so people can trim the apps to just what they use. Built on a shared, tested model and dialog (`core/app_features.py`, `ui/app_features_dialog.py`) reused by both apps, defaulting every area on so a new area is enabled until turned off. Richer tray menus too: Quill Radio's tray gains Play/Pause and Stop; Quill Weather's gains Quick Weather; both gain the sibling-app launchers. (`core/app_features.py`, `ui/app_features_dialog.py`, `apps/radio.py`, `apps/weather.py`, `ui/main_frame_weather.py`)
- **Calculator (Tools > Calculator) — a scientific calculator that also does the math *in your document*.** A new accessible calculator that is two tools in one. It **evaluates** scientific and natural-language expressions safely — `sqrt(264)`, `sin(pi/6)`, `2^10 + 5!`, `10 percent of 500`, `what is the square root of 264` — with no `eval`: it parses to an AST and walks an allowlist of operators, functions, and constants, so text pulled from a document can never execute code. And it does **statistics over your data**: select some numbers (or a column, or a pasted CSV or table) and it computes sum, average, minimum, maximum, count, product, median, range, or standard deviation — over **all the numbers**, **down each column**, or **across each row**, plus a one-line **full summary** — understanding currency symbols, thousands separators, percentages, and accounting negatives along the way. The input box is pre-filled with your editor selection ("select then calculate"), and any result can be copied or **inserted at the cursor**. This meets Leasey's scientific calculator and goes well beyond it with the column/row/table operations a calculator inside a writing tool should have. Core in the new `quill/core/calc/` (`evaluator.py`, `data_ops.py`); dialog in `quill/ui/calculator_dialog.py`; opened from Tools > Calculator (rebindable as `tools.calculator`). (`core/calc/*`, `ui/calculator_dialog.py`, `ui/main_frame_line_commands.py`)

- **Quill Weather — a standalone tray app that watches for alerts even when everything else is closed (Quill Weather 1.0.0).** The weather features below also ship as their own small app (`quill-weather`) whose whole job is to keep the National Weather Service alert watch running independently of Quill Radio or the editor. It launches to the **system tray**; closing its window minimizes to the tray so monitoring continues; and **Options → Start Quill Weather with Windows** (with **Start minimized to the tray**) makes it watch from login with no window ever shown. For a truly always-on watch with **no process running at all**, **Options → Check for alerts in the background (even when Quill Weather is closed)** registers a per-user **Windows Scheduled Task** that wakes a short-lived check on your monitor cadence, polls the NWS, and shows a **Windows toast** (which your screen reader announces) for any newly-issued alert, then exits — no NWWS credential or XMPP feed required. The live watch and the background check share one persisted "already-told-you" record so the same alert is never announced twice. (`apps/weather.py`, `core/weather/headless_check.py`, `platform/windows/scheduled_task.py`, `platform/windows/weather_startup.py`)
- **Weather Guardian — background alert monitoring with spoken warnings and a sounder (Quill Radio 2.2.0).** **Weather > Start/Stop Weather Monitoring** (Ctrl+Shift+M) watches one US location's active watches, warnings, and advisories on a timer and **speaks each newly-issued alert as it appears** — with forced, interrupting speech for tornado/flash-flood-level (Urgent and above) events — and announces when they all clear. It keeps running while the window is **minimized to the tray**, auto-resumes on launch, and shows a **system-tray toast** for each new alert. A **severe-weather mode** automatically tightens the poll (down to the NWS 30-second courtesy floor, default 60 s) while any alert is active, then relaxes back to the normal interval — near-real-time alerts on the free NWS API with no push feed. **Weather > Pause/Resume Alert Checks** temporarily snoozes the watch without turning it off (distinct from Stop, which is the full off). (`core/weather/monitor.py`, `ui/main_frame_weather.py`)
- **An alert sounder you control — on/off, your own sound, repeat count, and a Play preview (Quill Radio 2.2.0).** New alerts play a distinctive bundled chime. In **Weather > Settings** you can turn the sound **off** entirely (alerts are still shown and spoken), **choose your own `.wav`** with a **Play** button to hear it before saving (and **Use Default** to go back), and set **how many times it plays** per alert (1–10). Best-effort and non-blocking, so a sound problem never delays the alert itself. (`platform/alert_sound.py`, `assets/audio/weather_alert.wav`, `core/weather/settings.py`, `ui/weather/settings_dialog.py`)
- **Test Alert — preview exactly what a real alert does (Quill Radio 2.2.0).** **Weather > Test Alert** demonstrates the full experience in one click — the spoken/shown text, the sound (honoring your settings), a system-tray toast, and the alert dialog — all clearly marked as a **TEST** and dismissable, touching neither the network nor the monitor's real state. So you can confirm what a warning will look and sound like before one ever arrives. (`ui/main_frame_weather.py::weather_test_alert`)
- **Hour-by-hour forecast (Quill Radio 2.2.0).** The Weather Center gains an **Hourly forecast** pane — temperature, conditions, and chance of precipitation for each upcoming hour from the NWS hourly product — arrow through it like the daily outlook, with a configurable length (**Settings › Hourly forecast (hours)**, default 24, 0 = off). (`core/weather/nws.py::hourly_from_json`, `ui/weather/weather_center_dialog.py`)
- **Moon almanac — phase, illumination, moonrise and moonset (Quill Radio 2.2.0).** Current conditions and every day of the extended outlook now include the moon: its named phase, percent illuminated, and the day's moonrise and moonset — computed locally with no extra network call or dependency (a compact lunar theory validated against known lunations). Toggle it in **Settings › Moon phase, moonrise and moonset**. (`core/weather/astronomy.py`)
- **Current local time at the searched location (Quill Radio 2.2.0).** Weather Now and Quick Weather now lead with the location's own local day and time ("The local time there is Thursday, April 27, 9:51 AM."), so checking the weather in another city also tells you what time it is there — using the timezone the weather providers already return. Toggle in **Settings › Current local time at the location**. (`core/weather/render.py::local_time_phrase`)
- **Start Quill Radio with Windows (Quill Radio 2.2.0).** A new **Station > Start Quill Radio with Windows** checkbox adds (or removes) a per-user autostart entry so Quill Radio launches at sign-in — the same reliable, no-elevation mechanism QUILL itself uses. (`platform/windows/radio_startup.py`, `apps/radio.py`)

- **Improve Reading Order with AI — fix a jumbled document in one command.** A new **AI > More > Improve Reading Order…** (also on the command palette) sends the current document's text to your configured AI provider to repair a scrambled reading order — a multi-column PDF, a page with sidebars or text boxes, or lines that came out of sequence — and opens the reflowed result as a **new, unsaved document** so your original is never touched. It reorders columns into a single natural flow, joins lines broken mid-sentence, and infers headings, lists, and tables, while preserving your wording exactly (it never summarizes or invents). It **always asks first**, naming the provider and its host and the approximate page size before anything is sent; it refuses documents over a configurable page limit (**Settings › `reading_order_max_pages`**, default 40) so a huge send can't happen by accident; and it's off in Safe Mode. **It uses whichever AI backend you've configured** (AI > Set Up AI) — OpenAI, Claude, Google Gemini, OpenRouter, Ollama (local), Ollama Cloud, or a custom OpenAI-compatible endpoint (bring-your-own-key; QUILL bundles none) — or, with no cloud provider set up, the bundled **on-device** model (Apple's on-device model on a supported Mac, otherwise a local CPU model), so it can run entirely offline with nothing uploaded. Built on the assistant's existing backend seam (`Assistant.transform` → `make_default_backend`), so it inherits every provider QUILL already supports. This closes the last Leasey Word editor-parity gap ("Improve Reading Order with ChatGPT"). (`core/ai/assistant.py` `reading_order` operation, `ui/main_frame_ai_reading_order.py`, `core/settings.py`)
- **Open password-protected PDFs — QUILL asks for the password and reads the file (#58).** Previously a locked PDF was correctly *detected* but refused: QUILL told you to remove the password yourself with an external tool (`qpdf --decrypt`) and open the decrypted copy. Now, when you open an encrypted PDF, QUILL prompts for its password and reads the document directly — the same way Leasey Word does. Enter the password and the PDF opens; get it wrong and QUILL says so and lets you try again; press Cancel to abort the open. **The password is used only to unlock that one file for reading and is never stored, logged, or written anywhere** — reopen the file later and QUILL asks again. Both PDF extractors (pdfplumber and pypdf) receive the password through the read path, which now runs off the UI thread like every other office/PDF open, so the screen reader stays responsive while the file loads. Permissions-only "encrypted" PDFs (which open with an empty password) continue to open with no prompt, exactly as before. (`io/pdf.py`, `io/structured.py`, `io/open_read.py`, `ui/main_frame.py::_ask_pdf_password`)
- **Sort lines by date (Format > Sort Lines by Date) — Leasey Word parity.** Alongside the existing alphabetical, numeric, and by-length line sorts, QUILL can now sort the selected lines (or the whole document) by the first date it finds on each line. It recognizes the common styles — ISO `2020-03-05`, slash/dot forms like `03/04/2020` and `5.1.2020`, and English month names (`Jan 5, 2020`, `5 January 2020`, `March 3rd, 1999`) — and, like Leasey, infers day/month order for an ambiguous numeric date (is `03/04` March 4th or 4 March?) from your region: US English reads month-first, everywhere else reads day-first, and an unambiguous component such as `25/12` always wins regardless. Two-digit years follow the standard pivot (00–68 → 2000s, 69–99 → 1900s). Lines with no recognizable date sink to the bottom in their original order, so nothing is lost. The reusable date parser lives in its own `core/date_parse.py`; the command is on the Format menu next to the other sorts and is rebindable in the Keymap Editor. (`core/date_parse.py`, `core/format_ops.py::sort_lines_by_date`, `ui/main_frame_power_tools.py`)
- **Hear the whole sentence around a misspelling — Ctrl+R in the Spelling Review (Leasey Word parity).** The F7 Spelling Review dialog gains a **Read Sentence** button and a **Ctrl+R** shortcut that reads the full sentence surrounding the current misspelled word aloud, so you can judge a correction in context without leaving the dialog or hunting through the document. It reads the same context the dialog already shows, whitespace-collapsed so it speaks smoothly. (`ui/spelling_review_dialog.py`, `core/spelling/announcements.py::announce_context_sentence`)
- **A PDF's own bookmarks now open in the Bookmarks Manager (Leasey Word parity).** When you open a PDF that carries an embedded outline (Adobe bookmarks — its chapters and sections), QUILL now imports those entries into its Bookmarks Manager (Ctrl+Shift+G) automatically, the same way it already surfaces Word and EPUB structure — so you can jump straight to a chapter. Each imported bookmark lands exactly where *Go To Page* for that page would (resolved through the page markers QUILL writes when it extracts the PDF); the import runs **once, on first open**, and is skipped when the document already has bookmarks, so it never duplicates entries or resurrects ones you've since renamed or deleted; and it's best-effort — a malformed or absent outline never blocks the open. (`io/pdf.py::extract_pdf_outline`, `io/structured.py`, `ui/main_frame.py::_import_pdf_outline_bookmarks`)
- **Six more one-click writing presets in the Prompt Library (Leasey Word parity).** The built-in Prompt Library gains **Generate FAQs**, **Draft a Speech**, **Summary Email**, **Social Media Post** (≤280 characters), **Step-by-Step Instructions**, and **Paraphrase** — the named one-shot tools QUILL was missing next to its existing summarize / rewrite / tone / expand / extract-action-items set, matching Leasey Word's named ChatGPT tools. Each runs over your selection or the whole document from **AI > Prompt Library**, and (like every built-in) its wording can be tweaked and it can be disabled but not deleted. (`core/prompt_library.py`)
- **Cross-format conversion keeps far more of your formatting — with a documented fidelity matrix.** A round of work to make Save As / conversion between Markdown, HTML, Word, RTF, and plain text preserve as much as possible: **tables now convert as real tables between Markdown, HTML, and Word** (a Markdown/HTML table saved to Word becomes a genuine, editable Word table with a bold, repeating header row that screen readers announce — not pipe-text; Word tables already came across as native Markdown/HTML tables); **docx hyperlinks now round-trip both ways** (a real `<w:hyperlink>` is written and its target is read back, instead of links degrading to plain text); **numbered lists are first-class** across Markdown, HTML, and Word (a `1. 2. 3.` list stays an ordered list, keeping a non-1 start); and **Markdown → HTML now renders images as `<img>`** (previously a broken `!` plus a link) **and blockquotes as `<blockquote>`** (previously a literal `>`). A new comprehensive test suite (`tests/unit/io/test_save_as_format_fidelity.py`) verifies headings, bold, italic, underline, strike, links, bullet + numbered lists, tables, images, colour, and more across every direction, and the honest limits are now documented in the User Guide ("What carries over between formats") and the PRD: blockquote/code/rule are literal markers in Word/RTF; a table saved to **RTF** is readable pipe-text rather than a native RTF table; inline formatting inside a Markdown-authored table cell flattens to plain text in Word; Word-embedded images are not extracted; RTF drops alignment and page breaks. (`io/rtf_model.py`, `io/docx_reader.py`, `io/docx_writer.py`, `core/browser_preview.py`)
- **Quill Radio multi-window model — the menu bar never disappears (Quill Radio 2.2.0).** Browse Stations, Search Stations, Manage Favorites, Schedule Recording, and the Weather Center become modeless `wx.Frame`s that each carry the shared menu bar (fixing a reported "menus vanish" defect — a `wx.Dialog` cannot host a menu bar) and no longer lock out the main window. A new **&Window** menu lists open windows numbered 1–9; **Ctrl+Tab** / **Ctrl+Shift+Tab** cycle them and **Ctrl+1**–**Ctrl+9** jump to one, with "Entered …"/"Exited …" cues and primary-control focus on entry. Built on a pure, unit-tested `WindowRegistry` plus a thin wx `WindowManager`; each surface takes an optional `windows=` param so the same class is a modeless frame in standalone Radio and the classic modal dialog when embedded in QUILL. (`ui/window_manager.py`, `ui/window_menu.py`, radio surfaces)
- **Back up and restore your Radio stations and settings (Quill Radio 2.2.0, #1193).** New **Station > Back Up Stations and Settings...** and **Restore from Backup...** save favorites, settings, the wake timer, and the recording schedule -- and, on request, the recorded audio -- into one portable `.qrbackup` zip, and bring them back on a new device or after a reinstall. File-level so a backup made by one version restores into another; the restore validates the manifest, accepts only the known state filenames, is zip-slip-guarded, and reloads the app live. (`core/radio/backup.py`, `ui/radio/backup_ui.py`)
- **Ctrl+T opens a reviewable Now Playing window (Quill Radio 2.2.0).** "What's Playing?" now opens the `NowPlayingDialog` -- the current title and artist in a read-only, arrow-through, copyable field -- instead of only speaking the title; it falls back to fetch-and-speak when no title is cached yet. The window (#1134) existed but had no menu item or key, so nothing opened it. (`apps/radio.py`, `ui/main_frame_radio.py`)
- **Station Details for any favorite (Quill Radio 2.2.0).** A favorite's context menu gains **Station Details...**, opening the same reviewable, copyable readout (source, stream, format, country) the search results show. (`apps/radio.py`)
- **Radio Browser (by Genre) in Browse Stations (Quill Radio 2.2.0, #1194).** A first-class Browse-tree branch to walk the Radio Browser directory by genre, not only search it (thin adapters over the existing tag/search API); and the Search source filter now reads "Radio Browser" (two words) so a screen reader does not make the run-together label sound missing. (`core/radio/radio_browser.py`, `ui/radio/station_browser_dialog.py`, `ui/radio/browse_tree_dialog.py`)
- **NOAA Weather Radio is now an authoritative directory (Quill Radio 2.1.1).** The Browse Stations "Weather / NOAA" branch drops the fuzzy RadioBrowser name search for the **WeatherIndex** directory (api.wxindex.org) of actual NWR transmitters: browse state by state (call sign, frequency, place), search by SAME code, call sign, or "County, ST", and play the best available re-stream. A three-tier resolver -- live API, app-data cache, bundled snapshot of 1,035 transmitters (`quill/data/noaa_directory.json`) -- keeps every NOAA feature working fully offline. **Weather menu > Listen to your Local NOAA Weather Radio** resolves the transmitter covering your saved Weather location (county/SAME first, nearest covering transmitter by coordinates as fallback); **Weather menu > Update NOAA Weather Radio Directory** pulls the newest directory on demand into the cache tier, never overwriting the bundled floor. Live pulls are Safe-Mode-blocked and in the network-egress audit. (`core/radio/wxindex*.py`, `scripts/snapshot_wxindex.py`)
- **Radio Reading Services (Quill Radio 2.1.1).** A new "Radio Reading Services" Browse category and search blend for the audio information services that read newspapers and local print aloud for blind and print-disabled listeners -- WRBH, Sun Sounds of Arizona, CRIS, KPBS/WKAR reading services, ACB Media 1-5, NFB Radio Network, Voice Corps, and more. 20 vetted services ship as a bundled snapshot (`quill/data/reading_services.json`) so the category works offline; **Station > Update Radio Reading Services** refreshes live from RadioBrowser (cache -> live -> snapshot resolver mirroring wxindex, Safe-Mode-guarded). Stations play, favorite, record, and schedule like any other. (`core/radio/reading_services.py`)
- **"Find in this folder" search in Browse Stations.** A search box in the Browse tree that searches from the currently-highlighted folder **downward only** -- one genre, one state, one source -- instead of the whole app, so results stay small and relevant. It loads that folder's subtree (bounded by depth, a result cap, and a fetch budget so a search from a big branch or TuneIn's remote tree stays finite), filters its stations by name, and shows the matches as a flat list under the folder. **Clear** drops the results and returns the cursor to the folder you searched from. Works for every source -- favorites, station lists, genre catalogs, NOAA states, iHeart genres, TuneIn folders. (`ui/radio/browse_tree_dialog.py`)
- **iHeart is now in Browse Stations, not just Search.** A new **iHeart** branch in the Browse Stations tree groups iHeart's live stations by **genre**, and within each genre by an **A-Z** sub-directory (with 0-9 and # buckets), every level loading lazily. It uses iHeart's free, keyless JSON content API (`us.api.iheart.com`) because the XML sitemap the Search path uses carries no genre; each station row already embeds its stream, so a genre resolves in one request with no per-station page fetch. Leaves play, favorite, record, and schedule like any other station. Reached only by expanding the branch, and off in Safe Mode; the egress runs through the existing reviewed `iheart._fetch` site. (`core/radio/iheart.py`, `ui/radio/browse_tree_dialog.py`)

- **Format-aware Writing Tools: Block Quote, Horizontal Rule, and a smarter Insert Image.** The **Insert** menu gains **Insert Block Quote** and **Insert Horizontal Rule**, and every structured insert (block quote, horizontal rule, table, image) is now *format-aware*: it emits Markdown in a Markdown document and HTML in an HTML document. When the document's format isn't set yet (a fresh, unsaved, or plain buffer), QUILL asks **"Markdown or HTML?"** once, then remembers the choice for that document and stops asking — so inserts just work without turning a plain buffer into a guessing game. The structured inserts now carry direct authoring chords that mirror Leasey Word's muscle memory: **Insert Table = Ctrl+Alt+T**, **Insert Block Quote = Ctrl+Alt+Q**, **Insert Horizontal Rule = Ctrl+Alt+H** (joining the existing Ctrl+Alt+1–6 headings and Ctrl+Alt+7/8 lists). None of the three collides with a default NVDA/JAWS command, and all remain rebindable in the Keymap Editor. (`core/keymap.py`, `core/tagging.py`, `ui/main_frame.py::_resolve_structured_markup`, `ui/main_frame_commands.py`, `ui/main_frame_menu.py`, `tools/menu_lint.py`)
- **Insert Image now drafts alt text with AI and lays out correctly in HTML.** The **Insert Image** dialog gains two enrichments on top of its mandatory-alt-text promise. When an AI vision model is connected (and you are not in Safe Mode), a **Suggest alt text with AI** button describes the chosen file and drops the draft into the alt field for you to check and edit — the machine drafts, you approve; the vision call runs off the UI thread behind a progress indicator and, unlike the older describe path, is correctly disabled in Safe Mode. In an **HTML** document the dialog also collects **width/height** (so the browser reserves the box and the page doesn't jump as the image loads), a **Responsive** cap (`max-width:100%`, never overflowing a column), and an optional **Caption** (emitted as `<figure>`/`<figcaption>` so the caption is programmatically tied to the image); decorative images emit empty `alt` plus `role="presentation"`. These fields are hidden in Markdown, whose syntax cannot carry them. (`core/inline_image_alt.py::build_image_html`, `ui/insert_image_dialog.py`, `ui/main_frame_image_alt.py`)
- **ePub heading navigation reaches every chapter heading — even inferred ones.** ePub chapters now render their in-chapter headings inline (as Markdown `#` lines two levels below the chapter), so single-key heading navigation (`H` / `Shift+H`) walks them instead of stopping at chapter boundaries. And when a chapter has no real `<h1>`–`<h6>` markup at all (common in older, hand-made EPUBs), QUILL now **infers** headings from structure — a paragraph whose class names it a title/chapter/section, or a short standalone bold line acting as a heading — so navigation and the chapter outline still work where they used to come up empty. Long bold runs (emphasis inside a paragraph) are deliberately left alone. (`core/epub.py`)
- **Bookmarks that survive edits — "Points" you can trust.** Bookmarks (and the numbered quick-bookmarks) no longer store just a raw character position that silently drifts the moment you insert or delete text above them. Each now also captures the text around it, so jumping to a bookmark **re-anchors** to where that text actually lives now — text added or removed above the mark no longer lands you in the wrong place. If the bookmarked text was itself deleted, the jump falls back to the old clamped position (never worse than before). Anchors persist per-document across restarts and are fully backward-compatible with existing bookmark files. (`core/bookmark_anchor.py`, `core/bookmarks.py`, `ui/main_frame.py`)
- **Word tables are no longer lost when editing a .docx as a rich document.** Opening a Word document for rich editing used to drop every table silently — the cell contents simply vanished. Tables now appear inline, in reading order, rendered as accessible Markdown tables, so their content is preserved, readable, and reachable by single-key table navigation (`T`). (The classic open path already showed Word tables via MarkItDown; this closes the gap on the rich-edit path. `scan_docx_features` still flags tables honestly before a rich edit.) (`io/docx_reader.py`)

### Fixes

- **Save As to Markdown/HTML from a Word document keeps its formatting.** Opening a `.docx` in rich mode makes `document.text` a flattened plain-text mirror, and Save As to `.md`/`.html` serialized *that* — so headings, lists, bold, italic, and links were all lost (Save As to `.rtf`/`.docx` was already fine, and documents opened on the extract floor were fine, which made the loss inconsistent and easy to miss). Rich-mode Save As now reconstructs the RichDocument from the control's RTF and renders it with `rich_to_markdown` (Markdown) or `markdown_to_html` (HTML), so the formatting comes across as native markup. (Underline has no standard Markdown form, so it round-trips as QUILL's hidden-codes span, and renders natively in HTML.) The Save As dialog and its format routing were correct — this was a missing converter wiring in the rich-mode save path. (`ui/main_frame_rich_mode.py::_save_rich_as_markup`)
- **Podcast search returns you to the results list after subscribing (#1181 follow-up).** In **Add Podcast...**, subscribing to an iTunes search result left focus stranded on the Subscribe button, so a screen-reader user had to hunt back to the list to add the next show. Focus now returns to the results list and re-selects the row you subscribed from (clamped to the current list), ready to arrow on. The Add-by-Feed-URL path is unchanged (focus stays by the URL box). Applies on success, already-subscribed, and error outcomes. (`ui/podcasts/add_podcast_dialog.py::_return_focus_to_results`)
- **The accessible Word view no longer crashes on the first edit (#1198).** Typing into the Word structure surface raised `TypeError: MainFrame._sync_editor_change() missing 1 required positional argument: 'status'`, because `WordDocumentSurface` invokes its `on_change` callback with no arguments while `_sync_editor_change` required a `status`. The status now defaults to `"Modified"` (matching the plain-editor callers), so the surface's zero-argument callback works, and a signature contract test guards both halves so the arity can't drift apart again. (`ui/main_frame.py::_sync_editor_change`)
- **A single non-UTF-8 file no longer takes down a whole Vault scan (#1202).** Opening a folder as a Vault crashed with `UnicodeDecodeError` if any note inside was not valid UTF-8 (for example a Latin-1 file, or a stray non-text file in the folder). `scan_vault` now re-reads such a file leniently (`errors="replace"`) so the note is still indexed and searchable instead of aborting the scan. (`core/vault/vault.py::scan_vault`)
- **Launching Quill Radio no longer crashes on a stray keystroke (#1203).** A global key hook could fire before (or after) a document editor existed, and `_focus_is_in_document_surface` read `self.editor`/`self.notebook` directly, raising `AttributeError: 'MainFrame' object has no attribute 'editor'` — most visibly while starting Quill Radio, which has no editor. All three surface checks are `getattr`-guarded (the same hardening as #951) and covered by a regression test. (`ui/main_frame.py::_focus_is_in_document_surface`)
- **The live preview no longer renumbers ordered lists (#1200).** A numbered list that started at 3 (or used any non-1 start) showed correctly in the editor but was silently renumbered to start at 1 in the preview, and a loose list (blank lines between items) split into separate lists that each restarted. The Markdown preview now emits `<ol start="N">` to honor the author's starting number and keeps a blank-line-separated list as one list, so the preview matches what you typed. (`core/browser_preview.py::_render_markdown`)
- **Custom radio stations can be added to Favorites (#1205).** Adding a custom station played it but the favorites list never visibly updated — the station was saved but the tree wasn't refreshed, so it looked like nothing happened. The Add Custom Station flow now refreshes the favorites tree and the favorite toggle immediately (guarded so it stays a no-op in embedded QUILL, which has no favorites tree). (`ui/main_frame_radio.py::_radio_open_add_custom`)
- **Browse Stations picks up new listings after an in-place update (#1207).** After updating in place, the app-data directory cache written by the previous version — still inside its 7-day freshness window — kept shadowing the newer bundled station directory, so Browse Stations showed the old listings even though the app had updated. The cache is now bypassed when the bundled snapshot is newer than it (a genuinely fresher user-refreshed cache still wins), so new listings appear without waiting out the age window. (`core/radio/wxindex.py::_directory_stations`)
- **Alt+S presses Stop instead of opening the Stations menu (#1208).** The transport button's `&Stop`/`&Play` label advertised Alt+S / Alt+P as its access key, but those collide with the Station and Playback menu-bar mnemonics (the menu bar wins), so the button never fired and the reported hotkey did nothing. The button no longer claims a colliding mnemonic and announces the reliable transport key, Ctrl+P, which works regardless of focus. (`apps/radio.py`)
- **TuneIn stations can be added to Favorites from Browse Stations (#1210).** TuneIn leaves resolve their stream lazily at play time, so the "Add to Favorites" action was missing for them (present for every other category). Add to Favorites — via the context menu or the favorite button — now resolves the TuneIn stream on demand off the UI thread, then adds the resolved station. (`ui/radio/browse_tree_dialog.py`)
- **Radio audio no longer keeps playing after the app exits (#1195, mpv engine).** On the real exit path the mpv engine only performed a soft stop and left the actual libmpv teardown to a window-destroy event, so if that event was delayed or the frame wasn't destroyed, audio could outlive the app. The player controller now hard-terminates the engine deterministically on shutdown, and the window-destroy handler is guarded so a child window's destruction can't tear it down early; termination is idempotent. (The "keeps running in the tray" facet of #1195 is the deliberate close-to-tray behavior established in #1193 — Ctrl+W and the X minimize by design; use Exit to quit.) (`ui/radio/mpv_radio_engine.py`, `ui/radio/player_controller.py`)
- **New Folder (Ctrl+Shift+E) works from the Quill Radio favorites tree (#1211).** The Station menu advertised the accelerator, but a focused favorites `TreeCtrl` could swallow the chord before the menu accelerator fired, so nothing happened. Ctrl+Shift+E is now handled in the app char hook (like the reorder chord) so it opens New Folder app-wide, regardless of focus. (`apps/radio.py::_on_radio_char_hook`)
- **Delete all radio favorites in one step (#1201).** The Favorites manager gains a **Remove All...** button that clears every favorite (folders are kept) after a confirmation that defaults to No; a backup is snapshotted on save so it can be undone. (`ui/radio/favorites_manager_dialog.py`, `ui/radio/favorite_actions.py::remove_all_favorites`, `core/radio/favorites.py::clear`)
- **Quill Radio favorites move up/down works from the default view without destroying a hand-arranged order (Quill Radio 2.2.0, #1186).** Reordering from a sorted (A-Z/Z-A) view is treated as an intent to hand-arrange: the sort flips to manual, the tree reloads to *reveal* the preserved stored order, and the move happens within that now-visible order (announced "Switched to manual order"). Crucially it no longer bakes the alphabetized view over the stored list — which used to silently overwrite a listener's hand-arranged order the first time they reordered from A-Z, with no way to recover it. The stored order is left untouched; only the sort setting changes. (`apps/radio.py::_force_favorites_manual_order`)
- **Quill Radio Exit really exits (Quill Radio 2.2.0, #1193).** An explicit menu/tray Exit called the same close path as the titlebar X, so with close-behavior set to "minimize to tray" it bounced right back into the tray and the app could never be closed. A shared `_exit_application()` now flags the request so the close handler quits for real, bypassing minimize-on-close and the accidental-Alt+F4 confirm. (`ui/app_shell.py`, `apps/radio.py`)
- **Quill Radio menu bar is reachable on launch (Quill Radio 2.2.0, #1193).** The pre-show `SetFocus` did not stick, so the window opened with no control focused and the first Alt opened the window system menu instead of the app menu bar; focus now lands on the favorites tree via `wx.CallAfter` after the frame is shown. (`apps/radio.py`)
- **Quill Radio NOAA state folders show the stations they promise (Quill Radio 2.2.0).** A Weather / NOAA state could show a count ("9 items") yet expand to nothing, because the count came from the live `/v1/states` endpoint while the leaves come from the full-directory tier. `wxindex.states_with_playable_feeds` now derives the folders and counts from that same tier, so a count always equals what expanding shows. (`core/radio/wxindex.py`)
- **Quill Radio "Install and restart" no longer refuses the update (quill-radio 2.1.2, #1183).** One-click self-update extraction shares the generic 512 MiB decompression-bomb guard, but a full portable app bundle (Python + ffmpeg + mpv + libraries) uncompresses well past that -- Quill Radio's own portable zip is ~422 MiB compressed and over 1 GiB expanded -- so the extractor refused the legitimate update and Install-and-restart failed with "total uncompressed size exceeds 536870912 bytes (possible decompression bomb)". The update extractor (which only ever runs on Quill's own HTTPS + trusted-host-verified release asset, and keeps the per-entry compression-ratio guard) now uses a bundle-sized 4 GiB ceiling. (`core/updates.py::UPDATE_MAX_UNCOMPRESSED`)
- **Quill Radio favorites keep their hand-arranged order on upgrade (quill-radio 2.1.2, #1168, #1178).** The Favorites sort-order setting added in 2.0.2 defaulted an *absent* key (a store written by an earlier version, favorites in the user's manual order) to Ascending A-Z -- silently re-sorting 30-plus carefully ordered stations on the first launch after updating. A missing key is now treated as "manual" so an existing order is preserved; only an explicit stored value re-sorts. (The display sort is non-mutating, so anyone already re-sorted by the old default can restore their order with Unsorted in Preferences.) (`core/radio/history.py`)
- **Speech Hub no longer crashes opening Dictation (Offline) (#1135, #1177).** `SpeechSetupDialog` gained required `kokoro_ok` / `kokoro_can_install` arguments on 2026-06-26, but the Speech Hub's offline dictation panel did not pass them until 0.9.0 beta 3, so 0.9.0 beta 2 raised `TypeError: SpeechSetupDialog.__init__() missing 2 required keyword-only arguments`. Fixed in beta 3 and now guarded by a source-contract test that fails if any required `SpeechSetupDialog` kwarg is ever dropped again. (`ui/speech_hub_dialog.py`, `ui/main_frame.py`)
- **NOAA Weather Radio Browse no longer shows empty states.** With a network connection, expanding a state in the Browse Stations "Weather / NOAA" branch showed nothing and moved to the next state -- every state, because the live WeatherIndex per-state endpoint returns only a feed *count*, not the feed URLs (those live in the full directory / bundled snapshot), so every station parsed online had no playable stream and was filtered out. Browse now sources a state's playable transmitters from the full-directory tier (the refreshed directory cache, else the bundled snapshot -- both of which carry feeds), hides states that have no re-streamed transmitter at all, and labels each state with its playable count. Works online and offline, and needs no per-state network call. (`core/radio/wxindex.py::playable_stations_for_state`)
- **Radio Reading Services shows the full curated list, not a shrunken one.** The list could collapse to ~7 services because the resolver mirrored NOAA's "live replaces snapshot" model, letting a narrow RadioBrowser keyword search stand in for the 20 hand-vetted bundled services (most of which -- ACB Media, WRBH, Sun Sounds -- are not literally named "radio reading" and so never come back from that search). The bundled curated list is now always shown, with any live-discovered services unioned on top and de-duped by stream URL; the update command reports the total you will actually see. (`core/radio/reading_services.py`)
- **iHeart Browse ordering and live favorites.** In the iHeart genre tree, the "0-9" bucket now sorts before "A" (it was after "Z") and stations within each letter are alphabetised. And adding a favorite while the Browse Stations window is open now updates its Favorites branch immediately instead of only when the window is reopened. (`ui/radio/browse_tree_dialog.py`)
- **The Source filter in station search shows a station under every directory it appears in.** A SomaFM channel that RadioBrowser also lists was de-duplicated to the RadioBrowser copy in the unified search, so picking **SomaFM** in the Source dropdown hid it (while TuneIn's copy, which resolves a different mount URL, survived and showed under TuneIn). The merge now records every directory that carried a de-duplicated station, and the Source filter matches against the full set -- so Groove Salad appears under SomaFM, RadioBrowser, and TuneIn alike. The result row still badges the winning source. (`core/radio/directory_search.py`, transient `RadioStation.alt_sources`)
- **Radio recordings survive a restart, and ask before resuming (R3).** A recording in progress used to be lost if QUILL (or Quill Radio) quit or crashed -- the ffmpeg child kept writing to a temp file nobody would ever find. QUILL now persists an active-recording marker at start and clears it on a clean stop, so a crash leaves a breadcrumb. On the next launch, QUILL reconciles the temp folder (moves any finished orphan files to your recordings folder, leaves a file still being written untouched) and, if a recording was in progress and is still within a 10-minute grace window, asks once: "A recording of WQXR was in progress until 9:00 AM. Resume it for the remaining 12 minute(s)?" with **Resume** (Enter), **Skip** (Escape), and a **Don't ask me again** checkbox that remembers your choice (always resume / never resume, changeable later in Preferences). Choosing Resume restarts the recording for the remaining minutes only. The marker is strict-discard on corrupt data, so a bad marker file can never drive a bogus resume.

- **Scheduled recordings fire reliably throughout their window, not just at the exact minute (R2).** The scheduler used to match the exact start minute, so a recording scheduled for 8:00 that the app reached at 8:01 (after a slow launch or a brief stall) silently never fired, and a failed start still burned the occurrence for the day. The scheduler now uses a next-due-timestamp window model: an entry is due from its start through the end of its duration (start + duration), so a late arrival starts with the remaining minutes and launch-time catch-up is free. Last-fired is stamped only on a successful start (a failure retries on the next poll within the window), once-only entries auto-disable after they fire, and a same-minute conflict (two schedules due while the recorder is busy) defers the second instead of burning it. The scheduler thread is now lock-guarded and wrapped in a catch-log-continue so it can never die silently, and embedded QUILL gets the same missed-recording report standalone Quill Radio already had.

### Improved

- **Recordings list stops flickering and keeps your place (R1).** The Recordings manager used to rebuild its whole list every refresh, snapping a screen reader back to the top and losing your selection. It now updates rows in place keyed by full path: a no-op when nothing changed, selection/focus/scroll preserved when it has, and status flips update the existing row instead of rebuilding it. The active recording is counted from the recorder itself (so a recording writing to a temp folder is no longer invisible), a firing schedule is no longer double-counted, completed one-time entries drop out of the scheduled count, the active row shows a live elapsed time, scheduled entries show their zone-labeled times, and the tray tooltip carries "(recording)".

- **Radio recordings harden against drops, dead streams, and a crashed host (R4).** Four pipeline fixes: (1) a reconnect now records only the *remaining* time to the original scheduled end, not a fresh full duration -- a 60-minute show that drops at minute 50 records a ~10 minute continuation, not another 60. (2) Output filenames are uniquified (" (2)", " (3)" ...) instead of silently overwriting -- the unconditional `-y` is gone, so a pattern without a `{time}` token no longer destroys an earlier recording of the same name, and continuation parts keep the original start timestamp in their name so they group together. (3) A drop is now classified fatal (disk full, HTTP 4xx such as a 404/410 the server took down) vs transient (a network hiccup or 5xx); a fatal drop stops spending reconnect attempts instead of spamming continuation files for a stream that is gone. (4) On Windows, ffmpeg is launched in a job object that dies with QUILL, so a crashed or killed host can no longer strand a bare ffmpeg writing to your temp folder; and the stop-and-wait fallback moved off the UI thread, so closing the window never hangs on a slow ffmpeg shutdown.

- **Quill Radio tells you about recordings it missed while it was closed (quill-radio #4).** The scheduler only records while the app is running, so a scheduled recording whose time passed while Quill Radio was closed used to disappear silently. On launch, Quill Radio now checks which enabled schedules (one-time, daily, or weekly, honoring each entry's time zone) came due during the time it was closed and announces a short summary -- "2 scheduled recordings were missed while Quill Radio was closed: WQXR at Tue Jul 14 8:00 AM; ..." -- naming up to three and collapsing the rest to a count. Nothing is announced when nothing was missed (or on a first run), and a long-dormant install is capped so it can't recite months of daily occurrences.

### Improved

- **Quill Radio now writes a log, and you can choose where (quill-radio #5).** The standalone app never configured file logging, so debug mode had nowhere to write; it now writes `quill.log` from launch (to `<data>/logs` by default), and **Preferences (Ctrl+,)** gains a **Log folder** field to point it wherever you like -- changing it moves the live log immediately, and a bad path is ignored rather than breaking logging. This completes the observable-radio work: verbose debug mode, ffmpeg stderr capture, discovery/engine/finalization logging, and settable temp/log locations all now land in one readable log.

- **More radio debug logging: playback-engine selection and recording finalization (quill-radio #5).** With radio debug mode on, `quill.log` now also records which playback backend was chosen for a station and why (preference + whether mpv is present), and how each recording ended and where its finished file landed. Internal cleanup rode along: the pure ffmpeg/ffprobe command and filename builders moved out of `recording.py` into a new `recording_commands` module (no behavior change; the recorder module dropped back under its size budget).

- **Radio stream discovery now leaves a debug trail (quill-radio #5).** With radio debug mode on, Find Streams from a Website logs each scanned page and the candidate links it kept (with the reason for each, including the iHeart/TuneIn portal-page follow), and the Triton/StreamTheWorld resolver logs which callsign resolved to how many playable streams -- so a "why didn't this station's stream show up?" question has an answer in `quill.log`. Every logged URL is redacted first. (More per-module coverage -- engine selection, reconnects, recording finalization -- follows with the recording-module decomposition.)

- **Radio recordings can use a temporary folder while in progress (quill-radio #5).** Recording Settings gains an optional **Temporary folder (while recording)**: when set, a recording is written there and moved to your destination folder the moment it finishes, so a half-written file never appears in your recordings folder and a fast scratch/SSD volume can absorb the write churn. The move is atomic on the same volume and falls back to copy-then-delete across volumes; if the move ever fails the finished file is left safely in the temp folder rather than lost, and an unusable temp folder simply records straight to the destination. Blank keeps today's behavior (record straight to the destination).

- **Radio recordings now write ffmpeg's diagnostics to the log (quill-radio #4/#5).** A recording's ffmpeg process used to send its stderr to the void (`stderr=DEVNULL`), so when a recording failed or produced an odd file there was nothing to look at. Its live stderr is now drained to `quill.log` on a dedicated reader thread (so it can never fill the pipe buffer and stall ffmpeg): error-shaped lines are logged at WARNING so a failing recording leaves a trail even without debug mode, everything else at DEBUG, and every line is redacted first in case a stream URL carries a token. With radio debug mode on, the recording also runs at ffmpeg's `-loglevel verbose`, so the whole connection-and-codec story lands in the log. Groundwork toward the fuller scheduled-recordings and observable-radio work still in progress.

- **Radio recordings: a visible folder by default, and the list stays readable (quill-radio #4).** New recordings now go to **~/Music/Quill Radio Recordings** (falling back to your home folder) instead of a buried AppData path you had to go hunting for. The Recordings list also stops auto-rebuilding while you're reading it -- the 2-second live refresh pauses whenever the list has keyboard focus and resumes when you move off it, so a screen reader no longer gets yanked back to the top mid-read (the Refresh button still updates on demand).

- **Low-vision: the favorites tree is legible again (quill-radio #3).** The saved-stations tree (on the Quill Radio main page and in Manage Favorites) now pins itself to your desktop's system window and text colours, so it honours your theme and Windows High Contrast mode instead of a bare default that could render near-invisibly. This is a contrast fix, not a dark-mode or theme setting.

- **Browse Stations: Country and Tag/genre are now dropdowns, not free text (quill-radio #2).** The Country field is a pickable list (with an "Any country" default) and Tag/genre is an editable combo box — both filled from RadioBrowser's own most-popular lists (fetched once per session, in the background) so you no longer have to guess the exact spelling of a country or genre. Tag stays editable so a rare custom tag still works, the station name stays free text, and picking a country or tag runs the search right away.

### New

- **Unified Find Stations: one search across every source, merged and filterable.** Browse Stations now folds all its sources into a single ranked list: results from RadioBrowser, iHeart, TuneIn, and SomaFM are de-duplicated (the same stream on two directories, or the same station name+country twice, collapses to one entry) and exact name matches float to the top. Each result carries a **Source** column, and a new **Source** dropdown filters the list to just one source without re-searching. A **Refresh Directory** button re-fetches iHeart's station directory (its two-request sitemap index) on demand, for when the catalog has grown since you opened the dialog — TuneIn and RadioBrowser are always live. And you can now **type (or paste) a website address right into the search box**: Browse Stations scans it for streams and shows what it finds badged as "Website", so the "Find Streams from a Website" capability lives in the same one search box (the dedicated button stays as a shortcut). Builds on the wx-free `directory_search.merge_and_rank` blend.

- **Radio verbose logging is now a Preferences checkbox (quill-radio #5).** The debug-mode logging control shipped as a foundation with no way to turn it on; standalone Quill Radio's **Preferences (Ctrl+,)** now has a **Verbose logging (debug mode)** checkbox. Turn it on and the radio logger subtrees drop to DEBUG and recording runs ffmpeg at `-loglevel verbose`, so a hard-to-reproduce playback, recording, or stream-recovery problem leaves a full trail in `quill.log`; it takes effect immediately (not just next launch) and persists across launches. Off by default (it is chatty).

- **Observable radio: a debug-mode logging control (quill-radio #5, foundation).** New `quill/core/radio/radio_logging.set_radio_debug()` raises just the radio logger subtrees (`quill.core.radio`/`quill.ui.radio`) to DEBUG, never the root, so verbose radio diagnostics compose cleanly when Quill Radio is embedded in full QUILL and land in the existing rotating `quill.log`. The raw-capture codec probe also now records ffprobe's own (redacted) stderr when it can't read a codec, instead of silently falling back. (Settable temp/log paths and full per-module logging coverage are follow-on work.)

- **Browse Stations now searches iHeart and TuneIn too.** A station search in the Browse Stations dialog fans out to iHeart and TuneIn alongside RadioBrowser and SomaFM and blends the results into one list, each non-RadioBrowser row naming where it came from ("… - via iHeart"/"via TuneIn"). TuneIn results resolve their real stream on the fly; iHeart matches come from its sitemap directory (fetched once per session) with each match's stream resolved lazily, so a search stays cheap. Both are bounded to a handful of resolved results per search and are failure-tolerant — a down source never blanks the list — and both are off entirely in Safe Mode. Builds on the iHeart/TuneIn core clients above; the wx-free blend helpers live in `quill/core/radio/directory_search.py`.

- **Set your Read Aloud voice engine straight from Download Optional Components.** The **Help > Download Optional Components** hub gained a **Set as Default** button for voice engines (Kokoro and the other Read Aloud engines): select a voice-capable component and press it to make that engine — and a voice you pick from it — the Read Aloud default, without opening a separate speech dialog. The button only lights up for components that can actually be a Read Aloud default and once the component is installed. Voice previews also stop cleanly now when you move on to another before the first finishes.

- **iHeart and TuneIn are now station sources for Internet Radio (core clients).** Two long-standing gaps in station discovery are filled with open, no-key, no-auth backends that resolve only what the user searched for or what a page already advertises — the same shape as the Triton resolver QUILL already ships, and never a scrape of anyone's data files. **iHeart** (`quill/core/radio/iheart.py`) reads iHeart's public XML sitemap — two GETs (the index, then the livestations sub-sitemap) yield the whole ~4,790-station list, and each station's real stream (a `revma.ihrhls.com` HLS or a StreamTheWorld redirect) is extracted lazily from its page on play, so a refresh is cheap and no bulk crawl ever runs. **TuneIn** (`quill/core/radio/tunein.py`) uses RadioTime's OPML API for live search, browse, and resolving a station's guide id to its playable stream, and can turn a pasted TuneIn station page into a resolvable station. Both are refused in Safe Mode, funnel through one reviewed egress site each, and stamp results with a `source` label (a new field on `RadioStation`) for the upcoming unified Find Stations view. This reverses the earlier "TuneIn/iHeart deliberately left out" non-goal (approved 2026-07-17; PRD §5.84f and the RadioBrowser module docstring updated to match). The station-browser wiring that surfaces these sources in the UI is a separate, following change.

### Fixes

- **Report a Bug: paste your whole report, not a 120-character summary (#1102).** The short field is now labelled **Title** (raised to 200 characters) and the long field **Description**, so it's clear the short field is just the issue title and the full report goes in Description -- rather than users hitting the old "Summary" field's 120-character cap and having nowhere to put the detail (thank you, Shane). Needs the bundled **feedback-hub 1.0.2**, which makes the same rename in its own default form and matches the GitHub issue-title length so the full Description always reaches the issue body.

- **Crash-recovery reports are now actionable, and a slow-but-normal shutdown no longer files a false one (#1079, #1085, #1095).** Two changes to the "Quill detected an unclean exit" recovery flow. First, when a real crash left a `crash-<timestamp>.txt` traceback behind, that traceback is now stitched into the auto-submitted recovery report — so a report carries the actual error instead of being log-only. Second, QUILL's own last-resort hard-exit watchdog logs its force-exit at ERROR level; on a *committed* shutdown that merely ran slow, that line used to read as a crash and offer recovery next launch with nothing behind it. The clean-exit marker is now written first thing on close (before the slower teardown steps), and the watchdog's own force-exit line no longer counts as crash evidence, so a slow-but-normal close stops producing empty recovery reports.

- **Check for Updates now downloads the installer for an installed build, not the portable ZIP (#1100).** The updater decides between the installer `.exe` and the portable `.zip` by detecting how you're running QUILL, but an *installed* build that happens to keep its data under `{app}\data` looked identical to a portable bundle (`quill.exe` + a `data` folder), so some installed users were handed the portable ZIP. Detection now also checks for the Inno Setup uninstaller (`unins000.exe`) that every installed build has and a portable extracted ZIP never does — the same signal the standalone Quill Radio/Cast apps already used — so an installed build reliably gets the installer and a portable build the ZIP.

- **"Go to Entry in Notebook" no longer crashes (#1109).** Opening the notebook entry navigator raised `TypeError: unhashable type: 'NotebookEntry'` — the tree navigator kept an internal lookup keyed by each node's payload, which fails when the payload is an unhashable object like a notebook entry. It now keys that lookup by the tree item itself (always hashable), so any payload type works. Affects every navigator that carries object payloads, not just notebooks.

- **Find Streams from a Website now fully resolves TuneIn station pages to a playable stream.** A scanned (or pasted, or linked-to) `tunein.com/radio/...` page carries no stream in its HTML -- it's served by RadioTime's keyless OPML API, keyed by the page's `s`-prefixed guide id. Find Streams now recognizes a TuneIn page (by its host), reads the guide id from the URL, and resolves the real stream through that API, the TuneIn counterpart of the iHeart/Triton resolution already in place (#1087). A directory page that merely links to a TuneIn station is followed one level like any portal link, and the resolution happens on the TuneIn page itself; a bare `s`-id on an unrelated site is never mistaken for a TuneIn station. Refused in Safe Mode; any resolution failure degrades to the normal scan.

- **Find Streams from a Website now resolves iHeart (and TuneIn) station pages to a playable stream instead of returning the page URL (#1087).** Scanning a site that links to an iHeart `/live/...` player page used to hand back the iHeart page URL itself — which does nothing when you press play — because `/live` is a stream-shaped path hint that short-circuited the scanner before it followed the link. iHeart/TuneIn portal page links are now followed one level deep like any "Listen Live" link, so the real stream embedded in the page's inline player (an `stream.revma.ihrhls.com/.../hls.m3u8` HLS URL, for instance) is extracted and offered instead. A station's own `/live/` path on its own domain is unaffected.

### Improved

- **What's Playing now falls back to the station's own now-playing endpoint when the stream sends no title (quill-radio #1111).** Some stations send no ICY `StreamTitle` and expose no in-band title, so "What's Playing" (Ctrl+T) and announce-on-track-change had nothing to report. When both of those come up empty, Quill Radio now reads the current track from the station server's own Icecast/SHOUTcast status endpoint (`/status-json.xsl`, `/stats`, `/7.html`) on the same host it's already streaming — no third party, no cost, refused in Safe Mode. This is the free tier of the recognition request; an optional acoustic-fingerprinting tier (a paid/BYO-key service like ACRCloud or AudD) is tracked separately. A literal Shazam integration isn't possible on Windows (ShazamKit is Apple/Android-only).

- **Scheduled radio recordings: 12-hour times, Edit/Duplicate/Enable, and per-entry time zones (quill-radio #7).** The Schedule Recording dialog now accepts a friendly time like `7:30 PM` as well as `19:30`; you can **Edit** a schedule in place, **Duplicate** one as the starting point for a variation (the ACB-convention "same show, several days" case), and **Enable/Disable** a schedule without deleting it — from buttons or the list's context menu. Each schedule can also carry its own **time zone**, so a Pacific listener can pin an Eastern show to Eastern time and it records at the right local moment (DST handled automatically); leaving the zone as "(local time)" keeps the previous behavior. Existing schedules load unchanged (no zone = local). This is radio source shared with the standalone Quill Radio.

- **Internet Radio now identifies itself by name in station logs (quill-radio #6).** Playback (mpv) and recording/probing (ffmpeg) used to reach stations as the generic `libmpv`/`Lavf`, so a station owner couldn't tell Quill Radio listeners apart in their logs. Both now send a `Quill Radio/<version>` User-Agent through one shared helper (`quill/core/http_client.py`), and the standalone Quill Radio app reports its own release version instead of the embedded QUILL version. The User-Agent carries no user-identifying information, and no new outbound hosts are added.

- **Manage Favorites: Move Up/Down now says where the station landed (quill-radio #1).** Reordering a favorite used to announce a bare "Moved down" with no context. It now names the neighbor it now sits next to — "Moved down, now above Delilah Stream" — reusing the same station labels the Mark-and-Move path already speaks. At a folder edge it names the other neighbor instead, so there's always a reference point.

- **Audio Studio: shared listening modules + workbench player contract.** The Chapter Workbench player gained a **Mute** button (Ctrl+M in the standalone shell) and public transport (play/pause, stop, next/previous chapter) so a host can drive it. `open_book_in_workbench` now accepts optional `on_player_ready` / `on_finished` / `on_volume` / `on_mute` / `on_closed` callbacks threaded through to `PlayerPanel` — embedded QUILL passes none (unchanged), and the standalone QUILL-AS Audio Studio shell wires them to route media keys, persist per-book volume/mute, stamp Recently Played, and auto-advance a play queue on finish-then-close. The new wx-free stores `quill/core/audio_studio/{book_prefs,history,library,play_queue,sleep_timer}.py` and the shared `library_tree`, `play_queue_dialog`, and `sleep_timer_dialog` UIs live in `quill/` and are vendored into QUILL-AS; each `save_*` site is classified in the persistence audit and every focusable control carries an accessible name. The two Workbench helper dialogs (silence params, ACX result) moved to `chapter_workbench_dialogs.py` to keep `chapter_workbench.py` within the GATE-11 size ratchet.

### Fixes

- **AI Hub (and sibling AI dialogs) no longer crash if closed while a background probe is in flight (#1067).** The AI Hub's Ollama auto-probe, List-models, and Test-Connection actions run on a background thread and post their result back to the UI via `wx.CallAfter`. If you closed the dialog before the probe finished, the queued callback touched a `StaticText`/`Button` that wx had already torn down and raised `RuntimeError: wrapped C/C++ object of type StaticText has been deleted`. Those callbacks (and the same-shaped ones in AI Thesaurus lookup, AI Document Q&A ask, and the AI Model download) now check a shared `dialog_alive` guard and no-op when the dialog is gone. No behavior change when the dialog stays open; the result simply isn't shown for a dialog you've already closed.

- **AI agent result and AI thesaurus dialogs no longer crash on open (#1091, #1094, #1097).** Both `AI > AI Thesaurus...` and the agent/writing-assistant result dialog called QUILL's modal-dialog gate without the `label` argument that names the modal region for screen readers -- so either dialog crashed with `TypeError: MainFrame._show_modal_dialog() missing 1 required positional argument: 'label'` the moment it tried to appear, reported independently by three testers. Both now pass their dialog title as the label, matching the AI Hub and AI Model dialogs that already did. No behavior change beyond the crash going away; the dialogs were always meant to open.

## 0.9.0 Beta 3

The headline: **One Editor, Every Format** — the braille fix is on for everyone by default, and QUILL gains true rich text editing. Plus bug fixes driven by beta 2 community reports and eight small accessibility-first features. Rolls up on top of 0.9.0 Beta 2 (below).

### One Editor, Every Format (the Beta 3 highlight)

- **The braille fix ships on by default — #616 and #813 are closed for every user.** Beta 2 asked braille display owners to test an experimental combination; live JAWS + braille testing confirmed it works. QuillRichEdit — the same native Windows Rich Edit control QUILL always shipped, now with its Text Object Model wrapper — is THE editor surface, with the fix applied out of the box: text renders from braille cell 1 (no more "cell two" Word quirk) and selections show dots 7-8. Two plain checkboxes own the whole fix on **Preferences > Braille**: "Fix braille cell alignment and selection dots (recommended)" and "Hide editor border (required for braille cell alignment)" — live testing showed the visible border itself pushes braille out of cell 1, so the hidden border is part of the fix, not cosmetics. Both default on and are forced on for upgraders (old experimental overrides are dropped with a one-time notice); unchecking the border warns, specifically, that cell alignment will break. The whole Experimental-tab surface picker retired with this — the experiment is decided, and its engineering post-mortems are preserved in `docs/engineering/editor-surface-history.md`.
- **Rich mode: .rtf documents open as real rich text.** An RTF now loads natively through the control's Text Object Model — no conversion to Markdown on open, no fidelity loss on the round trip. Bold means bold: Ctrl+B applies genuine bold, Insert Heading 2 applies a real sized-and-bold heading, and Describe Formatting at Cursor answers from the live control ("Arial, 14 point, bold, centered") instead of parsing markup. Search, spell, AI commands, read-aloud, bookmarks, notes, and braille all keep working — both modes expose the same plain text. Autosave snapshots rich documents as RTF bytes alongside the text snapshot, so crash recovery restores formatting, not just words. Where the native path is unavailable (macOS without the PyObjC extra, comtypes missing), .rtf opens **converted** exactly as before — never a blank editor, never a lost document.
- **Mode-polymorphic formatting: one command, one shortcut, the right effect for your format.** In Markdown, Ctrl+B wraps `**`; in HTML, `<strong>`; in rich text, real bold via the native control. The Format menu's font, size, color, highlight, and alignment commands route the same way. In plain text — which cannot carry bold, that's the promise of .txt — the first formatting command asks once: treat as Markdown, convert to Rich Text, or stay plain (and then stays quiet).
- **The Document Format switcher.** **Format > Document Format...** (also Ctrl+Shift+Grave, K; the command palette; and the new interactive **Format** status bar cell) moves the current document between Plain text, Markdown, HTML, Rich Text (RTF), and Word (.docx) mid-session, converting through the RichDocument bridge. Anything lossy warns first with the *specific* inventory of what won't survive; a format switch retargets the file type on the next Save As — QUILL never silently writes a different format into the old extension. This closes #893 (making rich editing "discoverable") a different way than originally proposed: rather than surfacing the old read-only Rich Text lens, that lens is retired outright and the switcher becomes the one, in-context way to move any document into real rich editing.
- **Editable rich Word documents (.docx) — with your original protected.** A .docx can now open for real rich editing (headings, bold, fonts, colors, alignment), saved back as a genuine Word file. Because Word can carry things QUILL's editor cannot (tables, images, comments, tracked changes, headers/footers), the open is honest: a clean file opens rich directly; a file with flagged features asks — open for reading and plain editing (the safe default), edit as Rich Text with the losses named specifically, or edit a copy. The first rich save over a flagged original writes a timestamped backup alongside it, and read-extract plus faithful export remain exactly as before when python-docx is unavailable.
- **macOS comes along — batteries included.** The Mac editor is an NSTextView underneath, and a new PyObjC-based wrapper mirrors the Windows rich API over Cocoa's text model — same commands, same heading sizes, same everything. The Mac app **bundles the bridge**: nothing for users to install (the py2app build now explicitly includes objc/AppKit/Foundation, which the import tracer used to miss because the imports are lazy — a fix that also makes the existing VoiceOver editor-role pin actually ship inside the .app instead of silently no-op'ing). Source installs get it via `pip install "quill[mac]"`. If the bridge is ever absent, macOS degrades to converted rich: all shipped code, no new failure modes. VoiceOver hardware verification is the promotion gate — the release notes ask Mac users to report through Help > Report a Bug whether it works, good or bad.

### Fixes

- **Browse Stations opens again.** The Internet Radio station browser died before it could appear -- a stray sizer alignment flag tripped a wx assertion in the dialog's constructor -- so the Browse Stations button and menu item both looked dead, in QUILL and in standalone Quill Radio alike. One flag removed; every Radio dialog path is now exercised headlessly in review.
- **The optional audio pack now downloads whole.** "Audio: export, playback & chapters" in Download Optional Components used to fetch only the mpv player and MP3 chapter support, leaving FFmpeg to a second, surprise download the first time you exported compressed audio or recorded radio. Download now installs everything missing in one go -- one progress bar, FFmpeg's larger share weighted so the percentage moves honestly -- and Remove cleans up both managed folders. Pieces already installed are skipped, and each piece still auto-fetches individually at first use if you never visit the dialog.
- **The Application Status page (Help > Status Page) is navigable again (#969).** The page auto-refreshes every 2 seconds to keep task and download progress current, but the refresh rebuilt every list from scratch and forgot which row had keyboard focus — so pressing Down to move through the list got silently undone by the next tick, snapping focus back to the top before you could act on where you'd navigated. Each list now remembers and restores its focused row across a refresh, so the page is navigable the way any other accessible list is. Reported with exact repro steps that made the root cause obvious.
- **Narrator is now a first-class announcement target — no more double speech (#966).** Two layers of fix. Detection: alongside the process check, QUILL now also reads Windows' own API-level "Narrator is running" marker (the named `NarratorRunning` event, one cheap system call), so Narrator can never be missed. Speech: QUILL now talks to Narrator *directly* — announcements are raised as UI Automation notification events, the channel Narrator (and other UIA-aware readers) listens on, so you hear QUILL's announcements in your own One Core voice. When that channel is unavailable, the message goes to the status bar; the SAPI self-voice never runs while any screen reader is live, "forced" announcements included — that bypass was the double-speech. JAWS and NVDA behavior is unchanged (their dedicated bridges still take priority). Reported by George Kerscher; the direct-Narrator channel needs on-device Narrator confirmation, which this beta asks for.
- **Install Starter Snippet Packs is now genuinely accessible (#959).** The old checked-list dialog required pressing Space on an invisible checkbox with no feedback, and Enter on a merely-highlighted pack said "No packs selected." It is now a plain multi-select list: arrow to a pack and press Enter to install it — one step — or hold Shift/Ctrl to select several; NVDA and JAWS announce selection state natively.
- **A macOS crash while creating a Notebook (#956).** A window-activation event handler could crash the whole app when a wx string-array assertion fired during dialog teardown ("SystemError: ActivateEvent returned a result with an exception set"). Frame activation is a focus nicety, never worth the process: the handler is now fully contained, and the deferred focus-return tolerates a torn-down editor. Reported by Shannon Dyer.
- **Crash and feedback reports now say which beta you're on (#967/#968 triage).** Every 0.9.0 beta reported its version as just "0.9.0," so a crash long since fixed (the Profiles and Features `_LazyString` crash, fixed in Beta 2 as #878/#879) looked like a live regression when reported from a Beta 1 install. Reports now carry the channel-annotated version ("0.9.0 Beta 2") everywhere a version appears.
- **Portable updates left you with an unopened .zip and no in-app way to use it.** Downloading an update while running portable always ended in the same "Open folder" / "Close" dialog an installer download gets — but a portable update is a ZIP, not something you run, so "Open folder" just handed you a raw archive to figure out yourself. Quill now offers **Extract now** for a downloaded portable update, which unzips it into a ready-to-run sibling folder and reveals that instead of the raw archive. (We also verified the underlying portable-vs-installed asset selection and version-check logic directly against a real portable build during this investigation — it correctly detects portable mode and downloads the portable ZIP, not the installer, matching what was reported. This fix addresses the actual friction: reaching for the ZIP still left you to extract it by hand.) Quill still doesn't replace its own running files in place — you still copy your `data` folder over and swap folders yourself — but you no longer need to know how to unzip an archive first.
- **Pandoc EPUB (and other) imports could silently produce an empty document (#954).** `run_subprocess_safely` decoded a subprocess's output using the system's default locale encoding rather than an explicit one — on a Windows machine whose locale defaults to a legacy code page like CP1252, Pandoc's UTF-8 output could fail to decode, leaving `stdout` as `None` while still reporting success. The import then silently produced an empty document with no error at all. Output is now always decoded as UTF-8 (with `errors="replace"` so a genuinely non-UTF-8 byte never crashes or blanks the result, just shows a visible replacement character), and Pandoc conversion now explicitly raises if it ever gets no output instead of silently returning an empty result. Root-caused and reported with the exact fix by a community member — thank you.
- **Speech and Dictation crashed on open (#949, #950, #952, #953).** Opening Tools > Speech > Speech and Dictation raised `TypeError: SpeechSetupDialog.__init__() missing 2 required keyword-only arguments: 'kokoro_ok' and 'kokoro_can_install'` every time, on both Offline and Online tabs — reported independently by four testers. `open_speech_hub`'s shared `common_dict_kwargs` was missing both keys; they're now populated from `is_kokoro_onnx_available()`/`kokoro_onnx_install_supported()`, matching the existing `vosk_ok`/`vosk_can_install` pattern exactly.
- **A crash on macOS when a keystroke arrived before the first document existed (#951).** `_focus_is_in_document_surface()` read `self.editor`/`self.notebook` directly instead of defensively, unlike the `_documents_panel` check right above it, so `AttributeError: 'MainFrame' object has no attribute 'editor'` could reach the global character hook. All three checks are now consistently `getattr`-guarded.
- **"Go to Entry in Notebook" and other shared tree-navigator dialogs no longer crash on open (#939).** This was already fixed on `main` for #885 before Beta 2 shipped (verified: `_show_tree_navigator` no longer calls the invalid `tree.Expand()` on its hidden root) — documented here for anyone who filed or found the same report against a Beta 2 build.
- **The Kokoro-voices-unavailable error pointed at a menu item that doesn't exist.** Selecting a Kokoro voice without the `kokoro-onnx` package installed said "Tools > Speech > Install Kokoro ONNX will fetch it" — but that menu item was consolidated into **Help > Download Optional Components** during an earlier release and the error text was never updated to match. It now names the real location. Reported by a community member alongside the #949/#950/#952/#953 Speech and Dictation crash above (same offline-installer testing session).
- **On macOS, the G key stopped typing and opened Find instead (every keystroke, both cases).** Find Next is bound to Cmd+G on macOS. Quill builds each menu item's keyboard-shortcut hint by embedding it after a literal tab character, which wx parses as a real native accelerator, independent of Quill's own dispatch. wx recognizes "Ctrl", "Alt", and "Shift" in that string, but not the literal word "Cmd" — it silently dropped the unrecognized modifier and kept the bare key, so "Find Next␉Cmd+G" quietly became a native accelerator for a bare, unmodified **G**, intercepting the letter everywhere in the app before it ever reached the document. This is the same bug class as #612 (the QUILL Key chord display), just triggered by a different unrecognized modifier word. Every macOS-only "Cmd+…" shortcut is affected, not just Find Next — the fix translates "Cmd" to "Ctrl" only in that one native-parsed slot (wx already renders "Ctrl" as the ⌘ symbol on macOS), so the visible shortcut still reads "Cmd+G" everywhere a person actually looks at it.
- **Portable updates that finish downloading but still show the old version after restart are not silently applying themselves — nothing does that today.** A community member asked why QUILL still reported the old version after downloading and restarting. Portable updates have never auto-applied, on any QUILL release: the ZIP always lands in your updates folder and needs your own action to use it (previously a bare "Open folder" button; this release's Extract Now, above, does the unzip step for you). If you've downloaded an update and restarted expecting it to just be there, that is the gap — copy your `data` folder into the newly extracted version and launch from there. We've reworded the in-app text and this release's notes so "swap it into place" reads as the manual step it always was, not something QUILL does for you.
- **A per-machine install (Program Files, all users) no longer needs administrator elevation for SAPI, Narrator, or Rich Edit to work at full speed.** comtypes writes generated COM wrappers to disk the first time it touches a given type library — SAPI's voice, Narrator's UIA notification bridge, and the Rich Edit rich-text object model each touch a different one. QUILL already redirected this cache to a writable per-user folder for SAPI, but Narrator's and Rich Edit's own comtypes calls only got that redirect if SAPI happened to run first in the same session — an accident of import order, not something QUILL actually guaranteed. Every comtypes call site now requests the redirect itself before touching comtypes, so none of the three ever depends on this happening to work first. Reported by Tyler Rodick on the BITS mailing list, who noticed startup was several seconds faster running as administrator under a Program Files install — the case this closes.
- **File > Notebook > Manage Versions no longer renders as a silent, unexplained blank list.** A notebook with no saved Versions yet showed an empty list with no placeholder and no clue whether the feature was broken — a long-standing rough edge noted in planning (`docs/planning/roadmap.md`'s "Snapshots vs Versions"). The list now shows "(No versions saved yet)" and disables Rename/Delete until there's something to act on, matching the "(No open documents in workspace)" pattern already used elsewhere in QUILL.
- **Insert > Date and Time's submenu now actually opens (#974).** Pressing Right Arrow on it jumped straight to the next top-level menu instead — because Quill builds its menu bar before Quillins (including the bundled `insert-tools` Quillin that supplies Insert Date / Insert Time / Insert Date and Time) finish loading, the submenu was silently empty every session, with nothing there for Right Arrow to open. Quillin loading now rebuilds the menu bar once it finishes, both at startup and after any enable/disable/install/remove/reload in the Quillins Manager, so contributed menu items — this submenu's three entries, and any other Quillin's Insert/Format/Search contributions — actually appear. Reported by Jayson Smith.
- **Quill no longer offers crash recovery for exits with nothing to diagnose (#940, #948).** Two reports showed a log with only routine idle-sweep entries — no exception, no traceback — consistent with the process being killed externally (an OS shutdown, a forced close) rather than a QUILL bug. Quill now checks the log for real error evidence (`ERROR`, `CRITICAL`, or a traceback) before offering recovery at all; an inconclusive exit is treated the same as a clean one for the *offer*, and the "Quill detected an unclean exit" dialog no longer appears with nothing behind it. A genuine crash still logs an error and still offers recovery exactly as before — nothing about real crash detection changed. The autosave snapshot itself is never touched by this; only the prompt is suppressed.
- **Filed crash-recovery reports now include the evidence that justified them (#1013).** A follow-up report's filed body showed only routine log lines with no visible error, looking like a false-positive recovery offer. Root cause: the filed report bundles only the last ~6,000 characters of the log, while the offer-gating check above scans a much larger window (~256 KB) near the end of the file — so a genuine error early in that window could correctly justify the offer without ever appearing in what got filed. `quill.core.recovery.find_error_evidence()` now extracts the actual matching lines (with context) from that same window and includes them in the filed report, so a recovery report is self-explanatory instead of a mystery to whoever triages it.
- **macOS VoiceOver now announces what a control is for, not just its bare value (#1012).** A community accessibility audit found two related gaps: many hand-built dialogs relied on a Windows-only convention where a neighboring `StaticText` label implicitly names a control — VoiceOver does not infer that association and announces nothing, or just the value; and every `SpinCtrl`/`SpinCtrlDouble` (used throughout Preferences and elsewhere) is a composite control on macOS whose inner text field needs its own name even when the composite itself was named, so a "named" spinner could still read as a bare number. A new shared helper (`quill.ui.dialog_contract.set_accessible_name`) names a control from its visible label (stripping the `&` mnemonic and trailing colon) and, for spin controls, names the inner field too. Swept across every affected dialog the audit identified — Preferences, Watch Folder profiles, Export/Import, GitHub dialogs, Quick Nav, Heading Organizer, List Manager, Regular Expression Helper, and dozens more.
- **A community bug report crashed QUILL on autosave with a `UnicodeEncodeError`.** Autosave snapshots were written using the source document's own encoding (e.g. "ascii" for a file read as Braille Ready Format) instead of UTF-8 — any character outside that narrower range (reproduced live with a U+2004 space introduced via abbreviation expansion) crashed the write outright. Recovery always reads a snapshot back as UTF-8 regardless of the source document's encoding, so the writer now always writes UTF-8 too; a defensive try/except around the autosave call also keeps any future write failure from ever interrupting editing.
- **Radio and Podcasts could crash QUILL on every launch with `AttributeError: 'MainFrame' object has no attribute 'frame'`.** The Radio and Podcast player controllers were being built before `self.frame` existed in `MainFrame.__init__`, so parenting them on the not-yet-created frame failed immediately. Both now initialize right after the frame is created.
- **Downloading the Braille Translation Pack didn't make Translation appear without a restart.** Same root cause as #974 (Quillin menu contributions): the download's success handler refreshed menu-item *state* but never rebuilt the menu's *structure*, so the Tools > Braille > Translation submenu — which only exists once the pack is installed — stayed absent until the next launch even though the pack was correctly installed on disk. The direct "Download Braille Translation Pack..." menu item also now routes through the Download Optional Components hub (matching the existing "Set Up Braille" flow) instead of dropping you back into the editor when the download finishes.
- **Back/forward-translating a large BRF file failed instantly, with no clear explanation.** The whole document's text was packed into a single command-line argument to the liblouis worker subprocess; Windows caps total command-line length at roughly 32,000 characters, so any sizeable BRF file (reproduced live on a ~450 KB hymnal) failed to even launch the worker. The request now travels over the worker's stdin, which has no such limit, and a translation failure now also shows a visible dialog rather than only a spoken announcement that was easy to miss.
- **Fixed the AI Setup Wizard treating a working local Ollama as "not there," and asking for a cloud API key instead.** A never-configured install's saved settings default to "Ollama," which the wizard's "remember what you already set up" logic mistook for proof you'd deliberately added Ollama — so on first run, the wizard silently marked Ollama as already added, dropped it from the Provider list, and left only key-requiring cloud providers to choose from. It now confirms a local Ollama server actually answers before treating it as configured, so Ollama shows up normally when it should. The AI Hub's Provider tab had a related, simpler bug: the API key field stayed active for every provider regardless of whether one was needed, which is why Ollama's key field looked required even though nothing ever enforced it; it now greys out correctly for Ollama and any other no-key provider.
- **Fixed the AI Setup Wizard's Connect step landing you in the API key field instead of the Provider list, and its Remove button looking clickable before you'd selected anything.** Reaching the "Connect your AI providers" step (or removing a provider from Added) could jump focus straight into an API key field when the next provider in line happened to need one — jarring, and easy to mistake for "Ollama needs a key too." Focus now always starts on the Provider list itself. Remove selected also now stays disabled until you've actually selected an entry in the Added list, instead of looking usable the moment anything was added.
- **Ollama's server address is now a real, editable field — for a self-hosted or LAN Ollama, not just localhost.** The Setup Wizard always checked `localhost` and never let you point it anywhere else, even though the option to reach Ollama on another computer on your network was never actually wired up end to end. A new **Ollama server address** field on the Connect step (enabled only when Ollama is selected, defaulting to localhost) is used for the actual verify, model list, and Finish steps, so an Ollama running on another machine is a real, working choice.
- **Preferences now lands you on the right control when you switch tabs, not on a bare "Panel."** Using Ctrl+Tab or Ctrl+Shift+Tab to move between Preferences tabs (or clicking a different one) moved the visible page but left focus wherever it had been, so a screen reader sometimes announced just "Panel" instead of the new tab's first field — for example, the "Enable experimental features" checkbox on the Experimental tab. Switching tabs now always moves focus to that tab's first real control, the same routing every other tabbed dialog in QUILL already uses.
- **Audio Studio's batch export finally has a working Cancel button.** Generating audio for a folder of documents had no Cancel button at all, and pressing Escape just dinged — there was no way to stop a run short of killing QUILL outright. Cancel (and Escape) now work: whatever file is currently synthesizing finishes normally (so you never end up with a half-written audio file), and the run stops cleanly before starting the next one.
- **Audio Studio's log file now shows the same progress you see on screen.** The diagnostics log only ever recorded which document was up next, not the chunk-by-chunk progress within a document that the on-screen dialog already showed — so a log-only look at a run in progress (or a stalled one) told you far less than watching the screen did. The log now mirrors that same chunk-by-chunk detail.
- **Audio Studio: WAV exports get their own subfolder; MP3 still lands beside your document.** Choosing WAV as your export format used to drop the (often large) file right next to your source document, the same place MP3 already lands. WAV output now goes into an **Audio Output** subfolder next to the document it came from — and when exporting recursively through a folder of subfolders, each subfolder gets its own Audio Output folder rather than everything funneling into one shared folder at the top.
- **QUILL now warns before Alt+F4 (or the window's close button) silently abandons real work in progress.** Closing QUILL while an Audio Studio export was running used to just exit immediately, mid-job, with no warning. QUILL now asks first — close and stop it now, or leave QUILL open so it can finish — and mentions **File > Send to Tray** as a way to keep it running quietly in the background instead. Routine background activity (search/replace, dictation, downloads) is unaffected; only real, hard-to-redo jobs like an Audio Studio export trigger the warning.
- **A background task's very first status update could be silently dropped on a freshly-started QUILL.** The coalescing logic that throttles rapid-fire progress updates (so a fast task doesn't flood the UI with redraws) judged whether enough time had passed since the *last* update using a clock that starts counting from an arbitrary point rather than from zero — on a machine that had been running for under about 17 minutes, that arithmetic could come out negative, and the first update from a task never reached the screen. Now the first update from any task always gets through, regardless of how long the machine has been on.
- **Check for Updates could hand a Windows user the macOS download.** When a tagged release publishes assets for only one platform — as happened when the Windows Beta 3 build failed in CI while the macOS build succeeded — the asset picker's last-resort fallback returned *any* remaining asset rather than none, so a Windows client got pointed at the release's lone `.dmg`. Asset selection now excludes every other platform's installer extensions outright, and a release with nothing installable for the running platform is skipped entirely so Check for Updates falls back to the newest release that does have a matching build, instead of ever offering a foreign-platform link.

### New

- **Internet Radio grows up: a Favorites Manager, a Recordings shelf, and recordings that survive a dropped connection.** Three connected additions, identical in QUILL (Tools > Media) and standalone Quill Radio. **Manage Favorites...** organizes saved stations the way Podcasts organizes shows: folders of any depth (News/Morning style -- old favorites files load unchanged), Move Up/Down inside a folder, Mark for Move plus Move Above/Move Below for long hops (the moved station joins the destination's folder), a live search across names, countries, languages, tags, and folder names, folder rename (F2), and folder delete that walks its stations safely back to the top level -- stations are never deleted with a folder. The Favorite Stations submenu mirrors the same nesting. **Recordings...** is the whole recording life cycle in one list -- what is recording right now (size growing live), every finished file (newest first), and upcoming scheduled recordings with their times -- with Play (through the shared player), Stop Recording, Open in Folder, and Remove. **Recording now reconnects**: when the internet hiccups mid-recording, ffmpeg first rides out short gaps itself, and if the connection truly dies the recorder waits and resumes into a numbered part file -- attempts and spacing are yours to tune in Recording Settings, and every retry is announced. Starting any stream now also silences whatever else was playing (radio or podcast), so nothing ever double-plays. The standalone apps additionally gain QUILL's own Command Palette (Ctrl+Shift+P), naturally scoped to each app's commands.
- **Podcasts Phase 4: the podcast app grows up — pinned views, an Inbox, a Play Queue, transcripts, notes, local podcasts, and more.** The Podcast Manager's folder tree now leads with four pinned views: **Favorites** (mark any show from its context menu), **New Episodes** (every unplayed episode everywhere), **Continue Listening** (everything you're partway through), and the **Inbox** — a personal triage layer that organizes *episodes* rather than shows: route a show to the Inbox and its new episodes appear there regardless of library folder; file episodes into your own nested Inbox folders, with the first manual filing per show remembered and auto-applied (and a Forget command to revert). A cross-show **Play Queue** (Play Next / Add to Queue on any episode) auto-advances when an episode ends and survives restarts, with fully keyboard-accessible reordering (Move Up/Down plus Mark-and-Move for long hops — the Interactive Rebase pattern). **Search Everywhere** searches shows, episodes, your notes, and already-fetched transcripts at once, jumping straight to the result; episode and show **filters** narrow the list live. Feed-provided **transcripts** (Podcasting 2.0; VTT/SRT/JSON) save to a file or open in the editor, cached for instant reopening and searching. **Episode notes** timestamp a moment in whatever's playing; Enter on a note jumps playback there. **Local podcasts** turn your own audio files into shows (stored outside your synced data folder by construction), with optional **watched folders** that turn dropped files into new episodes. **Subscribe to ACB Media Podcasts** brings in ACB's whole live directory in one idempotent, stream-only command. **Always Sync** backfills and downloads a show's entire catalog (with an honest keep-all retention nudge); **auto-trim silence** and **normalize loudness** process finished downloads with the audiobook builder's own ffmpeg passes; a **volume boost** control raises quiet audio live without disturbing the volume the Sleep Timer restores. Pause/stop/switching away now also *saves* your position (resume always knew how to read it; now it's reliably written). Standalone **QUILL Cast** inherits every bit of this, plus its own menu items for local podcasts, watched folders, ACB Media, and episode notes.
- **Quill Radio and QUILL Cast: Radio and Podcasts as their own standalone apps.** Sometimes you just want the radio on, or your podcast queue, without loading the whole editor. Quill Radio (`run-quill-radio.bat`, or `python -m quill.apps.radio`) and QUILL Cast (`run-quill-cast.bat`, or `python -m quill.apps.podcasts`) are small standalone apps with their own window, menu bar, and system tray icon. They are not forks: each one runs the exact same feature code QUILL itself uses — same station browser, same podcast manager, same download queue, same dialogs — through a thin shared shell (`quill/ui/app_shell.py`), and they read the same settings, favorites, and subscriptions from the same place, so what you subscribe to in QUILL Cast is subscribed in QUILL. Quill Radio's menu bar covers Station (browse, add custom, link finder, favorites inline), Playback (with a live now-playing line), and Record (record now, schedule, settings); QUILL Cast covers Subscriptions (manager, add, OPML import/export, settings), Episode (play/pause, chapters), and Downloads (pause/resume all). Both apps open on a real, keyboard-first main panel — favorites (Radio) or subscribed shows (Cast) focused on launch, Enter to play or open the manager — with both tray icons mirroring the same radio/podcast sections QUILL's own tray shows, plus Show and Exit; both carry Help > Open in Quill to launch the full editor when you need it. One standalone-only difference: QUILL Cast's "Send Show Notes to Editor" copies the notes to the clipboard instead, since there is no editor buffer to send to. The installer now puts both apps in the Start Menu (with optional desktop icons) alongside QUILL itself.
- **Braille translation gets magical: auto-detected codes, one-command BRF conversion, and an engine that works everywhere.** Three connected changes. **You never pick a braille code again** — Back-Translate to Text (Auto-Detect Code), now the first item on the Translation submenu, samples your document (or selection), tries UEB Grade 2, UEB Grade 1, legacy American (EBAE) Grade 1 and 2, and computer braille, scores how much each result reads like real English, and announces the winner ("Detected UEB Grade 2 (contracted)") — you learn what your file is instead of being asked. When a file is uncontracted, QUILL says Grade 1 even though the contracted table would also have decoded it; the honest label wins ties. **Convert BRF File to Document...** goes from a `.brf`/`.brl` file on disk to a readable draft in one command — detect, back-translate, open — and because the draft is a normal document, Save As exports it to Markdown, HTML, Word, or plain text: BRF in, any format out. **The engine now works from every kind of install** — the translation worker previously required a separately installed Python liblouis binding that nothing actually installs, so running from source always failed with "liblouis is not installed" even with the pack present; the worker now falls back to the pack's own bundled `lou_translate` engine (which has shipped with the pack all along), so installed, portable, and source-checkout builds all translate identically out of the box. Detection runs all candidate codes in a single worker launch, and every failure surfaces as a visible dialog, never just a missable spoken message. And **File > Convert File... now accepts braille sources directly**: `.brf`/`.brl` appear in its file picker with every other document type, dispatching to the auto-detecting braille path (Pandoc has no braille reader) — one converter dialog for everything, braille included, with the full output-format list (Word, HTML, EPUB, and the rest) available via a Markdown intermediate.
- **The Sticky Notes Browser: every note, one hotkey away — from anywhere in Windows.** Tools > Sticky Notes Browser... (or a global hotkey you assign; see the next entry) opens a fast, keyboard-first finder: a search field filters your notes live as you type (titles and bodies, case-insensitive), Down-arrow drops into the results (newest first), Tab lands on a read-only multi-line preview of the selected note, and **Edit** (or Enter, or double-click) opens the full note editor. Invoked from another app via its global hotkey, QUILL's window is restored first so the browser always actually appears.
- **Global Hotkeys: your keys, anywhere in Windows — bounded by a safety allowlist.** Tools > Global Hotkeys... lets you bind system-wide key combinations (they must include Ctrl or Alt, so a bare letter can never be swallowed everywhere) to a curated list of commands that are genuinely safe to fire from outside QUILL: Radio and Podcasts transport (play/pause, stop, mute, volume), New Sticky Note, the Sticky Notes Browser, and Post to Mastodon (which only opens the compose dialog — nothing ever auto-sends). That list is the boundary by construction: nothing that edits a document or deletes anything can go global, whatever the settings file says, and a unit test guards the allowlist's shape. Assignment captures the next combination you press; conflicts with another app's hotkey are reported by name and simply stay inactive until you pick a different key; reassigning a key from one command to another steals it cleanly. Every global press speaks its outcome through the announcement engine, so triggering play/pause from your browser still tells you what happened. Dispatch runs through the same command gate as menus and the palette, so feature gating and the remote kill switch apply identically. Windows-only (the OS provides no macOS equivalent); your existing sticky-note hotkey keeps working untouched unless you override it here.
- **Help > Redeem Unlock Code... — signed, offline feature unlocking.** Some capabilities ship locked until they're ready for everyone and are enabled selectively for early testers and staged rollouts. An unlock code (starts with `QUILL-`) is verified by Ed25519 digital signature entirely on your machine — no network, nothing transmitted — and a valid code lifts its feature's lock immediately, announced by name, persisting across restarts. Expired or tampered codes are rejected with a spoken reason. No code? Nothing changes: every standard feature works without one.
- **QUILL Sync: carry your settings and your projects between devices, without QUILL running a sync service.** Two small, honest features rather than one large custom one. **Sync via a folder** — the existing "Where should QUILL store your data?" option (Help > Personalise QUILL, or the first-run wizard) is now documented as a sync strategy: point it at a folder OneDrive, Dropbox, Google Drive, or iCloud already keeps in sync, and your settings, snippets, dictionaries, and keymap travel with it — QUILL just writes to the folder, the sync client does the rest (don't run QUILL from two devices against the same folder at the same time; there's no conflict resolution for this path). **Sync Folder with GitHub...** (Tools menu) is new: point it at any folder — a writing project, a notes folder, anything — and QUILL commits, pulls, and pushes it over that folder's own git remote, the same accessible commit/pull/push engine Vault's "Sync Vault" already used, generalized to work on any folder. A folder that isn't a git repository yet, or has no remote configured, is never silently set up — QUILL explains exactly what will run (`git init`, `git remote add origin <url>`) and asks first. Conflicts are listed by name, never auto-merged. Relies on your own git installation and its own credentials (SSH key or your system's git credential manager), same as running `git push` from a terminal. We deliberately did not build a QUILL-branded sync engine with its own cloud accounts — the design considered and rejected is recorded in `docs/engineering/sync-engine-history.md`.
- **The Clipboard Collector is now system-wide (#964).** Toggle it on and *anything* you copy — in your browser, your mail client, anywhere in Windows — appends to the open QUILL document, EdSharp-style, not just copies made inside QUILL. It watches the OS clipboard change counter (one cheap system call per tick, no clipboard access unless something actually changed), collects each distinct copy exactly once, and still autosaves after each collection as before. Also works on macOS via the pasteboard change count. Requested by Dean Martineau.
- **QUILL works as Thunderbird's external editor (#965).** Verified and documented: QUILL opens one process per file and exits when you close it — exactly the contract Thunderbird's "External Editor Revived" add-on expects. The user guide's new "Using QUILL as an external editor" section walks through the three-step setup. Requested by Martin Courcelles.
- **Quill can now add itself to PATH, so `quill <file>` works from any Command Prompt or PowerShell window (#941, opt-in).** A tester wanted to open QUILL from a shortcut without typing the full install path, and separately noticed the user guide's command-line section told everyone to run `python -m quill` — which only works from a source checkout, not an installed or portable copy. The Windows installer's "Add Quill to PATH" task (unchecked by default, alongside the existing File associations tasks) adds the install directory to your per-user PATH — no elevation needed, and cleanly removed on uninstall — so `quill` resolves from a terminal or a shortcut's Target field without the full install path. The user guide's command-line examples now lead with `quill.exe`, the command every install and portable copy actually has.
- **Pull an Ollama model right from the AI Setup Wizard — no terminal required.** Choosing your default local model used to tell you to open a terminal and run `ollama pull <model>` yourself. The Model step now shows which recommended models are already installed and lists the rest with a **Pull model** button that downloads it directly (with live progress), then selects it for you the moment it's ready.
- **Temporary bookmark — a one-keystroke jump point with no dialog.** Set with **Ctrl+Shift+K**, return with **Alt+Shift+K**. Unlike named bookmarks, nothing is ever asked and nothing is ever listed — it's disposable scratch state for "come right back to exactly here," and it does not persist between sessions by design.
- **Numbered quick bookmarks (0-9) — direct chords, no sub-mode.** Set slot N with **Alt+Shift+N**; jump to it with **Ctrl+Alt+Shift+N** (N is any digit 0-9). One keystroke each way, no Quick Nav step in between. They persist the same way named bookmarks already do — no new storage, just a naming convention (`"Quick 3"`, etc.) layered on the existing bookmark store, so they survive a restart.
- **Spell Check Word (Alt+F7) — an instant, single-word spelling check.** Checks the word at the caret and offers the same suggestions/Add to Dictionary/Ignore choices as the right-click spelling menu, without opening the full-document Spell Check dialog. The keyboard equivalent of pressing F7 on a focused word in other word processors.
- **Accessible code folding.** Fold a heading section or a fenced code block with **Ctrl+Alt+Shift+F**; jump between foldable regions with **Alt+Shift+[** / **Alt+Shift+]**; see every fold at once with **Ctrl+Alt+Shift+L** (List Folds). Folding here is spoken state, never visual line-hiding — the document text is never touched, and ordinary arrow/word/line navigation is never intercepted, so nothing a screen reader user can reach is ever made silently unreachable.
- **Insert > Emoji... (Alt+Period) — browse or search all 3,781 standard emoji by name, keyword, a typed smiley like `:)` or `<3`, or the symbol itself, with a real spoken description of what each one looks like.** No visual grid — that's exactly the pattern that shuts screen reader users out of every other emoji picker — just a category list (Favorites and Recent first, then Unicode's own nine groupings) and a named results list, same shape as QUILL's other browse/search dialogs. **Favorites** and **Recent** (your last 30 inserted, automatically) sit at the top of the category list for one-step access to the emoji you actually use; an Add/Remove Favorites button acts on whatever's selected, and un-favoriting or clearing Recent never removes the emoji from the picker itself — it's still there under its usual category or search terms either way. Every description is original text QUILL generates itself from official Unicode data (not scraped from a picker site, for licensing reasons), so the catalog is fully self-hosted and works entirely offline once built.
- **Favorite folders — a short, curated list for instant access (Kurzweil-1000-style).** **Ctrl+Alt+Shift+A** adds the current document's folder to your favorites; **Ctrl+Alt+Shift+R** removes one; **Ctrl+Alt+Shift+O** opens the type-to-filter Quick Open dialog. Distinct from Windows' recent-folders list, which tracks what you *recently* touched — a folder you use constantly but haven't opened in months (the classic "boss might ask about this any minute" folder) stays in favorites regardless of recency.
- **Open From Favorite Folder — VSCode-style Quick Open, scoped to favorites.** Type to filter by filename across every favorite folder at once, arrow to a match, Enter to open. Defaults to top-level files only so it stays instant even if a favorite hides a huge tree; tick the **Include subfolders** checkbox to search recursively when you need to. Quill has no single-project-root "workspace" the way VSCode does, so this is scoped to your curated favorites list rather than a whole tree.
- **Ranked spelling (Ctrl+Shift+L) — misspellings sorted by how often they recur.** Kurzweil-1000-style: instead of reviewing errors in document order, the most-frequent misspelling comes first. A single OCR misread or a repeated typo (`teh` for `the`) is usually the fastest way to clear the bulk of a long list, since fixing one entry resolves every occurrence at once. The regular, document-order **Misspelling List** (Alt+Shift+L) is unchanged and remains the default.
- **GitHub Items, tranche two: accessible PR diffs through QUILL's own compare engine, batch operations, and AI thread summaries.** Select a pull request and press **Diff...** to browse its changed files — each file's before/after content is fetched and run through the same compare engine as Compare Documents, so changes read as a spoken difference walk ("Difference 2 of 5. Text changed at line 41...") instead of a raw patch; binary or oversized files degrade honestly to their +/- counts and GitHub's patch text. **Batch...** applies close, reopen, or add-label to every selected row at once — the one deliberate exception to the viewer's read-only rule, and tightly fenced: it requires a signed-in account (anonymous stays fully read-only), and a consent dialog names the exact action and the exact item numbers before anything touches GitHub, with per-item error reporting after. **Summarize** condenses a long issue or PR discussion to a screen-reader-friendly TL;DR (what it's about, current state, open questions, next step) through the same AI connection and consent gates as every other QUILL AI feature — nothing runs until you press the button.
- **GitHub Items grows up: pinned repositories, favorites, real search, local git sync, and View Upstream (the GHManage/fastgh merge).** The read-only GitHub Items viewer (File > Open from Remote) gains five power features from the Unified GitHub Management review. **Pinned repositories**: the Pinned... button pins the loaded repo or jumps to any pinned one — a curated list, no retyping owner/repo. **Favorites**: Ctrl+D bookmarks the selected issue, PR, branch, or release; the Favorites... menu reopens any bookmark in your browser, across every repo. **Advanced search**: Ctrl+F focuses a search box that takes full GitHub search syntax (`label:bug author:x is:pr created:>2026-01-01`), scoped to the loaded repository; an empty search restores the normal list. **Local git sync**: the repository field now also prefills from the document's own git checkout — open any file inside a clone whose origin points at GitHub and the viewer knows the repo, even if the file never came through Open-from-GitHub. **View Upstream**: loading a repository that's a fork enables a View Upstream button that jumps straight to the repository it was forked from — previously the only way there was retyping the parent's name by hand. Everything stays read-only against GitHub itself and behind the same consent, token, and Safe Mode gates; the only writes are your local bookmarks.
- **Download workflow run artifacts straight from GitHub Items.** Select a workflow run and choose **Actions... > View Artifacts...** to see its build artifacts (name, size, whether it has expired) and download one or all of them, with a status/error announcement, an overwrite confirmation before replacing an existing file, and a progress dialog with Cancel. Getting this right needed care: GitHub's artifact download link redirects to a short-lived signed URL on a different host, and your GitHub token must never be sent to that second host — QUILL follows the redirect by hand rather than trusting default redirect-following or reaching into PyGithub's internals, so the token only ever goes to github.com.
- **GitHub is no longer a read-only window: create, fork, rename, protect, and commit — right from QUILL.** `docs/planning/github.md` mapped out how far QUILL's existing PyGithub integration could go without a new `gh`-CLI dependency; this release ships the high-confidence half. **Tools > GitHub** is a new submenu with eight repository-lifecycle commands: Create Repository..., Fork Repository..., Rename Repository..., Change Repository Visibility..., Change Default Branch..., Configure Branch Protection..., Delete Branch..., and Commit Multiple Files... (one atomic commit across several local files, distinct from the existing single-document Save to GitHub). Create and Fork both end by offering to wire the result into **Sync Folder with GitHub** on the spot, so starting a brand-new GitHub-backed project never means leaving QUILL. The GitHub Items viewer's new **Actions...** menu adds New Issue.../New Pull Request..., Merge Pull Request..., Delete Branch..., Re-run Workflow, and — on top of the existing Alt+N/Alt+P comment navigation — Reply to Thread..., Edit This Comment..., and Delete This Comment... Every write needs a signed-in account (a missing token offers to sign you in on the spot rather than just refusing) and is named explicitly in its own confirmation; the four highest-consequence actions (rename, delete a branch, change visibility, merge a pull request) require retyping the exact name or number rather than a plain Yes/No. All thirteen GitHub commands — the eight new ones plus the five pre-existing read-only commands, which had never had default keybindings before — are in the Command Palette and now ship default QUILL Key chords.
- **Tools > Local Git: the first genuinely accessible interactive rebase and merge-conflict experience.** A local git companion to the GitHub work above, built because interactive rebase and merge conflicts are famously screen-reader-hostile everywhere they exist today — the `git` CLI's own editor-buffer todo list, every GUI client's visual diff. **Uncommitted Changes...** shows staged and unstaged files with an accessible diff (the same compare engine as Compare Documents) and one-click stage/unstage. **Resolve Conflicts...** turns `<<<<<<<`/`=======`/`>>>>>>>` markers into a spoken walk — "Conflict 1 of 3: your version says X, their version says Y" — with your version / their version / both / edit manually as the choice; the same walker resolves a conflict from a stuck rebase or from **Sync Folder with GitHub**. **Interactive Rebase...** replaces `git rebase -i`'s editor-buffer todo list with a real list dialog — pick, squash, reword, or drop per commit, Move Up/Move Down to reorder — using the same substitution trick every GUI git client relies on to avoid needing an actual text editor. Rounded out with Switch Branch..., Stash Changes.../Manage Stashes..., Who Wrote This Line... (blame), and a guided Start Bisect.../End Bisect wizard. Needs no GitHub account and touches no network — pure local git, tested against real temporary repositories including a genuine merge conflict and a genuine interactive rebase.
- **GitHub Tier 2: Organizations, Releases, Workflow Dispatch, Notifications, and Security Alerts.** Five more Tools > GitHub commands, verified against PyGithub's real API by direct introspection rather than assumption. **Browse Organization Repositories...** lists the orgs your account belongs to, then that org's repos (Teams stay explicitly out of scope). **Create Release...** drafts a release with either your own notes or GitHub's auto-generated notes from merged PRs. **Dispatch Workflow...** triggers a `workflow_dispatch` run on a branch or tag. **Notifications...** is a real cross-repo inbox, not scoped to one repository. **Security Alerts...** lists a repository's open Dependabot alerts. Discussions, Projects (v2), Packages, and repository transfer were investigated and deliberately not shipped this round — PyGithub either has no wrapper for them at all (Packages, transfer) or only wraps GitHub's deprecated classic Projects API / requires a hand-written GraphQL schema fragment we're not comfortable shipping unverified (Projects v2, Discussions).
- **GitHub Tier 3: Codespaces and Copilot CLI (needs live-device verification).** Four more Tools > GitHub commands, built on your own `gh` CLI install rather than QUILL's usual GitHub connection. **Codespaces...** lists your active Codespaces with Stop/Delete; **Create Codespace...** creates one — the one GitHub command in QUILL with a real dollar cost, and its confirmation says so explicitly. **Ask Copilot for a Command...** and **Explain a Command...** wrap `gh copilot suggest`/`explain` for plain-language command help. Unit-tested against a fake `gh` runner but not yet exercised against a real Codespaces-enabled repo or real Copilot CLI access — please report anything that looks wrong through Help > Report a Bug. **Don't have `git` or `gh`?** Both now have their own rows in Help > Download Optional Components — portable, checksum-verified copies (Git for Windows, and the GitHub CLI for Windows and macOS) for anyone who doesn't already have them installed; QUILL always prefers a system copy first.
- **GitHub Items reaches full parity with GHManage, its inspiration — Compare Branches, a Workflows view, a local Quick Filter, and columns that remember your choice.** This closes out the GHManage/fastgh unification review: every idea from Kelly Ford's GHManage (`github.com/kellylford/GHManage`) that hadn't yet made the jump now has, each one extended with QUILL's own reach. **Compare Branches** (select a branch, press **Compare...** or **Ctrl+Shift+B**) reports ahead/behind counts and every commit between two branches, and — going beyond GHManage's own comparison view — walks each changed file's differences through QUILL's own compare engine, the same accessible difference walk **Diff...** already gives a pull request; it needs no signed-in account, since it never writes to GitHub. A new **Workflows** view lists workflow *definitions* (not just run history); **Enter** (or **Actions... > Run ... on Branch...**) dispatches one after asking for a branch, and GitHub's own refusal is reported plainly if a workflow doesn't accept manual runs. **Quick filter** (**Ctrl+Shift+F**) narrows the already-loaded list live as you type, with no network request — and, extending GHManage's own version, without interrupting your screen reader's character echo on every keystroke, since QUILL only announces the result count once you stop typing, not on every key. **Columns...** picks which fields show as list columns per view, and now remembers your choice between sessions. **Backspace** in the Commits view (reached by pressing Enter on a branch) steps back to the branch list, and the repository field now accepts a pasted `github.com` URL or `git@github.com:` remote, not just `owner/repo`. Our thanks to Kelly Ford for GHManage — the reference viewer this entire GitHub integration has been measured against since it began.
- **Headers and footers now export natively into Word and RTF files (#892 follow-up).** The Header/Footer Builder's spec — title, filename, date, and page-number tokens in three zones, with an optional different first page and Roman numbering — previously only drew when printing. Saving as .docx now writes real Word header/footer parts with a live PAGE field (Word renumbers as the document reflows), and saving as .rtf writes real header/footer groups the same way. A blank spec changes nothing, and a header can never be the reason a save fails.
- **Ranked Spelling Review (Alt+Shift+F7) — the full guided F7 experience, in ranked order.** Same Change/Change All/Ignore/Ignore All/Add to Dictionary/Undo workflow as the regular F7 Spelling Review, but walking issues most-frequent-word-first instead of top-to-bottom — press **Change All** on the top entry and the next-most-frequent word rises to the front automatically, so a long, messy document (a bad OCR scan, for instance) can be brought under control in a handful of steps instead of scrolling through it linearly.
- **A fully offline edition, for machines with no internet.** QUILL normally downloads its bigger optional pieces (Pandoc, offline speech engines, neural voices, the braille pack, and more) only when you first reach for them, keeping the everyday installer small. A new **Offline Edition** build flips that: every optional component ships inside the installer and the portable bundle up front, so QUILL is fully functional from first launch with no internet connection ever needed — right for an air-gapped machine, a locked-down work laptop, or anywhere your first login can't reach the internet. **Help > Download Optional Components** shows each piece as already **Bundled** (or **Not included**, for the small number of components the offline build doesn't bundle) instead of offering a Download button, since there's nothing left to fetch. The regular, smaller installer and portable download are unchanged and remain the default.
- **Internet Radio (Tools > Media > Internet Radio) — listen in the background while you write.** Browse or search stations from RadioBrowser, a free, keyless, community-run station directory (no account, no ads, no commercial API to depend on); a bundled **ACB Media** category offers the American Council of the Blind's ten stations instantly, with no network call needed to see it. **Add Custom Station...** takes any stream link directly, with a Test button before you save it, and **Find Streams from a Website...** fetches one page you type and lists any stream-shaped links it finds — a scoped, accessible alternative to hunting through a station's website by hand. Playback lives in one shared player, so closing any of these dialogs never stops the music: a status bar cell shows what's playing and offers Play/Pause/Stop/Mute plus a Favorite Stations quick-switch from its context menu, the system tray's right-click menu gets the same controls when the window is hidden, and QUILL Key chords (Ctrl+Shift+Grave then N/0/9) give play-pause/stop/mute from anywhere in the editor without leaving the keyboard. Volume is QUILL's own, separate from your system volume and your screen reader's speech volume. TuneIn and iHeartRadio (both undocumented, reverse-engineered commercial APIs) and YouTube audio were deliberately left out — RadioBrowser alone covers the real need without that risk. **Record Now** (Tools > Media > Internet Radio, the status bar, or the tray) records whatever station is currently playing straight to a file via FFmpeg — an existing, on-demand optional component; the recording controls only appear once it's installed. **Schedule Recording...** queues a one-time, daily, or weekly recording that fires while QUILL is running, and **Recording Settings...** covers format (MP3/OGG/FLAC/WAV), bitrate, destination folder, filename pattern (`{station}`/`{date}`/`{time}` tokens), and a safety duration cap so a forgotten recording can't grow unbounded. Stopping asks FFmpeg to quit gracefully — the same clean shutdown a "q" keypress gives it in a terminal — so the recorded file's container closes properly rather than a hard kill leaving it truncated.
- **Podcasts (Tools > Media > Podcasts...) — subscribe, organize into nested folders, download for offline listening, and never lose your place.** Search Apple's free iTunes Search directory or add any feed by URL directly; **Import OPML...** brings in a whole existing subscription list (including its folder structure) from any other podcast app, and **Export OPML...** writes it back out the same way — genuinely portable, not locked into QUILL. Shows organize into folders that nest as deep as you like, right in the same tree-and-list shape Radio's dialogs already use. Downloads run on their own dedicated background thread so a big backlog never competes with AI calls or transcription for a pool slot, with two genuinely independent pause controls: **Pause All Downloads** (tray, status bar, or the Podcasts dialog) stops new transfers from starting while anything already mid-transfer keeps running to completion, and pausing one specific episode halts it immediately and resumes later from the exact byte it left off via HTTP Range requests — no re-downloading what you already have. Retention is a per-podcast (or global-default) setting: keep every episode, keep only the most recent N, or delete a file automatically once you've finished it. Playback shares the same single, app-owned player Radio uses — closing the Podcasts dialog never stops an episode, and starting a new one always replaces whatever was playing rather than layering two streams; play position is saved per episode so picking a podcast back up resumes exactly where you left off (QUILL Sync-ready — the position lives in the same JSON your sync folder already carries between machines). A **Speed** control in the Podcasts dialog (0.75x-2.0x) sets playback rate per podcast, remembered the next time you open that show. A **paused** podcast stays fully in your library (episodes, downloads, and all) but stops fetching or downloading new ones, for a show you want to keep without actively following. Rich right-click context menus on both the folder tree (Refresh Feed, Pause/Resume This Podcast's Downloads, Unsubscribe, New Folder) and the episode list (Play/Pause, Stop, Download, Pause/Resume Download, Remove Downloaded Copy, Mark as Played/Unplayed, Copy Episode Link) put every action one keystroke away without leaving the list. Unsubscribe with the Delete key or the context menu, with a **Podcast Settings...** choice for what happens to downloaded files when you do: ask each time, always delete, or never delete — alongside the same dialog's global defaults for playback mode, retention, speed, and download location. A **Chapters...** button (enabled whenever an episode has Podcasting 2.0 chapter data) opens a jumpable chapter list; **Next Chapter**/**Previous Chapter** work from anywhere via the Command Palette while an episode with chapters is playing. **Sort episodes** and **Sort shows** controls cover newest/oldest, title, duration, unplayed-first, and (for shows) most-unheard-first and recently-updated-first; every folder and show in the tree shows its own unheard-episode count. **View Show Notes...** reads an episode's description as accessible plain text (HTML stripped, real paragraph breaks, links shown as `text (url)`) or as rich formatted text with images removed (so viewing show notes can never trigger a silent, unaudited image fetch); **Send Show Notes to Editor**, from the same context menu, opens them as a new QUILL document. No video podcasts, ever — audio only, matching every other QUILL playback surface. Transcript viewing/export, an Inbox view, a cross-show Play Queue, and local (imported-file) podcasts were planned next — and shipped in this same beta (see the Podcasts Phase 4 entry above).
- **A shared Sleep Timer for Internet Radio and Podcasts (Tools > Media > Sleep Timer...).** Pick a preset (15/30/45/60/90 minutes) or a custom duration; over the last 20 seconds, whichever of Radio or Podcasts is currently playing fades gently down to silence rather than cutting off abruptly, then stops — and your volume is set back to what it was before the fade, so the next time you press play it isn't still quiet. Both surfaces are covered because they're independent players (starting one never stops the other), and **Cancel Sleep Timer** is available from the same dialog or the Command Palette.
- **Start QUILL when Windows starts (Preferences > General, next to Enable background mode).** Registers a per-user Windows startup entry — no elevation, no installer changes, cleanly removed the moment you uncheck it. Checking it also turns on background mode automatically, so a QUILL that launches silently at login always has a tray icon to bring it back from.

### Offline Edition

A community bug report (Kokoro voices needing an internet connection despite running the "Offline Edition" installer) turned into a full audit of every optional speech component. The result: the Offline Edition installer now genuinely needs no internet connection for the engines it bundles, not just their model files.

- **Kokoro neural voices now install with zero network access under the Offline Edition.** Previously, only Kokoro's ~114 MB *model* files were bundled — the actual `kokoro-onnx` Python package (which pulls in onnxruntime, phonemizer, and other dependencies) still required a live PyPI connection the first time you used a Kokoro voice, even on a build advertised as fully offline. The Offline Edition build now also downloads and bundles that whole package tree as local install files at build time; installing Kokoro now reads entirely from your own computer.
- **whisper.cpp — Quill's default, built-in offline transcription engine — now transcribes immediately after an Offline Edition install, with no download step at all.** whisper.cpp's small starter model previously always fetched itself from the internet the first time you transcribed anything, even under the Offline Edition, which is a bigger gap than Kokoro's since whisper.cpp isn't optional — it's the engine Quill reaches for by default. The Offline Edition now bundles that starter model too, verified the same way the Kokoro models already were.
- **Faster Whisper, Vosk, and MP3 chapter-marker support get the same offline-package treatment as Kokoro.** Each of these downloads a small Python package on first use; the Offline Edition now bundles all three so choosing any of them never needs the internet. As a side effect, this also closes a narrower long-standing gap in Vosk's installer: Vosk always needed one small supporting library (`cffi`) that could only come from the internet even when Vosk's own file was verified and local; the same offline bundling now covers that dependency too.
- **The Offline Edition installer itself now actually builds.** Bundling Vosk's package tree (above) hard-failed every attempt: Vosk also lists `srt`, an unrelated subtitle-file helper QUILL never uses, as a dependency, and `srt` has never published a pre-built package — only source — so the build's "verified pre-built packages only" rule rejected it outright, every time, regardless of network conditions. The build now fetches Vosk's real dependencies individually and skips the one it doesn't need.
- **Piper voices now install offline too.** The Offline Edition stages Piper's engine (SHA-256-verified at build time and re-verified at install time against the same pinned hash) plus a starter voice (Lessac, US English, medium quality) inside the installer. Choosing Piper under the Offline Edition — engine and first voice both — now needs no internet connection at all; additional voices still download from the pinned HuggingFace catalog when you are online.
- **Still not covered:** Node.js-based Quillins require an internet connection on first use, even under the Offline Edition — there is no bundling mechanism for Node yet. This is a tracked gap, not an oversight.

## 0.9.0 Beta 2

Bug-fix and polish release, driven by beta 1 user reports. Rolls up on top of 0.9.0 Beta 1 (below).

- **QuillRichEdit: a native Rich Edit wrapper, real RTF, and a candidate braille fix (experimental) — feedback wanted from braille display owners.** A new experimental editor surface wraps the same native Rich Edit control QUILL already ships as its default editor, adding native RTF load/save, in-place bold/italic/underline/font/alignment formatting, and — the part we most need your help with — a candidate fix for two long-standing braille reports: the "cell-two" line-start offset and missing selection dots (7-8) on some displays. Turn it on from **Preferences > Experimental**: tick **Enable experimental features**, tick **Enable experimental editor surfaces**, set **Editor surface** to **QuillRichEdit**, tick **QuillRichEdit: emulate a system edit control (braille test)**, then **restart QUILL**. If you use a braille display, please try it and tell us what you see (cell 1 or 2, selection dots or not, still reads correctly) via Help > Report a Bug — we genuinely don't yet know if this fixes it on real hardware. See the user guide's "QuillRichEdit (experimental)" section for the full walkthrough.
- **Wikipedia added to the non-AI Look Up dictionary/thesaurus (#897).** Look Up now includes a short encyclopedia summary alongside definitions and synonyms when you're online, with a link back to the source article. Same consent gate and offline fallback as the existing Free Dictionary/Datamuse lookups — nothing changes if you keep Look Up offline-only.
- **Clip Library: a rolling clip history beneath Copy Tray's curated 12 slots (#895).** Edit > Keep Selection in Clip Library remembers a selection (up to 200, de-duplicated, favorites protected from eviction); Edit > Open Clip Library... lets you search, favorite, remove, copy to the clipboard, or promote an entry into a specific Copy Tray slot. Copy Tray itself is unchanged — this is a second, complementary tier, not a replacement. An optional **Preferences > Editing > "Automatically keep everything you copy in the Clip Library"** setting (off by default) captures every copy made inside QUILL automatically, no separate Keep action needed.
- **Work Personas: named, launchable bundles of a feature profile, working folder, favorite files, and keymap (#896).** Tools > Work Personas... creates named bundles ("School," "Novel," "Freelance Client X") that switch your feature profile, change your working folder, reopen your favorite files, and apply a keymap profile in one action — Apply Now in the dialog, or `quill --persona NAME` from the command line, or a generated launch shortcut so a persona is reachable without QUILL already running.
- **Send as Email / Copy as Email Body (#900).** File > Send as Email opens your mail client with the current selection (or the whole document) as the body; File > Copy as Email Body puts the same rendered content on the clipboard instead, for mail clients that truncate or reject a long mailto: body. A new setting, Preferences > Editing > "Kept and sent content format" (plain text/Markdown/HTML), controls how both this and the Clip Library render content.
- **Accessible AutoOutline: heading auto-numbering (#894).** Format > Update Outline Numbering numbers every heading by nesting level — numeric (1, 1.1, 1.1.1) or legal (I, A, 1), set in Preferences > Editing > "AutoOutline numbering style" — as literal text in the heading itself, so it reads aloud, survives copy/paste, and exports cleanly with no extra machinery. Format > Remove Outline Numbering reverts it; re-running after adding, removing, or reordering headings replaces the numbers instead of stacking them.
- **Mandatory alt text at insertion, and inline "alt text MISSING" announcements (#899).** Insert > Image... is QUILL's first dedicated image-insertion flow: it requires real alt text or an explicit "this image is decorative" choice before it lets you insert, so a document can no longer accrue an un-alt-texted image through this path. Tools > Describe Image at Cursor announces what a screen reader hears for any image already in the document — typed, pasted, or imported — either its alt text, or, just as loudly, "alt text MISSING." GLOW's after-the-fact audit and repair are unchanged; this adds the proactive half.
- **Print Studio: an accessible print preview, plus odd/even/reverse/skip-first-page (#891).** File > Print Studio... reports a spoken/textual preview — "3 pages, Letter, default margins" — the screen-reader equivalent of a visual print preview, then lets you choose all/odd/even pages, reverse the print order, or skip the first page (for pre-printed letterhead) before handing off to the same Print dialog File > Print already uses. Along the way, printing became properly paginated — it previously drew as much of the document as fit on one page and silently dropped the rest.
- **A keyboard-first Header and Footer Builder (#892).** File > Header and Footer... lets you build a header and footer from named presets ("Title left, page number right," "Filename and date," "Roman numerals for front matter") or your own combination of a small token set — title, filename, date, page number — placed left, center, or right, with an optional different first page and a choice of numeric or Roman page numbering. Saved per document, and drawn on every printed page (both File > Print and Print Studio).
- **Fixed Import → PDF/OCR failing on a clean install with "no PDF extraction engine available" (#909), and made it a one-click download instead of forcing it onto every install.** The free-first import pipeline (the MarkItDown converter and the PDF text extractors) was advertised in-app as built-in, but the packages were only in an optional extra the shipping build never installed — so a fresh install had no PDF/Office text extractor at all. **Help > Download Optional Components > "PDF and Office text extraction"** (~30 MB) now fetches it in one click, on any install, the moment you need it — rather than bundling it whether or not you ever open a PDF or Office document. A PDF with no selectable text still says "this looks like a scanned PDF — use OCR" instead of the same message as a missing engine.
- **Fixed "Report a Bug" showing "no token" for users who upgraded (or never signed in).** The Windows release build never provided the bundled issues-only token (only macOS did), so it shipped empty and in-app bug reporting failed for anyone who hadn't configured their own GitHub token. The Windows build now supplies the token, and **every build — Windows and macOS, release or a throwaway local build — hard-fails if the token is missing, with no opt-out**, so a tokenless bug reporter can never ship again; a build-time check also asserts the token that actually lands in the bundle is non-empty (the exact "upgraded and got No token" symptom, locked out). When no token is present at runtime the app now offers the online bug form up front — with a spoken, actionable message — instead of dead-ending at submit. **Check for Updates now also self-heals a tokenless build (#21):** if the running build is found missing the bundled bug-report token, it offers the latest release even at the same version, with a dialog that says the reinstall restores the bug-report token. A silent background check only records a notification (it never auto-reinstalls the running version); Skip this version silences it, and it stops the moment the token is back — the runtime complement to the build-time "every build ships the token" hardening.
- **Fixed a crash opening the Quillins Manager when PyNaCl is not installed (#919).** PyNaCl is a dev/CI-only dependency for Quillin Hub artifact signing, never a shipping one, but viewing a Quillin's details (which checks whether it's publisher-signed) imported it unconditionally and crashed with `ModuleNotFoundError` on every real build. The signature check now degrades gracefully — reporting "PyNaCl is not installed" — instead of crashing.
- **Quillin signature verification now actually works for end users (#919 follow-up).** PyNaCl had been a dev/CI-only dependency (the `[signing]`/`[dev]` extras), so every real shipping build shipped without it — the Quillins Manager always showed "PyNaCl is not installed" and could never tell a publisher-signed Quillin from a tampered one. PyNaCl is now bundled as a runtime dependency (the `[ui]` extra, mirrored in `requirements.txt` and the macOS py2app includes), so the "Signature: verified" / "unsigned" lines in a Quillin's details are real on every install. The graceful missing-nacl path stays as defense in depth.
- **"Casual Writer" is now a true "just write" profile (#890).** It used to leave AI, GLOW review, remote files, document analysis, watch folders, notebooks, and the developer console switched on (any feature it didn't explicitly name defaulted to on), which is not what "casual" implies. Those power surfaces are now off by default — while read aloud, voice commands, dictation, OCR, and braille stay available, because a simpler profile must never mean a less accessible one. Turn any feature back on from Preferences > Profiles and Features.
- **GitHub Items: a read-only, screen-reader-first repository browser (#924).** **File > Open from Remote > GitHub Items...** opens a list-over-detail viewer for a repository's issues, pull requests, branches, commits, tags, releases, and workflow runs — modeled on the open-source GHManage viewer, on QUILL's existing PyGithub transport and consent/token gates. One **View** switcher covers all six; the **Issues & PRs** view is the combined inbox (merged from two API calls) with Show / State / Sort filters. A **Quick/Full list mode** (GHManage parity) spells each cell as `field: value` in Full mode so a screen reader reads a self-describing line per row. Selecting an issue/PR loads its comment thread and **Alt+N/Alt+P** jump between comments ("Comment N of M"). **Enter** opens a row in the browser (and drills a branch row into that branch's commits); **Ctrl+R** refreshes, **Ctrl+O** opens in browser, **Ctrl+G** goes to an issue/PR by number, **View More** loads the next page. Read-only in v1 (no close/reopen/comment); disabled in Safe Mode; works anonymously for public repos or with your stored token for private ones. The repository field is prefilled from the current document's GitHub origin.
- **QUILL no longer treats an OS shutdown or logoff as a crash (#920).** When Windows logs off, restarts, or shuts down while QUILL is open, the session-end event (`EVT_QUERY_END_SESSION` / `EVT_END_SESSION`) now marks a clean exit instead of leaving a crash marker, so the next launch no longer offers crash recovery for a session QUILL didn't actually crash on.
- **Fixed a crash registering Windows shell-integration entries on the Python 3.13 runtime (#921).** The `OpenWithProgids` entry writes an empty `REG_NONE` value with the progid as the value *name*; Python 3.13's `winreg` is strict and rejects a `str` for a binary registry kind, where older Pythons silently accepted it (so the bug only surfaced on the 3.13 embedded runtime). Registry values are now coerced to the type each kind requires — bytes for binary kinds, str for string kinds, int for `REG_DWORD`/`REG_QWORD`.
- **Mastodon posts can set their language, and the character counter respects each instance's limit (#922).** The compose dialog adds a language picker (Default/instance, or a specific language) so a post written in one language is filed under that language's preset instead of the account default. The live counter now reads the instance's own per-post character limit (for example an instance that allows 9999) via a one-time cached unauthenticated `/api/v2/instance` lookup (with a `/api/v1/instance` fallback for non-Mastodon forks like GoToSocial/Pleroma/Akkoma that don't implement v2), falling back to 500 on any failure — never blocking a post.
- **macOS users can launch QUILL from source by double-clicking in Finder (#923).** A new `run-from-source.command` wrapper forwards to `run-from-source.sh` — double-clicking a `.sh` in Finder opens it in a text editor, but macOS runs `.command` files in Terminal, so the wrapper makes source-launch reachable without opening a terminal. Header documents the first-run Gatekeeper quarantine prompt and the workaround.
- **Fixed the docs-regenerate CI job failing on pull requests from forks (#925).** The job checked out `github.head_ref`, which does not exist in this repo for a fork PR; it now checks out the fork's repository at the PR head SHA (and falls back to the repo's own ref on a push), so regenerated epub/html renders build for contributor PRs.
- **Voice preview** (Voice Browser, and Test in Download Optional Components) now plays a "generating, please wait" cue for slow voice synthesis, never overlaps a prior preview with a new one, and its button toggles to Stop while a preview is generating or playing.
- **Fixed earcons being completely silent on macOS.** `SoundPlayer` only ever tried `sound_lib` (a licensed engine excluded from every build) and `winsound` (Windows-only) — macOS had no audio backend at all, so the bundled Ink sound pack (correctly included in the app bundle) never played. Added an AppKit `NSSound` backend.
- **Fixed the AI Setup Wizard getting stuck showing OpenAI (or another SDK-based engine) as "active" with no way to configure it, after an install was interrupted.** A crashed or interrupted background install could leave a package partially written to disk; the availability check only confirmed the module could be *located*, not that it could actually *import*, so a broken install looked permanently "installed." It now verifies real importability, so an interrupted install correctly shows as not-installed and Set Up works again.
- **Fixed several related macOS gaps in one pass:** opening a file from Finder, the Dock, or `open -a Quill file` landed in a blank document (QUILL never handled macOS's file-open Apple Event); any `Cmd+`-based keybinding silently produced no shortcut at all on any platform; and Ctrl+Tab/Ctrl+Shift+Tab for switching documents landed on toolbar buttons instead of switching, because macOS reserves Cmd+Tab (what `Ctrl+Tab` maps to there) for its own App Switcher. Document switching on macOS now defaults to Cmd+Shift+]/[ instead.
- **A full-codebase macOS platform review landed ~24 fixes.** Read Aloud was silent on macOS for every WAV-based engine (Piper, Kokoro, ElevenLabs, SAPI5, DECtalk) — the live playback path gated on Windows' `winsound` and silently deleted each synthesized WAV; it now plays via `afplay` on macOS. The earcon volume slider was a no-op on macOS (`NSSound` had no volume control wired); it now applies `NSSound.setVolume_()` per sound. `total_ram_gb()` returned a flat 8.0 GB on macOS, so every Mac got wrong Whisper model recommendations; it now queries `sysctl hw.memsize`. DECtalk was offered as an installable component on macOS with no working backend (its only backend is `DECtalk.dll`); it's now Windows-only, and the "Dictation (offline speech)" description no longer claims SAPI 5 works on macOS (it doesn't). Three macOS keymap collisions — `edit.replace` (Ctrl+H → Cmd+H = Hide), `edit.pop_mark` (Ctrl+M → Cmd+M = Minimize), `edit.select_chunk` (Ctrl+Space → Cmd+Space = Spotlight) — now have darwin alternates (`Cmd+Alt+F`, `Cmd+Alt+M`, `Cmd+Alt+Space`); Find Next/Previous now default to the macOS-standard `Cmd+G` / `Cmd+Shift+G`. The duplicate "About Quill" Help-menu entry is hidden on macOS (the Application menu already shows it), and the redundant `Cmd+F4` close accelerator is Windows-only. VoiceOver announcements now cap at 4096 chars (so a runaway status string isn't an unreadable wall of text) and carry an interrupt flag (routine status no longer talks over what you're hearing), and the AppKit announce path marshals off-main calls onto the main thread. Document saves and autosave snapshots are now atomic (temp + fsync + rename) so a crash mid-write can't corrupt your real document or make a truncated snapshot the recovery source. The `[macos]` packaging extra no longer pulls macOS-only build tools (`py2app`, pinned `setuptools`) on Windows/Linux. The macOS dictation "microphone unavailable" message no longer says "Windows microphone permissions" verbatim. The macOS release CI now runs the Python test suite (`pytest -m "not slow"`), so the `skipif(sys.platform != "darwin")` tests finally execute. New dependency tests guard the macOS packaging markers, and `test_high_contrast.py` now actually tests true/false behavior instead of just `isinstance(result, bool)`.
- **Fixed "Failed to get data from the clipboard (OpenClipboard Failed)" errors during cut/paste.** Reading the clipboard made exactly one attempt, so a screen reader or clipboard-history manager briefly holding it produced this error immediately. Clipboard reads now retry briefly (up to ~200ms) before giving up.
- **macOS low-hanging-fruit pass (5 fixes from the platform review):** tray minimize/restore status messages now say "menu bar" on macOS instead of "system tray" (the feature renders as a menu-bar status item there); the Settings default-folder hint shows a `/Users/...` example on macOS instead of a Windows `C:\Users\...` path; the AI Hub Engines tab's install-complete callback now guards all four post-install widget calls against a destroyed panel (an earlier fix guarded only the button re-enable, so closing the Hub mid-install could still crash on a later widget); bundled-tool relative paths use forward slashes so the bundled binary is actually found on macOS (a backslash is a literal filename character there, not a separator); and the zero-caller Windows HTML/RTF email-clipboard module is flagged as dead code with a note that a revival needs a macOS `NSPasteboard` counterpart (it degrades to plain text on macOS today).
- **macOS review batch 2 (5 more fixes):** MathCAT is no longer offered as a download on macOS (#46) — like DECtalk, its only backend is a Windows `.dll` (`libmathcat_c.dll`) that can never load on a Mac, so it's now gated Windows-only alongside DECtalk in the optional-components catalog. Short keychain secrets no longer leak into logs (#60/#73): the macOS `security` CLI takes the secret as `-w <secret>` in separate argv, and a short/non-hex secret slipped past the per-arg redaction that guards the diagnostics log; the value following `-w` is now redacted explicitly before logging. Three fixes are code-complete and unit-tested here but only show their real effect on a Mac, so they await tester results (reopenable via Help > Report a Bug): Work Persona launchers now write a Finder-launchable `.command` shell script (shebang + `exec` + chmod 0o755) on macOS instead of a useless Windows `.bat` (#38); the Simple File Open dialog's "toggle hidden files" chord is now `Cmd+Shift+.` on macOS instead of `Ctrl+H` (which is the system Hide-window shortcut) (#51); and eSpeak synthesis pipes very long input (over 8,000 chars) via `--stdin` instead of passing it as a trailing argv element that can overflow the OS command-line length (Windows ~32,767) and truncate/abort a very long Read Aloud span with no clear error (#64/#77).
- **macOS review batch 3a (6 fixes, all code-complete and unit-tested here):** the braille pack download is now gated Windows-only and points macOS users to Homebrew liblouis (`brew install liblouis`), which QUILL detects automatically — the pinned pack ships the Windows `lou_translate.exe` binary and could never run on a Mac (#47). External-engine resolution now finds a Homebrew/nvm-installed Node on a Finder-launched macOS app, which gets a minimal PATH and never sources the user's shell profile, so a real on-disk install was invisible to the engine allowlist (#48); the lookup checks `/usr/local/bin`, `/opt/homebrew/bin`, `/opt/local/bin`, and the highest version under `~/.nvm/versions/node`. LibreOffice import now works on a standard macOS install: the three soffice call sites (XLS, legacy Office, and Pages) resolve `/Applications/LibreOffice.app/Contents/MacOS/soffice` via a new `libreoffice_executable()` helper instead of the bare `"soffice"` argv that is never on PATH on a Mac, with a Homebrew/installer hint when it's missing (#41). Portable mode no longer silently drops credentials on macOS: with no DPAPI-equivalent single-folder store off Windows, a portable Mac build now routes load/save/delete to the login Keychain (the best available store) and logs a warning that Keychain storage is system-level, not portable, instead of losing the key with no signal (#35). The two drift-prone platform-dispatch mechanisms are consolidated: `quill.platform.dispatch` now delegates to the module-level-gated root helpers (`high_contrast`, `sr_detect`) instead of carrying its own copy of the platform branch, so a future macOS-routing change applied in one place is picked up everywhere (#7). And the macOS `shell_integration` module — Info.plist document types, the best-effort `duti` association path, and its no-op/off-darwin branches — now has direct test coverage (#50).
- **macOS review batch 3b (7 fixes, all code-complete and unit-tested here; #2 native macOS TTS deferred to batch 3c):** PDF import now distinguishes four real failure modes instead of collapsing them all into "looks scanned — use OCR": *encrypted* (password-protected, suggests `qpdf --decrypt`), *damaged* (a real parse failure, suggests `qpdf --check` and notes OCR won't help a corrupt file), *scanned/image-only* (genuinely points at OCR), and *unavailable* (no extractor installed, points at Help > Download Optional Components), each with its own engine tag; a new `_is_encrypted_pdf` probes the empty user password so a permissions-only lock isn't misreported as encrypted (#58). Keymap packs no longer apply verbatim on macOS: `build_keymap_for_pack` routes darwin pack overrides through `_apply_darwin_pack_overrides`, which folds Ctrl->Cmd for *comparison only* (wx maps ACCEL_CTRL to Cmd at runtime, so a stored "Ctrl+G" and a default darwin "Cmd+G" are the same runtime shortcut even though they compare as different strings), drops overrides whose runtime chord is macOS-system-reserved (Cmd+H/M/Q/W/Space/Tab/Grave, F9-F12, the Alt+letter deadkeys), and drops overrides that collide with another command's runtime chord — so no pack silently steals a system shortcut or a sibling binding; storage is unchanged, only the comparison folds (#4). The screen-capture off-Windows message now names the macOS Screen Recording permission (System Settings > Privacy & Security > Screen Recording) and the built-in Cmd+Shift+3/4/5 shortcuts instead of the bare "only available on Windows" (#5). `install_shell_integration` now returns a `ShellIntegrationStatus` (hosted in the platform-neutral `quill/platform/shell_integration.py`) so the caller reports *why* nothing happened when `duti` is missing — a clear "install it with `brew install duti`; the app bundle's Info.plist associations still apply" message — instead of a false success (#8). Three are code-complete and unit-tested here but only show their real effect on real macOS hardware, so they're closed *pending tester validation* (reopenable via Help > Report a Bug): `quill/platform/macos/high_contrast.py` keeps the Increase Contrast detection (`is_high_contrast_enabled`) re-exported through the neutral `quill/platform/high_contrast.py`; the `is_dark_mode_enabled`/`is_reduce_motion_enabled`/`macos_appearance()` helpers were dead code with no UI consumer (Dark Mode is read via wx's `SystemSettings.GetAppearance().IsDark()` instead) and were removed (#6); the STT self-test (`verify_component`) now synthesizes its test clip via the built-in macOS `say` command on darwin (and SAPI 5 on Windows) so the speak->transcribe confidence loop runs on a Mac without a SAPI dependency (#29); and pausing Read Aloud mid-sentence now keeps the cursor at the sentence start (re-reads the partial sentence on resume) instead of advancing to `span.end` as if the whole sentence had been spoken, for both the live eSpeak and WAV runners (#65/#78). Also #40 closed as premise-false: the `Ctrl+Alt+Shift+` chords and `Alt+Shift+D` are actively routed (to the AI/compare command class and `view.toggle_dark_mode`), not dead.
- **macOS review batch 3c (6 fixes, all code-complete and unit-tested here; the full Read Aloud macOS engine #21/#75 is wired and awaiting Mac validation):** Keychain secrets no longer reach the command line on macOS (#1/#16/#43): `quill/platform/macos/keychain.py` now talks to Keychain through the native Security framework (pyobjc) first — `SecItemAdd`/`SecItemCopyMatching`/`SecItemUpdate`/`SecItemDelete` — passing the secret only in the Keychain item's `kSecValueData` field where it never becomes a process argument, instead of the `security` CLI that takes the value as `-w <secret>` argv (visible to other processes and the diagnostics log); the leaky CLI fallback still exists for machines without pyobjc but now warns the first time it's used that the secret will touch the command line, and the no-argv-leak guarantee is pinned by cross-platform branching unit tests (SecItemAdd used, no `subprocess.run`, secret in `kSecValueData`, duplicate->update, both pyobjc return-tuple conventions normalized). `install_shell_integration` now refreshes LaunchServices after registering associations (#74): it force-registers the app bundle with `lsregister -f` so the new default takes effect immediately instead of leaving the LaunchServices database stale until a reboot, and `_app_path` now walks up from the running executable to find the enclosing `.app` (recognizing a bundle from a Finder/Dock launch, not only when launched from inside one), with a `refresh_launch_services()` helper gated off-darwin/missing-bundle/missing-tool. The Window menu is now registered with the system as the macOS Window menu (#76): `menu_bar.SetWindowMenu(window_menu)` on darwin (guarded like the existing `SetHelpMenu` hint) tells AppKit to move it to its conventional slot just left of Help and merge in the standard Minimize (Cmd+M)/Zoom/Bring-All-to-Front items and the live window list alongside QUILL's own Next/Previous/Close-Other/Send-to-Tray entries. macOS announcements now self-voice when VoiceOver is off (#2): `quill/platform/macos/tts.py` is a new native TTS backend (`NSSpeechSynthesizer.availableVoices()`/`attributesForVoice_()` catalog + `speak_announcement`/`stop_announcement`), and the darwin announce branch in `prism_bridge.py` now routes to VoiceOver when a screen reader is running but to the native synthesizer when it isn't — mirroring the Windows SAPI self-voice fallback so a low-vision Mac user without VoiceOver hears "Saved"/"Ln 12, Col 7"/the QUILL-key chord instead of silence; the routing is pinned by cross-platform branching tests (both darwin branches exercised deterministically) plus darwin-gated live tests that assert `available()`/`list_voices()` on macOS CI. **Code-complete, unit-tested, awaiting Mac-hardware validation (#21/#75):** "macOS (system voice)" is now wired as a first-class Read Aloud engine in Speech Hub — `macos_say_available()`/`synthesize_with_macos()`/`list_macos_voices()` in `read_aloud.py` (the `say` CLI backend; >8000-char input via `-f` tempfile like the eSpeak `--stdin` guard; pyobjc voice catalog with `say -v ?` fallback), the `macos` engine in `_valid_engines`/`start()`/dispatch/`_run_macos_live`, the settings `read_aloud_macos_voice`/`read_aloud_macos_rate` fields + spec choice, the Speech Hub engine option/voice picker/preview/persist, `batch_export` + `document_speech` + `project_profile` + `batch_speech_runner` integration, and `voice_browser_dialog` rate handling; off-darwin it is inert (raises/guarded) and pinned by 10 new unit tests.
- **macOS review batch 3d — Windows-only UI strings sweep + module-ownership retarget (#37, #2/#10).** ~20 user-facing strings that named a Windows-only mechanism rendered verbatim on macOS; they now adapt to the platform via a new wx-free, gettext-wrapped `quill/core/platform_nouns.py` (`credential_store_name()` returns "macOS Keychain" on darwin vs "Windows Credential Manager" on Windows, used in the AI Hub Auphonic note, the Audio Studio SFTP publish note, the GitHub sign-in and forget-AI-key messages, and the trust-consent storage clause; `primary_command_chord_label()` returns "Cmd+Alt" on darwin vs "Ctrl+Alt" for help/status text that examples a chord). "Windows dictation" status messages are now "System dictation" everywhere; the setup wizard and settings data-location label say "In my user profile" instead of "In my Windows user profile"; the egress-audit note names both vaults. On Windows the helpers return the original strings so behaviour and the accessibility source-contract tests are unchanged. The `.pot` was regenerated and the three invalidated Italian entries cleared to English fallback (the `.mo` recompiled). Separately (#2/#10), the five remaining `quill.platform.windows.sr_announce` / `announce_engine` import sites in `main_frame.py`, `main_frame_intellisense.py`, `main_frame_format_codes.py`, and the accessibility tests now import from the platform-neutral `quill.platform.sr_announce` / `quill.platform.announce_engine` shims (the `tts_init_failed` deferred import in `main_frame.py` stays direct so the existing monkeypatch test keeps working) — pure import-path change, no behavioural change, finishing the module-ownership cleanup so macOS routing lives behind a neutral facade.
- **macOS review completion pass — six smaller fixes.** Extend-selection now follows native Mac semantics (Option selects by word, Cmd by line/document); the OK/Cancel button rows in dialogs use the native Mac order; pasting HTML as Markdown tries the `public.html` clipboard flavor on darwin; the New Sticky Note hotkey emits a clear status message on macOS; the close handler no longer calls Hide()+Veto() when there's no tray icon to hide into; and the diagnostics bundle collects `~/Library/Logs/DiagnosticReports` crash logs on macOS so a Mac crash is captured the way a Windows one is.
- **Help wanted from macOS users — three things we'd like you to confirm on real hardware (none of these block the release; they're confirmation we can only get from a real Mac, reopenable via Help > Report a Bug).** (1) **Sound and Read Aloud audibility.** The macOS sound backend (AppKit `NSSound` for earcons, and the `afplay` Read Aloud path in `read_aloud.py`) is unit-tested with fakes only on our Windows dev box; we'd like to hear whether earcons and Read Aloud are actually audible on your Mac, and whether the 16-entry live-sound retention is enough under real earcon firing rates without AppKit tearing a sound down mid-playback. (2) **File-open from Finder and the document-switching chords.** Opening a file from Finder, the Dock, or `open -a Quill file` (an Apple Event, not `argv`) is standard wx API, but the cold-launch race — where a file-open event can arrive before `MainFrame` finishes constructing — and the default document-switching chord (`Cmd+Shift+]`/`[`, chosen to match Safari/Xcode's tab-cycling convention), plus the newer `Cmd+Alt+F`/`Cmd+Alt+M`/`Cmd+Alt+Space` darwin alternates, are worth a real Mac user's eyes before we call them final; tell us if any collides with something on your setup. (3) **A latent, not-yet-reproduced intellisense crash risk.** The earlier #917/#918 fix made `_IntellisensePopup.is_visible()` tolerate a deleted C/C++ `Frame`, but a sibling path (`_show_intellisense_popup`) still calls `popup.update(...)`/`popup.show(...)` after that check — if a future keystroke reaches it with the same dead-frame condition, those calls are unguarded and could raise the same class of `RuntimeError` somewhere new. No crash report evidences this path is actually reached (the two filed crashes were both in the now-guarded `is_visible()` path), so this is a documented risk, not a confirmed bug — please report it if you see a similar crash with a different traceback.
- **Fixed 4 crash reports from user feedback:** the Spell Check Language chooser crashing immediately on open (a missing argument); word-prediction crashing after a crash-recovery restart (a stale reference to an already-destroyed popup window); and the AI Hub's Engines tab crashing if closed while a background install was still in progress.
- **Added API-key setup for OpenAI Agents SDK and Claude Agent SDK.** Unlike GitHub Copilot (which has its own guided sign-in), these two engines previously had no in-app way to add a key at all once installed — Set Up in the AI Hub's Engines tab now opens a small dialog to paste, save, or remove the key, applied immediately without a restart.
- **The AI Hub now shows each Ollama model's real capabilities, and auto-probes a running Ollama.** Ollama models are discovered via `/api/show` and tagged with their actual abilities (Vision, Tools) instead of a hardcoded list, so a model's badges reflect what it can really do. Selecting the Ollama provider also auto-probes `/api/tags` and announces whether Ollama is running and how many models are available, so you know immediately whether local AI is reachable.
- **Fixed Convert Non-ASCII to HTML Entities freezing QUILL (and your screen reader) on a large document (#906).** The per-character transform loop ran synchronously on the UI thread; on a 1MB+ file it could take the better part of a minute, during which QUILL (and NVDA riding along with it) went Not Responding. It now runs on a background thread like every other potentially-slow operation.
- **Fixed Convert Non-ASCII to HTML Entities leaving a pointless UTF-8 BOM behind (#905).** Converting a UTF-8 document with a byte-order mark left the file tagged as `utf-8-sig`, so saving still wrote the three-byte BOM even though every non-ASCII character was now an HTML entity and the file was otherwise pure ASCII. The BOM is now dropped when the conversion leaves the whole document ASCII (a partial-selection conversion that leaves non-ASCII text elsewhere correctly keeps it).
- **First-run "Personalise QUILL" now offers to restart when you change where your data lives.** Choosing to store data next to the app (or any other new location) on first run applied it only on the *next* launch — the same safe, restart-deferred behavior Preferences already uses, but silently, so the choice looked ignored until you happened to relaunch QUILL. It now offers the same Restart Now/Later prompt Preferences gives.
- **The status bar's Message cell no longer repeats what another cell already says.** A user reported it sometimes showing the same text as the Page cell. Message is meant to always show something — but not the same something twice — so it now hides itself whenever its text exactly matches another currently-visible cell's.
- **Fixed offline speech-model downloads crashing with `'NoneType' object has no attribute 'write'`.** The bundled `quill.exe` is a windowed `pythonw.exe` with no console attached, so `sys.stderr` is `None` there; the whisper.cpp/Faster Whisper download progress bar (`tqdm`) defaulted to writing its own bar to `sys.stderr` and crashed the moment any progress arrived. The progress-reporting subclass now gives `tqdm` a real, harmless sink instead.
- **Fixed Piper voice Test reporting "Piper model file was not found" for a voice that was just downloaded.** The preview code was passing the bare catalog voice id (e.g. `"en_GB-alan-medium"`) directly as a file path instead of resolving it to the actual downloaded `.onnx` file.
- **The braille pack's Test result now actually shows the installed LibLouis version.** It previously tried `import louis` to read the version — but QUILL never imports liblouis in-process (BR-020; it's a subprocess worker), so that import always failed silently and the version always read "unknown." The version now comes from the pack's own `manifest.json`.
- **Downloading something from Download Optional Components now reselects the row you were on**, instead of resetting the list to the top — including the spell-check dictionary rows, which previously dropped you into the editor instead of returning to the hub at all.
- **Vosk no longer has its own row in Download Optional Components.** It's a third engine choice (alongside Whisper.cpp and Faster Whisper) inside the same guided offline-speech picker, so there is exactly one place to set up offline dictation instead of two.
- **Audio export, playback, and chapters are now one place.** FFmpeg (compressed-audio export), the mpv playback engine, and MP3 chapter markers are a single **"Audio: export, playback & chapters"** row in Download Optional Components instead of three scattered entries — with each piece still fetched only when its feature is first used, so nothing large downloads until it is needed. (FFmpeg previously had its own row.)
- **Testing an offline speech engine with no model installed yet now reopens the guided engine+model picker**, not the full Speech Settings dialog — getting the missing piece stays a one-button action instead of a bigger detour.
- **Added "Set as Default"** for the offline speech model (a button and a right-click context menu in Manage Speech Models) and made it explicit for Read Aloud voices too (previously only implicit via the dialog's OK button). The guided offline-speech picker now also sets what it just installed as the default automatically.
- **Setting up offline dictation is now a guided, one-step-at-a-time journey.** The Download Optional Components row (renamed from "Offline speech engine (whisper.cpp)" to **"Dictation (offline speech)"**) and the Manage Speech Models panel now lead with a banner that always says which step you are on and the single next action — **1.** pick and install an engine, **2.** download a model (the best fit for your computer is pre-selected, so it is one click), **3.** **Test dictation** and set it as your default. A new **Test dictation** button runs the self-test inline for the engine you selected (Whisper.cpp, Faster Whisper, *or* Vosk — the test now covers all three, not just Whisper.cpp and Vosk), and a successful test also makes that engine your default, so "try it" and "use it" are one action. Each engine option in the guided picker announces its trade-off on focus ("light and fast, works on any computer" / "most accurate" / "tiny, for old or low-memory machines"), so a screen reader hears the difference without opening the docs.
- **Manage Speech Models now remembers the engine you chose.** It used to reopen on the built-in Whisper engine even after you switched to Faster Whisper, because the saved engine was only honoured when it was already fully ready. It now opens on your saved engine — showing its "needs a model" state when setup is unfinished — instead of silently snapping back.
- **Offline-speech Test results are now written to the log**, so a failure is captured in a diagnostics bundle instead of living only in the on-screen message — making a "the test didn't work" report far easier to pin down.
- **Node.js moved to the bottom of Download Optional Components**, as the least-used extra.
- **The Speech Settings dialog now splits Speech and Dictation into Offline/Online tabs** (Speech (Offline), Speech (Online), Dictation (Offline), Dictation (Online)) instead of mixing local engines and API-key cloud providers in one flat list per tab.
- Fixed `speech_provider`'s settings validation silently rejecting `"vosk"` as an unknown value (a latent bug exposed by Vosk's guided-picker consolidation above).
- **Every document now shows a Page indicator (#872).** A beta tester asked whether QUILL could show real page numbers. It can, for PDFs -- QUILL now preserves each PDF's real page boundaries at import, so the status bar's new **Page** cell (on by default, right next to your line/column position) reports an exact "3 of 12," and `Ctrl+Shift+G` (Go To Page) jumps exactly. For plain text, Markdown, and Word documents -- where a "page" has no real meaning until you print or export -- the same cell shows a clearly-labeled **estimate** based on word count instead: "~3 of ~12 (estimated)." The tilde and the word "estimated" always appear together, so an estimate is never mistaken for a fact; tune the words-per-page assumption in Preferences > Navigation and QUILL Key. Braille documents are unaffected -- they keep their own, richer page system.
- **Crash reports no longer leak your Windows username (#886).** A portable copy running from inside your home directory (e.g. `C:\Users\yourname\...`) had its local crash-report file path embedded verbatim in the metadata block of a submitted bug report, bypassing the redaction that already scrubbed the same path everywhere else in the report. That path is now redacted the same way before it's included.
- **Fixed a crash opening the Outline Navigator (#885).** `Ctrl+Shift+O` (and the EPUB/Quick Nav variants that share the same dialog) could throw a `wxAssertionError` and fail to open, because the tree control's hidden root was being expanded, which wx disallows. The invalid call is removed; the outline shows normally.
- **Fixed AI Hub focus jumping away from the Provider list (#883).** Choosing a provider with the arrow keys (without opening the dropdown) could bounce focus over to the Model field as its suggestions refreshed. Focus now stays on the Provider list when that happens.
- **Fixed the QUILL key not responding to Ctrl+Shift+` on macOS.** wx reports the Cmd key (not the physical Control key) through `ControlDown()` on macOS, so a literal Ctrl+Shift+` press was invisible to the QUILL key's shortcut handling. It's now recognized via the physical-Control detection macOS exposes separately. (Cmd+Shift+` is macOS's own reserved "cycle windows" shortcut and is not affected by this fix — use the physical Control key, or reassign System Settings > Keyboard Shortcuts > Mission Control if you'd rather keep Cmd.)
- **Fixed a crash opening non-UTF-8 text files (#867).** Opening a `.txt`/`.md` file saved in Windows-1252/Latin-1 (a curly quote, en-dash, or other high-byte character without a UTF-8 BOM) used to throw an unhandled `UnicodeDecodeError` straight out of the open flow. Reading now falls back from UTF-8 to cp1252 to latin-1 (the last of which can never fail), and the status bar announces "Opened using {encoding} text encoding (not UTF-8)" when a fallback fires so you know the source wasn't UTF-8.
- **Removed an unbounded UI freeze source in the speech probing path (#866).** `has_nvidia_gpu()` called `nvidia-smi` with no timeout, once per Speech Hub open, directly on the UI thread — a stalled driver/service could block QUILL indefinitely (matching a crash-recovery report of a 100+ second UI freeze). The probe now runs through QUILL's timeout-enforcing subprocess wrapper and is cached for the process lifetime.
- **Made Whisper model downloads self-diagnosing.** whisper.cpp models now download through `huggingface_hub` (the same library Faster Whisper already uses) instead of a hand-rolled request, so a future stale pin surfaces a clear "this QUILL build's model reference is out of date, please update QUILL" instead of a generic "download failed."
- **Offline transcription no longer mistakes the `openai-whisper` CLI for whisper.cpp (#931).** If you had the `openai-whisper` PyPI package installed, QUILL matched its bare `whisper`/`whisper.exe` command and ran it with whisper.cpp flags, so transcription failed with a confusing error. The detector now requires the real whisper.cpp binary name (`whisper-cli`/`main`), so a genuine whisper.cpp install is used and the OpenAI CLI is left alone.
- **Kokoro voices now report readiness accurately, and point at the fix.** Read Aloud used to mark Kokoro "available" once its model files were downloaded, even when the `kokoro_onnx` pip package hadn't installed — so selecting the voice failed at synthesis time with a confusing two-option error. The readiness check now requires both, and the failure message leads with the actual fix: **Tools > Speech > Install Kokoro ONNX**.
- **Speech Hub, Manage Speech Models, and Manage Voices now open with real content focused**, not the OK/Cancel button.
- **The Download Optional Components hub is far friendlier.** Help > Download Optional Components now leads with what people reach for first (Pandoc, then the braille pack), shows a plain-language description and a size for every row (spell-check dictionaries included), and — for anything installed — adds a **Test** button that *proves it works* and a **Remove** button. Test speaks a sample through a voice so you actually hear it, transcribes a spoken phrase through the offline speech engine and shows what it heard, or reports a tool's version; Remove deletes QUILL's downloaded copy and turns its features back off (removing the voice engine you were using switches Read Aloud back to the system voice). **Piper** voices and the **Node.js** runtime are now listed too, the window opens instantly (the list loads in the background instead of stalling on version probes), everything installs into your **portable data folder** in portable mode, and if a download or test fails QUILL offers to send a bug report with the details.
- **The installer no longer prompts for optional components.** Installing 0.9.0 Beta 1 presented a custom-install page asking you to choose Pandoc, Node.js, Piper, and Braille-pack components — but those are all fetched on demand now, so in the shipped build several of those checkboxes installed nothing. The installer ships only QUILL's core (no component or setup-type selection page at all); Pandoc, Piper (neural Read Aloud voices), Node.js, the braille pack, and the offline speech engines all download at point of use — Piper via Manage Voices, the braille pack and Pandoc via **Help > Download Optional Components** — completing the PRD 10.2.x footprint unbundle that had already dropped whisper.cpp, Kokoro, DECtalk, and eSpeak-NG.
- **Built-in keymap profiles now stay platform-aware, and Preferences is reachable from the standard macOS app menu.** The shipped keymap profiles no longer override the platform-specific defaults for quit, back/forward location, and document switching, and the Preferences command now uses the stock macOS app-menu id so it appears in the expected place on macOS.
- **The advertised AI, compare, and dark-mode shortcuts now fire as intended.** Proofread, translate, compare-navigation, and dark-mode commands were present in the menus but not wired through the shared accelerator path, so their documented chords could appear in the UI without actually running. They now honor the bindings shown in the UI and the keymap editor.
- **You can now reassign the QUILL key itself.** A new **Change QUILL Key...** button in the Keymap Editor (**Preferences > Keyboard > Keymap Editor**) lets you pick a new prefix key for every QUILL-key chord: it validates the choice, warns about conflicts with other bindings and OS-reserved chords, and rewrites your stored chords to follow the new prefix, so `QUILL Key + S` and friends all move together. The Keymap Editor's search box also lists every QUILL-key-chord command when you type `quill`, so you can see and rebind the whole chord set in one place. Cross-platform — the same on Windows and macOS.
- **Tabbed dialogs now open with the first control focused, not the tab strip.** The AI Hub (and the About and Quillin-preferences dialogs) opened with focus parked on the notebook tab control, so a screen reader announced a tab while users heard the first field's label and assumed they could arrow into it — landing on nothing. Initial-focus routing in the shared dialog contract (`focus_primary_control`) is now notebook-aware: it drills into the selected tab and lands on that page's first real control, and the per-dialog overrides that fought it were removed. Any tabbed dialog that goes through the contract now behaves this way — including the About Whisperer dialog and the Help status dialogs, swept in the same pass.
- **Fixed Piper (and every other Read Aloud engine) mis-reading Markdown syntax aloud.** Live Read Aloud and Export to Speech Audio used to hand raw `#`/`**`/`[text](url)` characters straight to the synthesizer; Piper's espeak-ng phonemizer in particular mis-tokenized it badly enough to sound like a different language. Both paths now share the same Markdown sanitizer batch export and document-to-speech already used.
- **macOS: Pandoc installed via the pandoc.org installer (not Homebrew) is now detected.** A Finder-launched QUILL doesn't inherit `/usr/local/bin` from the shell profile the way a terminal does, so a genuinely-installed Pandoc could still be reported missing. QUILL now also checks the well-known install locations (`/usr/local/bin`, `/opt/homebrew/bin`, `/opt/local/bin`) when PATH lookup comes up empty.
- **Fixed "Writing && Language" and other doubled ampersands in menu titles (#876).** Several Tools-menu submenu headers ("Writing & Language," "Reading & Dictation," "HTML & Encoding," "Sort & Filter," "Customize & Support") used wx's `&&` escape for a literal ampersand, which some screen readers read back as two ampersands instead of one. Those labels now spell "and" instead of relying on the escape sequence.
- **Added Danish to the Braille Translation menu (#877).** Danish grade 1 and grade 2 tables ship with liblouis and were on disk, but QUILL's curated language list never included them, so Danish never appeared under Tools > Braille > Translation > More Languages.
- **Italian now actually appears under Change Display Language.** Elena Brescacin's complete Italian translation shipped in Beta 1, but the build never compiled `quill.mo`, so it was never selectable in the language picker. The compiled `.mo` now ships with every build, and a regression test guards every tracked `.po` so a language can't silently vanish again.
- **The Italian translation no longer conflates two different "vaults" (#913).** The OS credential vault and QUILL's document vault had landed on the same Italian word; they're now distinct — the credential store is "archivio delle credenziali" and the document vault is "raccolta" — and stale fuzzy markers are cleared, with "encoding" corrected to "codifica".
- **Fixed a crash opening Profiles and Features (#878, #879, #880, #907).** Built-in profile names are translatable and use a lazy-loaded string internally; the dialog's list box requires a fully resolved string and raised `TypeError: Item at index 0 has type '_LazyString'...` the moment the list was built, whether opened from the Tools menu or the command palette.
- **Fixed the status bar re-announcing "Status Bar" on every arrow keystroke.** Pressing F6 into the status bar and then arrowing between cells made JAWS say "Status Bar" before every single cell. The region name is now spoken once, when you first land on the bar; arrowing between cells announces just that cell's label and value (e.g. "Position, Ln 12, Col 7") — the quieter, less repetitive behavior the status bar was always meant to have.
- **Stable error codes for support triage, now across the whole codebase (#873).** A `CodedError` base (`quill/core/error_codes.py`) prefixes a stable, greppable code — e.g. `[QUILL-SPEECH-WHISPER-DL-404]` — onto an error's message, and the code rides along in crash-report metadata automatically, so a pasted error message alone tells support which failure branch fired. Every custom exception class across `quill/core`, `quill/io`, and `quill/stability` (45 in all) now carries one, and a new CI gate (`quill/tools/error_code_audit.py`, GATE-EC) fails the build if a future exception class is added without a unique, correctly-shaped code.
- **Kokoro voices now actually speak on a clean install (#881).** After downloading Kokoro, synthesis failed with a misleading "needs one more component" message. Root cause (from a submitted diagnostics log): the packaged build pruned `babel`, but `kokoro-onnx` imports it transitively at runtime (`kokoro_onnx → phonemizer → segments → csvw → babel.numbers`), so its onnx path couldn't import and silently fell back to the torch route. Fixed by not pruning babel; it now ships (or, per the unbundle below, arrives with the on-demand install).
- **Fixed Piper voice preview crashing after downloading a voice (#882).** Preview worked before a voice was downloaded, then failed afterward with `'Settings' object has no attribute 'read_aloud_piper_executable'` — the field was read at the preview call site and listed in the settings-export allowlist but was never declared on the `Settings` dataclass. Mirrors `read_aloud_dectalk_executable`/`read_aloud_espeak_executable`, which were declared correctly.
- **Smaller installer — Kokoro is downloaded on demand.** The kokoro-onnx package (with onnxruntime, phonemizer, and babel) was bundled in the installer even though Kokoro's models already downloaded on demand. It is now installed on first use via `install_kokoro_onnx()` into an engine-pack, trimming the installer by roughly 23 MB (and ~600 MB unpacked). Kokoro's first use downloads it, consistent with the rest of the footprint unbundle.
- **DECtalk now speaks instead of opening a Python file.** In the packaged app, DECtalk drove its out-of-process worker as `[sys.executable, dectalk_say.py]`, but `sys.executable` is the `quill.exe` launcher there — so QUILL opened the worker script as a document instead of running it. The worker now runs through the embedded `pythonw.exe`/`python.exe` beside the launcher.
- **Testing a not-yet-ready component now guides you, not a bug report.** In the Download Optional Components hub, testing whisper.cpp with no model (or a voice engine with no voice) reported an error and offered to file a bug report for a completely normal not-yet-downloaded state. It now routes you to finish setup (the guided offline-speech picker for a missing model, Manage Voices for a missing voice) and only offers a bug report on a genuine failure — which also removed the failure dialog that could strand keyboard focus behind the hub.

## 0.9.0 Beta 1

The 0.9.0 beta. Rolls up everything through 0.8.0 (below) plus the features, fixes, and enhancements in this release — headlined by the new AI suite, the **Accessible Vault** (linked notes you can traverse by ear), the **GLOW accessibility suite** (guided document audit and repair, shipping as an experimental opt-in), the **ElevenLabs Read Aloud voice**, and a lighter, smaller install. **This is the final feature release before QUILL 1.0**: from this beta forward, no new features are added — only bug fixes and polish, driven by your reports, until 1.0 ships. This section doubles as the in-app release notes: the same text appears when you **Check for Updates** and any time from **Help > What's New**.

### QUILL parla italiano - the first community translation

- **Italian interface translation**, contributed by **Elena Brescacin** ([elettrona](https://github.com/elettrona)) — QUILL's first shipped display language beyond English: menus, dialogs, and spoken messages, validated by the CI placeholder and coverage gates and compiled into every build. Elena covered 100% of the catalog at contribution (669/672 strings); the catalog then grew with the Audio Studio's landing, the refreshed template ships in-repo for the translation to continue, and untranslated strings fall back to English. Switch under **Tools > Writing and Language > Change Display Language**; spoken messages change immediately, menus after a restart. Grazie mille, Elena!

### The Audio Studio - the family homecoming, completed during the beta

0.9.0 promised the whole product family home in QUILL; the last homecoming —
ChapterForge, rebuilt screen-reader-first as the **Audio Studio** — landed
during the beta window and completes that promise. The full story is in the
release notes; the log, newest first:

- **Taught, not just shipped.** Tutorial 4 — [From document to published audiobook](docs/tutorials/04-document-to-audiobook.md) — was rebuilt around the Audio Studio: voices and Read Aloud, then all three journeys from a folder of anything to a published feed. QUILL Cast **episode 24 was re-recorded as "The Audio Studio"** (the old text-to-audio episode's script retired with it), and the site FAQ answers the three questions people actually ask: can it make audiobooks, can it fix a finished book's chapters, and can it publish a podcast.
- **libmpv playback backend (optional, one download away).** The Audio Studio's player learns a second engine: **Help > Download Optional Components > mpv player engine** fetches the mpv playback library (about 44 MB, pinned to QUILL's assets release and SHA-256-verified; the zip carries the GPL license texts, mpv's copyright, and a corresponding-source offer) into `engine-packs\mpv`, and playback runs on **libmpv** for gapless audio, exact seeking, and wide format coverage, with pitch-preserved speed via mpv's scaletempo. A hand-placed `libmpv-2.dll` (pack folder, beside the executable, or the `QUILL_LIBMPV` override) works too. Without the DLL nothing changes: `wx.media` remains the zero-download default, and any mpv failure falls back to it automatically so a broken DLL can never take playback away. All mpv calls stay on the UI thread (a polling timer, no event thread), honoring the Studio's threading contract.
- **AI chapter titles — name a folder of track files by listening to them.** The Chapter Workbench's new **Propose AI titles...** button turns `track07.mp3` chapters into a navigable book: QUILL slices the opening minute of each chapter, transcribes it **on this machine** with the local speech model (the audio never leaves the computer), sends only that transcribed text to your configured AI (a local model keeps even the text on-device), and lands a short proposed title per chapter in the list — for review, never applied blind, with **Restore original** as the undo. Consent is asked up front in exactly those terms; a chapter whose transcription or summary fails simply keeps its current title, and the button requires a configured AI (absent in Safe Mode).
- **Voice casting — explicit assignment on top of the rotation.** The wizard's voice page grows **casting rules**: match chapters by heading title (`Chapter *`, `*interview*`, an exact title) or by number (`#1`), and name the voice that reads every match. First matching rule wins; unmatched sections still follow the round-robin rotation or the single voice, so casting layers on instead of replacing. Rules are engine-scoped (switching engines clears them, like the rotation), ride along in saved job files, and blacklisted voices lose their rules gracefully rather than failing the run. Interviews and dialogue-heavy fiction get real casting instead of a blind rotation.
- **Incremental rebuilds — edit one chapter, rebuild in minutes.** The Audio Studio now remembers a fingerprint of every document it narrates (the document's exact bytes plus every setting that shapes its audio: engine, voice, pace, gaps, sounder, round-robin rotation, translations, pronunciation dictionaries, loudness). On the next run, documents whose text and settings are unchanged — and whose audio is still on disk — are **reused instead of re-synthesized**, announced as "Reused chapter07.mp3 (unchanged since last run)". Editing one chapter of a 40-document book stops costing an overnight run and starts costing the one chapter. The **Reuse unchanged audio** checkbox on the output step (on by default) turns it off for a forced full rebuild; any settings change invalidates the fingerprints automatically, and dry runs, auditions, and the skip/rename policies are untouched. Fingerprints live in the folder's `.quill/speech-cache.json`.
- **Run a whole show from one folder.** The Publish dialog's new **Folder feed (all episodes)...** button turns a folder of masters into a real podcast: every MP3/M4B/M4A becomes an episode (oldest file = episode 1), each with its title from its tags or your override, a per-episode description edited in an accessible list, its true publication date, duration, and chapter link. Show settings — title, author, description, media URL base, feed URL, cover URL — persist in the folder (`.quill/feed.json`), so after each new build one button regenerates `feed.rss` with everything in it. A companion **show notes page** (`show-notes.html`) is generated on demand: semantic headings per episode, descriptions, and each episode's chapter list, screen-reader-navigable and ready to upload beside the feed. Chapter sidecars can now also carry **per-chapter links and images** (Podcasting 2.0 `url`/`img`), which survive import, editing, and re-export, and episode entries carry stable GUIDs.
- **Auphonic grows up: presets, credits, and a Services home.** The Publish dialog's Auphonic section now has a **Check account and load presets** button — one explicit call that announces who the token belongs to, how many processing credits remain, and fills a **preset picker** with your saved Auphonic presets; the send confirmation then names the exact preset and your credit balance before anything uploads. The API token also gains a proper home: **AI Hub > Services** now has an Auphonic section alongside the other service keys — save or clear the token (credential vault, never a settings file), check the account, and jump to auphonic.com, without opening a book first.
- **Cover art from the book lookup.** When **Look up book details** finds your book on Open Library and the match has a jacket image, QUILL offers to download it as `cover.jpg` next to your audio and fills the cover field with it — one button now completes title, author, genre, year, *and* the cover. The download is a separate yes/no question through the same free, keyless Open Library service, inventoried in the egress audit; a match without usable art says so instead of writing a placeholder.
- **Publish uploads you can watch and stop.** The Publish dialog's SFTP and Auphonic paths now show a live progress dialog with a real **Cancel** button. Progress speaks whole-percent steps as bytes actually move ("Uploading book.m4b: 42%") and mirrors to the status bar. Cancelling an SFTP upload stops mid-file and says that files already completed stay on the server; cancelling an Auphonic run before the upload finishes means no production starts, while cancelling later leaves the production running in your account and skips the download — the announcement tells you which happened.
- **Audio Studio automation and listening extras.** A new **watch action — "Build audiobook from the folder"** — rebuilds a watched folder's chaptered master automatically whenever new recordings land (one rebuild per batch, not per file; each file a chapter, titled from its name). **Library mode** on the combine-audio journey builds every subfolder as its own audiobook in one unattended run, each titled after its folder. The Workbench adds **Split into files...** — the reverse trip: one file per chapter, ready to publish as podcast episodes or play in track-based players. And the player learns three listening comforts: **it remembers where you stopped** in every book and resumes there next time; a **playback speed** control (0.75x to 2x, pitch preserved); and a **"Where am I?"** button that speaks the audible glance — chapter number and name, time into the chapter and left in it, and position and time remaining in the whole book.
- **Publish what you made — feed, server, or mastering service.** The Chapter Workbench gains a **Publish...** button with three explicit, consent-first paths. **Podcast feed:** QUILL writes a complete RSS 2.0 + iTunes + Podcasting 2.0 `.rss` file next to the book (chapters linked via the `chapters.json` sidecar) — upload it anywhere and subscribers are in business; generation is entirely local. **SFTP upload:** saved destinations send the book plus its companion files to your server through QUILL's own SSH client — the strict host-key policy applies, and the password lives in the Windows Credential Manager, never in a settings file. **Auphonic:** send the book to your own Auphonic account for professional post-production (leveling, noise reduction); QUILL uploads, waits, and downloads the results next to the book — your API token stays in the credential vault. Every network path is inventoried in the egress audit, and the whole dialog is absent in Safe Mode.
- **Job files, book lookup, auditions, and spoken credits.** Four Audio Studio conveniences. **Save a job file** on the summary page writes a portable, hand-editable `.quilljob` that pins the entire run — folder, voices, chapters, mastering, book tags; **Load a job file** on the first page brings it all back (edit it in Notepad between runs if you like). **Look up book details** on the book page searches **Open Library and MusicBrainz** — free, keyless public catalogs — by your typed title/author and fills the tags from the match you pick; QUILL asks before the first contact and sends nothing but the title and author. **Audition** converts only the first document so you can judge the voice, pace, and mastering in minutes before an hours-long run. And **spoken opening and closing credits** ("My Book. Written by Jane Doe. Narrated by Sam Reader.") can be synthesized in the run's own voice as the book's first and last chapters.
- **The Chapter Workbench — open a finished audiobook, hear it, reshape it, save it.** The Audio Studio's third journey: **Edit an existing audiobook** opens any chaptered MP3 or M4B (or one with no chapters at all — it opens as a single chapter, ready to carve). A built-in **chapter-aware player** anchors the work: Play/Pause, Stop, Previous/Next chapter, Rewind/Forward, a position slider that speaks human time, and the current chapter announced as you cross into it. Park the playhead where a boundary belongs and press **Split at playhead** — the fix-a-bad-chapter-by-ear operation — or **Set start to playhead** to retime an existing boundary; rename, merge, and Restore original round out the surgery. Chapter lists **import and export** in five formats (Audacity labels, timestamps, CUE, Podcasting 2.0 JSON, CSV), and the book's tags are editable in place. Saving is honest about physics: an **MP3 saves in place** (only the tags are rewritten; the audio bytes are untouched) and an **M4B saves as a new file via a lossless re-mux** (no re-encode, no quality loss). Fully keyboard-driven, every action announced.
- **Audiobook builds you can trust — and chapter tools with real power.** Before a long build, the Audio Studio now runs a **pre-flight check** (mixed sample rates, channel counts, or formats are named in the log, file by file) and states the estimated duration and size. After the build it **re-reads the finished book and verifies** what a player will actually see — the completion message says "verified 24 chapters," not just "done." Every book also gets two companions written next to it: a plain-text **chapter report** and a **Podcasting 2.0 `…chapters.json`** sidecar. The chapter review dialog grows up too: **Remove** a chapter, **Restore original** to undo everything, **Export titles**, and **Import titles** from Audacity labels, CUE sheets, timestamp lines, Podcasting 2.0 JSON, or a **CSV** (any sheet with a Title column, or number,title rows). Under the hood, a full chapter-surgery toolkit shipped in core — split at any point, retime a boundary, merge, clamp, silence-based auto-chapter proposals, head/tail silence trim, fades, tempo, and split-a-master-into-files — powering the chapter workbench and player that land next.
- **QUILL Audio Studio.** `Tools → Speech → Batch Export to Speech Audio` is now **Audio Studio** — a guided wizard that asks one thing at a time instead of a single forty-control dialog. The first page picks a journey: **narrate documents** into speech audio or an audiobook, or **combine a folder of recordings** into one chaptered book (each file becomes a chapter, and you always review the chapter list before the merge). Every option from the classic dialog survives — the transition sounder and its volume, pauses, round-robin voices, translated editions, dry runs, spoken-text sidecars, ACX loudness, the book tags and cover — spread across announced, keyboard-first steps ("Step 2 of 7: What should I read?"), with **Skip to summary** turning a repeat run on a remembered project into three keystrokes. Saved project profiles, cost estimates, progress, logs, and keymap bindings all carry over unchanged. This is the first slice of the Audio Studio consolidation: the chapter workbench with split-at-playhead editing, the chapter-aware player, opening existing audiobooks, metadata lookup, and publishing land next.
- **Maximum-file-size filter in the Audio Studio.** A **Skip files larger than (MB)** spinner on the *What should I read?* step lets a folder skip oversize documents during discovery. A folder with one accidental 400 MB export no longer hijacks an overnight run; the live document count on the same step reflects the cap as it changes. `0` means no limit (the default), so existing batches are unchanged.
- **Polish controls wired into the Audio Studio build.** The trim-silence checkbox on the audio source page, and the **fade-in / fade-out / tempo** controls on the book page, now actually run during the audiobook build. `core/speech/audiobook.build_audiobook` runs each chapter file through `audio_edit.prepare_chapter_files` (head/tail silence trim, fades, pitch-preserving tempo) before ffmpeg concatenation; the runner threads `req.trim_silence_files`, `req.book_fade_in_ms`, `req.book_fade_out_ms`, and `req.book_tempo` through. Staged files live in the build's tempdir — your source audio is never overwritten — and polish failure on one file keeps the build going with that file's previous form.
- **Silence auto-chapter and ACX check in the Chapter Workbench.** Two new analysis buttons finish the one-long-recording and pre-submission stories. **Propose chapters from silences...** runs ffmpeg's `silencedetect` on the background pool, with user-tunable noise threshold and minimum silence length, and the resulting proposal lands in the chapter list for review — never applied blind; **Restore original** undoes the proposal in one click. **Check against ACX** runs a loudnorm measurement and shows a verdict dialog with integrated loudness, true peak, noise floor, and a speakable recommendation for each failing criterion ("Integrated loudness is -14.2 LUFS, target -20 plus or minus 3; make the recording 5.8 dB quieter"). The verdict is announced when the measurement finishes, regardless of how the dialog is dismissed.
- **UIA regression coverage for the Audio Studio dialogs.** The nightly `tests/uia` suite (CI-only, never on a developer's desktop) walks the Audio Studio wizard page by page and asserts the same contract `test_dialog_accessibility.py` already enforces for Go To Line: every focusable control has an accessible name, the wizard announces itself on open and on every page change, Escape closes it cleanly, and the **edit** journey opens the **Chapter Workbench** on the seeded corpus sample. The suite also drives the new `SilenceParamsDialog` from the Workbench's "Propose chapters from silences..." button. Regressions in focus order, modal-id wiring, or announcements are caught by the robot overnight instead of by a user's ears after release.
- **Audio Studio keymap, command palette, and cross-link.** `Tools > Speech > Audio Studio` now appears in the command palette under its display name and ships with a default key binding (`Ctrl+Shift+Grave, Y`). The **Export to Translated Speech Audio** dialog gains an "Open in Audio Studio" button so the one-shot translation flow advertises the richer chaptered path; pressing it closes the dialog and opens the wizard with the document already on the audiobooks MRU.
- **Audio Studio recent folders and remembered journey.** The wizard's source pages (documents and audio) now show a combo of the most-recently-used folders, so the second run lands on the same folder with two Tab presses. The **edit** journey's file picker remembers the most recently opened audiobooks. The wizard's first page also remembers which journey you used last (documents / audio / edit) and pre-selects that radio, so "Skip to summary" stays a 3-keystroke promise across sessions.
- **Persisted Audio Studio project choices.** The Phase 4-6 wizard flags **book_credits** and **library_mode** are now part of `speech-project.json` (profile schema v2; v1 files load with the fields defaulting to `False`). The per-folder auto-remember covers them, so a folder that always wants spoken credits and library-mode builds lands on those toggles on the second run without a single click.

### Math in QUILL - equations that render, sound out, and travel to Word

- **Math AutoCorrect-style abbreviations.** 88 backslash-code shortcuts (`\alpha `, `\sqrt `, `\ne `, `\pi `, and more, seeded from the DAISY-published Word Math AutoCorrect list) expand to their symbol the moment you type the code and a space or punctuation, anywhere in ordinary prose. Contributed abbreviations now correctly honor `case_sensitive` (a fix in the underlying Insert Automation system: `\delta`/`\Delta` no longer collapse to whichever appeared first).
- **MathJax-safe delimiters.** The bundled Math Equations Quillin now wraps inline equations in `\(...\)` and display equations in a single-line `$$...$$`, both MathJax's own default-recognized delimiters — no template configuration needed in Browser Preview or HTML export, and no ambiguity with ordinary dollar-amount prose the way bare `$...$` had.
- **Common Formulas gallery.** Ten ready-made algebra and geometry formulas (quadratic formula, Pythagorean theorem, slope-intercept and point-slope forms, slope/distance/midpoint formulas, difference of squares, circle area and circumference) are one selection away in **Insert > Snippet Gallery...** — nothing to type.
- **Explore Equation Structure...** (**Ctrl+Shift+Grave, F**, or Insert menu) steps through a formula's parts — numerator/denominator, base/exponent, a root's radicand — via a lightweight, dependency-free structural navigator (`quill/core/math/navigator.py`); every list is a standard Windows single-select list (arrow keys, type-ahead, Enter/OK to choose) and Escape/Cancel at any depth ends the whole session immediately (it is not "go back one level" — **Back up one level** is the dedicated choice for that).
- **Real math speech for "Read this part aloud."** That command now upgrades automatically to genuine natural-language math speech — the same MathCAT engine NVDA itself ships — once installed via **Help > Download Optional Components... > MathCAT math speech engine** (~3 MB, MIT, `daisy/MathCATForC`; a `ctypes` binding to their prebuilt DLL, no Rust toolchain needed). Without it, the same command keeps working with the simpler built-in template reading — nothing regresses either way. Math braille (Nemeth/UEB) is not wired yet.
- **Real Word equations, both directions.** `File > Export > Word Document...` now writes a genuine `<m:oMath>` equation object for every `\(...\)`/`$$...$$` in the document (via a one-equation Pandoc round-trip, `quill/io/docx_math.py`), editable in Word and read as math by JAWS — not a picture, not literal text. Opening that file back in QUILL, with either docx reading engine, restores the same plain, editable equation text. Memoized so a document repeating the same formula doesn't spawn a Pandoc subprocess per occurrence.
- **`quill/core/math/`**: a canonical MathML data model and a `latex2mathml`-backed LaTeX-to-MathML bridge (new optional `math` extra), wx-free and unit-tested — the shared foundation under the abbreviations, the structure explorer, and the docx export.
- **Math Tutor AI agent.** A read-only agent that explains a selected equation in plain language — what it means, what each symbol is — without solving anything or touching the document.
- **New tutorial:** [Write math without learning a new language](docs/tutorials/07-type-math-like-a-pro.md) — the Common Formulas gallery, typing an equation from scratch, the structure explorer, Browser Preview rendering, and the Word round trip, gallery-first for anyone who has never typed math on a computer before.

### Trust on the road to 1.0

- **A Windows UI-automation regression suite now watches the real app.** A new opt-in test suite (`tests/uia`) launches the actual QUILL on a Windows desktop session and verifies what a screen-reader user experiences: the window title tells the truth, keystrokes reach the editor, dialogs close on Escape, every keyboard-reachable control has an accessible name, and — via the announcement trace — **what QUILL spoke**. It runs nightly in CI as an informational report (never a merge gate, never an auto-fix; humans read it and decide) and is deliberately barred from live screen-reader desktops, where automated keystrokes and JAWS fight each other. See `docs/qa/ui-automation.md`.
- **Safety advisories now reach you by default.** QUILL's remote safety-advisory system — the ability to temporarily disable one specific shipped feature via a signed notice if the community reports it misbehaving — is enabled and delivered by the startup update check, which is now **on by default** (the check fetches QUILL's own signed feed and sends nothing about you or your documents; turning it off in Preferences is still honored, and Safe Mode always skips it). Advisories only ever turn a feature *off*, are announced out loud with their reason, persist offline, are lifted by the same signed feed when the fix ships, and a local escape hatch (`QUILL_IGNORE_FEATURE_LOCKS=1`) always leaves you the last word. Policy: used only in response to real user feedback, when a fix cannot ship fast enough.

### Saving and converting: every save tells the truth

- **Restore points — bring back any earlier save.** Every save now quietly keeps a snapshot of your document, and **File > Restore Previous Version** lists them in plain language ("Today at 4:12 PM - 2,341 words"). Restore replaces the editor text — after saving your current text as a restore point first, so restoring is itself reversible — or open an earlier version as a copy in a new tab. Saving unchanged text stores nothing extra, a snapshot can never be the reason a save fails, and history thins politely as it ages (a full week kept, then daily, then weekly; the newest five versions always survive) under a per-document disk cap you control in Preferences. This is the first shipped piece of the QUILL Sync plan; the same version store becomes the sync engine's history layer later.
- **Save As now finishes the job — the title bar, the modified flag, and the next Ctrl+S all tell the truth.** Saving as a Word document (.docx) wrote the file but never recorded that the document now lived there, so the title bar stayed "Untitled [modified]" and the next Ctrl+S reopened an empty Save As dialog (thank you, Caroline). Word was the only format with this gap; it is fixed and regression-tested for every format.
- **Your line breaks survive every export.** Exports fed the document to Pandoc in a Markdown dialect where a single newline is a soft wrap, so consecutive lines merged into one long paragraph in Word, ODT, HTML, RTF, EPUB, and PDF output. Every export now treats one editor line as one paragraph — the same rule the native Word writer already follows.
- **QUILL will never overwrite an opened PDF, spreadsheet, or e-book with plain text.** Pressing Ctrl+S on a document opened from a PDF, EPUB, PowerPoint, or Excel file used to write the extracted text over the binary original, destroying it. QUILL now explains that the buffer is extracted text and routes you to Save As. Likewise, typing a name like `notes.pdf` in Save As no longer writes a Markdown file wearing a `.pdf` extension: QUILL offers File > Export (which produces a real PDF via Pandoc) or asks you to pick a format it can write.
- **A converting Save As says what it did.** After saving as Word, RTF, or HTML, QUILL announces: "Saved as report.docx, Word format. You are still editing QUILL text; each save converts it to Word." The on-disk file is always the converted format; the editor keeps QUILL's clean text.
- **Save failures are reported honestly.** A failed write (disk full, file locked, conversion error) now produces a clear spoken error and leaves your document state untouched, instead of crashing or claiming success.
- **Untitled documents suggest their own filename.** The Save dialog pre-fills the name from the document's first line (markup stripped, invalid characters removed) — now on by default. It only ever suggests; type over it freely, and it never renames a saved document.
- **Choose your Word conversion engine — with the outcome described in plain language.** Two new settings: *Word document reading engine* (Auto / MarkItDown / Pandoc) and *Word document saving engine* (Auto / Native / Pandoc). Each choice says what it keeps and what it drops — Native keeps QUILL's fonts, sizes, colors, and alignment; Pandoc maps structure to Word styles but drops those codes; MarkItDown is fast and structural. The Convert File dialog gains a per-conversion engine choice whose description follows your selection. Defaults are unchanged. An engine bake-off (docs/qa/converter-bakeoff.md) backs every description with evidence — and permanently retires pydocx, which cannot run on any modern Python.

### What's New in this beta

- **The QUILL Cast and hands-on tutorials.** QUILL now ships a complete audio course: **The QUILL Cast**, a **36-episode**, two-host curriculum (about 2¼ hours across seven parts) that leads a brand-new user from the installer to every feature family — first steps, the everyday editor, documents and formats, files and automation, the speech suite, AI, and the organization/production/trust features (Vault, Story Studio, GLOW, braille, extensions). Every episode builds on the previous one and ends with hands-on homework. The hosts are QUILL's own on-device Kokoro neural voices (Liam and Jessica) — the product narrates its own curriculum — full accessible transcripts are published with every episode, and an RSS feed lets you subscribe in any podcast app. Alongside it, a new **tutorials** collection (docs/tutorials) offers six hands-on walkthroughs, from your first hour to shipping a graded, accessible Word document.
- **Import / Convert Document — rescue any document, free first, local first.** A new tool at the top of **File → Import** (and under **Tools → Reading & Dictation**) turns hard-to-read files into editable text using only free, on-device services: born-digital Word, PowerPoint, Excel, HTML, EPUB, and text-layer PDFs convert instantly with the built-in local converter, and scanned PDFs and photos of pages are rescued by free **on-device OCR** (the Tesseract engine — CPU-only, works offline, one-time ~48 MB verified download from **Install Local OCR Engine**). QUILL never opens a blank result silently — when a PDF looks scanned it *asks* before running OCR — and it tells you plainly when recognition confidence is low so you know to review. A new **OCR and Conversion Services** page explains every service in plain language: what it does, what it costs, and what stays on your machine. Nothing is ever uploaded by the free tiers.
- **The complete OCR tool: cloud escalation, review mode, and a Services tab.** The document-conversion tool is now the full three-tier design. For documents even local OCR cannot rescue well (complex tables, forms, handwriting, poor scans), an **optional Datalab Chandra cloud service** is offered — strictly free-first (only after on-device OCR comes back weak), **consent-gated on every single upload** (with an extra caution when a filename suggests sensitive content — names only, content is never inspected), bring-your-own-key (stored in the Windows credential vault, never in settings files), HTTPS-enforced, Safe-Mode-blocked, and registered in the network egress audit. A new **AI Hub → Services** tab is the friendly service manager: live status, key and defaults, a **Test Connection** that uploads nothing, a secret-free **Copy Service Summary**, and direct links to the provider's site, key page, pricing, and privacy docs. **Review Last OCR Result...** opens an accessible checklist of every low-confidence line ("Page N: [confidence] text") so you review exactly the trouble spots by ear, and **Delete OCR Temporary Files** clears any crash leftovers. The whole workflow now lives in one **Tools → Reading & Dictation → OCR and Document Conversion** submenu.
- **Hey QUILL — talk to your editor, hands-free.** A complete voice-interaction experience that drives QUILL by speaking, entirely on-device with nothing uploaded, in four levels you can use as much or as little as you like. **(1) Speak a command:** **Tools → Speech → Voice Command (Offline)** — run it, say "save file", "word count", or "next heading", and QUILL acts. **(2) Hold a conversation:** **Voice Conversation Mode** keeps listening after each command through a follow-up window so you can chain commands, with warm musical **audio cues** for every state (a rising chime on, a soft two-note listening, a sparkle when done, a quiet "working" tick, a calm fall on no-match) — nine cues that are real **Sound Events** you can retune in any sound pack. Your turn ends **when you stop speaking** (voice-activity detection that calibrates to your room so a noisy mic isn't mistaken for talking); prompts can carry **your name** ("Listening, Jeff.") and be **spoken aloud** (staying silent when a screen reader is running, so QUILL never talks over it); and the pause, cancel, follow-up, and tick timings are all tunable. **(3) Just say "Hey QUILL":** **Listen for Hey QUILL** turns on always-listening — "Hey QUILL, save file" runs a command outright, the status bar and a periodic reminder keep the live mic perceivable, a new **Speak Voice Status** command reports what voice is doing, and it turns itself off when QUILL closes unless you opt to keep it on. **(4) Ask a question:** questions like "how do I save my document" are handed to **Ask Quill** with the text pre-filled — you press Enter, so a person is always in the loop for anything that reaches the AI. You can **choose the engine** (Settings → Voice recognition engine): whisper.cpp for accuracy or **Vosk** for a fast, light engine ideal for the wake word, with automatic fallback. One promise holds throughout: a misheard phrase can never do harm — voice only runs a curated, non-destructive allowlist, everything is off by default, off in Safe Mode, and abortable with "cancel". See the new **Voice Interaction** page in the user guide for the full reference.
- **Table Studio — accessible tables (experimental).** One new grid surface makes editing tables by ear genuinely workable. **Tools → Table Studio** builds a table from scratch, and **Open CSV in Table Studio** opens a CSV/TSV straight into the same fully keyboard-accessible grid. The arrow keys move by cell and **Left/Right speak the column heading** as you cross a row; F2 edits a cell, Alt+arrows move a row or column, Ctrl+Insert adds a row. Insert the result as a properly-headed **Markdown or HTML** table, or **save it back out as CSV** so a file you opened makes a full round trip. The grid announces cells through Windows accessibility for NVDA and JAWS, with an optional compiled native UIA provider for richer cell events on builds that include it (a built-in fallback works without it). An opt-in on the **Experimental** tab.
- **A rebuilt Experimental tab — consent in layers.** **Preferences → Experimental** is now the honest front door for features that work but are still maturing. The first checkbox is a true master switch, relabeled to say exactly what it does: **Enable experimental features** governs *everything* on the tab, and while it is off every other control is disabled and drops out of the tab order — an untouched Experimental tab is one checkbox to a screen reader. Each experiment then has its own switch: **GLOW accessibility review and repair**, **WordPress publishing connections** (the read-only inbound tools; the send half stays locked regardless), and **Read the document aloud in your browser**. The editor-surface options sit behind a *second* acknowledgement of their own — **Enable experimental editor surfaces (features may degrade based on the control selected)** — which separately gates the surface choice, the border option, and the surface explainer. Nothing experimental can ever be reached, focused, or applied by accident.
- **GLOW — guided accessibility review and repair, one switch away.** GLOW (Guided Layout and Output Workflow) graduates from hidden preview to an **experimental opt-in**: tick two checkboxes under **Preferences → Experimental** (the master switch and GLOW's own) and the **Tools → GLOW** menu appears immediately, no restart. Audit the document or just the paragraph in front of you — findings open as a readable tab, each with a rule, a severity, and a plain-language suggestion — and apply safe, deterministic fixes with a before/after compare, never a silent rewrite. New alongside the opt-in: **GLOW Audit File...** and **GLOW Fix File...** review and repair structured documents on disk (Word, PowerPoint, Excel, PDF, EPUB, Markdown) through the shared GLOW engine, with a scored, graded report; fixing always writes a repaired copy beside the original — your source file is never touched. Everything runs on your machine by default; the engine's optional networked helpers stay off unless you explicitly consent, and **Help → Check for GLOW Updates...** fetches a newer engine only when you ask, signature-verified with automatic rollback.
- **Golden Quills — a thank-you to those who support QUILL.** A new **Golden Quills** tab in **Help → About QUILL** recognizes the people who have chosen to support the project financially, listed in alphabetical order, with our heartfelt thanks. It includes an optional **Donate** button (opens PayPal in your browser). To be crystal clear: **donating is completely optional and is never required** — every feature of QUILL is, and will remain, free and fully available to everyone.
- **Smaller installer: Pandoc downloads on demand.** Pandoc — the engine behind Word, ODT, EPUB, and RTF import and export — was the single largest bundled component (~220 MB unpacked), yet plain-text and Markdown editing never use it. It is no longer bundled: the first time you import or export one of those formats (or run **Convert File**), QUILL **offers to download the official, pinned Pandoc build right there** — about 45 MB, checksum-verified, with a cancelable progress bar (disabled in Safe Mode) — and you can also get it any time from **Help → Download Optional Components**. This roughly halves the installer. Upgrading from a release that bundled Pandoc? Your existing copy keeps working.
- **Smaller installer: the braille translation pack downloads on demand.** The liblouis translation tables and BRF profiles that power the Translation submenu and BRF/embossing export (~68 MB unpacked) are no longer bundled. Reading with a braille display never needed them (that is your screen reader); QUILL's own *translation and embossing* did. The Braille menu now offers **Download Braille Translation Pack...** the first time you reach it without the pack — about 9 MB, checksum-verified, Safe-Mode-blocked, with live progress in the status bar — and it also appears in **Help → Download Optional Components**. Upgrading from a release that bundled it? Your existing copy keeps working.
- **One place to get optional downloads — Help → Download Optional Components.** A new dialog lists every component QUILL can fetch on demand — the offline speech engine (whisper.cpp), Kokoro neural voices, eSpeak NG and DECtalk voices, the FFmpeg audio-export helper, **Pandoc (document conversion)**, the **braille translation pack**, and non-English spell-check dictionaries — and shows for each whether it is **Installed** or **Available to download**, with its size. Pick one and choose **Download** to get it (each fetch is checksum-verified with its own progress). Everything here is optional; the base app works without any of it. This gives you a single, accessible touch point instead of hunting through separate menus.
- **A complete, optional, private-by-default AI suite — under one new top-level AI menu.** Beta 2's headline addition brings a screen-reader-first AI assistant into QUILL. It is off until you turn it on, works with the provider you choose — a private on-device model (Ollama) or an account with OpenAI, Anthropic (Claude), Google Gemini, or OpenRouter — and never sends anything without your consent. Set it up once and every AI feature shares that connection.
- **Set up AI in seconds — the AI Setup Wizard.** A short, screen-reader-first wizard ("Set Up AI… — start here") offers one choice (on-device, an account, or not now) with a one-step connect and Test Connection. Click an AI action before setup and QUILL offers the wizard right there instead of failing. A simpler **Basic** mode keeps the AI menu small for newcomers; "Show advanced AI features" reveals the rest.
- **Free AI for everyone — a strongly-advised no-cost path.** You never need to pay to use QUILL's AI. The setup wizard now leads with the best free options and picks good defaults for you: **most private** — run a model on your own computer (Ollama), no account, works offline, nothing leaves your device; or **best quality** — connect **OpenRouter** with your own free key and QUILL preselects a strong free writing model (currently a Llama 3.3 70B free model). Each provider now has a **Get API key** button that opens the right signup page in your browser, so there's no hunting for where to get a key. Both the wizard and the **AI Hub** now offer a real model **dropdown** — pick a recommended model or **List models** to load everything your account or device offers, instead of typing an id from memory. Model descriptions say **Free** out loud when a model costs nothing. Honest by design: free hosted models can be slower and are rate-limited to *your own* free quota (so there's no shared limit and no cost to anyone else), and QUILL reminds you to keep confidential writing on the private on-device option. Everyday writing help and the single-shot agents (Rewrite, Summarize, Expand, Table of Contents) work on these free models; Ask Quill automatically simplifies its steps on a small model so it answers instead of stalling.
- **Bring the AI agent you already use.** QUILL's agent can run on more than one engine. The built-in **Native** engine always works on whichever provider you connected. If you pay for **GitHub Copilot**, use that subscription directly — a short spoken device code in your browser signs you in, no API key at all. The **Claude Agent** and **OpenAI Agents** engines plug in with the Anthropic or OpenAI API key you already have — no separate QUILL charge, ever. On the **AI Hub → Engines** tab (or by choosing *"Use an AI agent you already pay for"* in the Setup Wizard), pick your engine; QUILL installs the small connector on demand and walks you through the sign-in out loud. The safety is unchanged whichever engine runs: QUILL owns every edit, the vendor agents run text-only (their own file/shell tools are off), and every change is a reviewable preview with one-step undo. Optional, off by default, off in Safe Mode.
- **Ask Quill — one conversation that knows your document.** A single, context-aware chat replaces the old scattered AI dialogs, with a reviewable change preview for anything it applies.
- **The Listening Companion — turn recordings into finished documents.** Transcribe audio or video (optionally translating to English or identifying speakers), then turn the transcript into Meeting Minutes, Action Items, an Executive Summary, Interview/Study Notes, Q&A, a Follow-Up Email, Key Quotes, a Decisions Log, or a clean draft. Run these Transcript Actions on any document, build your own with the no-syntax Action Builder, or let a watch-folder do it automatically.
- **The AI Library — Prompts, Skills, and Agents in one place.** One tabbed manager with a real Promote continuum: a Prompt graduates into a multi-step Skill, and a Skill into a first-class Agent — all reviewable and running through the same connection.
- **Everyday AI writing help, always reviewable.** Rewrite, summarise, expand, continue, fix grammar, or generate a table of contents; AI spell check and grammar-and-style check; translate a selection or document; the AI Thesaurus; and Document Q&A. Every proposed change is shown as an accessible accept/reject preview and applied as one undo step — nothing is silently rewritten.
- **Read Aloud in your language — not just English.** The voice lists are no longer English-only. The Windows engine now shows **every voice installed on your PC in any language** (add one in Windows Settings > Time & language > Speech — Italian, Spanish, French, German, and many more — and it appears in QUILL immediately). The offline **Kokoro** neural engine gains **Spanish, French, Hindi, Italian, and Brazilian Portuguese** voices — they live in the same voice pack you already downloaded, so there is nothing new to fetch. The **Piper** catalog adds the Italian voices **Paola** and **Riccardo** as one-click downloads, and **eSpeak NG** offers the same languages from its built-in data. Read Aloud, audiobook export, and batch speech all honor the chosen voice's language.
- **Read aloud and export audio in natural AI voices.** Read the selection or document aloud, stop on a key, or export the document as an audio file in your chosen cloud voice, alongside QUILL's on-device speech.
- **Read your document in the browser's best voices (experimental).** Turn on **Read the document aloud in your browser** under **Settings → Experimental** (it takes effect right away — no restart) and a **Read in Browser** command appears under **Tools → Reading & Dictation → Read Aloud** and in the command palette. QUILL opens a self-contained, accessible reader page in your chosen browser — labelled voice picker, Speed, Play/Pause/Stop, a live status line, Escape to stop — where the browser's full voice set is available, including Edge's "Online (Natural)" voices the built-in engines cannot reach. It reads section by section so book-length documents stay reliable, **Pause** keeps your place and tells you where you are ("Paused at section 12 of 300"), and your voice and speed choices are remembered. Privacy, plainly: QUILL itself makes no network call and no audio file is produced; voices labelled "on this device" stay fully local, while the browser's online voices synthesize in the vendor's cloud — choosing one sends the text being read to that service. The reader page is deleted when you close QUILL, so no plaintext copy of your document lingers.
- **Rich formatting that stays out of your way — hidden codes, spoken on demand.** You can now apply real document formatting — **bold, italic, underline, strikethrough, superscript/subscript, font family and point size, text color and highlight**, plus paragraph **alignment, line spacing, indent, and named styles** — without ever seeing markup clutter in your editor. The buffer stays clean, fast, plain text; the formatting rides along as invisible codes. Apply it from the new **Format** menu (Font/Size/Align/Color/Highlight) or the accessible **Font...** dialog, and ask **"Describe formatting at cursor"** to *hear* exactly what is in effect ("Arial, 14 point, centered, bold"). An optional setting announces formatting changes as you move the caret. The plain-text editor, undo, search, and AI all keep working on the same clean text — nothing about your normal editing changes.
- **Keep your formatting in a plain-text file — Illuminations.** A plain `.txt` can't hold fonts, colours, or alignment, so saving formatted text as plain text used to lose them. Now QUILL can write an **Illumination**: a small companion file (`yourfile.txt.illumination`) that stores the formatting beside the clean text. The `.txt` stays genuinely plain everywhere else, and reopening it *in QUILL* restores every font, colour, and alignment exactly. Choose what happens under **Settings → Editing → Saving formatted text as plain text**: *Ask each time* (keep formatting / save an Illumination / save plain), *Always save an Illumination*, or *Save plain and drop formatting*. If the `.txt` is edited in another program, QUILL notices the mismatch and opens it plain rather than mis-applying old formatting.
- **Open and hand back rich documents faithfully, across surfaces.** RTF and Word documents round-trip through QUILL's clean buffer and materialize back to real formatting on export: **Word (.docx)** export now carries font, size, color, highlight, and alignment via a native writer (falls back gracefully if the optional `python-docx` extra is not installed), and **RTF** and **HTML** export carry the same. When a target format genuinely cannot hold something, QUILL tells you before you commit, rather than dropping it silently.
- **Re-read anything QUILL just said — the Spoken Echo.** Speech disappears the moment it is spoken. The **Spoken Echo** keeps the last twenty announcements and shows them newest-first in a read-only dialog you can arrow through, re-read, and copy. Open it any time with **Alt+Shift+E** (Help → Show Spoken Echo); it works after *every* announcement, including ones from ordinary editing keys like Tab. For the familiar screen-reader gesture, **double-pressing** an informational command — Describe Formatting, Document Summary, Context Help, or Announce Contrast — opens the Echo instead of re-speaking. Toggle that under **Settings → Accessibility → Double-press to show the Spoken Echo**; the dedicated key always works.
- **A far richer Keyboard Manager.** The Keymap Editor (**Preferences → Keyboard → Keymap Editor**) now searches two ways from one box: type part of a command name to filter, or type a shortcut — `ctrl+alt+m`, `Control + Shift + K`, even a QUILL chord like `quill, s` — to reverse-look-up exactly which command owns that key (or learn it is free). Spelling is forgiving: `control`/`ctrl`/`ctl`, any modifier order, any case, with macOS `Cmd` kept distinct from `Ctrl`. **Record Keys** lets you press a combination instead of typing it. Assigning a taken key now names the command that owns it (by its friendly title) and offers to reassign — moving the key and freeing the other command — instead of silently refusing. A new **Run Diagnostics** audits the whole keymap for duplicate shortcuts, orphaned and unreadable bindings, and "assigned but inert" keys, with a one-click **Heal** that removes bad entries and re-applies your shortcuts.
- **Organize a whole book — Story Studio.** A new **Tools → Story Studio...** opens a keyboard-navigable **binder** for a project folder: your **Manuscript** with chapters and scenes taken straight from its Markdown headings, plus groups for **Characters, Places, Plot threads, Research, and Brainstorm**. Press Enter on any item to open that file (a chapter opens at its heading); press **Edit details...** on an element to fill in a small, accessible form — a character's Role, Goal, Motivation, and Arc; a plot thread's Status; tags — saved as tidy front matter in the file itself. Press **Compile manuscript...** to stitch every manuscript file together, in order, into a new document you can then send through **File → Export** (Markdown, HTML, Word, DAISY, and more). A project is just a folder of plain-text files plus one small companion file, so nothing is ever locked in: delete the companion and you still have every word. It is entirely optional and additive — if you never open it, nothing changes.
- **Linked notes and backlinks — the Accessible Vault.** A new **Tools → Vault** brings linked notes and backlinks to QUILL, built for the keyboard and the ear instead of a visual graph. **Open Vault...** points QUILL at a folder of notes; it indexes them and announces "Vault *name*: N notes, M links." Type `[[Note Title]]` anywhere, put the cursor on it, and **Follow Wikilink** opens that note (a `[[Note#Heading]]` opens at the heading, `[[Note#^block]]` at the block); a missing note offers to be **created**, and an ambiguous name is a spoken **chooser**, never a guess. **Show Backlinks** answers "what links here?" as a list you can hear — "5 notes link here," each read with the sentence its link sits in, Enter to open the source at that mention — the graph view, spoken. **Insert Link to Note...** picks a note by title and inserts `[[Title]]`. And there is much more, all spoken and keyboard-first: **Go to Note** is a type-to-filter switcher and **Search Vault** searches every note (with Regex / Whole-word) and opens a result at its exact line; **Show Tags** is a tag pane where nested tags roll up (`#area` finds `#area/sub`); **Speak / Resolve Embed** reads or inlines an `![[embed]]`; **Insert Template** fills in `{{date}}`/`{{title}}` and asks any `{{prompt}}` before dropping you at the `{{cursor}}`; **Open Today's Note** and **Previous/Next Daily Note** walk your dated journal; **Export Vault as Website** writes a small linked site (one accessible page per note, links and embeds resolved); and **Sync Vault** commits/pulls/pushes over your own Git remote and lists conflicts rather than overwriting. A vault is just a folder of Markdown files plus a small `.quill` cache you can delete without losing anything; links live as plain text. Optional and additive — never open a vault and nothing changes.

- **A "Notepad++ experiment" editor surface for the accessibility testing round.** The Experimental tab's editor-surface list gains a seventh option: the Scintilla control (wx.stc.StyledTextCtrl) — the engine behind Notepad++, and the only alternative surface with full multi-level undo AND redo. It is wrapped so QUILL's dirty tracking, caret behavior, and line endings work exactly as on the standard controls, and it falls back to the stock editor on any failure. Like every surface experiment it sits behind both Experimental switches and needs a restart; the open question this option exists to answer is JAWS/NVDA/braille behavior.

- **The Quillin Hub: share every QUILL artifact, validate locally first.** The Quillin Hub (`hub.quillforall.org`; service code in `quillin-hub/`) is the community store and submission service for every shareable QUILL artifact type -- Quillin extensions, AI agents, verbosity packs, sound packs, keyboard packs, AI skill packs, and pronunciation dictionaries -- not just Quillin extensions. **Tools > Quillins > Submit to Quillin Hub...** runs `python -m quill.tools.artifact_validate <path>` locally and reports pass/fail in an accessible dialog before anything goes near the network; pick a Quillin's `manifest.json` and the whole folder is checked. The Hub itself is GitHub-native: every submission is reviewed in the Hub's Submission Forge, then published via a pull request to `Community-Access/quill`. One validator, one source of truth, no duplicate verdicts.

### Fixes

- **"Restart Now" no longer crashes the relaunched QUILL.** Accepting an in-app restart offer (after changing the data location, importing legacy data, or switching the experimental editor surface) re-ran QUILL in a way that put the program folder ahead of Python's own libraries, and the new process died before its window appeared (`AttributeError: module 'platform' has no attribute 'system'`). Restarts now use the proper module invocation, QUILL repairs the search path defensively at startup if any launcher gets this wrong, and the menu code no longer depends on the module that was being shadowed.
- **The experimental "Rich text" editor surface no longer crashes at startup.** Selecting the wx.RichTextCtrl surface on the Experimental tab crashed QUILL while building the status bar (`TypeError: cannot unpack non-iterable RichTextSelection object`), because that control reports selections differently from every other surface. It now speaks the same selection language as the standard editor controls, and any failure falls back to the stock control instead of breaking the editor.
- **Dictation is one clear gesture now — Hold-to-Dictate is retired, Locked Dictation stays.** The press-and-hold F9 dictation mode from 0.7.0 has been removed: a held key repeats and announces itself endlessly under a screen reader, which made the gesture unreliable in exactly the situations it was meant for. **Ctrl+F9** Locked Dictation is the one way to dictate — press to start, press again to finish — with **Ctrl+Shift+F9** pause/resume, **Alt+F9** speak-status, **Escape** stop-and-keep, and **Shift+Escape** cancel, all remappable. The **Tools → Speech** submenu is renamed from "Hold & Locked Dictation" to **"Locked Dictation"** to match, the vestigial "minimum hold to start" knob is gone from the Dictation Settings dialog, and the user guide and product docs have been corrected everywhere the old two-mode story lingered.
- **The GLOW engine can no longer be installed-yet-silently-unavailable.** GLOW's shared engine recently split its analysis backend into a new component, and QUILL's version floor was loose enough that an older, pre-split install could satisfy it — leaving the engine reporting "not installed" with no error anywhere. QUILL now pins the exact backend it needs (`acb-large-print` 8.0.0 or newer alongside the engine contract), the vendored offline wheels install cleanly on a bare machine, and this failure mode is extinct by construction.
- **A startup step that escaped its safety harness is back inside it.** Every deferred startup task (screen-reader detection, crash recovery, watch folders) runs isolated so a failure is logged and skipped, never fatal — but the browser-preview warm-up scheduler had slipped outside that pattern and could in principle have taken down startup. It is now isolated like everything else, and the regression test guarding the whole contract is green again.
- **Bookmarks now stick to their document and survive a restart — plus QUILL remembers where you left off.** Named bookmarks used to be a single in-memory set that was forgotten the moment you closed QUILL and was shared across whatever document was open. Now each bookmark belongs to the **specific file** it was set in and is **saved between sessions**, so reopening a document brings its jump points back. QUILL also remembers your **last cursor position** in each saved document and returns you there when you reopen it. (Untitled documents keep bookmarks for the session until you save them.)
- **Opening Word (and other) documents with QUILL set as the default app now works.** Pressing Enter on a document in your file manager (with QUILL as its default app) did nothing, because the launcher tried to *run* the document instead of opening it. QUILL now opens the file as expected. The installer's "Open" and right-click "Send to QUILL" commands were hardened too.
- **Far less double-spoken chatter.** "No misspellings found" was one of many actions QUILL spoke twice — once from the status bar and again from an explicit announcement (because updating the status bar already speaks). Across the editor — updates, GitHub, SSH, dictation, the copy tray, profile switches, and more — these are now spoken exactly once, with the status bar still showing its (sometimes longer) text. A guard keeps the pattern from creeping back. (#728)
- **Report a Bug is keyboard-navigable again, and submitting no longer seems to lose your text.** You can now Tab through the form (it was built on a window that did not pass Tab between fields), and on submit QUILL reliably announces that the report was copied to your clipboard — previously that confirmation was spoken as the window closed and got lost, so it looked like nothing happened. (#729)
- **No more alarming "text-to-speech failed" when your screen reader is running.** QUILL's own SAPI voice is only a fallback for people with no screen reader; if it failed to start, QUILL spoke a scary "TTS engine failed" message (with a wrong "press F8" instruction) even though the screen reader was handling speech perfectly. Now that case is kept only as a quiet, informational note (not an alarming accessibility alert) and is never spoken — QUILL only speaks up about it when you genuinely have no other voice, and points you to the real Tools > Retry TTS Engine. Separately, the SAPI voice now initialises correctly even when QUILL is installed read-only (its helper cache moved to a writable per-user folder), so self-voicing works for people who rely on it. (#749)
- **A control-type choice for braille displays, and an honest status on the cell-two offset.** On a rich-text editor control, some braille displays show every line's first character in cell two — the same quirk long-time Word users will recognise. **Preferences → Accessibility → Editor control type (braille)** lets you switch the editor between RichEdit 3.0, RichEdit 2.0, and **Plain edit, like Notepad** (the rich control was only ever required for *read-only* views, #616; the change applies to documents opened afterward). Being straight with you: **testing shows the control-type switch does not resolve the cell-two offset** — the issue persists, and an outcome is still being considered. The options remain available for troubleshooting and experimentation, and we will keep reporting plainly on where this stands.
- **Downloading Kokoro voices now shows its progress instead of dropping you back at the document.** Starting the Kokoro voice-pack download from Manage Voices appeared to do nothing: focus snapped back to the editor and the progress window was never announced, because it opened while the Manage Voices dialog was still closing. The download now opens after that dialog is fully gone, so the progress window presents and your screen reader announces it. Once the Kokoro models are present, the redundant 114 MB download button is hidden rather than offered again.
- **Offline dictation works out of the box — the speech engine is now bundled.** The private, on-device Whisper engine that powers dictation (Ctrl+F9) and Tools > Speech was missing from the installer, so QUILL reported "whisper binary not found" even after you downloaded a model (the model and the engine are separate downloads). The engine now ships with every build, so offline dictation works with no extra step. (#742)
- **Saving a Faster Whisper model no longer freezes at 2% and crashes.** The download updated the on-screen progress so often that it flooded QUILL's main thread — the bar appeared stuck near 2% and the app eventually crashed. Progress now updates at most once per percent, so model downloads run smoothly to completion. (#748)
- **Export speech audio as MP3 (and more), not just WAV.** Generate Speech Audio only ever offered WAV, even with ffmpeg installed. When ffmpeg is present you can now save as **MP3, M4A, M4B, OGG, Opus, or FLAC**; without it, WAV still works exactly as before. (#750)
- **Live preview no longer flickers or re-announces as you type.** With a preview open, editing a line used to re-open/reload the external browser preview on every keystroke — a full page reload that flushed braille and re-announced from the top, and jumped the page back to the top. The external browser preview now refreshes only after you pause typing (debounced) and keeps your place on reload — landing back at the section you are editing, or at your previous scroll position — so it stays put and quiet. The in-app side preview (Ctrl+F6 to focus it) already updates silently in place with no reload — the recommended live preview for screen-reader and braille users.
- **Snappier, less alarming startup.** The one-time WebView2 preview-engine warm-up now runs after the editor is ready and focused, instead of before it — so a slow first-time Windows setup no longer looks like the app froze on launch. If the interface does ever stall, QUILL now records a diagnostic thread-stack snapshot for short stalls too (previously only very long ones), and startup task timings are now always written to the logs — so a slow launch can be reported with evidence, no special setting needed.
- **Idle AI models are actually released now.** The background sweep that unloads models after they have been idle (the Performance setting "Unload idle models after…") crashed silently on every tick, so nothing was ever unloaded and memory was held longer than intended. The sweep now runs correctly, freeing idle model memory as configured.
- **The crash-report dialog now tells you what happened.** After a crash, choosing Send, Copy, or Send-without-a-sign-in used to complete silently — indistinguishable from doing nothing for a screen-reader user. QUILL now confirms the outcome out loud: that the report was sent, that it was copied to your clipboard (with what to do next), or that sending failed and the report was copied instead.
- **Press F1 on any command and hear what it does.** Context help now covers every command. Previously more than two-thirds of commands had no help topic, so asking "what does this do?" said nothing useful. All 319 remaining commands — across Edit, Format, Navigate, File, Tools, and the rest — now have a plain-language description and their keyboard shortcut, spoken on demand.
- **Smart triggers and Quillin-contributed abbreviations now actually fire.** Typing `=bug()`, `=todo(10)`, `=rand(3,4)`, or any other declared `=name()` trigger alone on a line and pressing Enter now replaces the line with the generated text, and Quillin-contributed abbreviations like `qbug` and `qmeet` now expand as you type (when Abbreviation Expansion is turned on) — exactly as documented since 0.7.0. Both were declared by the bundled Smart Insert Quillin (and the manifest format accepted them) but were never dispatched. Numeric trigger arguments work too — `=todo(10)` makes a ten-item checklist — every insertion is announced and undoable, individual triggers and abbreviations can still be turned off on the Quillin's preferences page, and your own abbreviations always win over contributed ones.
- **Quiet failures now speak up.** Several actions could fail silently, which for a screen-reader user is indistinguishable from success: exporting or importing List Studio settings now confirms success or explains the failure; closing the Pronunciation Dictionaries dialog with OK now warns you if any dictionary could not be saved (instead of dropping your changes without a word); and the Quillin wizard's "Copy JSON" only claims "copied" when the clipboard actually took the text.
- **Report a Bug now submits your issue directly — one form, no browser detour.** Help → Report a Bug now ships with its direct-submission component (feedback_hub), so the accessible form files your report straight to the QUILL issue tracker, pre-filled from the shared feedback schema, with a real **Submit Issue** button and Escape to cancel. The old built-in form (whose button opened a browser support page, and whose separate window ignored Escape) is gone entirely, along with its two settings — there is one way to report a bug and it just works. In the unlikely event the form cannot open, QUILL copies the online support-form link to your clipboard and tells you so.
- **The dialog entry/exit cues now stay off everywhere.** Turning off **Announce entering and leaving dialogs** (or picking up its new quiet default) silenced the main window's dialogs, but standalone surfaces — the AI Hub, AI Library, prompt and skill libraries, publishing tools, Mastodon dialogs, the crash reporter, and more — kept speaking "Entered / Exited *name* dialog" regardless. The setting now governs every dialog in the app.
- **The Quillin Hub now fails closed on unsigned submissions.** A new Ed25519 / minisign-shaped publisher signature (`.minisig` sidecar next to the artifact) is verified at the Submission Forge before the validator runs; unsigned or invalid artifacts are rejected with a clear "Unsigned" / "Invalid" line in the report. The storefront and detail pages show a "Signed by `<keyid>`" badge for every artifact, the GitHub sync worker pulls the signer key id from sidecars on main, and the in-app `Submit to Quillin Hub...` dialog and the Quillin Manager both surface the signature state of the artifact you're submitting or have installed. See `docs/signing.md` for the protocol and `docs/release/quillin-hub-deployment.md` for the deploy runbook. (#517, #519)
- **The unified validator now reports and can require signatures.** `quill.tools.artifact_validate` always reports the signature status of an artifact; pass `--require-signed` to fail an audit whose sidecar is missing or does not match. This is the same gate the Hub uses, so the local pre-flight check and the Hub's Submission Forge share one truth.

### Enhancements

- **Faster startup.** QUILL now imports far fewer rarely-used modules up front. The update checker, GLOW's update checker, the BITS Whisperer speech provider/model tools, the publishing/share/export dialogs, Search and Replace In Files, the AI Assistant tools, and a dozen once-used dialogs (Command Palette, Sticky Notes, AI Model settings, Ask QUILL, and more) now load only when you actually use those features, instead of on every launch. Loading the bundled Quillins (Tools > Quillins) also moves to just after the window appears rather than before it, so the window itself shows sooner. Measured together, this cuts a good-sized slice off the time between starting QUILL and the editor being ready — with no change to how any of those features work. A new "Cold start" section in `logs/startup_tasks.txt` (Help > Open Logs Folder) shows exactly where the remaining time goes, for anyone curious or reporting a slow-launch issue.
- **The Python snippet sandbox is harder to escape.** Snippets that AI features or Quillins run in QUILL's isolated Python sandbox are now also statically blocked from dunder attribute access (the classic route from a harmless-looking expression to the underlying OS), on top of the existing separate-process isolation, import allowlist, scrubbed environment, and time/memory caps. If the operating system refuses a memory or CPU cap, QUILL now logs that the run was time-bounded only instead of staying silent.
- **Quieter dialogs by default — less duplicated chatter.** The spoken "Entered / Exited *name* dialog" cues (**Preferences → Accessibility → Announce entering and leaving dialogs**) now default to **off**, because every supported screen reader already announces a dialog and reads its title on focus, so the extra cue was redundant noise. The setting stays exactly where it was for anyone who wants it back, and because settings are stored as a delta from QUILL's defaults, existing users who never deliberately switched it on pick up the quieter default automatically on upgrade.
- **Open your WordPress posts and pages in QUILL (read-only, Full Quill profile).** A new **read-only publishing connection** lets you sign in to a WordPress site with your username and an application password, **browse a listing of your posts and pages**, and **open one into the editor** to read and edit it locally. This first step is deliberately read-only: **QUILL does not send anything back to the site yet** — there is no publish, update, or schedule. It is available in the **Full Quill** profile (and can be turned on for any profile via **Preferences → Profiles and Features → Manage Individual Features**); connections live under **File → Publish → Publishing Connections...**, and your application password is stored securely in the Windows Credential Manager. Connections only ever talk to your site over HTTPS (plain HTTP is allowed only for local/loopback addresses).
- **New Experimental settings tab — try different editor surfaces (for testing).** A new **Settings → Experimental** tab adds an **Editor surface** chooser so you can test how QUILL feels on different controls: **RichEdit 3.0**, **RichEdit 2.0**, **Notepad** (a plain edit control), **Rich text** (an experimental `wx.RichTextCtrl`), or **Native Win32 EDIT** (a pywin32 spike that hosts the very control Notepad uses, Windows only); "Default" follows your Accessibility *Editor control type* setting. A **Hide editor border** toggle draws the editor with no border for a cleaner, Notepad-like frame. A built-in **read-only explanation panel updates as you change the chooser**, describing what each surface does and its impact from both a user and a technical perspective, and the experimental options stay **ignored until you tick "I understand features may degrade based on the control selected"** — a safety gate so nothing changes by accident. These change how the editor is built, so QUILL **warns you to restart** when you change them and applies them to documents opened after restart.
- **Smaller installer: the offline speech engine downloads on demand.** The private, on-device speech engine (whisper.cpp) is no longer bundled in the installer. The first time you use offline dictation or transcription, QUILL **offers to download it right there** — about 8 MB, checksum-verified, with a cancelable progress bar (disabled in Safe Mode) — and you can also get it any time from **Tools > Speech > Download Offline Speech Engine...**. **Upgrading from a release that bundled the engine? Your existing copy is kept and keeps working** — nothing to re-download. (First step of the AI footprint/optimization plan: a pinned, SHA-256-verified release-asset acquisition path.)
- **Smaller installer: Kokoro neural voices now download on demand.** The ~120 MB Kokoro voice models are no longer bundled in the installer (it is that much smaller to download and install). The first time you choose a Kokoro voice, QUILL downloads it for you — checksum-verified, with a cancelable progress bar — and other read-aloud voices (DECtalk, eSpeak NG, Piper, SAPI) work in the meantime. **If you are upgrading from a release that bundled Kokoro, your existing copy is kept and keeps working** — nothing to re-download. (Proof-of-concept for the AI footprint/optimization plan's "host redistributable components as verified release assets.")
- **Smaller installer: the DECtalk and eSpeak NG voices download on demand too.** The classic DECtalk runtime (~2 MB) and the eSpeak NG engine and its voice data (~40 MB) are no longer bundled in the installer. When you choose one of these voices, QUILL downloads it for you — checksum-verified, with a cancelable progress bar (disabled in Safe Mode) — and Windows' built-in SAPI voices remain available immediately as the always-present offline voice. **If you are upgrading from a release that bundled DECtalk or eSpeak NG, your existing copies are kept and keep working** — nothing to re-download. (Same pinned, SHA-256-verified release-asset path as whisper.cpp and Kokoro.)
- **Smaller installer: the Vosk speech engine downloads on demand.** The optional **Vosk** engine — a very-low-resource, CPU-only offline dictation/transcription engine for older or low-memory machines — is no longer bundled (it was the single largest optional engine, ~51 MB). Get it from **Tools → Speech → Download Vosk** or **Help → Download Optional Components**; it installs on demand, preferring QUILL's own pinned, SHA-256-verified release asset and falling back to the public package index. whisper.cpp remains the default offline engine. Some build-only runtime data (the `Babel` translation-compiler, ~29 MB) was also dropped from the shipped runtime, since the app loads compiled translations with the standard library. **No offline speech engine is bundled in the installer any more**, so the base download is lighter than ever.
- **Runs light on modest machines: idle-model unloading and a Low-resource mode.** Two new options under **Settings → Performance and Memory** let the full AI and speech feature set fit on limited-memory, CPU-only machines — never by disabling features, only by managing memory. **Unload idle models after** *N* minutes frees an AI, read-aloud, or dictation model you have stopped using (it reloads on next use); **Low-resource mode** keeps only one model loaded at a time and prefers the smallest that fits, and turns on automatically (with a one-time spoken notice) on very-low-RAM machines. Peak memory drops when you move between features, at the cost of a brief reload. (`quill/core/model_lifecycle.py`, wired through `lifecycle_service` to the speech, Kokoro, and llama.cpp model holders.)
- **AI model guidance that fits your machine.** The on-device **AI model** dialog now surfaces a one-step, screen-reader-announced upgrade suggestion when your computer can comfortably run a more accurate model than the one currently selected — take it or ignore it; new installs still default to the smallest model that fits.
- **A way forward when the cloud is unreachable.** If a cloud AI request cannot reach the internet (offline, timeout, rate-limit) and you have an on-device model installed, QUILL now tells you — out loud — that you can switch to it and keep working offline. It never switches for you, so your privacy posture never changes without your say-so.
- **Proofread Mastodon posts before sending (per account).** In **Tools → Share → Mastodon Accounts...**, select an account and tick **Spell-check posts before sending** to have QUILL open the Spelling Review (F7) on the post text when you press Post, so you can fix misspellings before it goes out. Off by default and per account, so existing accounts are unaffected until you turn it on.
- **Spell check a document before saving.** A new **Settings → Editing → Spell check a document before saving** option (off by default) opens the Spelling Review (F7) automatically when you Save or Save As, so you can correct the document before the file is written, then the save proceeds.
- **Spell-check in other languages, downloaded on demand.** A new **Tools → Spell Check Language...** lets you pick the language QUILL checks against. English works out of the box; choosing **Spanish (Spain)** or **French (France)** downloads that dictionary the first time from QUILL's own verified source (checksum-checked, with a cancelable progress window), then it works offline. Your choice is remembered, and the spell checker uses it for the F7 review and check-as-you-type. (More languages can follow; this first release proves the path with Spanish and French.)
- **Hear how deep your indentation is.** Press **Tab** or **Shift+Tab** and QUILL can now speak the new indentation depth — "4 spaces", "8 spaces", "1 tab" — instead of just "Indented lines", so you always know where the line sits. It honours your tabs-vs-spaces and width choices (**Insert tab characters instead of spaces** and **Number of spaces per indent level** in Settings). Prefer the terse message? Turn off **Announce indentation depth on Tab** (Settings, Accessibility).
- **Quieter dialogs, your choice.** A new **Announce entering and leaving dialogs** setting (Settings, Accessibility) controls the spoken "Entered / Exited *name* dialog" cues. Off by default, because most screen readers already announce dialogs; turn it on if you want QUILL's own cues as well.
- **Jump straight to an open document.** With several documents open, press **Alt+1** through **Alt+9** (and **Alt+0** for the tenth) to go directly to that document by its position, instead of cycling with Ctrl+Tab. If nothing is open at that position, QUILL tells you and stays put. The bindings are remappable in the Keymap Editor.
- **Quieter Read Aloud for screen-reader users.** While Read Aloud played, QUILL selected each sentence in the editor to follow along — which made your screen reader announce the selection ("...selected") over QUILL's chosen voice. This follow-along is now **off by default**, so the cursor stays put and only the Read Aloud voice is heard. Sighted and low-vision users who want the cursor to track what is being read can turn it back on with the new **Move cursor to follow Read Aloud** setting (Settings → Read Aloud).
- **Portable installs update to the portable build, not the installer.** Check for Updates now recognises when you are running the portable bundle and offers the portable **.zip** for that release instead of pushing the Windows installer at you. The download lands in your updates folder with an "Open folder" button so you can swap it into place; installed copies keep getting the installer exactly as before.
- **Three classic-editor power features for keyboard-first writers.** Inspired by the venerable WordPerfect Editor, three additions that have no equivalent elsewhere in QUILL:
  - **Repeat Next Command** (Edit menu). Set a count, then the very next command runs that many times — move down twenty lines, delete ten words, or insert forty dashes in one gesture. The count applies once and clears. Works with any command, including a recorded macro. Unbound by default; assign a key in the Keymap Editor.
  - **Restore Deleted Text** (Edit menu). QUILL remembers the last three blocks removed by its structured delete commands (delete to line start/end, delete to document start/end, delete paragraph). Choose one from an accessible list and it is re-inserted at the cursor. Unlike Undo, which only reverts the last edit in place, this can place recovered text anywhere.
  - **Describe Character at Cursor** (Tools → Advanced). An accessible dialog — the same read-only style as F1 help — that names the exact character under the caret: its Unicode name, code point (hex and decimal), category, and plain-language notes for invisibles that are easy to miss (no-break space, zero-width space, smart quote, tab, line ending). The screen-reader descendant of "Reveal Codes".
- **Braille repair tools for files that will not emboss — Braille → Repair.** A new submenu brings NLS-style proofreading to QUILL's braille mode:
  - **Read Layout Metrics** speaks the diagnostic numbers in one pass: the cursor's cell and current line length, the longest line in the file against your cells-per-line limit (with a "page width exceeded" warning), the current and total braille pages, and the longest page against your lines-per-page limit (with a "page depth exceeded" warning).
  - **Go to Longest Line** and **Go to Longest Page** jump the cursor straight to the worst offender so you can fix a page-width or page-depth problem by hand.
  - **Remove Trailing Spaces on This Line** and **Remove Trailing Spaces in Whole File** clear the trailing spaces that cause most page-width problems, preserving every line ending and form feed.
  - The limits come from your existing **Cells per line** and **Lines per page** braille settings (Preferences → Braille), so the diagnostics match your page geometry.
- **Reveal Codes — see and hear every hidden formatting code (Alt+F3).** The beloved WordPerfect feature, reimagined screen-reader-first. Press **Alt+F3** (or **View → Reveal Codes**) to open a pane below the editor that shows your document as a stream of bracketed codes and text — `[Bold On]`, `[Font: Arial]`, `[Center]`, `[Tab]`, `[¶ Hard Return]`, `[No-Break Space]`, and more — so nothing about your document is hidden from you. **F6** moves between the editor, the Reveal Codes pane, and the status bar (**Shift+F6** goes back); the two carets stay in sync, so moving in the pane moves the editor caret and vice versa. Each code is an individually-announced, navigable item: arrow code-to-code, jump from a `[Bold On]` to its matching `[Bold Off]`, and hear "bold on, 12 characters." Choose a **Structured** list (one labeled item per code — the most accessible) or a **Flowed** view (codes inline within the text, the classic visual/braille layout) and a quiet / balanced / detailed verbosity — all in Settings. Hidden by default; nothing changes about your clean editing buffer.
- **Inline notes — sticky comments tied to your content.** Press **Alt+Shift+I** to jot a private note about the current line or your selection. The note is **anchored to the text**, so it follows that content as you edit and is **remembered the next time you open the document** (per document, like bookmarks). Move between notes with **Alt+Shift+J** (next) and **Alt+Shift+G** (previous) — the cursor jumps to the noted text and QUILL announces the note. Press **Alt+Shift+H** to hear the note at the cursor, and **press it again quickly** to open it for viewing, editing, or deleting. If the noted text is later removed, the note is kept (never silently lost) rather than pointing at the wrong place. All keys are remappable in the Keymap Editor; untitled documents keep notes for the session until you save.

## 0.8.0 Beta 1 (in development)

First public 0.8.0 beta. Rolls up the 0.7.0 line plus the changes below. This section doubles as the in-app release notes: the same text appears when you **Check for Updates** and any time from **Help > What's New**.

### What's New in this beta

- **First run no longer shows a second setup wizard.** A leftover legacy onboarding path could re-open a "Startup Wizard" overview (a read-only intro plus a privacy step list) and a "Start guided setup now?" prompt on every launch after the first run. That entire path has been removed: first run shows the single unified setup wizard and QUILL never re-prompts; each feature it covered remains set up from its own menu.
- **Release notes now show when you check for updates.** When an update is found, QUILL presents an abbreviated, screen-reader-friendly summary of what changed in a read-only multi-line edit (the same control help text and wizards use), alongside **Download**, **Skip this version**, and **Later**. The notes are sourced from this changelog, so every release carries a short "what's new" list.
- **New: Help > What's New.** See the current build's release notes on demand, between updates, in the same accessible control — so the format is familiar when an update lands.
- **Faster, simpler update prompt.** The update dialog no longer waits on a one-time WebView2 warm-up before it can appear.

### Runtime and packaging

- **Bundled Python runtime moved to 3.13.** The Windows installer's embedded interpreter is now CPython **3.13.14** (was 3.12.6). Minimum supported Python stays 3.12. Every bundled dependency ships a 3.13 Windows wheel.
- **Native Windows OCR migrated off `winsdk` to the `winrt-*` packages.** `winsdk` (the legacy monolith) shipped no wheel past CPython 3.12, which blocked the 3.13 move; it is replaced by Microsoft's pywinrt namespace packages (`winrt-runtime`, `winrt-Windows.Media.Ocr`, and the Graphics.Imaging/Globalization/Storage namespaces), which ship 3.13 wheels. The projected API is identical, so zero-install Windows OCR (OCR-1) is unchanged for users. Internal: `quill/platform/windows/windows_ocr.py` imports from `winrt.windows.*`; the availability flag is now `_WINRT_AVAILABLE`.
- **Kokoro neural voices are now bundled in the installer.** The Kokoro ONNX model and voices ship under `{app}/kokoro-models`, so the engine works offline at first launch without the ~114 MB download. The build stages them from a local directory (`--kokoro-dir`) or downloads and SHA-256-verifies them from the pinned kokoro-onnx release.

### Documentation accuracy and locked-feature hygiene

- **Documentation reconciled against the code.** All user-facing docs (user guide, release notes, control reference, PRD, keybinding standard) were verified against `quill/ui/main_frame_menu.py`, `quill/core/keymap.py`, and `quill/core/feature_catalog.py`. Locked-off features (**BITS Whisperer**, **GLOW**) were removed from the user-facing docs and preserved in `docs/planning/deferred-locked-features.md`; offline-speech menu paths were corrected to the flat **Tools > Speech** (the gated "Whisperer" submenu no longer appears in docs); and stale keybindings/menu names were fixed to match the code — AI Grammar and Style (`Ctrl+Alt+Shift+G`), Translate Selection (`Ctrl+Alt+Shift+T`), AI Thesaurus (`Ctrl+Alt+Shift+H`), Compare navigation (`Ctrl+Alt+Shift+.` / `,` / `D`), Verbosity Quiet/Meeting/Undo (no default key), Replace (`Ctrl+H`), Browser Preview (`QUILL Key + V`), List submenu under **Insert** (not Format), the **Advanced** Tools submenu (was documented as "Power Tools"), and **Keymap Editor** (was "Keyboard Manager").
- **No deferred-feature brand shows in a default build.** The offline watch-folder action was renamed "Transcribe audio (Whisperer)" → **"Transcribe audio (offline)"** (`quill/core/watch_transcribe.py`); and the About-dialog overview paragraph, the Transcription settings-group description, and the trust-consent disclosure were de-branded so they no longer name the deferred **BITS Whisperer** suite or **GLOW**. The full BITS Whisperer suite (menu, dialogs, provider/rollout surfaces) remains in the code but gated off behind the locked `core.bw_whisperer` flag for QUILL 2.0, so none of it renders today.
- **Dead keybinding fixed.** New Sticky Note (`tools.sticky_note_capture`) defaulted to the QUILL-key chord `N`, which the prefix handler intercepts for browse mode (so the chord never fired). It is now **`QUILL Key + Shift+N`** in `DEFAULT_KEYMAP` and the default/screen-reader keymap profiles.

### One dialog for batch speech and audiobooks

- **Build Audiobook from Folder is folded into Batch Export to Speech Audio.** The two near-identical dialogs are now one. In **Tools > Speech > Batch Export to Speech Audio...**, tick **Assemble the results into one audiobook** to reveal the book tags (title/author/narrator/genre/year), a cover-image picker, the book format (M4B/MP3), an ACX-loudness option, and a save-as path. After your documents are synthesized — one chapter each — the produced (and any pre-recorded) audio in the folder is combined into a single chaptered book. The standalone Build Audiobook dialog and its menu item were removed; the build logic (`quill/core/speech/audiobook.py`) is unchanged.
- **The "Kokoro speed" control now announces its name.** The speed spinner is a `SpinCtrlDouble`, whose embedded edit field did not inherit its adjacent label, so screen readers read it unnamed on Tab; it (and the Rate spinner) now carry explicit accessible names.
- **Choose where temporary files live, and keep a log.** A new **Temporary files folder** field puts each run's scratch dir under a folder you pick (blank = system temp). A timestamped diagnostic log is created in the output folder *before* conversion starts and records discovery, per-document progress and timings, skips, errors, and the audiobook build. An optional **Save the text sent to speech** checkbox writes a `<doc>.spoken.txt` sidecar of the exact text each document speaks.
- **A real progress dialog with a percentage.** Conversion now shows a focused, screen-reader-announced progress dialog whose percentage is words processed divided by total words, and which can be **minimized to the status bar** like other long operations. It opens after the configuration dialog closes so screen-reader focus reliably lands on it, and it advances **per audio chunk** — so even a single long document (or one with no headings) shows real movement instead of sitting on "Preparing...".
- **Fixed a heading-less document appearing to hang.** A Word document with no headings is one large section; it was handed to Kokoro in one oversized call (far past Kokoro's small context window), which stalled. Neural engines now synthesize in much smaller chunks (Kokoro especially), so these documents complete and report steady progress.
- **Review chapters before building.** Tick **Review chapters (rename/reorder/merge) before building** to open a chapter editor after synthesis; assembling a folder of pre-recorded audio always opens it. Rename, reorder, and merge chapters, then build. (This is the editor from the old standalone Build Audiobook dialog, brought back into the consolidated flow.)
- **Accessibility: spinner and list labels.** The "Kokoro speed" control is a composite whose inner edit field is what a screen reader focuses; its accessible name now reaches that inner field. The round-robin voice list and translated-languages list got adjacent labels so they are announced by name on Tab.

### Community fixes

Contributed by **Kelly Ford**:

- **New document tabs land focused, not blank.** Opening a document via **Open from URL**, **Import**, or **Open from Remote** could leave the new tab's editor unfocused and visually blank until you manually tabbed out and back — the closing modal dialog (a file, URL-entry, or remote-sites dialog) was restoring focus to the previous tab. The new tab now reliably receives focus, matching the normal Open flow (#805).
- **The Pandoc download shows a real, cancelable progress dialog.** The first time a conversion needs Pandoc, its on-demand download now opens the same accessible percentage dialog as the other on-demand downloads (ffmpeg, offline speech engines) — with a Cancel button and screen-reader-announced progress — instead of a status-bar line that was easy to miss (#807).

### Post to Mastodon, straight from the editor

- **Publish to Mastodon without leaving QUILL.** Press **QUILL Key + Shift+P** (or **Tools > Share > Post to Mastodon...**): QUILL takes your selection — or the whole document if nothing is selected — and opens a compose dialog where you edit the text, pick which account to post from, choose visibility (Public / Unlisted / Followers-only / Direct), and see a live character count. Posts appear **"via QUILL"**. This is a lean poster, not a full client (no timelines or media in this first version).
- **Multiple accounts, with friendly names.** **Tools > Share > Mastodon Accounts...** lets you add accounts (each with a nickname shown in the picker), set a default, and remove one. Adding an account registers QUILL on your server and uses a one-time browser authorization (you paste a short code back). Sign-in secrets are stored in the Windows Credential Manager / DPAPI, never in a plain file. New wx-free `quill/core/mastodon/` package (single audited `urllib` egress site in `client.py`); dialogs in `quill/ui/mastodon_dialogs.py`.

### Voice previews you can actually hear

- **Preview any voice with the Preview button — even before downloading it.** In **Manage Voices**, selecting a voice and pressing **Preview** now: synthesises the preview phrase with the voice's real model when it is downloaded, or plays a bundled pre-recorded sample (`quill/data/voice-previews/`) when it is not — so a Kokoro voice (or any not-yet-downloaded voice) can be auditioned before you commit to the ~114 MB download. The rate/volume/pitch/speed controls now **dim until the voice is downloaded** (they only affect real synthesis), and the wording points at the Preview button instead of an unreliable double-click/Enter. The eSpeak "Voice character" variant stays hidden for engines that don't use it.

### Suggest a filename from the first line

- **A new option pre-fills the Save dialog with a name taken from your document's first line.** Turn on **Suggest a filename from the first line** (Settings, General) and when you save an untitled document, QUILL proposes a name derived from the first line — across formats, stripping leading markup (a Markdown `#` heading, a `>` quote, a `-` list bullet, or inline HTML tags) and sanitizing it into a valid filename. Off by default; applies to Save As, Export, plain-text save, and DAISY. New wx-free `quill/core/titles.py`.

### Sound packs you can actually pick

- **The first-run Sound-pack control is now a dropdown of the packs that ship with QUILL**, replacing a `*.qsp` file picker that could never select them — the bundled packs are folders, not files, so the old picker was effectively broken. The dropdown defaults to **QUILL's own pack (Ink)**, so turning sound on always gives you working earcons. Bundled choices are stored as a stable `bundled:<id>` reference (or `""` for the default) and resolved against the install, so a chosen pack survives a move or reinstall instead of going silent. New `available_sound_packs()` / `resolve_sound_pack_path()` in `quill/core/sound_pack.py`.

### Upgrade hardening (durability for beta upgraders)

- **A corrupt config no longer crashes startup or silently vanishes.** If `settings.json` or `keymap.json` is present but unparseable, QUILL now **quarantines** the original to `migration-backups/<name>-corrupt-*` and falls back to defaults, instead of raising on load (`migration_backup.backup_corrupt_file`).
- **Changed *settings* defaults can be pushed to existing users, like shortcuts.** The recommended force-once mechanism now covers settings too (`RecommendedSettingsUpdate`), so an important changed default isn't permanently pinned in an upgraded full-snapshot file. Same opt-out (**Apply recommended keyboard-shortcut updates**).
- **The persistence contract is now enforced by a gate.** `quill/tools/persistence_audit.py` classifies every JSON-write site; a test fails if a new persisted store appears without deciding whether it needs the versioned-delta migration.
- **Every config store now carries a schema version.** The backlog the gate surfaced is cleared: each previously-unversioned config file (remote/SSH sites, AI engine/model/provider config, publishing connections, quillin settings, read-only guards, profile-startup, deepgram, and more) now stores a `schema_version` (bare lists/maps wrap in a versioned envelope, with old files still loading), so a future shape change is migratable. And `read_json` is now **corruption-tolerant globally** — a malformed config file degrades to its default instead of raising, so one bad file can never crash a load path.

### Upgrade hygiene: default hotkeys now reach existing users, and prior-install data can be imported

- **Changed and new default hotkeys now reach existing users automatically.** `keymap.json` previously stored a full snapshot of every binding, so once you had used QUILL, a later change to a default shortcut never reached you — your file pinned the old value for every command. It is now stored as a **delta of only your customizations** plus a `_defaults_epoch` stamp, so any command you have not personally rebound always tracks the current default. This removes the fragile "add an old→new migration entry for every default change" tax: changing `DEFAULT_KEYMAP` is now enough. Legacy full-snapshot files are converted to the delta format once, on first load, and stamped — preserving your genuine customizations. (`quill/core/keymap.py`.)
- **Find is forced back to `Ctrl+F` on upgrade.** As part of that legacy conversion, several pre-release builds that defaulted **Find** (`edit.find`) to a QUILL-key leader chord (e.g. `QUILL Key + Z`) are corrected: any leader-chord Find binding in a legacy keymap is reset to **`Ctrl+F`**, in place, with no data migration required. A non-leader Find you set deliberately (e.g. `Ctrl+Alt+F`), and any leader-chord Find you choose *after* upgrading, are left alone.
- **Settings now carry forward across upgrades, with a recoverable backup.** `settings.json` was a full snapshot, so a changed default never reached you and a new setting only arrived through code. It is now a **delta of just your changes** plus a `schema_version` stamp, so new settings arrive at their defaults automatically, changed defaults reach you unless you overrode them, and your customizations are preserved. The first launch after upgrade converts an old file once; the original is copied to `migration-backups/` first so the conversion is always reversible. Shared, reusable plumbing lives in the new wx-free `quill/core/versioned_store.py` and `quill/core/migration_backup.py`; settings serialization is in `quill/core/settings_migration.py` (`schema_version` 2). The contract is documented in `docs/design/persistence-and-migration.md`.
- **Recommended updates: important default changes can be pushed once, and you can opt out.** When a default change matters enough to apply even to people who already customized it — restoring **Find** to `Ctrl+F` is the first — a *recommended update* sets it **once**, then never touches it again, so you remain free to rebind. Turn the whole mechanism off with **Apply recommended keyboard-shortcut updates** in Settings if you would rather keep your own choices untouched. (`quill/core/recommended_updates.py`.)
- **You choose how upgrades are surfaced, and can undo a shortcut change.** A new rich **Upgrade notice** setting (`migration_notice`, Administration group: **Silent** / **Brief announcement** (default) / **Summary with Undo**) controls what QUILL says when it migrates your settings or applies a recommended shortcut fix on update. The **Summary with Undo** dialog and the **Undo Recent Shortcut Change** command (`tools.undo_recommended_updates`) revert a correction like Find→`Ctrl+F` while leaving it from re-applying. The migrate-and-surface plumbing is shared (`migration_backup.pop_recent_migrations`, `MainFrame._surface_migration_notice`).
- **The installer no longer leaves a half-upgraded app.** Inno Setup only overlays new files; modules renamed or removed between releases could linger next to new ones and crash on launch with `ImportError`/`AttributeError`. The installer now cleanly replaces the first-party `quill` package (and stray `__pycache__`) on every install, while leaving the embedded Python runtime and your `%APPDATA%\Quill` data untouched. (`scripts/build_windows_distribution.py`, `[InstallDelete]`.)
- **Import data from a previous QUILL install.** When QUILL starts in a fresh data location but finds a populated data directory from an earlier install elsewhere (typically after switching between the **portable** and **installed** builds, or when the storage-mode marker was lost on reinstall), the first-run flow now offers to **import your settings, keyboard shortcuts, and documents** and restart to apply them. Detection and the move live in the wx-free `quill/core/data_location.py` (`detect_importable_legacy_dir`, `apply_pending_legacy_import`); the import is applied very early in `quill.__main__.main()` — before settings are read — and the location-control file (`storage-mode.json`) is intentionally left behind so the active data directory does not bounce back to the emptied source. Declining is remembered so you are not asked again.

## 0.7.0 Beta 1 (in development)

First pre-release of the 0.7.0 line. Tagged off `release/0.7.0-verbosity` once the remaining waves (#271 verbosity rebuild, #238-#246 braille phase 3-4, #300-#359 polish, planning-folder retirement) merge. The GitHub Pages update feed remains pointed at 0.5.0 so testers checking for updates do not see a phantom bump until 0.7.0 ships as a stable release. See `RELEASE.md` for the tag-time flip step and the full pre-tag checklist.

### Hold-to-Dictate and Locked Dictation (F9 / Ctrl+F9)

- **Two keyboard-only ways to dictate into the editor, on the existing offline Whisper engine.** Hold **F9** to record and release to insert at the cursor as one undoable edit (Hold-to-Dictate); press **Ctrl+F9** to start a locked session and again to finish (Locked Dictation, announced "Locked dictation on"). While recording, **Escape** stops and keeps the speech, **Shift+Escape** cancels and discards, **Ctrl+Shift+F9** pauses/resumes a locked session, and **Alt+F9** speaks the current state. All six shortcuts are remappable (Keymap Editor) and conflict-checked; Escape/Shift+Escape are only consumed while a session is active.
- **A Dictation Settings panel.** **Tools > Speech > Hold & Locked Dictation > Dictation Settings…** exposes the dictation knobs the controller reads: the Locked-Dictation time limit, the minimum hold to start (to ignore accidental F9 taps), stop-and-keep-speech on focus loss, intelligent insertion spacing, and a reset to show the one-time first-use hint again. Accessible, keyboard-first; saves to settings.
- **A Dictation History & Review window, with startup recovery.** **Tools > Speech > Hold & Locked Dictation > Dictation History & Review…** lists every dictation recording whose transcript was never inserted — crash orphans and transcripts that couldn't be safely placed — so you can **insert** it at the cursor, **copy** it, or **discard** it (Enter inserts the selected row). On startup, if any recordings are awaiting review, QUILL announces it and points you here, so speech is never silently lost.
- **Locked Dictation now sounds distinct, and a one-time hint explains the keys.** Locked Dictation plays its own **distinct earcons** (`dictation_locked_on` / `dictation_locked_off`, new in the bundled Ink pack) instead of sharing the Hold-to-Dictate transcription cues, so a sustained locked session is audibly different from a press-and-hold one. The first time you start dictation, QUILL speaks a **one-time onboarding hint** (the F9 / Ctrl+F9 keys and Escape behavior) and remembers not to repeat it (`dictation_onboarding_shown` setting).
- **Built as a protected transaction.** New wx-free `quill/core/speech/dictation/` package: an explicit `DictationController` state machine (no bare `is_recording` boolean; the single-recorder invariant is enforced), `DictationSession`/`InsertionContext` records, conservative insertion spacing, and a `DictationRecoveryRepository` that saves audio to `recovery/dictation/` **before** transcription begins. Audio is secured before Whisper runs, a missing key-up cannot leave the microphone open (a watchdog polls physical key state), Locked Dictation stops at five minutes and on focus loss, the stop tone plays only after capture ends, and a transcript that cannot be safely inserted is kept for review rather than lost. The wx wiring lives in `quill/ui/main_frame_dictation_hotkeys.py`; `MicRecorder` gained pause/resume. Tests: `tests/unit/core/speech/dictation/` (42) plus capture and feedback-table tests. Remaining follow-ups are tracked in `docs/planning/program-tracker.md` (Speech & Dictation).

### Structured List Studio (F2)

- **Build and edit lists by concept, not syntax.** A new context-sensitive **F2** command (also **Insert > List > Structured List Studio...**) opens an accessible dialog that turns a selection into a list or starts a new one, supports **Bulleted / Numbered / Checklist / Definition** lists, and generates valid Markdown or HTML with a live read-only source preview — so the user never types `-`, `1.`, `[ ]`, `<ul>`, or `<dl>`. Definition lists emit semantic `<dl>`/`<dt>`/`<dd>` (HTML) or a Pandoc-compatible syntax (Markdown). Inserting is one undoable edit. **F2** moved Insert Special Character to **Shift+F2** (both remappable, with a legacy-binding migration). New wx-free `quill/core/lists/` package (model, import interpretation with ambiguity detection, renderers, conversions with information-loss detection, announcements) and the `quill/ui/list_studio_dialog.py` shell. This release covers flat lists and the common one-term/one-definition case; nested editing, multi-term/definition, import/conversion previews, and the full Settings/preset surface are planned follow-ups. Tests: `tests/unit/core/lists/` (42) plus dialog-wiring tests. See `docs/planning/quill-structured-list-studio-prd.md`.

### Document Language: edit anything as any language (#181)

- **A pinned Document Language now drives the editing characteristics, not just token navigation (#181).** Setting a language (HTML on a plain `.txt`, say) makes Bold/Italic insert the right markup, enables the heading/table/list/tag menu items, switches comment toggling to that language's syntax, and steers heading/structure navigation, the outline, link insertion, and live preview — all via a new pin-aware `_effective_markup_kind()`/`_current_markup_context()` and a `markup_kind` on `LanguageProfile`. Comment toggling (`format_ops.toggle_line/block_comment`) takes the profile so it wins over the file name. Set it with **Ctrl+Shift+L**, **Navigate > Set Document Language...**, the new **Format > Document Language** radio submenu, or Enter on the status-bar **Language** segment (which shows **(set)** when pinned). "Auto-detect from file" clears the override; a Save As hint fires when the language's extension doesn't match the file. Tab-only (not remembered across reopen). Added **C#** and **PHP** profiles.
- **Optional automatic language detection on paste/typing (#181).** New wx-free `quill/core/language_detect.py` scores ~18 languages from weighted structural signals with VS Code-style confidence discipline (absolute floor, relative margin, ambiguity penalties for YAML/TOML/SQL, session-history bias, and a `should_switch()` hysteresis gate) — no ML, no dependency. The `language_detection_mode` setting (default **off**; **hint**/**prompt**/**auto**, in Settings > Editing) drives a debounced detector (`main_frame_language_detect.py`) that runs only on unpinned untitled/`.txt` documents, never overrides a real extension or a user choice, and — unlike a silent or visual-only switch — keeps a screen-reader user informed. Verified it does not misfire on plain prose or pasted ASCII-braille (BRF). Tests: `test_language_detect.py` (20 cases), plus markup_kind and profile-aware comment tests.

### Quick Nav: misspellings and search hits as nav types (#513)

- **Go to Anything (Quick Nav) now lists misspellings and active search hits as navigable types.** Alongside the existing landmarks (headings, links, lists, tables, block quotes, bookmarks, code blocks) and their live per-type counts, the unified Quick Nav panel now includes the document's **misspellings** and — when a search is active — the current query's **search hits** as their own categories, so you can filter to and jump straight to a misspelled word or a match from one place. The two transient types are computed on demand for the panel (via `list_misspellings` and `core/search.find_matches`) rather than in the prewarmed browse cache, so the perf-critical navigation cache stays light. New nav kinds in wx-free `quill/core/quick_nav.py`; a new `_quick_nav_panel_context()` augments the index in `main_frame_browse.py`. Tests: `test_quick_nav.py` (transient types in the index, count panel, filtering) and `test_main_frame_navigation.py` (the panel context surfaces misspellings + hits). Closes #513 (and folds in the undefined NAV-10 stub #578).

### AI Voice: cloud TTS with Google Gemini and OpenAI

- **The AI Voice read-aloud and audio export now support Google Gemini 2.5 TTS in addition to OpenAI.** A provider-neutral layer (`quill/core/ai/cloud_tts.py`) selects the backend, lists each provider's models and voices (OpenAI 11 voices, Gemini 30), estimates the USD cost of a synthesis before it runs, and dispatches read-aloud/export. New `quill/core/ai/gemini_tts.py` calls the Gemini TTS REST API (the key travels in the `x-goog-api-key` header, never the URL), wraps its 24 kHz PCM into WAV, and is recorded in the network-egress audit. Pick the provider, model, and voice under Settings > Read Aloud; OpenAI exports MP3, Gemini exports WAV; "Export Document as MP3" is now "Export Document as Audio".
- **ElevenLabs joins as a premium cloud-TTS provider for audio export.** Export your document to ElevenLabs' natural, audiobook-grade narration (MP3) by choosing **ElevenLabs (export only)** under Settings > Read Aloud. All ElevenLabs calls go through a single host-owned gateway (`quill/core/ai/elevenlabs_tts.py`) — the only module that imports the official `elevenlabs` SDK — which retrieves your stored **ElevenLabs API key** (the same credential the ElevenLabs transcription provider uses, never the environment), talks only to `api.elevenlabs.io`, translates SDK errors to clean messages, chunks long text on safe boundaries, and is cancelable. It ships as an optional extra (`pip install quill[elevenlabs]`) and is inert until installed and a key is set; Safe Mode and the AI Voice per-action consent both apply, and the gateway is recorded in the network-egress audit. A conservative cost estimate is shown before export. **Scope note:** this release covers ElevenLabs **audio export**; live per-sentence Read Aloud through ElevenLabs (streaming) is planned for a later release (roadmap §4.2).
- **Long documents are split on safe boundaries so synthesized audio never ends on a weird spot.** A shared, boundary-safe splitter (`quill/core/ai/tts_chunk.py`, learned from the git-going-with-github Kokoro audiobook generator) normalizes whitespace and groups whole sentences under each provider's per-request character cap, only ever falling back to a word boundary for a single over-long sentence — never mid-word. Gemini's concatenated chunks get a short inter-chunk silence gap and a trailing tail so sentence endings are not clipped. Tests: `test_cloud_tts.py` (boundary safety, cost estimation, Gemini REST shape + error mapping, WAV header/tail, provider dispatch).

### Read Aloud engines: SAPI 5 system voice, DECtalk fix, full voice previews

- **Windows system speech now runs on SAPI 5 directly; the pyttsx3 dependency is removed.** Read Aloud's "System TTS" engine and the screen-reader-less self-voicing announcement fallback (`prism_bridge`) both talk to the SAPI 5 `SpVoice` COM object through `comtypes` instead of pyttsx3, in a new wx-free `quill/platform/windows/sapi5.py` (voice enumeration, WAV file synthesis via `SpFileStream`, and a worker-thread singleton for announcements). This drops pyttsx3 and its `runAndWait()`-reuse external-loop workaround. The engine id is now `sapi5`; settings stored under the old `pyttsx3` id migrate automatically, and SAPI token IDs match the old pyttsx3 voice IDs so saved voice selections carry over. `comtypes` is now a direct (Windows-only) dependency.
- **DECtalk Read Aloud actually works: synthesis is driven through `DECtalk.dll`, not the GUI `speak.exe`.** The bundled DECtalk package's `AMD64\speak.exe` is the graphical "Sample Speak Window", not a console synthesizer — invoking it with `-file`/`-wav`/`-dict` made it fast-fail at startup (`0xC000041D`, `STATUS_FATAL_USER_CALLBACK_EXCEPTION`). A new self-contained console worker (`quill/core/speech/dectalk_say.py`) loads `DECtalk.dll` with `DO_NOT_USE_AUDIO_DEVICE` and writes a validated WAV; `synthesize_to_file_with_dectalk` runs it out-of-process (payload on stdin as Windows-1252, `-w` output), and DECtalk discovery now requires `DECtalk.dll` and rejects `speak.exe`. Both Read Aloud and preview generation share this path.
- **File synthesis no longer flashes a console window, and eSpeak-NG can't hang the run.** The Piper and eSpeak-NG file-synthesis subprocesses now launch with `CREATE_NO_WINDOW`, so batch and export runs no longer pop a console window between files (a real distraction for screen-reader users), and the eSpeak-NG file synthesis carries a timeout that surfaces a clean "did not complete" error instead of stalling the task.
- **eSpeak-NG no longer crashes for portable/managed installs.** `synthesize_with_espeak` now passes `--path` to the co-located `espeak-ng-data` directory when present, so the in-app-downloaded and bundled portable eSpeak-NG synthesize cleanly instead of segfaulting (`0xC0000005`) when they cannot locate their data directory.
- **Kokoro catalog corrected to a real, CPU-only voice.** The non-existent `am_zeus` (which silently fell through to a torch/GPU download) is replaced by `am_santa`, the actual 28th English voice present in the bundled CPU ONNX pack — so the full 28-voice catalog works on the offline ONNX path with no GPU.
- **Bundled voice previews now cover every catalog voice and share one phrase.** All preview clips (Piper 37, Kokoro 28, eSpeak 8, DECtalk 9, plus the Windows SAPI voices) speak the same phrase from a single `phrase.txt` at the repo root, generated by `scripts/gen_voice_previews.py` (which now also covers SAPI 5 voices and returns a non-zero exit on any per-voice failure).

### Batch Document-to-Speech: a folder of documents to audio

- **Convert a whole folder of documents to speech audio in one pass (Tools > Speech > Batch Export to Speech Audio).** A keyboard-first dialog collects a source folder, the file types to include (.docx/.md/.html/.txt), the engine/voice/pace, the output format, and the chapter options, then runs the conversion on a background task with per-file progress and cancel. The conversion core is wx-free and headless-testable: `quill/core/speech/batch_export.py` (scan → extract → normalize → pronounce → polish → synthesize) plus `batch_discovery.py` (folder scan + filters) and `batch_manifest.py` (run report). Each document is read with the same shared pipeline live Read Aloud uses, so the voice you audition is the voice you get. **Richer `.docx` extraction** reads tables row by row (cells joined as "cell, cell"), pulls in **footnotes** (as a trailing "Footnotes" chapter) and **header/footer** text, and walks the body in order so a table never scrambles the surrounding prose.
- **Heading-aware chapterization with MP3 *and* M4B chapter markers.** `quill/core/speech/chapters.py` writes ID3v2.3 CHAP/CTOC frames (the format Apple Podcasts, Overcast, VLC, foobar2000 navigate) so a long document becomes a navigable, chaptered audio file; `chapter_assemble.py` stitches heading sections with a configurable inter-article pause, an optional transition earcon — a natural **page-turn cue by default** (`quill/assets/audio/page_turn.wav`), or your configured `batch_speech_chapter_sound_id` from the **active sound pack**; any chosen or default sound is **conformed** (resampled, channel-mixed, width-matched) to the speech format so it always splices cleanly, with the synthesized chime only as a last resort — with a clean and a with-tones variant sharing identical chapter timing, spoken headings, inter-sentence pauses, and an anti-clipping tail pad. The batch dialog now also offers **M4B audiobook** output with **native MP4 chapter atoms** (via ffmpeg FFMETADATA in `quill/core/speech/ffmpeg.py`) — the Apple/audiobook format — built from the same chapter timing as the MP3 markers. A very long section is **auto-chunked** on safe sentence/word boundaries (via `tts_chunk`) so a single synthesis call never runs past the engine timeout, and the run reports **each document's chapter count** (and a total in the summary). A **Chapter mode** choice adds **Separate file per article** — instead of one chaptered file, each heading-bounded section is written as its own `NNN - <heading>` audio file into a per-document folder. A **Dry run** option writes a `<doc>.preview.txt` of the exact spoken text — after normalization, pronunciation correction, and polish — for each document **without synthesizing**, reporting the pronunciation-substitution count, so you can review what will be said before paying for the (slow) synthesis.
- **Translated audio export — local *and* cloud voices, batch *and* single-document.** Export a document's audio in additional languages: pick a language (any of QUILL's ~37 translatable languages) and a voice, **Add language**, and QUILL translates and writes `<doc> (<Language>).<ext>` alongside the original. Two surfaces: **Batch Export to Speech** (a whole folder) and a new single-document action, **Tools > Speech > Export to Translated Speech Audio**, for just the current document. Translation uses **any configured AI provider** (the export rides QUILL's AI gateway) or **LibreTranslate** (local), with bounded-backoff retries that **halt a language on persistent failure** rather than emit half-translated audio, and a cache so repeated strings translate once (`quill/core/speech/translate_sections.py`). Voices are offered **local-first** via the per-language voice model (`quill/core/speech/voice_languages.py`): **eSpeak NG** speaks nearly every language fully offline (dialects like Spanish es / es-419), installed **SAPI 5** voices are matched by their language (LCID), and the **premium multilingual cloud voices** (OpenAI / Gemini / ElevenLabs) are offered as the quality tier — they synthesize translated audio through `cloud_tts` and are conformed to WAV via ffmpeg so chapter splicing still works. **Pronunciation dictionaries are language-aware** — a dictionary scoped to a language (`PronunciationDictionary.language`) only affects that language's synthesis. The full chaptered treatment (page-turn cue, chapters, combine-headings, ACX loudness) applies to each translated file. *(Remembering the language list per project is the one remaining 2.0 nicety.)*
- **Cost is surfaced before any metered cloud run.** Because a translated cloud run can meter twice — to translate (paid cloud AI) and to synthesize (cloud TTS) — QUILL shows a **combined estimate** and asks to proceed first (`quill/core/speech/cost_estimate.py`): TTS is priced precisely per provider/model, translation is free for LibreTranslate or a local AI model and estimated from a blended per-character rate for a paid cloud provider. Local-only runs are never interrupted.
- **Voice-failure blacklist (batch robustness).** A voice that fails synthesis — a broken SAPI token, a missing model, a rejected cloud voice id — is recorded and **skipped on later runs**, so one bad voice in a round-robin rotation no longer keeps aborting a batch. Persisted atomically in the app data dir (`quill/core/speech/voice_blacklist.py`); the round-robin rotation drops blacklisted ids and any new failure this run is remembered for next time.
- **Loudness normalization for batch export (ChapterForge-style).** A **Normalize loudness to audiobook (ACX) level** checkbox brings the audiobook-grade loudness the audiobook builder already had to batch document-to-speech: each output is run through a **two-pass `loudnorm`** (measure with `print_format=json`, then apply seeded with the measured values, `linear=true`) applied to the assembled WAV before encoding, so MP3/M4B **chapter markers survive** and the timing stays exact (loudnorm preserves duration). Falls back to a single pass if the measurement can't be parsed, and is a no-op (keeps your audio) when ffmpeg is absent. Persisted per project. New `loudness.normalize_wav_loudness`. Tests in `test_loudness.py`.
- **Combine empty headings, and round-robin voices.** Two new Batch Export to Speech controls. **Combine empty headings into the next article** folds a heading that has no body of its own into the next article that does and joins their titles (e.g. "Part One: Chapter 1"), so you don't get empty "chapter" announcements — the rule the ACB audio pipeline uses (`text_polish.combine_heading_only_sections`). **Round-robin voices** lets each article/heading be read by the next voice in a list you build: pick a voice from the engine's voices, **Add** it to an ordered list, and reorder with **Move Up / Move Down / Remove** — then section *i* is voiced by voice *i mod N* (`assemble_chaptered_audio(..., synthesizers=…)`). The rotation uses voices of the **selected engine** (so every section shares one audio format and splices cleanly); switching engines clears it. Both options are remembered per project (`.quill/speech-project.json`). Tests: `test_section_combining.py`, round-robin assembler + dialog tests.
- **Configure-once-per-project speech settings.** A project (a folder of documents) remembers its whole speech profile in `<project>/.quill/speech-project.json` (schema `quill/core/schemas/speech_project.json`): synthesizer + voice/pace, output, discovery, chapters, text normalization, the active pronunciation dictionaries, audiobook metadata, and execution policy. `to_batch_options` drives the batch pipeline straight from a project file, including headlessly in tests. The batch dialog now **applies the project profile on open** (so the folder you last tuned pre-fills its dialog) and **auto-remembers your choices on Start**, with a clear precedence (this run > project profile > global defaults), so per-project speech setup is genuinely configure-once.
- **Maximum flexibility knobs for batch conversion.** Output now covers **WAV, MP3, M4A, M4B (audiobook), Opus, FLAC, and OGG** (compressed formats via ffmpeg, falling back to WAV with a per-file note when ffmpeg is absent), with a selectable **MP3 VBR quality** and an optional uniform **WAV sample-rate / channel** conform. Discovery gained **include/exclude glob filters** and a **max-file-size** cap. The existing-file policy is now **skip / overwrite / rename** (rename keeps both as `name (2).ext`). Output layout supports **flatten** and a **filename template** (`{index:03d} - {stem}`). Compressed outputs are stamped with **audiobook metadata** (album, author/narrator, genre, year; per-file title from the heading/stem, track from the index). Error handling adds **stop-on-error** and **per-file retry**; throughput adds **parallel workers** (clamped to 1 for the single-apartment SAPI 5 / Kokoro engines); and an optional **manifest.json/.csv** records every file's status, output, duration, and errors. Per-engine shaping is exposed for eSpeak (**pitch**, **word gap**) and Piper (**length/noise scales**). Tests: `test_batch_export_flexibility.py`, `test_batch_export_formats.py`, `test_project_profile.py`.

### Build Audiobook from a folder (ChapterForge)

- **Combine a folder of audio files into one chaptered audiobook (Tools > Speech > Build Audiobook from Folder…).** The ChapterForge-aligned surface (design source: the sibling ChapterForge project): point QUILL at a folder of audio files and it builds a single chaptered **MP3** (ID3 CHAP markers) or **M4B audiobook** (native MP4 chapter atoms) master — each file becomes a chapter, titles are derived from the filenames in natural-sort order, a cover image in the folder is auto-detected, and the book's tags (title/author/narrator/genre/year) are written. New wx-free `quill/core/speech/audiobook.py` (folder scan, natural sort, title-from-filename, cover detection, ffprobe duration, and the ffmpeg concat-demuxer build) behind the keyboard-first `quill/ui/audiobook_builder_dialog.py`, run on the background task pool. Tests: `test_audiobook.py` (scan/sort/titles/cover + the concat command builders). Only the surfaces that fit QUILL's audiobook vision are ported; ChapterForge's Auphonic, RSS-feed, SFTP-publish, and metadata-lookup features are intentionally left out.
- **Edit the chapters before building — rename, reorder, merge.** The builder now lists the chapters and lets you **rename** the selected one (inline title field, Enter or the Rename button), **move** it **up** or **down**, or **merge** it into the chapter above (two source files then play as one chapter with a single marker — `AudiobookChapter.extra_paths`). The edited plan rides through `AudiobookRequest.chapter_plan` into `audiobook.chapters_from_plan`; the chapter list is keyboard-activatable (GATE-13).
- **One-click ACX loudness compliance.** A **Normalize loudness to ACX (Audible/audiobook) spec** checkbox runs an ffmpeg `loudnorm` pass during the build (so chapters and tags are preserved), targeting the ACX window (RMS between -23 and -18 dB, peak under -3 dB). After the build QUILL measures the finished master with `volumedetect` and reports the RMS/peak verdict in the completion status. New wx-free `quill/core/speech/loudness.py`; tests in `test_loudness.py`. (FLAC/Opus audiobook *output* is intentionally not offered — neither format carries chapter markers; both remain accepted as source files. Direct publishing to WordPress/etc. is tracked for a later release.)

### Pronunciation dictionaries: teach QUILL how to say things

- **Per-engine, global-or-project pronunciation dictionaries applied everywhere speech happens.** A new wx-free core (`quill/core/speech/pronunciation.py`, schema `pronunciation.json`) stores ordered substitution rules (literal or regex, case-sensitive optional, per-engine scoping) in global (app-data) and project (`<project>/.quill/pronunciation/`) dictionaries. Corrections are applied as a silent text transform **before** synthesis in both batch export and live Read Aloud — the same stage in one shared pipeline — so a fix made once is heard everywhere. A **Manage Pronunciations…** dialog (Tools > Speech) edits entries with live Read-Aloud preview and audio audition, and a bundled **starter dictionary** ships common tech/brand pronunciations out of the box.

### TTS text normalization: clean text in, clean speech out

- **Configurable, deterministic text cleanup before synthesis (`quill/core/speech/text_normalize.py`).** Real documents are full of typography that makes engines stumble — curly quotes, em/en dashes, ellipses, invisible spaces, soft hyphens, ligatures, bullets, symbols, fractions, emoji, control characters — and of structured tokens that must be spoken clearly. Normalization runs first in the shared pipeline with excellent defaults and rich per-pass options, including per-type speaking profiles for **phone numbers, emails, and URLs** (announce / speak / speak-then-repeat, with a long-URL threshold). It also speaks **publication shorthand** (`Vol.`→"Volume", `No.`→"Number") and **resolution-style numbers** (`2025-02`→"2025 dash 2"), both on by default and opt-out (the ACB pipeline learnings). It is opt-in via the `tts_normalization` setting and carried per project in the speech profile.

### SSML Builder and native SSML playback

- **Author guided pronunciation/prosody without hand-writing SSML.** A new **SSML Builder** dialog composes `<speak>` markup (emphasis, breaks, say-as, phoneme, prosody) from accessible controls with a read-only source preview, for fine-grained control over how a passage is spoken.
- **Native SSML playback on SAPI 5 and eSpeak (Phase 6).** Read Aloud now renders assembled `<speak>` utterances natively on SAPI 5 and eSpeak-NG (eSpeak via its markup mode) instead of reading the tags aloud, so `<break>`, emphasis, and prosody take effect; SSML utterances are passed through intact, bypassing punctuation verbalization that would corrupt the markup.

### Offline speech: model manager, formats, and reliability

- **Model downloads no longer freeze the app, and show real progress (#617).** `FasterWhisperProvider.is_available()` did a full `import faster_whisper` (which pulls in CTranslate2 and can take ~25 s on first load) on the UI thread whenever the Speech menu built its registry — freezing the whole app. It now probes with `importlib.util.find_spec` (~2 ms); the heavy import stays in the transcription path, which runs on a worker thread. Model downloads run on a worker thread behind a cancelable progress dialog with a real percentage and screen-reader milestone announcements (Faster Whisper downloads report byte-level progress via a tqdm subclass). Cancel is cooperative — the progress callback raises, aborting the stream and cleaning up the partial file.
- **Discoverable model deletion + machine-fit guidance (#617).** Manage Speech Models now shows an explicit Download / Remove action picker (deletion is no longer inferred silently from install state). The header shows a one-line machine summary (RAM + GPU); each model estimates the RAM it needs and is flagged when it exceeds available memory; the best fit is marked "Recommended for your computer"; heavy models note when no GPU is present; and the download prompt warns on low disk space before starting. Fit/recommendation/disk logic is wx-free in `quill/core/speech/service.py` (unit-tested), reusing the offline-speech RAM/GPU/disk probes.
- **Transcribe almost any audio or video format (#617).** whisper.cpp only reads 16 kHz mono WAV, so other inputs (MP3, M4A, MP4, MOV, MKV, …) could silently fail. When `ffmpeg` is available QUILL now transcodes the file to a temporary 16 kHz mono WAV first via the new wx-free `quill/core/speech/ffmpeg.py` (bundled-first-then-PATH resolver, basename allowlist, runs through `run_subprocess_safely` so no console window flashes); Faster Whisper decodes these formats itself. Without ffmpeg, QUILL passes a `.wav` through and gives a clear, actionable message for other formats. The Transcribe/Captions pickers were widened to the full format list. ffmpeg is GPL/LGPL and QUILL does **not** bundle it (non-redistributor stance) — it uses a system or user-installed copy.
- **Offline speech lives under Tools > Speech (#617).** The on-device transcription, captions, dictation, and voice-command items moved out of the AI menu — they need no AI account or key, so they no longer imply an AI dependency. The Windows installer's optional `speechwhisper` component (whisper.cpp engine payload under `tools\speech\whispercpp`) is now emitted by the installer-script generator so a build keeps the offline engine.
- **Hugging Face download hardening + transparency (#617).** Three changes to how speech models are fetched: (1) the model manager shows each model's license and a model-card URL in the row label and the download confirm (`service.model_card_url` derives it from either the whisper.cpp resolve URL or the FW repo id); (2) supply-chain pinning — whisper.cpp models download from a pinned commit with a per-file `sha256` (the existing verifier now runs), Faster Whisper repos pin a `revision` (new `SpeechModelInfo.revision`), and the stale tinydiarize speaker-detection URL (which 404'd against `ggerganov/whisper.cpp`) was fixed to `akashmjn/tinydiarize-whisper.cpp`; (3) an optional Hugging Face token (new wx-free `quill/core/speech/hf_auth.py`, reusing the `QUILL:huggingface:token` credential) is attached to both download paths when present, a 429 becomes a clear "add a token or retry" message, and `Tools > Speech > Hugging Face Token...` sets it via a masked dialog. A token is not required for the public MIT models. Tests: `test_hf_auth.py`, plus catalog-pinning and license/card-url assertions.
- **Watch Folder can now auto-transcribe arriving audio on-device (WATCH-9).** A new **Transcribe audio (offline)** watch action runs whisper.cpp / Faster Whisper entirely on your machine over each audio or video file a watch profile claims, writing a sibling `.txt` transcript — nothing is uploaded, so it needs no consent (the on-device counterpart to the existing cloud `Transcribe audio (OpenAI Whisper)` action). It replaces the old "not available yet" placeholder, is discoverable in the watch action picker, and reports clear guidance (open Tools > Speech > Manage Speech Models) when no offline model is installed rather than failing silently. New wx-free `quill/core/speech/transcribe.py` picks the best available offline provider and model; the two transcription watch actions moved into a new `quill/core/watch_transcribe.py` to keep `watch_actions.py` within its size budget. Tests: `test_transcribe.py` (8) and the WhispererTranscribeAction cases in `test_watch_actions.py`. This is the first item delivered from the offline-speech consolidation workstream.
- **Choose the transcript output format: Text, SubRip (.srt), WebVTT (.vtt), or Markdown (WATCH-9).** The offline transcribe watch action now honors an `output_format` option and writes the sibling file with the matching extension, reusing `speech/formatters.py` (the action returns the full timestamped result, not just text). SRT/VTT carry timestamps and fall back to plain text when the engine returns no segments, so a profile never writes an empty caption file. A **Transcript format** picker was added to the Add/Edit Watch Profile dialog. To stay under the GATE-11 size budget, that dialog's `_edit_watch_profile` was extracted from `main_frame.py` into a new `quill/ui/main_frame_watch_profile.py` (`WatchProfileDialogMixin`), ratcheting the `main_frame.py` budget down by ~430 lines.
- **Cloud transcription providers can now be added by Quillins (extensions).** A new declarative `transcription_providers` manifest contribution lets a Quillin add a cloud speech-to-text provider (e.g. OpenAI Whisper) to QUILL's speech engine, surfaced wherever you transcribe a file. It is **host-mediated and least-privilege**: the Quillin ships no code and needs no `net` capability — it only *declares* the provider, and the QUILL host performs the upload through its network-egress-audited transcription path, so the sandbox never handles audio bytes or the API key. Only host-vetted `kind`s are accepted, so a manifest can never point the host at an arbitrary endpoint. Cloud providers are **network-backed and excluded from the offline paths** — the offline Watch Folder transcribe action only ever uses on-device engines, so audio is never silently uploaded — and they are unavailable in Safe Mode or without a configured key. New: `quill/core/speech/quillin_providers.py` (host adapter + registry), the `transcription_providers` model/validation/schema, and the bundled reference Quillin `openai-whisper-transcription`. This is the next step in the offline-speech consolidation (#669) — shipping the cloud provider matrix as Quillins rather than core. See `docs/quillins/quillins.md`.
- **New optional offline engine: Vosk (English, very low resource) (#669).** A third on-device engine for old or constrained machines: Vosk (Kaldi) is **CPU-only** and runs on a ~40 MB English model with no GPU — the accessibility-reach option where the heavier engines are impractical. Because its wheel is self-contained (it ships `libvosk`), it now **bundles in the Windows installer** (added to the build's base dependency groups), so installer users get it out of the box — no separate component or native staging, unlike whisper.cpp; from source it is the `vosk` extra (`pip install -e ".[vosk]"`). Like the others it is never imported at startup. Two Apache-2.0 models (`vosk-model-small-en-us-0.15` ~40 MB, `vosk-model-en-us-0.22` ~1.8 GB) download from alphacephei.com via **Manage Speech Models** over verified HTTPS, **MD5-pinned** and zip-slip-guarded on extract; the new outbound host is recorded in the network-egress audit. Word-level timestamps are aggregated into segments. Fully **offline**, so the offline Watch Folder transcribe action can use it. New: `quill/core/speech/providers/vosk.py` + catalog entries; tests in `test_vosk_provider.py`.
- **Two more cloud transcription providers, on a config-driven adapter: Groq Whisper and ElevenLabs Scribe (#669).** Building the cloud provider matrix as Quillins continues. Most cloud speech APIs share a shape — POST audio to an HTTPS endpoint with an API-key header, read the transcript from a known JSON path — so a new wx-free `quill/core/speech/cloud_transcribers.py` describes each as a data-only `RestSpec` and performs the call generically (`transcribe_rest`), making a new kind a data entry rather than new code. Two are added now: **Groq** (`whisper-large-v3-turbo`, the same Whisper model run on Groq's hardware for very fast turnaround) and **ElevenLabs Scribe** (`scribe_v1`, with optional **speaker diarization**). A single generic `RestCloudProvider` host adapter serves every REST kind, selecting its endpoint by `kind`; the one `urlopen` call site is the single reviewed network-egress entry for all of them (HTTPS enforced, verified TLS). The `transcription_providers` manifest enum and validator allowlist grew to `openai_whisper`/`groq`/`elevenlabs`, and two bundled declarative Quillins ship (`groq-transcription`, `elevenlabs-transcription`) — each purely declarative, no `net` capability. Like all cloud providers they are network-backed, excluded from the offline paths, and unavailable in Safe Mode or without a key. Tests: `test_cloud_transcribers.py` (REST call shape, header schemes, raw vs multipart body, HTTPS enforcement, 401 mapping, JSON-path extraction, kind/allowlist consistency) and the `RestCloudProvider` routing case in `test_quillin_providers.py`.
- **Faster Whisper can now be installed on demand, no source checkout needed (#669).** The higher-throughput, GPU-capable Faster Whisper engine pulls in ~110 MB of binary dependencies (CTranslate2, ONNX Runtime, PyAV, tokenizers), so it is not in the installer payload. **Tools > Speech > Download Faster Whisper Engine...** now installs it on an explicit action: wheel-only (`pip install --only-binary=:all:`) into a user-writable engine-pack folder (`<app data>/engine-packs/faster-whisper`, no admin), which is prepended to `sys.path` at startup so the engine then appears in the Speech Engine chooser. Blocked in Safe Mode, behind a confirmation + progress dialog, and the pip-to-PyPI network touch is documented in the network-egress audit. The shipped runtime now keeps `pip` (setuptools/wheel are still pruned; a wheel-only install needs no build backend) to power this. New wx-free `quill/core/speech/engine_install.py`; tests in `test_engine_install.py` (command shape, Safe Mode block, unsupported-runtime guard, pip-failure surfacing, post-install import verification, sys.path activation).

### Text-file round-trip and accessibility fixes

- **UTF-8 BOM no longer leaks into the buffer (#648).** `quill.io.text.read_text_document` reads raw bytes, detects a UTF-8 BOM, decodes with `utf-8-sig` (so no editable `U+FEFF`), and stores `utf-8-sig` as the encoding so the BOM is re-added byte-for-byte on save. Byte-exact round-trip tests in `tests/unit/io/test_text.py`.
- **CRLF and blank-line runs preserved on save (#649).** Line endings are now detected from the raw bytes (the previous `path.read_text()` translated CRLF→LF before detection, so it always mis-detected LF). `quill.io.export.write_document_as` writes `.txt`/`.text` verbatim instead of routing them through `markdown_to_plain_text`, which collapsed runs of 3+ newlines to 2; the explicit **Save As Plain Text** command still flattens markup on purpose.
- **AI Hub tab group has an accessible name (#643/#646).** The `AIHubDialog` notebook now sets an explicit accessible name so VoiceOver announces the settings dialog's tab group (best-effort; macOS verification pending). GATE-11 budget rebaselined accordingly.

### Editing and keyboard polish

- **List boxes are now keyboard-activatable, not just double-click (GATE-13).** A `wx.ListBox` emits no item-activated event, so dialogs that bound only `EVT_LISTBOX_DCLICK` left their action unreachable for keyboard and screen-reader users. A new shared `apply_listbox_activation` helper (`quill/ui/dialog_contract.py`) binds the double-click **and** Enter / NumpadEnter / Space (consuming the key so the dialog's default button does not also fire), applied across the SSH, Copy Tray (×2), Prompt Library, Remote Sites (×2), Skill Library, Publishing, and Pronunciation manager dialogs. A new gate (`check_listbox_activation.py`, GATE-13) fails CI if a future `EVT_LISTBOX_DCLICK` binding ships without keyboard activation.
- **Tab key can now insert a literal tab character (QUILL Key + U).** The Tab key still defaults to Quill's smart line indent, but a new session toggle switches it to insert a tab character at the caret like a plain text editor. Toggle it with the **QUILL Key + U** chord (Ctrl+M and Ctrl+Shift+M are taken by the mark ring, and Ctrl+Alt+ chords are screen-reader-hostile), via the checkable **Format → Tab Key Inserts Tab Character** menu item, or by activating the new **Tab Mode** status-bar cell (shows **Indent** / **Tab char**). The mode change is spoken. Shift+Tab continues to outdent even in tab-character mode. New `format.toggle_tab_insert_mode` command bound in both keymap profiles.
- **Tab indent is spoken under a screen reader again.** A Tab/Shift+Tab indent (and Markdown list nest/promote) mutates text without moving focus, so the announcement engine — which stays silent while JAWS/NVDA is active to avoid talking over them — dropped the "Indented lines" status. The indent path now forces the announcement (the same escape hatch the QUILL-key chord uses) so the action is confirmed aloud.
- **F6 reaches the document tab bar.** When **Show Tab Control** is on, the tab strip now joins the F6 region rotation as the **Document Tabs** region (Editor → Document Tabs → Preview → Status Bar) instead of being unreachable from the keyboard and the JAWS cursor.
- **Clear All Notifications from the status bar.** The notifications (and background-tasks) status-cell context menu gained a **Clear All Notifications** entry that empties the list without opening the dialog.
- **Spoken confirmations for results that don't move focus.** A new internal escape hatch (`_announce_result`) force-speaks explicit command results that change nothing for the screen reader to pick up. **F7 / F8** (next/previous misspelling) now speak "No misspellings ahead; N behind" (and the reverse) instead of going silent when the caret is already past the last misspelling, and **Check for External Changes** speaks "matches the on-disk version" when there is no change.
- **Ctrl+W closes the active document when no side preview is open.** Previously Ctrl+W only closed a split side-preview and otherwise did nothing; it now falls back to closing the current document (only while focus is in the document surface, so dialogs are unaffected).
- **Search menu no longer announces a stray "Separator".** A feature-gated section left a dangling menu separator the screen reader read but could not focus; dangling leading/trailing/doubled separators are now pruned.
- **Watch Queue Monitor explains itself when unavailable.** Opening it in a profile without the watch-folder feature now speaks "Watch folder is unavailable in this profile" instead of returning to the editor with only a silent status.
- **Escape cancels the speech-engine chooser cleanly.** Pressing Escape on the **Manage Speech Models** engine picker now returns to the editor instead of falling through to the default engine's model list.
- **Optionally drop missing recent files (`recent_files_auto_clear_missing`).** A new General setting (off by default) removes Recent Files entries whose file no longer exists — but only on confirmed fixed/internal drives. Entries on removable, USB, or network drives are never probed and never dropped, because a "missing" file there usually means the drive is disconnected, not deleted.
- **Abbreviation expansion now ships off by default.** So text never silently changes as you type without your knowledge, `abbreviation_expansion` now defaults to **off**. Turn it on whenever you want it — `Insert > Toggle Abbreviation Expansion` (`Ctrl+Shift+Grave, E`), the **ABR** status-bar cell, or **Abbreviation expansion** in `Preferences > Editing` — and the choice is remembered. The fifteen built-in abbreviations and the manager are unchanged; they simply don't fire until you opt in.

### Removed

- **Pandoc Conversion Center menu placeholder removed.** The Tools menu no longer carries the "coming soon" Pandoc Conversion Center item; **File → Import** and **File → Export** (plus **Tools → Batch Conversion** for folders) cover conversion.

### Verbosity system (live wiring + polish)

- **Announcement anti-spam: repetition collapse + budget (#408/#409).** QUILL no longer re-speaks the exact same announcement when it repeats within a moment — holding a key at the top or bottom of a list, a repeated "no more results", a chattering status line — and an optional **announcement budget** caps how many announcements are spoken in a rolling 5-second window (0 = no cap). Both run at the verbosity controller's single `process()` choke-point (new wx-free `quill/core/verbosity/throttle.py`, an injectable clock for deterministic tests) and affect **only the spoken channel** — the visual status bar always shows every update, so nothing is hidden. Two new searchable settings under Preferences > Accessibility: **Collapse repeated announcements** (on by default) and **Announcement budget (per 5 seconds)**. Tests: `test_verbosity_throttle.py` + controller integration. GATE-11 rebaselined (`settings.py` +11, `settings_specs.py` +20). This completes the high-value verbosity polish for 1.0; the speculative long-tail addenda are deferred to 2.0 (roadmap §5).
- **Verbosity rebuild — wired into the editor and reachable (#365), and the 100-item polish consolidated (#366).** Sub-PR 1.5 makes the system live: a `VerbosityController` (wx-free, in `quill/core/verbosity/controller.py`) owns the engine, Quiet/Meeting modes, the undo stack, announcement history, mastery, and Safe Mode; `MainFrame` gains a `VerbosityCommandsMixin` and registers eight `verbosity.*` commands (palette- and Keyboard-Manager-reachable). `_announce` routes through the controller **only once the user engages verbosity**, so the default path is unchanged until then; once live, Quiet/Meeting suppress speech while the status-bar floor remains. Default chords (no conflicts; `quote_lines` keeps `Ctrl+Shift+Q`): Quiet = QUILL key + Q, Meeting = QUILL key + Shift+Q, Verbosity Undo = `Ctrl+Shift+Z`. Eight scalar `verbosity_*` settings persist (mastery, validation mode, history, task-profile suggestions, Safe Mode); collection-typed state lives in `verbosity_custom.json`. Tests: `test_verbosity_controller.py`, `test_verbosity_settings.py`, `test_verbosity_wiring.py` (incl. a `quote_lines` regression guard). GATE-11 rebaselined (`settings.py` 933→971, `main_frame.py` 25295→25355). Sub-PR 1.6 (the "100-item addendum") was **consolidated** during the 2026-06-21 tracker cleanup into the deduplicated *Polish backlog* in `docs/planning/verbosity-system.md` rather than built as 100 separate items: the themed survivors are tracked there (several already shipped as settings knobs and profile recipes), and the screen-reader-redundant ideas (typing/command echo, speech-rate knobs, punctuation profiles) are recorded as "recommend do not build." **Live in-app behavior (chords firing, mode suppression, badges) warrants a manual smoke run before release.**

### Verbosity system (the UI)

- **Verbosity rebuild — the wxPython UI landed (#364).** Sub-PR 1.4 adds the user-facing surfaces, all A11Y-4 hardened (label-then-control, mnemonics, `SetName`/`SetHint`, `apply_modal_ids`, no icon-only buttons) and wired to the already-tested pure core. New under `quill/ui/`: `verbosity_prefs.py` (the embeddable preferences panel — profile picker, the four-channel mix with the always-on Visual floor, validation-mode and mastery boxes, a filterable verb table with master/detail, initial focus on the filter), `verbosity_token_editor.py` (Simple/Advanced **RadioBox** view per the §5 decision, `Ctrl+T` validate / `Ctrl+Shift+P` preview via `EVT_CHAR_HOOK`, Save disabled while errors exist, Speak-current-template and Insert-token), `verbosity_data_order.py` (Move Up/Down/Reset/Preview), `verbosity_chord_editor.py` (per-chord overrides), `verbosity_library.py` (template CRUD + Install QVP), `verbosity_qvp_install.py` (pick → validate → install with the spoken sequence and accepted/rejected/warnings read-back), `verbosity_history.py` (review/replay/copy/explain with a filter), `verbosity_preview_lab.py` (the 14 scenarios with per-channel output), `verbosity_safe_mode.py` (scoped non-destructive resets), and `verbosity_import_export.py` (data-only profile import/export). The 3-tab About dialog already ships (About Quill, #260). The dialog inventory was regenerated (12 new hardened surfaces) and the A11Y-4 banned-pattern, button-contract, escape-z-order, and GATE-11 gates all pass. Tests: `tests/unit/ui/test_verbosity_ui.py` (62 source-contract cases). The dialogs are not yet launched from menus/chords — that wiring (and the user-guide/release-notes coverage) is sub-PR 1.5 (#365).

### Verbosity system (QVP packs, library, preview)

- **Verbosity rebuild — QVP packs, template library, and scenario preview landed (#363, closes §20 #382).** Sub-PR 1.3 adds the shareable-pack and preview core, still wx-free. New `quill/core/schemas/qvp.json` defines the canonical `.qvp.json` format (§20). `quill/core/verbosity/qvp.py` loads and validates packs **by hand** (QUILL ships no jsonschema runtime dependency) and runs the §21 install flow — JSON → schema → `kind` → `min_quill_version` gate → metadata → template ids → namespace collisions → dependency check → validate each template against its target verb → install → announce — returning a `QVPInstallResult` (`accepted`, `rejected_templates` with reasons, `warnings`, and the spoken sequence). Packs are strictly data: there is no `exec`/`eval`/`__import__` path, asserted by test. `library.py` is the templates library: a flat collection across built-in / user / QVP sources with save/rename/delete CRUD and the cross-verb *apply* that strips tokens a verb doesn't track and reports them ("Removed 2 tokens because this verb does not track them: cell, region."). `preview.py` renders fourteen canned scenarios through the engine, surfacing per-channel output and decision metadata for the Preview Lab. `schema.py`'s QVP schema now loads from the canonical `qvp.json` (single source of truth). Tests: `test_verbosity_qvp.py`, `test_verbosity_library.py`, `test_verbosity_preview.py`, plus golden snapshots in `tests/golden/verbosity/` (220 verbosity cases total; qvp coverage 95%). Partial progress on §19/§21/§23 (#381/#383/#385) whose CRUD/install-dialog/lab UIs land with the UI sub-PR.

### Verbosity system (engine and runtime modes)

- **Verbosity rebuild — engine, modes, history, and stores landed (#362, closes §30 #392).** Sub-PR 1.2 builds on the foundation with the central routing engine and its companions, still wx-free and strict-typed in `quill/core/verbosity/`. No user-facing surface yet (chords, badges, and dialogs come with the UI sub-PR), but the decision layer is complete and the engine is now reachable from the assistant-panel and AI-Hub announce paths via a no-op `speak_legacy_text()` passthrough. New modules: `engine.py` (`VerbosityEngine.speak()` → `RenderedAnnouncement` + `ExplanationTrace`; decides template precedence per-chord → per-verb → QVP → default, routes channels with the always-on visual floor, applies Quiet/Meeting/Expert suppression and the per-profile sound policy), `quiet.py` (Quiet Mode + the bounded §11 undo stack), `meeting.py` (Meeting Mode), `mastery.py` (per-verb use counter that offers a step-down once at threshold, no nagging), `history.py` (bounded, filterable announcement history with token-value redaction on by default), `explain.py` ("Why did QUILL say that?" trace → plain copyable text), `safe_mode.py` (`QUILL_SAFE_MODE` detection + non-destructive scoped resets for verb/chord/all), `feedback_tuning.py` (local Too Much / Too Little / Just Right store with a gentle one-shot suggestion), `task_profiles.py` (opt-in, default-off per-extension profile suggestions), `import_export.py` (`.quill-verbosity-profile.json` import/export — strictly data, no code-execution path, schema-checked), and `storage.py` (atomic `verbosity_custom.json` read/write that degrades to empty defaults on a corrupt file). Tests: 11 new `tests/unit/core/test_verbosity_*.py` modules (180 verbosity cases total; engine coverage 96%). `assistant_panel.py`/`ai_hub_dialog.py` +6 each (GATE-11 rebaselined). Partial progress on §9/§10/§11/§24-§27/§29/§31/§35 (#371/#372/#373/#386/#387/#388/#389/#391/#393/#397) whose chord/badge/dialog halves land with the UI sub-PR.

### Verbosity system (core foundation)

- **Verbosity rebuild — pure-domain foundation landed (#361, closes §6/§12/§15: #368, #374, #377).** New wx-free, strict-typed `quill/core/verbosity/` package, the foundation the per-verb verbosity rebuild (`docs/planning/verbosity-system.md`) builds on. No user-facing behavior changes yet — the engine, runtime modes (Quiet/Meeting), and UI land in later sub-PRs. Modules: `channels.py` (`Channel(Flag)` with the always-on VISUAL accessibility floor + `route_channels`), `tokens.py` (`TokenSpec` + the twelve engine filters; **no custom filters** — the data-only security boundary), `parser.py` (strict `{name}` / `${filter:name}` / `${filter:arg:name}` parser that returns structured errors instead of raising, plus §13 `validate()` with token allowlist, filter-type checking, and the spoken summary), `profiles.py` (built-in Beginner/Normal/Expert/Quiet + `CustomProfile` JSON round-trip, and `active_profile()` — the first real consumer of the legacy `announcement_verbosity` knob, mapping minimal/normal/verbose onto the profile ladder), `verbs.py`/`registry.py` (`VerbSpec` + `Severity` + the 34-verb §15 catalog and a duplicate-protected `VerbRegistry`), `data_order.py` (frozen, hashable `DataOrder`), and `schema.py` (draft-07 schemas for settings, custom profiles, QVP packs, and import/export). Tests: `tests/unit/core/test_verbosity_*.py` (102 cases; parser coverage 99%). The §15 prose says "44 verbs" but enumerates 34; the catalog ships the enumerated 34 and the count is asserted from the catalog itself. Partial progress on §5/§7/§13/§14 (#367/#369/#375/#376) whose UI/engine halves remain open.

### Publishing and export

- **DAISY 2.02 text-only talking-book export (#251).** New **File > Export > DAISY Talking Book** turns the current buffer into a DAISY 2.02 text-only book that opens in DAISY software readers and on hardware players (Victor Reader Stream, Plextalk, APH units), or in APH Book Wizard Producer to add TTS audio. A DAISY book is a folder, so the chosen name becomes a folder holding `ncc.html` (Navigation Control Center with `dc:`/`ncc:` metadata and heading links), `content.html` (XHTML with an `id` on every readable element), and `book.smil` (a SMIL 1.0 reading-order container, zero-duration since the book is text-only). Headings become player navigation points; documents with no headings (or whose first heading is below `h1`) get a synthetic title `h1` so navigation stays well-formed; inline Markdown is flattened to readable text. The writer is wx-free and strict-typed in new `quill/io/daisy.py` (`write_daisy_textonly`) and reads the live editor buffer, so no save is required first. `main_frame.py` +63 and `main_frame_menu.py` +8 (GATE-11 rebaselined). Tests in `tests/unit/io/test_daisy.py` (well-formed XML, DAISY metadata, heading→SMIL→content reference integrity, inline-markup stripping, synthetic-heading promotion). Completes Wave 1 / Phase 1.

### Planning and program management

- **Issue tracker consolidated to a 1.0 plan of record (2026-06-21).** `docs/planning/roadmap.md` was rewritten from a per-issue archive dump into the consolidated **QUILL 1.0 Plan of Record**, organized by workstream and naming the three sibling-product integrations being folded into QUILL: **BITS Whisperer** (speech/dictation, brand retained; `s:\code\bw`), **GLOW** (accessibility audit + agents; `s:\code\glow`), and **ChapterForge** (audio → chaptered audiobook/podcast; `c:\code\forum`). The GitHub tracker was reconciled to match: **open issues dropped from 232 to 80.** Closed 152 with pointers to their new home — the 100 verbosity brainstorm addenda (deduplicated into a themed polish backlog in `verbosity-system.md`, with screen-reader-redundant ideas like typing/command echo and speech-rate knobs recorded as "recommend do not build"), 11 AI placeholders (→ the Agentic AI PRD), 30 Tier-6 documentation stubs (→ a Docs & Tutorials track), 7 content-free FEAT stubs (no recoverable intent; their source `planning.md` was deleted), localization (already shipped), 3 Linux issues (out of scope), and 3 meta/archive placeholders. The GLOW integration (#528–#534, #593–#598) and BITS Whisperer (#515, #566–#577, #617, #663) stay open as live 1.0 workstreams.

### Planning and program management (earlier)

- **Issue tracker consolidated into shipping workstreams.** The full text of every open planning/design issue was gathered into consolidated workstream specs under `docs/planning/` (`verbosity-system.md`, `roadmap.md`, `feature-backlog.md`) with no content loss; the issues remain open and individually tracked. `docs/planning/program-tracker.md` is the living tracker — buckets, per-bucket risk/impact/value/effort, priority totals, status, and execution waves — driving every open issue to closure by **shipping** it.
- **Offline speech & dictation plan (#617).** Grounded the offline speech-to-text provider architecture in the current code (at the time, dictation only shelled out to Windows dictation; the vosk/whisper settings were dead stubs) and laid out a bold-but-simple reengineering: one offline-first speech engine, two user verbs (Dictate / Transcribe), an accessible model manager, and captions.

### Braille Mode (Phase 3 — proofing and progress)

- **BRF sidecar foundation (BR-015, #238).** New `quill/core/brf_sidecar.py` persists per-file braille-workflow state — last position, proofing progress, page anchors, and notes — alongside a braille file as `<name>.brf.quill.json`. Reads/writes are atomic (`storage.write_json_atomic`); the braille file is never modified; malformed sidecars raise a clear `BRFSidecarError`; a missing sidecar reads as `None`. Pure, wx-free, strict-typed, with round-trip / atomicity / validation tests in `tests/unit/core/test_brf_sidecar.py`. Foundation for restore-on-open (#239) and the Proofing submenu (#240).
- **Restore last position on opening a braille file (BR-016, #239).** Reopening a `.brf`/`.brl`/`.pef`/`.ueb` file now returns the caret to where you left off (from the sidecar) and announces it, e.g. "BRF file opened. 87 braille pages detected. Last position: braille page 12, line 14, cell 31." Restore is skipped in safe mode and when sidecar saving is off; a stale offset past the end of an edited file is clamped. Pure logic in new `quill/core/brf_progress.py`; the open flow delegates its announcement to a thin `main_frame_braille._brf_open_message` handler (`main_frame.py` unchanged, net zero). Tests in `tests/unit/core/test_brf_progress.py` and `tests/unit/ui/test_brf_open_restore.py`.
- **Braille > Proofing submenu (BR-017, #240).** Eight keyboard commands for braille proofing: Mark Current Page Proofed / Needs Review / Clear Mark, Add Proofing Note, Read Progress Summary, List Proofed Pages, List Pages Needing Review (both jump to the chosen page), and Export Proofing Report (to `.txt`). All state is written to the per-file sidecar (the braille file is never modified). Pure logic in new `quill/core/brf_proofing.py`; the submenu and handlers live in new `quill/ui/main_frame_braille_phase3.py` (`BrailleProofingCommandsMixin`, MRO-layered like Phase 2; `main_frame.py` +2 for the import + MRO insertion). Commands degrade gracefully on non-braille or unsaved documents. Tests in `tests/unit/core/test_brf_proofing.py` and `tests/unit/ui/test_braille_proofing.py`.
- **BRF layout validator (BR-018, #241).** New pure, read-only `quill/core/brf_validator.py` walks a braille document and emits `BRFWarning` records across ten categories: line-too-long, page-too-long, page-too-short, missing form feeds, mixed line endings, non-NABCC characters, malformed page-separator indicators, page-numbering gaps/duplicates, running-head inconsistency, and Unicode-braille-as-BRF. Each warning carries offset/line/page, a speakable message, and a severity. The validator never modifies the text. Tests in `tests/unit/core/test_brf_validator.py` (every category, a clean-document baseline, and the bundled corpus sample). The Validation submenu + Warnings List dialog is #242.
- **Braille > Validation submenu (BR-019, #242).** Four commands wire the validator (#241) into the editor: Validate BRF Layout (runs the validator and opens an accessible Warnings List — choose a warning to jump to it), Next Warning and Previous Warning (step the caret through findings, announcing "Warning N of M: ..."), and Warnings Summary (total count and top three categories). Added to the Phase 3 mixin (`BrailleProofingCommandsMixin`) — no new MRO insertion; the Warnings List is a stock `wx.SingleChoiceDialog` registered as native in the dialog inventory. Tests in `tests/unit/ui/test_braille_validation.py`. With this, **Braille proofing and validation (Phases 3 and 4) are complete.**
- **Selection-aware braille back-translation (BR-023, #246).** **Back-Translate (draft)** (Braille > Translation) now back-translates the **selected** braille passage when there is a selection, and the whole document otherwise, announcing which it used ("Back-translation draft from selection/document. N words. Review against the BRF."). This completes the back-translation deliverable of #246 — letting a proofreader recover the source text of a single passage. Tests in `tests/unit/ui/test_braille_translation.py`. (The separate "compare back-translation with source" feature was descoped; per-page source linking remains out of scope, needing a cross-format Source-Position model.)

### Speech and dictation

- **Dictation engine setting made honest (Speech wave S0, #617).** `settings.dictation_engine` moved to the `offline`/`windows`/`cloud` model with default `windows` (the only functional engine today); legacy `vosk`/`whisper` values migrate to `offline` to preserve local-engine intent. The dead `_transcribe_audio` local-recognizer stub (no audio capture was ever wired up) was removed, and `quill/core/dictation.py` now documents plainly that dictation drives the OS dictation panel until the offline engine lands. No change to dictation behavior; `settings.py` stayed at its GATE-11 budget. Tests in `tests/unit/core/test_dictation.py` and `test_settings_migration.py`.
- **Offline speech-to-text foundation (Speech wave S1, #617).** New pure, wx-free `quill/core/speech/` package: a typed provider protocol + data model (`provider.py` — `SpeechToTextProvider`, model/segment/result records), TXT/SRT/VTT/JSON output formatters (`formatters.py`), an atomic installed-model store (`models.py`), a lazy provider registry that skips unavailable/broken providers (`registry.py`), and a curated whisper.cpp model catalog with accessible size/accuracy/speed descriptions (`catalog.py`, recommending the Small model). No heavy dependencies and nothing imported at startup; the whisper.cpp provider, model-manager UI, and transcription/dictation flows build on this in S2–S3. Tests in `tests/unit/core/speech/`.
- **Offline transcription + model manager (Speech wave S2, #617).** A new **AI > Speech** menu makes private, on-device transcription discoverable: **Manage Speech Models...** (download or remove whisper.cpp models — sizes shown, downloaded over verified HTTPS from the Hugging Face Hub whisper.cpp repo, blocked in Safe Mode) and **Transcribe Audio or Video (Offline)...** (pick a file; QUILL transcribes locally on a background thread and opens the draft transcript in a new document). The `WhisperCppProvider` drives a whisper.cpp CLI via `run_subprocess_safely` with a narrow executable allowlist; the new outbound model download is recorded in the network-egress audit. Logic lives in `quill/core/speech/` + `quill/ui/main_frame_speech.py` (`SpeechCommandsMixin`); the two stock dialogs are registered native in the dialog inventory. Requires the offline speech engine (see below) and a downloaded model. Tests in `tests/unit/core/speech/` and `tests/unit/ui/test_speech_commands.py`.
- **Offline dictation, captions, microphone selection, and a bundled engine (Speech wave S3, #617).** AI > Speech gains: **Generate Captions (Offline)...** (transcribe with timestamps, save as SRT/VTT), **Dictate (Offline)** (push-to-talk: speak into the document at the cursor as one undoable edit; bound to **QUILL Key + Shift+D**, with distinct start/stop earcons via the `transcription_started`/`transcription_stopped` sound events and status-bar state), and **Dictation Microphone...** (choose the input device; saved in `<data>/speech-settings.json`). Mic capture uses the optional `sounddevice` extra (`quill[speech]`), lazily imported with a clear fallback to Windows dictation. **The whisper.cpp engine is now a distributable component**: a new installer component ("offline speech engine (whisper.cpp)") installs it to `tools\speech\whispercpp`, the build script gains `--whisper-dir` staging, and `resolve_whisper_executable` searches the QUILL-managed locations (`{QUILL_APP_ROOT}/tools/speech/whispercpp`, `<data>/speech-engine`) before PATH — so users no longer install whisper.cpp separately or edit PATH. New `quill/core/speech/capture.py` (+ device enumeration), `quill/ui/main_frame_speech.py` commands, keymap binding, and tests; the speech commands are registered for the command palette.
- **Transcript formats and speaker attribution (Speech wave S3, #617).** Transcribe (Offline) now asks for a transcript format — **Plain text, Markdown, or HTML** (captions remain SRT/VTT) — via new `formatters.to_markdown`/`to_html` (the existing `to_plain_text` gains speaker support). **Speaker attribution** ("who is speaking when") is produced offline with whisper.cpp tinydiarize: the catalog adds a "Small English with speaker detection" model (`small.en-tdrz`), `TranscriptionRequest.diarize` adds the `-tdrz` flag, the parser turns `[SPEAKER_TURN]` markers into `Speaker 1` / `Speaker 2` labels on each `TranscriptionSegment`, and transcripts render those labels (bold in Markdown/HTML). Transcribe auto-enables diarization when the speaker model is installed. **`sounddevice` is now bundled** in the Windows build (added to the bundled dependency groups), so offline dictation works out of the box. Tests in `tests/unit/core/speech/test_formatters.py` and `test_whispercpp.py`.

- **Faster Whisper engine (Speech wave S4, #617).** Added an optional, GPU-aware second offline engine. New `quill/core/speech/providers/fasterwhisper.py` (`FasterWhisperProvider`) loads a CTranslate2 model directory in-process, auto-selecting CUDA/float16 when a GPU is visible and CPU/int8 otherwise (`pick_device_and_compute`), and maps library segments to QUILL's `TranscriptionSegment` (`segments_from_faster_whisper`, unit-tested). A Faster Whisper model catalog (`catalog.FASTER_WHISPER_MODELS`, incl. `distil-large-v3`) downloads CTranslate2 repos from the Hugging Face Hub via `huggingface_hub.snapshot_download` (Safe-Mode gated). `default_registry` registers it only when the optional `fasterwhisper` extra imports, so an uninstalled engine never appears. The new `settings.speech_provider` (`""`/`whispercpp`/`fasterwhisper`) plus a **Speech Engine** chooser in Manage Speech Models lets users pick the engine; the choice drives transcription, captions, and dictation. whisper.cpp remains the default and needs nothing extra; Faster Whisper does not attribute speakers. Tests in `tests/unit/core/speech/test_fasterwhisper_provider.py`.
- **In-app display-language switcher (#i18n).** **Tools > Writing & Language > Change Display Language...** lists every installed translation plus System default and saves the choice to `settings.language`, re-initialising the locale (`available_languages`/`language_display_name` in `quill/core/i18n.py`). Translations are now submission-ready: the `.pot` template was regenerated from source, `quill.tools.compile_translations` builds `.mo` files via Babel (no `pybabel` CLI), and `quill/locale` is packaged into the wheel. The context-help coverage gate (`check_help_coverage`) was repaired (it pointed at the wrong path and checked nothing) and now validates topic integrity and flags commands missing help, with `--scaffold` to add stubs. Tests in `tests/unit/core/test_i18n.py`, `tests/unit/tools/test_help_coverage.py`, and `tests/unit/tools/test_compile_translations.py`.

### Build and naming

- **Public name is now QUILL for All.** The 0.7.0 release adopts `QUILL for All` as the user-visible project name in the About dialog, installer, crash reports, support bundles, and the repository README. The old `Quill` short name remains as `APP_SHORT_NAME` for legacy menu and shell-verb entries so the right-click "Open in Quill" verbs keep working. The new public name is paired with a one-paragraph Independence Notice that names Quill.js, QuillBot, and Quill.org so a first-time user can tell the project apart from similarly named products.
- **Trademark and legal docs.** New top-level `TRADEMARKS.md` and `NOTICE` files codify the naming policy and short copyright; `docs/legal/legal-notices.md` and `docs/legal/trademark-notices.md` carry the longer legal text. The repo no longer claims a registered trademark anywhere; all references are descriptive. `tests/unit/tools/test_legal_docs.py` and `tests/unit/core/test_branding.py` guard against future drift.
- **Single source of truth for the build identity.** New `build/version.toml` (base version, channel, prerelease number, product name, publisher, website) is read by `tools/generate_build_info.py` to produce `quill/_build_info.py` (consumed by the About dialog, support info, and crash reports) and `build/build-info.txt` (for humans and support). `quill/build_info.py` is a safe read wrapper that falls back to dev-build defaults if the generated module is missing. `quill/branding.py` carries the user-visible name constants so the About dialog, README, and crash reports always agree. `quill.core.about_info.AboutInfo` is refactored to consume the new sources and adds `product_name`, `display_version`, `license_name`, `independence_notice`, and `support_info` fields.
- **InnoSetup installer is wired to the same source.** `scripts/build_windows_distribution.py` now reads product name and publisher from `build/version.toml` (via the new `_build_identity` helper) so the installer's `AppName`, `AppPublisher`, `OutputBaseFilename`, and Add/Remove Programs metadata stay in lockstep with the About dialog. The `installer/quill.iss` filename pattern moved from `Quill-Setup-X` to `Quill-for-All-Setup-X` to match. The GATE-VC version-consistency gate now resolves the canonical version from `build/version.toml` when present, so the About dialog, installer, and CHANGELOG must all agree on the same display version.
- **About dialog gains a Legal tab and a Copy Support Info button.** The native 4-tab `About QUILL for All` dialog (Overview / Legal / Dependencies / Links) shows the Independence Notice, copyright, license name, and support info on the Legal tab; the dialog title is dynamic (`f"About {product_name}"`); the new **Copy Support Info** button writes the `support_info` string to the clipboard for inclusion in bug reports.

### QUILL Key branding and menu label clarity

- **QUILL Key chord shown as `QUILL Key + <key>` in every user-visible surface.** The 0.7.0 release replaces the raw `Ctrl+Shift+Grave, <key>` form with the branded `QUILL Key + <key>` form across menus, the About > Keyboard Reference page, the QUILL Key Help dialog, the QUILL Key cheat sheet, and the status bar / announce messages emitted while a chord prefix is pending. The stored binding (`Ctrl+Shift+Grave` in `DEFAULT_KEYMAP` / `keymap.json` / `quill_key_binding` setting) is unchanged — only the user-visible label moves. New `quill.core.keymap_format.format_binding_for_display` and `format_quill_key_chord` are the single source of truth for the rewrite; `quill.branding.QUILL_KEY_LABEL = "QUILL Key"` is the single source of truth for the constant. Test coverage: 18 cases in `tests/unit/core/test_keymap_format.py`.
- **A 4th `menu_lint` invariant guards against binding/label drift.** `quill.tools._check_binding_label_consistency` walks the AST of `quill/ui/main_frame_menu.py` and flags three regression classes: (a) `self._menu_label("", "command.with.binding")` patterns where the title literal is empty for a command that has a keybinding, (b) hand-written `<name>\t<binding>` literals whose tab portion disagrees with the matching `DEFAULT_KEYMAP` entry or wx stock-id binding, and (c) labels that end with a trailing tab and no binding portion. The runtime gap-check in `MainFrame._menu_label` (a one-shot `logger.warning` per affected item at first menu build) is the safety net for user-customization drift. The new check is wired into `python -m quill.tools.menu_lint` and exposed via 12 new cases in `tests/unit/tools/test_binding_label_consistency.py`.
- **Product name and publisher no longer hard-coded in tools and scripts.** `tools/generate_build_info.py`, `scripts/generate_update_feed.py`, and `scripts/build_windows_distribution.py` all read `APP_DISPLAY_NAME` and `APP_ORGANIZATION` from `quill.branding` so a rebrand touches one file. The TOML path still wins when `build/version.toml` provides a value (the installer / feed can be re-branded per release); the constant is the safety net for older checkouts and dev builds.

### Doc fixes

- **AI Hub menu path canonicalized to `AI > AI Hub...`** (#335). The release notes, the user guide, and the PRD no longer refer to a `Tools > AI Hub` alternative or to a `Tools > AI Assistant > AI Hub...` path. All paths now match the actual menu registered by `quill/ui/main_frame_menu.py`.
- **Update feed note + new `RELEASE.md` checklist** (#334). The 0.7.0 Beta 1 note already points at 0.5.0 to prevent a phantom update bump; the new `RELEASE.md` file documents the full pre-tag checklist and the tag-time flip step, and is linked from this section so the next release rotates the feed cleanly.
- **`quill.pot` version stamp + extraction freshness** (#336). `quill/locale/quill.pot` carries `Project-Id-Version: QUILL 0.7.0` and a fresh `POT-Creation-Date`. The POT was regenerated via `pybabel extract`; 402 new msgids were picked up from the post-0.6.0 source drift.
- **Translations: POT-only ship** (#340). The release notes now state explicitly that no `.po` or `.mo` files ship. The release notes point to `docs/translating.md` and `MAINTAINERS.md` for the translation contribution path.
- **Keymap consolidation: AI and compare chords on the same `Ctrl+Alt+Shift+` chord class** (#357). The inline F7 / Shift+F7 / F8 / Shift+F8 / Ctrl+Shift+T accelerators on the AI Spell Check, AI Spell Check Interactive, AI Grammar and Style, Translate Selection, AI Thesaurus, Next Difference, Previous Difference, and Announce Difference menu items are removed; the same commands are now bound to `Ctrl+Alt+Shift+S` / `I` / `G` / `T` / `H` and `Ctrl+Alt+Shift+.` / `,` / `D` respectively. The 8 new bindings each carry the inline `# §edsharp-ok` justification comment naming the screen-reader binding they reserve the chord class against, paired with matching entries in `_CTRL_ALT_DOCUMENTED` in `quill/tools/menu_lint.py`. `view.toggle_dark_mode` moves to `Alt+Shift+D` (different modifier stack from the compare binding). `docs/keybinding-standard.md` and `docs/release notes/release0.7.0.md` were updated; `docs/CONTROL_REFERENCE.md` was regenerated.
- **`quill/ui/style_panel.py` renamed to `quill/ui/train_style_dialog.py`** (#328). The Train Writing Style dialog's filename now matches its class. The rename updates the `quill/ui/main_frame.py` import site, the `tests/unit/ui/fixtures/dialog_inventory.json` qualname, the `tests/unit/ui/test_ai_tool_dialog_async_contract.py` source-path argument, the two PRD references (sections `3783` and `5963`), the `dialogs.md` and `.github/copilot-instructions.md` module lists, and the historical 2026-06-11l rebaseline comment in `quill/tools/module_size_budgets.json`. The new file (184 lines) is under the default 600 cap, so no explicit budget entry was needed.
- **`sound_manager.py`: promote `is_unsafe_path` and add public `set_volume`; unregister indent overlay events on every reload** (#332). `quill.core.sound_pack.is_unsafe_path` is the public traversal guard (the private `_path_is_unsafe` alias is kept so the loader's own validator does not have to round-trip through itself). `quill.platform.sound_player.SoundPlayer.set_volume(volume)` is the new public method for the master output level (clamps to `[0.0, 1.0]`, no-op on backends without a volume control, never raises). `SoundPlayer.unregister_event` and `SoundPlayer.unregister_events` are new public APIs used by the indent tone overlay so its events are explicitly removed on every reload, including `load_indent_tone_pack("")`. `quill/ui/sound_manager.py` no longer reaches into `_backend._output` or imports `_path_is_unsafe`. New tests: `tests/unit/platform/test_sound_player.py` (six new cases for `set_volume` / `unregister_event` / `unregister_events`) and `tests/unit/ui/test_sound_manager.py` (the new public-API-hygiene + indent-overlay-unregister guard).
- **`build_session_payload`: pair documents and caret positions via `zip(strict=True)` with an invariant assert** (#304). `quill/core/sessions.py` defaults missing caret positions to `0` for leniency, then asserts the lengths match before calling `zip(documents, positions, strict=True)`. A regression that breaks the length invariant now turns into `AssertionError` or `ValueError` instead of silently dropping trailing documents. Three new tests in `tests/unit/core/test_sessions.py` cover the padded-short input, the exact-length input, and the default-None input.
- **Trust-consent re-consent prompt on disclosure update** (#305). `quill/core/onboarding.py` now ships `current_trust_consent_version`, `trust_consent_change_log`, and `load_trust_consent_status` so the onboarding flow can distinguish "never consented" from "consented to an older disclosure". The trust consent version bumps to `2` with a delta naming the new BITS Whisperer, Glow update, and local-Quillin permission model disclosures. `quill/ui/main_frame._show_trust_consent_onboarding` prepends the per-version delta as numbered bullet points and changes the dialog title to `Trust and Privacy Consent` when re-consent is needed; `_first_run_trust_consent_prompt` stays `True` for users with stale consent so the prompt re-fires on next launch. Seven new tests in `tests/unit/core/test_onboarding.py` cover missing-file, current-version, older-version, malformed-version, non-dict, the reconsent helper, and the change-log invariant.
- **`documents_from_session` distinguishes missing key from empty list** (#342). `quill/core/sessions.py` now returns a single untitled `Document` only when the `documents` key is absent (sentinel for "no session seen") or when the value is non-list (malformed payload). An explicit `"documents": []` round-trips as an empty list, so a session saved with no open documents now restores with no open documents. Four new tests in `tests/unit/core/test_sessions.py` cover the missing-key, empty-list, non-list, and round-trip paths.

## 0.7.0 — Meet You Where You Are, with Braille Mode Phase 2 (2026-06-18)

### EdSharp port

- **Section-move chord pair** (`Alt+Shift+Up` / `Alt+Shift+Down`).  Pressing the chord while the caret is on a Markdown or HTML heading swaps that section with its previous (or next) sibling at the same level.  The move announces the sibling heading it swapped with.  Plain-text documents announce the chord is unavailable.  Fenced code blocks are honored so a `# fake` line inside a ``` fence is never promoted to a real sibling.  The chord displaced the previous expand/shrink selection pair, which migrates to the QUILL-key chord (`Ctrl+Shift+Grave, J` / `Ctrl+Shift+Grave, Shift+J`); saved user keymaps from older builds route through `legacy_rebindings`.
- **Heading shortcuts** at `Ctrl+Alt+1..6` (EdSharp PR #3).  The six heading shortcuts move from the QUILL-key chord space to `Ctrl+Alt+1` through `Ctrl+Alt+6`.  Each chord carries an inline `# §edsharp-ok` justification comment naming the screen-reader binding it overrides (NVDA's switch-to-synth-1..6) and a paired entry in `_CTRL_ALT_DOCUMENTED` in the menu-lint gate.
- **List toggle** at `Ctrl+Alt+7` and `Ctrl+Alt+8` (EdSharp PR #3).  `Ctrl+Alt+7` toggles a bullet list; `Ctrl+Alt+8` toggles a numbered list.  Each chord inspects the caret: if it is on a list item, the markers are stripped; otherwise a new list is inserted.  Plain-text documents announce the chord is unavailable.  Numbered-list insertion is governed by a new `list_auto_fill_numbers` setting (Preferences -> Editing -> Lists, default off) and a per-document five-minute arming flag set when the user toggles a numbered list; the three OR together so writers can stay in fill mode without re-pressing the chord.  New menu entries: Insert -> List -> Toggle Bullet / Toggle Numbered.  `Ctrl+Alt+9` for link insertion is intentionally not added because `Ctrl+K` already covers that command.
- **Section status bar cell**.  New `Section` cell that reads `Section: Heading N (ordinal of total)` whenever the caret is on a heading in a Markdown or HTML document.  Hidden by default; opt in via Preferences -> Status Bar.  Plain-text documents and carets on non-heading lines show nothing; the cell inherits the dead-widget guard from the other live-editor cells so a queued caret event after Ctrl+F4 cannot crash the status-bar refresh.
- **Revised §10.8 Ctrl+Alt+ policy**.  The original §10.8 policy banned `Ctrl+Alt+` outright.  The 0.7.0 revision relaxes the rule but keeps the gate strict: a `Ctrl+Alt+` binding may enter `DEFAULT_KEYMAP` when it is in the `_CTRL_ALT_DOCUMENTED` allowlist **or** carries an inline `# §edsharp-ok` justification comment naming the screen-reader binding it overrides.  Unjustified bindings still fail the gate.  Full audit in `docs/keybinding-standard.md`.
- **Copy Tray binding drift guard**.  New `quill.tools.check_copy_tray_binding` gate ensures the 12 Copy Tray paste slots (`Ctrl+Shift+1..9`, `Ctrl+Shift+0`, `Ctrl+Shift+-`, `Ctrl+Shift+=`) keep their default bindings.  A future change that reassigned any of those chords would now fail the gate.  The gate is automatically delegated from `menu_lint` so a single `python -m quill.tools.menu_lint` invocation covers all keymap and menu structural invariants.
- **Heading Organizer duplicate-H1 check is opt-in (#303).** A new `heading_organizer_warn_duplicate_h1` setting (default `False`) lets authors who deliberately write multi-H1 works opt into the duplicate-H1 accessibility warning. Existing behaviour is preserved for users who do not toggle the setting on. The setting lives in `quill.core.settings.Settings` and is read by the Heading Organizer's `Validate` button; the validator itself (`validate_heading_sequence`) keeps its `require_single_h1` keyword argument for unit tests and programmatic callers.
- **Dictation device picker deferred to 0.7.1 (#308).** The **Choose Dictation Device** menu entry planned for the Reading & Dictation submenu has been pulled from this release. The underlying infrastructure (`quill.core.dictation.list_dictation_devices` plus the `dictation_device_index` setting) is in place, but the menu surface and dialog contract were not finished in time for a quality release. The picker ships in 0.7.1 with a dedicated dialog. Until then, QUILL uses the system's default dictation input.

### Braille Mode Phase 2

- **Print-page and running-head detection (BR-013).** `quill/core/brf_page_detection.py` walks the BRF page map once and emits confidence-labelled indicators: high (separator line with anchor, or right-margin continuation), medium (right-aligned number), low (ambiguous). The detector also produces a `BraillePageMarker` per page and a `RunningHead` per page. When the detector has no anchor for the caret page, the status bar's print segment reads `Print ?` so the fallback is visible, not silent. Pure module — imports nothing from `wx` — covered by 12 unit tests including a real-world corpus test against the 5-page sample at `tests/corpus/braille/one_crazy_night.brf`.
- **Detailed status and print-page navigation (BR-014).** Six new Braille menu commands: Go to Print Page, Next/Previous Print Page Change, Announce Running Head, Include/Omit Running Head in Status. `Read Detailed Braille Status` now composes the full example string from the spec (print page, continuation letter, running head, proofing state, detection confidence) and `Read Current Print Page` no longer hard-codes "Print page unknown". Default key bindings intentionally left unset (matching the Phase 1 convention). Phase 2 is split into its own `main_frame_braille_phase2.py` mixin to keep `main_frame_braille.py` under the GATE-11 module-size budget.
- **Planning consolidation.** The 6,700-line `docs/planning/braille.md` was rolled into `docs/planning/planning.md` under "Feature: Braille Mode" so the live roadmap stays the single source of truth; the standalone file and its `.html`/`.epub` siblings were deleted; structure tests now assert it cannot reappear.

### Bug fixes (post-review triage)

- **Keymap: dead legacy-preview migration deleted.** `merge_keymaps`'s `legacy_preview_conflict` block checked the new chord defaults instead of the legacy ones, so it never fired for a real saved keymap; `legacy_rebindings` already migrates the same case correctly. Deleted per the locked decision on #274. Also removed an exact-duplicate comment block (#282) and added a debug log when `list_keymap_profiles` drops a malformed profile JSON instead of silently skipping it (#299).
- **Keymap: settings carry-over on load.** `quill.core.keymap.load_keymap` now drops saved entries whose command id is no longer in `DEFAULT_KEYMAP`, whose chord is whitespace-only, or whose chord collides with another command in the merged map, and persists the surviving subset back to disk so the on-disk `keymap.json` reflects what was actually honored. Files that are already clean are left untouched. Documents the settings carry-over rule in `docs/release notes/release0.8.0-beta1.md`; a standalone migration utility remains on the roadmap.
- **Section move: explicit enum match.** The edge-case announce branch in `_move_section` matched `MoveResult.NO_SIBLING` via a bare `else`; a future enum member would have silently announced the wrong outcome. Now every member is matched explicitly with a defensive fallback (#322).
- **Screen-reader name/focus gaps closed across five dialogs/panels.** Notebook panel name/goal labels and entry controls gain `SetName` (#327); the rich-text mode toggle button and indicator label gain `SetName` (#326); `SessionBrowserDialog._on_jump` now focuses the branch list after rebuilding it (#324); `status_dialog.py` converts its five `name=` kwargs to post-construction `SetName()` calls for consistency with the rest of the codebase (#320); the Command Palette and Go to Anything search fields gain `SetHint` placeholders in addition to their existing `SetName` (#325).
- **Removed orphaned `whisperer.about` menu-id scaffolding.** A `wx.NewIdRef()` and its `Bind()` call had no menu item wired to them; deleted both plus the stale `_command_to_menu_id_map` entry. The command itself remains live via Command Palette / Go to Anything (#284).
- **`kqp_validator._validate_file` renamed to `validate_file`.** The function is imported across the core/tools boundary, so the leading underscore was misleading (#290).
- **Copy Tray binding gate now discovers bundled profiles instead of hard-coding them.** `check_copy_tray_binding` previously checked only two named profile files; it now globs `profile_*.json`, so `profile_minimal.json` and any future bundled profile are covered automatically (#285).
- **Removed two never-shipped `future.*` feature placeholders; fixed `core.dictionary`'s dead command mapping.** `future.character_inspector` and `future.regex_library` had zero backing commands anywhere in the codebase and were deleted from the catalog and profile tables. `core.dictionary` (Dictionary and Thesaurus) was a real dead mapping: `tools.thesaurus` is now mapped to it in `feature_command_map.py`, so disabling the feature correctly hides the command from the Command Palette (#306).
- **Copy Tray accessibility: search-result announcement, status label, and modal-dialog delegation.** `_TraySearchDialog` now announces the first auto-selected search result after `SetSelection(0)` (#330). `CopyTrayDialog` gained a dedicated status `StaticText` plus a `_set_status` helper (SetLabel + announce) so ephemeral status messages (slot loaded/saved/cleared/pinned) no longer overwrite the listbox's stable accessible name (#329); `.show()` now delegates to `show_modal_dialog` instead of calling `ShowModal()` directly (#323).
- **`SoundEventsDialog` section headings now have an accessible name.** Each bold section heading gains `SetName(f"{heading} heading")` (#331).
- **Security: Heading Styles CSS/HTML injection fixed.** `HeadingStyle.declarations()` interpolated `text_align` and `font_family` unescaped into inline `style=""` attributes. `text_align` is now restricted to `{left, right, center, justify}`; `font_family` is HTML-escaped (#279).
- **F1 help for Copy Tray now matches the shipped 12-slot tray.** `topics.json` described the original nine-slot design (`Ctrl+1..9` paste, `Ctrl+Shift+T` open); updated to the real bindings (`Ctrl+Shift+1..9, 0, -, =` paste, `Ctrl+Shift+Grave, X` open) and regenerated `CONTROL_REFERENCE.md` (#276).
- **Version stamp swept to 0.7.0.** README, the userguide intro, both QUILL-PRD.md status lines, planning.md, translating.md, and quill.pot's `Project-Id-Version` all still referenced 0.5.0/0.6.0/0.6.1/0.1.5. Also collapsed CHANGELOG.md's two duplicate `## 0.6.0` headers into one (#277).
- **`Move Section Up`/`Down` menu ids were never wired.** `_id_move_section_up`/`_id_move_section_down` fed the global accelerator table (`Alt+Shift+Up`/`Down`) but had no `Append`/`Bind`, so the documented chord was silently inert outside the right-click context menu (which used its own local ids). Added real Format -> Line menu entries and frame-level bindings, matching the existing Move Line Up/Down pattern (#278).
- **`menu_lint.py`'s §10.3 required-cluster check now walks the AST instead of substring-matching.** A comment merely mentioning a cluster's label text (e.g. `"AI &Assistant"`) used to satisfy the gate; it now must appear as the label argument of a real `AppendSubMenu(...)` call, matching the rigor `_check_depth` already had (#286).
- **Snippet placeholders: full name/error contract.** `render_snippet` previously echoed a placeholder's raw `${kind:rest}` token verbatim into the document if no value was supplied; it now resolves through `extract_placeholders` and raises a `ValueError` naming the placeholder (e.g. `Workflow tested`), not just the token, so a caller no longer has to re-parse the token to report what's missing. `extract_placeholders` raises a clear error on an empty placeholder name or empty choice options instead of silently dropping the token. `_PLACEHOLDER_PATTERN` now allows one level of nested braces (`${input:Hello ${world}}`). `insert_snippet` and the `;trigger` auto-expand path catch the new error and report the snippet by name instead of crashing (#287).
- **AI Hub tab count: userguide.md was missing the Instructions tab.** It listed four tabs (Provider, On-Device, Audio Services, Advanced); release notes already correctly said five. Added the Instructions tab to the summary list (#293).
- **Profile/Quillin doc-drift resolved, code wins.** Release notes and the user guide disagreed on three points. Profile count: the wizard's seven `onboarding_profiles.py` intent profiles and the ten `features.py` technical FeatureProfiles are separate, already-accurate layers; added a cross-reference in the user guide instead of forcing one number. Writer/Casual Writer: adopted "Writer" (the wizard's canonical name) consistently in both docs, dropping the "renamed to Casual Writer" claim. Quillin count: `quill/quillins_bundled/` has fourteen directories, not five (release notes, which only ever described the new-in-0.7.0 set) or thirteen (user guide, which omitted Math Equations); reframed as fourteen bundled, five new in 0.7.0, nine carryover (#292).
- **F1 help for every braille command.** `quill/core/help/topics.json` now covers all 25 braille feature commands (status, navigation, page tools, translation, back-translation, pack install, line/cell, progress, save-as-clean, line-ending normalize). A new regression test in `tests/unit/tools/test_help_coverage.py` (`test_every_braille_command_has_a_help_topic`) walks `COMMAND_FEATURE_MAP` and fails CI if any new `braille.*` command is registered without a topic, preventing a future silent gap. Regenerated `docs/CONTROL_REFERENCE.md` to 134 topics with a new Braille Mode section (#294).
- **Release notes / user-guide contradiction on print-page detection removed.** Both documents now say the print-page segment is always populated when a print-to-braille anchor is available and reads `Print ?` only when no anchor exists, instead of the earlier "arrives in a later phase" claim. BR-013 has been live since 0.6.1 and is exercised by `quill/core/brf_page_detection.py` (#295).
- **Wizard page count corrected in release notes and user guide.** The setup wizard has six pages (Welcome, Intent, Extras, AI Provider, Keyboard and Sound, Summary) and five if you do not enable AI on the Extras page. Release notes line 80 was rewritten and the `docs/user guide/userguide.md` "Personalising QUILL" section was rewritten end-to-end so the page list (with the AI-conditional sixth page) and the profile summary table both match the canonical `quill/ui/setup_wizard_pages.py` (#297).
- **CommandRegistry gains `try_register` and `replace`.** `try_register(id, ...)` returns `bool` so tooling can detect collisions without catching `ValueError`; `replace(id, ...)` overwrites an existing entry for the rare case where a caller needs to take over a built-in command's slot. The original `register` behaviour is unchanged. Five new tests in `tests/unit/core/test_commands.py` (#312).
- **Markdown `apply_nl2br` now honours CommonMark fence semantics.** Previously it toggled on any line starting with three backticks; lines inside a tilde fence or with two backticks could be misidentified, and a tilde opener was never recognised. The fence detector now lives in a shared `quill/core/markdown_fences.py` module, recognises 3+ backticks and 3+ tildes (up to 3 leading spaces of indent), and a closing fence must use the same character as the opener and be at least as long. New tests cover tilde fences, four-backtick fences, the cross-character case (tilde opener is not closed by a backtick run), and the under-length closer case. `quill/core/markdown_extensions.py` no longer carries its own `startswith("```")` toggle (#307).

## 0.6.0 — Insert Automation, Quillin Platform, Braille Mode, AI Writing Toolkit (2026-06-17)

> Note: 0.6.0 was rolled into the CHANGELOG directly without a standalone `release0.6.0.md`; the section below is the canonical 0.6.0 record. The 0.6.1 release notes (`docs/release notes/release0.6.1.md`) are the first standalone post-0.5.0 release-notes file. (Closes #345.)

### Text hygiene

- **Quill Eraser.** `Tools → Writing & Language → Quill Eraser...` / `Quill Eraser on Selection...`. Deterministic, rule-based text hygiene checker: seven rules covering multiple spaces, trailing whitespace, space before punctuation, excessive blank lines, missing space after sentence/comma/colon punctuation, and lowercase sentence starts. Findings are presented in a modeless, keyboard-navigable review dialog with Apply Fix, Ignore, Go to Issue, Previous/Next, and Rescan actions. All actions are screen-reader-announced. Code files receive a prompt before checking; only safe trailing-space checks run unless you opt in. URLs, emails, file paths, code spans, decimal numbers, times, and (in Markdown) code blocks, front matter, and link URLs are never flagged. Four new preference fields control confidence threshold, two-space-after-period exception, max blank lines, and per-rule disable list. New files: `quill/core/hygiene/` package (findings.py, ignored_ranges.py, rules.py, engine.py), `quill/ui/hygiene_dialog.py`, `quill/ui/main_frame_hygiene.py`. New feature `core.hygiene` in the feature catalog. 41 unit tests in `tests/unit/core/test_hygiene_rules.py`.

### AI writing features

- **AI Hub (5-tab settings dialog).** `quill/ui/ai_hub_dialog.py` replaces the single-screen AI Connection dialog with a tabbed hub: Provider (provider choice, API key, model, test connection), On-Device (Ollama URL and recommended models), Audio Services (Deepgram key, max speakers), Instructions (custom system prompts per task), and Advanced (consent text, reset, safe mode docs). `open_ai_hub()` in `main_frame.py` now opens this dialog.
- **AI Thesaurus (Shift+F8).** `quill/core/ai/thesaurus.py` + `quill/ui/ai_thesaurus_dialog.py`. Sends the selected word and its surrounding context sentence to the configured AI provider and returns a list of synonyms with usage notes. Replace the word in-document from the dialog or double-click a synonym to apply immediately. Covered by `tests/unit/core/ai/test_ai_thesaurus.py` (16 tests).
- **Agentic writing tasks.** `quill/core/ai/agent_session.py` + `quill/ui/ai_agent_result_dialog.py`. Four new commands: AI > Rewrite Selection, AI > Summarize Selection, AI > Expand Selection (new), AI > Generate Table of Contents (new). Each runs on a background thread with a cancellation stop event and presents results in a two-part dialog (step log + final output) with Insert, Replace, Copy, and Re-Run actions. Covered by `tests/unit/core/ai/test_agent_session.py` (23 tests).
- **Custom Instructions.** `quill/core/ai/custom_instructions.py` provides per-task AI system prompts with user overrides. Twelve tasks ship with built-in defaults (chat, spell_check, grammar_check, rewrite, summarize, expand, toc, translate, thesaurus, document_qa, research, accessibility_agent). User overrides stored in `%APPDATA%\Quill\ai_custom_instructions.json` (only changed fields; defaults always from code). `apply_instruction(task_id, base_prompt)` is called by every AI module; it never raises — any failure returns the base prompt unchanged. Covered by `tests/unit/core/ai/test_custom_instructions.py` (22 tests).
- **Custom Instructions wired to all AI modules.** `apply_instruction()` integrated into spell check, grammar check, translation, thesaurus, document Q&A, and all four agent tasks. Users can change tone, format, or language model behaviour for any task without touching code.
- **Prompt caching.** `custom_instructions.py` gains `split_instruction(task_id, base_prompt) -> (str, str)` which returns the system prompt and user prompt as separate strings. `generate_assistant_response()` gains a `system_prompt` parameter; `build_chat_body()` and `build_chat_headers()` are extended to route the system prompt through each provider's caching path: Anthropic Claude uses `cache_control: ephemeral` blocks with the `anthropic-beta: prompt-caching-2024-07-31` header (5-minute cache, ~10% token cost); OpenAI/OpenRouter use a `role=system` message that qualifies for automatic prefix caching above 1024 tokens (~50% cost); Gemini uses `systemInstruction`; Ollama uses `role=system`. All six AI modules (spell_check, grammar_check, translation, thesaurus, document_qa, agent_session) updated from `apply_instruction` to `split_instruction`. 14 new tests in `test_assistant_ai.py` and `test_custom_instructions.py` lock in the caching contract per provider.
- **Expand Selection and Generate TOC agent profiles.** `assistant_agents.py` gains `expand` and `toc` profiles with carefully written default prompts.
- **Vision Prompt Library.** `quill/core/ai/vision_prompts.py` + `quill/ui/image_prompt_manager_dialog.py`. Twelve evaluated IDT-sourced image-description prompt styles, a management dialog, pre-describe picker, and "Try a different prompt" post-describe flow. Contributed by Kelly Ford. Settings sync bug fixed.
- **Image style prompt editing.** Built-in image description prompt text is now editable. `ai_hub_dialog.py` gains an Image Styles sub-tab within the Instructions tab. Each of Kelly's twelve styles shows a read-only reference panel (the shipped default) alongside an override editor and a Reset to Default button. Enable/disable is also surfaced here. `vision_builtin_overrides: dict[str, str]` added to `Settings`; `resolve_prompt_text()` checks overrides before the built-in constant. Saves on AI Hub OK; applied immediately on every subsequent Describe Image call.
- **Default AI writing prompts revised.** All twelve writing task default prompts in `custom_instructions.py` rewritten: tighter persona statements, explicit output rules (return only the text), screen-reader-aware guidance (prefer short sentences, direct language), and per-task specificity (accessibility agent now checks sentence length, jargon, passive voice, and link/image text; research assistant structures output into Claims, Key Points, Assumptions, Open Questions, Next Steps).
- **AI Hub Instructions tab restructured.** `_build_instructions_tab()` now renders a sub-notebook with two pages: Writing Tasks (existing twelve writing prompts) and Image Styles (Kelly's twelve image description prompts), unified under the same list + editor + reset-to-default UX.

### Accessibility fixes

- **JAWS label-buddy Z-order (#249).** Tabbing through Preferences dialogs under JAWS now announces field labels correctly. The fix converts every pre-created labeled control in `open_general_preferences/_make_control`, `open_profiles_and_features_settings`, and `ai_model_panel._build_tier_section` to factory callables so `StaticText` labels are always created before their associated `wx.Choice`/`wx.SpinCtrl`/`wx.TextCtrl` in the Windows child list. `wx.CheckBox` and `wx.Button` are exempt (they carry their own label text). Six gating tests in `tests/unit/ui/test_dialog_label_ordering.py` lock in the correct creation order. The Quillin preferences renderer (`quillin_prefs_dialog.py`) enforces label-first order throughout by construction.

### New features

- **Math Equations Quillin (`com.quill.bundled.math-equations`).** `Insert → Insert Equation...` (`Ctrl+Shift+E`) inserts LaTeX or MathML at the caret via two sequential accessible dialogs: a prompt for the equation text (with selection pre-fill and delimiter stripping) and a display-mode choice (Inline `$...$` / Block `$$...$$`). MathML input (`<math ...>`) is detected automatically and inserted verbatim without a mode step. Browser Preview and HTML export now inject MathJax 3 (CDN) so equations render visually. Sample equations in `docs/math/latex_testing.md`. 14 unit tests in `tests/unit/core/test_quillins_bundled_math_equations.py`. Contribution by Robert Danaraj; redesigned as a sandboxed Quillin.

- **Quillin preferences rendering.** All five bundled Quillins with `contributes.preferences` declarations now have live settings dialogs accessible from the Preferences hub. New `quill/ui/quillin_prefs_dialog.py` renders boolean (CheckBox), integer (SpinCtrl), string (TextCtrl), and choice (Choice) controls from the declarative manifest schema. Conditional `visible_when` and `enabled_when` rules are wired to wx change events so dependent controls update live. `main_frame_quillins.py` gains `_pref_manifests()` and `open_quillin_preferences()`. `open_preferences()` dynamically appends one hub entry per enabled Quillin with preferences.

- **Non-AI table of contents and Markdown profiles (#257).** New `Insert → Table of Contents` builds a TOC directly from headings — deterministic, offline, no model in the loop — replacing a `[TOC]` marker or inserting after the first heading. `Format → Markdown` adds Select Markdown Profile (Standard, GitHub-Style, Documentation, Poetry and Lyrics, Accessible Publishing, Technical Writing, PRD and Release Notes, Custom), Preserve Single Line Breaks (`nl2br`), and Read Markdown Processing Status. New pure core modules `quill/core/markdown_extensions.py` (heading extraction, slug generation matching Browser Preview's anchors, TOC generation, heading-structure diagnostics, `nl2br`) and `quill/core/markdown_profiles.py` (friendly-name extension catalog and the eight profile presets). New feature `core.markdown_profiles` (category `"markdown"`) — kept as a sibling of, not a subset of, `future.ai`, so disabling AI never disables the table of contents. 24 new unit tests.

- **Minimum required encoding (#256).** `quill/core/encoding_tools.py` gains `minimum_encoding`/`can_encode`/`describe_minimum_encoding`, picking the simplest lossless encoding in the order ASCII → Latin-1 → Windows-1252 → UTF-8. New `Format → HTML & Encoding → Analyze Encoding Requirements` and `Save Using Minimum Required Encoding...` commands. (Entity decoding itself — `&eacute;` → `é` — already shipped via `decode_html_entities`; this closes the remaining "don't force UTF-8 when a narrower legacy encoding still fits" half of the request.) New feature `core.text_encoding` (category `"text"`) now tags every entity/encoding command, replacing the generic always-on fallback they had before. Plus four small text-utility gaps closed alongside it: Remove Email Quote Markers, Strip Low ASCII Characters, Strip High ASCII Characters, and Convert to Hex Dump. 26 new/extended unit tests.

- **Casual Writer and Author or Student profiles.** The **Writer** feature profile is renamed **Casual Writer** (id unchanged, so saved settings are unaffected) to make room for a new ninth persona, **Author or Student**: long-form writing with a table of contents, footnotes, and citations for papers, theses, and class assignments. It turns on the new Markdown profiles and encoding features by default. New `Format → Markdown → Select Citation Style...` command and `Settings.citation_style` field choose between Markdown footnotes (default) and full MLA/Chicago/APA bibliography entries via the existing `quill/core/citations.py` (#203) — no new dependency either way.

- **More text-utility power tools.** Eight commands close the remaining text-utility gaps reported after the encoding-tools work above shipped: `Format → Line → Number Lines (Advanced)...` (start, increment, digit or Roman-numeral style, zero-padding, custom suffix, left/right alignment); `Format → HTML & Encoding → Convert OEM (DOS) to ANSI` / `Convert ANSI to OEM (DOS)` (CP437 ↔ Windows-1252 codepage-mismatch repair); `Convert Line-Drawing Characters to ASCII` / `Strip Line-Drawing Characters` (Unicode box-drawing U+2500–U+257F to `-`/`|`/`+`, or removed outright); `Search → Multi Replace...` (up to four search/replace pairs in one pass, optional case-insensitive); `Search → Count Occurrences...`; and `Tools → Line Statistics` (count, total, average, median, mode, standard deviation over one number per line). New pure functions in `quill/core/line_ops.py` (`to_roman_numeral`, `number_lines_advanced`), `quill/core/encoding_tools.py` (`oem_to_ansi`, `ansi_to_oem`, `convert_box_drawing_to_ascii`, `strip_box_drawing`), and `quill/core/format_ops.py` (`multi_replace`, `count_occurrences`, `compute_line_statistics`). Tagged `core.format`, `core.text_encoding`, `core.search`, and `core.analysis`. 27 new unit tests.

- **Emmet-style abbreviation expansion (MVP).** Three new `Edit` menu commands expand compact markup abbreviations into full HTML or CSS. `Expand Abbreviation` replaces the selection (or the token immediately before the cursor) in place, as one atomic undo step. `Preview Abbreviation...` expands into a scratch buffer without touching the document. `Explain Abbreviation...` opens a plain-text breakdown of the parsed tree. New pure core module `quill/core/emmet.py`: a recursive-descent parser for the core Emmet grammar (child `>`, sibling `+`, climb-up `^`, grouping `()`, multiplication `*N`, numbering `$`/`$$`, ids, classes, attributes, text content), with numbering resolved against the nearest enclosing multiplier, implicit tags/attributes for common elements, void-tag rendering, a curated common-subset CSS abbreviation table, and canned accessibility snippets (`!`, `!a11y`, `skiplink`, `form:a11y`, `table:a11y`). Mode (HTML vs. CSS) follows the current file's extension. New feature `core.emmet` (category `"markup"`). Placeholder/tab-stop navigation, a snippet manager, Quillin extension points for custom expansion providers, a Markdown abbreviation pack, and a full fuzzy CSS abbreviation engine are explicitly out of scope for this MVP (see PRD §29.3). 53 new unit tests.

## 0.5.1 — Sound Packs, Compare Mode, Code-Aware Editing, Encoding Tools (2026-06-15)

### New features

- **Save As Word (.docx).** `quill/io/export.py::write_document_as` now routes
  `.docx` through Pandoc (`gfm -> docx`) via `pandoc.py::convert_file_with_pandoc`,
  mapping Markdown headings to real Word styles for a navigable document. RTF
  was already supported; the Save As dialog gains a "Word Document (*.docx)"
  type (#204).
- **Citation help (MLA, Chicago, APA).** New pure `quill/core/citations.py`
  formats book / journal article / website sources in MLA 9, Chicago 17
  (author-date), and APA 7 — both in-text and bibliography, with per-style
  author handling (et al., initials, ampersand). **Insert -> Insert Citation...**
  is an accessible form that inserts the in-text citation, the bibliography
  entry, or both at the cursor (#203).
- **QSP sound pack system.** A pluggable earcon engine: `quill/core/sound_pack.py`
  loads a sound pack (a directory or `.qsp` zip with a `manifest.json` mapping
  event IDs to WAV files), `quill/ui/sound_manager.py` plays them non-blocking,
  and `quill/core/sound_events.py` is the canonical `SoundEvent` catalog. Ships
  the synthesised **Ink** pack plus four **indentation-tone** packs (pentatonic,
  whole-tone, diatonic, chromatic) that play a pitched tone as the caret crosses
  indent levels. Partial packs and an overlay architecture let an indent-tone
  pack layer over a primary pack. **Tools → Reading & Dictation → Sound Events...**
  toggles individual events; **Toggle Sound Notifications** flips them all and
  plays a confirming earcon. Quillins can contribute sounds via the host API.
  Generators: `scripts/gen_ink_sounds.py`, `scripts/gen_indent_tones.py`.
  Covered by `tests/unit/core/test_sound_pack.py`,
  `tests/unit/platform/test_sound_player.py` (#181/#182/#184).
- **Keyboard-first compare mode.** `quill/core/compare_service.py` (pure difflib
  engine) and `quill/ui/compare_dialog.py` (modal, screen-reader-first) add
  keyboard difference review: F8/Shift+F8 next/previous, Ctrl+F8 re-announce,
  Alt+F8 inline word changes, Ctrl+Shift+F8 whitespace toggle. Covered by
  `tests/unit/core/test_compare_service.py` (#193/#194).
- **Compare-mode sound events.** Five earcons — `compare_enter_mode`,
  `compare_exit_mode`, `compare_next_difference`, `compare_previous_difference`,
  `compare_no_more_differences` — fired across the compare dialog and the legacy
  F8 session, with a Compare section in the Sound Events dialog. Covered by
  `tests/unit/core/test_compare_sound_events.py` (#186).
- **Code-aware editing.** `quill/core/language_profile.py` dispatches a language
  profile by file extension (Python, JS/TS, Kotlin, Shell, Markdown, JSON, TOML,
  SQL, plain fallback); `quill/core/token_nav.py` adds Next/Previous Token
  navigation; **Navigate → Set Document Language** overrides detection. Covered
  by `tests/unit/core/test_language_profile.py`, `test_token_nav.py` (#181).
- **Text encoding tools.** `quill/core/encoding_tools.py` (wx-free) backs three
  Format → HTML & Encoding commands: Show Non-ASCII Characters (review report
  with Latin-1 / Windows-1252 convertibility), Convert Non-ASCII to HTML Entities
  (named with numeric fallback), and Re-encode As (UTF-8 / UTF-8 BOM / Latin-1 /
  Windows-1252 / ASCII, lossless via numeric-entity fallback). Covered by
  `tests/unit/core/test_encoding_tools.py` (#197).
- **Speak-status commands.** QUILL-key chords speak the window title
  (`Ctrl+Shift+Grave, F`), the full file path (`, P`), and a status summary
  (`, Q`) without leaving the editor (#189).
- **CLI `--goto` and `--diff`.** `--goto FILE[:LINE[:COL]]` opens a file at a
  position in one argument; `--diff LEFT RIGHT` opens two files straight into
  compare mode. `_parse_goto` correctly handles Windows drive-letter paths (#192).
- **Report a Bug enhancements.** The dialog opens focused on Summary and adds a
  screen-reader picker (None / JAWS / NVDA / Narrator / VoiceOver / Other,
  pre-selected from detection) plus remembered name and email fields, all sent
  with the report (#188).
- **Compare power features.** Character-level diff highlighting, word-level
  speech of inline changes, and Compare Selection With Clipboard, alongside the
  difference list, whitespace options, and accessible speech of the MVP
  (#193/#194).
- **Document switching with Ctrl+Tab / Ctrl+Shift+Tab** moves to the next or
  previous open document (#190).
- **Persistent startup folder.** A setting controls the initial folder for Open
  and Save As; file dialogs now default to Documents instead of the install
  directory (#168).
- **Feature search** now finds copy tray, macros, and abbreviations (#171).
- **Developer file extensions** added to the Open dialog wildcard (Kotlin, TS,
  Go, Rust, and more) (#191); **file-open focus** now lands in the editor with a
  screen-reader announcement, removing the Alt+Tab workaround (#187).
- **HEIC/HEIF image support** for AI image description (#164).
- **About screen** lists all GitHub contributors, fetched from the contributors
  API with a baked-in offline fallback; Ken Perry and Kelly Ford added.

### Bug fixes and security

- **Setup Wizard accessibility fixes.** The "Play sounds for mode changes"
  checkbox on step 2 now carries its label on the control, so screen readers
  announce it instead of an unlabeled checkbox (#208). On step 3, the Feature
  Profile choices use a single `wx.RadioBox` so arrowing past the last choice
  wraps within the group instead of escaping into the Back/Next/Cancel buttons,
  and the group is announced as one labelled control (#209).
- **Quill exits reliably when run from source.** A modeless top-level window
  (such as the Ask Quill chat frame) could keep the wx main loop alive after
  the main window closed, leaving the process running. `_on_close` now destroys
  straggler top-level windows so the app always exits (#210).
- **Report a Bug fields are now editable.** The form fields no longer reject
  keyboard input under NVDA; the dialog was rebuilt without the intermediate
  `wx.Panel` that broke editing, and moved from Tools to Help (#178). The bug
  report also no longer blocks the UI thread — the network call runs off-thread
  with a timeout fallback (#188).
- **Screen-reader chatter silenced.** JAWS no longer announces "splitter window"
  and "panel" on menu close and app focus; the layout container is no longer
  exposed in the accessibility tree (#170).
- **Describe Image** no longer fails silently — corrected an `AttributeError`
  on the region-tracking call (#165).
- **Startup is faster and quieter.** Screen-reader detection is offloaded to a
  background thread, a WebView2 prewarm crash is fixed, and the title no longer
  flashes "untitled Quill unavailable" before the app finishes loading
  (#176/#177). The preview pane no longer hangs for minutes and is dismissable
  (#174).
- **First-run experience fixed.** The first window now gains foreground focus so
  the trust/privacy dialog is reachable (#166); the personalization wizard can be
  re-triggered after first run (#167); the wizard's startup beep and Cancel
  focus are fixed.
- **Crash-recovery snapshot preview** is no longer blank for screen readers
  (#180).
- **User guide opens correctly.** It opens as read-only HTML in the browser
  instead of as an editable Markdown tab (#173), with a glossary of domain terms
  (#172), and a WebView2 fault no longer throws a `0x8007139f` error — the
  preview control is caught and rebuilt (#175/#183).
- **macOS: API keys and tokens persist via the login Keychain** instead of
  crashing on save when the Windows DPAPI import was unavailable (#160).
- **macOS notarized build** signs Pillow's bundled dylibs and uses
  hardened-runtime entitlements, fixing notarization.
- **Manage Features dialog** and the SSH Quick Connect / Site Manager dialogs
  were clarified and corrected (#161/#162).
- **Embedded Python build** bootstraps setuptools and fixes the LicenseFile path.
- Internal sound-design notes moved out of the repo root (`x.md` → `docs/wsp.md`).

### Governance

- **Kelly Ford** added as a project owner (contributors list, CODEOWNERS, and
  repo maintain access) alongside the existing maintainers.

## 0.5.0 — Developer Console, GitHub Integration, Keyboard Packs, Autoupdate (2026-06-12)

### New features

- **QUILL Developer Console (QDC).** Python and TypeScript consoles with session
  history, output capture, and a `q.*` host API for reading/writing document
  content. Opened from the Developer menu. Covered by `tests/unit/devtools/`.
- **GitHub Remote Files.** Open, browse, and save files directly from/to GitHub
  repositories (File > Open Remote > GitHub). Token stored in Windows Credential
  Manager; first-use consent dialog before any network call.
- **Keyboard packs (.kqp).** Export and import complete keybinding sets as
  self-contained `.kqp` JSON files (File > Keyboard Pack). Validated on import;
  atomic write on export.
- **Autoupdate pipeline.** Vendored `accessibleapps/app_updater` under
  `quill/_vendor/autoupdate`; release scripts (`build_update_zip.py`,
  `fetch_bootstrappers.py`, `generate_file_manifest.py`) produce
  installer-compatible update ZIPs with SHA-256 manifests.
- **Context-sensitive help.** `Ctrl+Shift+Grave, Shift+H` announces the most relevant shortcuts for
  the current focus context (`Alt+H` is reserved for the Help menu mnemonic).
  F1 shows per-control help; Shift+F1 opens "What Can I Do Here?".
  Implemented in `quill/ui/context_help.py` and `quill/ui/main_frame.py`.
- **Setup wizard.** First-run nine-page wizard guides new users through screen
  reader, AI, SSH, and cloud configuration.
- **Translation infrastructure.** Babel-based i18n scaffolding: `quill/locale/quill.pot`
  template, `babel.cfg` extraction config, and `quill/core/i18n.py` runtime loader.
  Strings in legacy modules and several new 0.5.0 surfaces (GitHub provider,
  update flow status strings) are not yet wrapped with `_()`. No translations are
  shipped; the `.pot` template is the floor. See
  `docs/localization/translation-contributor-plan.md` for contribution workflow.
- **Per-provider model memory.** AI chat remembers the last selected model per
  provider and restores it on next open.

### Accessibility and screen reader improvements

- **QDC console keyboard control.** `EVT_CHAR_HOOK` at the frame level now handles
  Esc (close), F1 (help), Ctrl+L (clear), Ctrl+Shift+C (copy transcript), Ctrl+S
  (save transcript) from any focused element inside the console window.
- **QDC console focus return.** Closing the console returns caret focus to the
  document editor via `focus_editor_cb`, not just `parent.SetFocus()`.
- **QDC history navigation announced.** Up/Down history recall announces
  "History N of M: entry" so screen reader users hear what was recalled.
- **QDC TypeScript worker start announced.** "Developer Console ready" is spoken
  when the Node worker is available. Previously the status bar changed silently.
- **QDC clipboard copy announced.** Copy-transcript announces success or failure.
- **QDC TypeScript console opens in TypeScript mode** instead of Python.
  `open_typescript_console()` calls `win.set_language("TypeScript")`.
- **AI chat, Skill Library, Prompt Library status changes announced.** All three
  dialogs now route status updates through `_set_status()` which calls both
  `SetLabel` and `announce_cb`. 13 status sites in AI chat, 9 in Skill Library,
  5 in Prompt Library were previously silent.
- **Command Palette and Go-to-Anything status announced.** Search result counts
  and unavailable-command messages are now spoken.
- **GitHub browser status announced.** Loading states, errors, and directory
  confirmations are spoken via `announce_cb`. Enter key works on the repository
  name field (`TE_PROCESS_ENTER`). Backspace no longer hijacks while editing the
  field. Focus moves to the first item after a directory loads.
- **SSH remote browser path announced.** Directory changes are spoken after each
  navigation step via `announce_cb` in `RemoteBrowserDialog`.
- **Setup wizard page transitions announced.** Each of the nine pages announces
  "Step N of 9: Title" and focus lands on page content rather than the Next button.
- **All modal dialogs through z-order gate.** Setup wizard, devtools consent,
  and GitHub URL/commit-message dialogs now route through `_show_modal_dialog` and
  `_show_message_box`, eliminating the "dialog opens behind main window" class.
- **Unhandled crash dialog readable by screen readers.** A Win32 `MessageBoxW`
  (readable by Narrator/NVDA even with no wx running) now shows on any unhandled
  exception, with the error message and crash report file path.
- **TTS self-voicing non-blocking.** The pyttsx3 TTS worker now runs on a daemon
  thread with a queue, so announcements for low-vision users no longer block the
  UI thread. SR detection result is cached with a 30-second TTL so starting
  NVDA mid-session stops double-talk within one announcement cycle.
- **GATE-12 (announce-gap) added.** `check_announce_gap.py` is a pre-commit gate
  that flags any dialog updating a status `StaticText` via `SetLabel` without an
  announce call. Triggers on `quill/ui/` and `quill/devtools/` files.

### Bug fixes and security

- Python console `compile()` now appends trailing `\n` before single-mode
  compile, fixing `SyntaxError` on compound statements (`for`, `with`, `if`).
- Nuitka build dependency removed entirely (was unreliable; took 44+ min and
  stalled). Purged from `pyproject.toml`, CI, and scripts.
- Stray vendor HTML file at repo root removed.
- Safe Mode now gates the Developer Console in addition to AI and Quillins.
- `write_json_atomic` now fsyncs before `os.replace` to survive power cuts.
- CLI missing-file paths now print a warning instead of silently skipping.
- `_screen_reader_active()` re-probes every 30 seconds (was cached forever).
- `safe_subprocess` passes `CREATE_NO_WINDOW` on Windows to suppress console flash.
- Redaction now covers GitHub PATs, OpenAI keys, AWS access keys, Slack tokens,
  and long alphanumeric tokens in addition to the existing bearer/hex patterns.
- GitHub URL parser rewrote using `urllib.parse` to handle query strings, anchors,
  and percent-encoded paths.
- Vendor autoupdate `_version_tuple` handles pre-release version segments.
- TypeScript console host API calls (`documentText`, `replaceSelection`, etc.) are
  now marshaled to the UI thread via `wx.CallAfter` + `threading.Event`. Previously
  they ran on the Node reader thread, violating the wx threading invariant.
- GitHub temp files now land in a content-addressed slot (`sha256(repo:ref:path)[:16]`)
  instead of a flat basename. Eliminates wrong-repo commits when two files share a name.
- GitHub `get_identity()` is no longer called on the UI thread. All three entry points
  (`Open Repository`, `Open File URL`, `Manage Accounts`) now post it to a daemon thread
  before showing any dialog, fulfilling the module docstring's threading promise.

## Security Hardening and UX Delight — 1.0 Release Pass (2026-05-01)

This section records the 13 HIGH-severity security fixes, 16 UX delight features, and the LOW/NIT fixes applied during the pre-1.0 code review. All items below were open in `issues.md` before this pass and are now closed.

### HIGH security and reliability fixes (all 13 closed)

- **H-SAFE-1 / H-1-tests — Safe Mode now enforced in all load-bearing paths.** `--safe-mode` / `QUILL_SAFE_MODE=1` disables AI responses, the watch folder, and Quillin contributions. Covered by `test_safe_mode_blocks_assistant_network_calls`.
- **H-1 — Subprocess args no longer logged in full.** `redaction.py::format_args_for_log` redacts every argument; only the executable basename and arg count are preserved. Covered by `test_run_subprocess_safely_does_not_log_secrets`.
- **H-2 — Crash bundle redacts secrets before shipping.** `build_diagnostic_bundle` runs `redact_text_for_bundle_with_stats` on every text file. Covered by `test_diagnostic_bundle_redacts_secrets_and_paths`.
- **H-3 — `recent_commands` sanitized before embedding in diagnostic bundle.** `filter_recent_commands` validates every item against the command-id grammar and drops anything invalid.
- **H-4-core — `recovery.py` state mutations serialized.** `begin_session`, `mark_clean_exit`, and `_record_offer_outcome` are now protected by a `threading.RLock` (in-process) and `msvcrt.locking` / `fcntl.flock` (cross-process). Covered by `test_concurrent_begin_session_serialize_via_lock`.
- **H-1-core — `QUILL_DATA_DIR` gated on `_DEV_BUILD`.** Release builds ignore the env var entirely. Dev builds additionally require the path to be under `Path.home()`. Covered by `tests/unit/core/test_paths.py` (4 tests).
- **H-2-core — External engine executable allowlist.** `configure_engine` and `probe_engine` validate the executable basename against `_ENGINE_EXECUTABLE_BASENAMES` before any I/O. Covered by `test_configure_engine_rejects_unallowed_executable` and `test_probe_engine_rejects_unallowed_executable`.
- **H-3-core — SSH uses `RejectPolicy` by default.** `paramiko.AutoAddPolicy` is only available when `trust_first_use=True` is passed explicitly. System host keys are always loaded first. Covered by 4 tests in `test_ssh_client.py`.
- **H-4-core-2 — IPC queue append serialized in-process.** `enqueue_open_request` acquires a module-level `threading.Lock` before opening the JSONL file. Covered by `test_concurrent_enqueue_serializes_via_lock`.
- **H-1-ui / H-2-ui — Quillin consent and remove-confirm dialogs use the modal contract.** Both `quillin_consent` and `on_remove` now route through `_show_modal_dialog` + `apply_modal_ids`. Covered by `test_quillin_consent_uses_modal_contract` and `test_on_remove_uses_modal_contract`.
- **H-3-ui — Watch Queue Monitor properly cleaned up on close.** `_on_close` explicitly destroys the monitor dialog and clears all references before the watch service stops.
- **H-1-platform / H-2-platform — `pyttsx3` engine is a process-wide singleton.** Initialization happens once; a `_pyttsx3_engine_failed` gate prevents repeated failure. `reset_pyttsx3_engine_for_tests()` helper added for test isolation.
- **H-3-platform — `Windows.Media.Ocr` import wrapped.** `winsdk` imports are wrapped in `try/except ImportError`; `_WINSDK_AVAILABLE` flag prevents crashes on non-Windows builds. Covered by `test_module_imports_without_winsdk`.
- **H-4-platform — macOS VoiceOver errors now logged.** The `except Exception: pass` branch is now `logger.warning(...)`. Covered by `test_macos_announce_error_logged`.

### Magic / UX delight (all 16 closed — §8)

- **Key cheatsheet (`Alt+Shift+/`).** `open_key_cheatsheet()` opens a searchable dialog listing every command and its keybinding.
- **Go to anything (`Ctrl+Shift+Grave, G`).** `GoToAnythingDialog` in `quill/ui/palette.py` searches commands (`>` prefix) and headings (`#` prefix). Activating a heading calls `go_to_line_number(lineno)` on `MainFrame`.
- **Earcons.** `_play_quill_sound()` fires at mode-entry transitions, queued separately from TTS so it does not interrupt screen-reader output.
- **"Why Don't I See a Feature?" (`Alt+F1`).** `explain_unavailable_feature()` announces the reason a command is unavailable.
- **Live contrast checker (`Ctrl+Shift+Grave, Shift+C`).** `announce_contrast_ratio()` computes the WCAG 2.1 relative-luminance ratio for the current theme and announces it. Also fires automatically after `_apply_theme()`.
- **Magic Paste (`Ctrl+Alt+V`).** `magic_paste()` inspects the clipboard for a URL, Markdown block, or base64 image and presents a picker before inserting.
- **Recovery diff UX.** `_offer_crash_recovery()` now includes a 30-line read-only snapshot preview so users can review content before deciding to restore.
- **Status bar context help (`Ctrl+Shift+Grave, Shift+H`).** `announce_context_mode_shortcuts()` announces the most useful keys for the current mode in priority order. (`Alt+H` is reserved for the Help menu mnemonic.)
- **Soft error recovery link.** `_show_error_with_hint()` is used for file-open, export, and import errors. A "What to try next..." toggle reveals a `wx.TE_READONLY` area with contextual guidance.
- **TTS fallback announcement.** `_check_tts_fallback_on_startup()` fires at startup and announces "Screen reader fallback active. F8 to retry TTS." when `pyttsx3` could not be initialised. `retry_tts_init()` exposed in `prism_bridge.py`.
- **Recovery `had_replacements` note.** `read_recovery_snapshot()` returns `(text, had_replacements)`; the recovery dialog shows a warning when replacement characters are detected.
- **Annisuggestion.** `top_suggestion()` in `quill/core/palette.py` surfaces the most-used recent command (≥3 uses, within 1 hour) as a `suggestion` status-bar cell. Activating the cell runs the command.
- **Crash-recovery loop fix (M-28).** `RecoveryOffer.dismissal_count` adapts the dialog text and relabels the skip button "Discard and Continue" after 3 dismissals.
- **File-context summary (`Alt+I`).** `show_document_summary()` announces word count, line count, heading count, last-saved time, and recovery snapshot presence.
- **A11Y live indicator.** `"sr_name"` status-bar cell shows which screen reader is detected, populated by `detect_screen_reader()` from `sr_detect.py`.
- **"Resume from where I left off".** Caret position is saved per autosave cycle (`save_cursor_position()` in `recovery.py`) and per workspace snapshot (`caret_positions_from_session()` in `sessions.py`). Both are restored on next open.

### MEDIUM — Sweep 14 (14 fixes: M-10 through M-26 batch)

- **M-12** — `io/rtf_safety.py`: removed `\bAUTOTEXT\b` from `_REMOTE_FIELD_RE`; `AUTOTEXT` is a benign boilerplate-insert control word, not a remote-fetch instruction. Covered by `test_autotext_not_flagged_as_remote`.
- **M-26** — `tools/module_size_budgets.json`: added `"_next_target_main_frame": 15000` to make the CQ-1 decomposition trajectory explicit.
- **M-21** — `stability/safe_regex.py`: added `_compile_cached` (`lru_cache(maxsize=128)`) so `safe_finditer` and `safe_subn` reuse compiled patterns across calls. Covered by `test_safe_finditer_uses_cached_compile`.
- **M-23** — `stability/wx_dispatch.py`: `call_ui_safely` now logs a `WARNING` when `wx.CallAfter` is unavailable and it falls back to synchronous execution on the caller thread. Covered by `test_call_ui_safely_logs_warning_without_wx`.
- **M-10** — `io/pdf.py`: `extract_pdf_text` now catches any `Exception` from each extractor (not just `ModuleNotFoundError`), so a malformed PDF falls through to the next extractor without crashing. Covered by `test_malformed_pdf_returns_empty_text_not_crash`.
- **M-17** — `stability/diagnostics.py`: `setup_fault_handler` now closes the previous handle and calls `faulthandler.cancel_dump_traceback_later()` before opening a new one, so handles stay bounded across long sessions. Added `close_diagnostic_handles()` helper. Covered by `test_diagnostic_handles_bounded`.
- **M-18** — `stability/task_manager.py`: `shutdown(wait, cancel_futures=not wait)` replaced with `shutdown(wait=True, cancel_pending=False)` — the two parameters are now independent. Covered by `test_task_manager_shutdown_decoupled`.
- **M-19** — `stability/wx_heartbeat.py`: `WxHeartbeatWatchdog.stop(timeout=5.0)` now calls `self._thread.join(timeout=timeout)` after setting the stop event, so callers know the watchdog has fully stopped. Covered by `test_watchdog_stop_joins_thread`.
- **M-20** — `stability/wx_heartbeat.py`: replaced the `already_dumped` boolean with a `last_dump_time` timestamp; the watchdog re-dumps when `age >= dump_after_seconds` AND at least `dump_after_seconds` seconds have elapsed since the last dump. This ensures a brief UI unblock followed by a second block triggers a second dump. Covered by `test_watchdog_re_dumps_after_recovery_window`.
- **M-22** — `stability/feature_contracts.py`: `validate_feature_contract` now enforces two additional rules: `risky`/`advanced` features must have `disabled_in_safe_mode=True`; `experimental` features must have `default_enabled=False`. Covered by `test_feature_contract_full_validation`.
- **M-11** — `io/structured.py`: `_format_spreadsheet` now catches `zipfile.BadZipFile` separately from generic `Exception` and returns a "corrupted file" message pointing the user to repair in Excel/LibreOffice, rather than the generic "import not available" message. Covered by `test_corrupt_xlsx_surfaces_actionable_error`.
- **M-13** — `io/rtf.py`: added `_detect_rtf_encoding(path)` which reads the first 512 bytes to extract the `\ansicpg` code-page number; `read_rtf_document` now uses the detected encoding instead of hard-coded `cp1252`, so Cyrillic (CP1251) and other non-Western RTF files decode correctly. Covered by `test_cyrillic_rtf_decoded_with_ansicpg`.
- **M-16** — `core/ai/assistant.py`: `make_default_backend()` now logs a `WARNING` when the configured provider probe fails, rather than silently swallowing the exception. Covered by `test_unreachable_provider_announced`.
- **M-25** — `tools/quillin_lint.py`: `_string_errors` now uses the `regex` package with `timeout=0.5` when available (falls back to `re` if not installed), guarding against ReDoS in Quillin manifest pattern validation. Covered by `test_redos_pattern_rejected`.

### MEDIUM — Sweep 15 (8 fixes: M-3, M-5, M-6, M-7, M-8, M-9, M-14, M-15)

- **M-9** — `io/pages.py`: `_read_pages_via_iwa` now acquires a module-level `threading.Lock` (stored as `_codec._quill_id_name_map_lock`) around the `ID_NAME_MAP` patch/restore cycle. Two concurrent `.pages` openers can no longer corrupt each other's codec state. Covered by `test_concurrent_reads_serialize_via_lock`.
- **M-14** — `core/read_aloud.py`: `_speak_sentence_dectalk` and `_run_espeak_live` now track `start = time.monotonic()` and call `process.kill()` + raise `ReadAloudUnavailableError` when `_MAX_SYNTHESIS_SECONDS` (120 s) elapses. Hanging DECtalk/eSpeak processes can no longer stall the worker thread indefinitely. Covered by `test_dectalk_killed_after_wall_clock_timeout`.
- **M-15** — `core/read_aloud.py`: `synthesize_with_piper` now writes the text to a `NamedTemporaryFile` and passes it as `stdin` (an open file object) instead of using `input=text`. This bypasses the 64 KiB OS pipe-buffer limit for large inputs and adds `timeout=_MAX_SYNTHESIS_SECONDS` to `subprocess.run`. Covered by `test_piper_long_text_via_temp_file`.
- **M-5** — `core/ai/foundation_models.py`: `FoundationModelsBackend` now caches a single `asyncio` event loop on a daemon thread (`fm-event-loop`) and submits all coroutines via `asyncio.run_coroutine_threadsafe`. `asyncio.run()` was creating a new loop per call, leaking OS handles. Covered by `test_event_loop_reused_across_calls`.
- **M-6** — `core/updates.py`: `verify_manifest_signature` now returns `False` immediately when `QUILL_UPDATE_MANIFEST_KEY` is not set. A salt-only HMAC (the default placeholder) is no longer accepted as a valid signature, preventing MITM forgery on unconfigured deployments. Covered by `test_salt_only_signature_rejected`.
- **M-7** — `core/python_sandbox.py`: added `_ProtectedGlobals(dict)` — a `dict` subclass whose `__setitem__` silently ignores writes to `"__builtins__"`. The sandbox's `globals_ns` is now a `_ProtectedGlobals` instance, preventing user code from replacing the restricted builtins dict via `globals()["__builtins__"] = original_builtins`. Covered by `test_builtins_rebinding_blocked`.
- **M-8** — `ui/main_frame.py`: `_watch_run_macro` already routes all UI-thread macro dispatch through `wx.CallAfter`. Verified clean; added `test_macro_dispatch_marshalled_to_ui_thread` to lock in the contract.
- **M-3** — `core/ai/external_engine.py`: `configure_engine` now calls `which(command[0])` (injectable for tests, defaults to `shutil.which`) and raises `ValueError` if the executable is not on `PATH` and no absolute path was given. A new `which=` parameter makes the check testable without modifying `PATH`. Covered by `test_unresolvable_executable_rejected`.

### MEDIUM — Sweep 16 (6 fixes: M-24, M-28, M-29, M-30, M-31, M-32) — all MEDIUM closed

- **M-24** — `tools/dialog_button_contract.py`: extended the dialog-button audit to also verify that every `apply_modal_ids` `affirmative_id` is backed by a real button or `CreateButtonSizer` flag, or that the scope handles `WXK_RETURN`/`WXK_NUMPAD_ENTER` manually. Removed the bogus `affirmative_id=wx.ID_OK` from five `assistant_tools.py` dialogs (no ID_OK button existed); added `# noqa: dialog_button_contract` to `preview_dialog.py` where the button ID is a loop variable (false positive). Covered by `test_unbacked_affirmative_id_flagged` and `test_audit_accepts_enter_handler_for_affirmative_id`.
- **M-28** — `ui/main_frame.py`: `_show_modal_dialog` gains a `restore_editor_focus: bool = True` parameter. The crash-recovery loop now passes `restore_editor_focus=False` so `editor.SetFocus()` is not called between re-show iterations, eliminating the focus-racing that caused screen readers to announce the editor between dialog opens. Covered by `test_crash_recovery_loop_does_not_steal_focus`.
- **M-29** — `ui/assistant_tools.py`: `RunPythonDialog._on_run` now dispatches `run_python_sandbox` to a daemon worker thread and delivers results back via `wx.CallAfter(_finish_run, result)`. The Run and Apply buttons are disabled during execution and re-enabled in `_finish_run`. Long-running sandbox scripts no longer freeze the UI thread or the screen reader. Covered by `test_run_python_does_not_block_ui_thread`.
- **M-30** — `ui/main_frame_browse.py`: `_run_browse_prewarm` now creates a per-run `threading.Event` (`cancel_event`). Before starting a new worker thread it sets any in-flight event (`old_cancel.set()`). The worker checks `cancel_event.is_set()` before calling `wx.CallAfter`, so a superseded build drops its result without triggering a UI update. Covered by `test_prewarm_thread_cancelled_on_repeat`.
- **M-31** — `ui/sticky_notes.py`: `StickyNotesVaultDialog._delete_selected` now uses `show_message_box` from `quill.ui.dialog_contract` instead of raw `self._wx.MessageBox`. Screen readers now hear the enter/exit announcement cues for the delete confirmation dialog. Covered by `test_delete_confirm_uses_contract_helper`.
- **M-32** — `ui/main_frame_image.py`: replaced both `time.sleep(0.1)` polling loops (OCR and image-description progress) with `wx.MilliSleep(100)`, and removed the `import time` that was no longer needed. `wx.MilliSleep` pumps the wx event queue between sleeps, eliminating CPU busy-wait while OCR or AI description runs.

### LOW — L-23 (csv_grid.py cell-ID stride)

- **L-23** — `quill/ui/csv_grid.py:GetSelection`: replaced the `row * 1000 + col` position encoding with `row * _CELL_POSITION_STRIDE + col` where `_CELL_POSITION_STRIDE = 16384`. The old stride collided for any column ≥ 1000 (e.g. row=1,col=0 → 1000 == row=0,col=1000). The new stride matches Excel's maximum column count (16 384) so no realistic spreadsheet can produce a collision. Seven regression tests added in `tests/unit/ui/test_csv_grid.py`.

### LOW and NIT — Sweep 12 (§6 and §7 fully closed)

- **L-17** — `tests/stability/test_stability.py`: added 6 direct unit tests for `redaction.py` (previously tested only indirectly via the bundle): `test_redact_command_arg_replaces_secret_name_value_pair`, `test_redact_command_arg_strips_windows_path_prefix`, `test_format_args_for_log_preserves_basename_and_count`, `test_format_args_for_log_empty_returns_no_args`, `test_redact_text_for_bundle_drops_bearer_line_and_reports_stats`, `test_filter_recent_commands_drops_non_id_strings`. Test count: 25 → 31.
- **L-18** — `tests/performance/test_budgets.py`: added `pytestmark = pytest.mark.perf` and registered the `perf` marker in `pyproject.toml`. Wall-clock budget tests can now be excluded with `-m "not perf"` in latency-sensitive CI environments.
- **L-19** — `dialogs.md`: added a cross-reference block near the top of the file pointing to `tests/accessibility/test_accessibility_suite.py`, `tests/accessibility/test_announcement_grammar.py`, and `docs/qa/final-qa-test-plan.md §6` ("Dialog estate pass").
- **L-20** — `docs/qa/final-qa-test-plan.md`: `§5.1` already carries all three required artifacts (`dialog_inventory.json` mtime, `module_size_budgets.json _rebaseline_*` keys, and wxPython runtime version, plus the public surface fixture and glow-core engine hash). Confirmed and closed.
- **N-13** — `quill/core/bookmarks.py`: added a module docstring explaining the rationale for keeping this as a separate wx-free module (pure dict operations, independently unit-testable without importing wx). Mirrors the existing `clipboard_collector.py` docstring.
- **N-14** — `quill/core/clipboard_collector.py`: existing module docstring (`EDS-11` reference, explicit wx-free contract) is sufficient. Confirmed and closed.

### LOW and NIT fixes (§6 and §7 continued)

- **L-2** — `core/lexical.py`: added `logger.debug("Lexical provider %s failed: %s", ...)` inside the broad `except` so provider regressions surface in diagnostic logs.
- **L-3** — `core/ai/assistant.py`: added `logger.warning(...)` inside the Foundation Models backend probe `except` so probe failures appear in the diagnostic bundle.
- **L-4** — `core/lexical_preload.py`: added `logger.debug(...)` inside the preload `except` so non-fatal warm-up failures are visible in debug logs.
- **L-6** — `core/watch_queue.py`: documented why `threading.RLock` is required (`_dequeue_item` re-enters `_try_flush` under the same lock; plain `Lock` would deadlock).
- **L-14** — `tools/check_banned_patterns.py`: enriched the unregistered-dialog-surface violation message to hint that stock `wx` dialogs should be added to `_NATIVE_WX_DIALOGS` in `dialog_inventory.py`.
- **L-16 / N-5** — `tools/ui_surface.py`: wrapped the bare `next(...)` call in `try/except StopIteration` and raised `SystemExit` with a clear message when `MainFrame` cannot be found (e.g. after a rename).
- **M-27** — `pyproject.toml`: added `"Operating System :: MacOS"` classifier to match the documented macOS support.
- **L-1** — `core/paths.py`: on Windows, missing `APPDATA` now raises `RuntimeError` with a clear message instead of silently falling back to the hidden `~/.quill` directory. Non-Windows still uses `~/.quill` as before. New test `test_windows_raises_when_appdata_missing` locks this in.
- **L-7** — `core/glow.py`: narrowed the `ImportError`-only case in `_load_glow_core`; all other broad `except Exception` sites in the GLOW backend now log `logger.warning(...)` before returning the safe fallback.
- **L-10** — `io/ocr.py`: narrowed `except Exception` to `except ImportError` in `_import_windows_ocr` so non-import errors are not silently swallowed.
- **L-21** — `stability/*.py`: all stability modules already carry `Implements: ROADMAP ...` docstrings — confirmed and closed.
- **L-22** — `tests/unit/tools/test_bundled_quillin_lint.py`: added `test_bad_quillin_fixture_is_rejected` negative test with a `fixtures/bad_quillin/manifest.json` that fails schema validation (missing `id`, invalid `version`).
- **N-10** — `dialogs.md`: safe mode flag already referenced at lines 280-305 — confirmed and closed.
- **N-3** — `stability/crash_report.py`: bundle filename now uses ISO-8601 (`YYYYMMDDTHHMMSSZ`) instead of a raw 19-digit nanosecond epoch, making bundles human-inspectable in Explorer and sorted correctly by name.
- **L-11** — `io/structured.py`: duplicate of M-11 (low because there is an existing fallback); closed as a reference item — will be addressed with M-11.

- **L-8** — `updates.py`: removed unnecessary `getattr` guard around `response.headers.get("Content-Length")`.
- **L-12** — `safe_mode.py`: deleted unused `safe_mode_message()` export.
- **L-15** — `network_egress_audit.py`: duplicate egress-site key now raises `ValueError` at scan time so no new egress site can be silently dropped.
- **N-1** — `stability/__init__.py`: re-exported `build_diagnostic_bundle`, `configure_logging`, and `run_subprocess_safely` for ergonomic call sites.
- **N-4** — `module_size_budgets.json`: `_comment` / `_rebaseline_*` keys are now stripped before the budget map is read.
- **N-7** — `quillin_lint.py`: `_JSON_TYPES` is now `types.MappingProxyType({...})` for immutability.
- **N-8** — `dialog_button_contract.py`: `_FLAG_TO_ID` reverse-lookup dict used by `_collect_button_ids`; `# noqa: dialog_button_contract` opt-out added.
- **N-9** — `feature_contracts.py`: `requires_timeout: bool | None = None` moved to end of dataclass for default-value ordering.
- **N-11** — `external_engine.py`: `configure_engine` docstring documents POSIX-style shell-command format and `shlex.split` semantics.
- **N-12** — `recovery.py`: `_validate_session_id()` helper replaces three `UUID(session_id)` side-effect calls.
- **N-15** — `dictation.py`: `try/except ImportError` block carries explicit Windows-only intent comment.
- **N-16** — `announcements.py`: `format_progress` docstring states its pure-function, no-I/O, thread-safe contract.
- **M-1** — `core/watch_actions.py`: added `_humanize_action_error(action_id, error)` and routed the 8 broad `except Exception` sites (`OpenAction`, `MoveAction`, `CopyAction`, `ConvertAction`, `RunMacroAction`, `RunPythonTransformAction`, `AiAction`, `OcrAction`) plus the registry's last-resort guard through it. Screen-reader users now get plain-English messages such as `"Quill cannot complete the move. The folder is read-only or you lack permission — choose a folder you own."` instead of `"[Errno 13] Permission denied: 'C:\\…'"`. Coverage: `test_humanize_permission_error_is_actionable`, `test_humanize_file_not_found_mentions_reappear`, `test_humanize_generic_oserror_keeps_strerror`, `test_humanize_unrecognized_error_falls_back_to_str`, `test_move_action_permission_error_humanized`. Budget re-baselined (+57 lines).
- **L-9** — `core/storage_mode.py`: `portable_root_dir()` now honours the `_DEV_BUILD` flag (set at module load from `QUILL_DEV_BUILD == "1"`), so release builds ignore `QUILL_PORTABLE_ROOT` even if a user has it set. Mirrors the H-1-core treatment of `QUILL_DATA_DIR`. Coverage: `test_release_build_ignores_quill_portable_root` and `test_dev_build_honours_quill_portable_root`.
- **L-13** — `stability/task_manager.py`: `QuillTask` now carries `submitted_at` (wall-clock at submit) and `result_summary` (one of `"pending"`, `"ok"`, `"cancelled"`, `"failed"`, exposed as a `TaskResult` literal). The worker's exception handler pre-tags the result, and the done callback only re-derives it when the worker never reached its exception path — eliminating a race where a cooperative cancel looked like `"failed"`. The diagnostic bundle picks the new fields up automatically because `_snapshot_task` runs `asdict()` on the dataclass. Coverage: `test_task_manager_records_submitted_at_and_pending_result`, `test_task_manager_result_summary_ok_after_success`, `test_task_manager_result_summary_failed_on_exception`, `test_task_manager_result_summary_cancelled`.
- **L-5** — `core/assistant_ai.py`: wrapped `unprotect_secret` in `try/except Exception` so a DPAPI decrypt failure (portable install moved between machines, current user differs from the original) no longer propagates. A new module-level `ASSISTANT_KEY_UNLOCK_FAILED_MESSAGE` constant (`"The saved API key is encrypted for a different Windows user. Open AI Connection and enter the key again."`) is now surfaced from `verify_assistant_connection()` and `list_assistant_models()` whenever `assistant_secret_unlock_failed()` returns True and no fresh key is supplied. The original provider "unauthorized" error is replaced with an actionable message. Coverage: `test_verify_assistant_connection_surfaces_unlock_failure`, `test_list_assistant_models_surfaces_unlock_failure`.
- **N-6** — `core/spellcheck.py` and `core/thesaurus.py`: added public `reset_caches()` helpers to both modules. Each takes its module's own backend/load lock, so a reset cannot race a lazy loader. `tests/performance/test_budgets.py` now calls the public helpers instead of poking `_WORDLIST_CACHE` / `_INDEX` directly; the old private-attribute reset code is retained as a backward-compat shim. New tests in `tests/unit/core/test_reset_caches.py` lock in the new contract: `test_spellcheck_reset_caches_clears_all_globals`, `test_spellcheck_reset_caches_acquires_backend_lock`, `test_spellcheck_preload_after_reset_loads_wordlist`, `test_thesaurus_reset_caches_clears_index_and_error`, `test_thesaurus_reset_caches_acquires_load_lock`, `test_thesaurus_preload_after_reset_is_idempotent`.

---

## QUILL Brand Identity

**QUILL** stands for **Quality, Usable, Inclusive, Lightweight, Literate**.

**QUILL: A quality, usable, inclusive, lightweight, and literate editor built for everyone who writes, codes, learns, and creates.**

## Cross-platform support and on-device AI

- **macOS support.** Quill now runs on macOS as well as Windows from one codebase. Announcements route to VoiceOver (never speaking over it); release Mac builds are code-signed with a Developer ID certificate and notarized by Apple.
- **Ask Quill chat.** An on-device AI chat rendered as a fully accessible WebView document — heading-navigable turns, announced replies, an in-page message box, and Escape to close. Verified in NVDA, JAWS, and VoiceOver.
- **On-device AI, no cloud required.** Apple Foundation Models on macOS; llama.cpp (CPU, GGUF) on Windows/Linux; optional Ollama (local/cloud) or a custom endpoint. The assistant answers in chat by default and never edits a document without approval.
- **Train Writing Style** conditions the assistant on your own writing.
- **Accessible WebView library.** The chat, preview, About box, and update/consent dialogs are built on the open-source `wx-accessible-webview` library (extracted from Quill).

## AI reliability and clarity (highlights)

- **Clearer AI connection messages.** Quill now tells the difference between a rejected API key ("Authentication failed. Check your API key.") and a valid key that lacks access to a model or region ("Access denied..."), and reports rate limiting, warm-up, and local-server-not-running states in plain language.
- **Warm-up retry.** When a model is still loading, Quill briefly retries before reporting it as warming up, instead of failing the first attempt.
- **No false 403s.** Connection status is matched on real HTTP status codes, so host ports like `localhost:11403` are never mistaken for an error.
- **Smarter quick writing actions.** Rewrite, Summarize, Continue Writing, and Fix Grammar now work with or without a selection, fall back to a sensible scope (paragraph or whole document), and announce the scope and word count.
- **AI-off guard everywhere.** The quick writing actions respect the AI-enabled setting from any entry point, including the command palette and keybindings.
- **Portable key recovery.** If a saved API key cannot be unlocked on the current device, the AI status line prompts you to re-enter it instead of showing a confusing authentication error.

## Quill 0.1.5 Beta

Quill 0.1.5 Beta focuses on safe rollout surfaces for BITS Whisperer, clearer preference parity, and more accessible status monitoring without changing core editor behavior.

### Added and improved in 0.1.5

- Added QUILL Quick Nav browse-style mode with `Ctrl+Shift+Grave`, cursor-only movement, and explicit non-editing behavior while active.
- Added mnemonic Quick Nav movement for links, lists, list items, tables, block quotes, bookmarks, code blocks, table of contents, headings, heading levels 1 through 6, paragraphs, sentences, and blocks, with `Shift` reversing direction where applicable.
- Added configurable Quick Nav wrap behavior and configurable Quick Nav feedback mode (`speech`, `sound`, `both`, `none`).
- Added document-surface-aware Quick Nav indexing for Markdown and HTML, including heading parsing, Markdown and HTML list-item anchors, paragraph anchors, and sentence anchors.
- Added Quick Nav cache invalidation on document edits, full-text replacement operations, and tab switches to preserve performance and correctness.
- Added BITS Whisperer provider onboarding, readiness checks, capability matrix, and guarded download queue controls.
- Added live Help status-page updates with quieter refresh announcements that only speak when tracked values change.
- Added Preferences controls for AI enable state, BITS Whisperer safe mode lock, auto-open status behavior, and refresh cadence.
- Added rollout-safe diagnostics snapshots and startup onboarding for BW setup defaults.
- Enabled Ruff markdown preview formatting so release docs can stay formatted consistently.
- Added robust command-line options, including `--help`, `--version`, startup cursor targeting (`--line`, `--column`), `--new-window`, and `--wait`.

## Quill 0.1.2 Beta

Quill 0.1.2 Beta expands Quill's writing flow with prediction, snippets, in-app preview, local assistant workflows, and packaging/onboarding polish.

### Added and improved in 0.1.2

- Added **Word Prediction** with `Ctrl+Space`, including document-word, HTML tag, and Markdown tag suggestions.
- Moved **Insert Snippet** to `Ctrl+Alt+Space` and **Manage Snippets** to `Ctrl+Alt+Shift+Space` so snippet insertion no longer clashes with prediction.
- Added a **Word Prediction as you type** preference and View-menu toggle.
- Added **In-App Preview** and **Side-by-Side Preview** with keyboard-first focus movement.
- Added a local **Writing Assistant** menu surface with rewrite/summarize/continue/grammar quick actions and ranked command suggestions.
- Added a sandboxed **Run Python** transform tool for document/selection automation.
- Added first-run **Writing Assistant onboarding** plus **Preferences -> AI Connection** for provider, host, and model setup.
- Added secure optional API-key storage for AI endpoints using **Windows DPAPI**.
- Added AI provider support for **Ollama Cloud (API key)** and improved custom-endpoint handling.
- Added explicit **Ollama Cloud onboarding** guidance in AI Connection, including note that free personal-use access is available with lower usage limits.
- Added **Verify Connection**, **List Models**, and **Recommend Model** actions in AI connection settings.
- Added automatic AI-connection verification on save and an AI-menu status flow with **Ready / Needs attention / Not checked**.
- Added an AI-menu detail line with short verification reason text.
- Improved screen-reader behavior by announcing plain-language AI verification outcomes immediately.
- Improved Ask Quill chat accessibility by announcing incoming responses/proposals/errors as they arrive.
- Updated Windows packaging to stage an assistant setup guide and expose an optional `aiassistant` installer component.
- Added custom profile management with opt-in inheritance from a parent built-in profile or an explicit bare-bones start.
- Added profile quick picker hotkey **Alt+Shift+P** (`help.switch_feature_profile`).
- Updated profile switching so custom profiles can carry feature states, settings, and keymap bindings together.
- Added Markdown list editing flow updates: `Enter` continues list items, `Enter` on an empty marker exits the list, and `Tab`/`Shift+Tab` nest or promote list items.
- Added a **List Manager** (`Ctrl+Alt+L`) under Format -> List for tree-based list restructuring (move, promote/demote, add, edit, delete).
- Added structured **PowerPoint (.pptx) import** with slide titles as headings, bullet levels as nested lists, table extraction, and speaker-note extraction.
- Added **Style Headings...** under Insert -> Heading to apply font family, size, and alignment to current-level or all headings in Markdown/HTML.
- Added **Heading Organizer** (`Ctrl+Alt+Shift+H`) for keyboard-first heading promotion/demotion, section reordering, heading renaming, and accessibility validation before apply.
- Added release-safety fallback for beta testing: Word (`.doc`, `.docx`) and CSV/TSV now open in the standard plain-text editing surface by default.
- Kept structured Word and CSV grid implementations in-repo behind an internal gate for continued verification.
- Added **Watch Folder automation** under **Tools -> Dictation** to monitor a folder and auto-open newly detected supported files.
- Added **Watch Folder Settings** and **Watch Folder Status** commands for path, subfolder, startup, and polling control.
- Added **Watch Folder onboarding** to Startup Wizard and first-run setup flow.
- Removed duplicate path reporting by hiding the status-bar file path item when full path is already shown in the title bar.
- Fixed intermittent unit-test file-locking in UI navigation tests by isolating `QUILL_DATA_DIR` per test.
- Expanded docs and release notes for the complete 0.1.2 feature set.

## Quill 0.1.1 Beta

Quill 0.1.1 Beta advances the 0.1 baseline with update-path hardening, status-bar parity completion, menu/discoverability polish, and documentation alignment.

### Added and improved in 0.1.1

- Completed status-bar interaction parity: focused cell context actions now include **Activate**, **Hide this item**, and **Status bar settings**.
- Added **Restore Defaults** to Status Bar Settings and persisted layout changes.
- Hardened **Help -> Check for Updates...** with guided installer handoff, including close-now support for clean setup.
- Simplified the Search menu to a single **Replace...** entry; replace-all now lives in the Replace dialog and keeps the existing replace-all hotkey path.
- Clarified naming and discoverability around **Workspace Snapshots**, **Recent Marks (Ring)**, and status-bar terminology.
- Expanded regression coverage for search/extend-selection and no-selection transform behavior.
- Added About-dialog acknowledgments for contributors and beta testers.
- Added a full snippets workflow: searchable insert (`Ctrl+Space`), manage (`Ctrl+Alt+Space`), placeholder prompts, trigger expansion, and starter packs.
- Regenerated the signed update feed for `0.1.1`.

## Quill 0.1.0 Beta

Quill 0.1 Beta is the first broad, coherent release of Quill as a screen-reader-first writing, reading, review, and document-intelligence environment for Windows from Blind Information Technology Solutions (BITS) and Community Access.

### Highlights

- Native wxPython editor shell with command palette, tabs, menus, and interactive status bar
- Plain text, Markdown, HTML, EPUB, PDF, DOCX, ODT, RTF, JSON, XML, TOML, CSV, TSV, notebook, and SQLite reading surfaces
- Deterministic GLOW audit and fix workflows inside Quill for plain text, Markdown, and HTML
- Guided optional-tool onboarding for Pandoc, Tesseract OCR, LibreOffice, Ghostscript, HTML Tidy, XML Lint, and PyMarkdown
- Pandoc Conversion Wizard for opening supported source files as Markdown, HTML, or plain text tabs
- In-app diagnostics review before export and in-app bug-report review before launching the Community Access support form
- Autosave, backups, recovery, persistent undo, trusted locations, notifications, and signed update checks
- Windows packaging flow with embedded Python, portable bundle generation, and Inno Setup installer compilation

### What feels new in this release

The Help menu now acts like a real support surface instead of a dead end. Users can review diagnostics before Quill writes a zip, review a bug report before Quill opens the browser, and route support feedback into the shared Community Access support flow with more confidence and less guesswork.

Quill also now has a more practical format-bridge story. With Pandoc available, documents can move into stable text-centric workflows without pushing users into command-line tooling. The external-tools dialog explains what each helper unlocks and keeps the setup story transparent.

### Evening polish updates

- File > Sessions was clarified as **workspace snapshots** with clearer menu labels for saving, opening, recent snapshots, and current workspace documents.
- Mark Ring and Bookmarks language was clarified in-app to distinguish temporary jump points (mark ring) from named jump points (bookmarks).
- Tools menu information architecture was simplified into clear submenus: Writing and Language, Read Aloud, Integrations, Document Intake, Authoring and Automation, Compare Documents, Accessibility, Support, and Customize.
- Added a menu binding contract test so menu IDs and EVT_MENU handlers stay aligned as menus evolve.
- Completed status-bar parity details: focused cell context menu now offers Activate, Hide this item, and Status bar settings.
- Status Bar Settings now includes Restore Defaults and persists layout changes immediately.
- Help -> Check for Updates now includes a guided installer handoff that can close Quill before running setup.
- Version bumped to 0.1.1 for the next patch upgrade path.
- About Quill now includes a sincere thanks to contributors and beta testers: Techopolis, Taylor Arndt, Michael Doise, Kayla Bentas, Shane Popplestone, and Becky Knobb.

### Packaging and release quality

- Embedded Python runtime verification with pinned SHA-256 validation
- Runtime dependency bundling derived from project metadata for UI and spell-check support
- Compiled Windows installer output: `Quill-Setup-0.1.exe`
- Release provenance and SBOM generation support via `scripts/generate_release_artifacts.py`

### Support and feedback

Quill 0.1.1 Beta uses a unified Help-menu support flow. `Help -> Report a Bug...` now handles report preparation, optional diagnostics generation, in-app review, and support-form handoff in one guided path. `Help -> Save Diagnostics...` remains available for standalone diagnostics export.

### Notes

This is a beta release. The product direction is aligned with the Quill 1.0 PRD, while some workflows are still evolving toward that fuller 1.0 target.