From cfca6161b04e611ee4f6838704f91093f79d28d5 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Tue, 21 Jul 2026 19:18:06 +0800
Subject: [PATCH 01/26] ci: remove GitHub push-mirror workflow

---
 .forgejo/workflows/mirror.yml | 19 -------------------
 1 file changed, 19 deletions(-)
 delete mode 100644 .forgejo/workflows/mirror.yml

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
deleted file mode 100644
index 37462af..0000000
--- a/.forgejo/workflows/mirror.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Mirror to GitHub
-
-on:
-  push:
-    branches: ['**']
-    tags: ['**']
-
-jobs:
-  mirror:
-    runs-on: [self-hosted, hestia]
-    steps:
-      - name: Mirror to GitHub
-        run: |
-          set -euo pipefail
-          git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
-          cd repo.git
-          git push --prune \
-            "https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/breadsearch.git" \
-            '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

From 13f5e509e415b6199d39599c03064f24985dbc43 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 09:56:49 +0800
Subject: [PATCH 02/26] ci: add dev/beta build track workflows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds dev-release.yml (publishes on every push to dev) and beta-release.yml
(publishes on a beta-v* tag), mirroring the pattern landing in
bread-ecosystem/bread. Also creates the dev branch for this repo, which
didn't exist before — see bread-ecosystem/docs/release-channels.md for the
three-track policy.
---
 .forgejo/workflows/beta-release.yml | 60 +++++++++++++++++++++++++
 .forgejo/workflows/dev-release.yml  | 69 +++++++++++++++++++++++++++++
 2 files changed, 129 insertions(+)
 create mode 100644 .forgejo/workflows/beta-release.yml
 create mode 100644 .forgejo/workflows/dev-release.yml

diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml
new file mode 100644
index 0000000..fccc4e0
--- /dev/null
+++ b/.forgejo/workflows/beta-release.yml
@@ -0,0 +1,60 @@
+name: beta release
+
+# Publishes a beta-track build when a `beta-v*` tag is pushed —
+# separate from release.yml's tag-triggered stable releases. See
+# bread-ecosystem's docs/release-channels.md for the three-track policy
+# this is part of.
+on:
+  push:
+    tags: ['beta-v*']
+
+jobs:
+  build:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: build
+        run: cd src && cargo build --release --locked --workspace --features full
+
+      - name: test
+        run: cd src && cargo test --release --locked --workspace --features full
+
+      - name: prepare artifacts
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#beta-v}"
+          PKG_DIR="/srv/breadway-dl/beta/breadsearch/${VERSION}"
+          mkdir -p "${PKG_DIR}"
+          for bin in breadsearch breadmill; do
+            cp "src/target/release/${bin}" "${PKG_DIR}/${bin}-x86_64"
+            strip "${PKG_DIR}/${bin}-x86_64"
+            sha256sum "${PKG_DIR}/${bin}-x86_64" | awk '{print $1}' \
+              > "${PKG_DIR}/${bin}-x86_64.sha256"
+          done
+          cp src/packaging/breadmill.service "${PKG_DIR}/"
+          cp src/config.example.toml "${PKG_DIR}/"
+          cp src/bakery.toml "${PKG_DIR}/bakery.toml"
+          ln -sfn "${VERSION}" "/srv/breadway-dl/beta/breadsearch/latest"
+
+      # No GitHub Release upload — beta, like the other non-stable track,
+      # is only distributed via dl.breadway.dev/beta/.
+      - name: regenerate beta index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
+            exit 1
+          fi
+          rm -rf /tmp/bread-ecosystem-ci
+          # --branch dev: the TRACK-aware gen-index.sh isn't merged to
+          # bread-ecosystem's main yet.
+          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
+          TRACK=beta bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
new file mode 100644
index 0000000..ad91274
--- /dev/null
+++ b/.forgejo/workflows/dev-release.yml
@@ -0,0 +1,69 @@
+name: dev release
+
+# Publishes a dev-track build on every push to `dev` —
+# separate from release.yml's tag-triggered stable releases. See
+# bread-ecosystem's docs/release-channels.md for the three-track policy
+# this is part of.
+on:
+  push:
+    branches: ['dev']
+
+jobs:
+  build:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch dev --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: build
+        run: cd src && cargo build --release --locked --workspace --features full
+
+      - name: test
+        run: cd src && cargo test --release --locked --workspace --features full
+
+      - name: compute dev version
+        run: |
+          set -euo pipefail
+          cd src
+          CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
+          IFS='.' read -r MA MI PA <<< "${CUR}"
+          SHA="$(git rev-parse --short HEAD)"
+          TS="$(date -u +%Y%m%d%H%M%S)"
+          echo "VERSION=${MA}.${MI}.$((PA + 1))-dev.${TS}+${SHA}" >> "$GITHUB_ENV"
+
+      - name: prepare artifacts
+        run: |
+          set -euo pipefail
+          PKG_DIR="/srv/breadway-dl/dev/breadsearch/${VERSION}"
+          mkdir -p "${PKG_DIR}"
+          for bin in breadsearch breadmill; do
+            cp "src/target/release/${bin}" "${PKG_DIR}/${bin}-x86_64"
+            strip "${PKG_DIR}/${bin}-x86_64"
+            sha256sum "${PKG_DIR}/${bin}-x86_64" | awk '{print $1}' \
+              > "${PKG_DIR}/${bin}-x86_64.sha256"
+          done
+          cp src/packaging/breadmill.service "${PKG_DIR}/"
+          cp src/config.example.toml "${PKG_DIR}/"
+          cp src/bakery.toml "${PKG_DIR}/bakery.toml"
+          ln -sfn "${VERSION}" "/srv/breadway-dl/dev/breadsearch/latest"
+
+      # No GitHub Release upload — dev, like the other non-stable track,
+      # is only distributed via dl.breadway.dev/dev/.
+      - name: regenerate dev index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
+        run: |
+          set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
+            exit 1
+          fi
+          rm -rf /tmp/bread-ecosystem-ci
+          # --branch dev: the TRACK-aware gen-index.sh isn't merged to
+          # bread-ecosystem's main yet.
+          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
+          TRACK=dev bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh

From bf711f8047a9a26c15f65369107539e79c94db42 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 10:10:16 +0800
Subject: [PATCH 03/26] ci: retrigger dev-track build now that
 BAKERY_MINISIGN_SEC_KEY_PATH is set


From 1e3872124b1d27ac412ad1126fb2acacf8092380 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 10:24:44 +0800
Subject: [PATCH 04/26] ci: use a unique temp dir for the bread-ecosystem clone
 in dev/beta CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fixed /tmp/bread-ecosystem-ci path races when multiple repos' dev/beta
workflows run close together on the same self-hosted runner — one job's
rm -rf/clone can stomp another's in-progress checkout, causing the
regenerate-index step to fail intermittently. Switch to mktemp -d.
---
 .forgejo/workflows/beta-release.yml | 12 +++++++-----
 .forgejo/workflows/dev-release.yml  | 14 ++++++++------
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml
index fccc4e0..e0870c2 100644
--- a/.forgejo/workflows/beta-release.yml
+++ b/.forgejo/workflows/beta-release.yml
@@ -53,8 +53,10 @@ jobs:
             echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate beta index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the beta track)"
             exit 1
           fi
-          rm -rf /tmp/bread-ecosystem-ci
-          # --branch dev: the TRACK-aware gen-index.sh isn't merged to
-          # bread-ecosystem's main yet.
-          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
-          TRACK=beta bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+          rm -rf /tmp/bread-ecosystem-ci-* 2>/dev/null || true
+          # mktemp: a fixed clone path races when multiple repos' dev/beta
+          # workflows run close together on the same self-hosted runner.
+          ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
+          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
+          TRACK=beta bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
+          rm -rf "${ECOSYSTEM_CI_DIR}"
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index ad91274..4c143bc 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -29,7 +29,7 @@ jobs:
         run: |
           set -euo pipefail
           cd src
-          CUR="$(grep -m1 '^version' Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
+          CUR="$(grep -m1 '^version' breadsearch/Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
           IFS='.' read -r MA MI PA <<< "${CUR}"
           SHA="$(git rev-parse --short HEAD)"
           TS="$(date -u +%Y%m%d%H%M%S)"
@@ -62,8 +62,10 @@ jobs:
             echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate dev index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone on the dev track)"
             exit 1
           fi
-          rm -rf /tmp/bread-ecosystem-ci
-          # --branch dev: the TRACK-aware gen-index.sh isn't merged to
-          # bread-ecosystem's main yet.
-          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
-          TRACK=dev bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+          rm -rf /tmp/bread-ecosystem-ci-* 2>/dev/null || true
+          # mktemp: a fixed clone path races when multiple repos' dev/beta
+          # workflows run close together on the same self-hosted runner.
+          ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
+          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
+          TRACK=dev bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
+          rm -rf "${ECOSYSTEM_CI_DIR}"

From dabd110f9208a2ae3f95787a4b76e9fe1ec28629 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 11:57:04 +0800
Subject: [PATCH 05/26] random commit message, read it yourself

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 36f7f5b..8d2803a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,6 @@ logs/
 # Runtime files
 *.sock
 *.pid
+
+# Local hygiene notes (not for commit)
+CLAUDE.md

From 19087b0168105b7a5dff7bdf631b5e06d0b4d692 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 13:52:44 +0800
Subject: [PATCH 06/26] ci: base dev version on the latest published tag, not
 Cargo.toml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cargo.toml can drift stale relative to the actual last release (observed
on breadbox/breadpad/breadcrumbs/breadpaper), which made the auto-bumped
dev version sort as OLDER than what's already installed — bakery's semver
check correctly refused those "updates". Deriving the base version from
git ls-remote --tags instead is self-healing regardless of Cargo.toml
drift, with a Cargo.toml fallback only for a repo with no tags yet.
---
 .forgejo/workflows/dev-release.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index 4c143bc..7a1ae2c 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -29,7 +29,19 @@ jobs:
         run: |
           set -euo pipefail
           cd src
-          CUR="$(grep -m1 '^version' breadsearch/Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
+          # Base the dev version off the latest published stable tag,
+          # not Cargo.toml — Cargo.toml can go stale relative to the last
+          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
+          # breadpaper), which would make a dev build sort as OLDER than
+          # what's already installed and bakery would correctly refuse it.
+          LATEST_TAG="$(git ls-remote --tags --refs \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
+            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
+          if [ -n "${LATEST_TAG}" ]; then
+            CUR="${LATEST_TAG}"
+          else
+            CUR="$(grep -m1 '^version' breadsearch/Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
+          fi
           IFS='.' read -r MA MI PA <<< "${CUR}"
           SHA="$(git rev-parse --short HEAD)"
           TS="$(date -u +%Y%m%d%H%M%S)"

From 1f9707f30a146b1989df22fcf05b6c5a4c9ed651 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 18:37:43 +0800
Subject: [PATCH 07/26] ci: make beta a branch-triggered freeze track, not a
 one-off tag

Beta is now a real stabilization branch: publishes on every push to
`beta` (mirroring dev's model, auto-versioned X.Y.Z-beta.<ts>+<sha>,
base version from the latest published tag) instead of a manual
beta-v* tag. Fixes made during the freeze land via fix/<issue> branches
merged into `beta` directly. The gen-index.sh clone for beta pulls
bread-ecosystem's default branch (main) rather than pinning to dev,
since beta is the more stable track and main now carries the
TRACK-aware script.
---
 .forgejo/workflows/beta-release.yml | 41 ++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 10 deletions(-)

diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/beta-release.yml
index e0870c2..43c2fb4 100644
--- a/.forgejo/workflows/beta-release.yml
+++ b/.forgejo/workflows/beta-release.yml
@@ -1,12 +1,12 @@
 name: beta release
 
-# Publishes a beta-track build when a `beta-v*` tag is pushed —
-# separate from release.yml's tag-triggered stable releases. See
-# bread-ecosystem's docs/release-channels.md for the three-track policy
-# this is part of.
+# Publishes a beta-track build on every push to `beta` — a frozen
+# stabilization branch cut from `dev` when ready to stabilize; only
+# fix/<issue> branches merged into `beta` should land here afterward.
+# See bread-ecosystem's docs/release-channels.md for the three-track policy.
 on:
   push:
-    tags: ['beta-v*']
+    branches: ['beta']
 
 jobs:
   build:
@@ -16,7 +16,7 @@ jobs:
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+          git clone --branch beta --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -25,10 +25,31 @@ jobs:
       - name: test
         run: cd src && cargo test --release --locked --workspace --features full
 
+      - name: compute beta version
+        run: |
+          set -euo pipefail
+          cd src
+          # Base the beta version off the latest published stable tag,
+          # not Cargo.toml — Cargo.toml can go stale relative to the last
+          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
+          # breadpaper), which would make a beta build sort as OLDER than
+          # what's already installed and bakery would correctly refuse it.
+          LATEST_TAG="$(git ls-remote --tags --refs \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
+            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
+          if [ -n "${LATEST_TAG}" ]; then
+            CUR="${LATEST_TAG}"
+          else
+            CUR="$(grep -m1 '^version' breadsearch/Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
+          fi
+          IFS='.' read -r MA MI PA <<< "${CUR}"
+          SHA="$(git rev-parse --short HEAD)"
+          TS="$(date -u +%Y%m%d%H%M%S)"
+          echo "VERSION=${MA}.${MI}.$((PA + 1))-beta.${TS}+${SHA}" >> "$GITHUB_ENV"
+
       - name: prepare artifacts
         run: |
           set -euo pipefail
-          VERSION="${GITHUB_REF_NAME#beta-v}"
           PKG_DIR="/srv/breadway-dl/beta/breadsearch/${VERSION}"
           mkdir -p "${PKG_DIR}"
           for bin in breadsearch breadmill; do
@@ -42,8 +63,8 @@ jobs:
           cp src/bakery.toml "${PKG_DIR}/bakery.toml"
           ln -sfn "${VERSION}" "/srv/breadway-dl/beta/breadsearch/latest"
 
-      # No GitHub Release upload — beta, like the other non-stable track,
-      # is only distributed via dl.breadway.dev/beta/.
+      # No GitHub Release upload — beta, like dev, is only distributed via
+      # dl.breadway.dev/beta/.
       - name: regenerate beta index.json
         env:
           MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
@@ -57,6 +78,6 @@ jobs:
           # mktemp: a fixed clone path races when multiple repos' dev/beta
           # workflows run close together on the same self-hosted runner.
           ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
-          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
+          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
           TRACK=beta bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
           rm -rf "${ECOSYSTEM_CI_DIR}"

From 08717e51c0dbcfa256ad30a6c30909857083cdf7 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 22 Jul 2026 19:41:42 +0800
Subject: [PATCH 08/26] docs: add CONTRIBUTING.md

Documents the dev/beta/main branch and release-track workflow shared
across the bread ecosystem. See bread-ecosystem's docs/release-channels.md
for the full policy this implements.
---
 CONTRIBUTING.md | 90 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..deebcfe
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,90 @@
+# Contributing
+
+`breadsearch` — Semantic system-wide search for BOS.
+
+Part of the bread ecosystem; this repo follows the same branch/release
+workflow as every other ecosystem product.
+
+## Branches
+
+- **`main`** — release branch, always tag-ready. Nothing is committed to it
+  directly; it only moves forward via a `beta` merge (see below).
+- **`dev`** — integration branch. All day-to-day work lands here first.
+  Every push to `dev` automatically builds and publishes a **dev-track**
+  build (see Tracks below) — use this to test your change in a real install
+  before it goes any further.
+- **`beta`** — a frozen stabilization branch, cut from `dev` periodically.
+  Every push to `beta` automatically builds and publishes a **beta-track**
+  build. While a freeze is active, only fixes for issues found *in that
+  freeze* should land on `beta`.
+
+New work — features and bug fixes alike — goes on a short-lived branch:
+
+```
+feature/<short-name>
+fix/<issue-number-or-short-name>
+```
+
+Branch off `dev`, open a PR/push back into `dev` when ready. If you're fixing
+something reported against an active `beta` freeze, branch off `beta`
+instead, merge the fix there to unblock testers, and also forward the same
+fix into `dev` so it doesn't quietly reappear next cycle.
+
+## The release cycle
+
+1. Work accumulates on `dev` via `feature/x` / `fix/x` branches. Each push
+   auto-publishes a dev build — install it with `bakery track set dev` and
+   `bakery update --all`, then report or fix anything broken with another
+   push to `dev`.
+2. Once `dev` has gone roughly **a week** without new issues, `beta` is cut
+   fresh from `dev`'s current tip. This freezes it as the stabilization
+   target — `dev` keeps moving independently starting the next cycle.
+3. `beta` is open for anyone to test: `bakery track set beta` and
+   `bakery update --all`. **File issues against anything you find on this
+   repo's Forgejo issue tracker.** Fixes land via `fix/<issue>` branches
+   merged into `beta`.
+4. Once `beta` has gone roughly **a month** without new issues, it's merged
+   into `main` and tagged `vX.Y.Z` — that tag is what actually triggers the
+   stable release build. `beta` is then reset from `dev` to start the next
+   cycle.
+
+## Tracks, from a user's perspective
+
+```
+bakery track show              # what you're currently on (defaults to stable)
+bakery track set dev           # or beta, or stable
+bakery update --all            # pull the latest build on your current track
+```
+
+| Track  | What it is | Published from |
+|--------|-----------|-----------------|
+| `stable` | The last tagged release | `main`, on a `vX.Y.Z` tag push |
+| `beta` | Current stabilization freeze | `beta`, on every push |
+| `dev` | Bleeding edge | `dev`, on every push |
+
+Dev/beta versions are auto-computed (`X.Y.Z-dev.<timestamp>+<sha>` /
+`-beta.…`) from the latest published stable tag, so they always sort as
+newer than what you have installed — no manual version bumping needed when
+pushing to `dev` or `beta`.
+
+## Local development
+
+```sh
+cargo build --release --workspace --features full
+cargo test --release --workspace --features full
+```
+
+## CI
+
+- `dev-release.yml` — triggered on push to `dev`.
+- `beta-release.yml` — triggered on push to `beta`.
+- `release.yml` — triggered on a `v*` tag push, cuts the actual stable release.
+
+All CI runs on a self-hosted runner; nothing runs automatically on plain
+commits or PRs beyond the track builds above. See
+[bread-ecosystem's docs/release-channels.md](https://git.breadway.dev/Breadway/bread-ecosystem/src/branch/main/docs/release-channels.md)
+for the full policy, including how a new product gets wired onto these tracks.
+
+## Questions
+
+Open an issue on this repo's Forgejo tracker.

From 5098780f5b7501437ad179905e5700868d3cb72e Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 29 Jul 2026 11:40:23 +0800
Subject: [PATCH 09/26] breadsearch: add --screenshot CLI mode for automated
 capture
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Same pattern as breadbox/breadclip: one view ("search"), full known-size
canvas capture since the search panel isn't its own layer surface. Also
fixes the same PID-file-toggle footgun — a screenshot run now skips
toggle_or_continue() entirely instead of killing whatever real instance
holds breadsearch.pid.
---
 Cargo.lock                    | 107 +++++++++++++++++++++++++++++++++-
 breadsearch/Cargo.toml        |   4 ++
 breadsearch/src/main.rs       |  42 ++++++++++---
 breadsearch/src/screenshot.rs |  94 +++++++++++++++++++++++++++++
 4 files changed, 239 insertions(+), 8 deletions(-)
 create mode 100644 breadsearch/src/screenshot.rs

diff --git a/Cargo.lock b/Cargo.lock
index 49e20a5..ad06819 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -51,12 +51,56 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
 [[package]]
 name = "anstyle"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.103"
@@ -141,7 +185,7 @@ version = "0.3.0"
 source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.3.0#8e82d2d833e992ce939a5b836f910ee109f2e939"
 dependencies = [
  "anyhow",
- "bread-utils",
+ "bread-utils 0.3.0",
  "hex",
  "ort",
  "sha2 0.10.9",
@@ -150,6 +194,16 @@ dependencies = [
  "ureq 2.12.1",
 ]
 
+[[package]]
+name = "bread-screenshots"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=dev#1a3475bd2358202f60e29c9bd27d06b1428b1a27"
+dependencies = [
+ "anyhow",
+ "bread-utils 0.3.1",
+ "tracing",
+]
+
 [[package]]
 name = "bread-theme"
 version = "0.2.3"
@@ -171,6 +225,16 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "bread-utils"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=dev#1a3475bd2358202f60e29c9bd27d06b1428b1a27"
+dependencies = [
+ "dirs",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "breadmill"
 version = "0.3.0"
@@ -198,8 +262,11 @@ dependencies = [
 name = "breadsearch"
 version = "0.3.0"
 dependencies = [
+ "anyhow",
+ "bread-screenshots",
  "bread-theme",
  "breadsearch-shared",
+ "clap",
  "gtk4",
  "gtk4-layer-shell",
  "serde_json",
@@ -364,6 +431,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
+ "clap_derive",
 ]
 
 [[package]]
@@ -372,11 +440,24 @@ version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
+ "anstream",
  "anstyle",
  "clap_lex",
  "strsim",
 ]
 
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "clap_lex"
 version = "1.1.0"
@@ -394,6 +475,12 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
 [[package]]
 name = "compact_str"
 version = "0.9.1"
@@ -1612,6 +1699,12 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itertools"
 version = "0.14.0"
@@ -2034,6 +2127,12 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "onig"
 version = "6.5.3"
@@ -3313,6 +3412,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 241457f..c661de3 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -11,6 +11,10 @@ path = "src/main.rs"
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
 bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.10", features = ["gtk"] }
+# Capture primitives for `--screenshot` mode — see src/screenshot.rs.
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", branch = "dev" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"
+clap = { version = "4", features = ["derive"] }
+anyhow = "1"
diff --git a/breadsearch/src/main.rs b/breadsearch/src/main.rs
index a9812fe..146dd46 100644
--- a/breadsearch/src/main.rs
+++ b/breadsearch/src/main.rs
@@ -18,6 +18,8 @@ use gtk4::{
 };
 use gtk4_layer_shell::{Edge, KeyboardMode, Layer, LayerShell};
 
+mod screenshot;
+
 // ---- Theming ----------------------------------------------------------------
 
 fn build_css(p: &Palette) -> String {
@@ -208,10 +210,17 @@ fn open_folder(path: &str) {
 
 // ---- UI ---------------------------------------------------------------------
 
-fn run_ui() {
-    let app = Application::builder()
-        .application_id("com.breadway.breadsearch")
-        .build();
+fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
+    let mut builder = Application::builder().application_id("com.breadway.breadsearch");
+    if screenshot_req.is_some() {
+        // GApplication is single-instance by default; this machine typically
+        // already has a real breadsearch instance, so without this a
+        // screenshot run would just message the *existing* instance instead
+        // of starting a fresh one that ever sees `screenshot_req`.
+        builder = builder.flags(gtk4::gio::ApplicationFlags::NON_UNIQUE);
+    }
+    let app = builder.build();
+    let is_screenshot_run = screenshot_req.is_some();
 
     let debounce_id: Rc<RefCell<Option<glib::SourceId>>> = Rc::new(RefCell::new(None));
 
@@ -419,18 +428,37 @@ fn run_ui() {
         window.add_controller(outside_click);
 
         window.connect_destroy(|_| cleanup_pid());
+
+        if let Some(req) = screenshot_req.clone() {
+            screenshot::dispatch(&window, req);
+        }
+
         window.present();
         search.grab_focus();
     });
 
-    app.run();
+    if is_screenshot_run {
+        // GLib's own option parser otherwise rejects --screenshot/--output
+        // before clap ever sees them (`Cli::parse()` already ran in `main`,
+        // over the real argv).
+        app.run_with_args(&[] as &[&str]);
+    } else {
+        app.run();
+    }
 }
 
 // ---- Main -------------------------------------------------------------------
 
 fn main() {
-    if !toggle_or_continue() {
+    use clap::Parser;
+    let cli = screenshot::Cli::parse();
+    let screenshot_req = cli.screenshot_request();
+
+    // The PID-file toggle kills whatever's holding the file — a real,
+    // already-running breadsearch instance included. A screenshot run must
+    // never touch it: it's a separate, disposable instance by design.
+    if screenshot_req.is_none() && !toggle_or_continue() {
         return;
     }
-    run_ui();
+    run_ui(screenshot_req);
 }
diff --git a/breadsearch/src/screenshot.rs b/breadsearch/src/screenshot.rs
new file mode 100644
index 0000000..4373fb3
--- /dev/null
+++ b/breadsearch/src/screenshot.rs
@@ -0,0 +1,94 @@
+//! `--screenshot` CLI mode: render breadsearch's search panel, capture it
+//! via `bread-screenshots`, then exit — driven by `bread-ecosystem`'s
+//! `bread-capture` orchestrator, or run standalone for one-off captures.
+//!
+//! Same reasoning as breadbox: one view ("search"), full known-size canvas
+//! capture since the panel isn't its own layer surface. Captures whatever
+//! the panel shows at settle time — normally the "Type to search…" empty
+//! state, since there's no query to type in an automated run.
+
+use clap::Parser;
+use gtk4::prelude::*;
+use std::path::PathBuf;
+use std::time::Duration;
+
+/// Extra settle time after `map` for the first frame to actually paint
+/// before grim runs — `map` fires once the surface exists, not once
+/// anything has been drawn into it.
+const SETTLE_DELAY: Duration = Duration::from_millis(300);
+
+#[derive(Parser)]
+#[command(name = "breadsearch")]
+pub struct Cli {
+    /// Render the named view, capture it, then exit instead of running
+    /// normally. Known views: "search".
+    #[arg(long)]
+    pub screenshot: Option<String>,
+
+    /// PNG path to write the capture to. Required together with --screenshot.
+    #[arg(long)]
+    pub output: Option<PathBuf>,
+
+    /// Capture canvas width — matches the isolated compositor's output width
+    /// (`bread-capture --isolate-width`).
+    #[arg(long, default_value_t = 1920)]
+    pub width: u32,
+
+    /// Capture canvas height — see `width`.
+    #[arg(long, default_value_t = 1080)]
+    pub height: u32,
+}
+
+#[derive(Clone)]
+pub struct ScreenshotRequest {
+    pub view: String,
+    pub output: PathBuf,
+    pub width: u32,
+    pub height: u32,
+}
+
+impl Cli {
+    /// `None` for a normal run. Exits the process with an error if
+    /// `--screenshot` was given without `--output`, before any GTK setup
+    /// happens.
+    pub fn screenshot_request(&self) -> Option<ScreenshotRequest> {
+        let view = self.screenshot.clone()?;
+        let Some(output) = self.output.clone() else {
+            eprintln!("breadsearch: --screenshot requires --output");
+            std::process::exit(1);
+        };
+        Some(ScreenshotRequest { view, output, width: self.width, height: self.height })
+    }
+}
+
+/// Wire up the given view's screenshot sequence against an already-built,
+/// not-yet-presented window. Every path here ends by exiting the process —
+/// it never returns control to the normal search UI.
+pub fn dispatch(window: &gtk4::ApplicationWindow, req: ScreenshotRequest) {
+    match req.view.as_str() {
+        "search" => {
+            let output = req.output;
+            let (width, height) = (req.width as i32, req.height as i32);
+            window.connect_map(move |_| {
+                let output = output.clone();
+                gtk4::glib::timeout_add_local_once(SETTLE_DELAY, move || {
+                    finish(bread_screenshots::capture_region(0, 0, width, height, &output));
+                });
+            });
+        }
+        other => {
+            eprintln!("breadsearch: unknown screenshot view '{other}' (known: search)");
+            std::process::exit(1);
+        }
+    }
+}
+
+fn finish(result: anyhow::Result<()>) {
+    match result {
+        Ok(()) => std::process::exit(0),
+        Err(e) => {
+            eprintln!("breadsearch: screenshot capture failed: {e}");
+            std::process::exit(1);
+        }
+    }
+}

From 8c11bfd3b8748d1c7f23a76d0292e01a600540e8 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Fri, 31 Jul 2026 11:05:29 +0800
Subject: [PATCH 10/26] =?UTF-8?q?CI:=20single-trunk=20model=20=E2=80=94=20?=
 =?UTF-8?q?dev=20triggers=20on=20main,=20beta=20becomes=20RC-tag-triggered?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the dev/beta branch split with one trunk (main): dev-track
builds still publish on every push, but the beta track now publishes
from a vX.Y.Z-rc.N prerelease tag instead of a separately-maintained
beta branch. Removes the branch nobody reliably kept in sync.
---
 .forgejo/workflows/dev-release.yml            | 15 ++++----
 .../{beta-release.yml => rc-release.yml}      | 38 +++++--------------
 .forgejo/workflows/release.yml                |  1 +
 3 files changed, 17 insertions(+), 37 deletions(-)
 rename .forgejo/workflows/{beta-release.yml => rc-release.yml} (60%)

diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index 7a1ae2c..aa80a71 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -1,12 +1,11 @@
 name: dev release
 
-# Publishes a dev-track build on every push to `dev` —
-# separate from release.yml's tag-triggered stable releases. See
-# bread-ecosystem's docs/release-channels.md for the three-track policy
-# this is part of.
+# Publishes a dev-track build on every push to `main` (the trunk
+# branch — there is no separate `dev` branch). See bread-ecosystem's
+# docs/release-channels.md for the release-track policy this is part of.
 on:
   push:
-    branches: ['dev']
+    branches: ['main']
 
 jobs:
   build:
@@ -16,7 +15,7 @@ jobs:
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch dev --depth 1 \
+          git clone --branch main --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -36,7 +35,7 @@ jobs:
           # what's already installed and bakery would correctly refuse it.
           LATEST_TAG="$(git ls-remote --tags --refs \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
+            | awk -F/ '{print $NF}' | sed 's/^v//' | (grep -v -- '-' || true) | sort -V | tail -1)"
           if [ -n "${LATEST_TAG}" ]; then
             CUR="${LATEST_TAG}"
           else
@@ -78,6 +77,6 @@ jobs:
           # mktemp: a fixed clone path races when multiple repos' dev/beta
           # workflows run close together on the same self-hosted runner.
           ECOSYSTEM_CI_DIR="$(mktemp -d /tmp/bread-ecosystem-ci-XXXXXX)"
-          git clone --branch dev https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
+          git clone --branch main https://git.breadway.dev/Breadway/bread-ecosystem.git "${ECOSYSTEM_CI_DIR}"
           TRACK=dev bash "${ECOSYSTEM_CI_DIR}/scripts/gen-index.sh"
           rm -rf "${ECOSYSTEM_CI_DIR}"
diff --git a/.forgejo/workflows/beta-release.yml b/.forgejo/workflows/rc-release.yml
similarity index 60%
rename from .forgejo/workflows/beta-release.yml
rename to .forgejo/workflows/rc-release.yml
index 43c2fb4..1a9385f 100644
--- a/.forgejo/workflows/beta-release.yml
+++ b/.forgejo/workflows/rc-release.yml
@@ -1,22 +1,23 @@
-name: beta release
+name: beta (rc) release
 
-# Publishes a beta-track build on every push to `beta` — a frozen
-# stabilization branch cut from `dev` when ready to stabilize; only
-# fix/<issue> branches merged into `beta` should land here afterward.
-# See bread-ecosystem's docs/release-channels.md for the three-track policy.
+# Publishes a beta-track build for any `vX.Y.Z-rc.N` prerelease tag
+# pushed to `main` — there is no separate `beta` branch; "freezing" is
+# just pausing pushes to main while an RC gets tested. See
+# bread-ecosystem's docs/release-channels.md for the release-track policy.
 on:
   push:
-    branches: ['beta']
+    tags: ['v*']
 
 jobs:
   build:
+    if: ${{ contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout
         run: |
           set -euo pipefail
           rm -rf src && mkdir src
-          git clone --branch beta --depth 1 \
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
@@ -25,31 +26,10 @@ jobs:
       - name: test
         run: cd src && cargo test --release --locked --workspace --features full
 
-      - name: compute beta version
-        run: |
-          set -euo pipefail
-          cd src
-          # Base the beta version off the latest published stable tag,
-          # not Cargo.toml — Cargo.toml can go stale relative to the last
-          # real release (seen in practice: breadbox/breadpad/breadcrumbs/
-          # breadpaper), which would make a beta build sort as OLDER than
-          # what's already installed and bakery would correctly refuse it.
-          LATEST_TAG="$(git ls-remote --tags --refs \
-            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" 'v*' \
-            | awk -F/ '{print $NF}' | sed 's/^v//' | sort -V | tail -1)"
-          if [ -n "${LATEST_TAG}" ]; then
-            CUR="${LATEST_TAG}"
-          else
-            CUR="$(grep -m1 '^version' breadsearch/Cargo.toml | sed -E 's/.*"(.*)".*/\1/')"
-          fi
-          IFS='.' read -r MA MI PA <<< "${CUR}"
-          SHA="$(git rev-parse --short HEAD)"
-          TS="$(date -u +%Y%m%d%H%M%S)"
-          echo "VERSION=${MA}.${MI}.$((PA + 1))-beta.${TS}+${SHA}" >> "$GITHUB_ENV"
-
       - name: prepare artifacts
         run: |
           set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
           PKG_DIR="/srv/breadway-dl/beta/breadsearch/${VERSION}"
           mkdir -p "${PKG_DIR}"
           for bin in breadsearch breadmill; do
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index e53b875..54298b4 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -6,6 +6,7 @@ on:
 
 jobs:
   build:
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     steps:
       - name: checkout

From 4cb254801f07f9018a9f916eb54c5bd725cdae07 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Fri, 31 Jul 2026 11:08:41 +0800
Subject: [PATCH 11/26] CONTRIBUTING.md: document single-trunk + RC-tag release
 model

---
 CONTRIBUTING.md | 70 ++++++++++++++++++++++---------------------------
 1 file changed, 32 insertions(+), 38 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index deebcfe..529208f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -7,16 +7,10 @@ workflow as every other ecosystem product.
 
 ## Branches
 
-- **`main`** — release branch, always tag-ready. Nothing is committed to it
-  directly; it only moves forward via a `beta` merge (see below).
-- **`dev`** — integration branch. All day-to-day work lands here first.
-  Every push to `dev` automatically builds and publishes a **dev-track**
-  build (see Tracks below) — use this to test your change in a real install
-  before it goes any further.
-- **`beta`** — a frozen stabilization branch, cut from `dev` periodically.
-  Every push to `beta` automatically builds and publishes a **beta-track**
-  build. While a freeze is active, only fixes for issues found *in that
-  freeze* should land on `beta`.
+There is one long-lived branch: **`main`**. All day-to-day work lands here.
+Every push to `main` automatically builds and publishes a **dev-track**
+build (see Tracks below) — a real install you can test before cutting
+anything more formal.
 
 New work — features and bug fixes alike — goes on a short-lived branch:
 
@@ -25,28 +19,26 @@ feature/<short-name>
 fix/<issue-number-or-short-name>
 ```
 
-Branch off `dev`, open a PR/push back into `dev` when ready. If you're fixing
-something reported against an active `beta` freeze, branch off `beta`
-instead, merge the fix there to unblock testers, and also forward the same
-fix into `dev` so it doesn't quietly reappear next cycle.
+Branch off `main`, open a PR/push back into `main` when ready. Short-lived
+branches get deleted on merge — they never accumulate the kind of drift a
+second long-lived branch does.
 
 ## The release cycle
 
-1. Work accumulates on `dev` via `feature/x` / `fix/x` branches. Each push
+There's no separate `beta` or release branch — "stable" and "beta" are both
+just **tags** on `main`, not branches that need to be kept in sync:
+
+1. Work accumulates on `main` via `feature/x` / `fix/x` branches. Each push
    auto-publishes a dev build — install it with `bakery track set dev` and
-   `bakery update --all`, then report or fix anything broken with another
-   push to `dev`.
-2. Once `dev` has gone roughly **a week** without new issues, `beta` is cut
-   fresh from `dev`'s current tip. This freezes it as the stabilization
-   target — `dev` keeps moving independently starting the next cycle.
-3. `beta` is open for anyone to test: `bakery track set beta` and
-   `bakery update --all`. **File issues against anything you find on this
-   repo's Forgejo issue tracker.** Fixes land via `fix/<issue>` branches
-   merged into `beta`.
-4. Once `beta` has gone roughly **a month** without new issues, it's merged
-   into `main` and tagged `vX.Y.Z` — that tag is what actually triggers the
-   stable release build. `beta` is then reset from `dev` to start the next
-   cycle.
+   `bakery update --all`, then fix anything broken with another push.
+2. When you want to stabilize before a real release, tag a release
+   candidate: `git tag vX.Y.Z-rc.1 && git push origin vX.Y.Z-rc.1` (push to
+   both remotes). That tag alone triggers a beta-track build —
+   "freezing" is just pausing pushes to `main` while you test it, not a
+   branch operation. Cut `-rc.2`, `-rc.3`, etc. for further fixes.
+3. Once an RC has gone without issues, tag the real release:
+   `git tag vX.Y.Z && git push origin vX.Y.Z` — that's what triggers the
+   signed stable release build.
 
 ## Tracks, from a user's perspective
 
@@ -58,14 +50,15 @@ bakery update --all            # pull the latest build on your current track
 
 | Track  | What it is | Published from |
 |--------|-----------|-----------------|
-| `stable` | The last tagged release | `main`, on a `vX.Y.Z` tag push |
-| `beta` | Current stabilization freeze | `beta`, on every push |
-| `dev` | Bleeding edge | `dev`, on every push |
+| `stable` | The last tagged release | a `vX.Y.Z` tag |
+| `beta` | Latest release candidate | a `vX.Y.Z-rc.N` tag |
+| `dev` | Bleeding edge | `main`, on every push |
 
-Dev/beta versions are auto-computed (`X.Y.Z-dev.<timestamp>+<sha>` /
-`-beta.…`) from the latest published stable tag, so they always sort as
-newer than what you have installed — no manual version bumping needed when
-pushing to `dev` or `beta`.
+Dev versions are auto-computed (`X.Y.Z-dev.<timestamp>+<sha>`) from the
+latest published stable tag, so they always sort as newer than what you
+have installed — no manual version bumping needed. Beta versions are just
+the RC tag itself (already valid semver, already sorts below the real
+release it's a candidate for).
 
 ## Local development
 
@@ -76,9 +69,10 @@ cargo test --release --workspace --features full
 
 ## CI
 
-- `dev-release.yml` — triggered on push to `dev`.
-- `beta-release.yml` — triggered on push to `beta`.
-- `release.yml` — triggered on a `v*` tag push, cuts the actual stable release.
+- `dev-release.yml` — triggered on push to `main`.
+- `rc-release.yml` — triggered on any `vX.Y.Z-rc.N` tag push.
+- `release.yml` — triggered on any other `v*` tag push, cuts the actual
+  stable release.
 
 All CI runs on a self-hosted runner; nothing runs automatically on plain
 commits or PRs beyond the track builds above. See

From 065f10658441cdf5ef1680e334616ff8999fc34e Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Fri, 31 Jul 2026 14:30:01 +0800
Subject: [PATCH 12/26] Repoint bread-ecosystem git deps from dev to main
 branch

---
 Cargo.lock             | 4 ++--
 breadsearch/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ad06819..0e1c309 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -197,7 +197,7 @@ dependencies = [
 [[package]]
 name = "bread-screenshots"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=dev#1a3475bd2358202f60e29c9bd27d06b1428b1a27"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "anyhow",
  "bread-utils 0.3.1",
@@ -228,7 +228,7 @@ dependencies = [
 [[package]]
 name = "bread-utils"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=dev#1a3475bd2358202f60e29c9bd27d06b1428b1a27"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "dirs",
  "serde",
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index c661de3..3f31d22 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -12,7 +12,7 @@ path = "src/main.rs"
 breadsearch-shared = { path = "../breadsearch-shared" }
 bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.10", features = ["gtk"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
-bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", branch = "dev" }
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", branch = "main" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"

From 572aebd2825cbe475ff6c6562c5a220250355111 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 21:40:06 +0800
Subject: [PATCH 13/26] Pin bread-ecosystem crates to v0.7.1 and document
 single-trunk + overlay split

bread-theme and bread-onnx now come from git.breadway.dev tag v0.7.1
(gtk feature on theme). bread-screenshots is not on that tag, so it is
pinned to rev f86e299 instead of branch=main. CLAUDE.md tracks the
single-trunk release model; README states breadsearch is document/meaning
search and is not breadbox's app-launcher overlay.
---
 .gitignore             |  3 ---
 CLAUDE.md              | 50 ++++++++++++++++++++++++++++++++++++++++++
 Cargo.lock             | 20 ++++++++---------
 README.md              |  2 ++
 breadmill/Cargo.toml   |  2 +-
 breadsearch/Cargo.toml |  5 +++--
 6 files changed, 66 insertions(+), 16 deletions(-)
 create mode 100644 CLAUDE.md

diff --git a/.gitignore b/.gitignore
index 8d2803a..36f7f5b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,3 @@ logs/
 # Runtime files
 *.sock
 *.pid
-
-# Local hygiene notes (not for commit)
-CLAUDE.md
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..d0dfa26
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,50 @@
+# CLAUDE.md — Repo hygiene
+
+Scope: this file covers *repo hygiene* — branching, remotes, CI — plus a
+short map of the binaries. It is not user-facing project documentation.
+
+This repo follows the branch/release workflow documented in `CONTRIBUTING.md`
+— read and follow it for any git, branch, or release work here (the
+single-trunk model, `feature/x`/`fix/x` branch naming, how RC tags work,
+etc). Don't improvise a different workflow. The short version: there is one
+long-lived branch, `main` — no `dev` or `beta` branch exists. `main`
+auto-publishes a dev-track build on every push. "Beta" and "stable" are both
+just tags, not branches: push a `vX.Y.Z-rc.N` tag to publish a beta-track
+build, push a plain `vX.Y.Z` tag to cut the signed stable release.
+"Freezing" for stabilization means pausing pushes to `main`, not moving a
+branch. This replaced an earlier three-branch (`dev`/`beta`/`main`) model
+after `main` was found to have silently rotted out of sync with `dev`/`beta`
+across most repos in this ecosystem.
+
+When starting work on a new feature, create branch `feature/<feature-name>`.
+When working on a bug or issue, create branch `fix/<issue you are fixing>`.
+
+## Remotes
+- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative.
+- `github` — GitHub mirror. Push both when publishing.
+
+## CI
+- `dev-release.yml` triggers on `push: branches: ['main']`.
+- `rc-release.yml` triggers on `vX.Y.Z-rc.N` tag pushes (beta track).
+- `release.yml` triggers on any other `v*` tag push (stable).
+  None of these run on plain commits or PRs beyond what's listed.
+
+## Architecture
+
+Two binaries + a shared lib:
+
+| Crate | Role |
+|---|---|
+| `breadsearch-shared` | XDG paths, config, IPC types, Unix-socket client |
+| `breadmill` | Daemon: walk → extract → chunk → embed → index; serves queries |
+| `breadsearch` | GTK4 layer-shell overlay: ranked document hits from breadmill |
+
+breadsearch is document/meaning search. breadbox is the app launcher. They
+are not the same overlay.
+
+`--screenshot` (`breadsearch/src/screenshot.rs`) captures the search panel
+through `bread-screenshots`; do not rewrite it just to retarget the crate pin.
+
+## Don't
+- Don't embed credentials in remote URLs — SSH or a credential helper only.
+- Don't rewrite `screenshot.rs` as part of pin/docs work.
diff --git a/Cargo.lock b/Cargo.lock
index 0e1c309..e679363 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -181,11 +181,11 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.0"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.3.0#8e82d2d833e992ce939a5b836f910ee109f2e939"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.0",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1)",
  "hex",
  "ort",
  "sha2 0.10.9",
@@ -197,17 +197,17 @@ dependencies = [
 [[package]]
 name = "bread-screenshots"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.1",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e)",
  "tracing",
 ]
 
 [[package]]
 name = "bread-theme"
-version = "0.2.3"
-source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.10#17d1bb85801b9a8c195b64c02d288cd662c9c780"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "dirs",
  "gtk4",
@@ -217,8 +217,8 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.0"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.3.0#8e82d2d833e992ce939a5b836f910ee109f2e939"
+version = "0.3.1"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
  "dirs",
  "serde",
@@ -228,7 +228,7 @@ dependencies = [
 [[package]]
 name = "bread-utils"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?branch=main#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
 dependencies = [
  "dirs",
  "serde",
diff --git a/README.md b/README.md
index af25de7..71663ce 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,8 @@
 
 Semantic document search for Bread OS. Type a concept — not a keyword — and get ranked hits from your documents.
 
+This is **not** [breadbox](https://git.breadway.dev/Breadway/breadbox). breadsearch is document/meaning search over your files; breadbox is the app launcher (fuzzy `.desktop` launch). They are separate overlays with separate binaries, sockets, and keybinds — even though the search panel was originally forked from breadbox's launcher UI.
+
 Two binaries in one Cargo workspace:
 
 - **breadmill** — background daemon. Walks configured directories, extracts text, chunks and embeds documents with [nomic-embed-text-v1.5](https://huggingface.co/nomic-ai/nomic-embed-text-v1.5) (768-dim ONNX), stores vectors in an HNSW index (usearch) backed by SQLite metadata, and serves queries over a Unix socket. Watches for filesystem changes and re-indexes incrementally.
diff --git a/breadmill/Cargo.toml b/breadmill/Cargo.toml
index 9faeae0..bd3a886 100644
--- a/breadmill/Cargo.toml
+++ b/breadmill/Cargo.toml
@@ -42,7 +42,7 @@ breadsearch-shared = { path = "../breadsearch-shared" }
 #   needed for the plain CPU path even in the npu build.
 ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing", "download-binaries", "tls-native", "copy-dylibs", "api-23"] }
 tokenizers = "0"
-bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.3.0" }
+bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1" }
 
 # Surfaces ort's own EP-registration tracing (e.g. a GPU EP silently failing to
 # register and falling back to CPU) as visible log output instead of nowhere.
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 3f31d22..1d2cb0b 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -10,9 +10,10 @@ path = "src/main.rs"
 
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
-bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.10", features = ["gtk"] }
+bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["gtk"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
-bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", branch = "main" }
+# Not on tag v0.7.1 (crate landed after that tag). Rev, not branch=main.
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", rev = "f86e299f4a0ea73ff485cd84923b986ddcc8242e" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"

From 6983fd83daf6a491eb06e9f5022f50cb4b6eba8f Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 22:03:30 +0800
Subject: [PATCH 14/26] Align bread-screenshots rev with siblings; track
 AGENTS.md

---
 AGENTS.md              | 50 ++++++++++++++++++++++++++++++++++++++++++
 Cargo.lock             |  6 ++---
 breadsearch/Cargo.toml |  3 ++-
 3 files changed, 55 insertions(+), 4 deletions(-)
 create mode 100644 AGENTS.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..3c0ac3f
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,50 @@
+# AGENTS.md — Repo hygiene
+
+Scope: this file covers *repo hygiene* — branching, remotes, CI — plus a
+short map of the binaries. It is not user-facing project documentation.
+
+This repo follows the branch/release workflow documented in `CONTRIBUTING.md`
+— read and follow it for any git, branch, or release work here (the
+single-trunk model, `feature/x`/`fix/x` branch naming, how RC tags work,
+etc). Don't improvise a different workflow. The short version: there is one
+long-lived branch, `main` — no `dev` or `beta` branch exists. `main`
+auto-publishes a dev-track build on every push. "Beta" and "stable" are both
+just tags, not branches: push a `vX.Y.Z-rc.N` tag to publish a beta-track
+build, push a plain `vX.Y.Z` tag to cut the signed stable release.
+"Freezing" for stabilization means pausing pushes to `main`, not moving a
+branch. This replaced an earlier three-branch (`dev`/`beta`/`main`) model
+after `main` was found to have silently rotted out of sync with `dev`/`beta`
+across most repos in this ecosystem.
+
+When starting work on a new feature, create branch `feature/<feature-name>`.
+When working on a bug or issue, create branch `fix/<issue you are fixing>`.
+
+## Remotes
+- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative.
+- `github` — GitHub mirror. Push both when publishing.
+
+## CI
+- `dev-release.yml` triggers on `push: branches: ['main']`.
+- `rc-release.yml` triggers on `vX.Y.Z-rc.N` tag pushes (beta track).
+- `release.yml` triggers on any other `v*` tag push (stable).
+  None of these run on plain commits or PRs beyond what's listed.
+
+## Architecture
+
+Two binaries + a shared lib:
+
+| Crate | Role |
+|---|---|
+| `breadsearch-shared` | XDG paths, config, IPC types, Unix-socket client |
+| `breadmill` | Daemon: walk → extract → chunk → embed → index; serves queries |
+| `breadsearch` | GTK4 layer-shell overlay: ranked document hits from breadmill |
+
+breadsearch is document/meaning search. breadbox is the app launcher. They
+are not the same overlay.
+
+`--screenshot` (`breadsearch/src/screenshot.rs`) captures the search panel
+through `bread-screenshots`; do not rewrite it just to retarget the crate pin.
+
+## Don't
+- Don't embed credentials in remote URLs — SSH or a credential helper only.
+- Don't rewrite `screenshot.rs` as part of pin/docs work.
diff --git a/Cargo.lock b/Cargo.lock
index e679363..b911012 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -197,10 +197,10 @@ dependencies = [
 [[package]]
 name = "bread-screenshots"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d#69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e)",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d)",
  "tracing",
 ]
 
@@ -228,7 +228,7 @@ dependencies = [
 [[package]]
 name = "bread-utils"
 version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=f86e299f4a0ea73ff485cd84923b986ddcc8242e#f86e299f4a0ea73ff485cd84923b986ddcc8242e"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d#69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d"
 dependencies = [
  "dirs",
  "serde",
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 1d2cb0b..0d2e114 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -13,7 +13,8 @@ breadsearch-shared = { path = "../breadsearch-shared" }
 bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["gtk"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
 # Not on tag v0.7.1 (crate landed after that tag). Rev, not branch=main.
-bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", rev = "f86e299f4a0ea73ff485cd84923b986ddcc8242e" }
+# v0.7.1 predates this crate; same rev siblings use.
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", rev = "69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"

From 95a97d63d3320a9f1be510857ccb69f320c5beeb Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 22:04:00 +0800
Subject: [PATCH 15/26] Remove CLAUDE.md (renamed to AGENTS.md)

---
 CLAUDE.md | 50 --------------------------------------------------
 1 file changed, 50 deletions(-)
 delete mode 100644 CLAUDE.md

diff --git a/CLAUDE.md b/CLAUDE.md
deleted file mode 100644
index d0dfa26..0000000
--- a/CLAUDE.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# CLAUDE.md — Repo hygiene
-
-Scope: this file covers *repo hygiene* — branching, remotes, CI — plus a
-short map of the binaries. It is not user-facing project documentation.
-
-This repo follows the branch/release workflow documented in `CONTRIBUTING.md`
-— read and follow it for any git, branch, or release work here (the
-single-trunk model, `feature/x`/`fix/x` branch naming, how RC tags work,
-etc). Don't improvise a different workflow. The short version: there is one
-long-lived branch, `main` — no `dev` or `beta` branch exists. `main`
-auto-publishes a dev-track build on every push. "Beta" and "stable" are both
-just tags, not branches: push a `vX.Y.Z-rc.N` tag to publish a beta-track
-build, push a plain `vX.Y.Z` tag to cut the signed stable release.
-"Freezing" for stabilization means pausing pushes to `main`, not moving a
-branch. This replaced an earlier three-branch (`dev`/`beta`/`main`) model
-after `main` was found to have silently rotted out of sync with `dev`/`beta`
-across most repos in this ecosystem.
-
-When starting work on a new feature, create branch `feature/<feature-name>`.
-When working on a bug or issue, create branch `fix/<issue you are fixing>`.
-
-## Remotes
-- `origin` — Forgejo (`git.breadway.dev` via Hestia, SSH) — authoritative.
-- `github` — GitHub mirror. Push both when publishing.
-
-## CI
-- `dev-release.yml` triggers on `push: branches: ['main']`.
-- `rc-release.yml` triggers on `vX.Y.Z-rc.N` tag pushes (beta track).
-- `release.yml` triggers on any other `v*` tag push (stable).
-  None of these run on plain commits or PRs beyond what's listed.
-
-## Architecture
-
-Two binaries + a shared lib:
-
-| Crate | Role |
-|---|---|
-| `breadsearch-shared` | XDG paths, config, IPC types, Unix-socket client |
-| `breadmill` | Daemon: walk → extract → chunk → embed → index; serves queries |
-| `breadsearch` | GTK4 layer-shell overlay: ranked document hits from breadmill |
-
-breadsearch is document/meaning search. breadbox is the app launcher. They
-are not the same overlay.
-
-`--screenshot` (`breadsearch/src/screenshot.rs`) captures the search panel
-through `bread-screenshots`; do not rewrite it just to retarget the crate pin.
-
-## Don't
-- Don't embed credentials in remote URLs — SSH or a credential helper only.
-- Don't rewrite `screenshot.rs` as part of pin/docs work.

From 0e3c8a1668140f332d2b190b38f7f328ec28da84 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 22:14:47 +0800
Subject: [PATCH 16/26] breadsearch: emit bread.search.opened and
 bread.search.opened_result
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wire the GTK overlay to the bread event fabric via bread-utils
BreadClient (app id search). Fail-silent when breadd is down.
No command verbs — the overlay has no existing command surface.
---
 Cargo.lock                      | 13 ++++++++++++
 EVENTS.md                       | 36 +++++++++++++++++++++++++++++++++
 breadsearch/Cargo.toml          |  2 ++
 breadsearch/src/bread_events.rs | 26 ++++++++++++++++++++++++
 breadsearch/src/main.rs         |  4 ++++
 5 files changed, 81 insertions(+)
 create mode 100644 EVENTS.md
 create mode 100644 breadsearch/src/bread_events.rs

diff --git a/Cargo.lock b/Cargo.lock
index b911012..118b7d4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -204,6 +204,17 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "bread-shared"
+version = "0.7.0"
+source = "git+https://git.breadway.dev/Breadway/bread?tag=v0.7.0#22e34e2cf2202305d7960759dfccb54dc79f948b"
+dependencies = [
+ "dirs",
+ "serde",
+ "serde_json",
+ "toml 0.8.23",
+]
+
 [[package]]
 name = "bread-theme"
 version = "0.3.1"
@@ -220,6 +231,7 @@ name = "bread-utils"
 version = "0.3.1"
 source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
 dependencies = [
+ "bread-shared",
  "dirs",
  "serde",
  "serde_json",
@@ -265,6 +277,7 @@ dependencies = [
  "anyhow",
  "bread-screenshots",
  "bread-theme",
+ "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1)",
  "breadsearch-shared",
  "clap",
  "gtk4",
diff --git a/EVENTS.md b/EVENTS.md
new file mode 100644
index 0000000..dbcaa54
--- /dev/null
+++ b/EVENTS.md
@@ -0,0 +1,36 @@
+# breadsearch — bread event integration
+
+breadsearch is a standalone document-search overlay: it works exactly the
+same with or without `breadd` running. When breadd *is* present, the
+`breadsearch` GTK overlay publishes events into the shared bread automation
+fabric. See the parent `bread` repo's `Documentation.md` — specifically its
+"Namespaces" and "Integrating a bread\* app" sections — for the general
+convention this follows.
+
+App id: **`search`**. Transport: `bread-utils`'s `bread_client` module
+(feature `bread-client`) — the overlay links it directly. Each `emit` is
+its own short-lived connection (`BreadClient::emit` is fire-and-forget,
+the same stance as `bread-emit`). breadmill, the indexing daemon, does
+not talk to breadd.
+
+## Events published (`bread.search.*`)
+
+| Event | Data | When |
+|-------|------|------|
+| `bread.search.opened` | `{}` | The overlay window maps (the search panel is shown). |
+| `bread.search.opened_result` | `{ "path": "<hit path>" }` | The user opens a hit — Enter / click opens the file, Ctrl+Enter reveals its folder. `path` is the hit's document path, not the parent folder. |
+
+## Commands honored (`bread.command.search.*`)
+
+None. The overlay is a short-lived toggle process with no existing command
+surface (no show/hide/query IPC beyond the PID-file toggle and breadmill's
+own query socket). Adding verbs would mean inventing a control plane that
+does not exist; if/when breadsearch grows one, the corresponding
+`bread.command.search.*` verbs should be added at the same time, not stubbed
+out ahead of it.
+
+## Fail-safe behavior
+
+- If breadd isn't installed or isn't running, `emit` is a silent no-op
+  (`BreadClient::emit` never blocks or errors the caller) — breadsearch's
+  overlay and breadmill's indexing/query path are entirely unaffected.
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 0d2e114..311cefd 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -11,6 +11,8 @@ path = "src/main.rs"
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
 bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["gtk"] }
+# Bread event fabric client — emit bread.search.* (fail-silent if breadd is down).
+bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["bread-client"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
 # Not on tag v0.7.1 (crate landed after that tag). Rev, not branch=main.
 # v0.7.1 predates this crate; same rev siblings use.
diff --git a/breadsearch/src/bread_events.rs b/breadsearch/src/bread_events.rs
new file mode 100644
index 0000000..d87e595
--- /dev/null
+++ b/breadsearch/src/bread_events.rs
@@ -0,0 +1,26 @@
+//! `bread.search.*` event integration — optional, non-blocking. See
+//! `EVENTS.md` at the repo root for the full contract. breadsearch works
+//! identically with or without breadd running; every call here is
+//! fire-and-forget (`BreadClient::emit` never blocks or errors this
+//! process) so a missing or restarting breadd never affects the overlay.
+
+use bread_utils::bread_client::BreadClient;
+
+/// This app's id in bread's sibling-app namespace registry
+/// (`bread_shared::apps::KNOWN_APPS`) — events publish as `bread.search.*`.
+pub const APP_ID: &str = "search";
+
+fn client() -> BreadClient {
+    BreadClient::connect(APP_ID)
+}
+
+pub fn emit_opened() {
+    client().emit("bread.search.opened", serde_json::json!({}));
+}
+
+pub fn emit_opened_result(path: &str) {
+    client().emit(
+        "bread.search.opened_result",
+        serde_json::json!({ "path": path }),
+    );
+}
diff --git a/breadsearch/src/main.rs b/breadsearch/src/main.rs
index 146dd46..6f55769 100644
--- a/breadsearch/src/main.rs
+++ b/breadsearch/src/main.rs
@@ -18,6 +18,7 @@ use gtk4::{
 };
 use gtk4_layer_shell::{Edge, KeyboardMode, Layer, LayerShell};
 
+mod bread_events;
 mod screenshot;
 
 // ---- Theming ----------------------------------------------------------------
@@ -193,6 +194,7 @@ fn open_file(path: &str) {
         .stdout(std::process::Stdio::null())
         .stderr(std::process::Stdio::null())
         .spawn();
+    bread_events::emit_opened_result(path);
 }
 
 fn open_folder(path: &str) {
@@ -206,6 +208,7 @@ fn open_folder(path: &str) {
         .stdout(std::process::Stdio::null())
         .stderr(std::process::Stdio::null())
         .spawn();
+    bread_events::emit_opened_result(path);
 }
 
 // ---- UI ---------------------------------------------------------------------
@@ -433,6 +436,7 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
             screenshot::dispatch(&window, req);
         }
 
+        window.connect_map(|_| bread_events::emit_opened());
         window.present();
         search.grab_focus();
     });

From 4f9f4de911828df36ff457859d5140a0cfd5ff85 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 5 Aug 2026 19:14:43 +0800
Subject: [PATCH 17/26] CI: build inside bread-ecosystem's shared Arch
 container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ports breadsearch onto the shared, pinned Arch build image already
proven in breadpad, so this repo's release CI stops installing its
toolchain/GTK4 stack directly on the bare self-hosted runner.

- ci/build.sh + ci/bread-ecosystem.rev: thin wrapper cloning
  bread-ecosystem pinned to a commit sha and delegating to its own
  ci/build.sh.
- dev-release.yml/rc-release.yml/release.yml: route the existing
  build/test cargo invocations through ci/build.sh, unchanged
  otherwise.
- check.yml: fast clippy/test signal on feature/**  and fix/** pushes.

No ci/deps.txt: breadmill's npu/rocm/cuda/openvino features (pulled
in by --features full) all use ort's load-dynamic (dlopen) mode, so
none of them link against a real ONNX Runtime EP at build time —
confirmed against breadmill/Cargo.toml and by breadpad already
building ort with its own rocm feature against the same base image
with no extra packages. The GUI's librsvg system dep is a runtime
icon-loader dependency (bakery.toml's system_deps), not something
linked at build/link time, so the base image's gtk4/gtk4-layer-shell
already cover what compiling breadsearch needs.
---
 .forgejo/workflows/check.yml       | 24 ++++++++++++++++++++++++
 .forgejo/workflows/dev-release.yml |  4 ++--
 .forgejo/workflows/rc-release.yml  |  4 ++--
 .forgejo/workflows/release.yml     |  4 ++--
 ci/bread-ecosystem.rev             |  1 +
 ci/build.sh                        | 21 +++++++++++++++++++++
 6 files changed, 52 insertions(+), 6 deletions(-)
 create mode 100644 .forgejo/workflows/check.yml
 create mode 100644 ci/bread-ecosystem.rev
 create mode 100755 ci/build.sh

diff --git a/.forgejo/workflows/check.yml b/.forgejo/workflows/check.yml
new file mode 100644
index 0000000..c9431c8
--- /dev/null
+++ b/.forgejo/workflows/check.yml
@@ -0,0 +1,24 @@
+name: check
+
+# Fast-fail lint/test on short-lived work branches, before it ever reaches
+# main and triggers a dev-track release build.
+on:
+  push:
+    branches: ['feature/**', 'fix/**']
+
+jobs:
+  check:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: clippy
+        run: cd src && bash ci/build.sh cargo clippy --workspace --all-targets --locked --features full -- -D warnings
+
+      - name: test
+        run: cd src && bash ci/build.sh cargo test --workspace --locked --features full
diff --git a/.forgejo/workflows/dev-release.yml b/.forgejo/workflows/dev-release.yml
index aa80a71..85fcaa6 100644
--- a/.forgejo/workflows/dev-release.yml
+++ b/.forgejo/workflows/dev-release.yml
@@ -19,10 +19,10 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: compute dev version
         run: |
diff --git a/.forgejo/workflows/rc-release.yml b/.forgejo/workflows/rc-release.yml
index 1a9385f..3bb6832 100644
--- a/.forgejo/workflows/rc-release.yml
+++ b/.forgejo/workflows/rc-release.yml
@@ -21,10 +21,10 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: prepare artifacts
         run: |
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 54298b4..bd7ff33 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -22,10 +22,10 @@ jobs:
         # `backend` in config.toml. All three are ort load-dynamic (dlopen)
         # EPs, so this doesn't require the NPU/ROCm/CUDA toolkits to be
         # present on the build host — see breadmill/Cargo.toml.
-        run: cd src && cargo build --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
 
       - name: test
-        run: cd src && cargo test --release --locked --workspace --features full
+        run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
 
       - name: prepare artifacts
         run: |
diff --git a/ci/bread-ecosystem.rev b/ci/bread-ecosystem.rev
new file mode 100644
index 0000000..34e7aa9
--- /dev/null
+++ b/ci/bread-ecosystem.rev
@@ -0,0 +1 @@
+147cfbbf96ae4b171027defa1130d2caddb934b1
diff --git a/ci/build.sh b/ci/build.sh
new file mode 100755
index 0000000..2c71070
--- /dev/null
+++ b/ci/build.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Delegates to bread-ecosystem's shared CI build image/script, pinned to
+# the commit in ci/bread-ecosystem.rev — not `main`. bread-ecosystem's CI
+# files now affect every product's release pipeline, so bumping the pin
+# is a deliberate act instead of silent drift (see the bread-theme test
+# that broke here for exactly that reason, before it was pinned by rev).
+#
+# Usage: ci/build.sh cargo build --release --locked
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REV="$(cat "${ROOT}/ci/bread-ecosystem.rev")"
+
+CACHE_DIR="/tmp/bread-ecosystem-ci-${REV}"
+if [ ! -d "$CACHE_DIR" ]; then
+    rm -rf /tmp/bread-ecosystem-ci-*
+    git clone https://git.breadway.dev/Breadway/bread-ecosystem.git "$CACHE_DIR"
+    git -C "$CACHE_DIR" checkout --quiet "$REV"
+fi
+
+bash "${CACHE_DIR}/ci/build.sh" breadsearch "$ROOT" "$@"

From 93c34e738714ffeea44423a8137bd816901f92d4 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 22:53:46 +0800
Subject: [PATCH 18/26] Pin bread-ecosystem crates to v0.7.2

Repoint bread-theme, bread-utils, bread-screenshots, and bread-onnx
at tag v0.7.2 on git.breadway.dev. Drop the 69ce2d67 rev pin now
that screenshots is on a tagged release.
---
 Cargo.lock             | 32 +++++++++++---------------------
 breadmill/Cargo.toml   |  2 +-
 breadsearch/Cargo.toml |  8 +++-----
 3 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 118b7d4..f0fc8bf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -181,11 +181,11 @@ dependencies = [
 
 [[package]]
 name = "bread-onnx"
-version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
+version = "0.7.2"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517f161724132cdeb658c04cf5e490be07ee73"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1)",
+ "bread-utils",
  "hex",
  "ort",
  "sha2 0.10.9",
@@ -196,11 +196,11 @@ dependencies = [
 
 [[package]]
 name = "bread-screenshots"
-version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d#69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d"
+version = "0.7.2"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517f161724132cdeb658c04cf5e490be07ee73"
 dependencies = [
  "anyhow",
- "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d)",
+ "bread-utils",
  "tracing",
 ]
 
@@ -217,8 +217,8 @@ dependencies = [
 
 [[package]]
 name = "bread-theme"
-version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
+version = "0.7.2"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517f161724132cdeb658c04cf5e490be07ee73"
 dependencies = [
  "dirs",
  "gtk4",
@@ -228,8 +228,8 @@ dependencies = [
 
 [[package]]
 name = "bread-utils"
-version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1#db2fa3c4b4c1e6933bc5cf62a236d05972fdc886"
+version = "0.7.2"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517f161724132cdeb658c04cf5e490be07ee73"
 dependencies = [
  "bread-shared",
  "dirs",
@@ -237,16 +237,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "bread-utils"
-version = "0.3.1"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?rev=69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d#69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d"
-dependencies = [
- "dirs",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "breadmill"
 version = "0.3.0"
@@ -277,7 +267,7 @@ dependencies = [
  "anyhow",
  "bread-screenshots",
  "bread-theme",
- "bread-utils 0.3.1 (git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.1)",
+ "bread-utils",
  "breadsearch-shared",
  "clap",
  "gtk4",
diff --git a/breadmill/Cargo.toml b/breadmill/Cargo.toml
index bd3a886..a651199 100644
--- a/breadmill/Cargo.toml
+++ b/breadmill/Cargo.toml
@@ -42,7 +42,7 @@ breadsearch-shared = { path = "../breadsearch-shared" }
 #   needed for the plain CPU path even in the npu build.
 ort = { version = "2.0.0-rc.12", default-features = false, features = ["std", "tracing", "download-binaries", "tls-native", "copy-dylibs", "api-23"] }
 tokenizers = "0"
-bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1" }
+bread-onnx = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2" }
 
 # Surfaces ort's own EP-registration tracing (e.g. a GPU EP silently failing to
 # register and falling back to CPU) as visible log output instead of nowhere.
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 311cefd..5b4933c 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -10,13 +10,11 @@ path = "src/main.rs"
 
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
-bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["gtk"] }
+bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["gtk"] }
 # Bread event fabric client — emit bread.search.* (fail-silent if breadd is down).
-bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.1", features = ["bread-client"] }
+bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["bread-client"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
-# Not on tag v0.7.1 (crate landed after that tag). Rev, not branch=main.
-# v0.7.1 predates this crate; same rev siblings use.
-bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", rev = "69ce2d67a8de8a09c064aa9d7ff99b46656f0b1d" }
+bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
 serde_json = "1"

From e20c64fa1a48f732dbb180f53ae0451df461830f Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 23:05:47 +0800
Subject: [PATCH 19/26] Bump version to v0.3.1

---
 Cargo.lock                    | 6 +++---
 breadmill/Cargo.toml          | 2 +-
 breadsearch-shared/Cargo.toml | 2 +-
 breadsearch/Cargo.toml        | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f0fc8bf..45c703a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -239,7 +239,7 @@ dependencies = [
 
 [[package]]
 name = "breadmill"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "bread-onnx",
  "breadsearch-shared",
@@ -262,7 +262,7 @@ dependencies = [
 
 [[package]]
 name = "breadsearch"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "bread-screenshots",
@@ -277,7 +277,7 @@ dependencies = [
 
 [[package]]
 name = "breadsearch-shared"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "serde",
  "serde_json",
diff --git a/breadmill/Cargo.toml b/breadmill/Cargo.toml
index a651199..f201c9a 100644
--- a/breadmill/Cargo.toml
+++ b/breadmill/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadmill"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadsearch-shared/Cargo.toml b/breadsearch-shared/Cargo.toml
index 3ebc491..a25ee94 100644
--- a/breadsearch-shared/Cargo.toml
+++ b/breadsearch-shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadsearch-shared"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 5b4933c..abc0269 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadsearch"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 license = "MIT"
 

From cdee9da60989b68d9fbf863acefaefca5b20edb4 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 15 Aug 2026 23:11:28 +0800
Subject: [PATCH 20/26] Honor bread.command.search.open via breadsearch listen

---
 EVENTS.md                 | 44 +++++++++++++++-----
 breadsearch/src/listen.rs | 84 +++++++++++++++++++++++++++++++++++++++
 breadsearch/src/main.rs   |  6 +++
 3 files changed, 125 insertions(+), 9 deletions(-)
 create mode 100644 breadsearch/src/listen.rs

diff --git a/EVENTS.md b/EVENTS.md
index dbcaa54..61f5030 100644
--- a/EVENTS.md
+++ b/EVENTS.md
@@ -10,8 +10,10 @@ convention this follows.
 App id: **`search`**. Transport: `bread-utils`'s `bread_client` module
 (feature `bread-client`) — the overlay links it directly. Each `emit` is
 its own short-lived connection (`BreadClient::emit` is fire-and-forget,
-the same stance as `bread-emit`). breadmill, the indexing daemon, does
-not talk to breadd.
+the same stance as `bread-emit`). Command verbs are only received while
+`breadsearch listen` is running — that process holds the
+`bread.command.search.**` subscription open. breadmill, the indexing
+daemon, does not talk to breadd.
 
 ## Events published (`bread.search.*`)
 
@@ -19,18 +21,42 @@ not talk to breadd.
 |-------|------|------|
 | `bread.search.opened` | `{}` | The overlay window maps (the search panel is shown). |
 | `bread.search.opened_result` | `{ "path": "<hit path>" }` | The user opens a hit — Enter / click opens the file, Ctrl+Enter reveals its folder. `path` is the hit's document path, not the parent folder. |
+| `bread.search.open.done` | `{}` | `bread.command.search.open` was received and `breadsearch` was spawned. This is the command confirmation, not proof the overlay mapped — the spawned process is the same PID-file toggle as a keybind. |
+| `bread.search.open.failed` | `{ "error": "<message>" }` | `bread.command.search.open` was received but this binary could not be started. |
 
 ## Commands honored (`bread.command.search.*`)
 
-None. The overlay is a short-lived toggle process with no existing command
-surface (no show/hide/query IPC beyond the PID-file toggle and breadmill's
-own query socket). Adding verbs would mean inventing a control plane that
-does not exist; if/when breadsearch grows one, the corresponding
-`bread.command.search.*` verbs should be added at the same time, not stubbed
-out ahead of it.
+These are only received while `breadsearch listen` is running. Publishing a
+command with no subscriber is a silent no-op — that is the documented
+bread convention, not a breadsearch bug.
+
+| Verb | Data | Effect |
+|------|------|--------|
+| `open` | none | Same as running `breadsearch` (PID-file toggle: show the overlay, or dismiss it if it is already up). Emits `bread.search.open.done` / `.failed`. |
+
+```lua
+bread.spawn(function()
+    bread.emit("bread.command.search.open")
+    bread.wait("bread.search.open.done", { timeout = 5000 })
+end)
+```
+
+### Not implemented: extra verbs
+
+There is no `query` / `close` / `reindex` command verb. breadmill already
+has its own query socket; inventing a bus query plane would be a new
+product surface. If/when that exists, add the corresponding
+`bread.command.search.*` verb at the same time, not stubbed as a no-op
+ahead of it.
 
 ## Fail-safe behavior
 
 - If breadd isn't installed or isn't running, `emit` is a silent no-op
-  (`BreadClient::emit` never blocks or errors the caller) — breadsearch's
+  (`BreadClient::emit` never blocks or errors the caller) and the
+  command subscription simply never receives anything — breadsearch's
   overlay and breadmill's indexing/query path are entirely unaffected.
+- If breadd restarts, the command subscription reconnects automatically
+  (`BreadClient::subscribe`'s background thread has its own backoff
+  loop); no restart of `breadsearch listen` is needed.
+- If `breadsearch listen` is not running, commands are a graceful no-op at
+  the bus (no subscriber). The overlay CLI still works.
diff --git a/breadsearch/src/listen.rs b/breadsearch/src/listen.rs
new file mode 100644
index 0000000..aef9c84
--- /dev/null
+++ b/breadsearch/src/listen.rs
@@ -0,0 +1,84 @@
+//! Long-running command subscription for `bread.command.search.*`.
+//!
+//! `breadsearch` is still a one-shot toggle overlay by default.
+//! `breadsearch listen` is the optional persistent process that can honor
+//! bus commands. See `EVENTS.md`.
+
+use bread_utils::bread_client::{BreadClient, BreadEvent};
+
+use crate::bread_events::APP_ID;
+
+/// Subscribe to `bread.command.search.**` and block until the process is killed.
+///
+/// breadd being absent is not an error: [`BreadClient::subscribe`] reconnects
+/// with backoff, and `on_event` simply isn't called until the daemon is up.
+pub fn run() {
+    let client = BreadClient::connect(APP_ID);
+    if client.health().is_none() {
+        eprintln!(
+            "breadsearch: breadd unreachable; command subscription will connect when it comes back"
+        );
+    }
+
+    let _commands = client.subscribe("bread.command.search.**", |event| {
+        handle_command(&event);
+    });
+
+    eprintln!("breadsearch: listening for bread.command.search.**");
+    loop {
+        std::thread::park();
+    }
+}
+
+/// Reacts to `bread.command.search.*` verbs. Only `open` is honored today —
+/// other verbs are ignored, not stubbed as no-ops that pretend to succeed.
+fn handle_command(event: &BreadEvent) {
+    let Some(verb) = command_verb(&event.event) else {
+        return;
+    };
+    match verb {
+        "open" => handle_open(),
+        other => {
+            eprintln!("breadsearch: ignoring unrecognized bread.command.search.{other}");
+        }
+    }
+}
+
+fn handle_open() {
+    // Same as running `breadsearch` from a keybind: the PID-file toggle
+    // shows the overlay (or dismisses it if it is already up).
+    let result = spawn_self();
+    let client = BreadClient::connect(APP_ID);
+    match result {
+        Ok(_) => client.emit("bread.search.open.done", serde_json::json!({})),
+        Err(e) => {
+            eprintln!("breadsearch: bread.command.search.open failed: {e}");
+            client.emit(
+                "bread.search.open.failed",
+                serde_json::json!({ "error": e.to_string() }),
+            );
+        }
+    }
+}
+
+fn spawn_self() -> std::io::Result<std::process::Child> {
+    let exe = std::env::current_exe().unwrap_or_else(|_| std::path::PathBuf::from("breadsearch"));
+    std::process::Command::new(exe).spawn()
+}
+
+fn command_verb(event_name: &str) -> Option<&str> {
+    event_name.strip_prefix("bread.command.search.")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn command_verb_strips_search_prefix() {
+        assert_eq!(command_verb("bread.command.search.open"), Some("open"));
+        assert_eq!(command_verb("bread.command.search.query"), Some("query"));
+        assert_eq!(command_verb("bread.command.box.open"), None);
+        assert_eq!(command_verb("bread.search.opened"), None);
+    }
+}
diff --git a/breadsearch/src/main.rs b/breadsearch/src/main.rs
index 6f55769..247ad80 100644
--- a/breadsearch/src/main.rs
+++ b/breadsearch/src/main.rs
@@ -19,6 +19,7 @@ use gtk4::{
 use gtk4_layer_shell::{Edge, KeyboardMode, Layer, LayerShell};
 
 mod bread_events;
+mod listen;
 mod screenshot;
 
 // ---- Theming ----------------------------------------------------------------
@@ -454,6 +455,11 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
 // ---- Main -------------------------------------------------------------------
 
 fn main() {
+    if std::env::args().nth(1).as_deref() == Some("listen") {
+        listen::run();
+        return;
+    }
+
     use clap::Parser;
     let cli = screenshot::Cli::parse();
     let screenshot_req = cli.screenshot_request();

From 7eefe9087a9717bc500c272bd99e2b8581f52d47 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 00:26:06 +0800
Subject: [PATCH 21/26] Adopt bread_utils::screenshot_cli for --screenshot
 flags

Replace the local settle delay, canvas defaults, and pair-validation
error path with bread-utils v0.7.2. Clap parsing stays in-tree.
---
 breadsearch/src/screenshot.rs | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/breadsearch/src/screenshot.rs b/breadsearch/src/screenshot.rs
index 4373fb3..ad1f6ad 100644
--- a/breadsearch/src/screenshot.rs
+++ b/breadsearch/src/screenshot.rs
@@ -7,15 +7,10 @@
 //! the panel shows at settle time — normally the "Type to search…" empty
 //! state, since there's no query to type in an automated run.
 
+use bread_utils::screenshot_cli::{validate_pair, DEFAULT_HEIGHT, DEFAULT_WIDTH, SETTLE_DELAY};
 use clap::Parser;
 use gtk4::prelude::*;
 use std::path::PathBuf;
-use std::time::Duration;
-
-/// Extra settle time after `map` for the first frame to actually paint
-/// before grim runs — `map` fires once the surface exists, not once
-/// anything has been drawn into it.
-const SETTLE_DELAY: Duration = Duration::from_millis(300);
 
 #[derive(Parser)]
 #[command(name = "breadsearch")]
@@ -31,11 +26,11 @@ pub struct Cli {
 
     /// Capture canvas width — matches the isolated compositor's output width
     /// (`bread-capture --isolate-width`).
-    #[arg(long, default_value_t = 1920)]
+    #[arg(long, default_value_t = DEFAULT_WIDTH)]
     pub width: u32,
 
     /// Capture canvas height — see `width`.
-    #[arg(long, default_value_t = 1080)]
+    #[arg(long, default_value_t = DEFAULT_HEIGHT)]
     pub height: u32,
 }
 
@@ -48,16 +43,20 @@ pub struct ScreenshotRequest {
 }
 
 impl Cli {
-    /// `None` for a normal run. Exits the process with an error if
-    /// `--screenshot` was given without `--output`, before any GTK setup
+    /// `None` for a normal run. Exits the process with an error if the
+    /// `--screenshot` / `--output` pair is incomplete, before any GTK setup
     /// happens.
     pub fn screenshot_request(&self) -> Option<ScreenshotRequest> {
-        let view = self.screenshot.clone()?;
-        let Some(output) = self.output.clone() else {
-            eprintln!("breadsearch: --screenshot requires --output");
+        if let Err(e) = validate_pair(self.screenshot.as_deref(), self.output.as_deref()) {
+            eprintln!("breadsearch: {e}");
             std::process::exit(1);
-        };
-        Some(ScreenshotRequest { view, output, width: self.width, height: self.height })
+        }
+        Some(ScreenshotRequest {
+            view: self.screenshot.clone()?,
+            output: self.output.clone()?,
+            width: self.width,
+            height: self.height,
+        })
     }
 }
 

From e1a2bef109de6b855a52ca934916491c039a072c Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 00:50:22 +0800
Subject: [PATCH 22/26] CI: refuse unsigned bakery index on stable tag releases

---
 .forgejo/workflows/release.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index bd7ff33..829ff6f 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -22,7 +22,16 @@ jobs:
         # `backend` in config.toml. All three are ort load-dynamic (dlopen)
         # EPs, so this doesn't require the NPU/ROCm/CUDA toolkits to be
         # present on the build host — see breadmill/Cargo.toml.
-        run: cd src && bash ci/build.sh cargo build --release --locked --workspace --features full
+        run: |
+          set -euo pipefail
+          if [ ! -f src/ci/build.sh ]; then
+            echo "::error::ci/build.sh is missing — bakery release builds must go through the shared CI wrapper"
+            exit 1
+          fi
+          cd src && bash ci/build.sh cargo build --release --locked --workspace --features full || {
+            echo "::error::cargo build --release --locked failed. If Cargo.lock drifted, update and commit it; do not drop --locked."
+            exit 1
+          }
 
       - name: test
         run: cd src && bash ci/build.sh cargo test --release --locked --workspace --features full
@@ -45,8 +54,14 @@ jobs:
           ln -sfn "${VERSION}" "/srv/breadway-dl/breadsearch/latest"
 
       - name: regenerate index.json
+        env:
+          MINISIGN_SEC_KEY: ${{ secrets.BAKERY_MINISIGN_SEC_KEY_PATH }}
         run: |
           set -euo pipefail
+          if [ -z "${MINISIGN_SEC_KEY:-}" ]; then
+            echo "::error::BAKERY_MINISIGN_SEC_KEY_PATH secret not set — refusing to regenerate index.json unsigned (would leave a stale signature mismatched against fresh content and break bakery for everyone)"
+            exit 1
+          fi
           rm -rf /tmp/bread-ecosystem-ci
           git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
           bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh

From 60d1d817779b82f767dc38cf802ea88d47015964 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 13:23:15 +0800
Subject: [PATCH 23/26] Bind the window to the current monitor's bread-theme
 palette

Pin bread-theme to v0.7.4.
---
 Cargo.lock              | 465 ++++++++++++++++++++++------------------
 breadsearch/Cargo.toml  |   2 +-
 breadsearch/src/main.rs |   1 +
 3 files changed, 253 insertions(+), 215 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 45c703a..c615ccc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -44,9 +44,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -103,9 +103,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arbitrary"
@@ -134,6 +134,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -217,8 +223,8 @@ dependencies = [
 
 [[package]]
 name = "bread-theme"
-version = "0.7.2"
-source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517f161724132cdeb658c04cf5e490be07ee73"
+version = "0.7.4"
+source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.4#fcba3760387e2523edb71350f8efea3bc851b21e"
 dependencies = [
  "dirs",
  "gtk4",
@@ -286,9 +292,9 @@ dependencies = [
 
 [[package]]
 name = "bstr"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f7dc094d718f2e1c1559ad110e27eeaae14a5465d3d56dd6dbd793079fbd530"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
 dependencies = [
  "memchr",
  "serde_core",
@@ -351,7 +357,7 @@ checksum = "f8b4985713047f5faee02b8db6a6ef32bbb50269ff53c1aee716d1d195b76d54"
 dependencies = [
  "glib-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -374,9 +380,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.3.0"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89588d05638b5b4594a3348a2d6c20277e43a7f5c5202b05cc56888475a47b8"
+checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -429,9 +435,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.2"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -439,9 +445,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.2"
+version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
 dependencies = [
  "anstream",
  "anstyle",
@@ -451,14 +457,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -636,9 +642,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.197"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00424da159cc5adcb4eeea7e7b5cb1d96df41f5fa695ec596922181bdc36232a"
+checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
 dependencies = [
  "cc",
  "cxx-build",
@@ -651,9 +657,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.197"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43e05269dbed4dab7072ae0f04ef31799ad189d52ce2ac12710c2997b754f86a"
+checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -661,39 +667,39 @@ dependencies = [
  "proc-macro2",
  "quote",
  "scratch",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.197"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2f017b07e0da7f425642339faff0edc9f0de6459a18180183d086d1f3381e89"
+checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
 dependencies = [
  "clap",
  "codespan-reporting",
  "indexmap",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.197"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "293d267f43a5778bf3b89fff2a658f081166e7f152d9640e2ee3d917d065a5fc"
+checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.197"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72dd233dc128223fe85d2afa5c617c79743c0f47fb495b69234b5da680d4986a"
+checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
 dependencies = [
  "indexmap",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -723,7 +729,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -734,7 +740,7 @@ checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -776,7 +782,7 @@ checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -797,7 +803,7 @@ dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -807,7 +813,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
 dependencies = [
  "derive_builder_core",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -855,13 +861,13 @@ dependencies = [
 
 [[package]]
 name = "displaydoc"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -875,9 +881,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
 name = "encode_unicode"
@@ -942,9 +948,9 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastrand"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "field-offset"
@@ -968,9 +974,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
 [[package]]
 name = "flate2"
@@ -1029,24 +1035,24 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
 ]
 
 [[package]]
 name = "futures-core"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1055,32 +1061,32 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "futures-task"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-core",
  "futures-macro",
@@ -1111,7 +1117,7 @@ dependencies = [
  "glib-sys",
  "gobject-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1144,7 +1150,7 @@ dependencies = [
  "libc",
  "pango-sys",
  "pkg-config",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1222,7 +1228,7 @@ dependencies = [
  "glib-sys",
  "gobject-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
  "windows-sys 0.61.2",
 ]
 
@@ -1276,7 +1282,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1286,14 +1292,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "030967459f9f676851872c6304adea7825c6d462ec9b72554c733cf0c5952233"
 dependencies = [
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
 name = "globset"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e47d37d2ae4464254884b60ab7071be2b876a9c35b696bd018ddcc76847309cd"
+checksum = "07c34a9410465b45bd9787443bc7370f37735bad04b0f0cd57ff1a3186c98988"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -1310,7 +1316,7 @@ checksum = "22a861859b887a79cf461359c192c97a57d8fb0229dd291232e57aa11f6fa72c"
 dependencies = [
  "glib-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1331,7 +1337,7 @@ checksum = "5c7ffdfde88f3570d3705e0d8a2433e036d387a1f2930bbf47eafcb5f569fd04"
 dependencies = [
  "glib-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1362,7 +1368,7 @@ dependencies = [
  "graphene-sys",
  "libc",
  "pango-sys",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1388,9 +1394,9 @@ dependencies = [
 
 [[package]]
 name = "gtk4-layer-shell"
-version = "0.8.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4069987ff4793699511a251028cc336b438e46565b463f111250148d574752a"
+checksum = "17c28ea0f4676fdaaae7ff2413a24d0d35c8657424f84856c1103c73454c9da4"
 dependencies = [
  "bitflags 2.13.1",
  "gdk4",
@@ -1403,15 +1409,15 @@ dependencies = [
 
 [[package]]
 name = "gtk4-layer-shell-sys"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f566a5ec5bcc454e7fcf2ab76930887ced5365afce12c1e5201bb296b95f1b9"
+checksum = "bcf19bb884ef0ef55b9e6b2b369c39b4fcc0c41e3a0c1cbc8c267720338b690b"
 dependencies = [
  "gdk4-sys",
  "glib-sys",
  "gtk4-sys",
  "libc",
- "system-deps",
+ "system-deps 8.0.0",
 ]
 
 [[package]]
@@ -1423,7 +1429,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1442,7 +1448,7 @@ dependencies = [
  "gsk4-sys",
  "libc",
  "pango-sys",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -1501,9 +1507,9 @@ checksum = "ec9d92d097f4749b64e8cc33d924d9f40a2d4eb91402b458014b781f5733d60f"
 
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -1517,18 +1523,18 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
  "typenum",
 ]
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -1540,9 +1546,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1553,9 +1559,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1567,16 +1573,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -1587,15 +1594,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "92a7ed671a6aad807a8651a2e1782a6598fda9ce5185dd8158549e95a91c6428"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1635,9 +1642,9 @@ dependencies = [
 
 [[package]]
 name = "ignore"
-version = "0.4.30"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b009b6744c1445efd7244084e25e498636412effb6760b55067553baa925cc7"
+checksum = "00b69833ed729dc5aa7d19541d96d6cf8e9137194207a04916d658e43168402f"
 dependencies = [
  "crossbeam-deque",
  "globset",
@@ -1735,9 +1742,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.103"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1752,9 +1759,9 @@ checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
 [[package]]
 name = "kqueue"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "273c0752728918e0ac4976f2b275b6fefb9ecd400585dec929419f3844cd87b5"
+checksum = "8d763e5b24120b4ddf50de6c92308156765aabfbbccebf401da7cff2d70a41ea"
 dependencies = [
  "kqueue-sys",
  "libc",
@@ -1778,9 +1785,9 @@ checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
@@ -1794,18 +1801,18 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.18"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6c19a05435c21ac299d71b6a9c13db3e3f47c520517d58990a462a1397a61db"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1829,9 +1836,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "log"
@@ -1861,7 +1868,7 @@ dependencies = [
  "rangemap",
  "sha2 0.10.9",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror 2.0.20",
  "ttf-parser",
  "weezl",
 ]
@@ -1895,19 +1902,19 @@ dependencies = [
 
 [[package]]
 name = "macro_rules_attribute"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65049d7923698040cd0b1ddcced9b0eb14dd22c5f86ae59c3740eab64a676520"
+checksum = "b3ae8f6d608c795738406608304d30a2dfbdc8e58e44f7ba43236da5208ded3c"
 dependencies = [
  "macro_rules_attribute-proc_macro",
- "paste",
+ "pastey",
 ]
 
 [[package]]
 name = "macro_rules_attribute-proc_macro"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "670fdfda89751bc4a84ac13eaa63e205cf0fd22b4c9a5fbfa085b63c1f1d3a30"
+checksum = "fc04a4c58212d57930a24bf47d3fa87485264a3a054e9c10e042eb373573ad3c"
 
 [[package]]
 name = "matchers"
@@ -2000,7 +2007,7 @@ checksum = "e4db6d5580af57bf992f59068d4ea26fd518574ff48d7639b255a36f9de6e7e9"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2099,9 +2106,9 @@ checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-integer"
-version = "0.1.46"
+version = "0.1.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
 dependencies = [
  "num-traits",
 ]
@@ -2117,9 +2124,9 @@ dependencies = [
 
 [[package]]
 name = "numkong"
-version = "7.7.0"
+version = "7.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b58d4bb97df102ebdde66a352a20c0bc65c7c407ee9bef12ebe317edc2458a55"
+checksum = "81601dc994296baed2968db046b01589be7898837c31f2b073704c6e65ff8f04"
 dependencies = [
  "cc",
 ]
@@ -2180,7 +2187,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2209,27 +2216,27 @@ checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
 [[package]]
 name = "ort"
-version = "2.0.0-rc.12"
+version = "2.0.0-rc.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7de3af33d24a745ffb8fab904b13478438d1cd52868e6f17735ef6e1f8bf133"
+checksum = "4336a1e2b38848325241c72889086886004e589b7c74f335e60a8e8db5138a0b"
 dependencies = [
  "libloading",
  "ndarray",
  "ort-sys",
  "smallvec",
  "tracing",
- "ureq 3.3.0",
+ "ureq 3.4.0",
 ]
 
 [[package]]
 name = "ort-sys"
-version = "2.0.0-rc.12"
+version = "2.0.0-rc.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7b497d21a8b6fbb4b5a544f8fadb77e801a09ae0add9e411d31c6f89e3c1e90"
+checksum = "cf211e3776eea6aec988552fa118dd746d70e1b1e5e244058d1c98015f3e5872"
 dependencies = [
  "hmac-sha256",
  "lzma-rust2",
- "ureq 3.3.0",
+ "ureq 3.4.0",
 ]
 
 [[package]]
@@ -2252,7 +2259,7 @@ dependencies = [
  "glib-sys",
  "gobject-sys",
  "libc",
- "system-deps",
+ "system-deps 7.0.8",
 ]
 
 [[package]]
@@ -2261,6 +2268,12 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pastey"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
+
 [[package]]
 name = "pbkdf2"
 version = "0.12.2"
@@ -2311,9 +2324,9 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "pom"
@@ -2323,9 +2336,9 @@ checksum = "60f6ce597ecdcc9a098e7fddacb1065093a3d66446fa16c675e7e71d1b5c28e6"
 
 [[package]]
 name = "portable-atomic"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
 
 [[package]]
 name = "portable-atomic-util"
@@ -2344,9 +2357,9 @@ checksum = "78451badbdaebaf17f053fd9152b3ffb33b516104eacb45e7864aaa9c712f306"
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
@@ -2377,9 +2390,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
@@ -2396,9 +2409,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -2463,9 +2476,9 @@ checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "rangemap"
-version = "1.7.1"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "973443cf09a9c8656b574a866ab68dfa19f0867d0340648c7d2f6a71b8a8ea68"
+checksum = "a611d15b50743feb4c76b7d03edcb0e64f399c26961e4efe6975bc398be6aa3d"
 
 [[package]]
 name = "rawpointer"
@@ -2529,9 +2542,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2565,14 +2578,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
 dependencies = [
  "hashbrown 0.16.1",
- "thiserror 2.0.18",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "rusqlite"
-version = "0.40.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11438310b19e3109b6446c33d1ed5e889428cf2e278407bc7896bc4aaea43323"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.1",
  "fallible-iterator",
@@ -2607,9 +2620,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "log",
  "once_cell",
@@ -2622,18 +2635,18 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.15.0"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2707,9 +2720,9 @@ checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -2717,29 +2730,29 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -2913,6 +2926,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -2921,7 +2945,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2933,7 +2957,20 @@ dependencies = [
  "cfg-expr",
  "heck",
  "pkg-config",
- "toml 1.1.3+spec-1.1.0",
+ "toml 1.1.4+spec-1.1.0",
+ "version-compare",
+]
+
+[[package]]
+name = "system-deps"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83779a5c956bcb6ba627a4ecf0a9d7625db47d7537e0892d97f712ac995648a3"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml 1.1.4+spec-1.1.0",
  "version-compare",
 ]
 
@@ -2976,11 +3013,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -2991,18 +3028,18 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -3016,9 +3053,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.53"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18dfaaeddcb932337b5e7866ee7d0ce9b76d2fd092997146f187ec09b4558a50"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "num-conv",
@@ -3035,9 +3072,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -3086,7 +3123,7 @@ dependencies = [
  "serde",
  "serde_json",
  "spm_precompiled",
- "thiserror 2.0.18",
+ "thiserror 2.0.20",
  "unicode-normalization-alignments",
  "unicode-segmentation",
  "unicode_categories",
@@ -3106,9 +3143,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "1.1.3+spec-1.1.0"
+version = "1.1.4+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53c96ecdfa941c8fc4fcaed14f99ada8ebed502eef533015095a07e3301d4c3c"
+checksum = "3aace63f4bbcdfc2c965b059de67119c89c4017a70d633be6c104910f67056f5"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -3165,9 +3202,9 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
  "winnow 1.0.4",
 ]
@@ -3203,7 +3240,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3352,11 +3389,11 @@ dependencies = [
 
 [[package]]
 name = "ureq"
-version = "3.3.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+checksum = "972d7902c8735f2695410b8aed7df6ed12a47394aa1c8d7af49f0497b731a94d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "der",
  "log",
  "native-tls",
@@ -3370,11 +3407,11 @@ dependencies = [
 
 [[package]]
 name = "ureq-proto"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+checksum = "da5f78b09e6941e1a0f2e30e695e4b120377b54d5e0aec11b594bb57b3971613"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "http",
  "httparse",
  "log",
@@ -3472,9 +3509,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3485,9 +3522,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3495,22 +3532,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
 dependencies = [
  "unicode-ident",
 ]
@@ -3769,15 +3806,15 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "xml-rs"
-version = "0.8.28"
+version = "0.8.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
+checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xz2"
@@ -3807,28 +3844,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.54"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.54"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3848,7 +3885,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "synstructure",
 ]
 
@@ -3869,14 +3906,14 @@ checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -3885,9 +3922,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -3896,13 +3933,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "47402523226a02bfe5230160dc3ccc089aa6f6f19e7fcbb4e6f824bbb1b4aa62"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -3927,7 +3964,7 @@ dependencies = [
  "memchr",
  "pbkdf2",
  "sha1",
- "thiserror 2.0.18",
+ "thiserror 2.0.20",
  "time",
  "xz2",
  "zeroize",
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index abc0269..56fab2b 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -10,7 +10,7 @@ path = "src/main.rs"
 
 [dependencies]
 breadsearch-shared = { path = "../breadsearch-shared" }
-bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["gtk"] }
+bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.4", features = ["gtk"] }
 # Bread event fabric client — emit bread.search.* (fail-silent if breadd is down).
 bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["bread-client"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
diff --git a/breadsearch/src/main.rs b/breadsearch/src/main.rs
index 247ad80..d4d4786 100644
--- a/breadsearch/src/main.rs
+++ b/breadsearch/src/main.rs
@@ -247,6 +247,7 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
             window.set_anchor(edge, true);
         }
         window.set_exclusive_zone(0);
+        bread_theme::gtk::bind_window_auto(&window);
 
         let close_all: Rc<dyn Fn()> = Rc::new({
             let w = window.clone();

From 1ce5f72819e5a388bc237ca6e715d22531b0642e Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 14:09:28 +0800
Subject: [PATCH 24/26] Bump version to v0.3.3

---
 Cargo.lock                    | 83 ++++++-----------------------------
 breadmill/Cargo.toml          |  2 +-
 breadsearch-shared/Cargo.toml |  2 +-
 breadsearch/Cargo.toml        |  2 +-
 4 files changed, 17 insertions(+), 72 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c615ccc..60a3e79 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -167,15 +167,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block-padding"
 version = "0.3.3"
@@ -194,7 +185,7 @@ dependencies = [
  "bread-utils",
  "hex",
  "ort",
- "sha2 0.10.9",
+ "sha2",
  "tokenizers",
  "tracing",
  "ureq 2.12.1",
@@ -245,7 +236,7 @@ dependencies = [
 
 [[package]]
 name = "breadmill"
-version = "0.3.1"
+version = "0.3.3"
 dependencies = [
  "bread-onnx",
  "breadsearch-shared",
@@ -258,7 +249,7 @@ dependencies = [
  "rusqlite",
  "serde",
  "serde_json",
- "sha2 0.11.0",
+ "sha2",
  "tokenizers",
  "tracing-subscriber",
  "ureq 2.12.1",
@@ -268,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "breadsearch"
-version = "0.3.1"
+version = "0.3.3"
 dependencies = [
  "anyhow",
  "bread-screenshots",
@@ -283,7 +274,7 @@ dependencies = [
 
 [[package]]
 name = "breadsearch-shared"
-version = "0.3.1"
+version = "0.3.3"
 dependencies = [
  "serde",
  "serde_json",
@@ -429,7 +420,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "inout",
 ]
 
@@ -517,12 +508,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -631,15 +616,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "cxx"
 version = "1.0.199"
@@ -822,22 +798,11 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
+ "block-buffer",
+ "crypto-common",
  "subtle",
 ]
 
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.1",
- "const-oid",
- "crypto-common 0.2.2",
-]
-
 [[package]]
 name = "dirs"
 version = "5.0.1"
@@ -1496,7 +1461,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -1521,15 +1486,6 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -1866,7 +1822,7 @@ dependencies = [
  "nom 8.0.0",
  "rand 0.10.2",
  "rangemap",
- "sha2 0.10.9",
+ "sha2",
  "stringprep",
  "thiserror 2.0.20",
  "ttf-parser",
@@ -1942,7 +1898,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
  "cfg-if",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -2280,7 +2236,7 @@ version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
- "digest 0.10.7",
+ "digest",
  "hmac",
 ]
 
@@ -2787,7 +2743,7 @@ checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest 0.10.7",
+ "digest",
 ]
 
 [[package]]
@@ -2798,18 +2754,7 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
+ "digest",
 ]
 
 [[package]]
diff --git a/breadmill/Cargo.toml b/breadmill/Cargo.toml
index f201c9a..c57023e 100644
--- a/breadmill/Cargo.toml
+++ b/breadmill/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadmill"
-version = "0.3.1"
+version = "0.3.3"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadsearch-shared/Cargo.toml b/breadsearch-shared/Cargo.toml
index a25ee94..6f45d3f 100644
--- a/breadsearch-shared/Cargo.toml
+++ b/breadsearch-shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadsearch-shared"
-version = "0.3.1"
+version = "0.3.3"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 56fab2b..4b200b7 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadsearch"
-version = "0.3.1"
+version = "0.3.3"
 edition = "2021"
 license = "MIT"
 

From 4bfcc694bd1d075c3171f7b421a0c909d437606a Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 23 Aug 2026 14:39:11 +0800
Subject: [PATCH 25/26] Adopt gtk_popup overlay helpers and
 singleton::toggle_or_kill

Replace the TOCTOU pid-file toggle with bread_utils::singleton and
the hand-rolled layer-shell overlay/Up-Down/click-outside with
gtk_popup, matching breadclip. Screenshot runs still skip the lock.
---
 Cargo.lock              |   2 +
 breadsearch/Cargo.toml  |   2 +-
 breadsearch/src/main.rs | 157 +++++++++++-----------------------------
 3 files changed, 47 insertions(+), 114 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 60a3e79..77a2b16 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -230,6 +230,8 @@ source = "git+https://git.breadway.dev/Breadway/bread-ecosystem?tag=v0.7.2#30517
 dependencies = [
  "bread-shared",
  "dirs",
+ "gtk4",
+ "gtk4-layer-shell",
  "serde",
  "serde_json",
 ]
diff --git a/breadsearch/Cargo.toml b/breadsearch/Cargo.toml
index 4b200b7..2c11e28 100644
--- a/breadsearch/Cargo.toml
+++ b/breadsearch/Cargo.toml
@@ -12,7 +12,7 @@ path = "src/main.rs"
 breadsearch-shared = { path = "../breadsearch-shared" }
 bread-theme = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.4", features = ["gtk"] }
 # Bread event fabric client — emit bread.search.* (fail-silent if breadd is down).
-bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["bread-client"] }
+bread-utils = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2", features = ["bread-client", "gtk"] }
 # Capture primitives for `--screenshot` mode — see src/screenshot.rs.
 bread-screenshots = { git = "https://git.breadway.dev/Breadway/bread-ecosystem", tag = "v0.7.2" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
diff --git a/breadsearch/src/main.rs b/breadsearch/src/main.rs
index d4d4786..53302ec 100644
--- a/breadsearch/src/main.rs
+++ b/breadsearch/src/main.rs
@@ -1,22 +1,12 @@
 use bread_theme::{hex_to_rgba, ink_on, load_palette, Palette};
 use breadsearch_shared::{Hit, Request, Response};
-use std::{
-    cell::RefCell,
-    env, fs,
-    path::PathBuf,
-    process::Command,
-    rc::Rc,
-    sync::mpsc,
-};
+use std::{cell::RefCell, process::Command, rc::Rc, sync::mpsc};
 
 use gtk4::{
-    glib,
-    pango::EllipsizeMode,
-    prelude::*,
-    Application, ApplicationWindow, Box as GBox, CssProvider, EventControllerKey, Image, Label,
-    ListBox, Orientation, PolicyType, ScrolledWindow, SearchEntry, SelectionMode,
+    glib, pango::EllipsizeMode, prelude::*, Application, Box as GBox, CssProvider,
+    EventControllerKey, Image, Label, ListBox, Orientation, PolicyType, ScrolledWindow,
+    SearchEntry, SelectionMode,
 };
-use gtk4_layer_shell::{Edge, KeyboardMode, Layer, LayerShell};
 
 mod bread_events;
 mod listen;
@@ -43,47 +33,14 @@ fn build_css(p: &Palette) -> String {
          .hit-snippet {{ opacity: 0.75; font-size: 11px; font-style: italic; }}\
          .hit-score {{ opacity: 0.5; font-size: 11px; }}\
          image {{ margin-right: 8px; }}",
-        bg_panel   = bg_panel,
-        surface    = p.color0,
-        accent     = p.color4,
-        on_bg      = ink_on(&p.background),
+        bg_panel = bg_panel,
+        surface = p.color0,
+        accent = p.color4,
+        on_bg = ink_on(&p.background),
         on_surface = ink_on(&p.color0),
     )
 }
 
-// ---- PID file toggle --------------------------------------------------------
-
-fn pid_file() -> PathBuf {
-    env::var("XDG_RUNTIME_DIR")
-        .map(PathBuf::from)
-        .unwrap_or_else(|_| PathBuf::from("/tmp"))
-        .join("breadsearch.pid")
-}
-
-fn is_breadsearch_pid(pid: u32) -> bool {
-    fs::read_to_string(format!("/proc/{}/comm", pid))
-        .map(|s| s.trim() == "breadsearch")
-        .unwrap_or(false)
-}
-
-fn toggle_or_continue() -> bool {
-    let pf = pid_file();
-    if let Ok(content) = fs::read_to_string(&pf) {
-        if let Ok(pid) = content.trim().parse::<u32>() {
-            if is_breadsearch_pid(pid) {
-                let _ = Command::new("kill").arg(pid.to_string()).status();
-                return false;
-            }
-        }
-    }
-    let _ = fs::write(&pf, std::process::id().to_string());
-    true
-}
-
-fn cleanup_pid() {
-    let _ = fs::remove_file(pid_file());
-}
-
 // ---- Row builder ------------------------------------------------------------
 
 fn make_hit_row(hit: &Hit) -> gtk4::ListBoxRow {
@@ -238,21 +195,13 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
             bread_theme::gtk::apply_user_css(&user_css_path, &user_cell);
         }
 
-        let window = ApplicationWindow::builder().application(app).build();
-        window.init_layer_shell();
-        window.set_namespace(Some("breadsearch"));
-        window.set_layer(Layer::Overlay);
-        window.set_keyboard_mode(KeyboardMode::Exclusive);
-        for edge in [Edge::Top, Edge::Bottom, Edge::Left, Edge::Right] {
-            window.set_anchor(edge, true);
-        }
-        window.set_exclusive_zone(0);
+        // Full-screen transparent overlay; panel widget is positioned inside it.
+        let window = bread_utils::gtk_popup::new_overlay_window(app, "breadsearch");
         bread_theme::gtk::bind_window_auto(&window);
 
         let close_all: Rc<dyn Fn()> = Rc::new({
             let w = window.clone();
             move || {
-                cleanup_pid();
                 w.close();
             }
         });
@@ -308,7 +257,10 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
                 let (tx, rx) = mpsc::sync_channel::<std::io::Result<Response>>(1);
 
                 std::thread::spawn(move || {
-                    let req = Request::Query { query: q, limit: 10 };
+                    let req = Request::Query {
+                        query: q,
+                        limit: 10,
+                    };
                     let _ = tx.send(breadsearch_shared::send_request(&req));
                 });
 
@@ -368,36 +320,11 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
                     glib::Propagation::Stop
                 }
                 Key::Down => {
-                    let cur = list_k.selected_row().map(|r| r.index()).unwrap_or(-1);
-                    let mut i = cur + 1;
-                    loop {
-                        match list_k.row_at_index(i) {
-                            Some(r) if r.is_selectable() => {
-                                list_k.select_row(Some(&r));
-                                break;
-                            }
-                            Some(_) => i += 1,
-                            None => break,
-                        }
-                    }
+                    bread_utils::gtk_popup::select_next_visible(&list_k);
                     glib::Propagation::Stop
                 }
                 Key::Up => {
-                    let cur = list_k.selected_row().map(|r| r.index()).unwrap_or(0);
-                    let mut i = cur - 1;
-                    loop {
-                        if i < 0 {
-                            break;
-                        }
-                        match list_k.row_at_index(i) {
-                            Some(r) if r.is_selectable() => {
-                                list_k.select_row(Some(&r));
-                                break;
-                            }
-                            Some(_) => i -= 1,
-                            None => break,
-                        }
-                    }
+                    bread_utils::gtk_popup::select_prev_visible(&list_k);
                     glib::Propagation::Stop
                 }
                 _ => glib::Propagation::Proceed,
@@ -415,24 +342,10 @@ fn run_ui(screenshot_req: Option<screenshot::ScreenshotRequest>) {
         });
 
         // Click outside launcher panel → close
-        let close_outside = Rc::clone(&close_all);
-        let vbox_ref = vbox.clone();
-        let win_ref = window.clone();
-        let outside_click = gtk4::GestureClick::new();
-        outside_click.connect_pressed(move |_, _, x, y| {
-            if let Some(b) = vbox_ref.compute_bounds(&win_ref) {
-                if x < b.x() as f64
-                    || x > (b.x() + b.width()) as f64
-                    || y < b.y() as f64
-                    || y > (b.y() + b.height()) as f64
-                {
-                    close_outside();
-                }
-            }
-        });
-        window.add_controller(outside_click);
-
-        window.connect_destroy(|_| cleanup_pid());
+        {
+            let close_outside = Rc::clone(&close_all);
+            bread_utils::gtk_popup::close_on_outside_click(&window, &vbox, move || close_outside());
+        }
 
         if let Some(req) = screenshot_req.clone() {
             screenshot::dispatch(&window, req);
@@ -465,11 +378,29 @@ fn main() {
     let cli = screenshot::Cli::parse();
     let screenshot_req = cli.screenshot_request();
 
-    // The PID-file toggle kills whatever's holding the file — a real,
-    // already-running breadsearch instance included. A screenshot run must
-    // never touch it: it's a separate, disposable instance by design.
-    if screenshot_req.is_none() && !toggle_or_continue() {
-        return;
-    }
+    // `toggle_or_kill` kills whatever's holding the single-instance lock —
+    // a real, already-running breadsearch included. A screenshot run must
+    // never touch it: it's a separate, disposable instance by design (same
+    // reasoning as breadbar's `allow_multiple_instances`), not a toggle of
+    // the operator's real search panel.
+    //
+    // Kept alive for the rest of `main` — dropping it releases the
+    // single-instance lock and removes the pid file, which happens
+    // naturally once `run_ui` returns (after the window closes).
+    let _singleton_guard = if screenshot_req.is_some() {
+        None
+    } else {
+        match bread_utils::singleton::toggle_or_kill("breadsearch") {
+            Ok(bread_utils::singleton::Toggle::Started(guard)) => Some(guard),
+            Ok(bread_utils::singleton::Toggle::KilledExisting) => return,
+            Err(e) => {
+                eprintln!(
+                    "breadsearch: single-instance lock unavailable ({e}); continuing without it"
+                );
+                None
+            }
+        }
+    };
+
     run_ui(screenshot_req);
 }

From 993dc4a52546d28c5b1b1ee73298eb9a198f677c Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Thu, 6 Aug 2026 08:52:18 +0800
Subject: [PATCH 26/26] Fix cargo clippy warnings across the workspace

- Derive Default for Config instead of manually mirroring each
  sub-config's Default impl
- Use std::io::Error::other instead of Error::new(ErrorKind::Other, ..)
- Drop the unused mut on the store lock in full_reindex
- Remove Store::dim, a field that was set once and never read
- Use char_indices().enumerate() instead of a hand-rolled loop counter
  in split_by_chars, and is_multiple_of() for the chunk boundary check
- Use strip_prefix instead of manual slicing in expand_home

(cherry picked from commit b740af38e17d04bd83db93bbb0585ed5744a436e)
---
 breadmill/src/chunk.rs        |  6 ++----
 breadmill/src/indexer.rs      |  6 +++---
 breadmill/src/store.rs        |  3 +--
 breadsearch-shared/src/lib.rs | 15 ++-------------
 4 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/breadmill/src/chunk.rs b/breadmill/src/chunk.rs
index dcddca8..7468f89 100644
--- a/breadmill/src/chunk.rs
+++ b/breadmill/src/chunk.rs
@@ -81,10 +81,9 @@ fn split_by_chars(chunk: Chunk, max_chars: usize) -> Vec<Chunk> {
     let text = &chunk.text;
     let mut result = Vec::new();
     let mut seg_start = 0usize;
-    let mut count = 0usize;
 
-    for (byte_idx, _) in text.char_indices() {
-        if count > 0 && count % max_chars == 0 {
+    for (count, (byte_idx, _)) in text.char_indices().enumerate() {
+        if count > 0 && count.is_multiple_of(max_chars) {
             result.push(Chunk {
                 text: text[seg_start..byte_idx].to_string(),
                 start: chunk.start + seg_start,
@@ -92,7 +91,6 @@ fn split_by_chars(chunk: Chunk, max_chars: usize) -> Vec<Chunk> {
             });
             seg_start = byte_idx;
         }
-        count += 1;
     }
     if seg_start < text.len() {
         result.push(Chunk {
diff --git a/breadmill/src/indexer.rs b/breadmill/src/indexer.rs
index 539b58c..67c7694 100644
--- a/breadmill/src/indexer.rs
+++ b/breadmill/src/indexer.rs
@@ -64,7 +64,7 @@ impl Indexer {
     pub fn full_reindex(&self) {
         eprintln!("breadmill: full reindex triggered");
         {
-            let mut store = self.state.store.lock_recover();
+            let store = self.state.store.lock_recover();
             // Clear all state
             let _ = store.conn.execute_batch("DELETE FROM chunks; DELETE FROM files;");
             let _ = store.index.reserve(4096);
@@ -416,9 +416,9 @@ fn sha256_str(bytes: &[u8]) -> String {
 }
 
 pub fn expand_home(path: &str) -> PathBuf {
-    if path.starts_with("~/") {
+    if let Some(rest) = path.strip_prefix("~/") {
         let home = std::env::var("HOME").unwrap_or_else(|_| "/tmp".into());
-        PathBuf::from(home).join(&path[2..])
+        PathBuf::from(home).join(rest)
     } else {
         PathBuf::from(path)
     }
diff --git a/breadmill/src/store.rs b/breadmill/src/store.rs
index ed1392a..106e4c5 100644
--- a/breadmill/src/store.rs
+++ b/breadmill/src/store.rs
@@ -6,7 +6,6 @@ use usearch::{Index, IndexOptions, MetricKind, ScalarKind, new_index};
 pub struct Store {
     pub conn: Connection,
     pub index: Index,
-    pub dim: usize,
 }
 
 // usearch::Index wraps a raw C++ pointer; access is serialized by the Mutex<Store>.
@@ -87,7 +86,7 @@ impl Store {
             index.reserve(4096).map_err(|e| e.to_string())?;
         }
 
-        Ok(Self { conn, index, dim })
+        Ok(Self { conn, index })
     }
 
     // ---- file state ---------------------------------------------------------
diff --git a/breadsearch-shared/src/lib.rs b/breadsearch-shared/src/lib.rs
index fdea6f5..5ed69c4 100644
--- a/breadsearch-shared/src/lib.rs
+++ b/breadsearch-shared/src/lib.rs
@@ -43,7 +43,7 @@ pub fn socket_path() -> PathBuf {
 
 // ---- Config -----------------------------------------------------------------
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct Config {
     #[serde(default)]
     pub index: IndexConfig,
@@ -157,16 +157,6 @@ impl Default for ModelConfig {
     }
 }
 
-impl Default for Config {
-    fn default() -> Self {
-        Self {
-            index: IndexConfig::default(),
-            search: SearchConfig::default(),
-            model: ModelConfig::default(),
-            power: PowerConfig::default(),
-        }
-    }
-}
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PowerConfig {
@@ -255,8 +245,7 @@ pub struct StatusInfo {
 pub fn send_request(req: &Request) -> std::io::Result<Response> {
     let mut stream = UnixStream::connect(socket_path())?;
 
-    let mut line = serde_json::to_string(req)
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))?;
+    let mut line = serde_json::to_string(req).map_err(std::io::Error::other)?;
     line.push('\n');
     stream.write_all(line.as_bytes())?;
     stream.flush()?;