Changelog

About-page version fix · blog line · tighter verify-code copy

• Local desktop / mobile builds now pass --dart-define=SSD_VERSION, fixing the about page showing “development build”.
• Added a blog line “https://erik.xyz” to the desktop about card and mobile capability page (bilingual).
• Verify-code copy tightened: the page no longer explains what the code contains or how it is generated; behavior unchanged.

Full rebrand to ssd (old brand strings removed)

• License format strings are now ssd-license-payload/1 / ssd-license/1; product identifier is ssd-desktop; UI, docs, assets and scripts cleaned.
• Compatibility: licenses signed with the old product string are rejected (expired/wrong_product); reissue using the new verify code.
• Fixed the architecture-diagram contract line (v1.18/132 → v1.19/135) and one baseline test failure.

Verify code on the license page (one code per machine)

• One-click local code: physical NIC address + local time + version, encrypted with RSA-3072 / OAEP-SHA256, three @@@ segments, 518 characters, copyable.
• Randomized NIC (LAA) or unreadable NIC ⇒ fail-closed refusal, so no code source repeatable across a LAN.
• Contract v1.19 (additive; golden 132 → 135); one key per release, private keys never committed or shipped.
• Compatibility: existing licenses, trial, activation time check and host binding unchanged; still exactly three network touchpoints.

Legacy-cleanup closing release · no product code changes

• Recording round W4 (independent re-verification 6/6) and activation-arm evidence W5; version surfaces synced.

About page: version + copyright

• The desktop About / Updates card and the mobile capability page now show both version and copyright line; UI-only, no behavior or contract change.

T7 observation closing release · no product code changes

• 10-session matrix measured all three network touchpoints: update check always fails against the placeholder domain, first-run anchor uses three hosts in random order, anchored restarts make zero time requests; engine makes zero non-loopback calls.

Verification closing release · no product code changes

• Full workspace 1489 passed / 0 failed / 7 ignored; Flutter all green; archive tree 761/761 OK + SSH signature Good.

Trial anchor + delivery and scan hardening

• Trial anchor: first-run network time; trial = 7 days from anchor ∧ at most 3 export sessions ∧ 20 files / 1 GiB, first limit wins; trial export unavailable before anchoring.
• Scan failure reasons shown in the UI; dir: / unix: / image: sources require absolute paths.
• Windows support stated as Windows 10 / 11 (x64); release checksums ship with an SSHSIG signature.
• Contract v1.17 / v1.18 (golden 125 → 132); AAB with three ABIs plus release-manifest assertion.

M4 mobile: iPhone backup import and parsing

• Manifest.db parsing, residue scan, per-item export; encrypted backups use keybag / two-stage PBKDF2 / RFC 3394 / AES-256-CBC, password kept in memory only.
• iOS in-app import flow: choose a backup folder → scan → results / preview / export.
• Android build hardening (ELF64 / AArch64 / executable-bit self-check); contract v1.16.
• Honest boundary: synthetic fixtures only; real backups and external KDF KAT pending.

Licensing overhaul

• Licenses can limit validity, export count and exported bytes; the first exhausted limit blocks export; a new license resumes use.
• One license, one machine: first activation binds the physical NIC MAC; no MAC means no activation; a new NIC requires reissue.
• Activation time check: over 10 minutes off Beijing time is refused; no network means no activation.
• Existing unlimited licenses remain valid (no quota fields = unlimited).

Scoped path scan + three data-safety fixes

• ext4 scoped path scan: only the selected subtree; other file systems are rejected explicitly.
• Directory-source exports preserve the subtree; same-name conflicts are never overwritten, with _2 / _3 suffixes inside a group.
• Fixes: exports no longer delete existing destination files; symlink write-through rejected; resume no longer silently falls back to a full scan.

Rebrand: xiaodun → ssd

• Android package xyz.erik.ssd, macOS com.erik.ssd, Linux package ssd; system path /usr/libexec/ssd.
• New “recover from folder” (dir: source, contract v1.12) and Chinese / English UI.
• Local-device recovery path connected; app icon unified as the mascot on all platforms.

M3 productization + M5 write-back complete

• Offline signed licenses, trial quota, update check, static manifest, nine-gate release checklist, release pipeline.
• xd-writer, byte-level undo, read-only allowlist, xd-cli; write-surface symbol gate in CI.
• f2fs engine, APFS snapshot surface, ext4 / NTFS hardening, carving quality gate.

Desktop trio: NTFS / ext4, platform closure, installers

• NTFS scan, unused-record recovery, $Bitmap grading; ext4 jbd2 journal overlay (kernel-delete e2e in CI).
• MP4 / PDF carving; home-page elevation entry, Windows volume-number same-disk check, macOS IOKit whole-disk ownership.
• Packaging matrix arm64 + x64: macOS dual-arch zip, Windows portable zip, Linux deb; unsigned packages.

Platform closure: elevated sessions and installers

• TCP loopback elevated session (0600 token, constant-time compare, owner-pid supervision, idle self-exit); Linux pkexec / Windows UAC / macOS osascript.
• Windows SetupAPI enumeration + read-only handles; macOS /dev/diskN enumeration + FDA hint.
• Windows portable zip and macOS staged zip (CI on demand); signing / notarization moved to M2.

Orchestration and carving + three-page UI + export

• Contract v1 scan event stream, task state machine, crash isolation, SQLite WAL streaming, resume.
• JPEG / PNG carving, unallocated-region deep scan, recovery-rate gate (100% on synthetic images, 0 false positives in CI).
• Chunked reads and dropped-privilege export worker; scan / results / preview / recover pages against the real daemon.

FAT / exFAT engines + Linux platform layer

• FAT12/16/32 read-only engine: BPB, SFN + LFN, deleted-file recovery, quality grading.
• exFAT read-only engine: directory-entry set validation, NoFatChain contiguous reads; external oracle cross-checks.
• Linux sysfs enumeration, read-only backend, udev uaccess + polkit elevation, deb packaging.

Contract, read-only device abstraction, end-to-end handshake

• xd-core JSON-RPC envelope, xd-device read-only block-device abstraction + image backend, xd-daemon stdio service.
• Contract v0 frozen + 5 golden cases; Flutter protocol models, IpcCoreClient, device list page.
• Mascot integrated into the UI, app icons on three platforms, daemon banner; Rust 21 · Flutter 10 tests.