feat: Notro v2.11.0 candidate — media UX, portability and release QA

[writingdeveloper]

Notro v2.11.0 — Draft for review, NOT ready for public release

This PR implements an independent Windows clipboard/media picker companion.
REA is developer-only offline research, not embedded in or started by Notro.
No Discord client patching, injection, private IPC, account token or user
messages. Do not claim Discord affiliation or guaranteed Terms compliance.

Product changes

• Updated Discord free attachment default to 20MB; Nitro Basic up to 50MB,
  optional Nitro 1GB preset with conservative decimal-byte ceiling; legacy
  10MB/500MB presets remain.
• Safe upload boundary/real-pixel compression, watched JPEG files, improved
  first-run picker and Windows focus/auto-send protection. Auto-send OFF by default.
• User-initiated emoji/sticker/GIF portable ZIP packs, duplicate detection,
  file preflight, and private Captures exclusion. Native Save/Open dialog tested.
• Opt-in animated GIF before/after comparison and confirmation, preserving
  original file/timing, no silent auto-send.
• Separate opt-in JSON settings backup/restore with review confirmation,
  sensitive watched-folder paths OFF by default, no account data/media,
  auto-send and auto-capture forced OFF after restoration.
• EN/KO/JA/ZH/ES README and in-app strings; ethical launch copy, privacy
  disclosures, source-compatible REA audit and no-signing policy.
• Contributor onboarding, PR review checklist, reproducible test harness,
  pinned PyInstaller build tools, automated pip-audit, origin/main-tag ancestry
  guard and manual GitHub hosted-runner unsigned installer QA.

Reproducible evidence (as of 2026-10-17)

• Latest source: 64ab145 (docs after tested candidate 413623c).
• 449 local tests, Python Ruff clean; Windows CI on 413623c PASSED.
• Python dependency audit and CI 20MB off-by-one, padded and real high-entropy
  27MB PNG-to-WebP preflight PASSED. A separate generated 5-second 960x540
  video with audio -> 854x480 encode + 2sec trim/mute real ffmpeg PASSED.
• Native real Windows WebView2 fixtures: five localized languages, ZIP drop,
  animated GIF preview and cancel/approval through inert controller, 5k
  synthetic-image DOM; native Windows Save/Open dialogs including Korean ZIP
  and JSON filenames: eight isolated stages PASSED.
• Manual unsigned QA workflow run 39058080501 PASSED:
  actual public v2.10.3 release checksum verified, disposable Windows runner
  installed v2.10.3 and upgraded to candidate 2.11.0; a synthetic local
  profile marker survived the upgrade and uninstallation. Release publishing
  was SKIPPED. No user's PC or Discord client was installed/altered.
• Downloaded the 3-day QA artifact to an isolated temporary folder without
  executing it on the user's machine: NotroSetup.exe 17,196,309 bytes,
  SHA-256 df91f3e77b7e81405511f767ef7f2f6f3a0c1f376f5c96d0b75f56680671ba73
  (checksum manifest matches); VersionInfo 2.11.0, Authenticode NotSigned.
• The public latest release remains v2.10.3; this v2.11.0 PR is Draft,
  unmerged. Source main and active user app are unchanged.
• Plane soursea / NOTRO: 26 issues, Done 4, QA 12, In Progress 1,
  To Do 5, Backlog 4. Sign-related NOTRO-6/22 deferred; user opted out.

Mandatory NO-GO blockers for public marketing

1. Real Windows 10/11 GUI first-run, tray, keyboard/focus and no-network tests,
   plus real Discord desktop unsent attachment previews with PNG/JPG/GIF.
   The runner success does not prove these experiences or SmartScreen behavior.
2. Public website writingdeveloper.blog/projects/notro still publishes outdated
   free-10MB/v2.0 and blanket Terms-safety copy. The separate
   portfolio landing Draft PR #36
   fails the portfolio dependency npm audit, and security Draft PR #33 also
   remains failing. Do not bypass audits or overwrite other agents' worktrees.
3. Current docs/demo.gif and picker.png include recognizable third-party media.
   Public advertising needs documented redistribution rights or genuine
   Notro footage with media the maintainer has permission to distribute.
4. Human approval for merge, version-matched unsigned public download and
   checksum, release notes/installation/disclosures, small opt-in beta and
   only later non-spam community launch. Never mass-post; HN forbids
   AI-generated submission/comment text and automated posting.

Documentation:

• Readiness verdict / evidence
• Manual Windows acceptance checklist
• REA static, read-only Discord investigation
• Privacy and security

Never merge/tag/publish automatically from this PR. Signing has been
explicitly excluded by the user. Future unsigned installer warnings must be
disclosed rather than bypassed.

2026-10-17 additional QA: owned native picker demo and real Windows clipboard

• The five README hero animations now use a 15.9-second nine-scene capture of the actual Windows CoreWebView2 Notro picker. All 25 test media icons/animations are original Pillow geometric artwork from an isolated temp library, not imported anime or Discord assets.
• Owned UI still image and regeneration/provenance details. Capture uses CoreWebView2.CapturePreviewAsync only on its own control, never desktop capture, live chats or user account data. It is an isolated source-app UI demo, NOT installed EXE or live Discord upload evidence.
• Visual QA found the original fixture had read a real HKCU auto-send setting: the test fixture is now hardened to intercept all registry setting reads/writes and explicitly assert auto-send/capture OFF before capture. No user's setting was changed and no automated message was sent.
• Commit fa3aff1: 454 local regression tests passed, Ruff/JS clean, Windows CI 39072813556 PASSED. Added 4 demo quality/README source tests and isolated native Windows UI smoke check.
• Manual unsigned workflow 39072830662 PASSED, including actual Win32 CF_HDROP Hangul file path, Unicode text, Notro clipboard marker, stale-sequence overwrite guard, runner cleanup, the pinned EXE/Inno installer, verified published v2.10.3-to-candidate v2.11.0 upgrade preserving a synthetic profile, and uninstall.
• Verified the QA installer on @4080 without executing it: 17,199,943 bytes, SHA256 d8ce5174c3e5462d03cc3f524a6bf861560becaf36ef91b1e8e6f399bf0b1848 (matches published same-run manifest), version 2.11.0, Authenticode NotSigned. Public release skipped and v2.10.3 stays latest.
• Plane NOTRO (28 issues): Done 6, QA 12, In Progress 2, To Do 4, Backlog 4. New NOTRO-27 owned UI demo and NOTRO-28 Win32 native clipboard gate marked Done; NOTRO-25 full marketing evidence remains In Progress and NOTRO-5 actual unsent Discord attachment remains In Progress.
• Public v2.11.0 release remains NO-GO pending actual consented Discord non-sending draft, Windows 10/11 human GUI install and offline coverage, portfolio landing PR #36 dependency security audit/deployment, authentic approved end-to-end media evidence and human release approval. Signing excluded by user decision. No main merge/tag, public promotion, or real Discord messages.

2026-10-17: paste safety hardening and validation-first growth research

• Code source e0e0d70 + follow-up 77689d6: PickerController now verifies the original window before writing clipboard, guards both CF_HDROP and copied URL/text against a newer clipboard sequence, rechecks focus after writing, and tests actual Win32 SendInput acceptance before reporting paste. The return value does not guarantee recipient-app attachment. New EN/KO/JA/ZH/ES notices, documentation and unit regressions.
• GitHub Windows CI 39075255709 PASSED: 465 tests, Ruff, dependency audit and media preflight.
• Manual QA run 39075263021 PASSED: independently owned Tk Windows foreground window received actual Notro Ctrl+V with Hangul CF_HDROP path; target-loss and later-copy scenarios preserved existing clipboard. Log: foreground_file_ctrl_v=true, lost_target_preserved=true, newer_copy_preserved=true, auto_send_called=false, passed=true, errors=[]. No Discord messages or live user clipboard were touched. Same run passed verified v2.10.3→v2.11.0 temporary-runner upgrade, uninstaller, SHA256 and unsigned QA artifact upload; public release skipped.
• Independently verified the unsigned QA installer without executing it on the user's PC: 17,199,014 bytes, SHA256 2529718fe90e54b28a8fc96ca03915ebc050bc033f5d9238f055e5580c8e888c (manifest matches), version 2.11.0, Authenticode NotSigned.
• Parallel competitor/positioning and consent-first growth research: comparison with ShareX, PowerToys Advanced Paste, Vencord FakeNitro and independent emoji pickers; proposes personal media-library/hotkey-first message, screenshot compression second, no false "free Nitro/native emoji" promises. Baseline 2026-10-17 GitHub API: 0 stars, 35 v2.10.3 installer asset downloads (NOT active users), 13 views/8 uniques in reported two-week window.
• Voluntary beta task scorecard: 5–10 consented users with local privacy-safe notes. No users recruited or contacted, no advertising, no external promotion, no analytics/telemetry installed.
• Plane soursea/NOTRO now 31 issues (Done 8, QA 12, In Progress 2, To Do 5, Backlog 4). Research NOTRO-30 and isolated owned-window paste NOTRO-29 Done; opt-in beta outreach NOTRO-31 To Do. The real Discord non-sending draft P0 (NOTRO-5), Windows 10/11 human GUI, audited portfolio landing PR #36 and version-matched publication remain NO-GO blockers.
• Source HEAD 6f2a7a6 adds evidence/docs only over verified core source; latest CI pending at writing time. Draft PR remains unmerged, public latest is v2.10.3, signing deliberately excluded. No Discord client patch, REA runtime, production tag or public release.

October 17: installed v2.11.0 EXE first-run and Product Hunt ROI review

• Source 0f4606c: new disposable GitHub Windows runner script launched the actually installed, unsigned v2.11.0 Notro.exe, after upgrading from verified public v2.10.3. It observed a visible first-run Notro welcome, a created hidden Notro Picker native window, live process, runner-only isolated APPDATA, welcome flag set, auto-send/capture OFF and startup registration unchanged; terminated only its own process tree.
• GitHub Windows CI 39076986269 PASSED with 466 local/remote unit tests and dependency audit. Manual unsigned QA build 39077002020 PASSED with NOTRO_INSTALLED_EXE_FIRST_RUN_QA: passed=true, errors=[]; previous real own-window paste, v2.10.3-to-v2.11.0 upgrade/data-preservation/uninstall all PASS. Public release publishing skipped.
• Artifact downloaded for independent integrity examination without running it on the user's PC: NotroSetup.exe 17,203,616 bytes, SHA256 b6f8ac78eae51c25a77cafda6f217351d8ce58fb750629e8e771e469dbd94cb7, checksum manifest matches, ProductVersion 2.11.0, Authenticode NotSigned.
• Updated 2026 Product Hunt effectiveness report: Product Hunt self-reported Q2 2026 platform launches 2,345 vs 1,508 in Q2 2025; individual Oct/July/Jan 2026 founder stories show poor or highly variable real acquisition despite votes. Platform is active but Notro should defer it as primary acquisition; opt-in 5–10 actual Windows/Discord users and audited/released website first, then optionally free 2–4-hour launch-page experiment. No upvote solicitation/ad spend/automated posts.
• Plane now 33 issues (Done 10, QA 12, In Progress 2, To Do 5, Backlog 4): NOTRO-32 disposable real installed-EXE first run and NOTRO-33 Product Hunt research Done.
• Source HEAD d1b736c includes research/evidence docs only beyond the verified tested source. Still NO-GO for public v2.11.0 release/marketing until human Windows 10/11 GUI, actual Discord unsent attachment/focus, secure bilingual portfolio landing (audit PR #36/#33 still failing) and human maintainer release review.
• Signing explicitly excluded. No main merge, published v2.11.0, user PC install, private account access, actual Discord message or public promotional post.

October 17: branded notification-area menu and About — QA verified

• User request implemented, source commit 461db39, evidence commit fd75562: an owned Windows Edge WebView2 popup opens from Notro's notification-area icon WM_RBUTTONUP using a dark #17191f/blurple #5865f2 interface, status, picker, pause/resume, local library, 10/20/50/500MB/1GB size presets, hotkey, EN/KO/JA/ZH/ES languages, startup, update and quit. When the web bridge isn't ready or WebView2 isn't available the classic native Windows context menu remains intact, including an accessible native About command.
• About page: current v2.11.0 candidate version from real app package metadata, supported Windows, Edge WebView2, publisher writingdeveloper, MIT, GitHub/release/issue/license links (explicit allowlist), unsigned and not-Discord-endorsed disclosure. The repository shortcut is available immediately, not buried under scrolling.
• Actual native Windows QA passed: Notro tray preview and About preview captured from the owned CoreWebView2 surface, no desktop/user clipboard/chat content. scripts/qa_native_tray_panel.py reports native_webview2=true, about_version/github/unsigned=true, rightclick/settings/ESC/picker/fallback=true, errors=[], passed=true. Fixed actual pywebview/WinForms Window.move ArgumentError by using private WinDLL SetWindowPos on ONLY the popup's HWND.
• Windows CI 39085969840 PASS with 485 tests, Ruff and pip-audit; manual unsigned hosted runner 39085985603 PASS: public v2.10.3 → candidate v2.11.0 upgrade, synthetic data preserved, installed EXE launched and created hidden Notro Tray Menu, hidden Notro Picker, visible welcome; no auto-send/capture, startup unchanged, uninstall successful. Release publish skipped.
• Independently checksum-verified same-run QA installer on @4080 (NOT executed there): 17,215,650 bytes, SHA256 62593f9b66f5ae6e568ef14b6b674c68934a69523e2f860d70503b8c85c23169, version 2.11.0, Authenticode NotSigned. Public latest remains v2.10.3.
• Plane soursea/NOTRO 35 issues: About NOTRO-34 and styled tray NOTRO-35 now Done (source/native/packaged QA). Real Windows 10/11 human notification-area behavior, DPI/SmartScreen/keyboard acceptance remains NOTRO-24; actual consented unsent Discord attachment remains NOTRO-5; landing portfolio dependency audit in PR #36 remains a P0 blocker.
• Still a Draft PR, not a public release. No signing (user opted out), GitHub main merge, public marketing, Discord modifications or account/chat access.

Detailed reproducible QA report

2026-10-17 final tray DPI, installed EXE click and portfolio audit triage

• Exact source c7248b3 verified: physical Windows 200%-DPI custom tray popup now multiplies logical 362×532 DIP by the native HWND's DPI (192/96 = 2), yielding a correctly sized 724×1064 physical Win32 window. Local native WebView2 QA also PASS for five languages, keyboard GitHub link, 100%/125%/150% simulated text zoom, compact 330×420 window scroll, native About localization/fallback; production popup checks the HWND is owned by its own Notro process before positioning it. 494 local/remote tests passed.
• Source CI 39093635986 PASSED. Exact-source disposable Windows unsigned QA 39093633727 PASSED, including v2.10.3→v2.11.0 upgrade, preserved synthetic profile, first-run welcome and picker, independent returning-user restart with real Notro pystray HWND WM_NOTIFY/WM_RBUTTONUP open AND close, auto-send/capture OFF, unchanged startup and uninstall. The two prior attempts failed only the first-run-modal test sequencing; fixed QA by separating first run and returning user.
• Independently downloaded same-run unsigned QA artifact to temporary @4080 storage without installing: 17,222,275-byte NotroSetup.exe, SHA256 c122cf31b40607faa7b5e9ff2f6075cfbc72f47ff0634cbe990cdc519240e360 matches manifest, ProductVersion 2.11.0, Authenticode NotSigned. Public release remains v2.10.3; publish release was SKIPPED. No signing per user request.
• Plane NOTRO now 38 issues: Done 15, QA 12, In Progress 2, To Do 5, Backlog 4. NOTRO-36 installed systray open/close, NOTRO-37 DPI/locales, NOTRO-38 isolated portfolio security triage DONE. Human Windows10/11 actual mouse + mixed monitor, SmartScreen, no-WebView2 fallback NOTRO-24 remain To Do; consented real Discord UNSENT attachment NOTRO-5 In Progress; audited bilingual public portfolio landing NOTRO-16 To Do.
• Portfolio isolated full-audit triage: Draft portfolio PR #33 production build/audit pass but full npm audit fails five HIGH dev-lint transitive eslint-config-next → fast-glob → micromatch → braces 3.0.3 advisories; no patched npm version at check time. Kept security gate intact and other portfolio sessions/worktrees untouched.
• Final evidence commit 1c5a730 updates QA and Plane ledger only; candidate remains DRAFT, user declined signing; no main merge, real Discord message, public installer release, marketing blast or personal clipboard access.