# Release 0.5.3

Branch: `release-0-5-3` → `main`

PR 9 of the review fixes plan (`docs/review-fixes-plan.md`): the 0.5.3 release of PRs 5–8 and 8b. After the merge, the merge commit is tagged `v0.5.3` ("MPCkit 0.5.3 (beta)").

## What's new in 0.5.3 (for beta testers)

0.5.3 is a hardening release. Projects from 0.5.2 open as before, and the files MPCkit exports are byte-for-byte the same as before for the same edits.

**You'll notice**
- **Pad labels are now "A1", "B2", … "H16"** instead of "A01", "B02", everywhere: the pad and sequence grids, the side panels, the move/copy picker and the confirm dialogs. One format everywhere, the same as MPCkit's command-line tool. Sequence names such as "Sequence 01" are unchanged, because that is how the device names them.
- **Declining to replace an export forgets the folder or file you picked.** The next export asks again.

**Safer under the hood**
- **A failed edit no longer leaves a project half-changed**, for example on a project file with an unusual pad layout. A failed tune, mute-group or sequence edit no longer marks the project as having unsaved changes.
- **The window's code can no longer load, assign or export using a file path of its own.** MPCkit only opens and writes files you picked in a dialog or dropped on a pad.
- **Builds are reproducible:**
  - the frontend's package versions are locked;
  - npm won't pick a package version published in the last 7 days;
  - unused server-mode and Docker build options are gone.

## What changed

- **Version 0.5.3** in every file the README's "Releasing" paragraph lists:
  - `APP_VERSION` in `Taskfile.yml`, and `version` in `build/config.yml`;
  - Windows: `build/windows/info.json` (four places), `wails.exe.manifest` and `nsis/wails_tools.nsh`;
  - macOS: `build/darwin/Info.plist` and `Info.dev.plist` (two places each);
  - Linux: `build/linux/nfpm/nfpm.yaml`.
- **Examples updated:** the `Version` comment's example in `internal/app/app.go`, and the README's About example.
- **No toolchain change:** `go.mod` keeps `toolchain go1.27.4` from 0.5.2, and `govulncheck` still finds nothing.

**PRs in this release:**

| PR | Branch | Findings fixed | What it did |
| --- | --- | --- | --- |
| 5 | `unbind-paths` | S4 | Export goes where the dialog chose; no bound method takes a path. |
| 6 | `atomic-edits` | M3, M4 | Edits are all-or-nothing; project state is only written by `project`. |
| 7 | `a1-labels` | M6 | "A1" labels everywhere. |
| 8 | `build-cleanup` | S6 (without CI), M7, M8, R1 | Lockfile, `.npmrc` `min-release-age=7`, no server, Docker or cross-compile tasks, config clean-up, unused `Version()` removed. |
| 8b | `bound-surface` | S4 (rest) | Go-only methods on an unbound `Host`, bound methods pinned by `TestBoundMethods`, and `CancelExport`. |

## Notes

- **The review's open items** are in the plan's Backlog: S5, M9–M11 and R2–R7. None of them blocks this release.
- **Open question 7 is unrelated to these fixes and still open:** whether `currentSequence` holds a slot or a list position.

## Testing

**On the server, every command with `GOTOOLCHAIN=go1.27.4`:**
- `go test ./...` passes.
- `go vet ./...` (also with `GOOS=windows`) and `staticcheck ./...` are clean.
- **`govulncheck ./...`: "No vulnerabilities found."**
- In `frontend`: `npm ci`, `npm run check` (0 errors, 0 warnings) and `npm run build`.
- `wails3 build` builds. `go version bin/mpckit` says `go1.27.4`, the binary carries version `0.5.3`, and it starts under Xvfb.

**On the laptop (PowerShell, in the repo):**
1. `git fetch; git checkout release-0-5-3`
2. `wails3 build`, then run `bin\mpckit.exe`. About shows "Version 0.5.3" and a Build line.
3. Properties → Details of `bin\mpckit.exe`: product version 0.5.3.
4. `go version bin\mpckit.exe`: `go1.27.4`.
5. Quick tour:
   - load `testdata\device\DemoFile.xpj`: the pads show "A1"-style labels;
   - preview a pad;
   - export to a folder, then export again and choose Cancel at "Replace existing files?".
6. Optional: `go run golang.org/x/vuln/cmd/govulncheck@latest ./...` reports "No vulnerabilities found."