Every release,
in order.

Motion taken back out where it was getting in the way.

• Switching between Live, Source, and Split is instant again. Several animated versions were tried and every one was worse — the two views are the same sheet in the same place, so a transition depicts a change that isn’t happening.
• Fixed the save indicator getting stuck on the unsaved dot next to a “Saved” label.
• The unsaved dot is smaller, so it reads as a marker rather than a bullet.
• The download page now offers the Windows and Linux builds directly, with the SmartScreen prompt on unsigned Windows installers spelled out up front.

A shared motion system — the app now moves as one piece.

• A single motion system behind fifteen signature interactions, replacing per-component one-offs.
• Panes, style pills, and the page colour now transition instead of snapping.
• The segmented-control thumb slides, from one shared component used everywhere.
• Staggered reveals removed — they read as slow rather than considered.
• Version history builds its file log and diff off the main thread, so opening history no longer stalls the window.
• Fixed the what’s-new note deleting itself when you hovered it.
• Signed apt and dnf repositories now published for Linux.

Export fidelity, and finer control over images and lists in the editor.

• Code themes and image sizing now match across PDF, Word, and HTML export.
• Editor zoom plus new list and image controls.
• Fixed multi-second slowness when opening the export window.
• Fixed image layout shift, lightbox panning, and lost scroll position.
• Restored select-all copy and the code-block selection highlight.

Windows joins the release matrix, alongside native arm64 Linux.

• Windows builds for x86_64 and arm64, shipped as installers on every release.
• Native arm64 Linux build added to the matrix.
• Windows: the Settings window shows its title band at the top.

A native Linux build, and the OS accent colour everywhere.

• Linux bring-up: client-side decorations, a frameless rounded window, and in-app window controls.
• Ampersand now adopts your operating system’s accent colour — on Linux, Windows, and macOS.
• The Settings sidebar gained an identity row with the logo and the running app version.
• A long list of Linux chrome fixes: sidebar and doc-panel alignment, modal overlays, rounded overlay backdrops, the Export and Quick Capture windows, tray icon contrast.
• Fixed a crash when opening the export window (an empty Radix Select value).
• Copy that assumed a Mac is now platform-aware on Windows and Linux.
• Tab tear-off is disabled on Linux — a Wayland cursor limitation, documented rather than half-working.

Published notes can now be gated — by password, or by email.

• Password-protect a published note from the publish flow.
• Email allowlist gate: only the addresses you name can open the page, verified by an access code.
• The access-code email is branded, comes from a named sender, and embeds the real mark.
• Editing a published note’s recipients is now discoverable, with Sharing settings in the Shared menu.
• Allowlist retention is bounded by the note’s expiry, and the privacy copy corrected to match.
• Replaced the last native selects in the app with the Radix Select used everywhere else.

Publish a note to a secret web link — plus an in-app inbox, and the first anonymous usage count.

• Publish any note to a secret, unguessable link on ampersand.page. Unpublishing only ever needs the link’s secret, never a valid licence.
• Links expire after 90 days by default, and every published page is unconditionally noindex.
• A published-notes manager lists every live link, including orphans whose local file is gone.
• On-brand status pages, share images, and an apex redirect for the share domain.
• In-app notifications: a titlebar bell and inbox, fed by a hosted feed, so a notice can reach you without an app update.
• Anonymous usage telemetry — one daily ping with an install id, version, OS, tier, and a note count. No content, no paths, no keys; opt out in Settings.
• Groundwork for Windows: platform-aware path validation, shortcuts, and window chrome.
• The end-to-end test suite landed — browser-mode Playwright over a mocked Tauri IPC layer, plus a real-binary macOS smoke suite.

A way back into an encrypted vault, and search that reaches inside it.

• Passphrase recovery kit: a generated recovery code that can unlock the vault and force a passphrase reset if you forget yours.
• Vault search now looks inside encrypted notes while the vault is unlocked. Locked, they stay invisible.
• Table column widths survive a round-trip — un-resized tables still serialize as byte-identical markdown.
• Bookmark auto-unfurl, off by default, because each unfurl reveals a request to the pasted domain.
• Several bookmark-card image layout fixes.

The agent reads the web more reliably.

• The agent is re-prompted after fetching a URL, so it acts on what it read.
• Falls back to a site’s /llms.txt when a page is bot-walled.

• Text in the agent transcript can be selected and copied.

The agent can fetch a web page.

• New fetch_url tool — the agent can pull a page into context.
• Dragging the last tab out of a window now closes the window it came from.
• Fixed stray text selection in the editor while dragging a tab.

What happens when something goes wrong — logging, crash recovery, and a way to tell us.

• Structured local logging with daily rotation and crash markers. Nothing is transmitted; the logs stay on your machine.
• Frontend error capture and a per-window error boundary, so a render error shows a recoverable screen rather than a blank one.
• A redacted diagnostics bundle you preview in full before it is written — paths, keys, and secrets scrubbed.
• Crash-loop detection with a Safe Mode that defers session restore instead of discarding it.
• A "Report a problem" path that prefills the facts and never sends anything on its own.
• Internally: the 5,400-line App component was decomposed into 21 focused controller hooks, with no behaviour change.
• Fixed a long-standing flaky test caused by a process-id reuse race.

Export layout and markdown round-trip fixes.

• PDF export keeps a lead-in heading or paragraph glued to the block it introduces.
• The markdown deserializer no longer duplicates equivalent nested marks.
• The export window reopens at the editor’s top edge.
• Fixed selection-toolbar timing, and added a highlight for the agent’s current selection.
• Default Claude model bumped to Sonnet 5, and provider error detail is no longer swallowed.

• CLI agent output preserves line breaks and blank lines.
• CLI presets use `codex exec` rather than the interactive TUI.

• Settings scroll position resets when you switch tabs.
• Fixed the document-actions inset with the sidebar collapsed.

A new smart block.

• Tufte-style ASCII chart smart block, with export support.
• Smart blocks share one resize and align shell.

• Build-pipeline release. No user-facing changes.

• Dragging titlebar tabs no longer selects text behind them.

• The About screen reads the running app version at runtime.

Ask AI to write, inline — and tables that behave.

• An inline "Ask AI to write" slash command that streams into the document.
• Table formula results are styled, and Enter moves down a row instead of splitting the cell.
• Tables get rounded corners with clean single-width borders.
• Smart blocks and table formulas deselect when you click away.
• CLI agent tools now work when Ampersand is launched from the Dock, by recovering the login shell PATH.

• Colour and layout consistency fixes across the light theme and the marketing site.

A proper first launch.

• First-run onboarding dialog.
• A small celebration when a licence activates.

• Shared download button across the site; disk-image window sizing fix.

• Disk-image installer background and download options.

• Custom disk-image background, with the layout preserved across updates.

• Release-pipeline fix. No user-facing changes.

• Release-pipeline fix. No user-facing changes.

• Search panel error handling and state cleanup; release-pipeline fixes.

• Toolchain and lint modernization across the codebase. No user-facing changes.

The first public build — the whole editor, shipped.

• A native macOS block editor built on Rust, Tauri, and TipTap, over plain .md files with optional YAML frontmatter.
• Smart blocks: diagrams, charts, math, and live calculation, all round-tripping to markdown.
• Tables with spreadsheet formulas, wiki-links and backlinks, tags, and templates.
• Bring-your-own-key AI across Claude, OpenAI, Apple Intelligence, local models via Ollama, and CLI agents — plus agent mode with file attachments.
• Export to PDF, Word, HTML, and Markdown.
• Per-vault version history with restore, and per-note encryption unlockable with Touch ID.
• Vault-wide search, a command palette, quick capture, a menu-bar tray, and customizable shortcuts.
• Import from Obsidian, Notion, Word, and any folder of markdown.
• Signed, notarized builds with a silent background auto-updater.