Desktop 0.1.6: signed updates on both OSes, without wiping Windows

0.1.5 capped what MCP tools send back. The Desktop sidecar was still writing access rows with no size, and cutting a release still meant a pile of one-off scripts. 0.1.6 closes the measurement gap on the sidecar, puts Codemagic next to the social tools on meronq-local, and — after we broke Windows Check for updates on the first 0.1.6 macOS publish — stops a macOS-only latest.json from erasing the other OS.

This is a Desktop release, not a sprint close. Sprint 24 (Desktop UI shell) is still open.

The sidecar finally records response_bytes

Handshake, memory, and related sidecar routes now call recordSizedAccess after the payload exists and after SQLite is closed — the same path MCP tools use. 0.1.5 put a ceiling on MCP answers; the Desktop client was still writing access events without a size, which is how hundreds of handshake rows held almost no measurements.

A leftover 0.1.0 on handshake / init / feedback is gone; those routes report desktopAppVersion(). A duplicate import block in handlers.ts compiled under tsx/esbuild and would have failed tsc. Removed.

A playbook next to JSON Project Skills

skill_propose / skill_apply (ADR-0024) sit beside skill_list's JSON Project Skills. Handshake names skill_propose when no marked playbook exists; handshake does not write files. Custom .skill.json kind: command stays locked in v0 — do not invent pnpm or Codemagic workflows there.

Deploy tools, not a renamed leftover

The old social publishing module is now deploy. meronq-local exposes Codemagic (codemagic_apps, codemagic_builds, codemagic_start_build) and desktop_cdn_status next to Discord / Telegram / dev.to / LinkedIn. Opt-in is MERONQ_DEPLOY_TOOLS (legacy MERONQ_SOCIAL_TOOLS). The product meronq server never reads .env.social.

Playbook: .cursor/skills/meronq-deploy. Tag desktop-v0.1.6 is what Codemagic desktop-mac-publish listens for. Windows still ships from a machine with .env.release via pnpm desktop:release.

What Check for updates actually looks up

Tauri 2 on Windows asks for windows-x86_64-nsis first, then windows-x86_64. Codemagic published a signed 0.1.6 darwin-only latest.json and replaced the channel file. Windows then failed with:

None of the fallback platforms ["windows-x86_64-nsis", "windows-x86_64"] were found

Copying 0.1.5 Windows bits into a 0.1.6 version field would have been worse: existing Windows installs would loop on a same-version "update". The fix is same-version merge, an nsis alias of the Windows payload, a versioned desktop/stable/{version}/latest.json so the second OS can merge even if the channel file was left alone, and a guard that does not replace channel latest.json when a new version would drop Windows or darwin.

desktop_cdn_status probes that public CDN. The website /download/ is static aliases into R2 — a Desktop version bump does not need a Pages rebuild.

Getting it

• Windows: installer. Existing installs update in place.
• macOS: Apple silicon · Intel. These builds are signed for the updater — in-app updates apply on both OSes when latest.json lists them.

What did not ship

Sprint 24's UI shell (sidebar, Assistants screen, map island) is not in this tag. ADR-0022 (documents Meronq leaves in the project) is still Proposed. Hashnode distribution is still blocked without a publication id.