Index: open questions from the recent fix series, and where things stand

[PathGao]

@alecdotdev — I've been working through a backlog of defects over the last stretch and there are now a handful of decisions that are yours rather than mine. Rather than pinging you on each one, here is a single index. Nothing here is urgent and nothing needs a long reply — a one-line "yes/no/not now" on any of them is enough, and I'm happy to implement whichever way you point.

Decisions I'd like your call on

	Question
#390	⌘Q discards the session snapshot while the red X keeps it, and quit only closes the focused window. Both live in appExit(), so they're one decision. My reading is that the discard is deliberate — the confirm dialog literally promises it — but that dialog only appears when a tab is dirty, so most people never see the sentence that explains the design.
#391	Undo history is destroyed on every tab switch, because one Monaco model is shared by all tabs and setValue clears the undo stack by definition. Fix is one model per tab (Monaco's intended usage), but it changes observable behaviour and adds model lifetime management.
#392	Ctrl+T means three different things across platforms, and the Home tab it opens on Windows/Linux renders blank.
#393	Monaco's defaults were never audited — that's why fullwidth CJK punctuation gets outlined (#186, #94) and why Vim's whole z family is dead (#104). Offering to bring a list before touching anything.
#394	img-src https: means opening an untrusted .md can silently contact a third party; assetProtocol.scope: ["**"] exposes the filesystem. Both look like deliberate trade-offs — I'd like to know if they are, so they can be recorded as such.
#395	The portable and installer .exe are the same binary distinguished by filename, and re-running the installer after installing silently opens the app instead of offering Repair/Uninstall.
#368	Undo deletes pasted/dropped images permanently, and sometimes the wrong one. Three separate defects; I closed my own PR for it because the prior question is whether that deletion should exist at all. Obsidian and Typora keep the file and make orphan cleanup an explicit command.
#372	Non-UTF-8 documents. #379 has landed the stop-loss (they open, but saving over the original is refused), so nothing is destroyed now. The open question is whether you want real encoding detection, which means a new dependency.
#373	Saving a read-only file: hard error, or a "this file is read-only, overwrite?" prompt like VS Code. #371 made all three platforms fail consistently, which removed a capability Unix users had.
#385	Three stale statements in AGENTS.md — most importantly that the frontend has no test framework, when there are 67 test files and CI runs them. Happy to PR it if you'd rather not.

Where the code stands

Roughly 60 commits are on master but unreleased. Several of those fix things people reported (checkbox toggling, preview width, Ctrl+O, PDF layout), so a release would let reporters confirm on their own machines rather than taking my word for it.

I've deliberately not closed any issue, even where the fix looks complete — I'd rather the reporter confirms against a build than have me close it from reading the code. I'll comment on the relevant ones with what changed and which PR did it.

Two more things worth flagging, neither needing a decision:

• [Bug] Incorrect parsing and rendering for multi-line aligned LaTeX formulas (nabla vector calculus formulas) #197, Math Expression Breaks #177 and math rendering problem with \bar, \vec and possibly others #174 are one bug, not three. comrak runs CommonMark inline rules inside math delimiters, so \\ collapses a multi-line aligned into one line, \% makes KaTeX treat the rest as a comment, and _{1} becomes <em>. The current guard protects only _ and only $$ — the intersection of the three. Masking the whole delimited span before comrak and restoring after fixes all three at once. I'm working on that.
• OS Error 3 #122 has a one-line cause underneath the failure fix(windows): make install and uninstall recoverable #364 made recoverable: create_shortcut never calls create_dir_all, so a missing Desktop or Start Menu directory fails the install outright.

Thanks for merging the recent series — happy to keep going, slow down, or drop anything you'd rather not carry.

[PathGao]

@alecdotdev — a status update, since a lot has landed and the index above has moved.

What went in

50 PRs merged onto master. The ones I would actually want you to know about:

Documents being destroyed. A >50KB file opened as a truncated preview could be written back over the whole document (#374). A non-UTF-8 file opened as mojibake and auto-saved over the original 1.5s later (#379). Dropping two same-named images in the same second silently replaced the first, while the document still linked to it (#383). A failed read during session restore evicted the tab and wrote the trimmed list back, so an unplugged drive lost the tab permanently (#401). Re-opening a file that was already open with unsaved edits discarded them — and cleared the dirty flag, so nothing told the user (#412). Two tabs could hold one path with two auto-save timers writing over each other (#413).

Security. Exported HTML bypassed the sanitizer entirely (#376). The preview never used the shared sanitize policy, so a document's <style> reached the app's own DOM — measured hiding the title bar and fetching a remote beacon (#384). A link could read as http://… in the status bar and open a local file (#415).

Three reports turned out to be one bug. #174, #197 and #177 are all comrak running CommonMark inline rules inside math delimiters — _{1} becoming <em>, \\ eaten so a multi-row aligned collapses to one line, \% eaten so KaTeX treats the rest as a comment. Fixed together in #402 by masking the whole span before comrak instead of patching one character class.

Windows. Install failed outright when the Desktop or Start Menu directory did not exist, which is #122's cause (#400). Uninstall could terminate unrelated processes with the same name (#358). Export inlined no local images at all (#363).

Also: the editor context menu was half English and did not follow a language change; a PDF exported from edit mode was blank; Copy Reference produced a link Markpad itself could not follow; open_path was rejected by the opener scope, so "open the exported file" had never worked.

Two things you may want to weigh in on

A release would be useful. Around 70 commits are on master unreleased, and several fix things people reported — checkbox toggling, preview width, Ctrl+O, PDF layout, scroll sync. I have commented on those issues but closed none of them: I would rather the reporter confirmed against a build than have me close it from reading the code.

The open questions in this issue are still open — #390 through #395, plus #368, #372, #373 and #385. None of them is urgent and a one-line answer on any is enough. Where I could not tell whether something was deliberate, I said so rather than guessing: #390 in particular reads to me like an intentional design that is simply never explained to the user on the path most people take.

Happy to keep going, slow down, or drop anything you would rather not carry.

[alecdotdev]

@PathGao I'll do a full review and test of everything that's hit master tomorrow. in the meantime you can take a break until everythings reviewed and a release is put through.

If you have a rough summary of changes we can use for release notes + screenshots wherever applicable, that'd be great.

cheers!

[PathGao]

Thanks — and sorry about the volume. 120 PRs since v2.6.13 is a lot to hand someone at once, and reviewing it is going to be more work than writing it was. Happy to answer questions on any of it, and equally happy for you to drop anything you'd rather not carry.

Below is a rough cut for release notes, grouped by what a user would notice rather than by PR. (Edited to add ~20 fixes I had left out of the first pass — the Windows "Move to New Window" freeze in particular deserved to be in there.) Cherry-pick freely — I've kept PR numbers on each line so you can drop the ones you don't want to mention. Screenshot suggestions are at the end.

---

Draft release notes

New

• Preview width is configurable — a setting, a shortcut pair to widen/narrow, and the preference persists (Persist a validated preview width preference #346, Apply the preview width preference to layout #347, feat(settings): configure preview content width #348, feat(preview): add width adjustment shortcuts #349)
• Editor toolbar — new icons and a show/hide toggle ( Revamp Editor Toolbar, Toolbar Settings & Table Creation #282)
• Window tags and pinned sessions rebuilt (feat: rebuild window tags and pinned sessions #280)
• Moving tabs between windows rebuilt (feat: rebuild tab movement across windows #279)
• macOS settings menu (Add a minimal macOS Settings menu #339)
• Floating table-of-contents toggle (Make the floating TOC toggle visible in preview mode #331)

Your documents

Six ways a document could be damaged, all closed:

• A file over 50 KB opened as a truncated preview, and saving wrote that preview back over the whole document (fix(documents): stop partial buffers and external changes from destroying work #374)
• A non-UTF-8 file opened as mojibake, and auto-save wrote the mojibake over the original 1.5 s later (fix(documents): refuse to save a buffer that was decoded lossily #379)
• Dropping two images with the same name in the same second silently replaced the first while the document still linked to it (fix(images): never overwrite an image a document already links to #383)
• A read failure during session restore evicted the tab and saved the trimmed list, so an unplugged drive lost the tab permanently (fix(session): stop startup from throwing away tabs it could not read #401)
• Re-opening a file that was already open with unsaved edits discarded them, and cleared the dirty flag so nothing said so (fix(documents): never reload a file over its own unsaved edits #412)
• Two tabs could hold one path with two auto-save timers writing over each other (fix(tabs): one tab per file path #413, fix(tabs): ask the filesystem whether two paths name the same file #416)

Also: a tab moved between windows could end up open in both, each copy with its own auto-save timer writing over the other (#366). Pressing ⌘S while an auto-save was mid-write could leave the older text on disk (#436, #438). Quitting with two tagged windows could lose one window's pinned tags (#424). A stale preview render could overwrite a newer one (#254), and an interrupted session restore left the app unable to recover (#260).

Security

• Exported HTML skipped the sanitizer entirely (fix(export): sanitize exported HTML #376)
• The preview never used the shared sanitize policy, so a document's <style> reached the app's own UI — reproduced hiding the title bar and fetching a remote beacon (fix(preview): route the preview through the shared sanitize contract #384)
• A link could read as http://… everywhere the user can see it and open a local file instead (fix(links): stop a document link from opening a local file through an asset URL #415)
• Imported VS Code theme colours are validated before being injected as CSS (fix(themes): validate imported theme colours before injecting CSS #362), and imported theme slugs are normalized (fix: normalize imported VS Code theme slugs #301)
• Theme and image file paths are constrained to their directories (fix: constrain theme and image file paths #249, fix: restore file-command and VSIX input boundaries #270)
• File IO, decoding and Markdown boundaries hardened on the Rust side (fix(backend): harden file IO, decoding and markdown boundaries #371)

Export and printing

• Exported HTML now contains rendered math, syntax highlighting and Mermaid diagrams instead of raw source (fix(export): render math, highlighting and diagrams into the exported HTML #411)
• Exported HTML carries the theme, and no longer cuts collapsed sections out of the document (fix(export): carry the theme into exported HTML, and stop cutting collapsed sections #382)
• PDF exports are readable in every theme — diagrams no longer come out dark-on-dark (fix(print): keep PDF exports readable in all themes #359)
• A PDF exported from edit mode is no longer blank (fix(print): make an editor-mode PDF export contain the document #407)
• Local images are inlined on Windows (fix(export): inline local images on Windows #363)
• Find highlights no longer print, and collapsed matches are revealed (fix(find): reveal collapsed matches, and keep them out of the PDF #377)
• Print layout: native controls, full page width, and tighter content rhythm (fix(print): use native controls and full page width #329, Refine printed Markdown content rhythm #333)
• The export menu is no longer greyed out for an unsaved document you're editing (fix(export): gate the export menu on the buffer, not the render cache #441)

Editor and preview

• Task checkboxes work in the preview, and the change is written back to the file (fix: enable preview task checkboxes #345, fix(preview): persist task checkbox changes #352)
• Three separate LaTeX reports turned out to be one bug — _{1} becoming italics, \\ being eaten so a multi-row aligned collapses, \% being eaten so KaTeX treats the rest of the line as a comment. All three are comrak applying Markdown inline rules inside math delimiters; fixed by masking the span before parsing rather than patching one character at a time (fix(math): preserve display math subscripts #351, fix(markdown): hide math delimiters from comrak instead of patching characters #402 — closes math rendering problem with \bar, \vec and possibly others #174 / Math Expression Breaks #177 / [Bug] Incorrect parsing and rendering for multi-line aligned LaTeX formulas (nabla vector calculus formulas) #197)
• Escaped dollars stay escaped, and $$…$$ inside a paragraph renders (fix(markdown): keep an escaped dollar escaped, and render display math inside a paragraph #422)
• The editor context menu is fully localized and follows a language change (fix(editor): localize the context menu and stop linkifying URLs in code #381)
• URLs pasted inside code blocks are no longer turned into links (fix(editor): localize the context menu and stop linkifying URLs in code #381)
• Scroll position returns to the block you left, not to a percentage (fix(preview): restore the scroll position to the block it was taken from #420)
• Heading folds are per-document, and are cleared when a tab follows a link to a different file (fix(preview): give each document its own heading fold state #425, fix(tabs): forget a document's folds when the tab is pointed at another one #448)
• A leading --- no longer swallows the paragraph after it (fix(preview): stop a leading --- from swallowing prose, and batch fold measurement #375)
• Copy Reference produces a link Markpad can actually follow (fix(capabilities): give open_path a scope so it can actually run #403)
• Preview works without saving first (fix(editor): show the preview without making the user save first #421)
• ToC jumps use heading source position (Fix duplicate-heading ToC jumps in the editor #335)
• Editor options and keyboard shortcuts now do what their labels claim (fix(editor): wire editor options and shortcuts to what they claim #369)
• Saving works from reading mode (fix(editor): allow saving from reading mode #365)
• "Save image as" works for local images, and says so honestly for remote ones (fix(images): make "Save image as" work for local images and refuse honestly for remote ones #408)
• A relative link to a non-Markdown file resolves against the document instead of the app (fix(links): resolve a relative link to a local file against the document #409, fix(links): stop a document link from opening a local file through an asset URL #415)
• Copy Reference produces a link Markpad can follow (fix(links): make Copy Reference output a working link #380), and "open the exported file" had never worked because the opener plugin had no path scope (fix(capabilities): give open_path a scope so it can actually run #403)
• Live Mode watched the wrong file after a tab switch (fix: route Live Mode changes to the watched file #296)
• YouTube embeds open externally instead of failing in place (fix: open YouTube embeds externally #338)
• Settings: the modal stays draggable (Keep Settings modal drag accessible #312), collapsed toolbar sections are remembered (fix: restore collapsed toolbar settings #286), and every setting syncs across windows instead of the last window overwriting the rest (fix(settings): persist each setting on its own key and sync across windows #370)
• Recent files are merged across windows instead of overwritten (fix(recents): merge the recent-files list instead of overwriting it #405)
• The auto-save failure toast no longer repeats (fix(documents): read through the checked command everywhere, and stop the auto-save toast repeating #406)
• A malformed UTF-8 code fence crashed the renderer (fix: prevent UTF-8 fence scanner panics #265)
• Window titles update natively (fix: allow native window title updates #288); a window created at startup is reused instead of a second one appearing (Reuse the created window handle during startup #318)

Windows

• "Move to New Window" froze the app. create_transfer_window built the window synchronously, and on Windows that deadlocks — WebView2 needs the main thread free to pump messages while the window is created (fix(tabs): stop the tab context menu from leaking and deadlocking #360)
• Right-clicking a tab twice opened the document menu the second time, because the first menu's full-viewport overlay swallowed the click and only called preventDefault() (fix(tabs): stop the tab context menu from leaking and deadlocking #360)
• Install failed outright when the Desktop or Start Menu folder did not exist — this is the cause of the OS Error 3 reports (fix(windows): create the shortcut directory before writing the shortcut #400)
• Uninstall could terminate unrelated processes with the same name (fix(windows): avoid terminating unrelated app instances #358)
• Install and uninstall are recoverable if interrupted (fix(windows): make install and uninstall recoverable #364)
• Markpad no longer registers itself for plain text files (fix: stop associating plain text files #302)
• The Install button stays reachable at large system text sizes (fix(installer): keep the Install button reachable when the window is shorter than the content #428)

macOS

• PDF export did not work at all (fix: enable PDF export on macOS #287)
• Opening several documents at once from Finder kept only one of them (fix: allow opening multiple documents #298, fix: retain all macOS open-document paths #300)
• The editor paste menu was missing (fix: restore editor paste menu and PDF reflow #266)

Performance

• Startup JavaScript down 81 % — Monaco now loads when you open the editor rather than before the first paint. First paint went from 4770 KB to 904 KB; entering edit mode costs ~330 ms once per window (perf(editor): load Monaco when the editor is opened, not at startup #423)
• Mermaid-heavy documents ~12× faster to type in — diagrams are no longer redrawn on every keystroke (2185 ms → 189 ms on a 20-diagram document) (perf(preview): stop redrawing unchanged mermaid diagrams on every keystroke #419)

Under the hood

Around 30 of the PRs are refactors, tests and build work with no user-visible effect: extracting the window/document session logic out of the 4000-line viewer, pinning the Rust↔frontend render protocol, upgrading comrak from 0.18 (2023) to 0.54, and bringing the test suite from 109 to 596 tests. Nothing there needs a release note — mentioning it only if you want a "and a lot of groundwork" line.

---

Screenshots

I don't have any prepared. These are the ones where a screenshot would carry the note better than the sentence does, roughly in order of value — tell me which you want and I'll produce them:

	shot
Preview width (#346–349)	settings panel + a narrow/wide before-after on the same document
Exported HTML (#411)	before/after of the same document — raw E = mc^2 and unhighlighted code vs. rendered
PDF in dark theme (#359)	before/after of a page with a Mermaid diagram
Editor toolbar (#282)	the toolbar, and the show/hide toggle
Window tags / pinned sessions (#280)	the tag UI
Floating ToC toggle (#331)	before/after
Installer at 125 % text (#428)	before/after — this one is the clearest single before/after in the set

The two performance items are numbers rather than pictures; a DevTools network panel before/after would work for #423 if you want one.

---

One thing worth deciding before the release

I've commented on the reported issues this fixes — checkbox toggling, preview width, Ctrl+O, PDF layout, scroll sync — but closed none of them, on the grounds that the reporter should confirm against a build rather than have me close it from reading the code. I closed exactly one (#319), and only because its stated premise no longer exists in the source; the comment there says plainly that it hasn't shipped yet.

If you'd rather I close the clearly-fixed ones now, say so and I'll go through them. Otherwise I'll wait until after the release and ask each reporter to confirm.

Take the time you need on the review — nothing here is urgent, and I'm not adding to the pile in the meantime.