chore: bump version to 0.9.0

A 5-minute poll now fetches at :00, :05, :10 and so on, and the update check runs at the top of the hour, at midnight or at Monday midnight. At launch a check runs only when such a boundary passed since the last one. Deadlines are wall-clock timestamps, so they also hold across sleep. jiff supplies the local time zone and daylight-saving rules.

Cargo.lock

@@ -4693,12 +4693,13 @@ dependencies = [
 
 [[package]]
 name = "usage-monitor"
-version = "0.7.0"
+version = "0.9.0"
 dependencies = [
  "auto-launch",
  "dbus",
  "dirs 6.0.0",
  "flate2",
+ "jiff",
  "libc",
  "libloading 0.9.0",
  "log",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "usage-monitor"
-version = "0.7.0"
+version = "0.9.0"
 edition = "2021"
 license = "Apache-2.0"
 description = "Floating bubble showing Claude Code and Codex usage"
@@ -23,6 +23,8 @@ tauri-plugin-single-instance = "2"
 ureq = { version = "3", features = ["platform-verifier", "socks-proxy"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# Local time zone for the clock-aligned poll and update check.
+jiff = "0.2"
 dirs = "6"
 log = "0.4"
 simplelog = "0.12"
@@ -56,6 +58,7 @@ windows = { version = "0.62", features = [
     "Win32_Foundation",
     "Win32_System_Registry",
     "Win32_System_Threading",
+    "Win32_UI_Accessibility",
     "Win32_UI_WindowsAndMessaging",
     "Win32_UI_Shell",
     "Win32_Graphics_Dwm",

README.md

@@ -45,8 +45,10 @@ self-updater are all written from scratch against the same public APIs
   expires and after an update was applied
 - Auto-hide when a fullscreen app is in the foreground (games, video,
   presentations) — reappears when you leave fullscreen
-- Every minute, shown bubbles are put back on top, so another
-  always-on-top window can't keep them covered or hidden
+- Bubbles stay above other always-on-top windows, such as chat
+  notifications: on Windows a bubble goes back on top the moment another
+  app shows such a window over it, and on every platform shown bubbles are
+  put back on top every minute, so nothing can keep them covered or hidden
 
 ## Who this is for
 
@@ -100,7 +102,8 @@ Grab `usage-monitor.exe` from the
 Put it in a folder of its own that you can write to (e.g.
 `%LOCALAPPDATA%\UsageMonitor\`) and run it. The app is portable: it keeps
 `settings.json` next to the exe, so moving the folder keeps your settings. It
-self-updates from the same Releases feed.
+updates itself from the same Releases feed: when a check finds a new
+release, it installs it and restarts on its own, with no click needed.
 
 **First-run note:** the binary is unsigned, so SmartScreen will show
 "Windows protected your PC". Click **More info** → **Run anyway**. Code
@@ -115,7 +118,7 @@ pick one:
 - `usage-monitor_X.Y.Z_amd64.AppImage`: make it executable
   (`chmod +x`) and run it. Like the Windows exe it is portable and keeps
   `settings.json` next to the AppImage file, so give it a folder you can
-  write to. The AppImage self-updates in place. If you turned on "Start
+  write to. The AppImage updates itself in place, the same way. If you turned on "Start
   at login" in v0.6.0 or earlier and the AppImage path contains a space,
   turn it off and on again once: those releases wrote the path unquoted,
   so the app never started at login.
@@ -169,6 +172,9 @@ primary monitor on first launch. Drag it where you want it, release to snap
 to the nearest edge if you let go close to one.
 
 - **Left-click** the bubble to open the expanded panel (5h + 7d + countdowns)
+- **Update frequency** sets how often usage is fetched. Fetches follow
+  your local clock: every 5 minutes means :00, :05, :10 and so on, and
+  every hour means the top of the hour
 - **Right-click** for **Refresh**, **Update frequency**, **Providers**,
   **Settings**, **Controls**, **Show widget**, **Click-through**,
   **Restart** and **Exit**.
@@ -255,9 +261,12 @@ What the app sends over the network:
 
 - Requests to Anthropic's Claude endpoints to read your usage
 - Requests to ChatGPT's Codex usage endpoint, if Codex is enabled
-- Requests for `latest.json` from GitHub Releases, hourly by default and at
-  launch when the last check is older than that. A failed check is retried
-  sooner, starting after a minute and backing off up to the interval. Set **Settings** → **Auto-update check** to
+- Requests for `latest.json` from GitHub Releases, hourly by default. Checks
+  run on your local clock: hourly at the top of each hour, daily at
+  midnight, weekly at midnight on Monday. At launch the app checks only if
+  such a time passed since its last check. A failed check is retried
+  sooner, starting after a minute and backing off, but never past the next
+  scheduled time. Set **Settings** → **Auto-update check** to
   **Disabled** in the right-click menu to stop them; **Check for updates**
   still works when you click it.
 

src/bubble.rs

@@ -15,9 +15,7 @@
 use std::collections::HashMap;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::{Arc, Mutex, PoisonError};
-use std::time::Duration;
-#[cfg(not(windows))]
-use std::time::Instant;
+use std::time::{Duration, Instant};
 
 use tauri::{
     AppHandle, Manager, Monitor, PhysicalPosition, PhysicalSize, WebviewUrl, WebviewWindow,
@@ -351,6 +349,8 @@ pub fn create(app: &AppHandle, provider: ProviderId) -> tauri::Result<()> {
         set_position(&window, placement.pos);
     }
     set_size(&window, placement.size);
+    // Windows applies it on the main thread, in `prepare_native`.
+    #[cfg(not(windows))]
     if click_through {
         set_ignore_cursor(&window, true);
     }
@@ -363,7 +363,7 @@ pub fn create(app: &AppHandle, provider: ProviderId) -> tauri::Result<()> {
         placement.dpi
     );
 
-    prepare_native(app, &window, provider);
+    prepare_native(app, &window, provider, click_through);
     #[cfg(target_os = "linux")]
     if let Some(is_dark) = platform::linux::portal_prefers_dark() {
         runtime.set_dark(is_dark);
@@ -399,13 +399,22 @@ pub fn create(app: &AppHandle, provider: ProviderId) -> tauri::Result<()> {
 /// move-end, setting-change and display-change messages. Both must run on
 /// the window's own (main) thread before the first show.
 #[cfg(windows)]
-fn prepare_native(app: &AppHandle, window: &WebviewWindow, provider: ProviderId) {
+fn prepare_native(
+    app: &AppHandle,
+    window: &WebviewWindow,
+    provider: ProviderId,
+    click_through: bool,
+) {
     let window = window.clone();
     let hook_app = app.clone();
     let queued = app.run_on_main_thread(move || {
         if let Err(err) = platform::windows::apply_no_activate(&window) {
             log::warn!("{} may take focus: {err}", window.label());
         }
+        if click_through {
+            set_ignore_cursor(&window, true);
+        }
+        watch_z_order(&hook_app);
         let hooked = platform::windows::install_bubble_hook(&window, move |event| {
             on_hook_event(&hook_app, provider, event);
         });
@@ -419,7 +428,13 @@ fn prepare_native(app: &AppHandle, window: &WebviewWindow, provider: ProviderId)
 }
 
 #[cfg(not(windows))]
-fn prepare_native(_app: &AppHandle, _window: &WebviewWindow, _provider: ProviderId) {}
+fn prepare_native(
+    _app: &AppHandle,
+    _window: &WebviewWindow,
+    _provider: ProviderId,
+    _click_through: bool,
+) {
+}
 
 #[cfg(windows)]
 fn on_hook_event(app: &AppHandle, provider: ProviderId, event: platform::windows::BubbleHookEvent) {
@@ -514,6 +529,75 @@ pub fn bring_back(app: &AppHandle) {
     }
 }
 
+/// Put back on top every shown bubble that another app's always-on-top
+/// window, such as a chat toast, now covers. Cheap enough to run on every
+/// fullscreen check; bubbles hidden for a fullscreen app are left alone.
+#[cfg(windows)]
+pub fn keep_on_top(app: &AppHandle) {
+    let handle = app.clone();
+    let queued = app.run_on_main_thread(move || raise_covered(&handle));
+    if let Err(err) = queued {
+        log::warn!("bubble on-top check could not reach the main thread: {err}");
+    }
+}
+
+/// Most raises in [`RAISE_WINDOW`] before raising pauses until it ends, so
+/// another app that also fights for the top cannot keep both busy; the
+/// fullscreen check carries on at its own pace.
+#[cfg(windows)]
+const MAX_RAISES: u32 = 20;
+#[cfg(windows)]
+const RAISE_WINDOW: Duration = Duration::from_secs(1);
+
+/// Body of [`keep_on_top`]; runs on the main thread.
+#[cfg(windows)]
+fn raise_covered(app: &AppHandle) {
+    static RAISES: Mutex<Option<(Instant, u32)>> = Mutex::new(None);
+    let shows = runtime_of(app).is_some_and(|r| r.with_state(|s| s.visibility.shows()));
+    if !shows {
+        return;
+    }
+    for (_, window) in windows(app) {
+        match platform::windows::covered_by_other_topmost(&window) {
+            Ok(true) => {}
+            Ok(false) => continue,
+            Err(err) => {
+                log::warn!("{} on-top check failed: {err}", window.label());
+                continue;
+            }
+        }
+        let allowed = {
+            let mut raises = RAISES.lock().unwrap_or_else(PoisonError::into_inner);
+            let now = Instant::now();
+            let (start, count) = raises.get_or_insert((now, 0));
+            if now.duration_since(*start) >= RAISE_WINDOW {
+                (*start, *count) = (now, 0);
+            }
+            *count += 1;
+            if *count == MAX_RAISES + 1 {
+                log::warn!("bubble raises paused: another window keeps taking the top");
+            }
+            *count <= MAX_RAISES
+        };
+        if allowed {
+            raise(&window);
+        }
+    }
+}
+
+/// Raise covered bubbles the moment another app shows a window or changes
+/// the z-order. Installed once, on the main thread.
+#[cfg(windows)]
+fn watch_z_order(app: &AppHandle) {
+    static WATCHING: std::sync::Once = std::sync::Once::new();
+    WATCHING.call_once(|| {
+        let handle = app.clone();
+        if let Err(err) = platform::windows::watch_z_order(move || raise_covered(&handle)) {
+            log::warn!("z-order watch unavailable, relying on the periodic check: {err}");
+        }
+    });
+}
+
 fn raise(window: &WebviewWindow) {
     #[cfg(windows)]
     let result = platform::windows::raise_topmost(window).map_err(|e| e.to_string());
@@ -541,8 +625,18 @@ pub fn set_click_through(app: &AppHandle, ignore: bool) {
     }
 }
 
+/// On Windows the style bits are set directly: tao's
+/// `set_ignore_cursor_events` re-applies all its window flags, and since
+/// bubbles are shown through [`show`], not tao, it believes them hidden and
+/// hides them, also dropping their no-activate and tool-window styles.
 fn set_ignore_cursor(window: &WebviewWindow, ignore: bool) {
-    if let Err(err) = window.set_ignore_cursor_events(ignore) {
+    #[cfg(windows)]
+    let result = platform::windows::set_click_through(window, ignore).map_err(|e| e.to_string());
+    #[cfg(not(windows))]
+    let result = window
+        .set_ignore_cursor_events(ignore)
+        .map_err(|e| e.to_string());
+    if let Err(err) = result {
         log::warn!("{} click-through not set: {err}", window.label());
     }
 }

src/core/state.rs

@@ -8,7 +8,11 @@
 use std::collections::HashMap;
 use std::time::{Duration, Instant, SystemTime};
 
+use jiff::tz::TimeZone;
+use jiff::{Timestamp, ToSpan, Zoned};
+
 use crate::core::i18n::{self, LocaleStrings};
+use crate::core::settings;
 use crate::usage::{ProviderId, UsageWindows, Window};
 
 /// Minimum gap between two cooldown-gated alerts (threshold and session
@@ -291,27 +295,78 @@ pub enum UpdateCheckDue {
 }
 
 /// Schedule the automatic update check from the last check time (unix
-/// seconds). `None` when auto-check is disabled. Due when never checked or
-/// when `now - last >= interval`; otherwise after the remainder.
+/// seconds). `None` when auto-check is disabled. Checks fall on local
+/// clock boundaries: hourly at the top of each hour, daily at midnight,
+/// weekly at midnight on Monday. Due when never checked or when the last
+/// check came before the boundary that most recently passed; otherwise
+/// after the time left until the next boundary.
 pub fn update_check_due(
     last_check_unix: Option<u64>,
     interval_secs: Option<u64>,
     now_unix: u64,
+    tz: &TimeZone,
 ) -> Option<UpdateCheckDue> {
     let interval = interval_secs?;
-    let Some(last) = last_check_unix else {
-        return Some(UpdateCheckDue::Now);
-    };
-    let elapsed = now_unix.saturating_sub(last);
-    if elapsed >= interval {
-        Some(UpdateCheckDue::Now)
-    } else {
-        Some(UpdateCheckDue::After(Duration::from_secs(
-            interval - elapsed,
-        )))
+    let (start, next) = clock_slot(interval, now_unix, tz);
+    // A last check after `now` (a clock set back) counts as this slot's.
+    match last_check_unix {
+        Some(last) if last >= start => Some(UpdateCheckDue::After(Duration::from_secs(
+            next.saturating_sub(now_unix),
+        ))),
+        _ => Some(UpdateCheckDue::Now),
     }
 }
 
+/// The slot of a clock-aligned timer that holds `now_unix`: the boundary
+/// that most recently passed and the next one, in unix seconds. An hour,
+/// a day and a week follow the local calendar (top of the hour, midnight,
+/// Monday midnight), across daylight-saving changes too. Any other interval
+/// splits the local day evenly, so 5 minutes falls on :00, :05, :10 and
+/// so on.
+pub fn clock_slot(interval_secs: u64, now_unix: u64, tz: &TimeZone) -> (u64, u64) {
+    let calendar = || -> Result<(Zoned, Zoned), jiff::Error> {
+        let now = Timestamp::from_second(i64::try_from(now_unix).unwrap_or(i64::MAX))?
+            .to_zoned(tz.clone());
+        let (start, step) = match interval_secs {
+            settings::UPDATE_CHECK_HOURLY_SECS => (
+                now.with()
+                    .minute(0)
+                    .second(0)
+                    .subsec_nanosecond(0)
+                    .build()?,
+                1.hour(),
+            ),
+            settings::UPDATE_CHECK_DAILY_SECS => (now.start_of_day()?, 1.day()),
+            settings::UPDATE_CHECK_WEEKLY_SECS => {
+                let days = now.weekday().to_monday_zero_offset();
+                let monday = now.start_of_day()?.checked_sub(i64::from(days).days())?;
+                (monday.start_of_day()?, 1.week())
+            }
+            _ => return Err(jiff::Error::from_args(format_args!("no calendar slot"))),
+        };
+        let next = start.checked_add(step)?;
+        Ok((start, next))
+    };
+    match calendar() {
+        Ok((start, next)) => (unix_secs(&start), unix_secs(&next)),
+        Err(_) => {
+            let interval = i64::try_from(interval_secs.max(1)).unwrap_or(i64::MAX);
+            let now = i64::try_from(now_unix).unwrap_or(i64::MAX);
+            let offset = Timestamp::from_second(now)
+                .map(|t| i64::from(tz.to_offset(t).seconds()))
+                .unwrap_or(0);
+            let local = now.saturating_add(offset);
+            let start = local - local.rem_euclid(interval) - offset;
+            let start = u64::try_from(start).unwrap_or(0);
+            (start, start.saturating_add(interval.unsigned_abs()))
+        }
+    }
+}
+
+fn unix_secs(zoned: &Zoned) -> u64 {
+    u64::try_from(zoned.timestamp().as_second()).unwrap_or(0)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -620,28 +675,61 @@ mod tests {
 
     #[test]
     fn update_schedule_due_and_remaining() {
-        let hour = 3_600;
-        assert_eq!(update_check_due(None, None, 10_000), None);
-        assert_eq!(update_check_due(Some(9_000), None, 10_000), None);
+        let utc = TimeZone::UTC;
+        let hour = settings::UPDATE_CHECK_HOURLY_SECS;
+        // 10_000 s is 02:46:40 UTC; the hour started at 7_200.
+        assert_eq!(update_check_due(None, None, 10_000, &utc), None);
+        assert_eq!(update_check_due(Some(9_000), None, 10_000, &utc), None);
         assert_eq!(
-            update_check_due(None, Some(hour), 10_000),
+            update_check_due(None, Some(hour), 10_000, &utc),
             Some(UpdateCheckDue::Now)
         );
         assert_eq!(
-            update_check_due(Some(10_000 - hour), Some(hour), 10_000),
+            update_check_due(Some(7_199), Some(hour), 10_000, &utc),
             Some(UpdateCheckDue::Now)
         );
         assert_eq!(
-            update_check_due(Some(10_000 - 600), Some(hour), 10_000),
-            Some(UpdateCheckDue::After(Duration::from_secs(3_000)))
+            update_check_due(Some(7_200), Some(hour), 10_000, &utc),
+            Some(UpdateCheckDue::After(Duration::from_secs(800)))
         );
-        // A clock that moved backwards counts as zero elapsed.
+        // A clock that moved backwards counts as checked this slot.
         assert_eq!(
-            update_check_due(Some(20_000), Some(hour), 10_000),
-            Some(UpdateCheckDue::After(Duration::from_secs(hour)))
+            update_check_due(Some(20_000), Some(hour), 10_000, &utc),
+            Some(UpdateCheckDue::After(Duration::from_secs(800)))
         );
     }
 
+    #[test]
+    fn clock_slots_follow_the_local_calendar() {
+        let utc = TimeZone::UTC;
+        // 5 minutes: 02:46:40 sits in 02:45..02:50.
+        assert_eq!(clock_slot(300, 10_000, &utc), (9_900, 10_200));
+        // At +05:30 local hours start at UTC :30.
+        let india = TimeZone::fixed(jiff::tz::Offset::from_seconds(5 * 3_600 + 30 * 60).unwrap());
+        assert_eq!(
+            clock_slot(settings::UPDATE_CHECK_HOURLY_SECS, 10_000, &india),
+            (9_000, 12_600)
+        );
+        // 1970-01-01 was a Thursday: its week started Monday 1969-12-29,
+        // before the epoch, so the slot start clamps to 0.
+        assert_eq!(
+            clock_slot(settings::UPDATE_CHECK_WEEKLY_SECS, 10_000, &utc),
+            (0, 4 * 86_400)
+        );
+    }
+
+    #[test]
+    fn a_daily_slot_spans_a_short_daylight_saving_day() {
+        let Ok(berlin) = TimeZone::get("Europe/Berlin") else {
+            return; // no tz database on this machine
+        };
+        // 2026-03-29 is 23 hours long in Berlin; it starts at 23:00 UTC.
+        let noon = 1_774_785_600; // 2026-03-29 12:00 UTC
+        let (start, next) = clock_slot(settings::UPDATE_CHECK_DAILY_SECS, noon, &berlin);
+        assert_eq!(start, 1_774_738_800);
+        assert_eq!(next - start, 23 * 3_600);
+    }
+
     #[test]
     fn countdown_delay_takes_the_nearest_change_with_a_floor() {
         let now = SystemTime::UNIX_EPOCH + Duration::from_secs(1_800_000_000);

src/fullscreen.rs

@@ -4,7 +4,10 @@
 //! unless the user hid them in the meantime.
 //!
 //! The same thread brings the bubbles back every minute while they should
-//! show, in case another window covered or hid them.
+//! show, in case another window covered or hid them. On Windows it also
+//! re-raises, on every check, a bubble that another app's always-on-top
+//! window (a chat toast, say) covers, as a backstop for the z-order watch
+//! in `bubble.rs`.
 
 use std::io;
 use std::sync::Arc;
@@ -28,6 +31,8 @@ pub fn spawn(runtime: Arc<Runtime>) -> io::Result<()> {
             let mut last_bring_back = Instant::now();
             while !runtime.is_exiting() {
                 tick(&runtime);
+                #[cfg(windows)]
+                runtime.keep_bubbles_on_top();
                 if last_bring_back.elapsed() >= BRING_BACK_INTERVAL {
                     last_bring_back = Instant::now();
                     runtime.bring_back_bubbles();

src/platform/windows.rs

@@ -1,5 +1,6 @@
 //! Windows-only helpers. This is the only module that talks to Win32 APIs.
 
+use std::cell::RefCell;
 use std::io;
 use std::path::Path;
 use std::time::Duration;
@@ -20,18 +21,22 @@ use windows::Win32::Graphics::Gdi::{
     GetMonitorInfoW, MonitorFromWindow, MONITORINFO, MONITOR_DEFAULTTONEAREST,
 };
 use windows::Win32::System::Threading::{OpenProcess, WaitForSingleObject, PROCESS_SYNCHRONIZE};
+use windows::Win32::UI::Accessibility::{SetWinEventHook, HWINEVENTHOOK};
 use windows::Win32::UI::Shell::{
     DefSubclassProc, RemoveWindowSubclass, SHAppBarMessage,
     SetCurrentProcessExplicitAppUserModelID, SetWindowSubclass, ABE_BOTTOM, ABE_LEFT, ABE_RIGHT,
     ABE_TOP, ABM_GETTASKBARPOS, APPBARDATA,
 };
 use windows::Win32::UI::WindowsAndMessaging::{
-    GetClassNameW, GetForegroundWindow, GetWindowLongPtrW, GetWindowRect, GetWindowThreadProcessId,
-    IsIconic, IsWindowVisible, MessageBoxW, SetForegroundWindow, SetWindowLongPtrW, SetWindowPos,
-    ShowWindow, GWL_EXSTYLE, GWL_STYLE, HWND_TOPMOST, MA_NOACTIVATE, MB_ICONERROR, MB_OK,
-    MB_SETFOREGROUND, SWP_FRAMECHANGED, SWP_NOACTIVATE, SWP_NOMOVE, SWP_NOSIZE, SWP_NOZORDER,
-    SW_HIDE, SW_SHOWNOACTIVATE, WM_DISPLAYCHANGE, WM_EXITSIZEMOVE, WM_MOUSEACTIVATE, WM_NCDESTROY,
-    WM_SETTINGCHANGE, WS_EX_NOACTIVATE, WS_EX_TOOLWINDOW,
+    GetClassNameW, GetForegroundWindow, GetWindow, GetWindowLongPtrW, GetWindowRect,
+    GetWindowThreadProcessId, IsIconic, IsWindowVisible, MessageBoxW, SetForegroundWindow,
+    SetWindowLongPtrW, SetWindowPos, ShowWindow, CHILDID_SELF, EVENT_OBJECT_REORDER,
+    EVENT_OBJECT_SHOW, GWL_EXSTYLE, GWL_STYLE, GW_HWNDPREV, HWND_TOPMOST, MA_NOACTIVATE,
+    MB_ICONERROR, MB_OK, MB_SETFOREGROUND, OBJID_WINDOW, SWP_FRAMECHANGED, SWP_NOACTIVATE,
+    SWP_NOMOVE, SWP_NOSIZE, SWP_NOZORDER, SW_HIDE, SW_SHOWNOACTIVATE, WINEVENT_OUTOFCONTEXT,
+    WINEVENT_SKIPOWNPROCESS, WM_DISPLAYCHANGE, WM_EXITSIZEMOVE, WM_MOUSEACTIVATE, WM_NCDESTROY,
+    WM_SETTINGCHANGE, WS_EX_LAYERED, WS_EX_NOACTIVATE, WS_EX_TOOLWINDOW, WS_EX_TOPMOST,
+    WS_EX_TRANSPARENT,
 };
 
 use crate::core::geom::{self, Edge, Rect};
@@ -202,19 +207,34 @@ pub fn apply_toolwindow(window: &tauri::WebviewWindow) -> io::Result<()> {
     add_ex_style(window, WS_EX_TOOLWINDOW.0)
 }
 
+/// Let mouse input pass through a bubble to the windows below, or take it
+/// again. These are the bits tao's `set_ignore_cursor_events` sets, without
+/// its re-applying every window flag, which hides a bubble shown through
+/// [`show_no_activate`]. Run it on the window's own (main) thread.
+pub fn set_click_through(window: &tauri::WebviewWindow, ignore: bool) -> io::Result<()> {
+    set_ex_style(window, (WS_EX_TRANSPARENT | WS_EX_LAYERED).0, ignore)
+}
+
 /// OR `bits` into a window's extended style and apply the frame change.
 fn add_ex_style(window: &tauri::WebviewWindow, bits: u32) -> io::Result<()> {
+    set_ex_style(window, bits, true)
+}
+
+/// Set or clear `bits` in a window's extended style and apply the frame
+/// change.
+fn set_ex_style(window: &tauri::WebviewWindow, bits: u32, on: bool) -> io::Result<()> {
     let hwnd = hwnd_of(window)?;
-    let wanted = bits as isize;
+    let bits = bits as isize;
     // SAFETY: `hwnd` is a live top-level window of this process.
     let current = unsafe { GetWindowLongPtrW(hwnd, GWL_EXSTYLE) };
-    if current & wanted == wanted {
+    let wanted = if on { current | bits } else { current & !bits };
+    if wanted == current {
         return Ok(());
     }
     // SAFETY: as above. A zero return is only an error when the last error
     // is set, so it is cleared first.
     unsafe { SetLastError(WIN32_ERROR(0)) };
-    let previous = unsafe { SetWindowLongPtrW(hwnd, GWL_EXSTYLE, current | wanted) };
+    let previous = unsafe { SetWindowLongPtrW(hwnd, GWL_EXSTYLE, wanted) };
     if previous == 0 {
         let err = io::Error::last_os_error();
         if err.raw_os_error().unwrap_or(0) != 0 {
@@ -313,6 +333,110 @@ pub fn raise_topmost(window: &tauri::WebviewWindow) -> io::Result<()> {
     .map_err(io::Error::from)
 }
 
+/// Whether a visible always-on-top window of another process sits above
+/// `window` in the z-order and overlaps it, such as a chat app's toast.
+/// Our own windows (the panel, a context menu) never count, so raising a
+/// bubble over them is never asked for.
+pub fn covered_by_other_topmost(window: &tauri::WebviewWindow) -> io::Result<bool> {
+    let hwnd = hwnd_of(window)?;
+    let Some((ours, _)) = visible_window_bounds(hwnd) else {
+        return Ok(false);
+    };
+    let own_pid = std::process::id();
+    // SAFETY: `hwnd` is a live window of this process; each step only reads
+    // the z-order, and a window closing mid-walk ends it with an error.
+    let mut above = unsafe { GetWindow(hwnd, GW_HWNDPREV) };
+    // Topmost windows sit at the head of the z-order, so the walk is short;
+    // the cap guards against a z-order that keeps changing under it.
+    for _ in 0..MAX_Z_ORDER_WALK {
+        let Ok(other) = above else {
+            return Ok(false);
+        };
+        if covers(other, &ours, own_pid) {
+            return Ok(true);
+        }
+        // SAFETY: as above.
+        above = unsafe { GetWindow(other, GW_HWNDPREV) };
+    }
+    Ok(false)
+}
+
+const MAX_Z_ORDER_WALK: usize = 1024;
+
+fn covers(other: HWND, ours: &Rect, own_pid: u32) -> bool {
+    // SAFETY: read-only queries; a stale handle yields 0 / false.
+    let ex_style = unsafe { GetWindowLongPtrW(other, GWL_EXSTYLE) } as u32;
+    if ex_style & WS_EX_TOPMOST.0 == 0
+        || unsafe { !IsWindowVisible(other).as_bool() }
+        || is_dwm_cloaked(other)
+        || window_process_id(other).is_none_or(|pid| pid == own_pid)
+    {
+        return false;
+    }
+    visible_window_bounds(other).is_some_and(|(theirs, _)| theirs.intersects(ours))
+}
+
+thread_local! {
+    /// The callback of [`watch_z_order`], on the thread that installed it.
+    static Z_ORDER_CALLBACK: RefCell<Option<Box<dyn Fn()>>> = const { RefCell::new(None) };
+}
+
+/// Call `callback` as soon as a window of another process is shown or the
+/// z-order changes, so a bubble can go back on top of a new always-on-top
+/// window (a chat toast, say) at once instead of at the next poll. The
+/// events arrive through this thread's message loop, so install it on the
+/// main thread; the hook lives as long as the process.
+pub fn watch_z_order(callback: impl Fn() + 'static) -> io::Result<()> {
+    Z_ORDER_CALLBACK.with(|slot| *slot.borrow_mut() = Some(Box::new(callback)));
+    // SAFETY: an out-of-context hook needs no module handle; the procedure
+    // is a plain function that lives for the whole process.
+    let hook = unsafe {
+        SetWinEventHook(
+            EVENT_OBJECT_SHOW,
+            EVENT_OBJECT_REORDER,
+            None,
+            Some(z_order_event_proc),
+            0,
+            0,
+            WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS,
+        )
+    };
+    if hook.is_invalid() {
+        Z_ORDER_CALLBACK.with(|slot| slot.borrow_mut().take());
+        return Err(io::Error::other("SetWinEventHook failed"));
+    }
+    Ok(())
+}
+
+unsafe extern "system" fn z_order_event_proc(
+    _hook: HWINEVENTHOOK,
+    event: u32,
+    _hwnd: HWND,
+    id_object: i32,
+    id_child: i32,
+    _thread: u32,
+    _time: u32,
+) {
+    // Only whole windows count: a shown caret or cursor is an object too,
+    // and a hidden window cannot cover anything.
+    let relevant = match event {
+        EVENT_OBJECT_SHOW => id_object == OBJID_WINDOW.0 && id_child == CHILDID_SELF as i32,
+        EVENT_OBJECT_REORDER => true,
+        _ => false,
+    };
+    if relevant {
+        // `try_borrow` skips an event raised from inside the callback.
+        Z_ORDER_CALLBACK.with(|slot| {
+            let Ok(callback) = slot.try_borrow() else {
+                return;
+            };
+            if let Some(callback) = callback.as_ref() {
+                callback();
+            }
+        });
+    }
+}
+
 /// Hide a bubble (see [`show_no_activate`]).
 pub fn hide(window: &tauri::WebviewWindow) -> io::Result<()> {
     let hwnd = hwnd_of(window)?;

src/runtime.rs

@@ -512,6 +512,12 @@ impl Runtime {
         bubble::bring_back(&self.ui.app);
     }
 
+    /// Raise shown bubbles that another app's always-on-top window covers.
+    #[cfg(windows)]
+    pub fn keep_bubbles_on_top(&self) {
+        bubble::keep_on_top(&self.ui.app);
+    }
+
     /// Apply a visibility event to every bubble. A user show or hide is
     /// also saved as `widget_visible`.
     pub fn apply_visibility(&self, event: visibility::Event) {
@@ -651,8 +657,9 @@ impl Runtime {
 
     /// Blocking body of [`Self::check_for_updates`]. Only a check that got
     /// an answer is stamped as the last check; a failed one leaves the
-    /// stamp alone and has the scheduler retry sooner.
-    fn run_update_check(&self) {
+    /// stamp alone and has the scheduler retry sooner. A release found where
+    /// the app can replace itself is installed straight away.
+    fn run_update_check(self: &Arc<Self>) {
         let proxy = update::proxy_url(net::env_proxy().as_ref(), self.http.system_proxy());
         let outcome = update::check(&self.ui.app, proxy);
         let succeeded = outcome.is_ok();
@@ -694,6 +701,13 @@ impl Runtime {
             succeeded,
         });
         self.refresh_shell(false);
+        let auto_apply = self.with_state(|s| {
+            s.update_status == UpdateStatus::Available && s.update_channel.can_apply()
+        });
+        if auto_apply {
+            log::info!("update found; installing it without waiting for a click");
+            self.apply_update();
+        }
     }
 
     /// Download and install the release the last check found on a worker
@@ -1020,6 +1034,7 @@ fn setup(app: &mut tauri::App, cli: &CliArgs) -> Result<(), Box<dyn Error>> {
         poll_interval: Duration::from_millis(u64::from(state.settings.poll_interval_ms)),
         update_interval_secs: state.settings.update_check_interval_secs,
         last_update_check_unix: state.settings.last_update_check_unix,
+        tz: jiff::tz::TimeZone::system(),
     };
     let providers = enabled_providers(&state.settings);
 

src/scheduler.rs

@@ -7,17 +7,20 @@
 //! each due [`Action`] to its [`SchedulerHost`]. A host must return quickly:
 //! slow work (HTTP, the CLI refresh) runs on worker threads it spawns.
 //!
-//! `Instant` stops while the machine sleeps, so the update check, which is
-//! due at a wall-clock time, is kept as a unix timestamp, and the thread
-//! wakes at least every [`MAX_WAIT`] to notice a resume (see
-//! [`resumed_from_sleep`]).
+//! The poll and the update check run on local clock boundaries (see
+//! [`clock_slot`]): a 5-minute poll at :00, :05, :10 and so on, a daily
+//! update check at midnight. `Instant` stops while the machine sleeps, so
+//! those deadlines are kept as unix timestamps, and the thread wakes at
+//! least every [`MAX_WAIT`] to notice a resume (see [`resumed_from_sleep`]).
 
 use std::io;
 use std::sync::mpsc::{Receiver, RecvTimeoutError};
 use std::thread::JoinHandle;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
-use crate::core::state::{update_check_due, UpdateCheckDue};
+use jiff::tz::TimeZone;
+
+use crate::core::state::{clock_slot, update_check_due, UpdateCheckDue};
 
 /// Shortest poll interval, guarding against a hand-edited `0` in the
 /// settings file turning into a busy loop.
@@ -42,7 +45,8 @@ const RESUME_THRESHOLD: Duration = Duration::from_secs(30);
 pub enum Message {
     /// Poll at once. The periodic poll deadline is left as it is.
     PollNow,
-    /// Change the poll interval and re-arm it from now, without polling.
+    /// Change the poll interval and re-arm it at its next boundary, without
+    /// polling.
     SetPollInterval(Duration),
     /// Re-render the countdowns after this delay; `None` clears the deadline.
     RecomputeCountdown(Option<Duration>),
@@ -53,9 +57,9 @@ pub enum Message {
         interval_secs: Option<u64>,
         last_check_unix: Option<u64>,
     },
-    /// An update check finished. Only this re-arms the check: after the
-    /// full interval when it succeeded, after a growing retry delay capped
-    /// at the interval when it failed.
+    /// An update check finished. Only this re-arms the check: at the next
+    /// boundary when it succeeded, after a growing retry delay capped at
+    /// that boundary when it failed.
     UpdateCheckDone {
         interval_secs: Option<u64>,
         succeeded: bool,
@@ -77,17 +81,21 @@ pub trait SchedulerHost {
 }
 
 /// Settings the deadlines start from.
-#[derive(Clone, Copy, Debug)]
+#[derive(Clone, Debug)]
 pub struct Config {
     pub poll_interval: Duration,
     pub update_interval_secs: Option<u64>,
     pub last_update_check_unix: Option<u64>,
+    /// The zone whose clock the poll and the update check follow.
+    pub tz: TimeZone,
 }
 
 #[derive(Debug)]
 pub struct Deadlines {
+    tz: TimeZone,
     poll_interval: Duration,
-    poll_at: Instant,
+    /// Unix seconds the next poll is due at.
+    poll_at_unix: u64,
     countdown_at: Option<Instant>,
     /// Unix seconds the next update check is due at.
     update_at_unix: Option<u64>,
@@ -98,15 +106,16 @@ pub struct Deadlines {
 impl Deadlines {
     /// Arm the deadlines at startup. Returns the actions due at once: the
     /// update check when the last one is older than its interval.
-    pub fn new(config: Config, now: Instant, now_unix: u64) -> (Self, Vec<Action>) {
-        let poll_interval = config.poll_interval.max(MIN_POLL_INTERVAL);
+    pub fn new(config: Config, now_unix: u64) -> (Self, Vec<Action>) {
         let mut deadlines = Self {
-            poll_interval,
-            poll_at: now + poll_interval,
+            tz: config.tz,
+            poll_interval: config.poll_interval.max(MIN_POLL_INTERVAL),
+            poll_at_unix: 0,
             countdown_at: None,
             update_at_unix: None,
             update_failures: 0,
         };
+        deadlines.poll_at_unix = deadlines.next_poll(now_unix);
         let actions = deadlines.arm_update(
             config.update_interval_secs,
             config.last_update_check_unix,
@@ -121,7 +130,7 @@ impl Deadlines {
             Message::PollNow => vec![Action::Poll],
             Message::SetPollInterval(interval) => {
                 self.poll_interval = interval.max(MIN_POLL_INTERVAL);
-                self.poll_at = now + self.poll_interval;
+                self.poll_at_unix = self.next_poll(now_unix);
                 Vec::new()
             }
             Message::RecomputeCountdown(delay) => {
@@ -136,29 +145,31 @@ impl Deadlines {
                 interval_secs,
                 succeeded,
             } => {
-                let delay = if succeeded {
-                    self.update_failures = 0;
-                    interval_secs.map(update_interval)
-                } else {
-                    let delay = interval_secs.map(|secs| self.retry_delay(secs));
-                    self.update_failures = self.update_failures.saturating_add(1);
-                    delay
-                };
-                self.update_at_unix = delay.map(|d| now_unix.saturating_add(d.as_secs()));
+                self.update_at_unix = interval_secs.map(|secs| {
+                    let next = self.next_update(secs, now_unix);
+                    if succeeded {
+                        self.update_failures = 0;
+                        next
+                    } else {
+                        let retry = now_unix.saturating_add(self.retry_delay().as_secs());
+                        self.update_failures = self.update_failures.saturating_add(1);
+                        retry.min(next)
+                    }
+                });
                 Vec::new()
             }
             Message::Shutdown => Vec::new(),
         }
     }
 
-    /// Fire every deadline that has passed. The poll re-arms for a full
-    /// interval; the countdown and update check stay disarmed until the
+    /// Fire every deadline that has passed. The poll re-arms at its next
+    /// boundary; the countdown and update check stay disarmed until the
     /// host re-arms them (after the re-render, after the check finished).
     pub fn take_due(&mut self, now: Instant, now_unix: u64) -> Vec<Action> {
         let mut due = Vec::new();
-        if self.poll_at <= now {
+        if self.poll_at_unix <= now_unix {
             due.push(Action::Poll);
-            self.poll_at = now + self.poll_interval;
+            self.poll_at_unix = self.next_poll(now_unix);
         }
         if self.countdown_at.is_some_and(|at| at <= now) {
             due.push(Action::Countdown);
@@ -171,25 +182,23 @@ impl Deadlines {
         due
     }
 
-    /// The machine woke from sleep: poll at once and re-arm the poll for a
-    /// full interval from now. The update check needs nothing here, since
+    /// The machine woke from sleep: poll at once and re-arm the poll at its
+    /// next boundary. The update check needs nothing here, since
     /// [`Self::take_due`] compares its wall-clock deadline with `now_unix`.
-    pub fn resume(&mut self, now: Instant) -> Vec<Action> {
-        self.poll_at = now + self.poll_interval;
+    pub fn resume(&mut self, now_unix: u64) -> Vec<Action> {
+        self.poll_at_unix = self.next_poll(now_unix);
         vec![Action::Poll]
     }
 
     /// Time until the nearest deadline. The poll deadline is always armed,
     /// so there always is one.
     pub fn next_wakeup(&self, now: Instant, now_unix: u64) -> Duration {
-        let update = self
-            .update_at_unix
-            .map(|at| Duration::from_secs(at.saturating_sub(now_unix)));
+        let until = |at: u64| Duration::from_secs(at.saturating_sub(now_unix));
         [
-            Some(self.poll_at.saturating_duration_since(now)),
+            Some(until(self.poll_at_unix)),
             self.countdown_at
                 .map(|at| at.saturating_duration_since(now)),
-            update,
+            self.update_at_unix.map(until),
         ]
         .into_iter()
         .flatten()
@@ -204,7 +213,7 @@ impl Deadlines {
         now_unix: u64,
     ) -> Vec<Action> {
         let interval_secs = interval_secs.map(|secs| secs.max(MIN_UPDATE_INTERVAL.as_secs()));
-        match update_check_due(last_check_unix, interval_secs, now_unix) {
+        match update_check_due(last_check_unix, interval_secs, now_unix, &self.tz) {
             None => {
                 self.update_at_unix = None;
                 Vec::new()
@@ -220,18 +229,24 @@ impl Deadlines {
         }
     }
 
-    /// Delay before the next try after the current run of failures:
-    /// `UPDATE_RETRY_BASE * 2^failures`, capped at the check interval.
-    fn retry_delay(&self, interval_secs: u64) -> Duration {
-        let factor = 1u32.checked_shl(self.update_failures).unwrap_or(u32::MAX);
-        UPDATE_RETRY_BASE
-            .saturating_mul(factor)
-            .min(update_interval(interval_secs))
+    /// The poll boundary after `now_unix`.
+    fn next_poll(&self, now_unix: u64) -> u64 {
+        clock_slot(self.poll_interval.as_secs(), now_unix, &self.tz).1
     }
-}
 
-fn update_interval(secs: u64) -> Duration {
-    Duration::from_secs(secs).max(MIN_UPDATE_INTERVAL)
+    /// The update-check boundary after `now_unix`.
+    fn next_update(&self, interval_secs: u64, now_unix: u64) -> u64 {
+        let interval_secs = interval_secs.max(MIN_UPDATE_INTERVAL.as_secs());
+        clock_slot(interval_secs, now_unix, &self.tz).1
+    }
+
+    /// Delay before the next try after the current run of failures:
+    /// `UPDATE_RETRY_BASE * 2^failures`; the caller caps it at the next
+    /// boundary.
+    fn retry_delay(&self) -> Duration {
+        let factor = 1u32.checked_shl(self.update_failures).unwrap_or(u32::MAX);
+        UPDATE_RETRY_BASE.saturating_mul(factor)
+    }
 }
 
 /// Whether the wall clock ran ahead of `Instant` by more than
@@ -260,7 +275,7 @@ where
     std::thread::Builder::new()
         .name("scheduler".into())
         .spawn(move || {
-            let (deadlines, initial) = Deadlines::new(config, Instant::now(), unix_now());
+            let (deadlines, initial) = Deadlines::new(config, unix_now());
             for action in initial {
                 host.run(action);
             }
@@ -282,7 +297,7 @@ fn run_loop<H: SchedulerHost>(mut deadlines: Deadlines, rx: &Receiver<Message>,
                 "wall clock moved {wall_elapsed:?} while Instant moved {instant_elapsed:?}; \
                  treating it as a resume from sleep"
             );
-            for action in deadlines.resume(now) {
+            for action in deadlines.resume(unix_now()) {
                 host.run(action);
             }
         }
@@ -308,71 +323,97 @@ mod tests {
     use super::*;
     use std::sync::mpsc::{self, Sender};
 
+    use jiff::tz;
+
     use crate::core::settings::{
         UPDATE_CHECK_DAILY_SECS, UPDATE_CHECK_HOURLY_SECS, UPDATE_CHECK_WEEKLY_SECS,
     };
 
     const MIN: Duration = Duration::from_secs(60);
+    const M: u64 = 60;
+    const HOUR: u64 = 60 * M;
+    const DAY: u64 = 24 * HOUR;
+    /// Friday 2027-01-15 08:00:00 UTC, a whole hour.
     const NOW_UNIX: u64 = 1_800_000_000;
-    const DAY: u64 = 24 * 60 * 60;
+    /// The Monday 00:00 UTC that starts `NOW_UNIX`'s week.
+    const MONDAY: u64 = NOW_UNIX - 4 * DAY - 8 * HOUR;
 
     fn config(update: Option<u64>, last: Option<u64>) -> Config {
         Config {
             poll_interval: 5 * MIN,
             update_interval_secs: update,
             last_update_check_unix: last,
+            tz: TimeZone::UTC,
         }
     }
 
     #[test]
-    fn poll_fires_every_interval() {
+    fn poll_fires_on_interval_boundaries() {
         let t0 = Instant::now();
-        let (mut d, initial) = Deadlines::new(config(None, None), t0, NOW_UNIX);
+        // Started at 08:02:10, a 5-minute poll is next due at 08:05:00.
+        let start = NOW_UNIX + 2 * M + 10;
+        let (mut d, initial) = Deadlines::new(config(None, None), start);
         assert!(initial.is_empty());
-        assert_eq!(d.next_wakeup(t0, NOW_UNIX), 5 * MIN);
-        assert!(d.take_due(t0 + 4 * MIN, NOW_UNIX).is_empty());
-        assert_eq!(d.take_due(t0 + 5 * MIN, NOW_UNIX), [Action::Poll]);
-        assert_eq!(d.next_wakeup(t0 + 5 * MIN, NOW_UNIX), 5 * MIN);
-        assert_eq!(d.take_due(t0 + 10 * MIN, NOW_UNIX), [Action::Poll]);
+        assert_eq!(d.next_wakeup(t0, start), Duration::from_secs(2 * M + 50));
+        assert!(d.take_due(t0, NOW_UNIX + 5 * M - 1).is_empty());
+        assert_eq!(d.take_due(t0, NOW_UNIX + 5 * M), [Action::Poll]);
+        assert_eq!(d.next_wakeup(t0, NOW_UNIX + 5 * M), 5 * MIN);
+        // A late wake-up keeps the boundaries: 08:10:20 re-arms 08:15:00.
+        assert_eq!(d.take_due(t0, NOW_UNIX + 10 * M + 20), [Action::Poll]);
+        assert!(d.take_due(t0, NOW_UNIX + 15 * M - 1).is_empty());
+        assert_eq!(d.take_due(t0, NOW_UNIX + 15 * M), [Action::Poll]);
+    }
+
+    #[test]
+    fn poll_boundaries_follow_the_local_clock() {
+        // At +05:45, 5-minute boundaries fall on the local :00, :05 and so
+        // on, which is UTC :15, :20 and so on.
+        let mut cfg = config(None, None);
+        cfg.tz = TimeZone::fixed(tz::Offset::from_seconds(5 * 3_600 + 45 * 60).unwrap());
+        cfg.poll_interval = 60 * MIN;
+        let (d, _) = Deadlines::new(cfg, NOW_UNIX);
+        assert_eq!(
+            d.next_wakeup(Instant::now(), NOW_UNIX),
+            Duration::from_secs(15 * M)
+        );
     }
 
     #[test]
     fn poll_now_polls_without_moving_the_periodic_deadline() {
         let t0 = Instant::now();
-        let (mut d, _) = Deadlines::new(config(None, None), t0, NOW_UNIX);
+        let (mut d, _) = Deadlines::new(config(None, None), NOW_UNIX);
         assert_eq!(
-            d.handle(Message::PollNow, t0 + 2 * MIN, NOW_UNIX),
+            d.handle(Message::PollNow, t0, NOW_UNIX + 2 * M),
             [Action::Poll]
         );
-        assert_eq!(d.take_due(t0 + 5 * MIN, NOW_UNIX), [Action::Poll]);
+        assert_eq!(d.take_due(t0, NOW_UNIX + 5 * M), [Action::Poll]);
     }
 
     #[test]
-    fn new_poll_interval_rearms_from_now_without_polling() {
+    fn new_poll_interval_rearms_at_its_next_boundary_without_polling() {
         let t0 = Instant::now();
-        let (mut d, _) = Deadlines::new(config(None, None), t0, NOW_UNIX);
-        let t1 = t0 + 4 * MIN;
+        let (mut d, _) = Deadlines::new(config(None, None), NOW_UNIX);
+        let t1 = NOW_UNIX + 4 * M;
         assert!(d
-            .handle(Message::SetPollInterval(MIN * 15), t1, NOW_UNIX)
+            .handle(Message::SetPollInterval(MIN * 15), t0, t1)
             .is_empty());
-        assert!(d.take_due(t0 + 5 * MIN, NOW_UNIX).is_empty());
-        assert_eq!(d.next_wakeup(t1, NOW_UNIX), 15 * MIN);
-        assert_eq!(d.take_due(t1 + 15 * MIN, NOW_UNIX), [Action::Poll]);
+        assert!(d.take_due(t0, NOW_UNIX + 5 * M).is_empty());
+        assert_eq!(d.next_wakeup(t0, t1), 11 * MIN);
+        assert_eq!(d.take_due(t0, NOW_UNIX + 15 * M), [Action::Poll]);
     }
 
     #[test]
     fn a_zero_poll_interval_is_floored() {
-        let t0 = Instant::now();
         let mut cfg = config(None, None);
         cfg.poll_interval = Duration::ZERO;
-        let (d, _) = Deadlines::new(cfg, t0, NOW_UNIX);
-        assert_eq!(d.next_wakeup(t0, NOW_UNIX), MIN_POLL_INTERVAL);
+        let (d, _) = Deadlines::new(cfg, NOW_UNIX);
+        assert_eq!(d.next_wakeup(Instant::now(), NOW_UNIX), MIN_POLL_INTERVAL);
     }
 
     #[test]
     fn countdown_fires_once_until_rearmed() {
         let t0 = Instant::now();
-        let (mut d, _) = Deadlines::new(config(None, None), t0, NOW_UNIX);
+        let (mut d, _) = Deadlines::new(config(None, None), NOW_UNIX);
         let delay = Duration::from_secs(31);
         d.handle(Message::RecomputeCountdown(Some(delay)), t0, NOW_UNIX);
         assert_eq!(d.next_wakeup(t0, NOW_UNIX), delay);
@@ -384,42 +425,10 @@ mod tests {
         assert!(d.take_due(t0 + 2 * delay, NOW_UNIX).is_empty());
     }
 
-    #[test]
-    fn startup_checks_for_updates_when_due() {
-        let t0 = Instant::now();
-        let hourly = Some(UPDATE_CHECK_HOURLY_SECS);
-        let (_, never_checked) = Deadlines::new(config(hourly, None), t0, NOW_UNIX);
-        assert_eq!(never_checked, [Action::CheckForUpdates]);
-        let (_, stale) = Deadlines::new(config(hourly, Some(NOW_UNIX - 2 * 3_600)), t0, NOW_UNIX);
-        assert_eq!(stale, [Action::CheckForUpdates]);
-        let (_, disabled) = Deadlines::new(config(None, None), t0, NOW_UNIX);
-        assert!(disabled.is_empty());
-    }
-
-    #[test]
-    fn startup_waits_for_the_remainder_when_not_due() {
-        let t0 = Instant::now();
-        let (mut d, initial) = Deadlines::new(
-            config(Some(UPDATE_CHECK_HOURLY_SECS), Some(NOW_UNIX - 600)),
-            t0,
-            NOW_UNIX,
-        );
-        assert!(initial.is_empty());
-        let remaining = 3_000;
-        assert!(!d
-            .take_due(t0, NOW_UNIX + remaining - 60)
-            .contains(&Action::CheckForUpdates));
-        assert_eq!(d.next_wakeup(t0, NOW_UNIX + remaining - 60), MIN);
-        assert_eq!(
-            d.take_due(t0, NOW_UNIX + remaining),
-            [Action::CheckForUpdates]
-        );
-    }
-
-    /// Whether a check is due at `now_unix`, with `Instant` left at `t0`
-    /// to show the update deadline follows the wall clock alone.
-    fn check_due(d: &mut Deadlines, t0: Instant, now_unix: u64) -> bool {
-        d.take_due(t0, now_unix).contains(&Action::CheckForUpdates)
+    /// Whether a check is due at `now_unix`.
+    fn check_due(d: &mut Deadlines, now_unix: u64) -> bool {
+        d.take_due(Instant::now(), now_unix)
+            .contains(&Action::CheckForUpdates)
     }
 
     fn done(interval_secs: Option<u64>, succeeded: bool) -> Message {
@@ -430,76 +439,118 @@ mod tests {
     }
 
     #[test]
-    fn only_a_finished_check_rearms_the_full_interval() {
-        let t0 = Instant::now();
-        let hour = UPDATE_CHECK_HOURLY_SECS;
-        let (mut d, initial) = Deadlines::new(config(Some(hour), None), t0, NOW_UNIX);
-        assert_eq!(initial, [Action::CheckForUpdates]);
-        // While the check runs nothing else is scheduled for it.
-        assert!(!check_due(&mut d, t0, NOW_UNIX + 3 * hour));
-
-        let t1 = NOW_UNIX + 3 * hour;
-        d.handle(done(Some(hour), true), t0, t1);
-        assert!(!check_due(&mut d, t0, t1 + hour / 2));
-        assert!(check_due(&mut d, t0, t1 + hour));
-        // It repeats every interval, not just once.
-        let t2 = t1 + hour;
-        d.handle(done(Some(hour), true), t0, t2);
-        assert!(check_due(&mut d, t0, t2 + hour));
+    fn startup_checks_only_when_a_boundary_passed_since_the_last_check() {
+        let hourly = Some(UPDATE_CHECK_HOURLY_SECS);
+        let (_, never_checked) = Deadlines::new(config(hourly, None), NOW_UNIX + M);
+        assert_eq!(never_checked, [Action::CheckForUpdates]);
+        // Checked at 07:59:59, started at 08:01: 08:00 passed in between.
+        let (_, passed) = Deadlines::new(config(hourly, Some(NOW_UNIX - 1)), NOW_UNIX + M);
+        assert_eq!(passed, [Action::CheckForUpdates]);
+        // Checked at 08:00:30, started at 08:59: no boundary yet, so it
+        // waits for 09:00.
+        let (mut d, waiting) =
+            Deadlines::new(config(hourly, Some(NOW_UNIX + 30)), NOW_UNIX + 59 * M);
+        assert!(waiting.is_empty());
+        assert!(!check_due(&mut d, NOW_UNIX + HOUR - 1));
+        assert!(check_due(&mut d, NOW_UNIX + HOUR));
+        let (_, disabled) = Deadlines::new(config(None, None), NOW_UNIX);
+        assert!(disabled.is_empty());
     }
 
     #[test]
-    fn a_failed_check_retries_with_a_doubling_delay_capped_at_the_interval() {
-        let t0 = Instant::now();
+    fn daily_and_weekly_checks_fall_on_local_midnight() {
+        let daily = Some(UPDATE_CHECK_DAILY_SECS);
+        let midnight = NOW_UNIX - 8 * HOUR;
+        let (_, before) = Deadlines::new(config(daily, Some(midnight - 1)), NOW_UNIX);
+        assert_eq!(before, [Action::CheckForUpdates]);
+        let (mut d, after) = Deadlines::new(config(daily, Some(midnight)), NOW_UNIX);
+        assert!(after.is_empty());
+        assert!(!check_due(&mut d, midnight + DAY - 1));
+        assert!(check_due(&mut d, midnight + DAY));
+
+        let weekly = Some(UPDATE_CHECK_WEEKLY_SECS);
+        let (mut d, initial) = Deadlines::new(config(weekly, Some(MONDAY + 1)), NOW_UNIX);
+        assert!(initial.is_empty());
+        assert!(!check_due(&mut d, MONDAY + 7 * DAY - 1));
+        assert!(check_due(&mut d, MONDAY + 7 * DAY));
+
+        // At UTC+07:00 local midnight is 17:00 UTC the day before.
+        let mut cfg = config(daily, Some(NOW_UNIX));
+        cfg.tz = TimeZone::fixed(tz::offset(7));
+        let (mut d, _) = Deadlines::new(cfg, NOW_UNIX);
+        assert!(!check_due(&mut d, NOW_UNIX + 9 * HOUR - 1));
+        assert!(check_due(&mut d, NOW_UNIX + 9 * HOUR));
+    }
+
+    #[test]
+    fn a_finished_check_rearms_at_the_next_boundary() {
         let hour = UPDATE_CHECK_HOURLY_SECS;
-        let (mut d, _) = Deadlines::new(config(Some(hour), None), t0, NOW_UNIX);
+        let (mut d, initial) = Deadlines::new(config(Some(hour), None), NOW_UNIX);
+        assert_eq!(initial, [Action::CheckForUpdates]);
+        // While the check runs nothing else is scheduled for it.
+        assert!(!check_due(&mut d, NOW_UNIX + 3 * hour));
+
+        let t1 = NOW_UNIX + 3 * hour + 20 * M;
+        d.handle(done(Some(hour), true), Instant::now(), t1);
+        assert!(!check_due(&mut d, NOW_UNIX + 4 * hour - 1));
+        assert!(check_due(&mut d, NOW_UNIX + 4 * hour));
+        // It repeats every boundary, not just once.
+        d.handle(done(Some(hour), true), Instant::now(), NOW_UNIX + 4 * hour);
+        assert!(check_due(&mut d, NOW_UNIX + 5 * hour));
+    }
+
+    #[test]
+    fn a_failed_check_retries_with_a_doubling_delay_capped_at_the_next_boundary() {
+        let day = UPDATE_CHECK_DAILY_SECS;
+        let (mut d, _) = Deadlines::new(config(Some(day), None), NOW_UNIX);
         let mut now = NOW_UNIX;
-        for expected in [60, 120, 240, 480, 960, 1_920, hour, hour] {
-            d.handle(done(Some(hour), false), t0, now);
-            assert!(!check_due(&mut d, t0, now + expected - 1));
-            assert!(check_due(&mut d, t0, now + expected));
+        for expected in [60, 120, 240, 480, 960, 1_920, 3_840] {
+            d.handle(done(Some(day), false), Instant::now(), now);
+            assert!(!check_due(&mut d, now + expected - 1));
+            assert!(check_due(&mut d, now + expected));
             now += expected;
         }
+        // The next delay would pass midnight, so it retries at midnight.
+        let midnight = NOW_UNIX - 8 * HOUR + DAY;
+        now = midnight - 10 * M;
+        d.handle(done(Some(day), false), Instant::now(), now);
+        assert!(check_due(&mut d, midnight));
         // A success resets the delay: the next failure retries after a minute.
-        d.handle(done(Some(hour), true), t0, now);
-        assert!(check_due(&mut d, t0, now + hour));
-        now += hour;
-        d.handle(done(Some(hour), false), t0, now);
-        assert!(check_due(&mut d, t0, now + 60));
+        d.handle(done(Some(day), true), Instant::now(), midnight);
+        d.handle(done(Some(day), false), Instant::now(), midnight + HOUR);
+        assert!(check_due(&mut d, midnight + HOUR + 60));
     }
 
     #[test]
     fn a_failed_check_with_auto_check_off_stays_off() {
-        let t0 = Instant::now();
-        let (mut d, _) = Deadlines::new(config(None, None), t0, NOW_UNIX);
-        d.handle(done(None, false), t0, NOW_UNIX);
-        assert!(!check_due(&mut d, t0, NOW_UNIX + 7 * DAY));
+        let (mut d, _) = Deadlines::new(config(None, None), NOW_UNIX);
+        d.handle(done(None, false), Instant::now(), NOW_UNIX);
+        assert!(!check_due(&mut d, NOW_UNIX + 7 * DAY));
     }
 
     #[test]
-    fn the_update_deadline_follows_the_wall_clock_across_a_sleep() {
+    fn the_wall_clock_deadlines_survive_a_sleep() {
         // `Instant` does not advance while the machine sleeps, but the
-        // check is still due once the wall clock passes its time.
+        // deadlines are due once the wall clock passes them.
         let t0 = Instant::now();
         let day = UPDATE_CHECK_DAILY_SECS;
-        let (mut d, _) = Deadlines::new(config(Some(day), Some(NOW_UNIX)), t0, NOW_UNIX);
-        assert!(!check_due(&mut d, t0, NOW_UNIX + day - 1));
-        assert!(check_due(
-            &mut d,
-            t0 + Duration::from_secs(1),
-            NOW_UNIX + day
-        ));
+        let (mut d, _) = Deadlines::new(config(Some(day), Some(NOW_UNIX)), NOW_UNIX);
+        let midnight = NOW_UNIX - 8 * HOUR + DAY;
+        assert!(!d
+            .take_due(t0, midnight - 1)
+            .contains(&Action::CheckForUpdates));
+        assert!(d.take_due(t0, midnight).contains(&Action::CheckForUpdates));
     }
 
     #[test]
-    fn resume_polls_at_once_and_rearms_the_poll() {
+    fn resume_polls_at_once_and_rearms_the_poll_at_its_boundary() {
         let t0 = Instant::now();
-        let (mut d, _) = Deadlines::new(config(None, None), t0, NOW_UNIX);
-        let t1 = t0 + 2 * MIN;
-        assert_eq!(d.resume(t1), [Action::Poll]);
-        assert!(d.take_due(t0 + 5 * MIN, NOW_UNIX).is_empty());
-        assert_eq!(d.next_wakeup(t1, NOW_UNIX), 5 * MIN);
-        assert_eq!(d.take_due(t1 + 5 * MIN, NOW_UNIX), [Action::Poll]);
+        let (mut d, _) = Deadlines::new(config(None, None), NOW_UNIX);
+        let woke = NOW_UNIX + 7 * HOUR + 2 * M;
+        assert_eq!(d.resume(woke), [Action::Poll]);
+        assert!(d.take_due(t0, woke).is_empty());
+        assert_eq!(d.next_wakeup(t0, woke), 3 * MIN);
+        assert_eq!(d.take_due(t0, woke + 3 * M), [Action::Poll]);
     }
 
     #[test]
@@ -520,11 +571,10 @@ mod tests {
     }
 
     #[test]
-    fn weekly_to_daily_with_the_last_check_two_days_ago_checks_at_once() {
-        let t0 = Instant::now();
+    fn weekly_to_daily_checks_at_once_when_midnight_passed_since_the_last_check() {
         let last = Some(NOW_UNIX - 2 * DAY);
         let (mut d, initial) =
-            Deadlines::new(config(Some(UPDATE_CHECK_WEEKLY_SECS), last), t0, NOW_UNIX);
+            Deadlines::new(config(Some(UPDATE_CHECK_WEEKLY_SECS), last), NOW_UNIX);
         assert!(initial.is_empty());
         assert_eq!(
             d.handle(
@@ -532,7 +582,7 @@ mod tests {
                     interval_secs: Some(UPDATE_CHECK_DAILY_SECS),
                     last_check_unix: last,
                 },
-                t0,
+                Instant::now(),
                 NOW_UNIX,
             ),
             [Action::CheckForUpdates]
@@ -540,44 +590,40 @@ mod tests {
     }
 
     #[test]
-    fn daily_to_weekly_waits_for_the_new_remainder() {
-        let t0 = Instant::now();
+    fn daily_to_weekly_waits_for_monday() {
         let last = Some(NOW_UNIX - 2 * DAY);
-        let (mut d, _) = Deadlines::new(config(Some(UPDATE_CHECK_HOURLY_SECS), last), t0, NOW_UNIX);
+        let (mut d, _) = Deadlines::new(config(Some(UPDATE_CHECK_HOURLY_SECS), last), NOW_UNIX);
         let actions = d.handle(
             Message::SetUpdateInterval {
                 interval_secs: Some(UPDATE_CHECK_WEEKLY_SECS),
                 last_check_unix: last,
             },
-            t0,
+            Instant::now(),
             NOW_UNIX,
         );
         assert!(actions.is_empty());
-        let remaining = 5 * DAY;
-        assert!(!check_due(&mut d, t0, NOW_UNIX + remaining - 60));
-        assert!(check_due(&mut d, t0, NOW_UNIX + remaining));
+        assert!(!check_due(&mut d, MONDAY + 7 * DAY - 1));
+        assert!(check_due(&mut d, MONDAY + 7 * DAY));
     }
 
     #[test]
     fn disabling_auto_check_cancels_the_deadline() {
-        let t0 = Instant::now();
         let (mut d, _) = Deadlines::new(
-            config(Some(UPDATE_CHECK_HOURLY_SECS), Some(NOW_UNIX - 600)),
-            t0,
-            NOW_UNIX,
+            config(Some(UPDATE_CHECK_HOURLY_SECS), Some(NOW_UNIX + 60)),
+            NOW_UNIX + 600,
         );
         d.handle(
             Message::SetUpdateInterval {
                 interval_secs: None,
-                last_check_unix: Some(NOW_UNIX - 600),
+                last_check_unix: Some(NOW_UNIX + 60),
             },
-            t0,
-            NOW_UNIX,
+            Instant::now(),
+            NOW_UNIX + 600,
         );
-        assert!(!check_due(&mut d, t0, NOW_UNIX + 7 * DAY));
+        assert!(!check_due(&mut d, NOW_UNIX + 7 * DAY));
         // A check that finishes after auto-check was turned off stays off.
-        d.handle(done(None, true), t0, NOW_UNIX);
-        assert!(!check_due(&mut d, t0, NOW_UNIX + 14 * DAY));
+        d.handle(done(None, true), Instant::now(), NOW_UNIX);
+        assert!(!check_due(&mut d, NOW_UNIX + 14 * DAY));
     }
 
     /// Records actions on a channel, standing in for the runtime.

ui/bubble.css

@@ -1,21 +1,27 @@
 /* Bubble palette. Accent and fill colours come from the payload. */
 :root[data-theme='dark'] {
-  /* 60% opaque, so the desktop shows through; text and bars stay solid. */
-  --bg: rgb(31 31 31 / 60%);
-  --track: #2c2c2c;
-  --time-track: #404040;
+  /* 80% opaque, so the desktop shows through. Tracks and the edge are
+     tints over it, so they keep the same contrast step on a light or dark
+     desktop; the text halo keeps text readable on either. */
+  --bg: rgb(31 31 31 / 80%);
+  --track: rgb(0 0 0 / 28%);
+  --time-track: rgb(255 255 255 / 14%);
   --time-fill: #b0b0b0;
+  --edge: rgb(255 255 255 / 22%);
   --text: #eaeaea;
-  --muted: #a8a8a8;
+  --muted: #c4c4c4;
+  --halo: 0 0 2px rgb(0 0 0 / 75%);
 }
 
 :root[data-theme='light'] {
-  --bg: rgb(243 243 243 / 60%);
-  --track: #e2e2e2;
-  --time-track: #e0e0e0;
+  --bg: rgb(243 243 243 / 80%);
+  --track: rgb(0 0 0 / 10%);
+  --time-track: rgb(0 0 0 / 8%);
   --time-fill: #666666;
+  --edge: rgb(0 0 0 / 18%);
   --text: #1f1f1f;
-  --muted: #5e5e5e;
+  --muted: #4a4a4a;
+  --halo: 0 0 2px rgb(255 255 255 / 85%);
 }
 
 html,
@@ -56,10 +62,15 @@ body {
   height: 100%;
 }
 
-.rings circle {
+.rings circle,
+.edge {
   fill: none;
 }
 
+.edge {
+  stroke: var(--edge);
+}
+
 .ring-track {
   stroke: var(--track);
 }
@@ -82,6 +93,7 @@ body {
   margin: 0;
   white-space: nowrap;
   color: var(--text);
+  text-shadow: var(--halo);
 }
 
 .head-label {

ui/bubble.html

@@ -9,6 +9,7 @@
   <body>
     <div class="pill" id="pill">
       <svg class="rings" id="rings" aria-hidden="true">
+        <path class="edge" id="edge"></path>
         <circle class="ring-track" id="ring-track"></circle>
         <circle class="ring-arc" id="ring-arc"></circle>
         <circle class="time-ring-track" id="time-ring-track"></circle>

ui/bubble.js

@@ -59,6 +59,8 @@ const FONT_STACK = '"Segoe UI", system-ui, sans-serif';
 /** Weight text is measured at when the caller names none (regular). */
 const MEASURE_WEIGHT = 400;
 const HEAD_LABEL_WEIGHT = 600;
+/** Outline stroke in CSS px; the clip keeps the inner half. */
+const EDGE_STROKE = 2;
 
 const slug = windowLabel.replace(/^bubble-/, '');
 
@@ -80,6 +82,8 @@ function byId(id) {
 const pill = byId('pill');
 /** @type {SVGSVGElement} */
 const rings = byId('rings');
+/** @type {SVGPathElement} */
+const edge = byId('edge');
 /** @type {SVGCircleElement} */
 const ringTrack = byId('ring-track');
 /** @type {SVGCircleElement} */
@@ -221,6 +225,9 @@ function relayout(p) {
   const outline = outlinePath(cssPx(p.canvasW, p.dpi), cssPx(p.canvasH, p.dpi));
   pill.style.clipPath = `path('${outline}')`;
   rings.setAttribute('viewBox', `0 0 ${p.canvasW} ${p.canvasH}`);
+  // Half the stroke falls outside the clip, leaving a 1 px edge.
+  edge.setAttribute('d', outlinePath(p.canvasW, p.canvasH));
+  edge.setAttribute('stroke-width', String((EDGE_STROKE * p.dpi) / BASE_DPI));
   placeCircle(ringTrack, head.ringCx, head.ringCy, head.ringRadius, head.ringStroke);
   placeCircle(ringArc, head.ringCx, head.ringCy, head.ringRadius, head.ringStroke);
   placeCircle(timeRingTrack, head.ringCx, head.ringCy, head.timeRingRadius, head.timeRingStroke);