docs: point downloads to Hex 2.1.17 and record release verification

Author: kitlangton

README.md

@@ -61,7 +61,7 @@ Or install manually:
 HEX checks for signed updates automatically. Use **HEX > Check for Updates...**
 to check immediately.
 
-**Download blocked?** [Alternative download: GitHub — Hex 2.1.16](https://github.com/anomalyco/hex/releases/download/app-v2.1.16/HEX-2.1.16-arm64.dmg)
+**Download blocked?** [Alternative download: GitHub — Hex 2.1.17](https://github.com/anomalyco/hex/releases/download/app-v2.1.17/HEX-2.1.17-arm64.dmg)
 contains the identical signed DMG for Apple silicon and macOS 15+. App releases
 use `app-v…` tags; the repository also publishes separate TypeScript SDK releases.
 If an older installation cannot check for updates on your network, install the

docs/downloads.md

@@ -46,6 +46,11 @@ App and model downloads have different hosts. Managed networks may need to allow
 - `huggingface.co` and its model download CDN for dictation-model setup.
 - `download.moonshine.ai` for optional Voice Commands.
 
+On September 11, 2026, a HEAD request for the pinned default Parakeet Unified
+English artifact followed `huggingface.co` to `us.aws.cdn.hf.co` and returned
+HTTP 200. This is an observed delivery host, not a permanent exhaustive CDN list.
+No model body was downloaded for that check.
+
 If the old update endpoint is blocked, install the new signed DMG manually.
 After restoring model-host access, retry preparation in Settings or choose
 Retry for Commands. Transfer failures preserve partial downloads. App download
@@ -74,3 +79,40 @@ not establish access from a particular enterprise network.
 - No signed Linux feed has been published yet. Linux installer/updater source
   defaults were migrated; no Linux native install or enterprise-network test
   was performed as part of these hosting checks.
+
+## Observed 2.1.17 Publication — September 11, 2026
+
+Published macOS build 20117 from `5825a84`, including the new built-in Sparkle
+feed URL and model-download recovery copy. Both the app and DMG were accepted by
+Apple's notarization service and stapled. Bundle identity, signing team, Sparkle
+key, archive layout, and both packaged app copies passed the release validator.
+The packaged executable reported 2.1.17 without launching the GUI; its dynamic
+library list contained no Homebrew or `/usr/local` dependency.
+
+- DMG SHA-256: `b8b9d0abecd86a73169ded8941b7c1979bd22d7fc838cc7b9e8696f15570bcc8`.
+- Sparkle ZIP SHA-256: `b773685fba2fb105c91eb30a4a8434003bcba300bece837149b3f42a5fcf17ce`.
+- The ZIP's Ed25519 signature was independently verified against the public key
+  inside its app. The custom-domain DMG, ZIP, and latest-DMG pointer matched the
+  prepared files byte-for-byte after publication. Both feed endpoints returned
+  the identical 2.1.17 appcast using a Sparkle user agent.
+- The GitHub `app-v2.1.17` release is public and its DMG has the same SHA-256.
+  Homebrew's cask is pinned to that version and checksum; its style check passed.
+- A clean headless Chromium session blocked all `*.r2.dev` requests, clicked the
+  live site's primary download, and verified the complete DMG's checksum. With
+  the custom download host also blocked, clicking the GitHub alternative still
+  downloaded the identical DMG. This proves independent browser download paths,
+  not a particular enterprise's gateway behavior.
+- Live desktop and mobile renders showed 2.1.17, requirements, and the alternate
+  link without horizontal overflow. Curl, Homebrew, Sparkle, Python, and browser
+  user-agent probes received direct 206 responses for ranged downloads during
+  the hostname migration.
+- The mirror helper was also run against an intentionally different local DMG
+  for an existing release. It rejected the mismatch before publishing or
+  replacing the GitHub asset.
+- Final debug and release suites each passed 457 tests with 10 opt-in tests
+  ignored, plus all 12 keyboard-layout child processes per profile. Strict
+  all-target/all-feature Clippy passed in both profiles. Formatting, app identity
+  guards, shell syntax, diff checks, and the site's production build passed.
+
+No native in-place Sparkle installation, new model download, microphone capture,
+or Linux binary publication was performed in this release verification.

docs/features/README.md

@@ -5,8 +5,8 @@ This maps existing behavior. [ROADMAP.md](../../ROADMAP.md) owns future work;
 [AGENTS.md](../../AGENTS.md) owns implementation invariants.
 
 Initial source baseline: September 1, 2026, `9e9da53aa9ed`. Public macOS release:
-[2.1.16](../releases/2.1.16.md), with the long-form Cohere correction and menu-bar
-model switching. The initial map was source-only. Listed checks are
+[2.1.17](../releases/2.1.17.md), with custom-domain downloads, a GitHub DMG mirror,
+and model-download recovery guidance. The initial map was source-only. Listed checks are
 locators unless an executed result is explicitly recorded, as in the
 [keyboard-layout verification](recovery.md#keyboard-layout-resolution).
 

site/src/App.tsx

@@ -1,7 +1,7 @@
 import * as m from "motion/react-m"
 import ChatteringTeeth from "./ChatteringTeeth"
 
-const MAC_VERSION = "2.1.16"
+const MAC_VERSION = "2.1.17"
 const DOWNLOAD_URL =
   `https://downloads.hex.kitlangton.dev/releases/HEX-${MAC_VERSION}-arm64.dmg`
 const GITHUB_DOWNLOAD_URL =