diff --git a/CHANGELOG.md b/CHANGELOG.md index 6661df6..00d94d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,15 @@ All notable changes to this project will be documented in this file. ## [Unreleased] -Target version: `0.2.1`. This is a local candidate, not a published release. +## [0.2.1] - 2026-10-14 ### Changed - Share one two-second connection-retry deadline across the read-only status pipe and its legacy control fallback, preserving the initial status startup grace and ordinary control retries. The unavailable-endpoint wait targets about two seconds plus scheduling overhead; connected reply reads are not bounded by this deadline. +- Add isolated native Windows singleton tests for primary/secondary claims, handle cleanup, bounded retries and reclaim after owner release. These tests do not start protection or validate an elevated relaunch; same-session mutex denial-of-service hardening remains pending. - Gate release tags on matching package/lock/manifest versions, main-branch provenance and successful Windows checks for the exact commit. Build and transfer the same checked binary into a draft only; publication remains manual. - Bound newline-terminated control IPC requests to 4096 bytes and one total second, preserving independent status availability and rejection/recovery behavior. +- Fix a missed status wake-up between named-pipe instances that could leave shutdown waiting for the status worker. Cover the creation gap with an isolated regression that verifies cleanup without a rescue connection. +- Add passive physical-power validation preparation and checkpoint scripts with mocked diagnostic checks; physical S3/monitor, Hibernate and Modern Standby acceptance remains pending. - Validate autostart path access with identification tokens, and record disposable-VM idle-power acceptance without claiming physical hardware coverage. - Bounded `--log --tail N` to 100000 lines and made line-buffer reservation incremental and fallible, so extreme values return a readable error instead of a capacity-overflow panic. - Ensure the runtime unregisters callbacks and shuts down its resources even when the Windows message loop fails; preserve both errors if cleanup also fails. diff --git a/docs/RELEASE_NOTES_DRAFT.md b/docs/RELEASE_NOTES_DRAFT.md index f59c89d..a5a8158 100644 --- a/docs/RELEASE_NOTES_DRAFT.md +++ b/docs/RELEASE_NOTES_DRAFT.md @@ -1,13 +1,24 @@ -# Wardoff v0.2.1 (draft, unreleased) +# Wardoff v0.2.1 -This candidate has not been published. The tag workflow prepares a draft only -after validation; a maintainer must review and publish it separately. +The tag workflow prepares a draft only after validation; a maintainer reviews +the exact candidate and publishes it separately. ## Changes since v0.2.0 - Bound each newline-terminated control request to 4096 wire bytes and one total second. Malformed, oversized, incomplete and disconnected clients cannot hold the control reader indefinitely; status remains independently available. +- Fix a missed status wake-up between named-pipe instances that could leave + shutdown waiting for the status worker. Coordinate instance publication with + the stop request, preserving the separate control and status pipes. +- Share one two-second connection-retry budget between the read-only status pipe + and its legacy control fallback. Unavailable-endpoint discovery targets about + two seconds plus scheduling overhead; connected reply reads remain outside this + budget, and ordinary control retries are unchanged. +- Add isolated native Windows singleton tests for primary/secondary claims, + handle cleanup, bounded retries and reclaim after owner release. They do not + start protection or validate an elevated relaunch, and do not fix the documented + same-session mutex denial-of-service risk. - Use process-owned system/display Power Requests for idle-power protection. Report activation errors synchronously, release on Allow/exit, and renew after the existing resume notification. Explicit Sleep/Hibernate are not vetoed. @@ -15,6 +26,10 @@ after validation; a maintainer must review and publish it separately. trusted-path and same-user/elevation boundaries. - Reject excessive log-tail requests with a readable error and bound allocation. Clean up runtime resources when the Windows message loop fails. +- Provide a passive physical-power validation kit to prepare a case matrix and + collect local checkpoints. Follow the existing + [validation matrix](MVP_VALIDATION_MATRIX.md); actual hardware acceptance remains + separate. - Isolate Windows smoke cleanup, consolidate developer instructions and checks, and validate release provenance, versions and the exact binary before creating a draft. No automatic public release or signing is added. @@ -25,9 +40,18 @@ The draft includes `build-info.json` and `SHA256SUMS.txt` for its exact unsigned MSVC binary and the Windows workflow run. Review the run and its explicit smoke skips before publishing. A green run on another commit is not release evidence. -- Disposable-VM idle-power results are recorded in - [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md); physical S3/monitor, - Hibernate and Modern Standby acceptance remains incomplete. +- An isolated status-shutdown regression reproduces the missed wake-up on the + prior worker, then verifies joined threads and endpoint cleanup without a + rescue connection after the correction. It does not establish the cause of the + earlier CI stall. +- The passive validation kit passes 111 checks with diagnostics mocked. Those + checks validate preparation, not actual sleep, display timeout, Hibernate or + Modern Standby behavior. +- Eight historical disposable-VM idle-power cases passed for source `4041db0` + and the earlier retained binary identified in + [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md). Those results do not qualify + the new v0.2.1 binary. Physical S3/monitor, Hibernate and Modern Standby acceptance + remains incomplete. - Missing UpdateOrchestrator Reboot tasks and unavailable interactive linked tokens cause documented smoke skips, not successful coverage of those paths. - Same-session mutex denial of service, the status pipe DACL and other residual