docs: finalize v0.2.1 release notes

CHANGELOG.md

@@ -4,12 +4,15 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
-Target version: `0.2.1`. This is a local candidate, not a published release.
+## [0.2.1] - 2026-10-14
 
 ### Changed
 - Share one two-second connection-retry deadline across the read-only status pipe and its legacy control fallback, preserving the initial status startup grace and ordinary control retries. The unavailable-endpoint wait targets about two seconds plus scheduling overhead; connected reply reads are not bounded by this deadline.
+- Add isolated native Windows singleton tests for primary/secondary claims, handle cleanup, bounded retries and reclaim after owner release. These tests do not start protection or validate an elevated relaunch; same-session mutex denial-of-service hardening remains pending.
 - Gate release tags on matching package/lock/manifest versions, main-branch provenance and successful Windows checks for the exact commit. Build and transfer the same checked binary into a draft only; publication remains manual.
 - Bound newline-terminated control IPC requests to 4096 bytes and one total second, preserving independent status availability and rejection/recovery behavior.
+- Fix a missed status wake-up between named-pipe instances that could leave shutdown waiting for the status worker. Cover the creation gap with an isolated regression that verifies cleanup without a rescue connection.
+- Add passive physical-power validation preparation and checkpoint scripts with mocked diagnostic checks; physical S3/monitor, Hibernate and Modern Standby acceptance remains pending.
 - Validate autostart path access with identification tokens, and record disposable-VM idle-power acceptance without claiming physical hardware coverage.
 - Bounded `--log --tail N` to 100000 lines and made line-buffer reservation incremental and fallible, so extreme values return a readable error instead of a capacity-overflow panic.
 - Ensure the runtime unregisters callbacks and shuts down its resources even when the Windows message loop fails; preserve both errors if cleanup also fails.

docs/RELEASE_NOTES_DRAFT.md

@@ -1,20 +1,35 @@
-# Wardoff v0.2.1 (draft, unreleased)
+# Wardoff v0.2.1
 
-This candidate has not been published. The tag workflow prepares a draft only
-after validation; a maintainer must review and publish it separately.
+The tag workflow prepares a draft only after validation; a maintainer reviews
+the exact candidate and publishes it separately.
 
 ## Changes since v0.2.0
 
 - Bound each newline-terminated control request to 4096 wire bytes and one total
   second. Malformed, oversized, incomplete and disconnected clients cannot hold
   the control reader indefinitely; status remains independently available.
+- Fix a missed status wake-up between named-pipe instances that could leave
+  shutdown waiting for the status worker. Coordinate instance publication with
+  the stop request, preserving the separate control and status pipes.
+- Share one two-second connection-retry budget between the read-only status pipe
+  and its legacy control fallback. Unavailable-endpoint discovery targets about
+  two seconds plus scheduling overhead; connected reply reads remain outside this
+  budget, and ordinary control retries are unchanged.
+- Add isolated native Windows singleton tests for primary/secondary claims,
+  handle cleanup, bounded retries and reclaim after owner release. They do not
+  start protection or validate an elevated relaunch, and do not fix the documented
+  same-session mutex denial-of-service risk.
 - Use process-owned system/display Power Requests for idle-power protection.
   Report activation errors synchronously, release on Allow/exit, and renew after
   the existing resume notification. Explicit Sleep/Hibernate are not vetoed.
 - Fix autostart access checks to use identification tokens. Keep the existing
   trusted-path and same-user/elevation boundaries.
 - Reject excessive log-tail requests with a readable error and bound allocation.
   Clean up runtime resources when the Windows message loop fails.
+- Provide a passive physical-power validation kit to prepare a case matrix and
+  collect local checkpoints. Follow the existing
+  [validation matrix](MVP_VALIDATION_MATRIX.md); actual hardware acceptance remains
+  separate.
 - Isolate Windows smoke cleanup, consolidate developer instructions and checks,
   and validate release provenance, versions and the exact binary before creating
   a draft. No automatic public release or signing is added.
@@ -25,9 +40,18 @@ The draft includes `build-info.json` and `SHA256SUMS.txt` for its exact unsigned
 MSVC binary and the Windows workflow run. Review the run and its explicit smoke
 skips before publishing. A green run on another commit is not release evidence.
 
-- Disposable-VM idle-power results are recorded in
-  [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md); physical S3/monitor,
-  Hibernate and Modern Standby acceptance remains incomplete.
+- An isolated status-shutdown regression reproduces the missed wake-up on the
+  prior worker, then verifies joined threads and endpoint cleanup without a
+  rescue connection after the correction. It does not establish the cause of the
+  earlier CI stall.
+- The passive validation kit passes 111 checks with diagnostics mocked. Those
+  checks validate preparation, not actual sleep, display timeout, Hibernate or
+  Modern Standby behavior.
+- Eight historical disposable-VM idle-power cases passed for source `4041db0`
+  and the earlier retained binary identified in
+  [IDLE_POWER_VALIDATION.md](IDLE_POWER_VALIDATION.md). Those results do not qualify
+  the new v0.2.1 binary. Physical S3/monitor, Hibernate and Modern Standby acceptance
+  remains incomplete.
 - Missing UpdateOrchestrator Reboot tasks and unavailable interactive linked
   tokens cause documented smoke skips, not successful coverage of those paths.
 - Same-session mutex denial of service, the status pipe DACL and other residual