This file keeps the release record. GitHub Release bodies are generated from the English section only.
No unreleased changes.
- Repaired stale-status recovery around one exact live Codex root, rejecting ambiguous roots and stale identity correlation.
- Added exact, safe lifecycle diagnostics that explain rejected repair evidence without broad process actions.
- TrayHost's native message loop now preserves the target HWND when redispatching posted work, so presentation updates reach the owner window and exact revision acknowledgements complete; About and language actions no longer time out.
- The acknowledged initial revision now serves as the current capability baseline until the first Supervisor projection, preventing startup or recovery windows from rejecting enabled About and language commands.
- Guardian now treats correlated transient static probe failures as retryable instead of permanently classifying the entire Supervisor lifetime as incompatible, so a stable replacement Codex root is inspected and taken over after logon races.
- TrayHost 原生消息循环在重新分发 posted work 时会保留目标 HWND，使 presentation 更新真正到达 owner window 并完成精确 revision acknowledgement；“关于”和语言操作不再超时。
- 在 Supervisor 首次 projection 前，已确认的初始 revision 会作为当前能力基线，避免启动或恢复窗口错误拒绝菜单中已启用的“关于”和语言命令。
- Guardian 会把相关联的瞬态 StaticProbe 失败保留为可重试状态，不再把整个 Supervisor 生命周期永久判为不兼容；登录启动竞态结束并出现稳定的新 Codex 根后，会重新检查并接管。
- Fixed installer readiness identity on Windows: CIM exposes process creation at microsecond precision while
Get-Processretains 100-nanosecond ticks. The verifier now accepts only the same truncated microsecond (a 0–9 tick forward delta), so the exact new Supervisor can reach its authenticated TrayHost Ready signal without weakening PID-reuse protection.
- 修复 Windows 安装就绪身份校验：CIM 只提供微秒精度的进程创建时间，而
Get-Process保留 100 纳秒 tick。校验器现在只接受同一截断微秒（向前 0–9 tick），使精确的新 Supervisor 能等待到已认证的 TrayHost Ready 信号，同时不放宽 PID 复用防护。
- Restored About, language selection, and Open logs by authorizing every tray action against the exact displayed and acknowledged presentation plus the current capability set; rejected or failed actions now surface localized feedback instead of disappearing silently.
- Removed the post-copy Setup pause: activation receipts are compact and tolerate legal JSON whitespace, new-runtime readiness retries the early Ready-event creation race, and Setup waits for an owned, deadline-bounded installer process to exit before a separate strict terminal validator can authorize success.
- 恢复“关于”、语言切换和“打开日志”：每个托盘操作都会同时校验实际显示并确认过的 presentation 与当前能力；被拒绝或执行失败的操作会显示本地化反馈，不再静默消失。
- 消除文件复制后的安装等待：activation receipt 使用紧凑 JSON 并接受合法空白，新 runtime 就绪检查会重试早期 Ready event 创建竞态；Setup 会等待受控且有截止时间的 installer 进程退出，再由独立严格终态校验器决定是否成功。
- Fixed LifecycleWorker request construction: ordinary observation now supplies an explicit schema-one empty status object, while
restartOrdinaryremains disabled for Close and enabled for Apply/Inspect repair actions. - Ordinary observation now uses the durable lifecycle creation time as its lower bound, so an automatically restored Codex root that appears just before the AppsFolder request remains eligible after the prior Close was proven.
- Supervisor now rebuilds special-process proof through one manifest-bound strong Inspect after lifecycle verification or restart; rebind failures produce one terminal receipt and suppress same-root Guardian retry loops.
- 修复 LifecycleWorker 请求构造：普通根观察会传入必需的空状态对象；
restartOrdinary对 Close 保持禁用，对 Apply/Inspect 修复动作启用。 - 普通根观察现在使用持久生命周期创建时间作为下限；此前 Close 已证明完成时，即使 Codex 自动恢复略早于 AppsFolder 请求，该普通根仍可被接受。
- Supervisor 现在只通过一次 manifest-bound 强 Inspect 在生命周期验证或自身重启后重建 special 进程证明；重绑定失败会生成一个终态回执，并抑制同根 Guardian 重试循环。
- Normalized the Windows native process-query exit race that can return Win32 error 31 immediately after an exact controller stop. The query is treated as exited only when an independent PID probe also proves the process absent or exited; a live or reused PID still fails closed.
- Added regression coverage for the absent-PID, live/PID-reuse, and unrelated native-error boundaries so a successful Close can advance instead of ending as
CCOD_SESSION_FAILED.
- 规范化 Windows 原生进程查询在精确停止后可能返回 Win32 error 31 的退出竞态。只有独立 PID 探针也证明进程不存在或已退出时才视为退出；PID 仍存活或被复用时继续失败关闭。
- 增加 PID 不存在、PID 存活/复用及其他原生错误的回归覆盖，使成功的 Close 能继续推进，而不再以
CCOD_SESSION_FAILED结束。
- Bound the LifecycleWorker delegated-ownership callback before dot-sourcing
SessionController.ps1. Its validatedActionparameter can no longer invalidateGetNewClosure(), so Close, Apply, and VerifyRemote now reach the manifest-bound controller instead of failing withCCOD_LIFECYCLE_OPERATION_FAILED. - Added a real scope-metadata regression that reproduces the PowerShell
ValidationMetadataExceptionand proves the correlated controller result survives the dot-source boundary.
- 在 dot-source
SessionController.ps1前绑定 LifecycleWorker 的 delegated-ownership 回调。控制器带验证的Action参数不再使GetNewClosure()失效，Close、Apply 与 VerifyRemote 现在能进入 manifest 绑定的控制器，而不会以CCOD_LIFECYCLE_OPERATION_FAILED失败。 - 增加真实作用域元数据回归，复现 PowerShell
ValidationMetadataException，并证明相关控制器结果可安全跨越 dot-source 边界。
- Preserved the real nonzero lifecycle-worker exit code after its PID disappears by arming and retaining the exact process handle before resume. A failed worker result now reduces to its durable terminal phase instead of being misread as exit code 0 and terminating the detached Supervisor.
- Recovered
CloseRequestedtransactions no longer treat a still-running ordinary Codex root as closed. The Supervisor repeats the verified close operation before repair, preventing a restart from skipping directly to Apply.
- 在 lifecycle worker 恢复运行前启用并保留精确进程句柄，使 PID 消失后仍能读取真实的非零退出码。失败结果现在会归约到持久终态，不再被误读为退出码 0 并导致脱离计划任务的 Supervisor 退出。
- 恢复中的
CloseRequested事务不再把仍在运行的普通 Codex 根进程当作已关闭；Supervisor 会先重复执行经验证的关闭操作，再进入修复，避免重启后直接跳到 Apply。
- Fixed bootstrap readiness accounting for a long-lived Supervisor: once the verified Ready event is signaled, a still-running Supervisor now returns bootstrap success so post-install activation can complete instead of reporting
CCOD_INSTALL_NEW_RUNTIME_NOT_READY. - Added regression coverage for the persistent Supervisor handoff while preserving nonzero propagation for a Supervisor that exits abnormally after readiness.
- 修复长驻 Supervisor 的 bootstrap 就绪计数：经验证的 Ready 事件触发后，即使 Supervisor 仍在运行，bootstrap 现在也会返回成功，安装后激活不再错误报告
CCOD_INSTALL_NEW_RUNTIME_NOT_READY。 - 增加长驻 Supervisor 交接回归覆盖，同时继续保留就绪后异常退出码的非零传播。
- Fixed the manifest-bound lifecycle worker so its JSON, runtime, lifecycle-fence, and process-control dependencies are bound to the verified module exports before worker adapter scriptblocks are created. Supervisor VerifyRemote now publishes a correlated result instead of failing with
CCOD_LIFECYCLE_WORKER_REQUEST_INVALIDin a real-Fileprocess. - Added a production-scope regression test for the worker dependency binding; the installer and portable launcher continue to share the same verified runtime closure.
- 修复 manifest 绑定的 lifecycle worker：在创建 worker 适配器脚本块前，将 JSON、runtime、生命周期围栏和进程控制依赖绑定到已验证的模块导出。真实
-File进程中的 Supervisor VerifyRemote 现在会发布相关结果，不再错误返回CCOD_LIFECYCLE_WORKER_REQUEST_INVALID。 - 增加生产脚本作用域回归测试；安装包和便携启动器继续共享同一份经验证的 runtime 闭包。
- Fixed the Inno Setup installer so it bundles the portable launcher with TrayHost; post-install activation now passes source validation instead of failing closed.
- Fixed bootstrap fallback sequencing so each verified runtime acquires and releases the transition lease around its launch, allowing the previous runtime to recover cleanly after an early exit.
- Increased the Supervisor startup proof budget and retained the ready Supervisor long enough for installer verification, while preserving lifecycle fencing and the DPAPI device-key store.
- 修复 Inno Setup 安装包：安装时会与 TrayHost 一起安装便携启动器，安装后激活现在能通过源校验，而不再失败关闭。
- 修复启动回退时序：每个经验证的 runtime 只在启动边界内获取并释放 transition lease，活动 runtime 提前退出时可安全回退到 previous runtime。
- 增加 Supervisor 启动证明预算，并在安装器验证窗口内保留 ready Supervisor，同时继续保护生命周期围栏和 DPAPI 设备密钥存储。
- Fixed release publication so the Inno Setup installer executable is uploaded alongside the portable ZIP and manifests.
- 修复发布上传：现在 Inno Setup 安装包可执行文件会与便携 ZIP 和清单一起上传。
- Fixed the live supervisor startup so the default trusted logon identity adapter matches its module contract and returns assertion-ready token facts. Fresh installs now prove supervisor and tray readiness instead of failing closed during activation.
- 修复守护程序真实启动：默认可信登录身份适配器现与其模块契约一致，并返回可供断言使用的令牌事实。全新安装现在能证明 Supervisor 与托盘已就绪，而不是在激活阶段失败关闭。
- Fixed the verified portable installer to create and revalidate each manifest-bound nested staging directory before copying payload files. This restores first-run portable installation while continuing to reject reparse paths.
- 修复经验证的便携安装器：复制载荷文件前会创建并重新验证每个受清单绑定的嵌套 staging 目录。在继续拒绝重解析点路径的同时，恢复首次便携安装。
- Replaced the unsigned self-extracting installer release with a manifest-bound portable ZIP. Release validation now binds the ZIP, checksum, TrayHost provenance, external payload manifest, and every archived payload file.
- Added a verified portable entrypoint that scans the payload with Microsoft Defender before installation, without disabling protection or adding exclusions.
- Added a staged portable uninstall finalizer that removes only the marker-bound current-user payload after the existing fail-closed cleanup proves the runtime/session boundary. The DPAPI device-key store remains untouched.
- 将无签名自解压安装器发布改为带清单绑定的便携 ZIP。发布校验现会绑定 ZIP、校验和、TrayHost provenance、外置 payload manifest 以及归档内的每一个载荷文件。
- 新增经验证的便携入口：安装前使用 Microsoft Defender 扫描载荷，不关闭防护，也不添加排除项。
- 新增 staged 便携卸载终结器：只有既有失败即停止清理已经证明 runtime/会话边界后，才删除带标记绑定的当前用户载荷；DPAPI 设备密钥存储保持不变。
- Added a tightly scoped compatibility inspection for an older manifest-sealed controller that omitted its
ProcessControlimport. It accepts only the exact correlated legacy failure and requires a manifest-verified read-only ordinary-session recheck immediately before each protected uninstall deletion boundary. - New
SessionControllerruntimes now loadProcessControlglobally, and regression coverage rejects every other controller failure or changed compatibility proof.
- 为遗漏
ProcessControl导入的旧版清单封存 controller 增加了严格限定的兼容探测。它只接受精确关联的旧版失败特征，并在每个受保护卸载删除边界之前重新执行经清单验证的只读普通会话检查。 - 新版
SessionControllerruntime 现会全局加载ProcessControl；回归覆盖会拒绝其他任何 controller 失败或已变化的兼容性证明。
- Made fail-closed uninstall recovery preclaim a durable nonempty controller result placeholder so it works with a still-manifest-sealed older controller runtime.
- Added regression coverage for the legacy strict byte-array writer and the prelaunch placeholder ordering.
- 调整失败即停止的卸载恢复：预占并认证的 controller 结果文件现在会持久写入非空占位内容，因此仍可由清单封存的旧 controller runtime 安全替换。
- 新增旧版严格字节数组写入器及控制器启动前占位写入顺序的回归覆盖。
- Fixed fail-closed uninstall recovery when its authenticated controller result placeholder is initially empty.
- Added regression coverage for atomically replacing the empty preclaimed controller result file.
- 修复失败即停止的卸载恢复：已认证的 controller 结果占位文件为空时，恢复结果可安全原子写入。
- 新增回归覆盖，可原子替换预先创建的空 controller 结果文件。
- Fixed the fail-closed uninstaller payload to include
TrustedLogonIdentity.psm1, required by the stagedStateStoredependency. - Added a regression that imports staged
InstallLifecyclebefore cleanup, proving its payload-local dependency closure is complete.
- 修复失败即停止的卸载载荷，补齐 staged
StateStore依赖的TrustedLogonIdentity.psm1。 - 新增回归：在清理前导入 staged
InstallLifecycle，证明其载荷内依赖闭包完整。
- Fixed a Supervisor startup contract mismatch that rejected the complete schema-two active runtime pointer immediately after installation.
- Added regression coverage that reads the canonical active pointer before Supervisor readiness, including upgrade pointers with a previous runtime.
- 修复 Supervisor 启动时错误拒绝完整 schema-two active runtime 指针、导致安装后立即退出的问题。
- 新增回归覆盖：Supervisor 就绪前读取标准 active 指针，并覆盖带有 previous runtime 的升级指针。
- Rebuilt restart and repair as a durable Supervisor-owned lifecycle that resumes safely after delayed or manual Codex launches.
- Simplified the tray to truthful connection/protection status, one repair action, language, logs, About, and safe Exit.
- Made upgrades wait for the new runtime and tray, preserved authorized devices, and unified Windows Settings and direct uninstall behind a fail-closed cleanup flow.
- Fixed upgrades leaving no tray icon even though the controlled Codex session was active.
- The installer now waits for the previous
IgnoreNewscheduled-task instance to leaveRunningbefore starting the new Supervisor. - Added lifecycle regression coverage and a stable
CCOD_INSTALL_SUPERVISOR_TASK_BUSYfailure when the old task cannot exit within the bounded wait.
- 修复升级后受控 Codex 会话已经生效、但托盘图标消失的问题。
- 安装器现在会等待旧
IgnoreNew计划任务实例退出Running，再启动新的 Supervisor。 - 新增生命周期回归测试；旧任务在限定时间内无法退出时，会返回稳定错误
CCOD_INSTALL_SUPERVISOR_TASK_BUSY。
- Replaced the embedded COM application activator with the standard Windows
explorer.exe shell:AppsFolder\<AUMID>route. - Preserved reliable ordinary Codex relaunch while removing the new embedded interop signature that triggered Defender's
Program:Win32/Contebrew.A!mldownload heuristic. - Added regression coverage that forbids the embedded COM activator and verifies the exact AppsFolder launch request.
- 将内嵌 COM 应用激活器替换为 Windows 标准
explorer.exe shell:AppsFolder\<AUMID>路径。 - 在保留普通 Codex 可靠重启的同时，移除触发 Defender
Program:Win32/Contebrew.A!ml下载启发式检测的新增互操作特征。 - 新增回归测试，禁止内嵌 COM 激活器，并验证精确的 AppsFolder 启动请求。
- Fixed Restart now closing Codex without reopening it by activating the ordinary packaged app through Windows' native Application Activation Manager.
- Ordinary launches now use the exact Codex AUMID
OpenAI.Codex_2p2nqsd0c76g0!App; controlled launches with debugging arguments keep their existing verified executable path. - Added a regression test that rejects direct WindowsApps executable launches for ordinary Codex recovery.
- 修复选择 立即重启 后只关闭 Codex、没有重新启动的问题：普通打包应用改由 Windows 原生 Application Activation Manager 激活。
- 普通启动使用精确 Codex AUMID
OpenAI.Codex_2p2nqsd0c76g0!App；携带调试参数的受控启动继续使用现有验证路径。 - 新增回归测试，禁止普通 Codex 恢复流程直接运行 WindowsApps 中的可执行文件。
- Fixed a TrayHost parent-reader disposal race that could terminate the persistent supervisor after the remote-control session had already become active.
- The parent now waits for TrayHost reader, writer, and stderr threads to leave their pipe operations before disposing synchronization handles.
- Added a native regression test for a remote-fault shutdown race, preventing the
System.ObjectDisposedExceptionobserved in the parent reader.
- 修复 TrayHost 父端读取线程的释放竞态：远程控制会话已生效后，持久 Supervisor 不会再因该竞态退出。
- 父端现在会等待 TrayHost 的读取、写入和 stderr 线程退出管道操作后，才释放同步句柄。
- 新增原生回归测试，覆盖远端故障与关闭并发场景，防止 ParentReader 出现
System.ObjectDisposedException。
- Added an English post-install prompt: restart Codex now or restart it manually later.
- The installer never closes or restarts Codex automatically; Later leaves the current session untouched.
- The installer now stops the persistent prior supervisor, validates the packaged TrayHost payload, and prompts only after the new runtime is active.
- Restart now safely closes the current Codex session and launches a fresh controlled session after explicit confirmation.
- Runtime activation runs in a background worker so the setup window remains responsive.
- Tray language changes wait for native-host acknowledgement before completing.
- Reissued the installer with a verified restart chain: recover a proven ordinary Codex session first, then activate the controlled session.
- If restart confirmation fails after activation, the new runtime remains active and the event is recorded as
RESTART_UNCONFIRMEDrather than a false activation failure.
- 安装完成后新增英文提示，可选择立即重启 Codex 或稍后手动重启。
- 安装器不会自动关闭或重启 Codex；选择“稍后”会保持当前会话不受影响。
- 安装器会关闭持久运行时中的旧 Supervisor，验证打包 TrayHost，并且只在新运行时已激活后提示。
- 只有明确选择“立即重启”后，才会安全关闭当前 Codex 并启动新的受控会话。
- 运行时激活改由后台工作器执行，安装窗口可保持响应。
- 托盘语言切换会等待原生宿主确认新快照后完成。
- 重新发布安装包：重启链路会先恢复并确认普通 Codex 会话，再激活受控会话。
- 如果激活完成后无法确认重启，新运行时仍保持已激活状态，并记录为
RESTART_UNCONFIRMED，不再误报激活失败。
- Added a native About menu item that displays the active CodexRemote-fix version.
- The installer now stops and verifies the running supervisor before replacing the installed runtime.
- Preserved device keys and persistent state through the safe atomic runtime upgrade; old runtimes are retired after activation.
- 新增原生“关于”菜单项，显示当前 CodexRemote-fix 版本。
- 安装器替换已安装运行时前，会先停止并验证当前守护程序。
- 安全的原子 runtime 升级会保留设备密钥和持久化状态，新运行时激活后才清理旧运行时。
- Centered the CodexRemote-fix icon, product name, language switch, and verified project badges in both README languages.
- Enabled repository Dependabot alerts and automatic security updates.
- Added scheduled and push/PR CodeQL scanning for the JavaScript/TypeScript and C# portions of the project.
- 中英文 README 顶部统一居中显示 CodexRemote-fix 图标、项目名、语言切换和真实项目徽章。
- 已启用仓库 Dependabot alerts 和自动安全更新。
- 新增 CodeQL 定期扫描及 main 的 push/PR 扫描，覆盖 JavaScript/TypeScript 与 C#。
- Major fix: authorized remote-control devices now survive Codex updates without re-pairing.
- Restored the preserved enrollment mapping through Codex's host bridge before refreshing remote connections.
- Patched already-cached native device-key addon exports in place so existing Codex consumers use the corrected implementation.
- Kept device keys, server-side authorization, and the normal Codex enrollment flow unchanged.
- 重大修复：Codex 更新后，已授权的远程控制设备无需重新配对即可保留。
- 在刷新远程连接前，通过 Codex host bridge 恢复保留的 enrollment 映射。
- 原地修补已被缓存的原生设备密钥模块导出对象，使现有 Codex 调用方使用修复后的实现。
- 保持设备密钥、服务器端授权和 Codex 原生注册流程不变。
- Fixed a Windows PowerShell redirected-input UTF-8 preamble that could make TrayHost exit before signaling readiness.
- Kept strict protocol validation and limited the compatibility path to one BOM on the initial bootstrap frame only.
- Added Windows GitHub Actions validation for pull requests and pushes to
main. - Added a concise before/after showcase image of the real Control other devices tab.
- 修复 Windows PowerShell 重定向输入中的 UTF-8 前导标记导致 TrayHost 在报告就绪前退出的问题。
- 保持严格协议校验，仅允许初始 bootstrap 帧兼容一个 BOM，不放宽后续认证帧。
- 新增 GitHub Actions Windows CI，检查 Pull Request 和推送到
main的变更。 - 新增真实“控制其他设备”标签的简洁修复前后展示图。
- Rebuilt the tray UI as a compiled native Win32 TrayHost with the standard Windows context menu behavior.
- Added the CodexRemote-fix product icon, Start-menu entry, and desktop shortcut.
- Preserved bilingual tray controls: Follow system, 中文, and English.
- Hardened interrupted-session recovery and kept the encrypted device-key store unchanged.
- 托盘 UI 重构为编译后的原生 Win32 TrayHost，使用 Windows 默认右键菜单行为。
- 新增 CodexRemote-fix 产品图标、开始菜单入口和桌面快捷方式。
- 保留双语托盘控制：跟随系统、中文、English。
- 加固中断会话恢复流程，保持加密设备密钥不变。
Each new tag should append one short vX.Y.Z section with matching English and Chinese bullets.