v1.2.2

Configuration

• Keep Windows config and settings filenames continuously readable during saves on hard-link-capable filesystems. Merge the original file's ACLs, creation time and alternate streams through a private link before publishing with a single native rename, rather than exposing ReplaceFileW's transient missing-name window. Retain bounded sharing/access-denied retries and the existing fallback on filesystems without hard links; clean inactive private staging links at startup.

Tools

• Offer catalog-declared tool renames (replaces) as same-source updates on the Tools page and through vosux --update <old-id>. Preserve durable data, settings, trust, enabled and autostart choices; refuse existing targets and cross-source migrations, and recover interrupted migrations before discovering tools. Installed replacements satisfy dependencies on former IDs without retaining old hosted routes. Catalog-only metadata keeps packages installable on vosu 1.2.0/1.2.1, where installation remains separate and state is not migrated.

Performance

• Project selected-field subscriptions from only the requested subtrees, borrowing hit-error histories instead of copying and normalizing the whole V2 document on every precise publication. Initial/update frames, JSON Pointer semantics, full-document selections, and error handling are unchanged.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure

v1.2.1

Dashboard

• Show catalog card art from release downloads. Available tool cards and catalog overlay cards showed initials and no banner or preview because release downloads (GitHub included) serve SVG art as application/octet-stream, which browsers do not render. The dashboard now loads catalog art through GET /api/tools/catalog/art: vosu fetches only URLs the loaded catalog lists, with the catalog download rules (HTTPS, public destinations, at most 5 redirects, 1 MiB), types it from its content (SVG, PNG, WebP, or JPEG), caches it in memory per catalog revision, and serves it as a sandboxed, inert document, so an SVG opened directly can run nothing on the dashboard origin. See the tool protocol.

Tools

• Install valid packages whose compressed data happens to contain ZIP end-record bytes. vosu treated every PK\x05\x06 in a file as a possible end of central directory, so a 221-entry tool package was refused with "unsafe ZIP entry: entry limit exceeded" because bytes inside a deflated binary read as 31,185 entries. Only the end record that ends exactly at the end of the file now decides the entry count, as in the ZIP specification; the opened archive must list that many entries. Data after the archive and a second end record inside the archive comment are still refused, ZIP64 records must sit right before that end record, and a ZIP64 record inside entry data stays capped. Tool packages, overlay downloads, and update archives share the same check.
• Refresh skin file listings and case-insensitive lookups when directory contents change even if directory timestamps do not advance, including deferred NTFS updates on Windows. Cache validation now checks bounded directory membership signatures as well as existing file sizes and modification times.

Updater

• Keep the Windows update helper alive through transient record sharing and delete-pending errors after authorizing the live owner. These errors now use the same bounded two-second retry window as truncated records instead of aborting handoff on a busy machine.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure

v1.2.0

Tools

• Host tools: out-of-process applications in any language, described by a tool.toml manifest, with an optional browser UI, an optional supervised background service, versioned APIs, dependencies on other tools, and requested host permissions. See the tool protocol and authoring guide.
• Distinguish independently useful background services from on-demand UI/CLI backends with manifest service.role; show only public UI/SERVICE/CLI interfaces and hide backend lifecycle controls. Add persisted Start with vosu overrides in tool Details, Settings, the dashboard API and vosux --autostart <id> on|off|default; launch eligible services dependencies-first after listeners bind.
• Show usable UI/CLI tools as Ready on their cards, or Working while their native backend starts or runs, rather than exposing idle backend process state. Background-service and error labels, API status values, and Details process status stay unchanged.
• Serve tools on the overlay listener under the reserved /tools/ prefix: UIs at /tools/<id>/, service APIs at /tools/<id>/api/. No overlay can be installed or served as tools. Read routes are open to overlays; writes need a dependent tool's per-launch token or a session minted by the dashboard's Open action. That session lives only in the opened page's memory, never in browser storage overlays can read, so reloading a tool page makes it read-only until it is opened again.
• Supervise services: loopback readiness handshake, health checks, on-demand start and idle stop, crash restart with backoff, dependency-first start, bounded logs, and orderly shutdown; children are killed with vosu on Linux and Windows.
• Respect voluntary status-0 service exits as stopped (exited), without crash counting or automatic restart, including always services; manual start and the next vosu launch can start them again.
• Run a tool from any directory with vosu --tool <directory>; manifests reload live and development services restart when their executable changes.
• User tools in <data dir>/tools/<id>/ require explicit trust on the dashboard. Official tools and their SDK now live separately in vosu-tools; vosu embeds none.
• Add a Python reference tool and a JSON Schema for tool.toml.
• Add Create a tool: a guided isolated-development-to-catalog tutorial, backed by the Python example's live UI, settings, selected-map context, optional read integration, CLI and package builder. Document the consumer's catalog/ZIP format in the protocol and separate the authoring reference from the tutorial.
• Share one 18-LAB design system with tools: /tools/_host/v1/theme.css serves the dashboard's tokens plus documented v- components (app shell with a fixed top bar, panels, buttons, fields, themed select, file picker, toggles, segmented control, tabs, table, stat readout, meter, status dot and badge, help hover, empty state, toast, drawer), with a live reference at /tools/_host/v1/design and rules in the design guide. The bridge applies the dashboard's mode as data-theme and exposes it as vosu.colorScheme.
• Add an optional manifest banner (3:1) beside icon, served at /tools/<id>/_banner and reported as ToolView banner_url; catalog tool and overlay entries may carry HTTPS icon_url and banner_url. Serve icons and banners in every tool status, sandboxed against script.
• Add GET /tools/<id>/_settings and the bridge's vosu.settings() so tool UIs read their effective settings. password settings are write-only from the dashboard (never returned; blank keeps, Clear removes) and never included in that route; only the tool's service reads them through the host API.
• Make the bridge's vosu.subscribe() survive vosu restarts and network drops: it reconnects with capped, jittered exponential backoff, re-sends the subscription, keeps a single socket, stops on unsubscribe, and reports "connecting"/"open"/"closed" through an optional onStatus callback.

Official catalog

• Install, update, and uninstall official tools from the Tools page's Available section or vosux --install, --update, and --uninstall with an explicit keep/remove-data choice.
• Verify HTTPS destinations, redirects, package SHA-256 and size, ZIP safety, and manifest identity before atomic installation; install dependencies first and restart running services after updates. Surface update badges and job progress.
• Add selected-instance osu_dir and current skin name/folder to the permission-filtered tool host context (lazer folders remain null).
• Add GET /tools/_host/v1/overlays (service or CLI token, context permission): the installed overlays that have an index.html, with id, name, dashboard nickname and alias, metadata author/version/resolution and absolute folder, so tools can load a local overlay. Read-only; settings values are never included.
• Serve the current imported lazer skin through /files/skin/<path> with case-insensitive filename lookup and confined content-addressed storage. Add public /files/skin/ metadata and tool-context availability/built-in identity so tools can explain built-in fallback.
• Add a cached, bounded skin file index to /files/skin/ as entries and truncated, retaining its existing files boolean. Stable entries report size/mtime and lazer entries report size/store hash; built-ins have no entries. Resolve stable skin filenames case-insensitively with exact-path priority and deterministic collisions, including under Wine/Linux.
• Add strong ETags, Last-Modified/no-cache revalidation, bodyless conditional 304s and HEAD support to current skin and beatmap file routes without changing GET bodies or byte-range behaviour.
• Add v2 renderer state: own-gameplay/replay/spectator source, authoritative lazer track rate/running state, fractional mania scroll speed and base scroll time, timing-based note colours, visual toggles and viewport scaling. Expose imported lazer skin families and stable per-map mania speed when readable. Preserve unset random seeds as null instead of exposing uninitialized storage.
• Generate lazer's local configuration enum keys per client version, fixing stale mappings for beatmap skins/colours, scoring display, replay controls and song-select settings. Clear stale replay/spectator flags when entering local play.
• Publish beatmap selection changes to current-file routes and compatibility APIs before notifying selected-field subscribers, even between regular polling ticks. A new subscribed checksum no longer briefly selects the previous map's file.
• Expose lazer's current combo-colour normalisation amount at /settings/visual/comboColourNormalisation using its generated version-specific configuration key; report null on stable.
• Stop slow selected-field subscriptions (ruleset/settings, client, skin folders and beatmap metadata) from forcing both memory readers to 1 kHz. Fast fields request only their producing lane, gameplay-only demand sleeps outside play, and live song-select time can still request the precise clock. Subscriber frame debounce and latest-only delivery are unchanged.
• Keep selected-field reader demand incrementally instead of locking every subscriber on each publication. Share immutable settings graphs across snapshots and copy only changed settings, eliminating repeated allocation and teardown without changing API payloads.
• Manage ordered catalog sources (owner/repo[@tag] or HTTPS catalog URLs) in Settings, with enable/disable, add/remove/reorder and per-source fetch results. Merge tools and overlays across sources; show provenance and shadowed duplicates. Default to 18-lab-dev/vosu-tools and 18-lab-dev/vosulay; only these exact source identities grant automatic tool trust. Overlays remain available through the existing tosu community catalog.
• Move live repository, updater, packaging, and schema links to the 18-LAB organization. At startup, idempotently migrate the two former official source identities and remove the unavailable private overlay source only from untouched old default lists. Customized lists retain their entries, ordering, and enabled flags; a retained former private overlay source is unreachable and can be removed in Settings / Catalog sources.
• License project-authored code under the 18-LAB copyright holder, retaining years, tosu and other third-party notices, and sxlvia's branding/artwork attribution.
• Install/update catalog-source overlays alongside the existing community catalog, retaining settings and offering required tools; keep the existing overlay disclosure and deletion flow. Add vosux --sources; CLI install/update/uninstall remain tool-only.
• Offer vosulay as an optional official tool supervised out-of-process; retain its standalone mode and keep in-game rendering outside the daemon.

Dashboard

• Redesign every page as a calm app shell in the 18-LAB system with Workstation (dark) and Drafting (light) modes, embedded Barlow and IBM Plex Mono fonts, and a restyled diagnostics report. Text, controls and dialogs use the tool design system's sizes (16 px root, 14 px body, 32 px controls); headings, labels and buttons are sentence case, booleans are switches, and the wordmark, tabs and header buttons share one baseline with the current tab's underline on the header rule. Sheet labels, card numbers, crop marks and the title-block footer are gone; the affiliation notice, version and source live in Settings › About.
• Add a Tools page with status, dependencies, permissions, API routes, storage, logs, lifecycle and trust actions, and tool settings that reuse the overlay settings editor. Cards stay compact (icon, name, version, status a...

v1.1.0

Dashboard origin

• Move trusted dashboard pages and management APIs to an independent loopback listener on port 24051 (DASHBOARD_IP/DASHBOARD_PORT), keeping overlay URLs on port 24050 so localStorage and IndexedDB remain intact. Add /api/dashboard discovery and safe path/query-preserving redirects for old dashboard links. Tray, startup and second-instance links follow the dashboard listener.
• Reject overlay-origin management mutations, require dashboard provenance plus a per-start CSRF token, and never serve overlay scripts on the dashboard origin. Scoped API keys, profiles, broker tokens and overlay command-socket settings remain compatible.
• Add explicit network Apply with server-side 30-second automatic rollback unless confirmed from the new dashboard origin. Rebind both listeners independently. Support IPv4/IPv6 CIDR allowlists, including the precise Tailscale 100.64.0.0/10 range, alongside legacy wildcard octets.
• Harden dashboard HTML with inert runtime context, CSP, Host checks, and no dashboard WebSocket upgrades. Network rollback targets cannot come from URL parameters; pending edits survive crashes as rollback journals, Keep checks both listeners, and dashboard binds cannot reuse recorded overlay origins.
• Print full clickable overlay/API and dashboard URLs at startup and after successful rebinds, mapping wildcard binds to loopback.
• Allow loopback native broker credentials to save HTTP settings values and manage profiles, with authorization rechecked after body reads; grant no schema or management authority.
• Dashboard pages cannot be framed by other sites.

Dashboard

• Manage settings profiles from a dropdown and overflow menu (Create, Copy, Rename, Delete, Set as default) with in-app naming and delete confirmation.
• Match API-key management to the runtime settings groups and rows, with compact permission dialogs, per-key overflow actions and a copyable show-once dialog.
• Restore mouse dragging of pinned overlays with a visible insertion marker, retaining keyboard menu moves and the existing dashboard-origin saved order.
• Add permanent local dismissal of the community-overlay notice and an About link to reopen it.
• Keep installed previews at or below their native size and label reduced previews with their scale.
• Give overlay updates a warning-coloured action, remove redundant settings badges, and use styled update/delete dialogs with the folder path and a bounded on-disk file-size scan.
• Match Installed cards against the catalog too, so their update action is visible without visiting Available; update the actual local folder even if it has a custom name. Hide empty author segments rather than leaving doubled metadata separators.
• Show per-instance attachment/version/polling information and identified live WebSocket connection counts. Counts include previews and profile-qualified command sockets, not unique users; unidentified connections are intentionally omitted.
• Present allowlist entries one per line, warn about public-space CIDR ranges (including 0.0.0.0/0 and ::/0) and broad wildcards, add interval units, simplify subscription wording, and make the catalog notice collapsible with quieter carousel controls and normalized display metadata.
• Rename "Download report" to "Diagnostics report".

Overlay settings

• Add named, revocable, hash-only API keys with fixed settings/profile scopes,
  same-origin dashboard management, native Bearer HTTP/WebSocket authentication,
  browser WebSocket subprotocol authentication, and immediate open-socket revocation.
  Revocation actively closes idle sockets and rejects in-flight POSTs whose bodies
  finish after revocation; warn about unsafe Unix registry ownership/permissions.

• Add per-start private broker credentials for loopback command WebSockets, so
  counters hosted by native overlay brokers can save and relay settings without
  forging Origin. Invalid credentials fail the upgrade with 401; HTTP management
  authorization and headerless read-only behavior remain unchanged.
  Treat Bearer scheme names case-insensitively and ignore other auth schemes;
  publication failures warn and disable broker writes without stopping serving.
  The credential file is replaced atomically at each start and never deleted; a
  stopped daemon's token is stale.

• Add named settings profiles with a default profile for unpinned overlays, per-instance
  vosuProfile overrides, a management API, and profile-aware command refreshes.
  The reserved default profile retains existing values files.

• Add profile management, title/description/ID search, and section navigation to
  the dashboard's card settings and inline /settings?overlay= editors.

Gameplay

• Added opt-in ENABLE_MANIA_KEY_HIT_ERRORS (default false) and vosu v2/precise keyHitErrors per-column press/release arrays. Stable preserves matched displayed lanes, including Mirror; lazer reads object columns and mirrors hold-release corrections.
• Added opt-in ENABLE_HIT_OFFSETS (default false) for vosu v2 play.hitOffsets and precise hitOffsets: flat cursor-x/y-offset
  and timing-error triples for osu!standard circles and slider heads, with
  incremental replay/map matching on stable and judgement-position reads on lazer.
  Stable under HR reflects positions before applying the stack offset, as the game does.
• osu!lazer: the embedded offsets now include the mania column, catch catcher and
  standard hit-object position fields, so keyHitErrors, catcher and hitOffsets
  work on lazer 2026.921.0 without runtime generation. A cached offsets file
  generated before an update that adds offset fields is regenerated instead of
  silently leaving those features off.
• osu!lazer: runtime offset generation no longer fails intermittently with a crash
  in osu.Game.Skinning.Skin finalization; the daemon previously retried and
  sometimes ran without offsets for a while.
• osu!stable mania: a final hit error that matches no key press or release is now also published as a press after the play ends. In 1.0.2 the one-second fallback only ran during play, so such a hit could stay missing from pressHitErrors on the results screen.
• Stable keys.all now uses replay-frame logical actions with lazer-compatible B names/order, frame-time transitions and incremental counts, independently of in-game overlay visibility. Legacy key members and configuration gating are unchanged. Catch movement actions remain unpressed because stable records positions rather than left/right input; dash is recorded. Preloaded replay capture follows the play clock. Lazer now accepts the full 20-action dual-stage mania range.
• Catch: v2 play and precise payloads expose a vosu-only catcher object with the client's playfield x and ordinary dashing state, omitted outside catch gameplay. Stable samples by current play time even for preloaded replays and without new hit errors; lazer uses precise native field reads.

Command line

• vosu -V and vosu --version print the version and exit. Previously the flag was ignored, so vosu started the daemon, or opened the running instance's dashboard and exited.

Performance

• osu!lazer settings are read in a handful of batched native reads instead of two reads per configuration entry, which removes most of a regular lazer capture's cost.
• Other osu!lazer state (gameplay score and leaderboard entry, user, multiplayer room and ranked play, menu checksum, global state, skin name) also reads independent fields together, and pointers the capture reuses (game services, the current screen's fields) are read once per capture.
• osu!stable regular captures batch pointer chains and related fields, reusing per-capture reads with sequential recovery when a batched read fails. The osu!lazer menu now batches its full traversal as well.
• Linux: nearby fields requested together share one native read range, and each native read checks the process generation once, after the read, instead of before and after it. A reused PID or exited process is still rejected.
• Selected-field v2 subscriptions share extraction and encoded frames for matching plans and baselines, write frames into shared bounded chunks, and skip memoization for plans used by only one client. Wire frames and latest-only delivery are unchanged.
• Selected-field subscriptions deliver changes with fewer locks, allocations, and wakeups while retaining bounded queues and latest-only delivery.
• Cold API serialization avoids repeated output-buffer growth; the high-rate v2 precise document writes directly from snapshot data without building an owned response first, preserving the existing JSON contract.
• Unfiltered v1, v2, and streamCompanion responses now write directly from snapshots without first building owned response documents, preserving JSON bytes and field semantics.
• Filtered compatibility WebSockets project only requested DTO fields directly, rather than materializing full JSON and typed trees. Identical ordered filter plans share encoded bytes within each broadcast pass, with at most 64 retained variants and 1 MiB of payload bytes; filters beyond either bound are still served without cache retention.
• Distinct filtered WebSocket plans reuse a broadcast's schema document and write only selected fields; frequently visited properties share bounded projection work even when clients request different filters.

Packaging

• Release builds now create a draft GitHub release. The release key signs the draft's files and then publishes it, because the repository's immutable releases reject new files after publication.
• v1.0.2 was published before it could be signed and has no .sig files. Verify its downloads with GitHub's release attestation instead: gh release verify-asset v1.0.2 <file> --repo shiruviaa/vosu.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the [code signing policy](https://github.com/shiruviaa/vosu/bl...

v1.0.2

Gameplay

• osu!stable mania: pressHitErrors and releaseHitErrors no longer stop updating for the rest of a play when stable records two judgements from the same millisecond in a different order than the map lists them (for example two hold notes released together). Hits kept appearing in hitErrorArray but stopped reaching the press/release arrays, so overlays reading them lost every later hit.
• osu!stable mania: a hit error that cannot be matched to a key press or release no longer holds back later hits. It is published as a press once the replay has moved 250 ms past it or one second has passed.
• osu!stable mania: hold-note releases are now classified with the Mirror mod. Before, Mirror plays published every hit as a press.
• osu!stable: reading the hit-error list while the game grew it could pair the new length with the old storage and replace that hit's error with a made-up 0. vosu now reads the length first, which always matches the storage it reads.
• The selected-field subscription README section no longer documents an application-level ["ping", nonce] heartbeat that was never implemented; any text sent after subscribing closes the connection with code 1008.

Packaging

• The AUR package is now vosu-git, built from main with packaging/aur/PKGBUILD. Releases no longer include the vosu-bin-aur-v<version>.tar.gz bundle.
• Release files, commits and tags are signed with an OpenPGP release key (6F0F 0D30 C09D 3A03 6246 A810 2CB6 524B B54B 2CDA), starting with the published 1.0.1 files; each <file>.sig sits next to its file on the release page. The public key is packaging/release-signing-key.asc.

Licensing

• tosu's copyright holder, Mikhail Babynichev, gave written permission on 2026-10-12 for vosu's tosu-derived Rust (memory readers, API, state and related code) to be distributed under MIT OR Apache-2.0 with tosu credited. THIRD_PARTY_NOTICES.md and the provenance audit record the permission and its scope; it does not cover the LGPL calculator wrapper reference.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure

v1.0.1

Dashboard

• The Available page notice now names tosu.app and osuck.link, states that vosu is not affiliated with the tosu project and does not operate either service, and points catalog or download outages to the tosu project.
• A failed overlay install names the download host when the host caused it, including a host that answers with a text page instead of a ZIP archive (osuck.link does this when rate-limiting), instead of reporting an opaque ZIP error.

Licensing

• The vosu logo and icons are now licensed separately from the code, under CC BY 4.0 crediting sxlvia, with an extra permission to show them without credit when using or talking about vosu. The terms are in LICENSE and ship in every release archive and package.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure

v1.0.0

Dashboard

• Move navigation and search into the top bar; remove the retired local-overlay guide and schema builder.
• Show larger installed cards with enlargeable live previews, and list catalog overlays with lazy-loaded preview images and their metadata.
• Adapt the dashboard to the screen: catalog rows sit side by side when there is room, previews follow the window height so short laptop screens show more cards, catalog text scales with its card, and the whole layout grows slightly on large monitors. Phones get a compact header with full-width page tabs and settings checkboxes beside their labels; short landscape screens no longer pin the header.
• Autosave runtime settings with interval/port validation; preserve the unsaved/error status until every rejected field is corrected.
• Show a community-overlays notice above the Available listing: listed overlays are third-party work from the tosu catalog, run with the dashboard's access, and should be installed only when trusted. It links the upstream catalog and the privacy policy.
• Describe Automatic updates accurately: turning it off stops startup installation, but release builds still check for a new version at every start.

Packaging and desktop

• Publish Debian/Ubuntu (.deb), Fedora (.rpm), and Arch (.pkg.tar.zst) packages next to the portable ZIPs, plus a rendered AUR vosu-bin PKGBUILD bundle. Packages install /usr/bin/vosu, an application launcher, and icons, and run vosu --setup on install and upgrade without failing the transaction when capabilities cannot be set.
• Build Linux releases against glibc 2.35, so the binary runs on Debian 12+, Ubuntu 22.04+, Fedora, and Arch; release CI asserts the baseline and install-tests every package in clean containers.
• Show a tray icon on Linux (StatusNotifierItem) and Windows with Open dashboard and Quit; headless sessions without a tray host run unchanged.
• Launching vosu while another instance already serves the configured address opens that instance's dashboard and exits instead of failing to bind.
• Add the Linux-only Start at login setting (START_AT_LOGIN), which manages a marked systemd user unit for the graphical session.
• Treat an executable whose directory the user cannot write (for example a package-managed /usr/bin/vosu) as externally managed: skip self-update checks, reject POST /api/runUpdates with an explanation, and disable the dashboard's automatic-update setting.
• Build tagged releases from a clean target directory without restoring any Cargo cache. Windows releases stay unsigned until SignPath signing is enabled; signed releases must carry a timestamped signature issued to SignPath Foundation.

Security

• Prevent counter-delete CSRF and protect the shared management mutation boundary with exact same-origin browser provenance. Counter delete/download/open, updater, and report actions now require POST; no mutating GET aliases remain. The dashboard uses the new methods.
• Preserve headerless/file-origin read-only overlay access and stock settings commands. Hosted counters can still save settings without new tokens or code; non-hosted sockets may read settings but cannot save them.
• Management writes require exact HTTP scheme/host/port browser provenance; Origin is authoritative, with Referer fallback only when absent. Missing, null, malformed, or duplicate provenance cannot authorize writes. Non-hosted settings sockets retain reads but close with 1008 before saving or relaying mutations.
• Made an unprivileged vosu --setup request OS-owned authentication through a trusted polkit pkexec boundary before any capability change. Root execution skips authentication; cancellation, denial, unavailable/noninteractive elevation, and missing pkexec fail without invoking setcap. Vosu never reads credentials and has no sudo fallback.
• vosu --setup warns before the authentication prompt when the executable or its directory is writable without root, as with a portable ZIP: the polkit prompt authorizes whatever file currently sits at that path. Setup still continues so portable installs can receive capabilities.
• Bound native telemetry, calculator inputs, counter installation and transport work without losing stable hit-error catch-up, ordered filter precedence or settings refreshes during receive-side connection contention. Preserve per-recipient control-queue backpressure.

Runtime and maintenance

• Selected-field v2 subscriptions now sample game state on their own cadence. While any selection is established, both readers run every V2_SUBSCRIPTION_DEBOUNCE milliseconds, so subscribed fields can change before HTTP and compatibility WebSocket payloads. Those payloads keep their POLL_RATE/PRECISE_DATA_POLL_RATE cadence; beatmap changes and retries still reach them immediately. The osu!stable stall-pause heuristic no longer depends on how often state is sampled.

• V2_SUBSCRIPTION_DEBOUNCE now defaults to 1 with a minimum of 1. Saved values below the minimum clamp to 1, and settings saves below 1 are rejected.

• Disable Nagle's algorithm (TCP_NODELAY) on every accepted connection. Small WebSocket state frames written while an earlier frame was still unacknowledged waited for the client's delayed ACK (about 40 ms on Linux loopback) and then arrived in bursts; at the 1 ms selected-field cadence this showed up as live-time delivery jitter.

• Fix automatic offset generation for lazer framework upgrades, including 2026.1005.0 on .NET 10: run both embedded helpers with the exact client's bundled CLR/framework in disposable staging instead of measuring under the helper's .NET 8 build runtime. No user-installed SDK, runtime download, or game-file modification is needed.

• Include client-published NuGet framework replacements and their transitive dependencies in the staged helper runtime. Native Windows startup with the client's .NET 8 runtime and System.Text.Json/System.IO.Pipelines 10 now resolves the game and serves its live API without changing the game or verified helper payload.

• Route maintained Windows autoresearch benchmarks through the shared windows-vm command: transfer filtered source/vendor archives with SFTP, extract through native PowerShell, and clean temporary archives on success or failure. Sources, Cargo vendor caches, builds, and run output stay on V:\agent-workspaces instead of an account-specific C: profile.

• Fix mania gradual-performance completion so last() and oversized skips return the final attributes before exhaustion; correct the osu! gradual example to finish without consuming the calculator before checking exhaustion.

• Make the daemon reload smoke verify rejected malformed TOML through unchanged served settings, untouched source bytes, and an unbound requested port, independently of whether osu! is running. Production last-good configuration and state-readiness behavior is unchanged.

• Split maintained code into domain-focused modules capped at 1,000 lines, preserving API and calculator behavior; remove tracked offset-tool build output while retaining source, locks, and provenance.

• Use the upstream tosu catalog service at https://tosu.app/api.json; vosu does not operate a website. Use vosu/<version> (+https://github.com/shiruviaa/vosu) as the first-party request identity.

• Derive Windows textual and numeric executable-resource versions from the root Cargo package version, keeping both resource version fields consistent with the package.

• Remove the report-only graphics stack; use Linux sysfs and Windows WMI hardware metadata, with explicit unavailable/unknown states.

• Bound report log retention with visible truncation notices; isolate counter discovery, report capture, configuration persistence/reload, and ordered console output from async workers.

• Avoid primary API graph/hit-error encoding copies, share live-calculator map preparation and unchanged stable mania replay batches, and bound WebSocket pong backpressure.

• Use component-aware case-insensitive Windows startup-path checks rather than string-prefix matching.

• Separate MSVC SDK, Cargo downloads, and build caches; restrict cross SDK downloads to x86_64; classify changes conservatively and always publish CI required, including docs-only changes.

• Move packaged-executable smoke checks into vosu-release-smoke, remove duplicate daemon asset embedding, and maintain existing Markdown without scheduled inference. Linux process-event backends and defaults remain unchanged.

• Pin release toolchain actions to reviewed commits and limit repository-write permissions to the release-publishing job. Documentation-only changes retain required CI checks without triggering native compilation.

• Add CONTRIBUTING.md with per-platform setup, the local check set, and a repository map; move the historical offsets-asset reproduction recipe from the README into docs/operations/offsets-asset.md. Remove the vendored third-party agent skills, personal agent settings, the superseded Windows verification batch script, and the retired docs instruction stub; the Linux process-event benchmark now lives at tools/autoresearch/process-events-bench.sh.

• Replace remote/manual offset acquisition with automatic exact-instance resolution: valid versioned <version>.json cache entries are preferred, then matching embedded offsets, then local generation from the exact PID and version. The extracted helper cache is keyed by the embedded bundle checksum; no bundle identity is added to offset-file metadata. Release binaries embed the platform-matching self-contained generator; end users do not install .NET, and debug builds without a prepared payload report an explicit missing-bundle error.

• Maintainer source builds prepare target/offset-generator/<rid>/offset-generator-v1-<rid>.zip plus its .zip.sha256 sidecar with the .NET 8 SDK. Release archives remain exactly the executable and root LICENSE; updater behavior is unchanged.

• Consolida...

Offset generator bundle v1

Self-contained Linux and Windows helpers used by vosu -g.