v0.36.0

All nine public packages at 0.36.0, published to npm latest from main 644cf95a2 (release validation run 41591161869, artifact release-pack-644cf95a… sha256:5c54a532…26ee). This is a MINOR release: the upgrade manifest from 0.35.0 holds 3 breaking entries and no additive entry. It also carries the fixes prepared for 0.35.1, which was never published. The wire stays v5; no drain is needed.

Highlights

• Windows per-user autostart (#1337): ServiceDefinition.windows is the union ServiceWindowsOptions. { scope: 'user'; stop: ServiceProgram } autostarts at the user's logon from a Startup .cmd, with no SCM registration and no administrator; { winswBin } still selects the WinSW service. A failing stop program is the new ServiceUnitError code service_stop_failed. byok-agent install still installs only the WinSW service.
• Result outcome contract rules (#1374): validateResultOutcome takes ({ contract, schema }, outcome). For bot-turn-outcome.v1 it rejects a repeated ask_user option id or a blank string with the new reason contract-mismatch, and the device applies it on submit_result so the model corrects the outcome in the same Turn.
• Status no longer trips on metadata-only changes (#1342, #1366): byok-agent status, doctor and the support bundle ignore a ctime-only change to a store file, and operational health no longer rewrites ACLs on every write on Windows.
• Service upgrade rollback (#1350): a failed or interrupted upgrade now rolls back a directory store whose path ends in /, /. or /./.
• Also: Grok no longer declares isolation.userContext (#1335); the device diagnostics summary names why identity cannot be read (#1365); the Windows Pi projection ACL query is about 6x faster (#1364); K8 gains the ./l-test-host export, suspended Bots, setModels, hostIntentMessages, create_room and external rooms (#1325, #1319, #1357, #1356, #1321, #1362).

Upgrading

• Host checklist (0.35.0 → 0.36.0): docs/releases/host-upgrade-0.36.0.md. A Host on an earlier release applies the 0.35.0 checklist first.
• Full notes: docs/releases/v0.36.0.md · CHANGELOG
• Known limitations: a Windows Pi projection ACL query still pays the PowerShell host start and exit, which can take seconds on a slow VM (#1373).