Winnow v4.3.0

[4.3.0] - 2026-09-23

Added

• Extended AI purge now covers the AI features Microsoft added across the 24H2/25H2 cycle: Click to Do (DisableClickToDo), the agentic Settings search (DisableSettingsAgent), and the Paint AI features Cocreator, generative fill, and Image Creator (DisableCocreator, DisableGenerativeFill, DisableImageCreator under the Paint policy key). DisableAIDataAnalysis and DisableClickToDo are written in both HKLM and HKCU, matching their machine-and-user policy scope. The update watchdog re-asserts the two new machine-wide WindowsAI policies after an update. Registry paths and scopes are from the WindowsAI policy CSP. Not yet verified against a real 24H2/25H2 Copilot+ device; the values and rollback coverage are unit-tested.

Fixed

• Block feature version upgrades now pins to the release the device is actually on. The DisableFeatureUpdates reg file hard-coded TargetReleaseVersionInfo to 24H2, so on a 25H2 machine the pin named an older release than the one installed. The applied value is now written from the running DisplayVersion at apply time, and verification (and the GUI applied-state read) compare the pin against the current release instead of a fixed literal. Quality and security updates are unaffected, so this does not interfere with Known Issue Rollback, which rides on quality updates.
• DisableTelemetryServices failed on every apply. Its apply and undo functions live in TelemetryServices.ps1, which Winnow.ps1 never loaded, so selecting the feature (it is part of the privacy-max preset) ended in "command not found" and an automatic rollback, and -Undo DisableTelemetryServices failed the same way. The file is now loaded, and a unit test fails the build if any script under Scripts is not dot-sourced by Winnow.ps1 (the download launcher and the watchdog payload are excluded by design).
• The run summary was never written. ExportRunSummary.ps1 was not loaded either, so the Winnow_RunSummary_*.json report in %TEMP% never appeared. It is now written at the end of every real apply and not for a dry run. After a rollback it reports the requested features as RolledBack (or Unknown if the rollback itself failed) instead of Applied, and it now counts registry import failures.
• -VerifyWatchdog reported a healthy watchdog as not installed. The watchdog's scheduled task folder was written as \Winnow, but Get-ScheduledTask -TaskPath only matches the stored form \Winnow\, so the health check never found the task and always exited 2, and re-installing the watchdog never found the old task to replace. The task identity is now defined once, with the trailing backslash. The unit tests had mocked Get-ScheduledTask without a path filter, which is how this went unnoticed.
• The PowerShell registry writer no longer prints "The operation completed successfully" after it skipped writes that access restrictions blocked. It says how many settings were skipped and that they are not in effect. Skipping is unchanged: one protected key still does not fail the whole feature.

Testing

• The Windows Sandbox integration suite now runs end to end and passes, including the mutating rollback and watchdog tests that had never been run. Running it found the four fixes above. The suite's runner no longer overwrites the per-test results with a generic bootstrap error when a test fails, and the summary now lists failed setup blocks. The rollback contract tests inject a failure the backup phase can read but the apply cannot write (a key that denies subkey creation), restore the registry after each test so one test cannot skew the next, and match the product's current messages. New live tests cover re-installing the watchdog and the apply/undo round trip of a feature implemented in code.