QWT-NG 4.3.11 (agent 71fa0a4)

The black window is fixed — it was the UAC prompt all along

The recurring "unclosable black window" (forum 42717, thank you GWeck for the logs) is
Windows' UAC secure desktop, mapped into dom0. When an app asks to elevate, Windows
switches the guest to a separate desktop and draws the consent dialog over a full-screen
dimming backdrop. The agent followed that switch and mapped those surfaces — so dom0 got a
big dark window that could not be closed and did not respond to anything, because the
guest's input was parked on a desktop dom0 never sees. If the agent happened to die during
the switch (a known bug it also hits), you got the backdrop without the dialog: a black
rectangle and an invisible prompt waiting for an answer nobody could give.

It never reproduced here because every test machine ran with UAC turned off. One registry
flip on a test VM reproduced the whole report on the first try.

4.3.11 fixes it in two layers:

1. UAC prompts are now just windows. The guest is configured to draw consent on the
   ordinary desktop, so an elevation prompt behaves like any other guest window: a
   standalone window in dom0 in seamless mode, or a window inside the desktop window in
   non-seamless mode. You can read it and click it. This is unconditional — there is no
   mode or setting in which Windows' secure desktop gets shown.
2. The secure desktop is never mapped. If Windows switches desktops anyway — a lock
   screen, Ctrl+Alt+Del, a site policy — the agent now freezes its output entirely for the
   duration instead of mapping those surfaces, and resumes cleanly afterwards. No black
   window, and your open windows stay as they were.

Also new: qvm-features <qube> service.uac-disable 1 turns UAC off in a guest if you want
that (reboot required). Only an explicit 1 acts, and clearing the feature undoes it —
disabling UAC is not recommended, since without it any code in the qube reaches
admin/kernel, which is the surface facing the hypervisor.

Other fixes

• Reinstalling an older release now actually downgrades the display driver. Windows'
  driver ranking only ever rebinds upward, so reinstalling an older QWT-NG silently left
  the newer driver bound against the older agent. Both install paths now verify the bound
  driver version against the package and force the rebind when it differs.
• /iddonly warns when it is run from a stale copy of the installer tree.
• Capture-engine telemetry from 4.3.10 (WCBLACK/WCDEAD) now has a fault-injection test
  behind it, so those warnings are proven to fire rather than assumed to.

Install

RPM in dom0, or the ISO/tarball inside the template; let the template shut down at the
end. In-place upgrade from any 4.3.x. Hand-created qube? qvm-features <qube> vmexec 1 and
qvm-prefs <qube> qrexec_timeout 1800 in dom0 (on the template; AppVMs inherit) — see the
README.