Cotabby for Windows v0.4.1

Cotabby for Windows v0.4.1

Tagged build from commit f5c6dbdd6691986c8f8834cddd16339871298553.

The v0.4.0 tag build was cancelled before publication when the final privacy
review found typed-character debug logging. v0.4.1 is the first published build
for this cumulative change set. No v0.4.0 release ZIP was published.

Added

• Complete the global, opt-in double-tap Tab acceptance port (#840): first Tab accepts a word/phrase, second distinct Tab within 300 ms accepts the remainder once. Backtick remains the default; Shift+Tab stays navigation. Serialized acceptance preserves spacing and handles repeats, delayed/failed insertion, focus changes and disposal. See scope and verification.
• Content-free application-log warnings for captured acceptance keys that cannot be inserted and are deliberately not replayed. No unsafe injection into an unknown foreground window.
• Actual Windows Settings dropdown/persistence and production text-inserter runtime regressions in both CI and the release workflow, in addition to nine synthetic hook/UIA cases.

Fixed

• Stop recording typed-character codes in key diagnostics, including credential fields. Older builds' local C:\tmp\cotabby-live.log may contain reconstructable keystrokes: remove that old log when upgrading; no logs are included in this release ZIP.
• Prevent a retiring acceptance processor from draining a replacement queue started by a completion callback or concurrent keypress; queued recovery keys keep their own processor and spacing.
• Recheck field/process/credential ownership before the first overlay chunk, even when a focus-change notification has not arrived.
• Revalidate the actual focused UIA element and foreground process at production insertion dispatch; a stale target cannot intentionally direct text into the newly focused field.
• Keep input blocking, clipboard paste and unblocking on one STA thread instead of crossing async continuations, which could silently lose long completions or leave input blocked.
• Preserve non-text clipboard formats, restore an originally empty clipboard, and avoid replacing a clipboard changed by another application. If a format cannot be copied, refuse long insertion before modifying it.
• Respect SendInput's dispatched-event count rather than reporting success unconditionally. Finish cleanup after an irreversible dispatch even when cancellation arrives.
• Preserve all earlier ports: full output-budget reservation (#851), partial GPU/request Performance pane (#858), and credential-field protection (#848).

Known limits

• Rejected captured keys are not replayed; that press can be lost. Warnings make this visible without logging its content.
• Physical keys, live-model suggestions, per-application accessibility and GPU accuracy still require owner testing. CI uses real Windows hooks/UIA with synthetic input and a deterministic engine; it is not live-model or universal host parity proof.

Assets

• Cotabby-win-x64-v0.4.1.zip — self-contained folder build. Extract into a new folder; do not flatten runtimes.
• Cotabby-win-x64-v0.4.1.zip.sha256 — verified checksum of the ZIP above.

SHA-256: fa6964220f78e23c9cec4e2bd158879f88d24bb92e23964a0abaee1c210b6ab7

Verification

• Windows CI on this commit runs the full test suite, the synthetic real-UI-Automation credential proof and a GPU counter/persistence smoke test.
• The published ZIP is extracted and every member is hashed against the packaged manifest before upload.
• Live model decoding, physical GPU readings, per-adapter behavior and browser/application credential coverage remain owner-verified.
• Inference stays local: no telemetry and no cloud completion. Do not share raw logs; they can contain typed text.