v0.1.200

Changes since v0.1.199

• release v0.1.200
• test: use genuinely-corrupt fixture for PUT-refuses-broken-config case (#3572)
• test: gate persist-guard debounce settle on the landed-write stamp (#3652)
• fix(win): spawn npm.cmd through a shell in thin-install smoke — Node >=22 EINVAL without it (#3617-C)
• fix: human-readable durations + hermetic e2e pins for the #3619 rollout (#3629)
• fix: keep update-owner-lane-backoff hermetic under the #3619 policy gate
• fix: unused-exports gate — drop speculative exports from hot-replace helper (#3630)
• feat: web panel banner for update-policy hold/pinned state (#3619)
• fix: seed the #3619 config surface in updates.yaml + drop internal-only exports (CI gates)
• docs: document staggered rollout + remote update policy (#3619)
• feat: staggered upgrade rollout + remote update policy file (#3619)
• test: wait for debounced saves to land instead of fixed sleeps (CI flake found via #3626)
• test: lifecycle coverage — shared hot-replace driver, pinned-attach rotation gate, transition-window contract (#3617-E)
• test: strict-path fake upstream in threads-lane + side-call 404 contract (#3617-B)
• ci: thin-install smoke lane — run the packed tarball from a bare install (#3617-C)
• test: e2e the PTC run_code-only shape through all four wires (#3617-F)
• test: complete the lane-decisions matrix — all profiles, proxy mode, EMERGENCY guard (#3617-D)
• fix: dsh attach — superseded recovery flights must not revert the registered origin (#3616)
• docs: negative-assertion discipline for gate tests (#3617-A)
• fix: #3573 carry savedTok in cold-load diagnostics (review supplement)
• fix: #3573 loud cold-load diagnostics — refs-without-blocks no longer silent
• fix: parse bili's own config file as JSONC in the web editor too (#3572)
• fix: accept JSONC (comments/trailing commas) in bili's own config file
• test: pin the #3575 squatter diagnostic channel behavior
• fix: route the #1753 squatter wait diagnostic through the host-safe channel (#3575)
• fix(#3436): decide attach compatibility from what the spawned child records
• fix(#3540 review): native attach wants the RECORDED mitm tier, not the raw union
• fix: native lanes reuse the shared proxy instead of spawning one per process (#3436)
• feat(#3546): settings panel quick-field for compress.absorb toggle
• feat(#3546): rename read_original_image to acp_read_original_image
• feat(#3546): settings panel quick-field for outbound image downscale
• fix(external-summary): boot audit defers unresolvable references to their owning surfaces
• test(external-summary): pin Retry-After math with a header value distinct from backoff
• fix(web): summary credential badge falls back to legacy boolean instead of mislabeling
• fix(external-summary): keep retry delay recording to test mode and mask urls in logged snippets
• fix: external summary credential tri-state visibility, per-attempt logging and bounded retry (#3488)
• fix: restore npm-standard indentation in kernel/package-lock.json (PR #3533 review nit)
• fix: tombstone host-pruned refs and make compress failure receipts actionable (#3302)
• kernel: unknown-ref errors now distinguish sparse gaps from stale generations, name failing endpoints (#3302)
• test(agent): pin the #3304 direct-send guard across all four incremental instances
• fix(agent): restore or refuse lane-mutated payloads on proxy-death direct fallback (#3304)
• chore(gate): ignore plugin-lanes/ work dir
• feat(gate): dsh protocol matrix + proxy lane with per-door wire assertions (#3475)
• test: pin client-disconnect abort of an in-flight HTTP fallback egress
• feat: WS client lane falls back to HTTP/SSE egress when the upstream refuses the upgrade
• fix: validate discovered Node candidates via --version before spawning them as proxy runtime (#3383)
• fix: route the recovery-path attach announcement through the host-safe channel too (#3404)
• fix: route attach startup banners through the host-safe diag channel (#3404)
• fix: persona-lineage follow requires candidates to hold refs (#2948)