Prepare the 4.3.0 release

CHANGELOG.md

@@ -4,7 +4,7 @@ Document all notable Winnow changes in this file. Releases before 4.0.0 were pub
 
 Follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [4.3.0] - 2026-09-23
 
 ### Added
 

HISTORY.md

@@ -1,3 +1,19 @@
+## [v4.3.0] - 2026-09-23
+### Artifacts
+- **Release Package**: Winnow-v4.3.0.zip
+- **Standalone**: Winnow-Standalone.ps1
+- Both built and published by the release workflow on tag push. Checksums are on the release page.
+### Added
+- Extended AI purge covers Click to Do, the agentic Settings search, and the Paint AI features (Cocreator, generative fill, Image Creator), with paths and scopes from the WindowsAI policy CSP; the update watchdog re-asserts the new machine-wide policies. Not yet verified on a Copilot+ device.
+### Fixed
+- `DisableTelemetryServices` failed every apply and undo because its script was never loaded; it is part of the `privacy-max` preset.
+- The run summary was never written because its script was never loaded; it is now written for every real apply and reports rolled-back features truthfully.
+- `-VerifyWatchdog` reported every watchdog as not installed (scheduled task folder path lacked the trailing backslash Task Scheduler stores); re-installing also failed to replace the old task.
+- Block feature version upgrades pins to the release the device is on instead of a hard-coded 24H2.
+- The registry fallback writer no longer reports success after skipping access-denied writes.
+### Note
+- First release whose mutating paths (automatic rollback, dry-run safety, Scope B module rollback, watchdog install/enforcement/tamper) passed end to end in Windows Sandbox: 30 passed, 0 failed, 1 skipped by design. The run found the four script-loading, watchdog, and writer bugs above. Still not exercised: the watchdog firing on a real Windows Update event.
+
 ## [v4.2.3] - 2026-09-18
 ### Artifacts
 - **Release Package**: Winnow-v4.2.3.zip

Publishing/winget/BiosSystem.Winnow.installer.yaml

@@ -21,14 +21,14 @@
 #      or let `wingetcreate update BiosSystem.Winnow` fill it in.
 
 PackageIdentifier: BiosSystem.Winnow
-PackageVersion: 4.2.3
+PackageVersion: 4.3.0
 Platform:
   - Windows.Desktop
 MinimumOSVersion: 10.0.22000.0
 InstallerType: zip
 Installers:
   - Architecture: neutral
-    InstallerUrl: https://github.com/BiosSystem/Winnow/releases/download/v4.2.3/Winnow-v4.2.3.zip
+    InstallerUrl: https://github.com/BiosSystem/Winnow/releases/download/v4.3.0/Winnow-v4.3.0.zip
     InstallerSha256: 0000000000000000000000000000000000000000000000000000000000000000
     NestedInstallerType: portable
     NestedInstallerFiles:

Publishing/winget/BiosSystem.Winnow.locale.en-US.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.12.0.schema.json
 
 PackageIdentifier: BiosSystem.Winnow
-PackageVersion: 4.2.3
+PackageVersion: 4.3.0
 PackageLocale: en-US
 Publisher: BiosSystem
 PublisherUrl: https://github.com/BiosSystem

Publishing/winget/BiosSystem.Winnow.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://aka.ms/winget-manifest.version.1.12.0.schema.json
 
 PackageIdentifier: BiosSystem.Winnow
-PackageVersion: 4.2.3
+PackageVersion: 4.3.0
 DefaultLocale: en-US
 ManifestType: version
 ManifestVersion: 1.12.0

SECURITY.md

@@ -8,7 +8,8 @@ Winnow is a modular Windows 11 optimization and debloating toolkit. Because Winn
 
 | Version | Supported | Status |
 |---|---|---|
-| `4.2.x` | Yes | Active production release for Windows 11 (24H2, 25H2). Current Winnow line. 4.2.1 through 4.2.3 carry the 2026 security-hardening cycle (watchdog ACL/integrity anchor, standalone elevate-first extraction, winget argument isolation, reliable user-hive unload) |
+| `4.3.x` | Yes | Active production release for Windows 11 (24H2, 25H2). Current Winnow line. Carries the 4.2 security-hardening cycle, plus a working `-VerifyWatchdog` health check (it reported every watchdog as not installed in 4.2.x) and the first release whose rollback and watchdog paths were exercised end to end in Windows Sandbox |
+| `4.2.x` | No | Superseded by 4.3. 4.2.1 through 4.2.3 introduced the security-hardening cycle (watchdog ACL/integrity anchor, standalone elevate-first extraction, winget argument isolation, reliable user-hive unload), but `-VerifyWatchdog` could not find the watchdog task |
 | `4.0.x` - `4.1.x` | No | Superseded by 4.2. Predate the watchdog and standalone privilege-escalation fixes |
 | `3.x` | No | Superseded by 4.0. Published under the former name, WinSwift; 3.3.x and earlier also carried the elevation-guard bug fixed in 3.4.0 |
 | `< 3.0` | No | Legacy baseline |

Scripts/Helpers/Initialize-Environment.ps1

@@ -6,7 +6,7 @@ $script:Version = if (Get-Variable -Name WINNOW_VERSION -Scope Global -ErrorActi
 } elseif ($WINNOW_VERSION) {
     $WINNOW_VERSION
 } else {
-    "4.2.3"
+    "4.3.0"
 }
 $script:AppVersion = $script:Version
 $rootDir = Split-Path (Split-Path $PSScriptRoot -Parent) -Parent

Winnow.ps1

@@ -6,7 +6,7 @@
     purge AI/Copilot integrations, and reclaim your Windows experience.
     Created by Bios-System | https://github.com/BiosSystem/Winnow
 .VERSION
-    4.2.3
+    4.3.0
 #>
 [CmdletBinding(SupportsShouldProcess)]
 param (
@@ -156,7 +156,7 @@ if ($PSVersionTable.PSEdition -eq 'Core') {
     exit 1
 }
 
-Set-Variable -Name 'WINNOW_VERSION' -Value '4.2.3' -Option Constant
+Set-Variable -Name 'WINNOW_VERSION' -Value '4.3.0' -Option Constant
 
 # Call Helper Scripts
 . (Join-Path $PSScriptRoot 'Scripts\Helpers\Ensure-Admin.ps1') -OriginalCommandPath $PSCommandPath -OriginalBoundParameters $PSBoundParameters -OriginalUnboundArguments $MyInvocation.UnboundArguments