JWeBot/CHANGELOG.md

# Changelog

## beta 1.2.6.1019 - 2026-10-19 22:26:26

- 冷门知识问答新增少女乐团派对、韩流和原神题库，并支持 `/知识问答 主题` 定向开题。
- Unknown trivia topics now return the supported topic list, while automatic
  quiz broadcasts still draw from the full trivia bank.

## beta 1.2.5.1019 - 2026-10-19 22:12:52

- 冷门知识问答题库改为中文展示：题干、选项和解释不再混用英文词。
- Keep trivia answer letters unchanged while localizing displayed trivia
  domains, prompts, choices, and explanations.

## beta 1.2.4.1019 - 2026-10-19 18:15:01

- 增强 Taffy 对本地游戏结果的理解：闲聊上下文扩大到 25 轮，并明确标注本地命令结果的发送者和类型。
- Format local command history as tagged context entries so follow-up phrases
  like "这一把" can link back to recent blackjack and other game results.

## beta 1.2.3.1019 - 2026-10-19 18:04:57

- 扩大 Taffy 闲聊可读取的上下文窗口：后续回复现在最多参考最近 15 轮相关对话。
- Increase the default direct-chat context window from 6 to 15 retained turns.

## beta 1.2.2.1019 - 2026-10-19 17:31:56

- 修复本地命令后的闲聊断上下文，新增 `/知识问答` 强制开题，并让多条回复按 0.5～1 秒随机间隔逐条发送。
- Include non-tool local command results in the follow-up chat context so game
  and account actions like `/原石祈愿` can be referenced naturally afterward.
- Exclude utility local commands such as `/version`, `/状态`, `/debug`, and
  feature-list output from chat context to avoid noisy system details.
- Add randomized spacing between queued multi-part replies and immediate local
  multi-reply sends.
- Add `/知识问答` as a Kernel-owned local command that starts a cold-knowledge
  quiz immediately while reusing the active five-minute question when one is
  already running.

## beta 1.2.1.1019 - 2026-10-19 17:23:58

- 修复 Taffy 短句拆分只换行不分条的问题：多句闲聊现在会按多条消息逐条发送。
- Encode multi-sentence chat replies with the existing multi-reply marker so
  direct and cloud chat results enter the multi-message delivery path.
- Split queued delivery helper calls per message part, giving each part a
  stable per-part event id while preserving structured local command output.

## beta 1.2.0.1019 - 2026-10-19 17:05:47

- 优化 Taffy 群聊语气：回复更短、更像群友，减少 AI 式自我解释，并保留主动插话、冷门问答和更新状态提示。
- Add a chat-specific reply style layer that removes common AI-like padding,
  keeps direct unknown-subject clarification, and splits long casual replies
  into shorter lines.
- Apply the style rule to direct chat and cloud-agent replies while leaving
  structured local command output unchanged.
- This 1.2 release grants each existing account both 200 Mora and
  1 primogem.

## beta 1.1.2.1019 - 2026-10-19 16:38:10

- 新增低频主动插话、随机冷门知识问答和更新生命周期提示：Taffy 会偶尔自然冒泡，抛出限时答题奖励摩拉，并在停机、上线和更新就绪时主动说明状态。
- Use recent safe group context to replace some hourly scan slots with an
  ambient chat message during active daytime windows.
- Add a 200+ question CS, Apex, Overwatch, and LoL trivia bank with
  five-minute `/回答 A/B/C/D` answers, recent-question avoidance, and
  rarity-based Mora rewards.
- Limit ambient chat with deterministic probability, multi-hour cooldown, and
  minimum recent-speaker activity so proactive replies feel occasional.
- Send guarded shutdown and startup lifecycle notices during production
  cutover before the normal ready-stage update announcement and compensation.

## beta 1.1.1.1016 - 2026-10-16 17:19:45

- 修复扫码加权重复购买只刷新不叠加的问题。
- Change scan boost semantics to stack each successful purchase as an
  independent 24-hour +5 weight entry.
- Preserve legacy boost entries by deriving their 24-hour expiry from their
  creation time.

## beta 1.1.0.1016 - 2026-10-16 17:04:25

- 修复 OCR 偶发重复识别消耗型命令导致重复回复的问题，并完善摩拉/扫码榜展示。
- Extend OCR semantic duplicate suppression for resource-mutating local
  commands so a visible command bubble re-detected after the short 8 second
  window is still ignored.
- Keep ordinary local commands on the short duplicate window to avoid blocking
  intentional repeated game/query commands.
- Show scan-boost coupon count in `/摩拉`, and make `/扫码榜` list every
  configured scan candidate plus next-hour scan weights.
- This major settlement grants each existing account both 200 Mora and
  1 primogem.

## beta 1.0.5.1016 - 2026-10-16 16:30:44

- 新增原石系统：成就可获得原石，并开放祈愿、扫码加权、Taffy发话和原石榜。
- Add primogem account state, primogem movement history, wish records, scan
  boost coupons, Taffy speech credits, scheduled speech delivery, and
  primogem-source ranking without a SQLite schema migration.
- Award primogems from blackjack natural 21, blackjack 20-to-21 hit challenges,
  Taffy blackjack win streaks, and personal consecutive lottery high-hit pairs.
- Extend post-release settlement so this version grants each existing account
  both 200 Mora and 1 primogem, and show `/version` update time down to seconds.

## beta 1.0.4.1016 - 2026-10-16

- 新增版本更新补偿流程：每次生产更新后向所有既有账户发放 200 摩拉，并在目标群发布更新公告。
- Add a version-idempotent post-release settlement tool that creates an online
  SQLite backup, grants Mora through the production account schema, records a
  version-labelled movement, and tracks announcement delivery independently.
- Run release settlement only after coordinated cutover and rollback gates are
  disarmed, keeping a healthy runtime active when GUI delivery is uncertain.
- Require the first changelog bullet to be a concise user-facing announcement
  summary and require visual confirmation before explicitly retrying an
  uncertain announcement.

## beta 1.0.3.1016 - 2026-10-16

- Rename the virtual currency user-facing copy to Mora (`摩拉`) while keeping
  the existing `/金币`, `/金币排行`, and `/Taffy金币` commands as aliases.
- Add recent account movement details to `/摩拉` and `/金币`, covering the
  latest transfer, loan, repayment, lottery, draw, and blackjack net changes.
- Suppress short-window semantic duplicate OCR events so one visible command
  bubble cannot trigger the same local reply multiple times under new event IDs.

## beta 1.0.2.1016 - 2026-10-16

- Cache OCR-negative visible bubbles and reuse stable visual signatures as the
  OCR cache key so unreadable or lightly re-rendered bubbles do not trigger
  repeated 10+ second RapidOCR passes during active chat windows.

## beta 1.0.1.1016 - 2026-10-16

- Limit RapidOCR ONNXRuntime intra/inter operation threads by default so the
  adaptive OCR recorder no longer saturates CPU after restart and slow recovery
  windows do not stretch local command detection into 10+ second scans.

## beta 1.0.0.1016 - 2026-10-16

- Promote JWeBot from alpha to beta after the local, staging, privacy, and
  production deployment gates stabilized.
- Consolidate the current reviewed local command set, including virtual coin
  transfer, loans, repayment, group leaderboard, multiplayer lottery,
  blackjack, Steam queries, and CS Major autochess.
- Externalize CS Major autochess game content into package JSON data files for
  cards, coaches, narratives, draft/shop/economy rules, match formats, and
  MR15/overtime settings.
- Add a maintained command catalog and keep debug session notes out of the
  repository by default.
- Keep release validation on `tools/sync-local-extensions.py --check`,
  `tools/check-local.sh`, and `tools/check-secrets.py --history`.

## alpha 0.6.11.1015

- Add `/大富翁榜`, `/金币排行`, `/金币排行榜`, and `/richlist` for a
  group-scoped virtual coin leaderboard. Rankings are read-only, sorted by
  current coin balance, recover display names from configured aliases and
  observed profiles, and mark active loan principal when present.
- Split leaderboard command ownership into a dedicated reviewed
  `coin-ranking` local extension.

## alpha 0.6.10.1015

- Add virtual coin loans with `/贷款 [金额]` and `/loan amount`, plus
  repayments through `/还款 [金额|全部]` and `/repay`. Loans are stored in
  the same group-scoped virtual coin account, capped at 500 coins, limited to
  one active loan per account, and replay-safe through the existing ledger
  transaction path.
- Split loan command ownership into a dedicated reviewed `coin-loan` local
  extension so the single-player game plugin stays under the command-count
  validation limit.

## alpha 0.6.9.1015

- Move CS Major autochess public game data out of `cs_autochess.py` and into
  package data files under `jwebot_official_extensions/data/cs_autochess/`.
  Player cards, coach cards, narrative fragments, shop/economy odds, draft
  pacing, synergy thresholds, match formats, MR15/overtime settings, and
  special event rewards are now data driven.
- Add startup validation for the externalized data so missing fields,
  duplicate card IDs, invalid schema versions, or an undersized narrative
  library fail fast before the command engine runs.
- Add regression coverage that verifies the JSON files are packaged, readable,
  and consistent with the runtime card, coach, match-format, and narrative
  inventories.
- Add virtual coin transfers with `/转账 对方 金额` and `/transfer name amount`.
  Transfers are single-transaction ledger updates, require the receiver to
  initialize `/金币` first, reject self-transfers, and replay safely by event ID.

## alpha 0.6.8.1015

- Add an atomic compatibility path for old active CS autochess runs. When a
  group still has a pre-schema-3 active tournament, `/自走棋开始` now archives
  that old run as cancelled and opens a fresh schema-3 season in the same
  SQLite transaction.
- Preserve old story and battle archive rows while ensuring the new season is
  the only active autochess run selected by future commands.

## alpha 0.6.7.1015

- Expand CS Major autochess content to 100+ player cards and an 18-coach
  metadata pool while keeping the opening coach draft to 10 visible choices.
- Replace abstract training targets with real round-robin training rounds.
  Each round resolves participant-vs-participant or participant-vs-AI BO1
  scrims, then opens an operation window for D rolling, locking, lineup swaps,
  tactics, and readiness.
- Replace fixed score bands with deterministic MR15 round simulation. Map
  scores now come from individual round outcomes, including 15-15 overtime,
  instead of direct mappings such as 16-6 or 16-9.
- Add a 120+ line local narrative library for openings, streaks, pauses,
  clutches, economy beats, closes, training hooks, and media/sponsor
  challenges so match reports vary across maps.
- Hide raw target/performance calculation text from training, match, and
  challenge reports while preserving structured battle facts in the archive.
- Start drafted players as two-star素材 and rebalance roster completion toward
  low/mid-cost cards, leaving upgrades and synergies to the shop loop.

## alpha 0.6.6.1015

- Rebuild CS Major autochess around multi-message hosting: tournament
  welcomes, seed order, draft boards, status panels, training results, match
  reports, standings, brackets, and awards are emitted as separate bounded
  replies.
- Replace instant full rosters with three draft rounds: round one selects from
  a fixed 10-coach pool, rounds two and three draft players, then each team is
  completed to five starters, one coach, and three bench slots.
- Run the full event as training camp, BO3 single-round-robin group stage,
  one media/sponsor challenge after group round one or two, BO5 semifinals,
  BO5 final, and final awards.
- Let readiness advance phases automatically. Group matches wait for all real
  players, while knockout matches only wait for real players still in the
  current pairing, so eliminated players are not prompted to prepare.
- Add local multi-text reply support across the SDK, official extension
  adapter, Edge response contract, and recorder GUI sender while preserving
  single-message compatibility.

## alpha 0.6.5.1015

- Extend the AI test path for CS Major autochess to support two-human games:
  `/自走棋加AI战队` now adds AI 战队 A and AI 战队 B when exactly two
  real players have registered.
- Keep the same command for two- and three-human test modes. The tournament
  engine selects 2 人+2 AI or 3 人+1 AI from the current registration count.
- Lock the roster after AI teams join, seed the four-team bracket as 1v4 and
  2v3, and keep AI teams out of the human preparation order while preserving
  independent AI operations and story archives.

## alpha 0.6.4.1015

- Add a reviewed 2-8 player CS Major autochess extension with a fixed
  five-player starting lineup, one always-active coach, an eight-slot bench,
  and a six-candidate shop that shows complete game data.
- Ship a fixed 60-player local pool with rifle, sniper, and in-game-leader
  roles; team and nation synergies; shared copy counts; and deterministic
  three-copy/two-star and nine-copy/three-star upgrades.
- Keep all five player slots occupied. Lineup changes are one-for-one swaps,
  starters cannot be sold directly, and coach upgrades only add a 2%-10%
  team bonus.
- Add player-selected firepower, stability, and clutch tactics. Resolve
  stability over firepower, firepower over clutch, clutch over stability,
  plus sniper/rifle/leader role counters before bounded +/-2% map variance.
- Generate the competition format once at tournament start: two players go
  directly to the final, three play a round robin for two final places, four
  use seeded 1v4 and 2v3 semifinals, and five to eight play a complete round
  robin for four semifinal places.
- Add an explicit three-human-plus-one-AI test mode. The host can add one
  deterministic local AI as seed four; it buys players, upgrades its coach,
  swaps its strongest lineup, and selects a counter tactic without an online
  model.
- Give the bot a persistent host state machine: welcome and format briefing,
  rotating human preparation order, turn enforcement, explicit handoffs,
  round introductions, matchup calls, overtime narration, advancement, and
  championship presentation.
- Run group matches as BO3 and knockout matches as BO5. Simulate every map
  under MR15, including 15-15 overtime, 19-17/22-20 scores, and separately
  archived overtime stories.
- Persist run state, idempotent action responses, structured battles, and
  every generated story in serialized SQLite transactions. Invalid archives
  roll back the full action.

## alpha 0.6.3.1015

- Replace instant personal lottery tickets with one persistent multiplayer
  lottery round per group: start, register/update, status, draw, and cancel.
- Treat each ticket as three distinct digits from 0-9. Sort digits before
  storage so `347` and `743` represent the same selection.
- Accept spaced and compact OCR forms. Ticket stakes are 1-500 coins with a
  default of 10 when omitted.
- Return 0%, 50%, 120%, or 300% of the stake for matching zero, one, two, or
  three drawn digits. All settlement values remain integer coins.
- Commit entry updates, stake differences, all-player payouts, cancellation
  refunds, and event replay responses in serialized SQLite transactions.
- Raise the blackjack stake range to 1-500 coins.
- Add per-game personal sequence numbers and `/游戏记录` (`/gamehistory`) for
  prize draws, lottery rounds, and blackjack hands.
- Prefix game output with the configured player label and game number, such as
  `Player #1：...`; aliases share the same counter and account.

## alpha 0.6.2.1015

- Bound direct DeepSeek SSE reads to 30 seconds of total wall time in addition
  to the existing 18-second socket inactivity timeout.
- Stop reading as soon as the SSE `[DONE]` marker arrives instead of waiting
  for the upstream connection to close.
- Prevent a trickling or unfinished upstream response from occupying both
  generation workers for about 15 minutes and delaying later final replies.
- Preserve fast ACK delivery, three-attempt retry behavior, two generation
  workers, and strict final-reply ordering.
- Treat `/21点 开始 100` as a 100-coin stake and accept OCR forms with missing
  whitespace, such as `/21点开始100` and `/blackjackstart100`.
- Keep blackjack play as explicit steps: start and deal first, then hit or
  stand in a separate command. Combined forms return this workflow without
  opening a game or deducting funds.
- Prefix blackjack hands, status and settlement replies with the current
  group-scoped player's configured display label, such as `player：...`.

## alpha 0.6.1.1015

- Add three reviewed plugins: local context summaries for 100/200/300 messages,
  person and alias lookup, and single-player virtual coin games.
- Provide corresponding Chinese and English commands, including `/context`,
  `/people`, `/person`, `/wallet`, `/draw`, `/lottery`, and `/blackjack`.
- Grant each group-scoped person 1000 virtual coins once; persist account state,
  private blackjack decks, timeout/forfeit rules, and win/loss statistics.
- Commit funds, game state and event replay responses in one SQLite transaction;
  retries never debit twice, and aliases share the canonical person's account.
- Reconcile the message image after a two-second idle wait so a missed final
  XDamage notification does not strand an isolated message; drain buffered Xlib
  events before waiting on the socket. Preserve visual deduplication and guards.
- Keep the generated feature list within the sender's 900-character boundary.
- Document local extractive-summary coverage, OCR identity limitations,
  game payouts, persistence and rollback behavior.

## alpha 0.6.0.1015

- Replace repository-local and hardcoded deployment values with independent,
  profile-based configuration packages.
- Add atomic config generation, activation, import, redacted/private export,
  schema validation, and migration of legacy environment/context material.
- Move private person aliases, bot identity, debug sessions, incident reports,
  telemetry exports, and root-operation archives outside Git with strict
  permissions.
- Remove fixed Steam rosters, aliases, display names, and SteamIDs from source.
- Make `/steam` discover the configured account's public friend list at runtime.
- Add `/steam时长 游戏名`, whitespace-free OCR forms, game-name fuzzy matching,
  bounded per-account playtime queries, privacy-state accounting, and caching.
- Add `/steam时长 游戏名、玩家名` with exact, unique partial, and fuzzy persona
  matching while limiting game-library requests to the selected account.
- Preserve optional group-person-to-SteamID mappings in private profiles,
  migrate legacy scoped rosters and aliases, and prefer that roster over public
  friend discovery.
- Preserve multiline local-command output so `/debug` remains readable.
- Remove the visible `好友` wording and add a dedicated Steam progress ACK.
- Rename built-in plugin ownership from a personal namespace to `jwebot`.
- Rename the SDK event field to the generic `mention_bot`.
- Add a privacy-safe tracked-file/Git-object scanner that never prints matched
  values.
- Add a six-stage new-host bootstrap, an eight-stage coordinated deployment
  progress display, runtime requirements, and zero-to-running documentation.
- Add public repository, configuration, SDK, contribution, security, and
  licensing documentation.
- Start the public history from a sanitized root after a verified private
  backup; pre-public operational history remains only in protected local
  archives.

## alpha 0.5.11.1015

- Reduce the conservative follow-latest scroll burst from a fixed `25ms` to
  `1ms` between each of the existing 30 wheel events.
- Reuse the XDamage producer's verified WeChat window identifier in the
  adaptive ready-layout gate instead of rediscovering the same window before
  each screenshot.
- Preserve the shared GUI lock, ready-window geometry gate, second screenshot,
  and loaded-bottom visual confirmation.
- Add privacy-safe per-step capture telemetry and regression coverage for the
  optimized slow path.

## alpha 0.5.10.1015

- Prioritize queued fast acknowledgements and local-command replies over queued
  final replies in the guarded GUI sender.
- Keep the active GUI send non-preemptive and preserve strict FIFO ordering
  within each priority class through a monotonic sequence number.
- Raise the adaptive recorder CPU quota from `150%` to `250%` to reduce
  screenshot subprocess stalls under OCR and GUI contention.
- Add deterministic coverage for ACK/local priority, final FIFO ordering,
  single-sender serialization, and clean worker shutdown.

## alpha 0.5.9.1014

- Preserve both capture call contracts in the adaptive ready-window wrapper:
  zero arguments for startup/polling and one verified window identifier for the
  optimized XDamage producer.
- Fix the alpha 0.5.8 internal `CaptureProducerError` restart loop that began on
  the first relevant XDamage event.
- Add direct regression tests for both ready-gated capture signatures.

## alpha 0.5.8.1014

- Recover one unseen bottom-most bot trigger when a viewport resync has no
  visual overlap, instead of silently dropping the new command.
- Persist a bounded recent-trigger visual history so an old command is not
  replayed by a later no-overlap resync; ordinary messages remain fail-closed.
- Seed that history from one startup baseline before enabling recovery, so a
  service restart cannot replay a visible pre-existing command.
- Reuse the XDamage monitor's verified WeChat window identifier and the
  maximize gate's geometry result, removing one redundant window lookup and
  one redundant geometry subprocess from each changed-frame capture.
- Add regression coverage for unseen-trigger recovery, seen-trigger replay
  suppression, signature migration, and the optimized capture path.

## alpha 0.5.7.1014

- Replace the single direct-request worker with two parallel generation workers
  and one strictly ordered GUI delivery worker for ordinary chat and Steam
  requests.
- Keep final replies in durable `created_at, event_id` order even when a newer
  provider call completes first; failed acknowledgements and exhausted requests
  remain terminal and do not block later replies.
- Separate generation and delivery retry counters so each phase retains its
  complete retry budget.
- Wake generation and delivery workers immediately on enqueue, generation
  completion, and acknowledgement instead of adding a one-second idle polling
  delay to the normal path.
- Split direct-queue telemetry into `direct_generation` and `direct_delivery`
  phases and add concurrency, ordering, ACK-race, retry, Steam, and duplicate
  regression coverage.

## alpha 0.5.6.1014

- Preserve both pre-draft and post-draft group fingerprint gates while
  capturing only the configured title region instead of decoding the complete
  WeChat window twice per GUI send.
- Keep the previous full-window fingerprint path as a compatibility fallback
  for older adaptive upstream modules.
- Add GUI sender coverage for the title-region primary path, full-window
  fallback, and visual group-mismatch fail-closed handling.

## alpha 0.5.5.1014

- Accept incoming WeChat bubbles up to `900px` wide so long single-line bot
  mentions are not discarded before OCR; preserve position, height, area, and
  outgoing-bubble exclusion gates.
- Wait for adaptive OCR warmup and a first baseline capture from the current
  service start before reporting `adaptive ready` or successful deployment.
- Fail and roll back deployment if the adaptive service exits or cannot
  establish its recorder baseline within 90 seconds.
- Retry the WeChat ready-window gate for up to 30 seconds and discover the
  exact `Weixin` window by both class and title before failing closed.
- Pin production privilege switching and X11 inspection to verified absolute
  executable paths so a restricted root `PATH` cannot masquerade as a missing
  WeChat window.

## alpha 0.5.4.1014

- Stabilize visible-message sequence alignment with thresholded binary
  sender/body fingerprints while retaining exact RGB keys for OCR cache
  invalidation.
- Reset 0.5.3 exact-visual recorder state to a safe no-reply baseline during
  the signature migration.
- Prefix coordinated deploy phases with `[JWeBot]`, report explicit
  `starting`, `ready`, and `active` states, and run user installation from the
  target home to avoid inherited `/root` working-directory warnings.

## alpha 0.5.3.1014

- Align visible message sequences with existing exact bubble visual
  fingerprints instead of OCR text, preventing scroll/resync OCR drift from
  dropping a newly mentioned slash command.
- Reset legacy text-signature recorder state to a no-reply visual baseline on
  startup, avoiding duplicate replay during the signature-scheme migration.
- Preserve repeated identical commands as separate visual occurrences.

## alpha 0.5.2.1014

- Print an ASCII pixel-art project signature only after the coordinated
  production deployer passes every cutover gate and disables rollback.

## alpha 0.5.1.1014

- Exclude the static bottom-left input hint from the realtime text ROI so an
  empty WeChat input box is not misclassified as dirty.
- Label the corrected ROI as `input_text_core_v2` in bridge telemetry, keeping
  pre-fix and post-fix production evidence distinguishable.

## alpha 0.5.0.1014

- Move visible WeChat delivery onto a persistent in-process GUI sender queue
  hosted by the adaptive recorder, avoiding per-message bridge subprocesses for
  ACK, local-command replies, and final deliveries.
- Add a private AF_UNIX sender socket so Edge delivery helpers submit final
  replies to the same serialized GUI queue instead of racing the input box.
- Combine clear, paste, ROI draft flag, post-draft group check, Enter send,
  ROI clear confirmation, and send-button fallback into one bridge call.
- Confirm the input ROI is empty after Ctrl-A/Backspace before using it as the
  paste baseline, preventing repeated `喵......` ACK drafts from being mistaken
  for paste failures.

## alpha 0.4.15.1014

- Force adaptive recorder logging to INFO so GUI bridge timing telemetry is
  visible on ACK and final delivery paths.
- Allow ROI, poll, pixel-threshold, flag, and coordinate fields through the
  packaged runtime telemetry sanitizer.

## alpha 0.4.14.1014

- Replace full-input send confirmation with a left-side input-text ROI flag so
  draft and send confirmation poll only the region that should visibly change.
- Restore the guarded send order to Enter first, then click the scaled send
  button only as a fallback when ROI clearing is not visually confirmed.
- Emit ROI coordinates, flag state, flag wait time, confirmation source, and
  bridge stderr tail diagnostics for GUI delivery failures.

## alpha 0.4.13.1014

- Emit detailed guarded GUI delivery timings for lock acquisition, pre/post
  draft screenshots, group fingerprint checks, bridge subprocess duration,
  draft paste confirmation polling, send-button confirmation polling, Enter
  fallback, callback hooks, and total send time.
- Return per-step timing metadata from the adaptive GUI bridge so ACK and final
  delivery reports can attribute fixed waits, screenshot confirmation, VNC
  input, and fallback paths without logging message text.

## alpha 0.4.12.1014

- Optimize guarded WeChat GUI delivery by clicking the scaled send button first
  and polling for visual confirmation instead of waiting on fixed sleeps.
- Preserve the Enter-key fallback when the button path is not visually
  confirmed.

## alpha 0.4.11.1014

- Add explicit `edge.fast_ack.*` and `recorder.fast_ack.*` telemetry names
  alongside the existing ACK metrics, making fast acknowledgement latency
  independently filterable without breaking historical dashboards.

## alpha 0.4.10.1014

- Cache configured person-alias rows once per group and make configured
  identity persistence idempotent, eliminating thousands of redundant
  `FULL`-synchronous SQLite commits during Edge startup.
- Reduce measured production host systemd socket readiness on the production database
  snapshot from more than 90 seconds to about one second.

## alpha 0.4.9.1014

- Wait up to 45 seconds for the newly started Edge socket and health response
  before deciding that a production cutover failed, while still failing
  immediately if systemd marks the service failed.

## alpha 0.4.8.1014

- Keep the adaptive OCR process alive while WeChat is absent or awaiting login,
  then resume capture against the ready main window without a systemd restart
  storm.
- Install the reviewed `wechat_local_ocr.py` beside the adaptive runtime instead
  of importing an independently managed root copy.
- Add a root-coordinated production deploy that records both systemd
  topologies, backs up root and user files plus SQLite, disables both legacy OCR
  units, and rolls back all layers when a health gate fails.
- Require empty OCR queues, a ready WeChat window, Edge socket health, stable
  adaptive restart counts, and SQLite integrity before accepting a production
  cutover.
- Preserve incoming service state in legacy install and upgrade tools; legacy
  OCR now remains disabled unless an operator explicitly opts in.
- Prevent Extension Host imports from writing bytecode into verified releases,
  and exclude only standard interpreter cache files from source packaging.
- Add deployment contract tests and shell-aware syntax validation to the local
  release gate.

## alpha 0.4.7.1014

- Prewarm RapidOCR recognition and detection paths before live capture.
- Cache successful bubble recognition by bounded exact visual fingerprint,
  recognize only new or changed crops, and periodically revalidate the cache.
- Persist OCR command events through atomic file replacement plus file and
  directory `fsync`, then immediately wake the in-process responder while
  retaining the one-second recovery scan.
- Name the three execution paths explicitly as `local-command`, `deepseek`, and
  `openclaw` in Edge responses and privacy-safe routing telemetry.
- Add signed plugin description/help metadata, validate it through Host health,
  generate bundled `/功能列表` output automatically, and update plugin creation
  tooling and author documentation.

## alpha 0.4.6.1014

- Add a repeatable local performance baseline for OCR preprocessing, sequence
  alignment, durable ACK/queue state, and real signed Host process execution.
- Add a structured telemetry-log analyzer with p50, p95, maximum, status, and
  event-count summaries.
- Measure queue waiting, capture-buffer age, ACK end-to-end latency, and final
  Edge delivery latency without recording message content.
- Establish the bottleneck order from local measurements and existing runtime
  evidence: RapidOCR, provider generation, polling wakeups, then one-shot Host
  startup; SQLite and sequence work remain below 2 ms p95 locally.
- Document the evidence, measurement gaps, and optimization order for later
  `0.4.x` iterations.

## alpha 0.4.5.1014

- Close the approved repository-only Extension Host migration scope.
- Treat an invalid installed signed release as a startup failure rather than a
  preferred-mode fallback; only missing or startup-unhealthy Hosts may fall
  back.
- Enforce the end-to-end Host deadline after Kernel service execution and
  expand transport-error telemetry.
- Document completed local work, explicitly deferred external operations, and
  the next measurement-led OCR/queue/ACK performance-analysis phase.

## alpha 0.4.4.1014

- Add privacy-safe structured telemetry for OCR, routing, ACK preparation and
  confirmation, queues, providers, Host processes, service brokering, and final
  GUI delivery.
- Hash event and group identifiers, reject message-body fields, and retain only
  low-cardinality process-local counts and latency summaries.
- Expose telemetry summaries through Edge health without making telemetry part
  of delivery correctness.
- Instrument OCR capture/recognition/queue stages and distinguish ACK GUI
  delivery from Edge confirmation.
- Document ACK ordering and the measurement points needed for future OCR,
  queue, Host-startup, and provider latency optimization.

## alpha 0.4.3.1014

- Require a signed release to pass isolated Host health before atomic
  activation; failed new releases are removed without switching `current`.
- Add explicit local-only health bypass for packaging environments.
- Complete real-process parity coverage for all 12 reviewed plugins, including
  memory CRUD, both stateful games, dice challenge, rankings, history, and
  Steam fast-ACK final generation.
- Fix Host protocol writes so broker messages bypass redirected plugin stdout
  without exposing plugin output to the parent protocol.

## alpha 0.4.2.1014

- Load installed signed plugin manifests into a deterministic startup catalog
  and freeze command ownership before routing.
- Add `in-process`, `prefer-host`, and `host-only` Edge execution modes with
  subprocess or AF_UNIX Host transports.
- Route signed healthy plugins through the isolated Host while preserving
  Kernel-direct commands and Steam fast-ACK queueing.
- Permit startup fallback for missing or unhealthy preferred Hosts, but never
  replay an active invocation after a possible stateful service call.
- Add real subprocess end-to-end coverage from Edge through the generated
  adapter, Host protocol, Kernel service broker, and final reply.

## alpha 0.4.1.1014

- Add bounded bidirectional JSON-line service brokering between isolated
  Extension Host processes and Kernel-owned service profiles.
- Enforce declared profile ownership, call IDs, call count, message size, and
  end-to-end process/socket deadlines.
- Add Host health inventory responses and broker support to both subprocess and
  AF_UNIX clients.
- Keep service errors generic across the isolation boundary.

## alpha 0.4.0.1014

- Start the approved `0.4.x` local extension-host migration and performance
  instrumentation milestone.
- Keep signing-pipeline integration, key rotation, PR rehearsal, target-machine
  provisioning, deployment, and Linux verification deferred.

## alpha 0.3.1.1014

- Add OpenSSH `sshsig` publisher signatures for canonical extension release
  records.
- Bind the publisher principal, release filename, artifact metadata, source
  digest, manifest author, and exact file list through one signed payload.
- Require trusted publisher verification for activation, Host loading, and
  rollback; unsigned paths now require an explicit local-test override.
- Persist the canonical signature record with each installed release and
  re-verify it before execution or rollback.
- Add signing support to package, verify, activate, rollback, and standalone
  release-signing tools.
- Keep production host provisioning, deployment, and systemd validation deferred.

## alpha 0.3.0.1014

- Close the `0.2.x` complete-function migration after the corrected granular
  plugin ownership model passed the full local gate.
- Start the approved `0.3.x` baseline with Kernel-direct operational commands,
  official-owned person memory, and 11 project-owned plugins.
- Keep Linux deployment and systemd verification explicitly deferred.

## alpha 0.2.6.1014

- Replace grouped plugin domains with one plugin per independently
  understandable function.
- Keep dice and dice challenge as one complete project-authored collection.
- Make person-memory the only official-authored command plugin.
- Move feature list, status, and balance to unconditional Kernel-direct
  routing.
- Add required manifest author metadata and release-record schema version 2.
- Generate 11 project plugin packages under the reviewed local-extension namespace and keep only
  person-memory under `extensions/official`.
- Rename the canonical rollback switch to
  `JWEBOT_LOCAL_EXTENSIONS_ENABLED`, while accepting the old environment key
  as a compatibility fallback.

## alpha 0.2.5.1014

- Move the complete Steam provider into `jwebot-official-extensions`.
- Migrate fixed roster, group aliases, mode filtering, single-person lookup,
  cache, API batching, proxy enforcement, and error classification.
- Preserve the existing public `SteamClient`, `SteamUnavailable`, API base, and
  Mihomo default exports through the packaged Edge runtime.
- Keep the no-direct-network-fallback regression tests passing.

## alpha 0.2.4.1014

- Add full official-adapter versus compatibility-path parity tests.
- Cover every stateless command family, all memory operations, every
  dice-challenge phase, guess-number lifecycle, RPS lifecycle, status, balance,
  Steam generation, and restart persistence.
- Make parity and persistence checks part of the permanent local/CI gate.

## alpha 0.2.3.1014

- Route all known local commands through generated official SDK adapters by
  default.
- Execute stateful behavior through named in-process service brokers without
  exposing raw Ledger or providers to adapters.
- Preserve the Steam fast-ACK asynchronous path through the official adapter.
- Add `JWEBOT_OFFICIAL_EXTENSIONS_ENABLED=0` as a compatibility rollback to
  direct command-engine dispatch.
- Keep unknown slash-command errors on the compatibility path.
- Install generated adapter modules with the official package.

## alpha 0.2.2.1014

- Add reviewed `service_profiles` as a narrow SDK/manifest capability.
- Generate real Host-loadable packages for all seven official function domains.
- Register every existing alias through SDK command adapters.
- Delegate complex stateful behavior through named Kernel service profiles
  instead of exposing raw Ledger or provider objects.
- Add synchronization checks so official manifests, adapters, docs, and command
  ownership cannot drift.
- Validate, source-scan, and package every official extension in CI.

## alpha 0.2.1.1014

- Move the complete local command engine out of the Edge runtime into the
  installable `jwebot-official-extensions` package.
- Preserve all command replies, persistence, deterministic seeds, game state
  machines, memory operations, rankings, status, balance, and Steam behavior.
- Inject Ledger, Steam, balance, reply-cleaning, identity, and memory-policy
  brokers from Kernel instead of importing Edge internals.
- Add a unique ownership map covering every current command kind and alias.
- Add an authoritative migration matrix documenting every command subfunction
  and non-command Kernel responsibility.

## alpha 0.2.0.1014

- Start the approved `0.2` full-function migration milestone.
- Move the complete Edge runtime into `jwebot-kernel`.
- Keep `jwebot_edge.py` as a compatibility CLI and module alias so existing
  imports and runtime monkeypatches continue to affect implementation globals.
- Update tests and the installer for the packaged runtime.
- Preserve all existing command, queue, ledger, model, memory, broadcast, and
  delivery behavior.
- Do not deploy or validate on Linux in this stage.

## alpha 0.1.11.1014

- Add a bounded AF_UNIX client matching the systemd socket-activated Host
  design.
- Send one canonical JSON request, half-close the write side, and read one
  bounded response.
- Fail closed on socket timeout, unavailable socket, malformed response, and
  Host error status.
- Keep the socket client disconnected from the current production Edge path.

## alpha 0.1.10.1014

- Add uninstalled systemd socket/service templates for the extension Host.
- Specify a fixed unprivileged identity, AF_UNIX-only private network,
  read-only system/release paths, empty capabilities, syscall filtering, and
  CPU/memory/process/runtime limits.
- Add static sandbox-policy checks and unit tests.
- Require explicit target-host provisioning and systemd verification before
  any future enablement.

## alpha 0.1.9.1014

- Add the Kernel-side extension Host client with a minimal inherited
  environment and isolated process group.
- Enforce parent wall-time deadlines and kill the entire Host process group on
  timeout.
- Bound request, response, and stderr sizes and reject malformed protocol
  responses.
- Limit plugin stdout/stderr inside the Host.
- Hash both plugin log messages and field-name sets instead of emitting plugin
  text.
- Test timeout child-process cleanup and environment-secret exclusion.
- Keep the client disconnected from the production Edge path.

## alpha 0.1.8.1014

- Add an installable `jwebot-extension-host` package.
- Re-verify installed release content, manifest, and source policy before import.
- Enforce exact declared command registration and freeze it before invocation.
- Add a bounded single-request JSON stdin/stdout protocol.
- Scrub inherited environment values and redirect plugin stdout away from IPC.
- Keep storage, HTTP, and scheduling brokers fail-closed.
- Return generic plugin failure classes without exception text.
- Do not connect the Host to Edge or install it on production host.

## alpha 0.1.7.1014

- Add verified release installation under full source-digest directories.
- Add locked, atomic `current` and `previous` activation pointers.
- Re-verify installed release file lists, records, and source content before
  reuse.
- Add explicit local activation and rollback tools with no default production
  path.
- Test rollback, tampered artifacts, tampered installed content, unsafe
  pointers, and private installed-file permissions.
- Do not execute extension code or modify production host.

## alpha 0.1.6.1014

- Add deterministic, content-addressed extension release artifacts.
- Add canonical source and artifact SHA-256 records.
- Verify artifacts without extraction and reject path traversal, non-regular
  members, expansion limits, file-list drift, and content tampering.
- Refuse replacement of an existing digest-addressed artifact with different
  bytes.
- Build and verify the example extension artifact in Gitea Actions.
- Explicitly defer publisher signing and production host activation to a later phase.

## alpha 0.1.5.1014

- Add a static extension source-policy preflight before packaging.
- Reject unapproved imports, file/process/socket access, dynamic execution
  builtins, and dunder attribute traversal.
- Enforce source count, size, UTF-8, syntax, and symlink limits.
- Make `validate-plugin.py` validate both manifest and source policy.
- Document that static policy is a CI prefilter, not a replacement for OS
  process isolation.

## alpha 0.1.4.1014

- Restrict extension command names to Unicode word characters, dots, and
  hyphens.
- Reject quote/newline template injection before plugin skeleton files are
  created.
- Add manifest and generator regression tests while preserving Chinese command
  names.

## alpha 0.1.3.1014

- Add a safe command-extension generator that refuses invalid IDs, invalid
  commands, path traversal, and overwriting existing extensions.
- Add official and friend extension namespaces.
- Add an author guide, SDK API reference, and reusable AI-author prompt.
- Include author tooling and required documentation in the repository gate.

## alpha 0.1.2.1014

- Add a deterministic extension catalog that accepts reviewed manifests only
  during startup.
- Reject duplicate plugin IDs and case-insensitive command ownership conflicts.
- Freeze registration before runtime command resolution.
- Keep catalog views immutable and require explicit command-token boundaries.

## alpha 0.1.1.1014

- Make `jwebot-kernel` the authoritative pure routing implementation used by
  the existing Edge compatibility entrypoint.
- Preserve the existing `jwebot_edge.py` public function shapes for current
  callers and tests.
- Update the production host installer to deploy and roll back the SDK and Kernel package
  directories together with the compatibility scripts.
- Do not deploy or restart any production service in this repository change.

## alpha 0.1.0.1014

- Start the approved `0.1` milestone with installable `jwebot-sdk` and
  `jwebot-kernel` packages.
- Add versioned event, reply, fact, and extension-result contracts.
- Add capability-limited context protocols that expose no GUI, group selector,
  raw ledger, environment, shell, or unrestricted network access.
- Add strict plugin manifest validation and pure local/chat/cloud routing
  primitives.
- Add a minimal `/hello` command extension and package boundary tests.
- Keep all existing root runtime entrypoints unchanged for production host compatibility.

## alpha 0.0.7.1014

- Move unit tests into `tests/`.
- Update tests to load root compatibility entrypoints from the repository root.
- Update local verification commands to discover tests from `tests/`.

## alpha 0.0.6.1014

- Add repository-safe configuration templates under `config/examples/`.
- Add `docs/configuration-guide.md` for runtime configuration ownership and
  deployment destinations.
- Add `tools/check-config.sh` and include it in the local migration gate.
- Keep real secrets and production host runtime files outside Git.

## alpha 0.0.5.1014

- Add a Gitea Actions workflow that runs the standard local migration gate on
  push and pull request.
- Add `requirements-dev.txt` for local and CI test dependencies.
- Document dependency installation in `README.md`.

## alpha 0.0.4.1014

- Move home-backup operational material into `ops/home-backup/`.
- Move the TigerVNC config snippet into `deploy/config/`.
- Keep backup material in the repository for reference while separating it from
  the bot runtime path.

## alpha 0.0.3.1014

- Add `tools/check-local.sh` as the standard local migration gate.
- Wire the gate to compile Python entrypoints, validate shell scripts, reject
  active emergency debug hooks outside their archive docs, and run the full
  unittest suite.
- Document the local check command in `README.md`.

## alpha 0.0.2.1014

- Remove temporary emergency HTTP debug hooks from production Python entrypoints.
- Preserve removed hook context in `docs/debug/emergency-hooks-archive.md`.
- Add `docs/configuration-inventory.md` to document hardcoded addresses, paths,
  service names, dimensions, models, and their migration policy.
- Keep historical incident markdown unchanged for auditability.

## alpha 0.0.1.1014

- Establish the repository version baseline for the private alpha migration.
- Move operational docs into `docs/`.
- Move deployment scripts, defaults, and systemd units into `deploy/`.
- Move the cloud responder prompt workspace into `agents/wechat-responder/`.
- Move the old direct OpenClaw watcher into `legacy/`.
- Keep current Python runtime entrypoints at repository root to preserve test and
  deployment compatibility during the first migration step.