Link Windows 0.2.0 beta — 2026-10-11

CHANGES
- Fixed paste/import for Unicode whitespace and invisible edge characters.
- Copy wrappers and Happ deep links preserve percent-encoded subscription tokens.
- Import errors are Russian, actionable and never echo an untrusted exception/token.
- Added AmneziaWG 1/2 .conf with official native engine and self-hosted vpn:// client exports.
- Native service uses a private administrator-owned ProgramData staging directory,
  per-session demand-start SCM registration and a parent-process watchdog.
- AWG preserves configuration DNS and AllowedIPs; full IPv4 routes get a connectivity check.
- Unsupported commands/protocols, administration keys and Premium API links are rejected.
- Simplified home/settings; compatibility, routing and privacy details moved to help.
- Signed feed checks at startup/every 6h; bounded HTTPS background download, SHA-256,
  explicit install/restart with protected staging and preserved DPAPI profiles.

VALIDATION
76 .NET parser/compiler/update regressions passed in the isolated Linux .NET 10 SDK.
Windows x64 managed code cross-build passed with 0 warnings / 0 errors.
Native AWG PE32+ x64 DLL builds in pinned Go 1.25.14 Docker image; Go modules verified.
Export WireGuardTunnelService and dependencies KERNEL32/msvcrt inspected.
Windows core: amneziawg-windows e90531d15802cb976773f3b63443bc281f738ca3;
amneziawg-go/v3 v3.1.20260814. MIT sources and notices shipped alongside the binary.
Integration patch restores upstream tunnel DNS/physical-socket binding and disables
persistent ringlogger. See tools/prepare-awg.py and modified source archive.

NOT YET VERIFIED ON A WINDOWS DEVICE
Installer elevation; WinForms rendering/focus; SCM startup; Wintun creation;
actual AWG handshake/data transfer; DNS/IPv6 route behavior; switching and route restore;
process-crash watchdog and service/session cleanup; full update/UAC/restart workflow.
A cross-build is not device validation.
No active VPN on the developer's Mac or production VPN servers was switched or changed.

DEVICE ACCEPTANCE
1. Install/launch 0.2.0, import a HTTPS subscription copied from Telegram, select a profile.
2. Import both an AWG client .conf and its vpn:// export. Confirm equal server/parameters.
3. Connect; test a website, expected external IP, DNS and IPv6 behavior according to .conf.
4. Switch AWG -> VLESS -> AWG, disconnect and verify the normal connection returns.
5. Close Link; confirm no LinkAWG-* service, Wintun adapter or active routes remain.
6. Repeat with forcibly closed UI to validate the owner-exit watchdog.
7. Never include subscription URLs, private keys or full config in public bug reports.
8. With a later signed release, verify background download, explicit update, VPN stop,
   in-place replacement/restart and unchanged profiles. Reject tampered feeds/packages.

PACKAGES
dist/releases/Link-0.2.0-Windows-x64-Setup.exe
dist/releases/Link-0.2.0-Windows-x64-Portable.zip
Packages are unsigned beta builds. Existing user profiles remain in the DPAPI vault.
